starred/hickory-dns

Fork 0

mirror of https://github.com/hickory-dns/hickory-dns.git synced 2026-04-24 18:55:55 +03:00

[GH-ISSUE #907] Drop all usage of OpenSSL in primary code paths (tests and key generation is ok) #560

New issue

Open

opened 2026-03-15 23:09:01 +03:00 by kerem · 7 comments

kerem commented

2026-03-15 23:09:01 +03:00

Owner

Originally created by @bluejekyll on GitHub (Nov 3, 2019).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/907

This is a proposal to move away from using OpenSSL in the trust-dns crates, and instead solely rely on *ring*. This requires supporting all cases where OpenSSL is used that currently doesn't have *ring* bindings, like in DNSSEC.

If this library were started today, only *ring* would be in use, but given the fact that it has always had OpenSSL support, this issue is to track discussion of removing it.

Originally created by @bluejekyll on GitHub (Nov 3, 2019). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/907 This is a proposal to move away from using OpenSSL in the trust-dns crates, and instead solely rely on \*ring\*. This requires supporting all cases where OpenSSL is used that currently doesn't have \*ring\* bindings, like in DNSSEC. If this library were started today, only \*ring\* would be in use, but given the fact that it has always had OpenSSL support, this issue is to track discussion of removing it.

kerem added the

labels

2026-03-15 23:09:01 +03:00

kerem commented

2026-03-15 23:09:12 +03:00

Author

Owner

@Darkspirit commented on GitHub (Nov 3, 2019):

Depends on briansmith/ring#870 for DNSSEC verification.

@Darkspirit commented on GitHub (Nov 3, 2019): Depends on briansmith/ring#870 for DNSSEC verification.

kerem commented

2026-03-15 23:09:17 +03:00

Author

Owner

@bluejekyll commented on GitHub (Nov 3, 2019):

For some reason I thought that landed with the _FOR_LEGACY_USE_ONLY, but I guess I misunderstood some of the emails I saw fly by.

@bluejekyll commented on GitHub (Nov 3, 2019): For some reason I thought that landed with the `_FOR_LEGACY_USE_ONLY`, but I guess I misunderstood some of the emails I saw fly by.

kerem commented

2026-03-15 23:09:22 +03:00

Author

Owner

@briansmith commented on GitHub (Apr 29, 2020):

Depends on briansmith/ring#870 for DNSSEC verification.

ring 0.16.13 was just released with that implemented.

@briansmith commented on GitHub (Apr 29, 2020): > Depends on [briansmith/ring#870](https://github.com/briansmith/ring/issues/870) for DNSSEC verification. *ring* 0.16.13 was just released with that implemented.

kerem commented

2026-03-15 23:09:27 +03:00

Author

Owner

@briansmith commented on GitHub (Apr 29, 2020):

I think resolving #180 would be a big step towards this.

@briansmith commented on GitHub (Apr 29, 2020): I think resolving #180 would be a big step towards this.

kerem commented

2026-03-15 23:09:32 +03:00

Author

Owner

@kmod-midori commented on GitHub (Dec 29, 2021):

Ring and Rustls are great libraries, but given that ring does not support anything except x86, x86_64, arm, arm64, and wasm, dropping support for native cryptography solutions can make this library unusable for many that develop for older or less popular architectures (such as MIPS routers, ring is working on MIPS support, but it is not working right now).

@kmod-midori commented on GitHub (Dec 29, 2021): Ring and Rustls are great libraries, but given that ring does not support anything except x86, x86_64, arm, arm64, and wasm, dropping support for native cryptography solutions can make this library unusable for many that develop for older or less popular architectures (such as MIPS routers, ring is working on MIPS support, but it is not working right now).

kerem commented

2026-03-15 23:09:37 +03:00

Author

Owner

@briansmith commented on GitHub (Oct 16, 2023):

@bluejekyll Does this issue still make sense the way it is phrased? Does anybody have a good summary of what, if anything, especially outside of test-only code, depends on OpenSSL?

@briansmith commented on GitHub (Oct 16, 2023): @bluejekyll Does this issue still make sense the way it is phrased? Does anybody have a good summary of what, if anything, especially outside of test-only code, depends on OpenSSL?

kerem commented

2026-03-15 23:09:42 +03:00

Author

Owner

@bluejekyll commented on GitHub (Oct 16, 2023):

Do you mean in the wild, how many people are using OpenSSL enabled as a dependent on this project? Or do you mean in the context of the project itself? Today we allow for OpenSSL to be used for DNSSEC operations, that's about it, and DNS over TLS. I think we can remove it, and my suspicion is that for the majority of people out there, this won't matter.

@bluejekyll commented on GitHub (Oct 16, 2023): Do you mean in the wild, how many people are using OpenSSL enabled as a dependent on this project? Or do you mean in the context of the project itself? Today we allow for OpenSSL to be used for DNSSEC operations, that's about it, and DNS over TLS. I think we can remove it, and my suspicion is that for the majority of people out there, this won't matter.

kerem referenced this issue

2026-03-16 02:10:50 +03:00

[PR #566] [MERGED] Delays all connections until actual use. #1519