Ignore the closing SOA record in IXFR-turned-AXFR.

Fixes: #12984
Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

dnsdist: Add the same basic response consistency check for DoQ/DoH3 queries

This check is only useful when the response has been received from the backend
over UDP, which is currently not supported for DoQ/DoH3 queries, and only to prevent
collisions as we otherwise do not validate the content of the response before forwarding
it to the client, but AI tools keep reporting this as a critical security issue. In any
case it will make sense to have this check once we support using UDP to the backend
for DoQ/DoH3-originated queries.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Fix the dropping of responses for DoQ and DoH queries

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #17716 from miodvallat/overoptimism

auth: stop being an optimist

Merge pull request #17711 from miodvallat/vertbaudet

pdnsutil: more checks in set-catalog

Merge pull request #17708 from omoerbeek/rec-named-interface

rec: allow explicitly named interface for source address

Merge pull request #17706 from miodvallat/qtypemismatch

auth: minor zone parsing tweaks

Merge pull request #17713 from esensar/feature/qlogdir

dnsdist: add qlogdir support for DoH3 and DOQ

Merge pull request #17692 from rgacogne/ddist-always-log-which-configuration-file-was-loaded

dnsdist: Always log which configuration file has been loaded

Pass the packet length to submitResponse() to avoid recomputing it.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Only update network statistics if we could actually send the packets.

Fixes: #15101
Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

dnsdist: use a helper function for qlog configuration

Signed-off-by: Ensar Sarajčić <dev@ensarsarajcic.com>

Update pdns/dnsdistdist/dnsdist-settings-definitions.yml

Co-authored-by: Remi Gacogne <github@coredump.fr>
Signed-off-by: Ensar Sarajčić <dev@ensarsarajcic.com>

Add logging

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Add universal ref ct

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

dnsdist: add qlogdir support for DoH3 and DOQ

Signed-off-by: Ensar Sarajčić <dev@ensarsarajcic.com>

Separate out expected.hh

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Process review comments from @rgacogne

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Check that the catalog zone actually is a catalog zone in set-catalog.

Fixes: #16772
Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #17695 from PowerDNS/dependabot/github_actions/astral-sh/ruff-action-4.1.0

build(deps): bump astral-sh/ruff-action from 4.0.0 to 4.1.0

Apply suggestions from code review

Co-authored-by: Miod Vallat <miod.vallat@powerdns.com>
Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

feat(dnsdist): Log TraceID in maintenance logs

feat(dnsdist): Log TraceID in structured logs

When a traced query generates a log message, log the TraceID as well fo
easier correlation.

Add a poor man's "std:expected" and use it in sendMsgwithOptions

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #17697 from pieterlexis/meson-test-timeouts

chore: Increase testrunner timeouts

Honour upgrade-unknown-types for zone load and zone edit.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Skip record content checks when provided as TYPE### and raw binary data.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #17671 from miodvallat/like,duh

auth, SQL: stricter listSubZones operation

Merge pull request #17666 from miodvallat/statoholic

Better reporting of filesystem errors

Merge pull request #17694 from miodvallat/waketr

Allow NAPTR additional processing to be disabled

Merge pull request #17693 from omoerbeek/rec-protobuf-stalled-config

rec: add handling of new protobuf logging parameter: stalledWriteTimeout

Merge pull request #17702 from pieterlexis/dnsdist-docs-rm-quote

docs(dnsdist): remove quoted lists

docs(dnsdist): remove quoted lists

These lists were accidentally quoted because they had a space prefixed.
This commit also fixes a few other, related rendering issues.

Merge pull request #17699 from PowerDNS/chore-add-pf-to-frontpage

Add platform-filter to frontpage

Add platform-filter to frontpage

feat(dnsdist): Add OTLP-related unit-tests

feat: add `operator==` to all ProtoZero Trace structs

feat(dnsdist): Create protozero-otlp.cc

feat: Add OTLP logger test

feat(dnsdist): More options and config for the OTLP Logger

feat(dnsdist): queue OTLP messages in the logger

Use config value if available

Co-authored-by: Remi Gacogne <github@coredump.fr>
Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #17696 from omoerbeek/rec-update-rust-crates

rec: Update our Rust deps

chore: Increase testrunner timeouts

Closes #17552

Merge pull request #17690 from rgacogne/ddist-update-rust-deps

dnsdist: Update our Rust deps

rec: Update our Rust deps

This fixes a low severity security issue in the cxx crate.

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

build(deps): bump astral-sh/ruff-action from 4.0.0 to 4.1.0

Bumps [astral-sh/ruff-action](https://github.com/astral-sh/ruff-action) from 4.0.0 to 4.1.0.
- [Release notes](https://github.com/astral-sh/ruff-action/releases)
- [Commits](https://github.com/astral-sh/ruff-action/compare/v4.0.0...v4.1.0)

---
updated-dependencies:
- dependency-name: astral-sh/ruff-action
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Add some comments on sendMsgWithOptions(), which has a surprising return value

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #17108 from rgacogne/ddist-max-oustanding-queries-per-backend

dnsdist: Implement per backend max outstanding queries

dnsdist: (Really) fix tests now that the loaded configuration file is printed

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Allow NAPTR additional processing to be disabled, on a global scale.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Move NAPTR additional processing to its own routine. NFCI

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Appease Miod

Co-authored-by: Miod Vallat <miod.vallat@powerdns.com>
Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

dnsdist: Reformat (again)

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

rec: add handling of new protobuf logging parameter: stalledWriteTimeout

While there, remove default parameters of RemoteLogger ct, as it is called
with all args (one exception in dnsdist fixed)

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

dnsdist: Python reformat

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #17689 from rgacogne/ddist-update-yml-lua-doc

dnsdist: Clarify that we will fall back to `dnsdist.conf`

Merge pull request #17691 from rgacogne/ddist-longer-timeout-for-dot-pp-tests

dnsdist: Use a longer timeout for DoT connections in the proxy tests

dnsdist: Always log which configuration file has been loaded

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Test DownstreamState::canAcceptQueries

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Use a longer timeout for DoT connections in the proxy tests

These tests regularly fail when the CI is overloaded, probably because
establishing the TLS connection is taking a long time.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Perform extra filtering of listSubZone results for SQL backends.

This makes sure that we do not return an out-of-zone result by mistake, due
to LIKE interpreting % or _ characters possibly found in a domain name as
wildcards.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

dnsdist: Fix brain farts spotted by Miod (thanks!)

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

rec: Log when NSEC signers are not part of the name we are validating

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Update our Rust deps

This fixes a security issue in the `cxx` crate.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Clarify that we will fall back to `dnsdist.conf`

If `dnsdist.yml` does not exist.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Add a Lua binding for `DownstreamState::canAcceptQueries`

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Replace boolean query kind with an enum. NFC yet.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #17542 from PowerDNS/feature/add-auth-51-to-repo-test-script

Add `auth-51` to repo test script.

Merge pull request #17541 from PowerDNS/feature/podman-support-for-repo-test-script

Add Podman support to repo test script.

Merge pull request #17660 from jsoref/issue-7568

Consider presigned while worrying about occlusion and seeing RRSIG

Consider presigned while worrying about occlusion

- Tolerate RRSIG for DS/NSEC

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

Split complicated if into readable assertions

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

Rename `rr` to `drr` to make clang-tidy happy

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

Run clang-format-19 on checkOcclusion block

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

feat(dnsdist): hook up OTLP logger to the config

feat(dnsdist): Add a simple OTLP exporter

Merge pull request #16888 from miodvallat/nsecession

auth: factor code responsible for the NSEC{,3} QType bitmap computation

Merge pull request #16542 from miodvallat/aschung

auth: Überbackend code cleanup

Merge pull request #17673 from miodvallat/tinypr

docs: tinydns precisions

Merge pull request #17657 from rgacogne/ddist-quic-connection-metrics

dnsdist: Implement missing connection metrics for QUIC frontends

Merge pull request #17680 from rgacogne/dist-update-quiche-0292

dnsdist: Update Quiche to 0.29.2 in our builds

Merge pull request #17678 from miodvallat/coverup

auth: yet another round of coverity-induced improvements

Merge pull request #17679 from miodvallat/neuronsoup

auth: preserve brain cells

Add an annotation to disable coverity from suggesting a wrong change.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Minor tweaks to avoid object copies, pointed at by Coverity.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

dnsdist: Update Quiche to 0.29.2 in our builds

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #17676 from pieterlexis/dnsdist-rm-kiss

fix(dnsdist): remove dangling symlink

Merge pull request #17675 from miodvallat/big-removal

auth: remove dead test

Merge pull request #17674 from pieterlexis/dnsdist-doc-fixes

dnsdist: some small documentation fixes

dnsdist: Document the difference between `maxInFlight` and `maxOutstandingQueries`

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

fix(dnsdist): remove dangling symlink

Merge pull request #17670 from rgacogne/ddist-eol-2.1.0

dnsdist: Update EOL statement now that 2.1.0 has been released

Remove test which has been disabled in 858309ed9c412c7d9976fd22a5429c7ac392c798.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

docs(dnsdist): better format the RemoteLogger IP encryption docs

Mention TinyDNS SOA record must have no location restriction.

Fixes: #13315
Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

docs(dnsdist): stop quoting versionadded/modified bumpers in YAML config docs

docs(dnsdist): Fix internal link to method

Merge pull request #17637 from jacob-masse/docs-dynblocks-external-webhook

docs(dnsdist): add webhook-triggered dynamic blocks guide

Add `auth-51` to repo test script.

Signed-off-by: aerique <aerique@xs4all.nl>