From 29d39da4a992336821079a0081b2ee63d1859703 Mon Sep 17 00:00:00 2001
From: Miod Vallat <miod.vallat@powerdns.com>
Date: Wed, 16 Apr 2025 17:35:39 +0200
Subject: [PATCH] clang-tidy all the things!

---
 modules/lmdbbackend/lmdbbackend.cc | 10 +++++-----
 pdns/auth-primarycommunicator.cc   | 11 ++++++-----
 pdns/auth-secondarycommunicator.cc | 11 +++++++++--
 pdns/axfr-retriever.cc             |  8 ++++----
 pdns/dbdnsseckeeper.cc             |  3 ++-
 pdns/dnsname.cc                    |  8 ++++----
 pdns/dnsname.hh                    |  4 ++--
 pdns/ixfrutils.cc                  |  6 +++---
 pdns/logger.cc                     |  4 ++--
 pdns/lua-auth4.cc                  |  2 +-
 pdns/packethandler.cc              | 10 ++++++----
 pdns/pdnsutil.cc                   |  6 ++++--
 pdns/rfc2136handler.cc             | 15 ++++++++++++---
 pdns/tcpreceiver.cc                |  2 +-
 14 files changed, 61 insertions(+), 39 deletions(-)

diff --git a/modules/lmdbbackend/lmdbbackend.cc b/modules/lmdbbackend/lmdbbackend.cc
index 8f6086e581..0bfb41265c 100644
--- a/modules/lmdbbackend/lmdbbackend.cc
+++ b/modules/lmdbbackend/lmdbbackend.cc
@@ -2386,7 +2386,7 @@ bool LMDBBackend::getBeforeAndAfterNames(uint32_t domainId, const ZoneName& zone
     // cout << "Hit end of database, bummer"<<endl;
     cursor.last(key, val);
     if (compoundOrdername::getDomainID(key.getNoStripHeader<string_view>()) == domainId) {
-      before = co.getQName(key.getNoStripHeader<string_view>()) + zonename.operator const DNSName&();
+      before = compoundOrdername::getQName(key.getNoStripHeader<string_view>()) + zonename.operator const DNSName&();
       after = zonename.operator const DNSName&();
     }
     // else
@@ -2417,7 +2417,7 @@ bool LMDBBackend::getBeforeAndAfterNames(uint32_t domainId, const ZoneName& zone
       after = zonename.operator const DNSName&();
       return false;
     }
-    after = co.getQName(key.getNoStripHeader<string_view>()) + zonename.operator const DNSName&();
+    after = compoundOrdername::getQName(key.getNoStripHeader<string_view>()) + zonename.operator const DNSName&();
     return true;
   }
 
@@ -2444,7 +2444,7 @@ bool LMDBBackend::getBeforeAndAfterNames(uint32_t domainId, const ZoneName& zone
         break;
     }
 
-    before = co.getQName(key.getNoStripHeader<string_view>()) + zonename.operator const DNSName&();
+    before = compoundOrdername::getQName(key.getNoStripHeader<string_view>()) + zonename.operator const DNSName&();
     // cout<<"Found: "<< before<<endl;
     return true;
   }
@@ -2456,7 +2456,7 @@ bool LMDBBackend::getBeforeAndAfterNames(uint32_t domainId, const ZoneName& zone
     LMDBResourceRecord lrr;
     deserializeFromBuffer(val.get<StringView>(), lrr);
     if (co.getQType(key.getNoStripHeader<string_view>()).getCode() && (lrr.auth || co.getQType(key.getNoStripHeader<string_view>()).getCode() == QType::NS)) {
-      after = co.getQName(key.getNoStripHeader<string_view>()) + zonename.operator const DNSName&();
+      after = compoundOrdername::getQName(key.getNoStripHeader<string_view>()) + zonename.operator const DNSName&();
       // cout <<"Found auth ("<<lrr.auth<<") or an NS record "<<after<<", type: "<<co.getQType(key.getNoStripHeader<string_view>()).toString()<<", ttl = "<<lrr.ttl<<endl;
       // cout << makeHexDump(val.get<string>()) << endl;
       break;
@@ -2482,7 +2482,7 @@ bool LMDBBackend::getBeforeAndAfterNames(uint32_t domainId, const ZoneName& zone
       // cout << "We hit the beginning of the zone or database.. now what" << endl;
       return false;
     }
-    before = co.getQName(key.getNoStripHeader<string_view>()) + zonename.operator const DNSName&();
+    before = compoundOrdername::getQName(key.getNoStripHeader<string_view>()) + zonename.operator const DNSName&();
     LMDBResourceRecord lrr;
     deserializeFromBuffer(val.get<string_view>(), lrr);
     // cout<<"And before to "<<before<<", auth = "<<rr.auth<<endl;
diff --git a/pdns/auth-primarycommunicator.cc b/pdns/auth-primarycommunicator.cc
index 4555886f6b..1513a958f6 100644
--- a/pdns/auth-primarycommunicator.cc
+++ b/pdns/auth-primarycommunicator.cc
@@ -53,6 +53,7 @@ void CommunicatorClass::queueNotifyDomain(const DomainInfo& di, UeberBackend* B)
 
   try {
     if (d_onlyNotify.size()) {
+      // NOLINTNEXTLINE(bugprone-narrowing-conversions,cppcoreguidelines-narrowing-conversions)
       B->lookup(QType(QType::NS), di.zone.operator const DNSName&(), di.id);
       while (B->get(rr))
         nsset.insert(getRR<NSRecordContent>(rr.dr)->getNS());
@@ -139,7 +140,7 @@ void CommunicatorClass::getUpdatedProducers(UeberBackend* B, vector<DomainInfo>&
   std::string metaHash;
   std::string mapHash;
   for (auto& ch : catalogHashes) {
-    if (!catalogs.count(ch.first.operator const DNSName&())) {
+    if (catalogs.count(ch.first.operator const DNSName&()) == 0) {
       g_log << Logger::Warning << "orphaned member zones found with catalog '" << ch.first << "'" << endl;
       continue;
     }
@@ -293,9 +294,9 @@ void CommunicatorClass::sendNotification(int sock, const ZoneName& domain, const
   }
 
   vector<uint8_t> packet;
-  DNSPacketWriter pw(packet, domain.operator const DNSName&(), QType::SOA, 1, Opcode::Notify);
-  pw.getHeader()->id = notificationId;
-  pw.getHeader()->aa = true;
+  DNSPacketWriter pwriter(packet, domain.operator const DNSName&(), QType::SOA, 1, Opcode::Notify);
+  pwriter.getHeader()->id = notificationId;
+  pwriter.getHeader()->aa = true;
 
   if (tsigkeyname.empty() == false) {
     if (!ueber->getTSIGKey(tsigkeyname, tsigalgorithm, tsigsecret64)) {
@@ -315,7 +316,7 @@ void CommunicatorClass::sendNotification(int sock, const ZoneName& domain, const
       g_log << Logger::Error << "Unable to Base-64 decode TSIG key '" << tsigkeyname << "' for domain '" << domain << "'" << endl;
       return;
     }
-    addTSIG(pw, trc, tsigkeyname, tsigsecret, "", false);
+    addTSIG(pwriter, trc, tsigkeyname, tsigsecret, "", false);
   }
 
   if (sendto(sock, &packet[0], packet.size(), 0, (struct sockaddr*)(&remote), remote.getSocklen()) < 0) {
diff --git a/pdns/auth-secondarycommunicator.cc b/pdns/auth-secondarycommunicator.cc
index 31d999709f..e63355af6c 100644
--- a/pdns/auth-secondarycommunicator.cc
+++ b/pdns/auth-secondarycommunicator.cc
@@ -87,6 +87,7 @@ struct ZoneStatus
   size_t numDeltas{0};
 };
 
+// NOLINTNEXTLINE(readability-function-cognitive-complexity)
 static bool catalogDiff(const DomainInfo& di, vector<CatalogInfo>& fromXFR, vector<CatalogInfo>& fromDB, const string& logPrefix)
 {
   extern CommunicatorClass Communicator;
@@ -483,6 +484,7 @@ void CommunicatorClass::ixfrSuck(const ZoneName& domain, const TSIGTriplet& tsig
         vector<DNSRecord> rrset;
         {
           DNSZoneRecord zrr;
+          // NOLINTNEXTLINE(bugprone-narrowing-conversions,cppcoreguidelines-narrowing-conversions)
           di.backend->lookup(QType(g.first.second), g.first.first.operator const DNSName&() + domain.operator const DNSName&(), di.id);
           while (di.backend->get(zrr)) {
             zrr.dr.d_name.makeUsRelative(domain);
@@ -763,8 +765,9 @@ void CommunicatorClass::suck(const ZoneName& domain, const ComboAddress& remote,
             rr.qname += domain.operator const DNSName&();
             rr.qname.makeUsLowerCase();
             rr.domain_id = zs.domain_id;
-            if (!processRecordForZS(domain.operator const DNSName&(), firstNSEC3, rr, zs))
+            if (!processRecordForZS(domain.operator const DNSName&(), firstNSEC3, rr, zs)) {
               continue;
+            }
             if (dr.d_type == QType::SOA) {
               auto sd = getRR<SOARecordContent>(dr);
               zs.soa_serial = sd->d_st.serial;
@@ -881,8 +884,9 @@ void CommunicatorClass::suck(const ZoneName& domain, const ComboAddress& remote,
         if (zs.nsset.count(shorter) && rr.qtype.getCode() != QType::DS)
           rr.auth = false;
 
-        if (shorter == domain.operator const DNSName&()) // stop at apex
+        if (shorter == domain.operator const DNSName&()) { // stop at apex
           break;
+        }
       } while (shorter.chopOff());
 
       // Insert ents
@@ -942,6 +946,7 @@ void CommunicatorClass::suck(const ZoneName& domain, const ComboAddress& remote,
     // Insert empty non-terminals
     if (doent && !nonterm.empty()) {
       if (zs.isNSEC3) {
+        // NOLINTNEXTLINE(bugprone-narrowing-conversions,cppcoreguidelines-narrowing-conversions)
         di.backend->feedEnts3(zs.domain_id, domain.operator const DNSName&(), nonterm, zs.ns3pr, zs.isNarrow);
       }
       else
@@ -1311,6 +1316,7 @@ void CommunicatorClass::secondaryRefresh(PacketHandler* P)
     SOAData sd;
     try {
       // Use UeberBackend cache for SOA. Cache gets cleared after AXFR/IXFR.
+      // NOLINTNEXTLINE(bugprone-narrowing-conversions,cppcoreguidelines-narrowing-conversions)
       B->lookup(QType(QType::SOA), di.zone.operator const DNSName&(), di.id, nullptr);
       DNSZoneRecord zr;
       hasSOA = B->get(zr);
@@ -1334,6 +1340,7 @@ void CommunicatorClass::secondaryRefresh(PacketHandler* P)
     else if (hasSOA && theirserial == ourserial) {
       uint32_t maxExpire = 0, maxInception = 0;
       if (checkSignatures && dk.isPresigned(di.zone)) {
+        // NOLINTNEXTLINE(bugprone-narrowing-conversions,cppcoreguidelines-narrowing-conversions)
         B->lookup(QType(QType::RRSIG), di.zone.operator const DNSName&(), di.id); // can't use DK before we are done with this lookup!
         DNSZoneRecord zr;
         while (B->get(zr)) {
diff --git a/pdns/axfr-retriever.cc b/pdns/axfr-retriever.cc
index d3e0c2b914..adac75b482 100644
--- a/pdns/axfr-retriever.cc
+++ b/pdns/axfr-retriever.cc
@@ -57,8 +57,8 @@ AXFRRetriever::AXFRRetriever(const ComboAddress& remote,
     d_soacount = 0;
   
     vector<uint8_t> packet;
-    DNSPacketWriter pw(packet, DNSName(domain), QType::AXFR);
-    pw.getHeader()->id = dns_random_uint16();
+    DNSPacketWriter pwriter(packet, DNSName(domain), QType::AXFR);
+    pwriter.getHeader()->id = dns_random_uint16();
 
     if (!tsigConf.name.empty()) {
       if (tsigConf.algo == DNSName("hmac-md5")) {
@@ -69,9 +69,9 @@ AXFRRetriever::AXFRRetriever(const ComboAddress& remote,
       }
       d_trc.d_time = time(nullptr);
       d_trc.d_fudge = 300;
-      d_trc.d_origID=ntohs(pw.getHeader()->id);
+      d_trc.d_origID=ntohs(pwriter.getHeader()->id);
       d_trc.d_eRcode=0;
-      addTSIG(pw, d_trc, tsigConf.name, tsigConf.secret, "", false);
+      addTSIG(pwriter, d_trc, tsigConf.name, tsigConf.secret, "", false);
     }
   
     uint16_t replen=htons(packet.size());
diff --git a/pdns/dbdnsseckeeper.cc b/pdns/dbdnsseckeeper.cc
index 7d1ae97f6c..c8ec62d910 100644
--- a/pdns/dbdnsseckeeper.cc
+++ b/pdns/dbdnsseckeeper.cc
@@ -779,8 +779,9 @@ bool DNSSECKeeper::rectifyZone(const ZoneName& zone, string& error, string& info
     if (rr.qtype.getCode())
     {
       qnames.insert(rr.qname);
-      if(rr.qtype.getCode() == QType::NS && rr.qname != zone.operator const DNSName&())
+      if(rr.qtype.getCode() == QType::NS && rr.qname != zone.operator const DNSName&()) {
         nsset.insert(rr.qname);
+      }
       if(rr.qtype.getCode() == QType::DS)
         dsnames.insert(rr.qname);
       rrs.emplace_back(rr);
diff --git a/pdns/dnsname.cc b/pdns/dnsname.cc
index 0b5c8421de..4f735d8f08 100644
--- a/pdns/dnsname.cc
+++ b/pdns/dnsname.cc
@@ -732,14 +732,14 @@ bool DNSName::RawLabelsVisitor::empty() const
 }
 
 #if defined(PDNS_AUTH) // [
-std::ostream & operator<<(std::ostream &os, const ZoneName& d)
+std::ostream & operator<<(std::ostream &ostr, const ZoneName& zone)
 {
-  return os <<d.toLogString();
+  return ostr << zone.toLogString();
 }
 
-size_t hash_value(ZoneName const& d)
+size_t hash_value(ZoneName const& zone)
 {
-  return d.hash();
+  return zone.hash();
 }
 
 // Sugar while ZoneName::operator DNSName are made explicit. These can't be
diff --git a/pdns/dnsname.hh b/pdns/dnsname.hh
index 74a7392376..1c2e591bd2 100644
--- a/pdns/dnsname.hh
+++ b/pdns/dnsname.hh
@@ -381,9 +381,9 @@ private:
   DNSName d_name;
 };
 
-size_t hash_value(ZoneName const& d);
+size_t hash_value(ZoneName const& zone);
 
-std::ostream & operator<<(std::ostream &os, const ZoneName& d);
+std::ostream & operator<<(std::ostream &ostr, const ZoneName& zone);
 namespace std {
     template <>
     struct hash<ZoneName> {
diff --git a/pdns/ixfrutils.cc b/pdns/ixfrutils.cc
index 3de6f22d32..2eae98ec87 100644
--- a/pdns/ixfrutils.cc
+++ b/pdns/ixfrutils.cc
@@ -34,15 +34,15 @@
 uint32_t getSerialFromPrimary(const ComboAddress& primary, const ZoneName& zone, shared_ptr<const SOARecordContent>& soarecord, const TSIGTriplet& tsig, const uint16_t timeout)
 {
   vector<uint8_t> packet;
-  DNSPacketWriter pw(packet, zone.operator const DNSName&(), QType::SOA);
+  DNSPacketWriter pwriter(packet, zone.operator const DNSName&(), QType::SOA);
   if(!tsig.algo.empty()) {
     TSIGRecordContent trc;
     trc.d_algoName = tsig.algo;
     trc.d_time = time(nullptr);
     trc.d_fudge = 300;
-    trc.d_origID=ntohs(pw.getHeader()->id);
+    trc.d_origID=ntohs(pwriter.getHeader()->id);
     trc.d_eRcode=0;
-    addTSIG(pw, trc, tsig.name, tsig.secret, "", false);
+    addTSIG(pwriter, trc, tsig.name, tsig.secret, "", false);
   }
 
   Socket s(primary.sin4.sin_family, SOCK_DGRAM);
diff --git a/pdns/logger.cc b/pdns/logger.cc
index caa27dfd36..77a4ce5fd4 100644
--- a/pdns/logger.cc
+++ b/pdns/logger.cc
@@ -212,9 +212,9 @@ Logger& Logger::operator<<(const DNSName& d)
 }
 
 #if defined(PDNS_AUTH)
-Logger& Logger::operator<<(const ZoneName& d)
+Logger& Logger::operator<<(const ZoneName& zone)
 {
-  *this << d.toLogString();
+  *this << zone.toLogString();
 
   return *this;
 }
diff --git a/pdns/lua-auth4.cc b/pdns/lua-auth4.cc
index 7a3468eb42..18f235b3c5 100644
--- a/pdns/lua-auth4.cc
+++ b/pdns/lua-auth4.cc
@@ -65,7 +65,7 @@ void AuthLua4::postPrepareContext() {
   d_lw->registerFunction<DNSPacket, std::unordered_map<unsigned int, DNSRecord>()>("getRRS", [](DNSPacket &p){ std::unordered_map<unsigned int, DNSRecord> ret; unsigned int i = 0; for(const auto &rec: p.getRRS()) { ret.insert({i++, rec.dr}); } return ret;});
   d_lw->registerMember<DNSPacket, DNSName>("qdomain", [](const DNSPacket &p) -> DNSName { return p.qdomain; }, [](DNSPacket &p, const DNSName& name) { p.qdomain = name; });
   d_lw->registerMember<DNSPacket, DNSName>("qdomainwild", [](const DNSPacket &p) -> DNSName { return p.qdomainwild; }, [](DNSPacket &p, const DNSName& name) { p.qdomainwild = name; });
-  d_lw->registerMember<DNSPacket, DNSName>("qdomainzone", [](const DNSPacket &p) -> DNSName { return p.qdomainzone.operator const DNSName&(); }, [](DNSPacket &p, const DNSName& name) { p.qdomainzone = ZoneName(name); });
+  d_lw->registerMember<DNSPacket, DNSName>("qdomainzone", [](const DNSPacket &pkt) -> DNSName { return pkt.qdomainzone.operator const DNSName&(); }, [](DNSPacket &pkt, const DNSName& name) { pkt.qdomainzone = ZoneName(name); });
 
   d_lw->registerMember<DNSPacket, std::string>("d_peer_principal", [](const DNSPacket &p) -> std::string { return p.d_peer_principal; }, [](DNSPacket &p, const std::string &princ) { p.d_peer_principal = princ; });
   d_lw->registerMember<DNSPacket, const std::string>("qtype", [](const DNSPacket &p) ->  const std::string { return p.qtype.toString(); }, [](DNSPacket &p, const std::string &type) { p.qtype = type; });
diff --git a/pdns/packethandler.cc b/pdns/packethandler.cc
index 8ea1b013a0..ed8f530a15 100644
--- a/pdns/packethandler.cc
+++ b/pdns/packethandler.cc
@@ -455,6 +455,7 @@ bool PacketHandler::getBestWildcard(DNSPacket& p, const DNSName &target, DNSName
         ret->push_back(rr);
       }
 
+      // NOLINTNEXTLINE(readability-misleading-indentation): go home, clang-tidy, you're drunk
       wildcard=g_wildcarddnsname+subdomain;
       haveSomething=true;
     }
@@ -711,7 +712,7 @@ void PacketHandler::emitNSEC(std::unique_ptr<DNSPacket>& r, const DNSName& name,
     }
     else
 #endif
-      if (d_doExpandALIAS && rr.dr.d_type == QType::ALIAS) {
+    if (d_doExpandALIAS && rr.dr.d_type == QType::ALIAS) {
       // Set the A and AAAA in the NSEC bitmap so aggressive NSEC
       // does not falsely deny the type for this name.
       // This does NOT add the ALIAS to the bitmap, as that record cannot
@@ -797,7 +798,7 @@ void PacketHandler::emitNSEC3(std::unique_ptr<DNSPacket>& r, const NSEC3PARAMRec
       }
       else
 #endif
-        if (d_doExpandALIAS && rr.dr.d_type == QType::ALIAS) {
+      if (d_doExpandALIAS && rr.dr.d_type == QType::ALIAS) {
         // Set the A and AAAA in the NSEC3 bitmap so aggressive NSEC
         // does not falsely deny the type for this name.
         // This does NOT add the ALIAS to the bitmap, as that record cannot
@@ -1114,6 +1115,7 @@ int PacketHandler::tryAutoPrimarySynchronous(const DNSPacket& p, const DNSName&
       g_log << Logger::Error << "Failed to create " << zonename << " for potential autoprimary " << remote << endl;
       return RCode::ServFail;
     }
+    // NOLINTNEXTLINE(bugprone-narrowing-conversions,cppcoreguidelines-narrowing-conversions)
     g_zoneCache.add(zonename, di.id);
     if (tsigkeyname.empty() == false) {
       vector<string> meta;
@@ -1164,7 +1166,7 @@ int PacketHandler::processNotify(const DNSPacket& p)
       return RCode::Refused;
     }
     vector<string> meta;
-    if (B.getDomainMetadata(zonename,"AXFR-MASTER-TSIG",meta) && meta.size() > 0) {
+    if (B.getDomainMetadata(zonename,"AXFR-MASTER-TSIG",meta) && !meta.empty()) {
       DNSName expected{meta[0]};
       if (p.getTSIGKeyname() != expected) {
         g_log<<Logger::Warning<<"Received secure NOTIFY for "<<zonename<<" from "<<p.getRemoteString()<<": expected TSIG key '"<<expected<<"', got '"<<p.getTSIGKeyname()<<"' (Refused)"<<endl;
@@ -1176,7 +1178,7 @@ int PacketHandler::processNotify(const DNSPacket& p)
   // Domain verification
   //
   DomainInfo di;
-  if(!B.getDomainInfo(zonename, di, false) || !di.backend) {
+  if(!B.getDomainInfo(zonename, di, false) || di.backend == nullptr) {
     if(::arg().mustDo("autosecondary")) {
       g_log << Logger::Warning << "Received NOTIFY for " << zonename << " from " << p.getRemoteString() << " for which we are not authoritative, trying autoprimary" << endl;
       return tryAutoPrimary(p, p.getTSIGKeyname());
diff --git a/pdns/pdnsutil.cc b/pdns/pdnsutil.cc
index 467403e7c3..65d3a2f965 100644
--- a/pdns/pdnsutil.cc
+++ b/pdns/pdnsutil.cc
@@ -1343,7 +1343,7 @@ static int editZone(const ZoneName &zone, const PDNSColors& col) {
     unixDie("Editing file with: '"+cmdline+"', perhaps set EDITOR variable");
   }
   cmdline.clear();
-  ZoneParserTNG zpt(tmpnam, ZoneName(g_rootdnsname));
+  ZoneParserTNG zpt(static_cast<const char *>(tmpnam), ZoneName(g_rootdnsname));
   zpt.setMaxGenerateSteps(::arg().asNum("max-generate-steps"));
   zpt.setMaxIncludes(::arg().asNum("max-include-depth"));
   DNSResourceRecord zrr;
@@ -1986,7 +1986,7 @@ static void testSpeed(const ZoneName& zone, int cores)
     rr.content=tmp;
 
     snprintf(tmp, sizeof(tmp), "r-%u", rnd);
-    rr.qname=DNSName(tmp)+zone.operator const DNSName&();
+    rr.qname=DNSName(static_cast<const char *>(tmp))+zone.operator const DNSName&();
     DNSZoneRecord dzr;
     dzr.dr=DNSRecord(rr);
     if(csp.submit(dzr))
@@ -2265,6 +2265,7 @@ static bool showZone(DNSSECKeeper& dnsseckeeper, const ZoneName& zone, bool expo
     vector<DNSKEYRecordContent> keys;
     DNSZoneRecord zr;
 
+    // NOLINTNEXTLINE(bugprone-narrowing-conversions,cppcoreguidelines-narrowing-conversions)
     di.backend->lookup(QType(QType::DNSKEY), zone.operator const DNSName&(), di.id );
     while(di.backend->get(zr)) {
       keys.push_back(*getRR<DNSKEYRecordContent>(zr.dr));
@@ -2519,6 +2520,7 @@ static int testSchema(DNSSECKeeper& dsk, const ZoneName& zone)
   cout<<"Committing"<<endl;
   db->commitTransaction();
   cout<<"Querying TXT"<<endl;
+  // NOLINTNEXTLINE(bugprone-narrowing-conversions,cppcoreguidelines-narrowing-conversions)
   db->lookup(QType(QType::TXT), zone.operator const DNSName&(), di.id);
   if(db->get(rrget))
   {
diff --git a/pdns/rfc2136handler.cc b/pdns/rfc2136handler.cc
index d6a0da6f8a..23a9700603 100644
--- a/pdns/rfc2136handler.cc
+++ b/pdns/rfc2136handler.cc
@@ -99,6 +99,7 @@ int PacketHandler::checkUpdatePrescan(const DNSRecord *rr) {
 
 
 // Implements section 3.4.2 of RFC2136
+// NOLINTNEXTLINE(readability-function-cognitive-complexity)
 uint PacketHandler::performUpdate(const string &msgPrefix, const DNSRecord *rr, DomainInfo *di, bool isPresigned, bool* narrow, bool* haveNSEC3, NSEC3PARAMRecordContent *ns3pr, bool *updatedSerial) {
 
   QType rrType = QType(rr->d_type);
@@ -276,18 +277,21 @@ uint PacketHandler::performUpdate(const string &msgPrefix, const DNSRecord *rr,
             break;
 
           bool foundShorter = false;
+          // NOLINTNEXTLINE(bugprone-narrowing-conversions,cppcoreguidelines-narrowing-conversions)
           di->backend->lookup(QType(QType::ANY), shorter.operator const DNSName&(), di->id);
           while (di->backend->get(rec)) {
             if (rec.qname == rr->d_name && rec.qtype == QType::DS)
               fixDS = true;
-            if (shorter.operator const DNSName&() != rr->d_name)
+            if (shorter.operator const DNSName&() != rr->d_name) {
               foundShorter = true;
+            }
             if (rec.qtype == QType::NS) // are we inserting below a delegate?
               auth=false;
           }
 
-          if (!foundShorter && auth && shorter.operator const DNSName&() != rr->d_name) // haven't found any record at current level, insert ENT.
+          if (!foundShorter && auth && shorter.operator const DNSName&() != rr->d_name) { // haven't found any record at current level, insert ENT.
             insnonterm.insert(shorter.operator const DNSName&());
+          }
           if (foundShorter)
             break; // if we find a shorter record, we can stop searching
         } while(shorter.chopOff());
@@ -335,6 +339,7 @@ uint PacketHandler::performUpdate(const string &msgPrefix, const DNSRecord *rr,
         DLOG(g_log<<msgPrefix<<"Going to fix auth flags below "<<rr->d_name<<endl);
         insnonterm.clear(); // No ENT's are needed below delegates (auth=0)
         vector<DNSName> qnames;
+        // NOLINTNEXTLINE(bugprone-narrowing-conversions,cppcoreguidelines-narrowing-conversions)
         di->backend->listSubZone(ZoneName(rr->d_name), di->id);
         while(di->backend->get(rec)) {
           if (rec.qtype.getCode() && rec.qtype.getCode() != QType::DS && rr->d_name != rec.qname) // Skip ENT, DS and our already corrected record.
@@ -401,8 +406,9 @@ uint PacketHandler::performUpdate(const string &msgPrefix, const DNSRecord *rr,
     di->backend->lookup(rrType, rr->d_name, di->id);
     while(di->backend->get(rec)) {
       if (rr->d_class == QClass::ANY) { // 3.4.2.3
-        if (rec.qname == di->zone.operator const DNSName&() && (rec.qtype == QType::NS || rec.qtype == QType::SOA)) // Never delete all SOA and NS's
+        if (rec.qname == di->zone.operator const DNSName&() && (rec.qtype == QType::NS || rec.qtype == QType::SOA)) { // Never delete all SOA and NS's
           rrset.push_back(rec);
+        }
         else
           recordsToDelete.push_back(rec);
       }
@@ -433,6 +439,7 @@ uint PacketHandler::performUpdate(const string &msgPrefix, const DNSRecord *rr,
       // If we've removed a delegate, we need to reset ordername/auth for some records.
       if (rrType == QType::NS && rr->d_name != di->zone.operator const DNSName&()) { 
         vector<DNSName> belowOldDelegate, nsRecs, updateAuthFlag;
+        // NOLINTNEXTLINE(bugprone-narrowing-conversions,cppcoreguidelines-narrowing-conversions)
         di->backend->listSubZone(ZoneName(rr->d_name), di->id);
         while (di->backend->get(rec)) {
           if (rec.qtype.getCode()) // skip ENT records, they are always auth=false
@@ -474,6 +481,7 @@ uint PacketHandler::performUpdate(const string &msgPrefix, const DNSRecord *rr,
       // on that level. If so, we must insert an ENT record.
       // We take extra care here to not 'include' the record that we just deleted. Some backends will still return it as they only reload on a commit.
       bool foundDeeper = false, foundOtherWithSameName = false;
+      // NOLINTNEXTLINE(bugprone-narrowing-conversions,cppcoreguidelines-narrowing-conversions)
       di->backend->listSubZone(ZoneName(rr->d_name), di->id);
       while (di->backend->get(rec)) {
         if (rec.qname == rr->d_name && !count(recordsToDelete.begin(), recordsToDelete.end(), rec))
@@ -963,6 +971,7 @@ int PacketHandler::processUpdate(DNSPacket& packet) { // NOLINT(readability-func
     if (nsRRtoDelete.size()) {
       vector<DNSResourceRecord> nsRRInZone;
       DNSResourceRecord rec;
+      // NOLINTNEXTLINE(bugprone-narrowing-conversions,cppcoreguidelines-narrowing-conversions)
       di.backend->lookup(QType(QType::NS), di.zone.operator const DNSName&(), di.id);
       while (di.backend->get(rec)) {
         nsRRInZone.push_back(rec);
diff --git a/pdns/tcpreceiver.cc b/pdns/tcpreceiver.cc
index 1b27dff0a7..b5d22eea86 100644
--- a/pdns/tcpreceiver.cc
+++ b/pdns/tcpreceiver.cc
@@ -1265,7 +1265,7 @@ int TCPNameserver::doIXFR(std::unique_ptr<DNSPacket>& q, int outsock)
   }
 
   if (serialPermitsIXFR) {
-    ZoneName target = zonename;
+    const ZoneName& target = zonename;
     TSIGRecordContent trc;
     DNSName tsigkeyname;
     string tsigsecret;
-- 
2.47.2