Adjust default value of "max-recursion-queries"
Since the queries sent towards root and TLD servers are now included in
the count (as a result of the fix for CVE-2020-8616),
"max-recursion-queries" has a higher chance of being exceeded by
non-attack queries. Increase its default value from 75 to 100.
(cherry picked from commit ab0bf49203)
This commit is contained in:
@@ -1,3 +1,6 @@
|
||||
5541. [func] Adjust the "max-recursion-queries" default from 75 to
|
||||
100. [GL #2305]
|
||||
|
||||
5540. [port] Fix building with native PKCS#11 support for AEP Keyper.
|
||||
[GL #2315]
|
||||
|
||||
|
||||
+1
-1
@@ -185,7 +185,7 @@ options {\n\
|
||||
max-clients-per-query 100;\n\
|
||||
max-ncache-ttl 10800; /* 3 hours */\n\
|
||||
max-recursion-depth 7;\n\
|
||||
max-recursion-queries 75;\n\
|
||||
max-recursion-queries 100;\n\
|
||||
message-compression yes;\n\
|
||||
# min-roots <obsolete>;\n\
|
||||
minimal-any false;\n\
|
||||
|
||||
@@ -9299,7 +9299,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
|
||||
This sets the maximum number of iterative queries that
|
||||
may be sent while servicing a recursive query.
|
||||
If more queries are sent, the recursive query
|
||||
is terminated and returns SERVFAIL. The default is 75.
|
||||
is terminated and returns SERVFAIL. The default is 100.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
@@ -7115,7 +7115,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
|
||||
This sets the maximum number of iterative queries that
|
||||
may be sent while servicing a recursive query.
|
||||
If more queries are sent, the recursive query
|
||||
is terminated and returns SERVFAIL. The default is 75.
|
||||
is terminated and returns SERVFAIL. The default is 100.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term"><span class="command"><strong>notify-delay</strong></span></span></dt>
|
||||
|
||||
@@ -55,7 +55,14 @@
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
None.
|
||||
Adjust the <command>max-recursion-queries</command> default
|
||||
from 75 to 100. Since the queries sent towards root and
|
||||
TLD servers are now included in the count (as a result
|
||||
of the fix for CVE-2020-8616),
|
||||
<command>max-recursion-queries</command> has a higher
|
||||
chance of being exceeded by non-attack queries, which is
|
||||
the main reason for increasing its default value. [GL
|
||||
#2305]
|
||||
</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
|
||||
+2
-2
@@ -169,8 +169,8 @@
|
||||
|
||||
/* The default maximum number of iterative queries to allow before giving up. */
|
||||
#ifndef DEFAULT_MAX_QUERIES
|
||||
#define DEFAULT_MAX_QUERIES 75
|
||||
#endif
|
||||
#define DEFAULT_MAX_QUERIES 100
|
||||
#endif /* ifndef DEFAULT_MAX_QUERIES */
|
||||
|
||||
/*
|
||||
* After NS_FAIL_LIMIT attempts to fetch a name server address,
|
||||
|
||||
Reference in New Issue
Block a user