Merge pull request #17884 from locker95/docs/forward-dnsupdate-default-yes

docs: fix forward-dnsupdate default to yes

Merge pull request #17885 from locker95/docs/webserver-basic-auth-password-only

docs: note webserver Basic auth ignores username

Merge pull request #17887 from M4t7e/master

auth: fix pickclosest across the antimeridian

auth: fix pickclosest across the antimeridian

Signed-off-by: M4t7e <7535523+M4t7e@users.noreply.github.com>

docs: note webserver Basic auth ignores username

HTTP Basic only compares the password half of user:pass; the username
is not checked (see HttpRequest::compareAuthorization).

Fixes: #5908
Signed-off-by: Dean Chen <862469039@qq.com>

docs: fix forward-dnsupdate default to yes

auth-main.cc registers the switch with default "yes"; the settings page
incorrectly listed no.

Fixes: #12727
Signed-off-by: Dean Chen <862469039@qq.com>

Merge pull request #17717 from miodvallat/mydatabaseisinvaliderthanyou

lmdb: reduce hair pulling in users by 42%

Merge pull request #17871 from omoerbeek/prep-20260806

Prep 20260806

Auth part

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Prep for dnsdist 20260806

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

rec: Prep for 20260806 releases

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #17869 from omoerbeek/rec-skip-unexpected

rec: skip unexpected tags when deserializing protobuf messages

rec: skip unexpected tags when deserializing protobuf messages

Buys more robustness against future changes.

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #17867 from omoerbeek/rec-apex-hash-label-parent-impersonation

rec: add unit test and a bit more logging for apex hash label parent impersonation

rec: Go even further in the "apex hash label parent impersonation" unit test

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

rec: Add more debug information to `getDenial()`

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

rec: Add a unit test for Palo Alto's "apex hash label parent impersonation"

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #17865 from omoerbeek/rec-no-wait-log

rec: zap no longer useful and now annoying debug log line

Merge pull request #17864 from Habbie/dnsdist-19-eol

dnsdist: mark 1.9 as EOL

rec: zap no longer useful and now annoying debug log line

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Prep for dnsdist 20260806

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

dnsdist: mark 1.9 as EOL

Merge pull request #17822 from miodvallat/cant_afford_writable_storage_anymore

auth: better handling of sqlite read-only databases

Merge pull request #17831 from miodvallat/the_1980s_called

docs: the 1980s called, they want their WKS records back

Merge pull request #17794 from Habbie/crypto-cleanup

drop support for openssl 1.0 and very old libressl

Merge pull request #17835 from Support-itecz/iputils-byte-aligned-prefix

iputils: do not index past the address for byte-aligned prefixes

iputils: do not index past the address for byte-aligned prefixes

Signed-off-by: Itecz Solution <support@itecz.au>

Remove no-longer relevant or applicable limits in DNS update intro.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #17829 from miodvallat/comboredom

boring auth PR of the day

Make this build again.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #17743 from miodvallat/inet_atonishment

IPv4 sugar

Merge pull request #17827 from miodvallat/lmdb_bargain

auth lmdb: remove dead transaction code

Merge pull request #17742 from miodvallat/selenism

auth: minor Lua2 backend improvements

Use sqlite3_open_v2() so that we can open the database read-only if need be.

Fixes: #13952 (again, but better)
Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #17566 from miodvallat/mëtricks

auth: some API metrics

Merge pull request #17826 from miodvallat/x-no-api-key

auth: do not log x-api-key value in 'detailed' log level

Appease clang-tidy due to unrelated changes in these areas.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Do not create temporary transactions in methods which require one anymay.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Enfore active transactions in update{DNSSECOrderNameAndAuth,EmptyNonTerminals}

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #17821 from miodvallat/no_smoke_without_pr

pdnsutil: let zone edit recreate the whole zone if it contains invalid records

Do not log x-api-key value in 'detailed' log level.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Make less use of the StatBag globals.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Add counters for API calls and some of their results.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Do not truncate webserver statistics to int.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Remove dead prototype.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #17824 from Support-itecz/geoip-key-file-mode

geoipbackend: create DNSSEC key files with mode 0600

create geoip dnssec key files with mode 0600

Signed-off-by: Itecz Solution <support@itecz.au>

Merge pull request #17804 from Habbie/new-in-51-not-52

auth settings docs: fix "added-in" version numbers

Let zone edit recreate the whole zone if it has invalid records.

Since zone edit knows the complete zone contents, we can recreate it and
fill it with the (possibily modified) contents, making these invalid records
disappear.

Fixes: #6070 (last nail into its coffin)
Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #17808 from ersingundem/dnsdist-fix-web-dashboard-drops

dnsdist: Fix drops in the web dashboard

Merge pull request #17770 from miodvallat/unknotted

auth: safer error handling in bind parser

Merge pull request #17771 from miodvallat/retry_ignore

remove objectionable abort() calls

Merge pull request #17778 from miodvallat/nonrandom_api_axfr

auth api: allow a primary server address to be passed to the axfr-retrieve endpoint

Merge pull request #17787 from miodvallat/would_you_like_records_with_that

auth: yet another lmdb buglet

Replage the lmdb test binary files with mdb_dump output.

Update the lmdb-schema-upgrade to rebuild the database from these dumps
prior to performing the actual tesst.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Allow integers in contexts where bools are expected.

Fixes: #7008
Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Prefer to raise a more detailed exception.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Try and give more details if boost::get<> fails.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Implement lookupEnd().

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Fix documentation: Lua2 backend is (mostly) read-only.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Let pdnsutil -v lmdb-get-backend-version also print the LMDB library version.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Hint that database open errors may be caused by incompatible LMDB versions.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

dnsdist: Fix drops in the web dashboard

Signed-off-by: Ersin Gündem <ersingundem@gmail.com>

Merge pull request #17802 from rgacogne/ddist-nghttp2-in-set-last-io-blocked

dnsdist: Properly set the "last IO blocked" flag from incoming DoH

Merge pull request #17801 from rgacogne/ddist-modernize-nghttp2-code

dnsdist: Modernize our `nghttp2`-related code

naptr-additional-processing is coming to 5.1.4

default-soa-edit-api is new in 5.1, not 5.2

dnsdist: USe the short `std::array` version suggested by Miod (thanks!)

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Properly set the "last IO blocked" flag from incoming DoH

It is used in at least one method inherited from `IncomingTCPConnectionState`.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Modernize our `nghttp2`-related code

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

require libcrypto 1.1 or up, and report version

Merge pull request #17799 from Habbie/dnsdist-eol-word

add "DNSdist" word after "PowerDNS"

Merge pull request #17798 from rgacogne/ddist-nghttp2-error-callback

dnsdist: `nghttp2`'s error callback is "solely for debugging purpose"

fully drop openssl_thread_setup/cleanup

add "DNSdist" word after "PowerDNS"

Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>

dnsdist: `nghttp2`'s error callback is "solely for debugging purpose"

So there is no need to terminate the stream/session ourselves.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #17797 from rgacogne/dnsname-too-long

dnsname: Account for the existing content when parsing labels

we can trust SSL_set_hostflags to be there, libressl has had it for five years

test-dnsname_cc: clang-tidy fixes

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #17751 from Support-itecz/lmdb-key-length-check

lmdbbackend: bounds-check compoundOrdername key decoders

dnsname: Don't mix additions and subtractions when possible

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsname: Account for the existing content when parsing labels

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

drop support for openssl 1.0 and very old libressl

Merge pull request #17790 from rgacogne/dnsname-256

dnsname: Properly reject 256-bytes wire-encoded DNS names

Merge pull request #17789 from omoerbeek/coverity-20260723

Two coverity fixes

Merge pull request #17791 from rgacogne/ddist-coveiryy-20260727

dnsdist: Fix a missed performance optimization reported by Coverity

Merge pull request #17360 from omoerbeek/rec-warmcache

rec: keep cache warm for a list of names

test-dnsname_cc: Fix coverity warning

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Fix a missed performance optimization reported by Coverity

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Handle review comments fomr @rgacogne

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #17785 from omoerbeek/rec-warn-CARGO_USE_DEV

rec: add a comment wrt using g++ with CARGO_USE_DEV=1

Merge pull request #17786 from omoerbeek/rec-unsupported-digest-is-not

rec: bandaid for disabling algo 8 also disables DS digest 2

Add docs

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Add basic tests

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Apply suggestions from code review

Co-authored-by: Miod Vallat <miod.vallat@powerdns.com>
Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Add conversion functions (just to be complete)

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Rework logic a bit to make it more resilient against failing cases

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Make number of task threads configurable

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Base of a working mechanism using a multi-index

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Do the actual pin in cache work.

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>