Merge pull request #17749 from miodvallat/vector_like_a_pirate

Prefer std::array to std::vector for const values

Merge pull request #17758 from omoerbeek/rec-prep-20260722

rec: prep for 2026-07-22 security release

rec: prep for 2026-07-22 security release

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #17750 from omoerbeek/ddist-fix-compilation

dnsdist: fix compilation on platforms lacking quiche_conn_set_qlog_path()

constexpr'r'us

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Use std::array instead of std::vector for const values whenever possible.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

dnsdist: avoid a few compiler warnings about unused args/vars

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

dnsdist: quiche_conn_set_qlog_path() is not available always

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #17748 from omoerbeek/rec-ghost-refresh

rec: do not attempt to refresh NS records in refresh-almost-expired.

rec: do not attempt to refresh NS records in refresh-almost-expired.

If the auth responds *very* slowly and the records expire in between,
the capping of TTLs is not enforced for lack of data.

This does not happen on regular resolve as then then the child
records are used immediately if not expired and thus valid, or the
records *are* expired, and in that case not used.  So this case can
only happen if almost expired records are used to refresh the
authoritative NS records.

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #17747 from rgacogne/ddist-handle-error-dynamic-rule-suffix-match

dnsdist: Gracefully handle errors in DynBlock's suffix match policy

Merge pull request #17746 from omoerbeek/rec-named-bind-fixes

rec: SO_BINDTODEVICE is not available everywhere

rec: SO_BINDTODEVICE is not available everywhere

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #17740 from rgacogne/ddist-yaml-exceptions

dnsdist: Improve exception handling when parsing our YAML configuration

Merge pull request #17728 from miodvallat/bounce

do not use str{n,}casecmp for DNS names

Extra const

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

ruff

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Add a regression test for PDNSException raised from C++ while parsing a YAML configuration file

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Gracefully handle errors in DynBlock's suffix match policy

There is no need to stop the whole processing if we choked on one entry,
or even could not properly insert one new rule.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Fix formatting in the Rust bridge

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Rebuild the Rust library when the Rust bridge is modified

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Properly handle PDNSException in our Rust library

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

pdnsexception: Stop importing various namespaces

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #17738 from miodvallat/lortnocenoz

auth tests: more scrutinization

Perform more thorough zone contents checks.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

When there is a single rrset, we can perform an equality check.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #17721 from miodvallat/some_enchanted_afternoon

auth: ignore the closing SOA record in IXFR-turned-AXFR

Merge pull request #17722 from miodvallat/swallow

pdnsutil b2b-migrate: also copy zone options and catalog membership

Merge pull request #17729 from pieterlexis/ywh-ixfrdist

fix(ixfrdist): Allow 64K AXFR chunks

fix(ixfrdist): Allow 64K AXFR chunks

This was changed in #8051 for performance (compression) reasons. But
this would limit each AXFR chunk to 16K, so *large* TXT records (over
16K) could not be transferred out by ixfrdist.

This commit uses a 64K limit once when a chunk was truncated twice (once
can happen after any number of records, the second time would mean
truncation on a single record, when the second happens, we error).

Discovered by Haruto Kimura (Stella), thanks!

Merge pull request #17731 from miodvallat/luampire

auth: Lua2 backend: more robust script results parsing

Pay more attention to boost::variant types.

This allows record contents made of digits only to be correctly handled as
strings.

Fixes: #10657
Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Wrap boost::get checks into exception guards.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

clang-tidize

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Move Lua2BackendAPIv2 method bodies from .hh to .cc. NFC

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

dnsdist: Properly deal with exceptions when registering objects from YAML

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

clang-tidize.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Look, ma, no more strncasecmp!

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Replace the use of strncasecmp with pdns_ilexicographical_compare_three_way.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Replace the use of strncasecmp with pdns_ilexicographical_compare_three_way.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #17719 from rgacogne/ddist-fix-drop-response-quic

dnsdist: Fix the dropping of responses for DoQ and DoH3 queries

Explain why we can't have nice things.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Replace the use of str{n,}casecmp with pdns_ilexicographical_compare_three_way.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #17727 from romeroalx/fix-verify-pkg-137

requirements.txt: update version of pinned packages

Move pdns_i*() from misc.hh to dnsname.hh. NFCI

This will avoid future chicken-and-egg problems.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

requirements.txt: update version of pinned packages

Merge pull request #17723 from miodvallat/shaolin_satellite

auth: report remote in "unable to get SOA" messages

Report the remote queried in "Unable to retrieve SOA" messages.

Fixes: #12564
Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Pour some syntactic sugar. NFC

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

dnsdist: Fix awful typo

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #17701 from pieterlexis/dnsdist-spoof-ttl

feat(dnsdist): Allow setting TTL in DNSQuestion:spoof

dnsdist: Document the return values of some process* functions

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #17720 from rgacogne/ddist-add-response-consistency-check-quic

dnsdist: Add the same basic response consistency check for DoQ/DoH3-originated queries

Copy zone options and catalog in pdnsutil b2b-migrate.

Fixes: #12879
Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #17618 from pieterlexis/dnsdist-otlp-remote-logger

dnsdist: Implement OTLP RemoteLogger

feat(dnsdist): Allow setting TTL in DNSQuestion:spoof

Closes: #16470

Merge pull request #17700 from pieterlexis/dnsdist-trace-traceid-in-slog

dnsdist: Log TraceID in structured logs (when available)

Document that pdnsutil zone copy does not copy options and catalog.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Ignore the closing SOA record in IXFR-turned-AXFR.

Fixes: #12984
Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

dnsdist: Add the same basic response consistency check for DoQ/DoH3 queries

This check is only useful when the response has been received from the backend
over UDP, which is currently not supported for DoQ/DoH3 queries, and only to prevent
collisions as we otherwise do not validate the content of the response before forwarding
it to the client, but AI tools keep reporting this as a critical security issue. In any
case it will make sense to have this check once we support using UDP to the backend
for DoQ/DoH3-originated queries.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Fix the dropping of responses for DoQ and DoH queries

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #17716 from miodvallat/overoptimism

auth: stop being an optimist

Merge pull request #17711 from miodvallat/vertbaudet

pdnsutil: more checks in set-catalog

Merge pull request #17708 from omoerbeek/rec-named-interface

rec: allow explicitly named interface for source address

Merge pull request #17706 from miodvallat/qtypemismatch

auth: minor zone parsing tweaks

Merge pull request #17713 from esensar/feature/qlogdir

dnsdist: add qlogdir support for DoH3 and DOQ

Merge pull request #17692 from rgacogne/ddist-always-log-which-configuration-file-was-loaded

dnsdist: Always log which configuration file has been loaded

Pass the packet length to submitResponse() to avoid recomputing it.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Only update network statistics if we could actually send the packets.

Fixes: #15101
Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

dnsdist: use a helper function for qlog configuration

Signed-off-by: Ensar Sarajčić <dev@ensarsarajcic.com>

Update pdns/dnsdistdist/dnsdist-settings-definitions.yml

Co-authored-by: Remi Gacogne <github@coredump.fr>
Signed-off-by: Ensar Sarajčić <dev@ensarsarajcic.com>

Add logging

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Add universal ref ct

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

dnsdist: add qlogdir support for DoH3 and DOQ

Signed-off-by: Ensar Sarajčić <dev@ensarsarajcic.com>

Separate out expected.hh

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Process review comments from @rgacogne

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Check that the catalog zone actually is a catalog zone in set-catalog.

Fixes: #16772
Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #17695 from PowerDNS/dependabot/github_actions/astral-sh/ruff-action-4.1.0

build(deps): bump astral-sh/ruff-action from 4.0.0 to 4.1.0

Apply suggestions from code review

Co-authored-by: Miod Vallat <miod.vallat@powerdns.com>
Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

feat(dnsdist): Log TraceID in maintenance logs

feat(dnsdist): Log TraceID in structured logs

When a traced query generates a log message, log the TraceID as well fo
easier correlation.

Add a poor man's "std:expected" and use it in sendMsgwithOptions

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #17697 from pieterlexis/meson-test-timeouts

chore: Increase testrunner timeouts

Honour upgrade-unknown-types for zone load and zone edit.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Skip record content checks when provided as TYPE### and raw binary data.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #17671 from miodvallat/like,duh

auth, SQL: stricter listSubZones operation

Merge pull request #17666 from miodvallat/statoholic

Better reporting of filesystem errors

Merge pull request #17694 from miodvallat/waketr

Allow NAPTR additional processing to be disabled

Merge pull request #17693 from omoerbeek/rec-protobuf-stalled-config

rec: add handling of new protobuf logging parameter: stalledWriteTimeout

Merge pull request #17702 from pieterlexis/dnsdist-docs-rm-quote

docs(dnsdist): remove quoted lists

docs(dnsdist): remove quoted lists

These lists were accidentally quoted because they had a space prefixed.
This commit also fixes a few other, related rendering issues.

Merge pull request #17699 from PowerDNS/chore-add-pf-to-frontpage

Add platform-filter to frontpage

Add platform-filter to frontpage

feat(dnsdist): Add OTLP-related unit-tests

feat: add `operator==` to all ProtoZero Trace structs

feat(dnsdist): Create protozero-otlp.cc

feat: Add OTLP logger test

feat(dnsdist): More options and config for the OTLP Logger

feat(dnsdist): queue OTLP messages in the logger

Use config value if available

Co-authored-by: Remi Gacogne <github@coredump.fr>
Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>