Need to add support for trust anchor

[ngoyal]

This can be an option specified when building getdns and making sure it is an iOS accessible spot. Default path is not an iOS friendly path.

[marcgweg]

In the show case I made for SIDN Labs, I had a keys resource added to the project. This Plain Text file had the DS record for the root zone (key tag 19036).

With the following code I created a stdC string from the NSString read from the bundle:
NSString keyFile = [[NSBundle mainBundle] pathForResource:@"keys" ofType:@""];
const char keys = [keyFile cStringUsingEncoding:NSASCIIStringEncoding];

The keys file looked like this:
. IN DS 19036 8 2 49AAC11D7B6F6446702E54A1607371607A1A41855200FD2CE1CDDE32F24E8FB5

I used this with libunbound to perform a simple check whether a record was DNSSEC signed.

[ngoyal]

Great info - did you use the ub_ctx_add_ta API? We are currently figuring out the best way to implement this in the core lib - getdnsapi/getdns#14

[marcgweg]

Yes, after the 2 lines of Objective-C follows:
if( (retval=ub_ctx_add_ta_file(ctx, (char *)keys)) != 0) {
printf("error adding keys: %s\n", ub_strerror(retval));
return;
}

/* query for host /
retval = ub_resolve(ctx, (char *)[requestedDomain UTF8String],
1 / TYPE A (IPv4 address) /,
1 / CLASS IN (internet) */, &result);

[marcgweg]

Just take a look at my blog:
http://www1.sidnlabs.nl/laatste-berichten/nieuwsdetail/article/dnssec-validatie-implementeren-op-ios/

It's in Dutch, but hey, you'll get the picture.