986cee7
diff -up openssh-5.2p1/dns.c.rh205842 openssh-5.2p1/dns.c
986cee7
--- openssh-5.2p1/dns.c.rh205842	2009-07-27 16:25:28.000000000 +0200
986cee7
+++ openssh-5.2p1/dns.c	2009-07-27 16:40:59.000000000 +0200
986cee7
@@ -176,6 +176,7 @@ verify_host_key_dns(const char *hostname
986cee7
 {
986cee7
 	u_int counter;
986cee7
 	int result;
986cee7
+	unsigned int rrset_flags = 0;
986cee7
 	struct rrsetinfo *fingerprints = NULL;
986cee7
 
986cee7
 	u_int8_t hostkey_algorithm;
986cee7
@@ -199,8 +200,19 @@ verify_host_key_dns(const char *hostname
986cee7
 		return -1;
986cee7
 	}
986cee7
 
986cee7
+	/*
986cee7
+	 * Original getrrsetbyname function, found on OpenBSD for example,
986cee7
+	 * doesn't accept any flag and prerequisite for obtaining AD bit in
986cee7
+	 * DNS response is set by "options edns0" in resolv.conf.
986cee7
+	 *
986cee7
+	 * Our version is more clever and use RRSET_FORCE_EDNS0 flag.
986cee7
+	 */
986cee7
+#ifndef HAVE_GETRRSETBYNAME
986cee7
+	rrset_flags |= RRSET_FORCE_EDNS0;
986cee7
+#endif
986cee7
 	result = getrrsetbyname(hostname, DNS_RDATACLASS_IN,
986cee7
-	    DNS_RDATATYPE_SSHFP, 0, &fingerprints);
986cee7
+	    DNS_RDATATYPE_SSHFP, rrset_flags, &fingerprints);
986cee7
+
986cee7
 	if (result) {
986cee7
 		verbose("DNS lookup error: %s", dns_result_totext(result));
986cee7
 		return -1;
986cee7
diff -up openssh-5.2p1/openbsd-compat/getrrsetbyname.c.rh205842 openssh-5.2p1/openbsd-compat/getrrsetbyname.c
986cee7
--- openssh-5.2p1/openbsd-compat/getrrsetbyname.c.rh205842	2009-07-27 16:22:23.000000000 +0200
986cee7
+++ openssh-5.2p1/openbsd-compat/getrrsetbyname.c	2009-07-27 16:41:55.000000000 +0200
986cee7
@@ -209,8 +209,8 @@ getrrsetbyname(const char *hostname, uns
986cee7
 		goto fail;
986cee7
 	}
986cee7
 
986cee7
-	/* don't allow flags yet, unimplemented */
986cee7
-	if (flags) {
986cee7
+	/* Allow RRSET_FORCE_EDNS0 flag only. */
986cee7
+	if ((flags & !RRSET_FORCE_EDNS0) != 0) {
986cee7
 		result = ERRSET_INVAL;
986cee7
 		goto fail;
986cee7
 	}
986cee7
@@ -226,9 +226,9 @@ getrrsetbyname(const char *hostname, uns
986cee7
 #endif /* DEBUG */
986cee7
 
986cee7
 #ifdef RES_USE_DNSSEC
986cee7
-	/* turn on DNSSEC if EDNS0 is configured */
986cee7
-	if (_resp->options & RES_USE_EDNS0)
986cee7
-		_resp->options |= RES_USE_DNSSEC;
986cee7
+	/* turn on DNSSEC if required  */
986cee7
+	if (flags & RRSET_FORCE_EDNS0)
986cee7
+		_resp->options |= (RES_USE_EDNS0|RES_USE_DNSSEC);
986cee7
 #endif /* RES_USE_DNSEC */
986cee7
 
986cee7
 	/* make query */
986cee7
diff -up openssh-5.2p1/openbsd-compat/getrrsetbyname.h.rh205842 openssh-5.2p1/openbsd-compat/getrrsetbyname.h
986cee7
--- openssh-5.2p1/openbsd-compat/getrrsetbyname.h.rh205842	2009-07-27 16:35:02.000000000 +0200
986cee7
+++ openssh-5.2p1/openbsd-compat/getrrsetbyname.h	2009-07-27 16:36:09.000000000 +0200
986cee7
@@ -72,6 +72,9 @@
986cee7
 #ifndef RRSET_VALIDATED
986cee7
 # define RRSET_VALIDATED	1
986cee7
 #endif
986cee7
+#ifndef RRSET_FORCE_EDNS0
986cee7
+# define RRSET_FORCE_EDNS0	0x0001
986cee7
+#endif
986cee7
 
986cee7
 /*
986cee7
  * Return codes for getrrsetbyname()