Get rid of a "may be uninitialized" warning.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #16843 from omoerbeek/rec-docs-prs

rec docs: fill in PR#s for SA 2026-01 now that we know the numbers

rec docs: fill in PR#s for SA 2026-01 now that we know the numbers

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #16838 from omoerbeek/rec-limitcachesize

rec: Limit packet and record cache entry size

Merge pull request #16837 from omoerbeek/rec-answer-sizes

rec: Limit amount of work done for a single client query in new ways

Merge pull request #16836 from omoerbeek/rec-cname-follow

rec: Allowed names should not include names from CNAMEs that cannot be reached

Merge pull request #16835 from omoerbeek/rec-prep-20260209

Prep for 20260209 Recursor security release

Update versionadded in docs

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Limit packet and record cache entry size

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Update versionadded in docs

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Set a max on the number of visted IPs for a single qname/type

We use 2 * outgoing.max_ns_per_resolve as a limit. A tigher limit makes a few unit test fail.

Proper limit to be discussed.

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

rec: if the IPs of the auths of a zone resolve to duplicate IPs, skip the dups

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

If we received a delegation, also sample NS set if size > s_maxnsperresolve

Previously this was only done for NS sets retrieved fomr the record cache

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

rec: count cumulative answer sizes for a single client query

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

boost::optional -> std::optional

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

rec: allowed names should not include names from CNAMEs that cannot be reached

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Prep for 20260209 Recursor security release

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #16670 from miodvallat/frontline

auth: better advice when creating zones

Merge pull request #16573 from miodvallat/soaked

auth: minor getAllDomains optimizations

Merge pull request #16829 from pieterlexis/docs-setuptools-pin

chore: pin setuptools so pkg_resources keeps working

chore: Pin setuptools for build scripts

chore: Pin setuptools for builder tools

chore: Pin setuptools for remotebackend tests

chore: Pin setuptools for meson venv

chore: Pin setuptools for pdns-keyroller

chore: Pin setuptools for all regression tests

chore(auth): Pin setuptools for auth venv

docs(dnsdist): Pin setuptools so pkg_resources keeps working

docs(auth): Pin setuptools so pkg_resources keeps working

docs(recursor): Pin setuptools so pkg_resources keeps working

Merge pull request #16826 from zeha/drop-boost-system

Drop usage of libboost-system library

Merge pull request #16818 from miodvallat/squint

auth: useful views advice

Merge pull request #16824 from PowerDNS/dependabot/pip/regression-tests.recursor-dnssec/protobuf-6.33.5

build(deps): bump protobuf from 6.33.4 to 6.33.5 in /regression-tests.recursor-dnssec

Merge pull request #16825 from PowerDNS/omoerbeek-patch-1

rec docs: Fix typo in YAML

Drop usage of libboost-system library

Boost 1.89 dropped the stub library, apparently boost-system was headers only since 1.69.

https://www.boost.org/doc/libs/1_90_0/libs/system/doc/html/system.html#changes_in_boost_1_89

Signed-off-by: Chris Hofstaedtler <chris.hofstaedtler@deduktiva.com>

Fix typo in YAML

From @neilcook

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

build(deps): bump protobuf in /regression-tests.recursor-dnssec

Bumps [protobuf](https://github.com/protocolbuffers/protobuf) from 6.33.4 to 6.33.5.
- [Release notes](https://github.com/protocolbuffers/protobuf/releases)
- [Commits](https://github.com/protocolbuffers/protobuf/commits)

---
updated-dependencies:
- dependency-name: protobuf
  dependency-version: 6.33.5
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #16822 from rgacogne/ddist-noexcept

dnsdist: Add missing `noexcept` on move ctors/assignment operators

Merge pull request #16796 from pieterlexis/dnsdist-dq-labels

feat(dnsdist): Add `prepend` and `append` methods to Lua DNSName

Merge pull request #16821 from rgacogne/cleanup-remove-useless-class

Remove unused `DNSRecordOracle` class

Merge pull request #16817 from omoerbeek/base64

Base64 tidy and unit test fix

Merge pull request #21 from rgacogne/base64

base64: Wrap `BIO` objects in smart pointers, keep the check always enabled for DNSdist

Merge pull request #16806 from rgacogne/ddist-ipcrypt2-auto-switch

dnsdist: Fix issues with `ipcrypt2`

dnsdist: Add missing `noexcept` on move ctors/assignment operators

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Remove unused `DNSRecordOracle` class

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

test-base64: Keep the check enabled for DNSdist even w/ recent OpenSSL versions

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

base64: Use `unsigned` constants

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

base64: Wrap `BIO` objects in smart pointers

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Apply Miod's suggestion from code review

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16820 from miodvallat/banana_arrow

Stricter timestamp checks

Merge pull request #16756 from omoerbeek/rec-ot-instance

rec: harmonize with dnsdist PR #16741 wrt OpenTelemetry instance name

Merge pull request #16786 from omoerbeek/rec-ot-edns

Opentelemetry: add flags field in TRACEPARENT EDNS option

Perform stricter validation of timestamps.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

There are only 24 hours in a day, not 60.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #16807 from clwluvw/default-soa-edit-api

auth: add default-soa-edit-api setting for API zone creation

Strongly suggest storing variants in the same backend as their regular zone.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Apply suggestions from code review

Co-authored-by: Miod Vallat <miod.vallat@powerdns.com>
Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Depending on openssl version, base 64 decode is more or less strict

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #16812 from PowerDNS/dependabot/pip/regression-tests.dnsdist/protobuf-6.33.5

build(deps): bump protobuf from 6.33.4 to 6.33.5 in /regression-tests.dnsdist

Merge pull request #16811 from PowerDNS/dependabot/pip/docs/wheel-0.46.2

build(deps): bump wheel from 0.45.1 to 0.46.2 in /docs

Reformat

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

More (allocation) error checking fix a type

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

auth: add default-soa-edit-api setting for API zone creation

Add a configurable default-soa-edit-api setting that sets the
SOA-EDIT-API metadata for zones created via the API when the
zone creation request does not include the soa_edit_api field.

Signed-off-by: Seena Fallah <seenafallah@gmail.com>

Do not print recommendations if quiet.

There are people out there using shell scripts to make nails out of
pdnsutil, do not make pdnsutil output parsing more difficult.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #16810 from miodvallat/discount

auth: correctly compute DNSSEC public key exponent lengths when larger than 255

Merge pull request #16802 from rgacogne/ddist-quiche-congestion-bbr

dnsdist: Work around Quiche not dealing well with removed congestion algorithms

Merge pull request #16805 from rgacogne/ddist-nicer-b64-error

dnsdist: Better handling of invalid Base64 content

build(deps): bump protobuf in /regression-tests.dnsdist

Bumps [protobuf](https://github.com/protocolbuffers/protobuf) from 6.33.4 to 6.33.5.
- [Release notes](https://github.com/protocolbuffers/protobuf/releases)
- [Commits](https://github.com/protocolbuffers/protobuf/commits)

---
updated-dependencies:
- dependency-name: protobuf
  dependency-version: 6.33.5
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

build(deps): bump wheel from 0.45.1 to 0.46.2 in /docs

Bumps [wheel](https://github.com/pypa/wheel) from 0.45.1 to 0.46.2.
- [Release notes](https://github.com/pypa/wheel/releases)
- [Changelog](https://github.com/pypa/wheel/blob/main/docs/news.rst)
- [Commits](https://github.com/pypa/wheel/compare/0.45.1...0.46.2)

---
updated-dependencies:
- dependency-name: wheel
  dependency-version: 0.46.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #16808 from PowerDNS/dependabot/cargo/pdns/recursordist/rec-rust-lib/rust/bytes-1.11.1

build(deps): bump bytes from 1.11.0 to 1.11.1 in /pdns/recursordist/rec-rust-lib/rust

Correctly compute public key exponent length when larger than 255.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

build(deps): bump bytes in /pdns/recursordist/rec-rust-lib/rust

Bumps [bytes](https://github.com/tokio-rs/bytes) from 1.11.0 to 1.11.1.
- [Release notes](https://github.com/tokio-rs/bytes/releases)
- [Changelog](https://github.com/tokio-rs/bytes/blob/master/CHANGELOG.md)
- [Commits](https://github.com/tokio-rs/bytes/compare/v1.11.0...v1.11.1)

---
updated-dependencies:
- dependency-name: bytes
  dependency-version: 1.11.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

dnsdist: Enable ipcrypt2 w/ autotools in our CI

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Disable ipcrypt2 by default w/ autotools

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Do NOT add `c++` flags to `CPPFLAGS`

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Fix files order in the ipcrypt2 Makefile

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Better detection of whether ipcrypt2 will compile

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Disable `ipcrypt2` support when testing the "least" features set

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Add an option to disable ipcrypt2 w/ autotools

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

ext/ipcrypt2: Add missing softaes/untrinsics.h header

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Add a unit test for invalid Base64 content

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Cleanup of base64-related header and unit tests

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Better handling of invalid Base64 content

The existing code would throw an exception instead of returning
an error for some invalid content, which was harder to diagnose.

Reported by Surya Narayan Kushwaha (aka Cavid), thanks!

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16799 from rgacogne/update-ipcrypt2

dnsdist: Update ipcrypt2 to 1.1.10 + 1 commit

dnsdist: Add a regression test for the `bbr` congestion algo removed by Quiche

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Switch to cubic as default congestion algo for QUIC

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Work around Quiche not dealing well with removed congestion algorithms

See https://github.com/cloudflare/quiche/issues/2342

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16801 from sskender/master

docs: Fix grammar in running description

docs: Fix grammar in running description

Merge pull request #16800 from zeha/dnsdistspoof

dnsdist: SpoofAction: clarify what gets spoofed

dnsdist: SpoofAction: clarify what gets spoofed

Signed-off-by: Chris Hofstaedtler <chris.hofstaedtler@deduktiva.com>

ext/ipcrypt2: Add missing softaes/untrinsics.h header

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

ext/ipcrypt2: Update to `70a4daf` (1.1.10 plus 1 commit)

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16798 from hhoffstaette/no-yml-plz

dnsdist: Only install dnsdist.yml-dist if yaml support was enabled

dnsdist: Only install dnsdist.yml-dist if yaml support was enabled

Signed-off-by: Holger Hoffstätte <holger@applied-asynchrony.com>

feat(dnsdist): Add `prepend` and `append` methods to Lua DNSName

Merge pull request #16793 from rgacogne/ddist-do-not-install-dnsdist-yml

dnsdist: Do not create `dnsdist.yml` in RPM system configuration directory

dnsdist: Do not create `dnsdist.yml` in RPM system configuration directory

DNSdist now looks for a `dnsdist.yml` file first, which means that any
existing `dnsdist.conf` would no longer be taken into account if we create
a default `dnsdist.yml`. Let's install a sample YAML configuration file
in `dnsdist.yml-dist` instead.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16782 from rgacogne/ddist-210-a1

dnsdist: Update security polling zone and ChangeLog for 2.1.0-alpha1

dnsdist: Fix missing tag in 2.1.0-alpha1 changelog

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>