Merge pull request #17126 from miodvallat/createhex

auth lua: one more bad case of createForward

Merge pull request #17044 from PowerDNS/dependabot/pip/meson/requests-2.33.0

build(deps): bump requests from 2.32.4 to 2.33.0 in /meson

Merge pull request #17046 from PowerDNS/dependabot/pip/regression-tests.api/requests-2.33.0

build(deps): bump requests from 2.32.4 to 2.33.0 in /regression-tests.api

Merge pull request #17130 from miodvallat/dynlistentome

auth: some pdns_control love

Merge pull request #17129 from rgacogne/ddist-coverity-cid-502893

dnsdist: Fix a warning from Coverity about unintentional copy

Merge pull request #17128 from omoerbeek/rec-coverity-lua

rec: minor optimization from Coverity

Give some details about control socket setup and access control.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

rec: minor optimization from Coverity

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

dnsdist: Fix a warning from Coverity about unintentional copy

It is intentional, so make it clear.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #17127 from kpfleming/complete-rename-swagger-to-openapi

Complete the transition from Swagger to OpenAPI

Merge pull request #17125 from pieterlexis/dnsdist-padding-ecs

feat(dnsdist): Test for Frontend padding and backend ECS

Complete the transition from Swagger to OpenAPI

Remove one remaining reference to Swagger in the documentation, and
rename the API schema file to use 'openapi' instead of
'swagger'. These are all internal (build system and other) changes and
should have no effect on users.

Signed-off-by: Kevin P. Fleming <kevin@km6g.us>

Add a test with trailing hex digits for createfoward 1-2-3-4.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Reject trailing hex digits in createforward 1-2-3-4 format.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

feat(dnsdist): Test for Frontend padding and backend ECS

Make more use of all-zeros strings. NFC

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #17123 from miodvallat/backtick

fix markdown error

Remove spurious backticks.

Closes: #17111
Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #17120 from rgacogne/ddist-coverity-20260408

dnsdist: Fix some warnings reported by Coverity

dnsdist: Fix some warnings reported by Coverity

Being more consistent when moving `RemoteLogActionConfiguration` objects.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #17081 from rgacogne/ddist-dont-keep-parsed-edns-options-around

dnsdist: Do not keep the parsed EDNS options around

Merge pull request #17058 from rgacogne/ddist-move-dnsname-response-ring

dnsdist: Move the existing DNSName into the response rings

build(deps): bump requests in /regression-tests.api

Bumps [requests](https://github.com/psf/requests) from 2.32.4 to 2.33.0.
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](https://github.com/psf/requests/compare/v2.32.4...v2.33.0)

---
updated-dependencies:
- dependency-name: requests
  dependency-version: 2.33.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

build(deps): bump requests from 2.32.4 to 2.33.0 in /meson

Bumps [requests](https://github.com/psf/requests) from 2.32.4 to 2.33.0.
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](https://github.com/psf/requests/compare/v2.32.4...v2.33.0)

---
updated-dependencies:
- dependency-name: requests
  dependency-version: 2.33.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #17115 from pieterlexis/dnsdist-yw-202-padding

dnsdist: Actually pad responses

Merge pull request #17119 from pieterlexis/update-py-deps

chore: Update all python dependencies

dnsdist: Pass copies of EDNS options to Lua, views are error-prone

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Do not keep the parsed EDNS options around

The idea to keep the EDNS options around to avoid parsing them
a second time was a nice one, but invalidation is error-prone and
this is rarely useful in practice.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

chore: Update all python dependencies

Merge pull request #17117 from ronhombre/fix/cpq-use-after-move-doh3

Hardened DoH3 internal error handling for cpq

chore(dnsdist): Add unit tests for addEDNSPadding

Merge pull request #17116 from pieterlexis/dnsdist-remove-debug

chore(dnsdist): clean up troubleshooting code

Hardened DoH3 internal error handling for cpq

Added a check for cpq before releasing DU to handle exceptional cases.

Signed-off-by: Ron Lauren Hombre <118486316+ronhombre@users.noreply.github.com>

fix(dnsdist): allow adding empty options in addOrReplaceEDNSOption

fix(dnsdist): actually pad responses when requested

feat(dnsdist): test self-answered, padded DOH

fix(dnsdist): do not let dnspython pad responses

chore(dnsdist): clean up troubleshooting code

Merge pull request #17114 from ronhombre/fix/cpq-use-after-move

Hardened DoQ internal error handling for cpq

Merge pull request #17110 from ronhombre/fix/give-tcp-thread-to-doq-and-doh3

Give TCP thread as default for definition USE_SINGLE_ACCEPTOR_THREAD

Hardened DoQ internal error handling for cpq

Added a check for cpq before releasing DU to handle exceptional cases.

Signed-off-by: Ron Lauren Hombre <118486316+ronhombre@users.noreply.github.com>

Merge branch 'PowerDNS:master' into fix/give-tcp-thread-to-doq-and-doh3

Merge pull request #17112 from jsoref/check-spelling-0.0.26

Upgrade check-spelling to v0.0.26

Simplify TCP client thread initialization

Removed conditional TCP client thread creation and make them the default for definition USE_SINGLE_ACCEPTOR_THREAD

Signed-off-by: Ron Lauren Hombre <118486316+ronhombre@users.noreply.github.com>

Merge pull request #17070 from rgacogne/ddist-ywh-102

dnsdist: Fix use-after-free in EDNS options handling

Upgrade check-spelling to v0.0.26

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

spelling: whether or not

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

spelling: see

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

spelling: please

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

spelling: lowercase

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

spelling: configuration:

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

spelling: better or worse

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

spelling: be

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

spelling: auth-zone:

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

spelling: also

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

spelling: a

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

Use internet archive link

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

Give TCP thread for DoQ and DoH3

On OpenWRT, the dnsdist implementation isn't normally built with DoQ and DoH3 due to the lack of quiche support. However, when it is enabled and queried through QUIC, dnsdist sees that the connection we have is too big and goes out of its way to try to use TCP to make that request upstream when using PROXYv2.

This fixes that by checking if DoQ or DoH3 are enabled so that in certain configurations with only DoQ or DoH3 enabled, a TCP thread is given to the internal client.

Signed-off-by: Ron Lauren Hombre <118486316+ronhombre@users.noreply.github.com>

Merge pull request #16970 from omoerbeek/rec-rpz-vs-cache

rec: RPZ add auto cache flush of packet cache feature on RPZ updates

Merge pull request #17062 from pieterlexis/dnsdist-docs-rm-old-changed

docs(dnsdist): Remove all version changes pre-1.9

docs(dnsdist): Remove all version changes pre-1.9

Zap debug line

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #17102 from rgacogne/ddist-ywh-172

dnsdist: Do not oversize the received buffer with `recvmmsg`

Merge pull request #17017 from rgacogne/ddist-remotelogaction-export-tags-prefixes

dnsdist: Add more options to select which tags to export over ProtoBuf

Merge pull request #17105 from rgacogne/ci-disable-tsan-arm

dnsdist: Do not run our tests under TSAN on ARM

Correct default value, from @pieterlexis

Co-authored-by: Pieter Lexis <pieter@plexis.eu>
Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #17104 from rgacogne/curl-fail

builder-support: Call `curl` with `--fail` in our scripts

dnsdist: Do not run our tests under TSAN on ARM

TSAN-enabled builds crash for no indentifiable reason on ARM
so for now let's disable them.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #17103 from rgacogne/ddist-quiche-0.28.0

dnsdist: Update our version of Quiche to 0.28.0

dnsdist: Increment our metrics in a consistent order to appease Miod!

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

builder-support: Call `curl` with `--fail` in our scripts

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #17069 from rgacogne/ddist-ywh-94

dnsdist: Prevent unbounded memory allocation for DoQ/DoH3

dnsdist: Reformat regression tests with ruff

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #17101 from rgacogne/rec-aggressive-nsec-transition

rec: Better handling of RFC5155 transitions in the aggressive NSEC cache

dnsdist: Update our version of Quiche to 0.28.0

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Do not oversize the received buffer with `recvmmsg`

Passing `MSG_TRUNC` to `recvmmsg` causes the Linux kernel to report
the real size of the datagram even if it was longer than the passed
buffer, which is not what we want here as it would be wasteful to
resize our internal buffer to this size.

This was reported by komaku in #YWH-PGM6095-172, many thanks!.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

rec: Better aggressive NSEC cache type to string handling

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

rec: Better handling of RFC5155 transitions in the aggressive NSEC cache

This commit ensures that we do not cache NSEC and NSEC3 records for the
same zone at the same time, which could lead to surprises during
NSEC -> NSEC3 or NSEC3 -> NSEC transitions as described in RFC5155 sections
10.4 and 10.5.
The existing code was correctly handling the NSEC -> NSEC3 transition
by clearing any existing NSEC records when a NSEC3 record was received
for a zone, but this behaviour could have been problematic for NSEC3
to NSEC transitions.
The new behaviour is to refuse to insert records during the transition,
keeping the existing entries until they expire.

This was reported by:
- Qifan Zhang (Palo Alto Networks) qzhang@paloaltonetworks.com
- Zilin Shen (Purdue University) shen624@purdue.edu
- Imtiaz Karim (The University of Texas at Dallas) imtiaz.karim@utdallas.edu
- Elisa Bertino (Purdue University) bertino@purdue.edu
- Daiping Liu (Palo Alto Networks) dpliu@paloaltonetworks.com
- Zhou Li (University of California, Irvine) zhou.li@uci.edu

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Reformat regression tests with ruff

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Add "too large" and "too many headers" regression tests

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Use a smart pointer for DoH3 events

I don't see any issue right away but let's make sure we don't leak.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Cap the maximum amount of HTTP headers on incoming queries

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Prevent unbounded memory allocation for DoQ queries

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Prevent unbounded memory allocation for DoH3 queries

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Fix use-after-free in EDNS options handling

I think a better fix is going to be to get rid of the caching,
but the patch would be significantly bigger so let's go with this
for now.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #17077 from rgacogne/ywh-137

dnsparser: Harden the DNS parser against malformed records

Merge pull request #17076 from rgacogne/handle-malformed-pointers-in-dnswriter

Handle malformed pointers in dnswriter

Merge pull request #17035 from miodvallat/umentation

auth: minor doc tweaks

Merge pull request #17079 from omoerbeek/doc-plexus

docs: Add Plexus to front page

Merge pull request #17080 from rgacogne/ddist-fix-doh-regression-tests-formatting-master

dnsdist: Fix the formatting of `test_DOH.py`

dnsdist: Fix the formatting of `test_DOH.py`

I made the mistake of merging one PR where the formatting was not right,
and now it makes a lot of PRs that are not touching this code unhappy.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #17071 from rgacogne/ywh-115

DNSWriter: Prevent overflow when generating (too) large DNS packets

dnsdist: Reformat regression tests with ruff

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Reformat regression tests with ruff

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Add Plexus to front page

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #17065 from rgacogne/ddist-fix-js

dnsdist: Fix HTML injection in the Web dashboard

auth: Implement `consumeRemaining` in DNSParser, DNSWriter, RecordTextReader and RecordTextWriter

This is needed to deal with a bug (#17000) in the authoritative code that at
some point created non-empty ENT records in our databases.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Update unit tests for parsing issues now reported earlier in the process

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

auth: Fix invalid TKEY payload in our tests

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Warn early when parsing a too large DNS record

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>