rec: Prep for rec 5.2.11, 5.3.8, 5.4.3

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #17613 from rgacogne/ddist-1.9.15-2.0.7-changelog-secpoll

dnsdist: Update ChangeLog and secpoll for 1.9.15, 2.0.7

dnsdist: Update ChangeLog and secpoll for 1.9.15, 2.0.7

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Do not put a trailing space for empty record contents of unknown type.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #17592 from miodvallat/doc_sa_2026_07

auth: 4.9.16, 5.0.6 and 5.1.2 documentation updates

Merge pull request #17588 from miodvallat/sa_2026_07

auth: fixes for SA 2026-07

documentation and secpoll update for auth 4.9.16, 5.0.6 and 5.1.2

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Do not allow chunk size lines to be larger than 100 bytes.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

rec: Also check that the NSEC next name is in the zone during validation

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

rec: Sanitize NSECs whose next names are out of the zone

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

rec: Don't insert NSECs whose next names are out of zone in the aggressive NSEC cache

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

rec: Fix log message, as suggested by Miod

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

rec: Also check the validity of the RRSIG labels count when looking for a wildcard

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

rec: Harden `getMessageForRRSET()` against RRSIGs with too few labels

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

rec: Discard RRSIG with too few labels

Otherwise we might allow out-of-zone wildcards to go through.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

rec: Fix invalid RRSIG in one unit test

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

rec: Add a unit test checking that we discard RRSIG with too few labels

Otherwise we might allow an out-of-zone wildcard to go through.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Trivial code factorization.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Reject numerical record type values which do not fit in 16 bits.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Do not try to normalize json input for unknown record types.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

failing test for generic record type in auth api

Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>

Remove the ability to report ENT in NSEC (not NSEC3) bitmaps.

This was probably an oversight at the time ENT support was introduced.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Simplify the second loop even further, no need to rebuild the container.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #17584 from rgacogne/document-oss-fuzz-ci-fuzz

fuzzing: Document our use of OSS-Fuzz and CI-Fuzz

fuzzing: Document missing corpus

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

fuzzing: Document recently added fuzzing targets

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

fuzzing: Document our use of OSS-Fuzz and CI-Fuzz

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #17579 from rgacogne/fix-clang-tidy-dnsdist-rec

ci: Fix clang-tidy workflow for dnsdist and recursor

git-filter: Apply formatting

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

ci: Path the correct path to the compile database for dnsdist and rec builds

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

git-filter.py: Add an option to specify the path to the compile database

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

soa-edit-spread test: start measuring earlier

Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>

Add an optional write_unchanged argument to update RRset even if no change.

This will change the modified_at timestamp.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #17567 from miodvallat/ENOTTY

pdnsutil: non-interactive zone edit

Merge pull request #17545 from Habbie/auth-51-lmdb-schema-notes

auth docs lmdb: footnote about 5.1.x schema usage

improve text, thanks hlindqvist

Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>

note that the split domains subdb is optional

Co-authored-by: Miod Vallat <miod.vallat@powerdns.com>
Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>

Merge pull request #17281 from Habbie/soa-edit-jitter

auth: implement SOA-EDIT spreading + RRSIG expiry extension

Merge pull request #17578 from rgacogne/fix-clang-tidy-newly-created-files

clang-tidy: Properly process newly created files

configurable extension for RRSIG expiry

Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>

openbsd has doas now

auth: implement soa-edit-spread

Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>

Merge pull request #17576 from karelbilek/kb/readmes

dnsdist: Fix build readme - link, meson, mac brew

dnsdist: Add configuration items for remote logger's "stalled write timeout"

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

remote_logger: Make the stalled write timeout configurable

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Add a unit test for the new "maxOutstandingQueries" setting for backends

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Document the new "maxOutstandingQueries" Lua backend option

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Implement per backend max outstanding queries

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #17556 from karelbilek/kb/doh-fix-doh

dnsdist: TCP multiplexer: update should reset ttd

Merge pull request #17575 from hector-cao/fix-armhf-build

dnsdist: fix build error on 32 bits systems (armhf, ...)

Merge pull request #17577 from arthurscchan/new-fuzzer-3

OSS-Fuzz: Add fuzzer targets dnsdist logic

ci: Fix `ValueError: I/O operation on closed file` in clang-tidy.py

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

clang-tidy: Properly process newly created files

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

OSS-Fuzz: Add fuzzer targets dnsdist logic

Signed-off-by: Arthur Chan <arthur.chan@adalogics.com>

dnsdist: Fix build readme - link, meson, mac brew

I have tested mac brew instructions on a fresh Mac VM.

Signed-off-by: Karel Bilek <kb@karelbilek.com>

dnsdist: fix build error on 32 bits systems (armhf, ...)

The YAML configuration field cache.size is a uint64_t, while
DNSDistPacketCache::CacheSettings::d_maxEntries is a size_t. On 32-bit
architectures (e.g. armhf) size_t is 32-bit, so the designated-initializer
assignment is a narrowing conversion, which clang rejects with
-Wc++11-narrowing. Cast explicitly to size_t.

Signed-off-by: Hector Cao <hector.cao@canonical.com>

Merge pull request #17572 from arthurscchan/new-fuzzer-2

OSS-Fuzz: Add new fuzzer for dns packet processing

fuzz_dnspacketroundtrip: Fix clang-tidy warnings

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

fuzz: Build the new dnspacketroundtrip target with meson

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

build(deps): bump cryptography in /regression-tests.recursor-dnssec

Bumps [cryptography](https://github.com/pyca/cryptography) from 48.0.0 to 48.0.1.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pyca/cryptography/compare/48.0.0...48.0.1)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 48.0.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #16518 from jsoref/codeql-pep8-first-argument-should-be-self

codeql PEP8 first argument should be self

Merge pull request #17569 from zeha/meson-dist

auth: initial meson dist script

Merge pull request #16702 from zeha/dynamic-mods

auth: meson: fix missing symbols for dynamic backends

Merge pull request #17571 from jsoref/use-ubuntu-keyserver

docs: replace mit keyserver with ubuntu

Merge pull request #17573 from miodvallat/rcpeit

auth: minor SVCB record parsing fixes

Merge pull request #17562 from miodvallat/whereami

auth: stricter LOC record parsing

Do not assume char is unsigned when parsing SVCB records off the wire.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

ci: Add action to check for "self"

Signed-off-by: Pieter Lexis <pieter.lexis@powerdns.com>

Mark `classmethod` ClientSubnetOption.from_wire

Signed-off-by: Pieter Lexis <pieter.lexis@powerdns.com>

Mark `classmethod` ClientSubnetOption.from_wire

Signed-off-by: Pieter Lexis <pieter.lexis@powerdns.com>

Mark `classmethod` CookiesOption.from_wire

Signed-off-by: Pieter Lexis <pieter.lexis@powerdns.com>

Mark `classmethod` ExtendedErrorOption.from_wire

Signed-off-by: Pieter Lexis <pieter.lexis@powerdns.com>

Mark `classmethod` PaddingOption.from_wire

Signed-off-by: Pieter Lexis <pieter.lexis@powerdns.com>

Mark `staticmethod` TestBackendDiscovery.NoSVCCallback

Signed-off-by: Pieter Lexis <pieter.lexis@powerdns.com>

Mark `staticmethod` TestBackendDiscovery.NoUpgradePathCallback

Signed-off-by: Pieter Lexis <pieter.lexis@powerdns.com>

Mark `staticmethod` TestBackendDiscovery.UpgradeDoTCallback

Signed-off-by: Pieter Lexis <pieter.lexis@powerdns.com>

Mark `staticmethod` TestBackendDiscovery.UpgradeDoHCallback

Signed-off-by: Pieter Lexis <pieter.lexis@powerdns.com>

Mark `staticmethod` TestBackendDiscovery.UpgradeDoTDifferentAddr1Callback

Signed-off-by: Pieter Lexis <pieter.lexis@powerdns.com>

Mark `staticmethod` TestBackendDiscovery.UpgradeDoTDifferentAddr2Callback

Signed-off-by: Pieter Lexis <pieter.lexis@powerdns.com>

Mark `staticmethod` TestBackendDiscovery.UpgradeDoTUnreachableCallback

Signed-off-by: Pieter Lexis <pieter.lexis@powerdns.com>

Mark `staticmethod` TestBackendDiscovery.BrokenResponseCallback

Signed-off-by: Pieter Lexis <pieter.lexis@powerdns.com>

Mark `staticmethod` TestBackendDiscovery.UpgradeDoHMissingPathCallback

Signed-off-by: Pieter Lexis <pieter.lexis@powerdns.com>

Mark `staticmethod` TestBackendDiscovery.EOFCallback

Signed-off-by: Pieter Lexis <pieter.lexis@powerdns.com>

Mark `staticmethod` TestBackendDiscovery.ServFailCallback

Signed-off-by: Pieter Lexis <pieter.lexis@powerdns.com>

Mark `staticmethod` TestBackendDiscovery.WrongNameCallback

Signed-off-by: Pieter Lexis <pieter.lexis@powerdns.com>

Mark `staticmethod` TestBackendDiscovery.WrongIDCallback

Signed-off-by: Pieter Lexis <pieter.lexis@powerdns.com>

Mark `staticmethod` TestBackendDiscovery.TooManyQuestionsCallback

Signed-off-by: Pieter Lexis <pieter.lexis@powerdns.com>

Mark `staticmethod` TestBackendDiscovery.BadQNameCallback

Signed-off-by: Pieter Lexis <pieter.lexis@powerdns.com>

Mark `staticmethod` TestBackendDiscovery.UpgradeDoTNoPortCallback

Signed-off-by: Pieter Lexis <pieter.lexis@powerdns.com>

Mark `staticmethod` TestBackendDiscovery.UpgradeDoHNoPortCallback

Signed-off-by: Pieter Lexis <pieter.lexis@powerdns.com>

Mark `staticmethod` TestOutgoingDOHBrokenResponsesOpenSSL.callback

Signed-off-by: Pieter Lexis <pieter.lexis@powerdns.com>

Restore documentation of EXTEND and PRUNE, lost during openapi changes.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Mark `staticmethod` TestOutgoingDOHBrokenResponsesGnuTLS.callback

Signed-off-by: Pieter Lexis <pieter.lexis@powerdns.com>

Mark `staticmethod` TestOutgoingDOHXForwarded.callback

Signed-off-by: Pieter Lexis <pieter.lexis@powerdns.com>

Mark `staticmethod` KeepOpenTCPTest.sendTCPQueryKeepOpen

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>
Signed-off-by: Pieter Lexis <pieter.lexis@powerdns.com>

Move range checks before actual computations.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

OSS-Fuzz: Add new fuzzer for dns packet processing

Signed-off-by: Arthur Chan <arthur.chan@adalogics.com>

docs: replace mit keyserver with ubuntu

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

auth: initial meson dist script

Signed-off-by: Chris Hofstaedtler <chris.hofstaedtler@deduktiva.com>

Merge pull request #17563 from zeha/auth-meson-version-stopgap

auth: set version in meson.build in autoconf make dist path