748232 - add optional dnssec local validation (via dnssec-tools libs)

Status: NEW

(NSPR :: NSPR, defect)

Description

[Robert]

This series of patches adds optional local dnssec validation to NSPR. When enabled, dns requests are handled by the libval library from the DNSSEC-Tools project. Additionally, an API is added for asynchronous handling of DNSSEC requests.

A tiny piece of this patch was previously submitted as Bug 685524.

The first two patches were also previously submitted as Bug 699055 and Bug 743705.

Tested on Linux, Mac OS X, mingw32 (cross-compiled on Linux).

Comment 1

[Robert]

Attachment: fix getaddr detection

Comment 2

[Robert]

Attachment: add nspr log module for dns

Comment 3

[Robert]

Attachment: configure/makefile changes

Comment 4

[Robert]

Attachment: dnssec error codes/text

Comment 5

[Robert]

Attachment: factor out some code into smaller functions (used in next patch)

Comment 6

[Robert]

Attachment: add dnssec to headers

Comment 7

[Robert]

Attachment: add dnssec validation/async api

Comment 8

[Robert]

Attachment: update pr/test/getai for testing dnssec/async

Comment 9

[BugBot [:suhaib / :marco/ :calixte]]

The bug assignee didn't login in Bugzilla in the last 7 months.
:KaiE, could you have a look please?
For more information, please visit auto_nag documentation.

Comment 10

[BugBot [:suhaib / :marco/ :calixte]]

The severity field for this bug is relatively low, S3. However, the bug has 11 votes.
:KaiE, could you consider increasing the bug severity?

For more information, please visit auto_nag documentation.

Comment 11

[BugBot (nomail) [:suhaib / :marco/ :calixte]]

The last needinfo from me was triggered in error by recent activity on the bug. I'm clearing the needinfo since this is a very old bug and I don't know if it's still relevant.

Comment 12

[sophie]

In the recent ICANN Registrations Operation Workshop 30th September 2025, the following data was shared about DNSSEC Validation Rates

• Region / Rate / Increase since 2023
  

• Asia 32% +4%
  

• Oceania 54% +11%
  

• Africa 46% +15%
  

• Americas 37% +4%
  

• Europe 48% +8%
  

DNSSEC is being used, its growing and support is required within the browser, this of course would require a change on DANE support

https://regiops.net/event/14th-registration-operations-workshop-row14-online-event