diff -I '\$Id: ' -u -r -b -w -p -d --exclude-from=/home/rstory/.rcfiles/diff-ignore --new-file clean/ncftp-3.2.3/Strn/syshdrs.h ncftp-3.2.3/Strn/syshdrs.h
--- clean/ncftp-3.2.3/Strn/syshdrs.h	2008-07-13 22:14:17.000000000 -0400
+++ ncftp-3.2.3/Strn/syshdrs.h	2009-10-20 22:33:02.000000000 -0400
@@ -63,4 +63,8 @@
 extern char *strdup(const char *const src);
 #endif
 
+#ifdef DNSSEC_LOCAL_VALIDATION
+#include <validator/validator.h>
+#endif
+
 /* eof */
diff -I '\$Id: ' -u -r -b -w -p -d --exclude-from=/home/rstory/.rcfiles/diff-ignore --new-file clean/ncftp-3.2.3/configure.in ncftp-3.2.3/configure.in
--- clean/ncftp-3.2.3/configure.in	2009-07-28 11:01:25.000000000 -0400
+++ ncftp-3.2.3/configure.in	2009-10-20 22:33:02.000000000 -0400
@@ -86,6 +86,33 @@ dnl if test "$nc_cv_readline" = yes ; th
 dnl 	wi_LIB_READLINE
 dnl fi
 
+dnl
+dnl DNSSEC
+dnl
+# Check whether user wants DNSSEC local validation support
+AC_ARG_WITH(dnssec-local-validation,
+        [  --with-dnssec-local-validation Enable local DNSSEC validation using libval (no)], want_dnssec=$withval, want_dnssec=no)
+if ! test "x-$want_dnssec" = "x-no" ; then
+    AC_CHECK_HEADERS(validator/validator.h)
+    if test "$ac_cv_header_validator_validator_h" != yes; then
+        AC_MSG_ERROR(Can't find validator.h)
+    fi
+    AC_CHECK_LIB(ssl, SHA1_Init,,AC_MSG_ERROR([Can't find SSL library]))
+    AC_CHECK_LIB(sres, query_send,,AC_MSG_ERROR([Can't find libsres]))
+    AC_CHECK_LIB(val, p_val_status,
+                 LIBS="$LIBS -lval"
+                 have_val_res_query=yes,
+                 [ AC_CHECK_LIB(pthread, pthread_rwlock_init)
+		   AC_CHECK_LIB(val-threads, p_val_status,
+                   have_val_res_query=yes
+                   LIBS="-lval-threads $LIBS"
+                   LIBVAL_SUFFIX="-threads",
+                   AC_MSG_ERROR(Can't find libval or libval-threads))
+                 ])
+    AC_DEFINE(DNSSEC_LOCAL_VALIDATION, 1,
+              [Define if you want local DNSSEC validation support])
+fi
+
 
 
 dnl ---------------------------------------------------------------------------
diff -I '\$Id: ' -u -r -b -w -p -d --exclude-from=/home/rstory/.rcfiles/diff-ignore --new-file clean/ncftp-3.2.3/libncftp/ftp.c ncftp-3.2.3/libncftp/ftp.c
--- clean/ncftp-3.2.3/libncftp/ftp.c	2008-10-05 16:02:20.000000000 -0400
+++ ncftp-3.2.3/libncftp/ftp.c	2009-10-20 22:33:02.000000000 -0400
@@ -146,7 +146,7 @@ OpenControlConnection(const FTPCIPtr cip
 	volatile int sock2fd = -1;
 	ResponsePtr rp = NULL;
 	char **volatile curaddr;
-	int hpok;
+	int hpok, hprc;
 	struct hostent hp;
 	char *volatile fhost;
 	unsigned int fport;
@@ -186,11 +186,19 @@ OpenControlConnection(const FTPCIPtr cip
 
 	cip->servCtlAddr.sin_port = (unsigned short) fport;
 
-	if (GetHostEntry(&hp, fhost, &ip_address, cip->buf, cip->bufSize) != 0) {
+	hprc = GetHostEntry(&hp, fhost, &ip_address, cip->buf, cip->bufSize);
+	if (hprc != 0) {
 		hpok = 0;
 		/* Okay, no Host entry, but maybe we have a numeric address
 		 * in ip_address we can try.
 		 */
+#ifdef DNSSEC_LOCAL_VALIDATION
+		if (hprc == -2) {
+			FTPLogError(cip, kDontPerror, "%s: untrusted DNS response.\n", fhost);
+			cip->errNo = kErrHostUnknown;
+			return (kErrHostUnknown);
+		}
+#endif
 		if (ip_address.s_addr == INADDR_NONE) {
 			FTPLogError(cip, kDontPerror, "%s: unknown host.\n", fhost);
 			cip->errNo = kErrHostUnknown;
diff -I '\$Id: ' -u -r -b -w -p -d --exclude-from=/home/rstory/.rcfiles/diff-ignore --new-file clean/ncftp-3.2.3/libncftp/syshdrs.h ncftp-3.2.3/libncftp/syshdrs.h
--- clean/ncftp-3.2.3/libncftp/syshdrs.h	2008-09-04 20:13:11.000000000 -0400
+++ ncftp-3.2.3/libncftp/syshdrs.h	2009-10-20 22:33:02.000000000 -0400
@@ -347,4 +347,8 @@ extern ssize_t nsendmsg(int, const struc
 #include "util.h"
 #include "ftp.h"
 
+#ifdef DNSSEC_LOCAL_VALIDATION
+#include <validator/validator.h>
+#endif
+
 /* eof */
diff -I '\$Id: ' -u -r -b -w -p -d --exclude-from=/home/rstory/.rcfiles/diff-ignore --new-file clean/ncftp-3.2.3/ncftp/cmds.c ncftp-3.2.3/ncftp/cmds.c
--- clean/ncftp-3.2.3/ncftp/cmds.c	2008-10-05 16:53:13.000000000 -0400
+++ ncftp-3.2.3/ncftp/cmds.c	2009-10-22 22:13:43.000000000 -0400
@@ -2244,7 +2244,7 @@ LookupCmd(const int argc, char **const a
 	const char *host;
 	char **cpp;
 	struct in_addr ip_address;
-	int shortMode, optrc;
+	int shortMode, optrc, dnsrc;
 	char ipStr[16];
 	GetoptInfo opt;
 
@@ -2267,11 +2267,17 @@ LookupCmd(const int argc, char **const a
 
 	for (i=opt.ind; i<argc; i++) {
 		hpok = 0;
-		if (GetHostEntry(&hp, (host = argv[i]), &ip_address, gConn.buf, gConn.bufSize) == 0)
+		dnsrc = GetHostEntry(&hp, (host = argv[i]), &ip_address, gConn.buf, gConn.bufSize);
+		if (dnsrc == 0)
 			hpok = 1;
 		if ((i > opt.ind) && (shortMode == 0))
 			Trace(-1, "\n");
 		if (hpok == 0) {
+#ifndef DNSSEC_LOCAL_VALIDATION
+                        if (dnsrc == -2)
+			    Trace(-1, "DNS response for site %s is untrused.\n", host);
+			else
+#endif
 			Trace(-1, "Unable to get information about site %s.\n", host);
 		} else if (shortMode) {
 			MyInetAddr(ipStr, sizeof(ipStr), hp.h_addr_list, 0);
@@ -2542,6 +2548,7 @@ DoOpen(void)
 	if (gConn.firewallType == kFirewallNotInUse) {
 		(void) STRNCPY(ohost, gConn.host);
 		OpenMsg("Resolving %s...", ohost);
+#ifndef DNSSEC_LOCAL_VALIDATION
 		if ((gLoadedBm != 0) && (gBm.lastIP[0] != '\0')) {
 			result = MyGetHostByName(ipstr, sizeof(ipstr), ohost, 3);
 			if (result < 0) {
@@ -2558,6 +2565,21 @@ DoOpen(void)
 			(void) printf("Unknown host \"%s\".\n", ohost);
 			return (-1);
 		}
+#else
+                result = MyGetHostByName(ipstr, sizeof(ipstr), ohost, 15);
+		if (result < 0) {
+			(void) printf("\n");
+                        /*
+                         * It would be nice to print a little more information,
+                         * but that would mean an API change to MyGetHostByName.
+                         */
+			(void) printf("%s host \"%s\".\n",
+                                      (result == -2) ?
+                                      "Untrusted DNS response for" : "Unknown",
+                                      ohost);
+                        return (-1);
+                }
+#endif
 		(void) STRNCPY(gConn.host, ipstr);
 		OpenMsg("Connecting to %s...", ipstr);
 	} else {
diff -I '\$Id: ' -u -r -b -w -p -d --exclude-from=/home/rstory/.rcfiles/diff-ignore --new-file clean/ncftp-3.2.3/ncftp/syshdrs.h ncftp-3.2.3/ncftp/syshdrs.h
--- clean/ncftp-3.2.3/ncftp/syshdrs.h	2008-09-04 20:14:32.000000000 -0400
+++ ncftp-3.2.3/ncftp/syshdrs.h	2009-10-20 22:33:02.000000000 -0400
@@ -291,3 +291,8 @@
 #include <Strn.h>			/* Library header. */
 #include <sio.h>			/* Library header. */
 #include <ncftp.h>			/* Library header. */
+
+#ifdef DNSSEC_LOCAL_VALIDATION
+#include <validator/validator.h>
+#endif
+
diff -I '\$Id: ' -u -r -b -w -p -d --exclude-from=/home/rstory/.rcfiles/diff-ignore --new-file clean/ncftp-3.2.3/ncftp/util.c ncftp-3.2.3/ncftp/util.c
--- clean/ncftp-3.2.3/ncftp/util.c	2008-07-08 18:04:24.000000000 -0400
+++ ncftp-3.2.3/ncftp/util.c	2009-10-22 22:14:00.000000000 -0400
@@ -690,6 +690,9 @@ MyGetHostByName(char *const volatile dst
 #ifdef HAVE_INET_ATON
 	struct in_addr ina;
 #endif
+#ifdef DNSSEC_LOCAL_VALIDATION
+        val_status_t val_status;
+#endif
 
 #ifdef HAVE_INET_ATON
 	if (inet_aton(hn, &ina) != 0) {
@@ -728,12 +731,26 @@ MyGetHostByName(char *const volatile dst
 		osigalrm = NcSignal(SIGALRM, CancelGetHostByName);
 		if (t > 0)
 			(void) alarm((unsigned int) t);
+#ifndef DNSSEC_LOCAL_VALIDATION
 		hp = gethostbyname(hn);
+#else
+                hp = val_gethostbyname(NULL, hn, &val_status);
+#endif
 		if (t > 0)
 			(void) alarm(0);
 		(void) NcSignal(SIGPIPE, osigpipe);
 		(void) NcSignal(SIGINT, osigint);
 		(void) NcSignal(SIGALRM, osigalrm);
+#ifdef DNSSEC_LOCAL_VALIDATION
+                /*
+                 * It would be nice to pass a little more information back,
+                 * but that would mean an API change to MyGetHostByName.
+                 */
+                if ((hp != NULL) && ! val_istrusted(val_status)) {
+                    *dst = '\0';
+                    return (-2);
+                }
+#endif
 		if (hp != NULL) {
 			InetNtoA(dst, ((struct in_addr **) hp->h_addr_list)[0], dsize);
 			return (0);
diff -I '\$Id: ' -u -r -b -w -p -d --exclude-from=/home/rstory/.rcfiles/diff-ignore --new-file clean/ncftp-3.2.3/sh_util/syshdrs.h ncftp-3.2.3/sh_util/syshdrs.h
--- clean/ncftp-3.2.3/sh_util/syshdrs.h	2008-09-04 20:14:38.000000000 -0400
+++ ncftp-3.2.3/sh_util/syshdrs.h	2009-10-20 22:33:02.000000000 -0400
@@ -280,3 +280,8 @@
 #include <Strn.h>			/* Library header. */
 #include <sio.h>			/* Library header. */
 #include <ncftp.h>			/* Library header. */
+
+#ifdef DNSSEC_LOCAL_VALIDATION
+#include <validator/validator.h>
+#endif
+
diff -I '\$Id: ' -u -r -b -w -p -d --exclude-from=/home/rstory/.rcfiles/diff-ignore --new-file clean/ncftp-3.2.3/sio/DNSUtil.c ncftp-3.2.3/sio/DNSUtil.c
--- clean/ncftp-3.2.3/sio/DNSUtil.c	2008-07-13 20:25:54.000000000 -0400
+++ ncftp-3.2.3/sio/DNSUtil.c	2009-10-20 22:33:02.000000000 -0400
@@ -26,7 +26,31 @@ extern int getdomainname(char *name, get
 int
 GetHostByName(struct hostent *const hp, const char *const name, char *const hpbuf, size_t hpbufsize)
 {
-#if defined(HAVE_GETHOSTBYNAME_R) && (defined(SOLARIS) || defined(IRIX) || defined(BSDOS))
+#if defined(DNSSEC_LOCAL_VALIDATION)
+	char *usehpbuf;
+	struct hostent *h;
+	int my_h_errno, rc;
+        val_status_t val_status;
+
+	usehpbuf = hpbuf;
+	forever {
+		errno = 0;
+		my_h_errno = 0;
+		h = NULL;
+		memset(usehpbuf, 0, hpbufsize);
+		rc = val_gethostbyname2_r(NULL, name, AF_INET, hp, usehpbuf,
+                                          hpbufsize, &h, &my_h_errno,
+                                          &val_status);
+		if ((rc == 0) && (h != NULL)) {
+                    if (!val_istrusted(val_status))
+			return (-2);
+                    return (0);
+                }
+		if ((rc == 0) && (my_h_errno != 0))
+			errno = ENOENT;
+		break;
+	}
+#elif defined(HAVE_GETHOSTBYNAME_R) && (defined(SOLARIS) || defined(IRIX) || defined(BSDOS))
 	struct hostent *h;
 	int h_errno_unused = 0;
 	memset(hpbuf, 0, hpbufsize);
@@ -114,7 +138,21 @@ GetHostByName(struct hostent *const hp, 
 int
 GetHostByAddr(struct hostent *const hp, void *addr, int asize, int atype, char *const hpbuf, size_t hpbufsize)
 {
-#if defined(HAVE_GETHOSTBYADDR_R) && (defined(SOLARIS) || defined(IRIX) || defined(BSDOS))
+#if defined(DNSSEC_LOCAL_VALIDATION)
+	struct hostent *h;
+	int h_errno_unused = 0, rc;
+	val_status_t val_status;
+
+	memset(hpbuf, 0, hpbufsize);
+	rc = val_gethostbyaddr_r(NULL, addr, asize, atype,
+                                 hp, hpbuf, hpbufsize, &h, &h_errno_unused,
+                                 &val_status);
+	if ((rc == 0) && (h != NULL)) {
+		if (!val_istrusted(val_status))
+			return (-2);
+		return (0);
+	}
+#elif defined(HAVE_GETHOSTBYADDR_R) && (defined(SOLARIS) || defined(IRIX) || defined(BSDOS))
 	struct hostent *h;
 	int h_errno_unused = 0;
 	memset(hpbuf, 0, hpbufsize);
@@ -182,7 +220,7 @@ int
 GetHostEntry(struct hostent *const hp, const char *const host, struct in_addr *const ip_address, char *const hpbuf, size_t hpbufsize)
 {
 	struct in_addr ip;
-	int rc = -1;
+	int rc;
 	
 	/* See if the host was given in the dotted IP format, like "36.44.0.2."
 	 * If it was, inet_addr will convert that to a 32-bit binary value;
@@ -190,7 +228,8 @@ GetHostEntry(struct hostent *const hp, c
 	 */
 	ip.s_addr = inet_addr(host);
 	if (ip.s_addr != INADDR_NONE) {
-		if (GetHostByAddr(hp, (char *) &ip, (int) sizeof(ip), AF_INET, hpbuf, hpbufsize) == 0) {
+		rc = GetHostByAddr(hp, (char *) &ip, (int) sizeof(ip), AF_INET, hpbuf, hpbufsize);
+		if (rc == 0) {
 			rc = 0;
 			if (ip_address != NULL)
 				(void) memcpy(&ip_address->s_addr, hp->h_addr_list[0], (size_t) hp->h_length);
@@ -201,12 +240,19 @@ GetHostEntry(struct hostent *const hp, c
 		/* No IP address, so it must be a hostname, like ftp.wustl.edu. */
 		if (ip_address != NULL)
 			ip_address->s_addr = INADDR_NONE;
-		if (GetHostByName(hp, host, hpbuf, hpbufsize) == 0) {
-			rc = 0;
+		rc = GetHostByName(hp, host, hpbuf, hpbufsize);
+		if (rc == 0) {
 			if (ip_address != NULL)
 				(void) memcpy(&ip_address->s_addr, hp->h_addr_list[0], (size_t) hp->h_length);
 		}
 	}
+#if defined(DNSSEC_LOCAL_VALIDATION)
+	if ((rc < 0) && (rc != -2))
+		rc = -1;
+#else
+	if ((rc < 0) && (rc != -1))
+		rc = -1;
+#endif
 	return (rc);
 }	/* GetHostEntry */
 
diff -I '\$Id: ' -u -r -b -w -p -d --exclude-from=/home/rstory/.rcfiles/diff-ignore --new-file clean/ncftp-3.2.3/sio/StrAddr.c ncftp-3.2.3/sio/StrAddr.c
--- clean/ncftp-3.2.3/sio/StrAddr.c	2008-07-13 20:26:01.000000000 -0400
+++ ncftp-3.2.3/sio/StrAddr.c	2009-10-20 22:33:02.000000000 -0400
@@ -268,8 +268,16 @@ AddrStrToAddr(const char * const s, stru
 		sa->sin_family = AF_INET;
 		sa->sin_addr.s_addr = ipnum;
 	} else {
+#ifdef DNSSEC_LOCAL_VALIDATION
+		val_status_t val_status;
+		errno = 0;
+		hp = val_gethostbyname(NULL,hostcp,&val_status);
+		if ((hp != NULL) && (!val_istrusted(val_status)))
+			hp = NULL;
+#else
 		errno = 0;
 		hp = gethostbyname(hostcp);
+#endif
 		if (hp == NULL) {
 			if (errno == 0)
 				errno = ENOENT;
@@ -305,7 +313,14 @@ AddrToAddrStr(char *const dst, size_t ds
 		InetNtoA(addrName, &saddrp->sin_addr, sizeof(addrName));
 		addrNamePtr = addrName;
 	} else {
+#ifdef DNSSEC_LOCAL_VALIDATION
+		val_status_t val_status;
+		hp = val_gethostbyaddr(NULL, (const char*)&saddrp->sin_addr, sizeof(struct in_addr), AF_INET, &val_status);
+		if ((hp != NULL) && (!val_istrusted(val_status)))
+			hp = NULL;
+#else
 		hp = gethostbyaddr((gethost_addrptr_t) &saddrp->sin_addr, sizeof(struct in_addr), AF_INET);
+#endif
 		if ((hp != NULL) && (hp->h_name != NULL) && (hp->h_name[0] != '\0')) {
 			addrNamePtr = hp->h_name;
 		} else {
diff -I '\$Id: ' -u -r -b -w -p -d --exclude-from=/home/rstory/.rcfiles/diff-ignore --new-file clean/ncftp-3.2.3/sio/sio.version ncftp-3.2.3/sio/sio.version
--- clean/ncftp-3.2.3/sio/sio.version	1969-12-31 19:00:00.000000000 -0500
+++ ncftp-3.2.3/sio/sio.version	2009-10-21 10:43:49.000000000 -0400
@@ -0,0 +1 @@
+6.2.1
diff -I '\$Id: ' -u -r -b -w -p -d --exclude-from=/home/rstory/.rcfiles/diff-ignore --new-file clean/ncftp-3.2.3/sio/syshdrs.h ncftp-3.2.3/sio/syshdrs.h
--- clean/ncftp-3.2.3/sio/syshdrs.h	2008-07-13 22:13:40.000000000 -0400
+++ ncftp-3.2.3/sio/syshdrs.h	2009-10-20 22:33:02.000000000 -0400
@@ -215,4 +215,8 @@ extern ssize_t nsendmsg(int, const struc
 #	endif
 #endif	/* SOCKS */
 
+#ifdef DNSSEC_LOCAL_VALIDATION
+#include <validator/validator.h>
+#endif
+
 /* eof */
diff -I '\$Id: ' -u -r -b -w -p -d --exclude-from=/home/rstory/.rcfiles/diff-ignore --new-file clean/ncftp-3.2.3/vis/syshdrs.h ncftp-3.2.3/vis/syshdrs.h
--- clean/ncftp-3.2.3/vis/syshdrs.h	2008-09-04 20:14:44.000000000 -0400
+++ ncftp-3.2.3/vis/syshdrs.h	2009-10-20 22:33:02.000000000 -0400
@@ -340,3 +340,8 @@
 #include <Strn.h>			/* Library header. */
 #include <sio.h>			/* Because ../ncftp/util.c needs it. */
 #include <ncftp.h>			/* Mostly for utility routines it has. */
+
+#ifdef DNSSEC_LOCAL_VALIDATION
+#include <validator/validator.h>
+#endif
+
