dnsdist: Fix missed optimizations reported by Coverity in config

This does not really matter because we don't care much about small
performance gains in configuration parsing, but it makes Coverity
happy.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16588 from omoerbeek/janitor-20251203

Kill a handful of clang++ warnings, mostly comparing unsigned to an signed constant

Kill a handful of clang++ warnings, mostly comparing unsigned to an signed constant

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #16585 from romeroalx/build-packages-gh-arm64-runners

GH actions: build packages on Github arm64 runners

build-packages.yml: use GH arm64 runners

builder.yml: use GH arm64 runners

Merge pull request #16582 from rgacogne/ddist-202-changelog-typo

dnsdist: Fix a typo in the 2.0.2 ChangeLog

dnsdist: Fix a typo in the 2.0.2 ChangeLog

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16578 from rgacogne/ddist-2.0.2-secpoll-changelog

dnsdist: ChangeLog and security polling update for 2.0.2

Merge pull request #16487 from pieterlexis/chore-rm-boost-optional

chore: Switch trivial usage of boost::optional to std::optional

Merge pull request #16580 from omoerbeek/rec-move-g_logRPZChanges

rec: move g_logRPZChanges to proper spot

rec: move g_logRPZChanges to proper spot

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

spell-check: Allow new contributors, remove unneeded `ssi`

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: ChangeLog and security polling update for 2.0.2

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16572 from rgacogne/ci-use-cargo-dev-profile

ci: Use `Cargo`'s `dev` profile

Merge pull request #16577 from omoerbeek/rec-docs-upgrade-merge-fix

rec docs: fix GH merge botch

rec docs: fix GH merge botch

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #16553 from omoerbeek/rec-any-to-tcp

rec: always do ANY queries using TCP

Merge pull request #16570 from omoerbeek/rec-rust-unwrap

rec:  rewrite all  unwrap calls in web.rs

Merge pull request #16575 from miodvallat/rm_is_your_best_friend

auth: mention extra steps for manual upgrades

Mention manual cleanup of no-longer-built modules if manual upgrade.

Fixes: #16549
Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

chore(luawrapper): stop linting a false positive

chore: allow "ip" as variable name in clang-tidy

chore(res): appease clang-tidy

chore(dnsdist): appease clang-tidy

chore(rec): update the logger to use std::optional

chore(rec): Replace all trivial boost::optional with std::optional

chore(dnsdist): stop boost::optional to std::optional conversions in generated code

chore(dnsdist): Switch from boost::optional to std::optional

This also updates the DNSTap code to accept a DNSName as `auth` always
and checks its emptyness.

ci: Use `Cargo`'s `dev` profile

Using the `dev` profile means faster builds and more checks.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16393 from TooManyBees/lua-metric-prometheus-types

Recursor: add types and descriptions to dynamic metrics defined in Lua

Reformat

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

rec: zap all unwrap calls in web server

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #16565 from omoerbeek/rec-run-clippy

rec: Run clippy when CARGO_USE_DEV and CARGO_USE_CLIPPY are set

Merge pull request #16543 from karelbilek/kb/recursor_no_api

rec: make webserver work without an API key

rec: Run clippy when CARGO_USE_DEV and CARGO_USE_CLIPPY are set

Adapted from #16557

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #16520 from miodvallat/accept_of_the_dawn

auth, rec webservers: recognize Accept: */* header

Merge pull request #16558 from omoerbeek/no-rng-no-entropy-source

rec: Remove mentions of rng and entropy-source in as much places as possible

Merge pull request #16547 from miodvallat/upgrade_thorns

auth lmdb: error path cleanup in upgrade code

Better words in docs

Co-authored-by: Josh Soref <2119212+jsoref@users.noreply.github.com>
Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #16557 from rgacogne/ddist-run-clippy

dnsdist: Run clippy when `CARGO_USE_DEV` and `CARGO_USE_CLIPPY` are set

Merge pull request #16556 from rgacogne/ddist-rust-clippy

dnsdist: Apply Clippy's suggestions to our Rust code

Merge pull request #16563 from rgacogne/ddist-use-dns-random

dnsdist: Get rid of our own `random` code and use `dns_random`

Merge pull request #16564 from miodvallat/stowaway

auth lua: add missing catch block for STL exceptions in createForward

Add upgrade guide note

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Add missing catch block for STL exceptions in createForward.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

dnsdist: Get rid of our own `random` code and use `dns_random`

We introduced that code because the `dns_random` version that existed
at the time was pulling in a lot of code we did not want (logging,
configuration parsing, etc), but that no longer makes sense.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

rec: Remove mentions of rng and entropy-source in as much places as possible

Rec part of of #16554

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #16555 from rgacogne/ddist-do-not-use-random

dnsdist: Stop using `random()` to bench rules

dnsdist: Run clippy when `CARGO_USE_DEV` and `CARGO_USE_CLIPPY` are set

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Apply Clippy's suggestions to our Rust code

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Stop using `random()` to bench rules

This makes Coverity (CID 500050) and probably other tools
very unhappy.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16546 from omoerbeek/rec-rust-dev

rec: Build our Rust lib in dev profile when CARGO_USE_DEV is set

Merge pull request #16544 from rgacogne/ddist-rust-dev

dnsdist: Build our Rust lib in `dev` profile when `CARGO_USE_DEV` is set

Merge pull request #16545 from rgacogne/ddist-adddynblock-typo

dnsdist: Report the proper Lua function when parsing fails

Merge pull request #16428 from rgacogne/ddist-yaml-rules

dnsdist: Expose `TimedIPSet` to YAML-originated Lua contexts

Fix tests using ANY queries

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Force outgoing ANY queries to use TCP by default

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Change default of recursor.any_to_tcp to true

This is the client side handling.

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Prevent missing mdb_env_close in error paths in upgradeToSchemav5.

Using unique_ptr guards as used in getSchemaVersionAndShards, we can
guarantee that there will be no missing calls, regardless of how we
exit the function (which swears^Wthrows a lot).

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

rec: make webserver work without an API key

Currently, recursor web server doesn't work if API key is not set, even
when the API key is not actually used in the webserver auth.

Signed-off-by: Karel Bilek <kb@karelbilek.com>

rec: Build our Rust lib in dev profile when CARGO_USE_DEV is set

Adapted from #16544

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Recognize Accept: */* when deciding which content type to use for replies.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #16538 from famfo/nixos-is-cursed

m4/pdns_check_libcrypto: fix ecdsa/eddsa includedir

dnsdist: Report the proper Lua function when parsing fails

It looks like we copy/pasted the `addDynBlockSMT` name when calling
the parser from the `addDynamicBlock` function.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Build our Rust lib in `dev` profile when `CARGO_USE_DEV` is set

It is roughly halving the compile time in my tests, and comes
with more checks (see https://doc.rust-lang.org/cargo/reference/profiles.html#dev)
so I find it useful to be able to explicitly request building
using the `dev` profile. The default remains to build in `release`
mode for performance, of course.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16447 from jsoref/codeql-quality-unused-imports

chore: Remove first set of unused imports

Merge pull request #16539 from famfo/acl-mask

pdns/sstuff: convert mapped IPv4 addresses for ACL

pdns/sstuff: convert mapped IPv4 addresses for ACL

When a mapped address does not get converted, ACLs do not match as
expected. For example ::ffff:127.0.0.1 did not match the ACL 127.0.0.1.

Signed-off-by: famfo <famfo@famfo.xyz>

Merge pull request #16517 from miodvallat/path

auth regress: Fix PDNS_BUILD_PATH for non-meson builds

Merge pull request #16536 from rgacogne/ddist-inc-number-of-fd

dnsdist: Raise the maximum number of descriptors to 1M

Fix PDNS_BUILD_PATH for non-meson builds.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #16496 from omoerbeek/rec-tcounters-tidy

rec: Tidy tcounter related code

m4/pdns_check_libcrypto: fix ecdsa/eddsa includedir

On more excotic Linux distributions, like NixOS, the directory in which
the libraries are stored and the directory of the headers is different.
This uses pkg-config to find the right includedir of the headers.

Signed-off-by: famfo <famfo@famfo.xyz>

dnsdist: Raise the maximum number of descriptors to 1M

When running under systemd there is a cap on the number of open file or
socket descriptors that we can have at a given time. We used to set this
to 16k which was a large enough value for most installations, but now that
people are deploying DNSdist to offer DoT/DoH/DoQ/DoH3 to large numbers of
users we are regularly getting complaints that the default value is too low.
On the other hand I'm not aware of any case where having a cap actually
prevented an issue where we would be opening too many descriptors.
Therefore this commit is raising the default value to 1 millions, a large
enough values for even very large setups dealing with > 100k incoming
connections at a time.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16531 from jsoref/spelling

Spelling

spelling: work

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

spelling: with

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

spelling: will

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

spelling: where the query was sent

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

spelling: unsupported

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

spelling: unknown

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

spelling: transition

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

spelling: to

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

spelling: threshold

https://clang.llvm.org/extra/clang-tidy/checks/bugprone/easily-swappable-parameters.html#cmdoption-arg-NamePrefixSuffixSilenceDissimilarityThreshold

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

spelling: the

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

spelling: that

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

spelling: that the

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

spelling: system

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

spelling: successfully

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

spelling: successful

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

spelling: structure

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

spelling: stream

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

spelling: still

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

spelling: stepped

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

spelling: should

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

spelling: settings

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

spelling: setting

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

spelling: separate

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

spelling: sanitize

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>