dnsdist: Properly link with `libdl` when building with `autotools`

Depending on the system we might actually need to link with `libdl`
when our Rust library is used, and the mechanism to do that was not
properly set up when building with `autotools` (we were adding `LIBDL`
to the the libraries we need but the variable was not properly filled).
Unfortunately the systems we are exercising in our CI do not need to
explicitly link with `libdl` so we did not notice.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>
(cherry picked from commit 83416a76b6df3af560514caea8c45e750f1fd24b)

Merge pull request #15805 from rgacogne/ddist20-backport-15639

dnsdist-2.0.x: Backport 15639 - Add el-10 target

builder: avoid duplicate installation of meson/quiche/rust

(cherry picked from commit adc4a45244c64cfcd52d03b8a392224c3851e1ff)

builder: add el-10 target, based on rockylinux:10 for now

cherry-picked from 32a5ef17f4aa04822b79aafd2c783c19433955a5

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #15787 from rgacogne/ddist20-remove-more-workflows

dnsdist-2.0.x: Remove more useless workflows

Merge pull request #15784 from rgacogne/ddist20-backport-15747

dnsdist-2.0.x: Backport 15747 - Add a Lua binding to get objects declared in YAML

dnsdist-2.0.x: Remove more useless workflows

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Add an explicit return type to getObjectFromYAMLConfiguration

As suggested by Otto.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>
(cherry picked from commit 9263b481855ffc6e3324f2d342ce66b57e4ac0fa)
Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Add a regression test for `getObjectFromYAMLConfiguration`

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>
(cherry picked from commit 80f292fc5d96ab59afea63aaf8323267081b9114)
Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Add a Lua binding to get objects declared in YAML

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>
(cherry picked from commit d98d50b1939016d03a522cb6a79834088949e913)
Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #15780 from rgacogne/ddist20-backport-15751

dnsdist-2.0.x: Backport to 15751 - Error on unsupported backend protocols from YAML

Merge pull request #15779 from rgacogne/ddist20-backport-15750

dnsdist-2.0.x: Backport 15750 - Fix logging and XSK YAML settings being ignored

Merge pull request #15778 from rgacogne/ddist20-backport-15739

dnsdist-2.0.x: Backport 15739 - lmdb-safe: Fix a small race in `getMDBEnv`

Merge pull request #15777 from rgacogne/ddist20-backport-15738

dnsdist-2.0.x: Backport 15738 - Prevent users from opening the same LMDB twice

Merge pull request #15776 from rgacogne/ddist20-backport-15735

dnsdist-2.0.x: Backport 15735 - lmdb-safe: Improve the scalability of transaction maps

Merge pull request #15775 from rgacogne/ddist20-backport-15718

dnsdist-2.0.x: Backport 15718 - Return nil for non-existing Lua objects

Merge pull request #15774 from rgacogne/ddist20-backport-15707

dnsdist-2.0.x: Backport 15707 - Prevent Lua bindings for backend from crashing on empty backend

Merge pull request #15781 from rgacogne/ddist20-backport-15754

dnsdist-2.0.x: Backport 15754 - Error if backend certificate validation is enabled without a subject name

dnsdist: Lowercase the TLS provider name for YAML-originated backends

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>
(cherry picked from commit 7106cda315dff6969062899ecb6360768e9f3fee)

dnsdist: Error if backend certificate validation is enabled without a subject name

We can only validate if a proper subject name or subject address is passed,
and we do not want to silently disable validation, so let's refuse to start.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>
(cherry picked from commit 8a9142058f82e0fd70b428ddc50848f00a59d2c4)

dnsdist: Error on unsupported backend protocols from YAML

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>
(cherry picked from commit def4733d1eb32c80ccc79f7f6ed39ab7be49f33f)

dnsdist: Fix logging and XSK YAML settings being ignored

It turns out that the configuration we receive from the
serde parser was not correctly translated to our own
configuration.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>
(cherry picked from commit f18dbfa050241f925b19c53653b3ef4061afa1e1)

lmdb-safe: Do not use strerror() which is not thread-safe

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>
(cherry picked from commit 7ad3b74ea624b47441f717ad7ced209ef01869c8)

lmdb-safe: Fix a small race in `getMDBEnv`

I believe there is a small race in the `getMDBEnv`: if the database
file does not exist when we first try to get the file metadata, we
acquire the lock then create a new `MDBEnv` and store it in the map.
But what happens if a different thread created the database between
our first check and the call to `MDBEnv`? I believe we would create
a new environment and override the existing entry in the map, bypassing
the check.
This commit introduces a second check right after acquiring the lock
to prevent that.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>
(cherry picked from commit 57224e94d9189f4916bbd7b2aaf61fa0821b1a2c)

dnsdist: Prevent users from opening the same LMDB twice

As noted by Peter: "LMBD requires that database is opened
exactly once per process. Opening multiple times breaks file
locks silently, which leads to corrupting the database."

While I don't expect users to actually do that, we already have
a nice helper function to prevent this mistake in the lmdb-safe
code base, so let's use it.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>
(cherry picked from commit 0cfa000e3f7a47c96a3129d5ef27ce13022707f6)

lmdb-safe: Use unordered maps for the transaction maps

We don't need the maps to be ordered, and unordered maps are usually
slightly faster.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>
(cherry picked from commit 883aec59cf56f9345b0a229ed7af35490a113494)

lmdb-safe: Improve the scalability of transaction maps

This commit improves the scalability of the transaction maps by
moving from a `mutex` to a `shared_mutex` and making the stored value
atomic. This allows accessing the maps concurrently from different threads
as long as the entry for the thread exists, and we fall back to
taking a full lock otherwise.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>
(cherry picked from commit c340aa91bf37d8105d2b2390eecbadfca88c1d27)

dnsdist: Rely upon type deduction, as suggested by Miod

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>
(cherry picked from commit a5ede88eea4c55f8e5536ca17b4fbb2992bb6271)

dnsdist: Return `nil` for non-existing Lua objects

Until now we were returning an empty shared pointer, but unfortunately
LuaWrapper is currently not smart enough to turn that into a `nil`
value.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>
(cherry picked from commit 4b07e08e8b5aeef617c016c00ca344669870a8ce)

dnsdist: Prevent Lua bindings for backend from crashing on empty backend

We currently return an empty `std::shared_ptr` when the backend is not
set (self-answered response, for example), and unfortunately LuaWrapper
is not smart enough to make that equivalent to `nil`, so testing whether
the backend is valid from Lua is not possible. While I would prefer to
fix that, this fix prevents us from crashing when calling the bindings
associated to a backend with an empty shared pointer.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>
(cherry picked from commit a12bea636790a3be73516a2a24af1a8351c016c5)

Merge pull request #15760 from rgacogne/ddist20-disable-unneeded-workflows

dnsdist-2.0.x: Disable non-dnsdist workflows

dnsdist-2.0.x: Disable non-dnsdist workflows

Merge pull request #15734 from rgacogne/ddist20-15729

dnsdist-2.0.x: Backport 15729 - Enforce that additional addresses are DoT/DoH only

dnsdist: Remove useless empty line

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>
(cherry picked from commit 8f90541906c3040727bca08bafbe63ce38a23153)

dnsdist: Reduce the complexity of the YAML frontend code

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>
(cherry picked from commit d64936e33c62fda11e5b5cd2832b2daefae67b26)

dnsdist: Enforce that additional addresses are DoT/DoH only

I want to support additional addresses on frontends for all protocols,
but the amount of code to change is too important for the 2.0 branch.
So for now, let's document and enforce the current limitation to prevent
surprises.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>
(cherry picked from commit df7cbdb3d7f66e3bfe788d149661101bcac36647)

dnsdist: Generate files when building the release tarball

Some build systems are very unhappy with `dnsdist-rust-lib/rust/src/lib.rs`
not existing before actually starting the build process (mostly because
of `cargo-vendor`), so let's make their life easier.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #15709 from omoerbeek/libssl-depends-on-libcrypto

libssl depends on libcrypto

libssl depends on libcrypto

Otherwise all kinds of meson setup logic goes wrong,
symptom: DoH connection from 127.0.0.1:44825 expected ALPN value 'h2', got ''

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #15706 from rgacogne/rec-fix-zonetocache-unit-tests

rec: Prevent a crash in the ZoneToCache unit tests

Merge pull request #15703 from rgacogne/ddist-fix-documentation-workflow

dnsdist: Fix the documentation workflow

Merge pull request #15705 from omoerbeek/lmdb-unsafe

auth: rename bswap64 to pdns_bswap64.

rec: Prevent a crash in the ZoneToCache unit tests

Since 753ad2390bfbc90f6bc1b68f980ef4bcdc2cfddc ZoneToCache checks
whether a given zone has a recursive forward rule, so we need the
Domain map to be properly initialized in all tests, as they can be
executed in random order.

Fixes:
```
ThreadSanitizer:DEADLYSIGNAL
==35969==ERROR: ThreadSanitizer: SEGV on unknown address 0x000000000018 (pc 0x5568e9f8bb04 bp 0x4c00000000000 sp 0x7ffcc13b77f0 T35969)
==35969==The signal is caused by a READ memory access.
==35969==Hint: address points to the zero page.
    #0 std::_Hashtable<DNSName, std::pair<DNSName const, SyncRes::AuthDomain>, std::allocator<std::pair<DNSName const, SyncRes::AuthDomain> >, std::__detail::_Select1st, std::equal_to<DNSName>, std::hash<DNSName>, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<true, false, true> >::empty() const /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/hashtable.h:653:23 (testrunner+0x47fb04)
    #1 std::unordered_map<DNSName, SyncRes::AuthDomain, std::hash<DNSName>, std::equal_to<DNSName>, std::allocator<std::pair<DNSName const, SyncRes::AuthDomain> > >::empty() const /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/unordered_map.h:306:21 (testrunner+0x47fb04)
    #2 SyncRes::getBestAuthZone(DNSName*) /__w/pdns/pdns/pdns/recursordist/pdns-recursor-0.0.0-git1/syncres.cc:2464:29 (testrunner+0x47fb04)
    #3 SyncRes::isRecursiveForward(DNSName const&) /__w/pdns/pdns/pdns/recursordist/pdns-recursor-0.0.0-git1/syncres.cc:1098:21 (testrunner+0x47fb04)
    #4 ZoneData::ZoneToCache(RecZoneToCache::Config const&) /__w/pdns/pdns/pdns/recursordist/pdns-recursor-0.0.0-git1/rec-zonetocache.cc:423:28 (testrunner+0x404931)
    #5 RecZoneToCache::ZoneToCache(RecZoneToCache::Config const&, RecZoneToCache::State&) /__w/pdns/pdns/pdns/recursordist/pdns-recursor-0.0.0-git1/rec-zonetocache.cc:473:10 (testrunner+0x4059fd)
    #6 rec_zonetocache::zonemdGenericTest(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, pdns::ZoneMD::Config, pdns::ZoneMD::Config, unsigned long) /__w/pdns/pdns/pdns/recursordist/pdns-recursor-0.0.0-git1/test-rec-zonetocache.cc:157:3 (testrunner+0x7a7113)
    #7 rec_zonetocache::test_zonetocachegeneric::test_method() /__w/pdns/pdns/pdns/recursordist/pdns-recursor-0.0.0-git1/test-rec-zonetocache.cc:177:3 (testrunner+0x7a60a5)
    #8 rec_zonetocache::test_zonetocachegeneric_invoker() /__w/pdns/pdns/pdns/recursordist/pdns-recursor-0.0.0-git1/test-rec-zonetocache.cc:173:1 (testrunner+0x7a60a5)
    #9 boost::detail::function::void_function_invoker0<void (*)(), void>::invoke(boost::detail::function::function_buffer&) /usr/include/boost/function/function_template.hpp:117:11 (testrunner+0x57dfab)
    #10 <null> <null> (libboost_unit_test_framework.so.1.74.0+0x323fd)
    #11 boost::execution_monitor::catch_signals(boost::function<int ()> const&) <null> (libboost_unit_test_framework.so.1.74.0+0x30b0c)
    #12 boost::execution_monitor::execute(boost::function<int ()> const&) <null> (libboost_unit_test_framework.so.1.74.0+0x30b90)
    #13 boost::execution_monitor::vexecute(boost::function<void ()> const&) <null> (libboost_unit_test_framework.so.1.74.0+0x30c60)
    #14 boost::unit_test::unit_test_monitor_t::execute_and_translate(boost::function<void ()> const&, unsigned long) <null> (libboost_unit_test_framework.so.1.74.0+0x5f1a0)
    #15 <null> <null> (libboost_unit_test_framework.so.1.74.0+0x37cdf)
    #16 <null> <null> (libboost_unit_test_framework.so.1.74.0+0x381d0)
    #17 <null> <null> (libboost_unit_test_framework.so.1.74.0+0x381d0)
    #18 boost::unit_test::framework::run(unsigned long, bool) <null> (libboost_unit_test_framework.so.1.74.0+0x3bf36)
    #19 boost::unit_test::unit_test_main(bool (*)(), int, char**) <null> (libboost_unit_test_framework.so.1.74.0+0x5e10d)
    #20 main /__w/pdns/pdns/pdns/recursordist/pdns-recursor-0.0.0-git1/testrunner.cc:84:10 (testrunner+0xc85591)
    #21 <null> <null> (libc.so.6+0x27249)
    #22 __libc_start_main <null> (libc.so.6+0x27304)
    #23 _start <null> (testrunner+0x1b79e0)
```

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Typo in comment

Co-authored-by: Miod Vallat <miod.vallat@powerdns.com>
Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

auth: rename bswap64 to pdns_bswap64.

Using bswap64 causes infinite reursion if your system has a #define bswap64 __builtin_bswap64

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

documentation: DNSdist needs python-yaml

dnsdist: Fix the documentation workflow

We need to generate the parts of the documentation sources that are no
longer present in the repository before building it.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #15701 from rgacogne/ddist-20-b1-changelog-secpoll

dnsdist: Update ChangeLog and security polling zone for 2.0.0-beta1

Merge pull request #15700 from omoerbeek/coverity-20250620

Two Coverity issues, the truncation is meant to be

Two Coverity issues, the truncation is meant to be

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #15697 from Habbie/pickselfweighted-added-5

auth docs: note that pickselfweighted() is new in auth 5

auth docs: note that pickselfweighted() is new in auth 5

Merge pull request #15684 from PowerDNS/dependabot/pip/regression-tests.recursor-dnssec/protobuf-5.29.5

build(deps): bump protobuf from 5.28.2 to 5.29.5 in /regression-tests.recursor-dnssec

Merge pull request #15693 from miodvallat/rmdb

better rm in LMDB

dnsdist: Update ChangeLog and security polling zone for 2.0.0-beta1

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Use faster logic in deleteDomainRecords().

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #15692 from omoerbeek/rec-yaml-aliases

rec: introduce aliases for camelCase field names

Merge pull request #15690 from rgacogne/ddist-meta-api

dnsdist: Add Lua APIs to set Meta tags in protobuf messages

dnsdist: Apply Otto's suggestions (thanks!)

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #15691 from rgacogne/ddist-completion-chains

dnsdist: Generate completion and help for rule chains

Merge pull request #15695 from omoerbeek/dnsdist-meson-libcrypto

dnsdist meson: followup to #15685 to avoid compiler warnings

Merge pull request #15646 from Habbie/rrsig-times-1982

rec validate: use rfc1982 math for RRSIG timestamps

Merge pull request #15652 from omoerbeek/rec-ztc-vs-recforward

rec: when using ZTC, do not store non-auth data if the name is subject to recursive forwarding

Add missed zoneSizeHint

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

dnsdist meson: followup to #15685 to avoid compiler warnings

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Simple test for replaceRRSet ANY operation.

Also exercize the newest pdnsutil syntax while there.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Correctly handle QType::ANY in replaceRRSet().

Co-Authored-By: Håkan Lindqvist <h@qw.se>
Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Rework deleteDomainRecords() interface.

NFC yet, will benefit upcoming commits.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

dnsdist: Reorder files in Makefile.am

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Yet another formatting mistake

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Appease code formatting daemon

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Generate completion and help for rule chains

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Move completion-related code to a separate file

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Add docs, typos

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #15689 from omoerbeek/auth-no-more-instances-vec

auth: stop maintaining vector of ueberbackend instances

Merge pull request #15687 from rgacogne/ddist-remove-generated-doc-files

dnsdist: Remove generated YAML documentation files

rec: provide snake_case aliases for CamelCase names in YAML config

dnsdist: Add Lua APIs to set Meta tags in protobuf messages

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

auth: stop maintaining vector of backend instances

Unused. Fixes #15688

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

dnsdist: Remove generated YAML documentation files

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #15682 from pieterlexis/superfluous-code-block

doc(dnsdist): remove superfluous code block in YAML config

Merge pull request #15685 from omoerbeek/dnsdist-ssl-crypto

meson: Pick -lcrypto up from the spot defined by dep_libcrypto

dnsdist: remove superfluous code block in YAML config

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #15676 from nokia/restartcnt

dnsdist: add a count to track the number of query restarts

Merge pull request #15670 from nokia/policy

dnsdist: add route policy of first ordered then weighted

Pick -lcrypto up from the spot defined by dep_libcrypto

Also avoid a bunch of warning: as compile commands don't take -L:
c++: warning: argument unused during compilation: '-L/usr/local/eboringssl/lib' [-Wunused-command-line -argument]

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Indentation correction

build(deps): bump protobuf in /regression-tests.recursor-dnssec

Bumps [protobuf](https://github.com/protocolbuffers/protobuf) from 5.28.2 to 5.29.5.
- [Release notes](https://github.com/protocolbuffers/protobuf/releases)
- [Changelog](https://github.com/protocolbuffers/protobuf/blob/main/protobuf_release.bzl)
- [Commits](https://github.com/protocolbuffers/protobuf/compare/v5.28.2...v5.29.5)

---
updated-dependencies:
- dependency-name: protobuf
  dependency-version: 5.29.5
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

Add regression test for the restart counting

Optimize policy with already sorted servers and add tag testing

doc(dnsdist): remove superfluous code block in YAML config

Merge pull request #15679 from miodvallat/fragmented_sun

Provide an IP_OFFMASK value for systems lacking it

Merge pull request #15681 from miodvallat/geoipfeetshooting

Lua GeoIPQueryAttribute documentation update

Fix documentation build warning.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Mention that GeoIPQueryAttribute symbolic constants in Lua are v5+.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Provide an IP_OFFMASK value for systems lacking it.

Fixes: #8060
Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #15662 from rgacogne/ddist-apply-yaml-items-early

dnsdist: Apply generic YAML configuration items early

Change integer type from uint8_t to int in the docs

Merge pull request #15672 from miodvallat/silencing_the_signing

Stop listing the trusted keys at the end of tests

Merge pull request #15661 from omoerbeek/rec-nta-retrieval

rec: fix negativetrustanchor.server CH TXT query processing (disabled by default)