calidns: Also handle `PDNSException`s in `main`

Reported by Coverity as CID 1644004: Uncaught exception.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16662 from omoerbeek/rec-tsan-trixie

rec: add acquire/release in broadcast pipes to fix TSAN issues seen on trixie

Merge pull request #16701 from jsoref/codeql-imprecise-assert

Use `assertIn`

Merge pull request #16700 from rgacogne/ddist-coverity-20260106

dnsdist: Fix small issues reported by Coverity

Use assertIn

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

Merge pull request #16655 from omoerbeek/rec-suse-boost66

rec: make code boost 1.66 compatible again

dnsdist: Prevent surprise exceptions raised in a dtor

Reported by Coverity.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Fix small performance issues reported by Coverity

Mostly copying objects that could be moved, plus a few cases of
mistakenly copying objects while looping over them.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16622 from rgacogne/luawrapper-std-variant

LuaWrapper: Add support for `std::variant`

Merge pull request #16696 from omoerbeek/janitor-contrib-spurious-message

contrib: fix spurious "openTelemetry decoding not available" warning

Merge pull request #16695 from omoerbeek/janitor-zap-tcounters-spelling

Janitor work: fix `tcounters` is ignored by check-spelling because another more general variant is also in expect. (ignored-expect-variant)

Merge pull request #16661 from rgacogne/ddist-escape-spoof-raw-yaml

dnsdist: Handle escaped values in YAML SpoofRaw parameters

Merge pull request #16674 from rgacogne/ddist-fix-ip-only-certificate

dnsdist: Fix handling of IP-only TLS certificates

Merge pull request #15301 from rgacogne/calidns-proxy-protocol

calidns: Initial proxy protocol support

contrib: fix spurious "openTelemetry decoding not available" warning

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Janitor work: fix `tcounters` is ignored by check-spelling because another more general variant is also in expect. (ignored-expect-variant)

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #16597 from jsoref/peek-a-boo

Allow peeking at cache using an env var

Process miod's review comments

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #16694 from omoerbeek/rec-docs-mem

rec: State more clearly that memory usage may vary on usage and config

Move common sanitizer preprocessor handling to separate file

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Zap debug line and undo unrelated change

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

rec: State more clearly that memory usage may vary on usage and config

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #16576 from pieterlexis/dnsdist-ot-send-raii

dnsdist: OpenTelemetry additions

Merge pull request #16678 from miodvallat/cold_turkey

auth: deaden dead code

Merge pull request #16690 from esensar/fix/set-extended-dns-errors-missing-docs

dnsdist: update docs for `DNSQuestion::setExtendedDNSError`

dnsdist: update docs for `DNSQuestion::setExtendedDNSError`

PR #16680 introduced new parameter for `setExtendedDNSError` - `clearExistingEntries`.
Docs were added for actions, but not for the lua function, which was
changed together with the actions.

Related: https://github.com/PowerDNS/pdns/pull/16680
Signed-off-by: Ensar Sarajčić <dev@ensarsarajcic.com>

Merge pull request #16680 from esensar/feature/add-extended-dns-errors

dnsdist: add a way to add multiple EDE codes to a packet

dnsdist: use new object in `addExtendedDNSError`

Signed-off-by: Ensar Sarajčić <dev@ensarsarajcic.com>

dnsdist: move `clearExisting` from EDNSError flag to a separate object

Signed-off-by: Ensar Sarajčić <dev@ensarsarajcic.com>

dnsdist: make `clear_existing_entries` optional in `SetExtendedDNSError`

Signed-off-by: Ensar Sarajčić <dev@ensarsarajcic.com>

dnsdist: add tests for multiple EDE options support

Signed-off-by: Ensar Sarajčić <dev@ensarsarajcic.com>

dnsdist: add Lua FFI version of add extended DNS error

Signed-off-by: Ensar Sarajčić <dev@ensarsarajcic.com>

dnsdist: store clear flag in EDNS EDE

This allows more control over which ENDS EDE entries will be kept (e.g.
clear on first one, to delete existing data and then add additional
codes on top of that).

Signed-off-by: Ensar Sarajčić <dev@ensarsarajcic.com>

dnsdist: add `clearExistingEntries` to `SetExtendedDNSError`

Signed-off-by: Ensar Sarajčić <dev@ensarsarajcic.com>

dnsdist: reorder `AddExtendedDNSError` in actions definitions

Signed-off-by: Ensar Sarajčić <dev@ensarsarajcic.com>

Merge pull request #16677 from romeroalx/fix-auth-build-systemd

Fix builder-support/dockerfiles/Dockerfile.authoritative: remove copy of removed folder auth/systemd

dnsdist: add a way to add multiple EDE codes to a packet

Signed-off-by: Ensar Sarajčić <dev@ensarsarajcic.com>

Remove dead code.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

builder-support/dockerfiles/Dockerfile.authoritative: remove copy of renamed folder auth/systemd

Merge pull request #16676 from PowerDNS/dependabot/pip/docs/urllib3-2.6.0

build(deps): bump urllib3 from 2.5.0 to 2.6.0 in /docs

Merge pull request #16636 from miodvallat/autotertiary

auth: perform axfr immediately when creating an autosecondary domain

Merge pull request #16348 from miodvallat/disordername

auth rfc2136: more code cleanup

Merge pull request #16301 from miodvallat/ixfratu

auth: always send a response for {A,I}XFR requests

build(deps): bump urllib3 from 2.5.0 to 2.6.0 in /docs

Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.5.0 to 2.6.0.
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](https://github.com/urllib3/urllib3/compare/2.5.0...2.6.0)

---
updated-dependencies:
- dependency-name: urllib3
  dependency-version: 2.6.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #16675 from romeroalx/tests-auth-py-dnspython-2.8.0

regression-tests.auth-py: upgrade dnspython to a more recent version

regression-tests.auth-py: upgrade dnspython to a more recent version

clang-tidy: Reduce the complexity of the main function

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

calidns: Initial proxy protocol support

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16441 from rgacogne/sort-by-pr-number-in-changelog-from-pr

changelog-from-pr: Sort PRs based on their ID

Merge pull request #16671 from rgacogne/auth-meson-install

auth: Actually install binaries when building with meson

auth: Fix generating dist with autotools

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

auth: Install example configuration files when building with meson

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

auth: Install systemd unit files when building with meson

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

auth: Properly install schema files and upgrades

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

auth: Install dynamic modules when building with `meson`

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Add missing configuration file for the IP-only tests

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Add regression tests for IP-only TLS certificates

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Fix handling of IP-only TLS certificates

To properly handle SNI with OpenSSL, we have to keep track of the TLS
names supported by the different certificates associated to a frontend.
Since IP-only names are not involved in SNI negotiations, we are currently
skipping them when creating the TLS SNI map. Unfortunately this causes
an issue when we have a single certificate that only contains IPs,
the default context not being properly set.
This commit ensures the default context is properly set in that case.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16669 from esensar/fix/geoip-mmdb-open-error

auth: fix geoip_mmdb backend MMDB_open error handling

Merge pull request #16672 from ukleinek/trippple-listen

rec/doc: Fix stray 'listen:' tokens in code example

rec/doc: Fix stray 'listen:' tokens in code example

Signed-off-by: Uwe Kleine-König <uwe@kleine-koenig.org>

auth: Actually install binaries when building with meson

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

auth: fix geoip_mmdb backend MMDB_open error handling

According to [MMDB_open docs], errors from `MMDB_open` should be
compared to `MMDB_SUCCESS` (which is 0). All other errors are > 0, which
means that existing check never detects errors, causing further queries
to fail with error:
```
The MaxMind DB file is in a format this library can't handle
(unknown record size or binary format version)
```

[MMDB_open docs]: https://maxmind.github.io/libmaxminddb/#mmdb_open

Signed-off-by: Ensar Sarajčić <dev@ensarsarajcic.com>

Merge pull request #16653 from simmonyau/sdig-missing-libcurl-dep

Meson: Add missing libcurl dep for sdig

Merge pull request #16656 from PowerDNS/dependabot/pip/meson/requests-2.32.4

build(deps): bump requests from 2.32.3 to 2.32.4 in /meson

Merge pull request #16663 from milzi234/chore/docs_lse_version_selector

Version selector for PDNS Lightning Stream Enterprise in docs

Merge pull request #16660 from rgacogne/dnsdist-fix-selectors-actions-order-documentation

dnsdist: Ensure selectors and actions are properly ordered in the documentation

fixes typo in version selector call

Do away with std::optional for Routing tag

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

adds a separate version selector for PDNS Lightning Stream Enterprise to the documentation site

wip for acquire/release in broadcast pipes

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

dnsdist: Ensure selectors and actions are properly ordered in the documentation

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Fix ordering of actions in the action definitions

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16659 from xabinapal/issue-16074

Add fail-close backupselector mode for Lua healthcheck functions

Merge pull request #16658 from omoerbeek/rec-docs-source-address-note

rec: better describe which source addresses are accepted

test(auth): rename empty backupselector test record

Signed-off-by: Xabier Napal <xabier.napal@dvzr.io>

Merge pull request #16657 from miodvallat/luastice

auth: more robustness in createReverse*

test(auth): add empty backupselector test case

Signed-off-by: Xabier Napal <xabier.napal@dvzr.io>

docs: add new backupselector option in lua functions

Signed-off-by: Xabier Napal <xabier.napal@dvzr.io>

feat(auth): add empty selector for ifportup and ifurlup functions

Signed-off-by: Xabier Napal <xabier.napal@dvzr.io>

rec: better describe which source addresses are accepted

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #16642 from miodvallat/lmdbettercheck

auth lmdb: winter paranoia

Add more createReverse/createReverse6 error tests.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Add missing exception guard to lua createReverse.

While there, amend the exception messages in createReverse and createReverse6
to be a bit more precise and identify which function produced them.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

dnsdist: Handle escaped values in YAML SpoofRaw parameters

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

build(deps): bump requests from 2.32.3 to 2.32.4 in /meson

Bumps [requests](https://github.com/psf/requests) from 2.32.3 to 2.32.4.
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](https://github.com/psf/requests/compare/v2.32.3...v2.32.4)

---
updated-dependencies:
- dependency-name: requests
  dependency-version: 2.32.4
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #16640 from PowerDNS/dependabot/pip/builder-support/urllib3-2.6.0

build(deps): bump urllib3 from 2.5.0 to 2.6.0 in /builder-support

Avoid a few unused vars reported by g++-15

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Don't include filesystem if not needed, it might not be available

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Avoid a shadowing case reported by g++-15

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Avoid cases of "sorry, unimplemented: non-trivial designated initializers not supported"
reported by g++-15 (missing initializer)

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Avoid a few cases of shadowing reported by g++-15

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

wip

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Meson: Add missing libcurl dep for sdig

Fix error seen when linking sdig without lua records.

Signed-off-by: Simmon Yau <syau@fastly.com>

Merge pull request #16644 from rgacogne/rust-audit-branches

ci: Run the daily Rust dependencies audit for all stable branches

Merge pull request #16652 from rgacogne/auth-doc-api-replace-is-not-new

auth: `EXTEND` and `PRUNE` are new in 4.9.12 and 5.0.2, not `REPLACE`

auth: `EXTEND` and `PRUNE` are new in 4.9.12 and 5.0.2, not `REPLACE`

Spotted by `rdz` on IRC.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16651 from omoerbeek/rec-cookie-dump-pretty

rec: Print irrelevent entries in cookie dump more nicely

rec: Print irrelevent entries in cookie dump more nicely

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #16646 from omoerbeek/rec-prep-5.4.0-alpha1

Prep for rec-5.4.0-alpha1