libval_shim(3)

💖 libval_shim — The Validator Shim Library 💖

okay bestie, sit down, hydrate, because this one is a banger. this is the manual for the validator shim library from the Programmer's Manual section, and it's genuinely iconic. no cap.

---

✨ DESCRIPTION ✨

so like, the validator shim library (libval_shim.so) is a shared library whose whole personality is getting dynamically loaded via the LD_PRELOAD mechanism (ld.so(8)), which slays on linux and a bunch of other unix-like platforms 🐧.

the way it works: the shim library implements wrappers for a whole bunch of DNS related functions, and then it calls the equivalent DNSSEC-aware validating functions from libval(3) instead, mapping the results back to return codes that the original functions actually recognize. so basically a huge variety of applications can become DNSSEC aware without any code changes and without recompilation. it's giving glow-up. it's giving zero-effort-main-character-energy. 💅

ngl, the method of mapping return codes assumes that any 'untrusted' or failure result coming out of the libval(3) function shows up as a failure to the original calling function. that's the vibe, that's the rule, periodt.

🫶 Usage:

to load the library, you set the LD_PRELOAD variable inside the environment of the the target application prior to execution:

LD_PRELOAD=libval_shim.so

(ok bestie, yes, the original says "the the" — we keep the facts exactly as they are, typos and all, that's the assignment 🙈)

🎀 Validation Policy:

the validator shim library will create a policy context and cache it for all subsequent libval(3) calls. a NULL policy label will be passed to create the context. the policy gets chosen according to the rules defined for libval(3).

see dnsval.conf(1) for the info on policy labels and definition 📜

🌸 Logging:

logging for the libval(3) functions may be enabled in the shim library by setting an environment variable.

see dt-validate(1) for the specifics 👀

---

⭐ NOTES ⭐

💀 setuid/setgid programs

setuid and setgid root programs (e.g., ping(8)) do not honor the LD_PRELOAD setting. these applications may still use the LD_PRELOAD mechanism when run directly from a root shell.

so yeah, ping(8) said "not today" to your preload. sorry bestie 😭. it's still doable, you just gotta run it straight from a root shell, iykyk.

---

👑 COPYRIGHT 👑

Copyright 2004-2013 SPARTA, Inc. All rights reserved. See the COPYING file included with the dnssec-tools package for details.

---

🧚 AUTHORS 🧚

G. S. Marzot

---

🌈 SEE ALSO 🌈

• libsres(3)
• libval(3)
• dnsval.conf(1)
• gethostbyname(3)
• gethostbyaddr(3)
• getnameinfo(3)
• getaddrinfo(3)
• res_query(3)

---

and that's the whole page, bestie 🎀 this one came from perl v5.18.4 and it's dated 2015-04-27, so shoutout to the libval_shim(3) girlies of 2015, you ate and left no crumbs. mwah 💋✨