build(deps): bump urllib3 in /regression-tests.dnsdist

Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.5.0 to 2.6.0.
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](https://github.com/urllib3/urllib3/compare/2.5.0...2.6.0)

---
updated-dependencies:
- dependency-name: urllib3
  dependency-version: 2.6.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #16601 from rgacogne/fewer-boost-optional

Remove some `boost::optional` leftovers

Remove some `boost::optional` leftovers

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16589 from miodvallat/gramophone

auth: allow finer-grained rrset changes through the API

No more reasons to reject more than one EXTEND or PRUNE anymore.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #16521 from rgacogne/ddist-xsk-unit-tests

dnsdist: Cleanup of the `AF_XDP`/`XSK` code

dnsdist: Consistenly use `getL4HeaderOffset()` in our XSK code

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16590 from rgacogne/ddist-coverity-20251204

dnsdist: Fix missed optimizations reported by Coverity in config

Allow PRUNE/EXTEND to coexist with DELETE/REPLACE.

This causes us to maintain a local cache of the rrsets being modified by
both sets of operations, so that we keep a consistent view of them during
the backend transaction, regardless of what the backend might be able to
return.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Spelling fixes from review

Co-authored-by: Josh Soref <2119212+jsoref@users.noreply.github.com>
Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Logic buglet found during review.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #16596 from jsoref/codeql-remove-unused-imports

Remove unused imports

Merge pull request #16595 from jsoref/codeql-remove-unused-variable

Remove unused variable

Merge pull request #16594 from jsoref/codeql-test-promtool-result

Tolerate promtool failing with exit code 3

Remove unused imports

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

Promtool may return 3 because of the "_total" suffix warnings

Co-authored-by: Miod Vallat <miod.vallat@powerdns.com>
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

Merge pull request #16593 from jsoref/codeql-unused-global-variable

Remove unused global variable

Remove unused variable

It was introduced (unused) in b8db58a230959585880e15c097851c5139d90f45

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

Allow for multiple extend/prune in the same request as long as different RRsets.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Tolerate promtool failing with exit code 3

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

Remove unused global variable

It was orphaned by 0bbd0a64dc496720155c575c5ff438a92b05e76c

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

Tests for EXTEND and PRUNE zone patch operations.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Fix assert_in_json_error because I'm a careless python programmer.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

New API zone patch feature: individual record add/delete (not rrset).

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

dnsdist: Fix missed optimizations reported by Coverity in config

This does not really matter because we don't care much about small
performance gains in configuration parsing, but it makes Coverity
happy.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16587 from omoerbeek/rec-coverity-20251203

rec: coverity 20251203

Merge pull request #16588 from omoerbeek/janitor-20251203

Kill a handful of clang++ warnings, mostly comparing unsigned to an signed constant

Split patchZone() in smaller bits.

This is preparation work for future changes which would likely to trigger
the "excessive cognitive complexity" diagnostic from clang-tidy, so cut
ahead.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Kill a handful of clang++ warnings, mostly comparing unsigned to an signed constant

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

1643551 Variable copied when it could be moved

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

1643563 Variable copied when it could be moved

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

1643013 Check of thread-shared field evades lock acquisition

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Coverity 1643564 Using a moved object

Looks harmless

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #16585 from romeroalx/build-packages-gh-arm64-runners

GH actions: build packages on Github arm64 runners

build-packages.yml: use GH arm64 runners

builder.yml: use GH arm64 runners

Merge pull request #16582 from rgacogne/ddist-202-changelog-typo

dnsdist: Fix a typo in the 2.0.2 ChangeLog

dnsdist: Fix a typo in the 2.0.2 ChangeLog

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16578 from rgacogne/ddist-2.0.2-secpoll-changelog

dnsdist: ChangeLog and security polling update for 2.0.2

Merge pull request #16487 from pieterlexis/chore-rm-boost-optional

chore: Switch trivial usage of boost::optional to std::optional

Merge pull request #16580 from omoerbeek/rec-move-g_logRPZChanges

rec: move g_logRPZChanges to proper spot

rec: move g_logRPZChanges to proper spot

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

spell-check: Allow new contributors, remove unneeded `ssi`

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: ChangeLog and security polling update for 2.0.2

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16572 from rgacogne/ci-use-cargo-dev-profile

ci: Use `Cargo`'s `dev` profile

Merge pull request #16577 from omoerbeek/rec-docs-upgrade-merge-fix

rec docs: fix GH merge botch

rec docs: fix GH merge botch

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #16553 from omoerbeek/rec-any-to-tcp

rec: always do ANY queries using TCP

Merge pull request #16570 from omoerbeek/rec-rust-unwrap

rec:  rewrite all  unwrap calls in web.rs

Merge pull request #16575 from miodvallat/rm_is_your_best_friend

auth: mention extra steps for manual upgrades

Mention manual cleanup of no-longer-built modules if manual upgrade.

Fixes: #16549
Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

chore(luawrapper): stop linting a false positive

chore: allow "ip" as variable name in clang-tidy

chore(res): appease clang-tidy

chore(dnsdist): appease clang-tidy

chore(rec): update the logger to use std::optional

chore(rec): Replace all trivial boost::optional with std::optional

chore(dnsdist): stop boost::optional to std::optional conversions in generated code

chore(dnsdist): Switch from boost::optional to std::optional

This also updates the DNSTap code to accept a DNSName as `auth` always
and checks its emptyness.

ci: Use `Cargo`'s `dev` profile

Using the `dev` profile means faster builds and more checks.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16393 from TooManyBees/lua-metric-prometheus-types

Recursor: add types and descriptions to dynamic metrics defined in Lua

Reformat

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

rec: zap all unwrap calls in web server

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #16565 from omoerbeek/rec-run-clippy

rec: Run clippy when CARGO_USE_DEV and CARGO_USE_CLIPPY are set

Merge pull request #16543 from karelbilek/kb/recursor_no_api

rec: make webserver work without an API key

rec: Run clippy when CARGO_USE_DEV and CARGO_USE_CLIPPY are set

Adapted from #16557

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #16520 from miodvallat/accept_of_the_dawn

auth, rec webservers: recognize Accept: */* header

Merge pull request #16558 from omoerbeek/no-rng-no-entropy-source

rec: Remove mentions of rng and entropy-source in as much places as possible

Merge pull request #16547 from miodvallat/upgrade_thorns

auth lmdb: error path cleanup in upgrade code

Better words in docs

Co-authored-by: Josh Soref <2119212+jsoref@users.noreply.github.com>
Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #16557 from rgacogne/ddist-run-clippy

dnsdist: Run clippy when `CARGO_USE_DEV` and `CARGO_USE_CLIPPY` are set

Merge pull request #16556 from rgacogne/ddist-rust-clippy

dnsdist: Apply Clippy's suggestions to our Rust code

Merge pull request #16563 from rgacogne/ddist-use-dns-random

dnsdist: Get rid of our own `random` code and use `dns_random`

Merge pull request #16564 from miodvallat/stowaway

auth lua: add missing catch block for STL exceptions in createForward

Add upgrade guide note

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Add missing catch block for STL exceptions in createForward.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

dnsdist: Get rid of our own `random` code and use `dns_random`

We introduced that code because the `dns_random` version that existed
at the time was pulling in a lot of code we did not want (logging,
configuration parsing, etc), but that no longer makes sense.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

rec: Remove mentions of rng and entropy-source in as much places as possible

Rec part of of #16554

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #16555 from rgacogne/ddist-do-not-use-random

dnsdist: Stop using `random()` to bench rules

dnsdist: Run clippy when `CARGO_USE_DEV` and `CARGO_USE_CLIPPY` are set

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Apply Clippy's suggestions to our Rust code

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Stop using `random()` to bench rules

This makes Coverity (CID 500050) and probably other tools
very unhappy.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16546 from omoerbeek/rec-rust-dev

rec: Build our Rust lib in dev profile when CARGO_USE_DEV is set

Merge pull request #16544 from rgacogne/ddist-rust-dev

dnsdist: Build our Rust lib in `dev` profile when `CARGO_USE_DEV` is set

Merge pull request #16545 from rgacogne/ddist-adddynblock-typo

dnsdist: Report the proper Lua function when parsing fails

Merge pull request #16428 from rgacogne/ddist-yaml-rules

dnsdist: Expose `TimedIPSet` to YAML-originated Lua contexts

Fix tests using ANY queries

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Force outgoing ANY queries to use TCP by default

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Change default of recursor.any_to_tcp to true

This is the client side handling.

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Prevent missing mdb_env_close in error paths in upgradeToSchemav5.

Using unique_ptr guards as used in getSchemaVersionAndShards, we can
guarantee that there will be no missing calls, regardless of how we
exit the function (which swears^Wthrows a lot).

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

rec: make webserver work without an API key

Currently, recursor web server doesn't work if API key is not set, even
when the API key is not actually used in the webserver auth.

Signed-off-by: Karel Bilek <kb@karelbilek.com>

rec: Build our Rust lib in dev profile when CARGO_USE_DEV is set

Adapted from #16544

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Recognize Accept: */* when deciding which content type to use for replies.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #16538 from famfo/nixos-is-cursed

m4/pdns_check_libcrypto: fix ecdsa/eddsa includedir

dnsdist: Report the proper Lua function when parsing fails

It looks like we copy/pasted the `addDynBlockSMT` name when calling
the parser from the `addDynamicBlock` function.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Build our Rust lib in `dev` profile when `CARGO_USE_DEV` is set

It is roughly halving the compile time in my tests, and comes
with more checks (see https://doc.rust-lang.org/cargo/reference/profiles.html#dev)
so I find it useful to be able to explicitly request building
using the `dev` profile. The default remains to build in `release`
mode for performance, of course.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16447 from jsoref/codeql-quality-unused-imports

chore: Remove first set of unused imports

Merge pull request #16539 from famfo/acl-mask

pdns/sstuff: convert mapped IPv4 addresses for ACL

pdns/sstuff: convert mapped IPv4 addresses for ACL

When a mapped address does not get converted, ACLs do not match as
expected. For example ::ffff:127.0.0.1 did not match the ACL 127.0.0.1.

Signed-off-by: famfo <famfo@famfo.xyz>

Merge pull request #16517 from miodvallat/path

auth regress: Fix PDNS_BUILD_PATH for non-meson builds