Merge pull request #16599 from miodvallat/backport-16589-to-auth-5.0.x

auth 5.0: backport "allow finer-grained rrset changes through the API"

Merge pull request #16603 from miodvallat/backport-16538-to-auth-5.0.x

auth 5.0: backport "m4/pdns_check_libcrypto: fix ecdsa/eddsa includedir"

m4/pdns_check_libcrypto: fix ecdsa/eddsa includedir

On more excotic Linux distributions, like NixOS, the directory in which
the libraries are stored and the directory of the headers is different.
This uses pkg-config to find the right includedir of the headers.

Signed-off-by: famfo <famfo@famfo.xyz>
(cherry picked from commit 48578f782de8d6c840fa41b8e1eed2a12ed7c1c4)

Add a backport of #16602 to let tests pass.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Clang-tidy wants an initializer here.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Add latest version of assert_in_json_error for the new tests to pass.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

No more reasons to reject more than one EXTEND or PRUNE anymore.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>
(cherry picked from commit 64252645422fd2876d10ac318b3ae7ffea0a875a)

Allow PRUNE/EXTEND to coexist with DELETE/REPLACE.

This causes us to maintain a local cache of the rrsets being modified by
both sets of operations, so that we keep a consistent view of them during
the backend transaction, regardless of what the backend might be able to
return.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>
(cherry picked from commit 923b4b708af111fed424bb5a68e01d126be64174)

Spelling fixes from review

Co-authored-by: Josh Soref <2119212+jsoref@users.noreply.github.com>
Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>
(cherry picked from commit d2415df70682764dd736c5215953b208536effb8)

Logic buglet found during review.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>
(cherry picked from commit e13f3db78c7acaa2cf87fa2beeaef6965c7251fa)

Allow for multiple extend/prune in the same request as long as different RRsets.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>
(cherry picked from commit 9017ef0b5b71214202181662af6b2822d792b8ef)

Tests for EXTEND and PRUNE zone patch operations.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>
(cherry picked from commit ab0a34201d1fca47514556e026195d07432803ed)

New API zone patch feature: individual record add/delete (not rrset).

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>
(cherry picked from commit acd2c6b5421e927e96ab55eb68bf7a4bf082056b)

Split patchZone() in smaller bits.

This is preparation work for future changes which would likely to trigger
the "excessive cognitive complexity" diagnostic from clang-tidy, so cut
ahead.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>
(cherry picked from commit a8e57021e4a69164445acad7b56862a7c04b5788)

Rework patchZone() signature and split it in multiple pieces. NFC

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>
(cherry picked from commit 67161693f5896ff581df6684bda1e61758e78be1)

Merge pull request #16566 from miodvallat/backport-16564-to-auth-5.0.x

auth 5.0: backport "add missing catch block for STL exceptions in createForward"

Add missing catch block for STL exceptions in createForward.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>
(cherry picked from commit f3d9786ec28a797bb479a7834777f19b55785183)

Merge pull request #16533 from romeroalx/trim-build-test-all-auth50

auth-5.0.x - actions: Clean up unused workflows and disable non-auth jobs

Merge pull request #16532 from miodvallat/backport-16059-to-auth-5.0.x

auth 5.0: backport "REST API: bring back 404 errors"

Prevent the /* OPTIONS handler to turn every 404 error into 405.

Fixes: #14572
Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>
(cherry picked from commit 8d6161dbd93d932b55f7e5232f93c389d78d8206)

auth-5.0 actions: Remove non-required workflows. Disable non-auth jobs

Merge pull request #16512 from miodvallat/backport-15894-to-auth-5.0.x

auth 5.0: backport "Give backends the ability to perform extra actions during zone rectify".

Give backends the ability to perform extra actions during zone rectify.

Use this is the LMDB backend to purge possibly orphaned (dangling) NSEC3
records created by 4.x servers.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>
(cherry picked from commit be43b2e70193b13c01a268381b654dce8b6cc7ec)

Merge pull request #16513 from romeroalx/backport-16409-auth-5.0.x

auth-5.0.x - backport: auth-backend tests: make more diskspace on the github runner

auth-backend tests: make more diskspace on the github runner

Merge pull request #16486 from Habbie/backport-16401-to-auth-5.0.x

auth-5.x meson build: restore original binary names

Merge pull request #16466 from Habbie/backport-16398-to-auth-5.0.x

auth-5.0.x sdist: copy files as files, not as new dirs

auth sdist: copy files as files, not as new dirs

Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>
(cherry picked from commit 2f0422387539772b03dc9b9f202617ffa25791a4)

auth meson build: restore original binary names

(cherry picked from commit 13be29806ccf4bb5e79f8e02a58ba981f38bd266)

Merge pull request #16412 from rgacogne/auth50-backport-16217

auth-5.0.x: Backport 16217 - Add package urls to our SBOMs

dnsdist: Add package urls to our SBOMs

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>
(cherry picked from commit 0da0d23db6c38a72ecb8dae0317fc5aa12ef4d25)

Merge pull request #16391 from romeroalx/backport-15267-auth-5.0.x

Auth 5.0.x - backport 15267 - Upload packages to additional repository

gh actions build-packages: avoid duplicates download-artifacts action. Fix publications

gh actions: upload packages to an additional repository

Merge pull request #16360 from miodvallat/backport-16352-to-auth-5.0.x

auth 5.0: backport "api: relax zone name check in view removal "

Merge pull request #16359 from miodvallat/backport-16287-to-auth-5.0.x

auth 5.0: backport "Prevent a potential race condition in cache cleaning"

Merge pull request #16358 from miodvallat/backport-16259-to-auth-5.0.x

auth 5.0: backport "auth and rec: Allow selecting a specific version of Lua with meson"

Merge pull request #16357 from miodvallat/backport-16253-to-auth-5.0.x

auth 5.0: backport "sdist: include additional files/dirs"

Merge pull request #16356 from miodvallat/backport-16209-to-auth-5.0.x

auth 5.0: backport "pdnsutil: fix b2b-migrate to from sql to non-sql"

Merge pull request #16355 from miodvallat/backport-16193-to-auth-5.0.x

auth 5.0: backport " lmdb: optional memory-only freshness check timestamp"

Merge pull request #16354 from miodvallat/backport-16119-to-auth-5.0.x

auth 5.0: backport "LUA shared exec: reset exec limit for every invocation"

Merge pull request #16353 from miodvallat/backport-16112-to-auth-5.0.x

auth 5.0: backport "Fix EDNS Cookie & Proxy protocol"

Merge pull request #16211 from miodvallat/backport-15929-to-auth-5.0.x

auth 5.0.x: backport "grow auth source tarballs fatter"

Merge pull request #16210 from miodvallat/backport-16152-to-auth-5.0.x

auth 5.0: backport "auth views: perform character set validation of view names"

On second thought, relax the zone check for the view add operation too.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>
(cherry picked from commit d6f700a88b9038298ac55023a7eb5bc66a8eb575)

Relax zone checks when removing a zone from a view.

It's ok for the zone to no longer exist at this point.

Fixes: #16351
Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>
(cherry picked from commit a912c5a1623372e87c663c55956bbd3dda652d0f)

Sigh... this triggers clang-tidy

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

authoritative: Prevent a potential race condition in cache cleaning

Clean query cache before cleaning packet cache. Otherwise the following
situation is possible:

* thread A cleans packet cache
* thread B answers a question for the same name that is being cleaned by A
* since there is no packet cache it populates a packet cache entry from the
  query cache (which has not yet been cleaned by thread A
* thread A cleans query cache
* the server will return the old packet cache entry until its TTL expires or
  cache is cleaned again

Switching which cache is cleaned first fixes this race condition.

Signed-off-by: Deyan Doychev <deyan@siteground.com>
(cherry picked from commit fdcc9ab427f8deb73a4b5603ec2cb5233ec8bd78)

auth and rec: Allow selecting a specific version of Lua with meson

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>
(cherry picked from commit 2715604894ca3cbcd23d53584c8adc36a320d408)

auth sdist: include additional files/dirs

Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>
(cherry picked from commit 4e308131ebb42c2005e7edde67a72b5fcb050a4d)

In zone copy, proceed anyway if --force even if target doesn't support comments.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>
(cherry picked from commit 516d38c2037c39fcc1833f49c8aa4e2fe263e12a)

When copying/migrating zones, only complain about comments if there are any.

Fixes: #16201
Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>
(cherry picked from commit dd6e79a5bf56bd80452295ac1f4a8ccbaafdd126)

Be more careful when initializing TransientDomainInfo.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>
(cherry picked from commit b6276dbf3297665b75cf0e4e342ad257a2f0b0e1)

Handle freshness check timestamps similarly to notified serials.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>
(cherry picked from commit dc22b370d4af51e3dede9a50d9677854e7f58fe1)

Invoke Namingway and change a bunch of data structure names. NFCI

This will make them look less awkward in the near future.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>
(cherry picked from commit 416166997339ddc9431d5524328c54830244e36f)

auth LUA shared exec: reset exec limit for every invocation

fixes #16118

(cherry picked from commit 61253c3a0302beffb3bc1040f77eb284acfc3082)

Use getInnerRemote() to fix EDNS Cookie & Proxy protocol

(cherry picked from commit 62d5e22b5a2e3c5271aa935a8b41dcc5c6de9e95)

Merge pull request #16329 from romeroalx/backport-16323-auth-5.0.x

auth-5.0.x: backport 16323 - gh actions: add npm package for swagger test

gh actions: add npm package for swagger test

Merge pull request #16280 from rgacogne/auth-5.0.x-backport-16169

auth-5.0.x: Backport 16169 - build-docker-images-tags: Grant enough permissions to sign images

Merge pull request #16271 from rgacogne/auth-5.0.x-backport-15267

auth-5.0.x: Backport 15267: Fix the build-packages workflow

build-docker-images-tags: Grant enough permissions to sign images

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

auth-5.0.x: Fix the build-packages workflow

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Be sure to add the meson build files to the contents of `make dist'.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>
(cherry picked from commit d99f8cf85b730379783fc09fe1689412acfbce78)

sort EXTRA_DIST

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>
(cherry picked from commit e4a5f74715897454a78ed4488fed40a627efa66a)

This does not try to generate the man pages if they are found in the tarball

Same method as dnsdist and rec

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>
(cherry picked from commit aa22142831bdbe665dced6202d890c6e6aeb72ee)

Perform character set validation of view names.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>
(cherry picked from commit b260728c8517d205636471e42deb3b8ffb7db664)

Merge pull request #16147 from miodvallat/backport-16141-to-auth-5.0.x

auth 5.0: backport "lmdb: optional memory-only notification timestamps"

Reverse polarity

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>
(cherry picked from commit 86d641da024d9a153f8fdc710d38e1bc18f1b7de)

lmdb: allow domain notification timestamps to be kept in memory only.

They will get synchronized on disk only when another DomainInfo field
gets modified.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>
(cherry picked from commit 51d5dbc558e36f3bb6d487c5c46737e58e2f4b19)

Factor code responsible for filling DomainInfo. NFC yet.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>
(cherry picked from commit 7c5d7af8ba785c99021a78b229f89ea6ad652170)

Merge pull request #16143 from miodvallat/backport-15991-to-auth-5.0.x

auth-5.0: backport "Fix Boost system lib dependency: it is no longer available since 1.89"

Fix Boost system lib dependency: it is no longer available since 1.89

To do that, partly sync with upstream boost.m4

Should fix #15972

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>
(cherry picked from commit e096f48218dd2ea82fc907ff62e4cbced121ca8b)

Merge pull request #15948 from miodvallat/random-bakery

auth: random edns cookies

Merge pull request #14927 from Cybertinus/patch-1

Update pdnsutil.bash_completion.d

Merge pull request #15949 from omoerbeek/rec-tidy-20250709

rec: assorted tidy

Typo in comment

Merge pull request #15950 from omoerbeek/rec-reorder-cacheentry

rec: reorder fields of record cache entry by size (saves 8 bytes per entry on 64-bit systems)

Typo in comment

Co-authored-by: Doug Freed <dwfreed@mtu.edu>
Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Process review comments from Miod

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Allow edns-cookie-secret to be set to "random".

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

rec: asssorted tidy

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

rec: reorder fields of record cache entry by size (saves 8 bytes per entry on 64-bit systems)

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #15928 from miodvallat/slebalwar

Make keyUnconv a bit less inefficient

Merge pull request #15603 from zeha/svcb-generic

SVCB: allow parsing keys in generic format without value

SVCB: allow parsing generic key without value

Merge pull request #15881 from rgacogne/ddist-opcode-mnemonic

dnsdist: Support mnemonics for the Opcode selector

Merge pull request #15938 from omoerbeek/rec-pregen-librs

rec: put lib.rs into tarball

Merge pull request #15936 from omoerbeek/prep-5.1.7-5.2.5

rec: Prep for 5.1.7 and 5.2.5

Merge pull request #15937 from rgacogne/ddist-no-rust-quiche-ci-least

ci: Don't install Rust or Quiche when testing DNSdist 'least'

rec: put lib.rs into tarball

Plus some rearrangement is more like the dnsdist one

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Prep for 5.1.7 and 5.2.5

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

dns: Get rid of the ugly special case for OpCode 3

As suggested by Miod.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Support mnemonics for the Opcode selector

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #15904 from rgacogne/ddist-fix-systemd-unit-meson

dnsdist: Fix systemd template unit and restricted network families when building with meson

Merge pull request #15923 from rgacogne/ddist-add-test-netmask-exclusion

dnsdist: Test netmask exclusions via YAML

Merge pull request #15919 from rgacogne/ddist-upgrade-quiche

dnsdist: Upgrade Cloudflare's Quiche to 0.24.4

Merge pull request #15914 from rgacogne/ddist-fix-quickstart-qps

dnsdist: Fix invalid "qps" in Quickstart Guide

Merge pull request #15915 from omoerbeek/rust-build-env

rec and dnsdist: properly set up env vars for rust build

ci: Don't install Rust or Quiche when testing DNSdist 'least'

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>