Better python formatting from @rgacogne

Co-authored-by: Remi Gacogne <github@coredump.fr>
Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Add docs

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Fix race and test and check subject of client cert and add PEM test

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Add test for Dot with client cert

When run individually, the new test works. But there seems to be a race
condition: in some cases old responders look to be still running, making
subsequent test fail on larger test runs.

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Tidy existing TLS tests a bit

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Generate cert to use as client cert in tests

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Basic infra for client cert

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Refactor key setup so it isn's tied to server-only code

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #16872 from PowerDNS/feature/update-repo-test-script-20260212

Update Repo Test Script

Use `not in` instead of a fugly line of `and`s.

Undo some whitespace changes so diff looks good.

Reinstate `while` usage.

Remove `auth-47` as it is not maintained anymore.

Comment by @miodvallat in #16872.

Merge pull request #16871 from miodvallat/gettingtoooldtowritecode

auth: fix stupid logic error in lmdb-write-update-notification=no

Update repo test script.

This had not been synced to the repo for a while.

Perform DomainInfo consolidation before filtering.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Fix polarity of setting description.

This was forgotten after this setting changed name and polarity.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #16868 from rgacogne/rust-audit-pr

CI: Run the Rust deps audit check on the correct branch for pull requests

CI: Run the Rust deps check workflow on PR to master

As suggested by Alexis, many thanks!

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16862 from omoerbeek/rec-janitor-lwres

rec: cleanup lwres.??

Run the Rust deps audit check on the current branch for PRs

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

CI: Do not run the Rust deps audit on all branches for PRs

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16861 from PowerDNS/dependabot/cargo/pdns/recursordist/rec-rust-lib/rust/time-0.3.47

build(deps): bump time from 0.3.45 to 0.3.47 in /pdns/recursordist/rec-rust-lib/rust

build(deps): bump time in /pdns/recursordist/rec-rust-lib/rust

Bumps [time](https://github.com/time-rs/time) from 0.3.45 to 0.3.47.
- [Release notes](https://github.com/time-rs/time/releases)
- [Changelog](https://github.com/time-rs/time/blob/main/CHANGELOG.md)
- [Commits](https://github.com/time-rs/time/compare/v0.3.45...v0.3.47)

---
updated-dependencies:
- dependency-name: time
  dependency-version: 0.3.47
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #16855 from omoerbeek/rec-ws-pkcs12

rec: add feature to read TLS key info from an encrypted PKCS12 (pfx) file for the embedded web server

Better var name

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Process review comments from Miod

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

skip test on class level

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Mention the PKCS12 feature is not available everywhere.

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Make pkcs12 feature dependent on rust version

Also add test infra to test for rec features

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Add password field in yaml generation from map

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Better comments and function names

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Add docs

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Add test, pin time crate to avoid depending on rustc 1.88

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

rec: add feature to read webserver key and cert from (encrypted) pkcs12 file

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #16857 from PowerDNS/dependabot/pip/regression-tests.recursor-dnssec/cryptography-46.0.5

build(deps): bump cryptography from 46.0.4 to 46.0.5 in /regression-tests.recursor-dnssec

Merge pull request #16856 from omoerbeek/rustc-update-to-1.93

rec and dnsdist: Update rustc and cargo to 1.93

build(deps): bump cryptography in /regression-tests.recursor-dnssec

Bumps [cryptography](https://github.com/pyca/cryptography) from 46.0.4 to 46.0.5.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pyca/cryptography/compare/46.0.4...46.0.5)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 46.0.5
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #16852 from PowerDNS/dependabot/pip/regression-tests.dnsdist/cryptography-46.0.5

build(deps): bump cryptography from 46.0.4 to 46.0.5 in /regression-tests.dnsdist

Merge pull request #16823 from rgacogne/ddist-export-dns-flags-via-protobuf

dnsdist: Export DNS flags via ProtoBuf

Reduce include files to much smaller set

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

rec: cleanup in lwres related code

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #16854 from miodvallat/wolf

auth: get rid of a "may be uninitialized" warning.

Update rustc and cargo to 1.93

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Get rid of a "may be uninitialized" warning.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #16849 from rgacogne/quiche-0.24.9

dnsdist: Update Quiche to 0.24.9

Merge pull request #16846 from rgacogne/ddist-fix-pool-zero-scope-version

dnsdist: Fix version added for `ServerPool:{g,s}etZeroScope`

Merge pull request #16853 from omoerbeek/rec-regr-test-robustness

rec: improve regression test startup/teardown robustness

Type in var name from Miod

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

build(deps): bump cryptography in /regression-tests.dnsdist

Bumps [cryptography](https://github.com/pyca/cryptography) from 46.0.4 to 46.0.5.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pyca/cryptography/compare/46.0.4...46.0.5)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 46.0.5
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Make sure all teardown class methods are called before raising a potential exception

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

dnsdist: Fix version added for `ServerPool:{g,s}etZeroScope`

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Call super().tearDownClass() if possible

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Wrong type of object used

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

dnsdist: Update Quiche to 0.24.9

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

rec: check if auths are running

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #16843 from omoerbeek/rec-docs-prs

rec docs: fill in PR#s for SA 2026-01 now that we know the numbers

rec docs: fill in PR#s for SA 2026-01 now that we know the numbers

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #16838 from omoerbeek/rec-limitcachesize

rec: Limit packet and record cache entry size

Merge pull request #16837 from omoerbeek/rec-answer-sizes

rec: Limit amount of work done for a single client query in new ways

Merge pull request #16836 from omoerbeek/rec-cname-follow

rec: Allowed names should not include names from CNAMEs that cannot be reached

Merge pull request #16835 from omoerbeek/rec-prep-20260209

Prep for 20260209 Recursor security release

Update versionadded in docs

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Limit packet and record cache entry size

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Update versionadded in docs

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Set a max on the number of visted IPs for a single qname/type

We use 2 * outgoing.max_ns_per_resolve as a limit. A tigher limit makes a few unit test fail.

Proper limit to be discussed.

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

rec: if the IPs of the auths of a zone resolve to duplicate IPs, skip the dups

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

If we received a delegation, also sample NS set if size > s_maxnsperresolve

Previously this was only done for NS sets retrieved fomr the record cache

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

rec: count cumulative answer sizes for a single client query

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

boost::optional -> std::optional

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

rec: allowed names should not include names from CNAMEs that cannot be reached

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Prep for 20260209 Recursor security release

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #16670 from miodvallat/frontline

auth: better advice when creating zones

Merge pull request #16573 from miodvallat/soaked

auth: minor getAllDomains optimizations

Merge pull request #16829 from pieterlexis/docs-setuptools-pin

chore: pin setuptools so pkg_resources keeps working

chore: Pin setuptools for build scripts

chore: Pin setuptools for builder tools

chore: Pin setuptools for remotebackend tests

chore: Pin setuptools for meson venv

chore: Pin setuptools for pdns-keyroller

chore: Pin setuptools for all regression tests

chore(auth): Pin setuptools for auth venv

docs(dnsdist): Pin setuptools so pkg_resources keeps working

docs(auth): Pin setuptools so pkg_resources keeps working

docs(recursor): Pin setuptools so pkg_resources keeps working

Merge pull request #16826 from zeha/drop-boost-system

Drop usage of libboost-system library

Merge pull request #16818 from miodvallat/squint

auth: useful views advice

Merge pull request #16824 from PowerDNS/dependabot/pip/regression-tests.recursor-dnssec/protobuf-6.33.5

build(deps): bump protobuf from 6.33.4 to 6.33.5 in /regression-tests.recursor-dnssec

Merge pull request #16825 from PowerDNS/omoerbeek-patch-1

rec docs: Fix typo in YAML

Drop usage of libboost-system library

Boost 1.89 dropped the stub library, apparently boost-system was headers only since 1.69.

https://www.boost.org/doc/libs/1_90_0/libs/system/doc/html/system.html#changes_in_boost_1_89

Signed-off-by: Chris Hofstaedtler <chris.hofstaedtler@deduktiva.com>

Fix typo in YAML

From @neilcook

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

build(deps): bump protobuf in /regression-tests.recursor-dnssec

Bumps [protobuf](https://github.com/protocolbuffers/protobuf) from 6.33.4 to 6.33.5.
- [Release notes](https://github.com/protocolbuffers/protobuf/releases)
- [Commits](https://github.com/protocolbuffers/protobuf/commits)

---
updated-dependencies:
- dependency-name: protobuf
  dependency-version: 6.33.5
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #16822 from rgacogne/ddist-noexcept

dnsdist: Add missing `noexcept` on move ctors/assignment operators

dnsdist: Fix formatting

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Add regression tests for DNS flags in ProtoBuf messages

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Set `QR=1` for responses triggered by timeout response rules

These are, after all, supposed to be responses by all the rules and
actions that are processing them.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Export DNS flags via ProtoBuf

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16796 from pieterlexis/dnsdist-dq-labels

feat(dnsdist): Add `prepend` and `append` methods to Lua DNSName

Merge pull request #16821 from rgacogne/cleanup-remove-useless-class

Remove unused `DNSRecordOracle` class

Merge pull request #16817 from omoerbeek/base64

Base64 tidy and unit test fix