Perform DomainInfo consolidation before filtering.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Fix polarity of setting description.

This was forgotten after this setting changed name and polarity.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #16823 from rgacogne/ddist-export-dns-flags-via-protobuf

dnsdist: Export DNS flags via ProtoBuf

Merge pull request #16854 from miodvallat/wolf

auth: get rid of a "may be uninitialized" warning.

Get rid of a "may be uninitialized" warning.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #16849 from rgacogne/quiche-0.24.9

dnsdist: Update Quiche to 0.24.9

Merge pull request #16846 from rgacogne/ddist-fix-pool-zero-scope-version

dnsdist: Fix version added for `ServerPool:{g,s}etZeroScope`

Merge pull request #16853 from omoerbeek/rec-regr-test-robustness

rec: improve regression test startup/teardown robustness

Type in var name from Miod

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Make sure all teardown class methods are called before raising a potential exception

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

dnsdist: Fix version added for `ServerPool:{g,s}etZeroScope`

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Call super().tearDownClass() if possible

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Wrong type of object used

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

dnsdist: Update Quiche to 0.24.9

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

rec: check if auths are running

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #16843 from omoerbeek/rec-docs-prs

rec docs: fill in PR#s for SA 2026-01 now that we know the numbers

rec docs: fill in PR#s for SA 2026-01 now that we know the numbers

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #16838 from omoerbeek/rec-limitcachesize

rec: Limit packet and record cache entry size

Merge pull request #16837 from omoerbeek/rec-answer-sizes

rec: Limit amount of work done for a single client query in new ways

Merge pull request #16836 from omoerbeek/rec-cname-follow

rec: Allowed names should not include names from CNAMEs that cannot be reached

Merge pull request #16835 from omoerbeek/rec-prep-20260209

Prep for 20260209 Recursor security release

Update versionadded in docs

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Limit packet and record cache entry size

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Update versionadded in docs

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Set a max on the number of visted IPs for a single qname/type

We use 2 * outgoing.max_ns_per_resolve as a limit. A tigher limit makes a few unit test fail.

Proper limit to be discussed.

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

rec: if the IPs of the auths of a zone resolve to duplicate IPs, skip the dups

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

If we received a delegation, also sample NS set if size > s_maxnsperresolve

Previously this was only done for NS sets retrieved fomr the record cache

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

rec: count cumulative answer sizes for a single client query

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

boost::optional -> std::optional

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

rec: allowed names should not include names from CNAMEs that cannot be reached

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Prep for 20260209 Recursor security release

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #16670 from miodvallat/frontline

auth: better advice when creating zones

Merge pull request #16573 from miodvallat/soaked

auth: minor getAllDomains optimizations

Merge pull request #16829 from pieterlexis/docs-setuptools-pin

chore: pin setuptools so pkg_resources keeps working

chore: Pin setuptools for build scripts

chore: Pin setuptools for builder tools

chore: Pin setuptools for remotebackend tests

chore: Pin setuptools for meson venv

chore: Pin setuptools for pdns-keyroller

chore: Pin setuptools for all regression tests

chore(auth): Pin setuptools for auth venv

docs(dnsdist): Pin setuptools so pkg_resources keeps working

docs(auth): Pin setuptools so pkg_resources keeps working

docs(recursor): Pin setuptools so pkg_resources keeps working

Merge pull request #16826 from zeha/drop-boost-system

Drop usage of libboost-system library

Merge pull request #16818 from miodvallat/squint

auth: useful views advice

Merge pull request #16824 from PowerDNS/dependabot/pip/regression-tests.recursor-dnssec/protobuf-6.33.5

build(deps): bump protobuf from 6.33.4 to 6.33.5 in /regression-tests.recursor-dnssec

Merge pull request #16825 from PowerDNS/omoerbeek-patch-1

rec docs: Fix typo in YAML

Drop usage of libboost-system library

Boost 1.89 dropped the stub library, apparently boost-system was headers only since 1.69.

https://www.boost.org/doc/libs/1_90_0/libs/system/doc/html/system.html#changes_in_boost_1_89

Signed-off-by: Chris Hofstaedtler <chris.hofstaedtler@deduktiva.com>

Fix typo in YAML

From @neilcook

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

build(deps): bump protobuf in /regression-tests.recursor-dnssec

Bumps [protobuf](https://github.com/protocolbuffers/protobuf) from 6.33.4 to 6.33.5.
- [Release notes](https://github.com/protocolbuffers/protobuf/releases)
- [Commits](https://github.com/protocolbuffers/protobuf/commits)

---
updated-dependencies:
- dependency-name: protobuf
  dependency-version: 6.33.5
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #16822 from rgacogne/ddist-noexcept

dnsdist: Add missing `noexcept` on move ctors/assignment operators

dnsdist: Fix formatting

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Add regression tests for DNS flags in ProtoBuf messages

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Set `QR=1` for responses triggered by timeout response rules

These are, after all, supposed to be responses by all the rules and
actions that are processing them.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Export DNS flags via ProtoBuf

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16796 from pieterlexis/dnsdist-dq-labels

feat(dnsdist): Add `prepend` and `append` methods to Lua DNSName

Merge pull request #16821 from rgacogne/cleanup-remove-useless-class

Remove unused `DNSRecordOracle` class

Merge pull request #16817 from omoerbeek/base64

Base64 tidy and unit test fix

Merge pull request #21 from rgacogne/base64

base64: Wrap `BIO` objects in smart pointers, keep the check always enabled for DNSdist

Merge pull request #16806 from rgacogne/ddist-ipcrypt2-auto-switch

dnsdist: Fix issues with `ipcrypt2`

dnsdist: Add missing `noexcept` on move ctors/assignment operators

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Remove unused `DNSRecordOracle` class

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

test-base64: Keep the check enabled for DNSdist even w/ recent OpenSSL versions

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

base64: Use `unsigned` constants

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

base64: Wrap `BIO` objects in smart pointers

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Apply Miod's suggestion from code review

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16820 from miodvallat/banana_arrow

Stricter timestamp checks

Merge pull request #16756 from omoerbeek/rec-ot-instance

rec: harmonize with dnsdist PR #16741 wrt OpenTelemetry instance name

Merge pull request #16786 from omoerbeek/rec-ot-edns

Opentelemetry: add flags field in TRACEPARENT EDNS option

Perform stricter validation of timestamps.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

There are only 24 hours in a day, not 60.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #16807 from clwluvw/default-soa-edit-api

auth: add default-soa-edit-api setting for API zone creation

Strongly suggest storing variants in the same backend as their regular zone.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Apply suggestions from code review

Co-authored-by: Miod Vallat <miod.vallat@powerdns.com>
Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Depending on openssl version, base 64 decode is more or less strict

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #16812 from PowerDNS/dependabot/pip/regression-tests.dnsdist/protobuf-6.33.5

build(deps): bump protobuf from 6.33.4 to 6.33.5 in /regression-tests.dnsdist

Merge pull request #16811 from PowerDNS/dependabot/pip/docs/wheel-0.46.2

build(deps): bump wheel from 0.45.1 to 0.46.2 in /docs

Reformat

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

More (allocation) error checking fix a type

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

auth: add default-soa-edit-api setting for API zone creation

Add a configurable default-soa-edit-api setting that sets the
SOA-EDIT-API metadata for zones created via the API when the
zone creation request does not include the soa_edit_api field.

Signed-off-by: Seena Fallah <seenafallah@gmail.com>

Do not print recommendations if quiet.

There are people out there using shell scripts to make nails out of
pdnsutil, do not make pdnsutil output parsing more difficult.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #16810 from miodvallat/discount

auth: correctly compute DNSSEC public key exponent lengths when larger than 255

Merge pull request #16802 from rgacogne/ddist-quiche-congestion-bbr

dnsdist: Work around Quiche not dealing well with removed congestion algorithms

Merge pull request #16805 from rgacogne/ddist-nicer-b64-error

dnsdist: Better handling of invalid Base64 content

build(deps): bump protobuf in /regression-tests.dnsdist

Bumps [protobuf](https://github.com/protocolbuffers/protobuf) from 6.33.4 to 6.33.5.
- [Release notes](https://github.com/protocolbuffers/protobuf/releases)
- [Commits](https://github.com/protocolbuffers/protobuf/commits)

---
updated-dependencies:
- dependency-name: protobuf
  dependency-version: 6.33.5
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

build(deps): bump wheel from 0.45.1 to 0.46.2 in /docs

Bumps [wheel](https://github.com/pypa/wheel) from 0.45.1 to 0.46.2.
- [Release notes](https://github.com/pypa/wheel/releases)
- [Changelog](https://github.com/pypa/wheel/blob/main/docs/news.rst)
- [Commits](https://github.com/pypa/wheel/compare/0.45.1...0.46.2)

---
updated-dependencies:
- dependency-name: wheel
  dependency-version: 0.46.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #16808 from PowerDNS/dependabot/cargo/pdns/recursordist/rec-rust-lib/rust/bytes-1.11.1

build(deps): bump bytes from 1.11.0 to 1.11.1 in /pdns/recursordist/rec-rust-lib/rust

Correctly compute public key exponent length when larger than 255.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

build(deps): bump bytes in /pdns/recursordist/rec-rust-lib/rust

Bumps [bytes](https://github.com/tokio-rs/bytes) from 1.11.0 to 1.11.1.
- [Release notes](https://github.com/tokio-rs/bytes/releases)
- [Changelog](https://github.com/tokio-rs/bytes/blob/master/CHANGELOG.md)
- [Commits](https://github.com/tokio-rs/bytes/compare/v1.11.0...v1.11.1)

---
updated-dependencies:
- dependency-name: bytes
  dependency-version: 1.11.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

dnsdist: Enable ipcrypt2 w/ autotools in our CI

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Disable ipcrypt2 by default w/ autotools

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Do NOT add `c++` flags to `CPPFLAGS`

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Fix files order in the ipcrypt2 Makefile

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Better detection of whether ipcrypt2 will compile

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Disable `ipcrypt2` support when testing the "least" features set

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Add an option to disable ipcrypt2 w/ autotools

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

ext/ipcrypt2: Add missing softaes/untrinsics.h header

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Add a unit test for invalid Base64 content

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Cleanup of base64-related header and unit tests

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>