auth: fix geoip_mmdb backend MMDB_open error handling

According to [MMDB_open docs], errors from `MMDB_open` should be
compared to `MMDB_SUCCESS` (which is 0). All other errors are > 0, which
means that existing check never detects errors, causing further queries
to fail with error:
```
The MaxMind DB file is in a format this library can't handle
(unknown record size or binary format version)
```

[MMDB_open docs]: https://maxmind.github.io/libmaxminddb/#mmdb_open

Signed-off-by: Ensar Sarajčić <dev@ensarsarajcic.com>

Merge pull request #16653 from simmonyau/sdig-missing-libcurl-dep

Meson: Add missing libcurl dep for sdig

Merge pull request #16656 from PowerDNS/dependabot/pip/meson/requests-2.32.4

build(deps): bump requests from 2.32.3 to 2.32.4 in /meson

Merge pull request #16663 from milzi234/chore/docs_lse_version_selector

Version selector for PDNS Lightning Stream Enterprise in docs

Merge pull request #16660 from rgacogne/dnsdist-fix-selectors-actions-order-documentation

dnsdist: Ensure selectors and actions are properly ordered in the documentation

fixes typo in version selector call

adds a separate version selector for PDNS Lightning Stream Enterprise to the documentation site

dnsdist: Ensure selectors and actions are properly ordered in the documentation

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Fix ordering of actions in the action definitions

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16659 from xabinapal/issue-16074

Add fail-close backupselector mode for Lua healthcheck functions

Merge pull request #16658 from omoerbeek/rec-docs-source-address-note

rec: better describe which source addresses are accepted

test(auth): rename empty backupselector test record

Signed-off-by: Xabier Napal <xabier.napal@dvzr.io>

Merge pull request #16657 from miodvallat/luastice

auth: more robustness in createReverse*

test(auth): add empty backupselector test case

Signed-off-by: Xabier Napal <xabier.napal@dvzr.io>

docs: add new backupselector option in lua functions

Signed-off-by: Xabier Napal <xabier.napal@dvzr.io>

feat(auth): add empty selector for ifportup and ifurlup functions

Signed-off-by: Xabier Napal <xabier.napal@dvzr.io>

rec: better describe which source addresses are accepted

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #16642 from miodvallat/lmdbettercheck

auth lmdb: winter paranoia

Add more createReverse/createReverse6 error tests.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Add missing exception guard to lua createReverse.

While there, amend the exception messages in createReverse and createReverse6
to be a bit more precise and identify which function produced them.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

build(deps): bump requests from 2.32.3 to 2.32.4 in /meson

Bumps [requests](https://github.com/psf/requests) from 2.32.3 to 2.32.4.
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](https://github.com/psf/requests/compare/v2.32.3...v2.32.4)

---
updated-dependencies:
- dependency-name: requests
  dependency-version: 2.32.4
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #16640 from PowerDNS/dependabot/pip/builder-support/urllib3-2.6.0

build(deps): bump urllib3 from 2.5.0 to 2.6.0 in /builder-support

Meson: Add missing libcurl dep for sdig

Fix error seen when linking sdig without lua records.

Signed-off-by: Simmon Yau <syau@fastly.com>

Merge pull request #16644 from rgacogne/rust-audit-branches

ci: Run the daily Rust dependencies audit for all stable branches

Merge pull request #16652 from rgacogne/auth-doc-api-replace-is-not-new

auth: `EXTEND` and `PRUNE` are new in 4.9.12 and 5.0.2, not `REPLACE`

auth: `EXTEND` and `PRUNE` are new in 4.9.12 and 5.0.2, not `REPLACE`

Spotted by `rdz` on IRC.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16651 from omoerbeek/rec-cookie-dump-pretty

rec: Print irrelevent entries in cookie dump more nicely

rec: Print irrelevent entries in cookie dump more nicely

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #16646 from omoerbeek/rec-prep-5.4.0-alpha1

Prep for rec-5.4.0-alpha1

Merge pull request #16639 from miodvallat/entropocene

auth: remove configurable random generator leftovers

Prep for rec-5.4.0-alpha1

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #16643 from rgacogne/ddist-update-rust-libs

dnsdist: Update our Rust dependencies

Merge pull request #16569 from miodvallat/unsort

pdnsutil: make "zone list" record sorting optional

ci: Run the daily Rust dependencies audit for all stable branches

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Update our Rust dependencies

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

build(deps): bump urllib3 from 2.5.0 to 2.6.0 in /builder-support

Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.5.0 to 2.6.0.
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](https://github.com/urllib3/urllib3/compare/2.5.0...2.6.0)

---
updated-dependencies:
- dependency-name: urllib3
  dependency-version: 2.6.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #16641 from PowerDNS/dependabot/pip/regression-tests.recursor-dnssec/urllib3-2.6.0

build(deps): bump urllib3 from 2.5.0 to 2.6.0 in /regression-tests.recursor-dnssec

Make sure never to try and access LMDBResourceRecords beyond their actual size.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Give the list flavour of deserializeFromBuffer() a different name.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Minor code cleanups:

- remove unused bits from getUnfreshSecondaryInfo().
- use similar logic for the two code paths which need to fetch SOA numbers.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #16627 from omoerbeek/rec-rust-nicer-errs

rec: format rust IOErrors in a nicer way instead of using the default formatter

No need to do a downcast dance and include fix for https://github.com/dtolnay/cxx/issues/1684

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Allow (but warn) entropy-source and rng settings until 5.2.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

build(deps): bump urllib3 in /regression-tests.recursor-dnssec

Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.5.0 to 2.6.0.
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](https://github.com/urllib3/urllib3/compare/2.5.0...2.6.0)

---
updated-dependencies:
- dependency-name: urllib3
  dependency-version: 2.6.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #16637 from romeroalx/ci-build-test-dnsdist-deb11-noarm

gh actions - build-and-test-all skip build dnsdist arm64 on debian 11

Remove KISS rng configuration leftovers.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #16638 from miodvallat/undercover

auth: i like to std::move it std::move it

Remove use of rng and entropy-source parameters.

Document them as having been removed.

Fixes: #16554
Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Address Coverity reported unnecessary object copies.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

build-and-test-all.yml: skip swagger-syntax-check on debian 11

build-and-test-all.yml: skip build dnsdist arm64 on debian 11

Merge pull request #16632 from miodvallat/rectify_docs

auth: minor docs tweaks

Merge pull request #16628 from miodvallat/numbers

auth: changelog and secpoll update for 4.9.12 and 5.0.2

Merge pull request #16631 from romeroalx/manual-install-libh2o

tasks.py: add option to install libh2o manually

Changelog and secpoll update for 4.9.12 and 5.0.2.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Do not mention rectify will fail on non-DNSSEC zones.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Replace master/slave with primary/secondary when applicable.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

tasks.py: add option to install libh2o manually

Merge pull request #16620 from Habbie/prune-extend-versions

auth: note that PRUNE/EXTEND are new in 4.9.12/5.0.2

rec: format rust IOErrors in a nicer way instead of using the default formatter

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #16568 from miodvallat/path_less_travelled

auth: yet another boring autoconf regression

Merge pull request #16609 from PowerDNS/dependabot/pip/regression-tests.ixfrdist/urllib3-2.6.0

build(deps): bump urllib3 from 2.5.0 to 2.6.0 in /regression-tests.ixfrdist

Merge pull request #16623 from rgacogne/daily-rust-only-when-scheduled

Only run the daily Rust audit when `SCHEDULED_MISC_DAILIES` is set

Merge pull request #16624 from omoerbeek/rec-rust-ruttls-pemfile

rec: move away from rustls-pemfile including update of Rust dependencies

build(deps): bump urllib3 in /regression-tests.ixfrdist

Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.5.0 to 2.6.0.
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](https://github.com/urllib3/urllib3/compare/2.5.0...2.6.0)

---
updated-dependencies:
- dependency-name: urllib3
  dependency-version: 2.6.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #16607 from PowerDNS/dependabot/pip/pdns/dnsdistdist/docs/urllib3-2.6.0

build(deps): bump urllib3 from 2.5.0 to 2.6.0 in /pdns/dnsdistdist/docs

Merge pull request #16608 from PowerDNS/dependabot/pip/regression-tests.dnsdist/urllib3-2.6.0

build(deps): bump urllib3 from 2.5.0 to 2.6.0 in /regression-tests.dnsdist

Merge pull request #16610 from PowerDNS/dependabot/pip/regression-tests.api/urllib3-2.6.0

build(deps): bump urllib3 from 2.5.0 to 2.6.0 in /regression-tests.api

Merge pull request #16611 from PowerDNS/dependabot/pip/pdns/recursordist/docs/urllib3-2.6.0

build(deps): bump urllib3 from 2.5.0 to 2.6.0 in /pdns/recursordist/docs

Merge pull request #16612 from PowerDNS/dependabot/pip/meson/urllib3-2.6.0

build(deps): bump urllib3 from 2.5.0 to 2.6.0 in /meson

rec: move away from rustls-pemfile

Fixes #16606

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Only run the daily Rust audit when `SCHEDULED_MISC_DAILIES` is set

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16602 from miodvallat/misorder

auth: proactive test fix

Merge pull request #16619 from omoerbeek/rec-prep-20251208

rec: Prep for 20251208 security releases

auth: note that PRUNE/EXTEND are new in 4.9.12/5.0.2

Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>

Merge pull request #16615 from omoerbeek/rec-tcp-notify

rec: Do proper validation of TCP notifies

Merge pull request #16614 from omoerbeek/anyauthrecord

rec: ensure authRecords is empty, as handleHit checks that

rec: Prep for 20251208 security releases

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Correct comment

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Add tests for disallowed notifies

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

rec: do proper validation of TCP notifies

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Check size of returned vector in test

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

rec: Handle more cases where the authority records might not be empty

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

If we iterator the loop multiple times for ANY requests, authRecords might not be empty

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

build(deps): bump urllib3 from 2.5.0 to 2.6.0 in /meson

Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.5.0 to 2.6.0.
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](https://github.com/urllib3/urllib3/compare/2.5.0...2.6.0)

---
updated-dependencies:
- dependency-name: urllib3
  dependency-version: 2.6.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

build(deps): bump urllib3 from 2.5.0 to 2.6.0 in /pdns/recursordist/docs

Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.5.0 to 2.6.0.
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](https://github.com/urllib3/urllib3/compare/2.5.0...2.6.0)

---
updated-dependencies:
- dependency-name: urllib3
  dependency-version: 2.6.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

build(deps): bump urllib3 from 2.5.0 to 2.6.0 in /regression-tests.api

Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.5.0 to 2.6.0.
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](https://github.com/urllib3/urllib3/compare/2.5.0...2.6.0)

---
updated-dependencies:
- dependency-name: urllib3
  dependency-version: 2.6.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

build(deps): bump urllib3 in /regression-tests.dnsdist

Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.5.0 to 2.6.0.
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](https://github.com/urllib3/urllib3/compare/2.5.0...2.6.0)

---
updated-dependencies:
- dependency-name: urllib3
  dependency-version: 2.6.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

build(deps): bump urllib3 from 2.5.0 to 2.6.0 in /pdns/dnsdistdist/docs

Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.5.0 to 2.6.0.
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](https://github.com/urllib3/urllib3/compare/2.5.0...2.6.0)

---
updated-dependencies:
- dependency-name: urllib3
  dependency-version: 2.6.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #16601 from rgacogne/fewer-boost-optional

Remove some `boost::optional` leftovers

Fix test to not depend upon the order of the returned records.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Remove some `boost::optional` leftovers

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16589 from miodvallat/gramophone

auth: allow finer-grained rrset changes through the API

No more reasons to reject more than one EXTEND or PRUNE anymore.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #16521 from rgacogne/ddist-xsk-unit-tests

dnsdist: Cleanup of the `AF_XDP`/`XSK` code

dnsdist: Consistenly use `getL4HeaderOffset()` in our XSK code

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16590 from rgacogne/ddist-coverity-20251204

dnsdist: Fix missed optimizations reported by Coverity in config

Allow PRUNE/EXTEND to coexist with DELETE/REPLACE.

This causes us to maintain a local cache of the rrsets being modified by
both sets of operations, so that we keep a consistent view of them during
the backend transaction, regardless of what the backend might be able to
return.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Spelling fixes from review

Co-authored-by: Josh Soref <2119212+jsoref@users.noreply.github.com>
Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Logic buglet found during review.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>