Adjust default value of "max-recursion-queries"

Since the queries sent towards root and TLD servers are now included in
the count (as a result of the fix for CVE-2020-8616),
"max-recursion-queries" has a higher chance of being exceeded by
non-attack queries.  Increase its default value from 75 to 100.

(cherry picked from commit ab0bf49203)
This commit is contained in:
Mark Andrews
2020-12-01 22:13:05 +00:00
parent 53203b8f04
commit d09991e4e9
6 changed files with 16 additions and 6 deletions
+3
View File
@@ -1,3 +1,6 @@
5541. [func] Adjust the "max-recursion-queries" default from 75 to
100. [GL #2305]
5540. [port] Fix building with native PKCS#11 support for AEP Keyper.
[GL #2315]
+1 -1
View File
@@ -185,7 +185,7 @@ options {\n\
max-clients-per-query 100;\n\
max-ncache-ttl 10800; /* 3 hours */\n\
max-recursion-depth 7;\n\
max-recursion-queries 75;\n\
max-recursion-queries 100;\n\
message-compression yes;\n\
# min-roots <obsolete>;\n\
minimal-any false;\n\
+1 -1
View File
@@ -9299,7 +9299,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
This sets the maximum number of iterative queries that
may be sent while servicing a recursive query.
If more queries are sent, the recursive query
is terminated and returns SERVFAIL. The default is 75.
is terminated and returns SERVFAIL. The default is 100.
</para>
</listitem>
</varlistentry>
+1 -1
View File
@@ -7115,7 +7115,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
This sets the maximum number of iterative queries that
may be sent while servicing a recursive query.
If more queries are sent, the recursive query
is terminated and returns SERVFAIL. The default is 75.
is terminated and returns SERVFAIL. The default is 100.
</p>
</dd>
<dt><span class="term"><span class="command"><strong>notify-delay</strong></span></span></dt>
+8 -1
View File
@@ -55,7 +55,14 @@
<itemizedlist>
<listitem>
<para>
None.
Adjust the <command>max-recursion-queries</command> default
from 75 to 100. Since the queries sent towards root and
TLD servers are now included in the count (as a result
of the fix for CVE-2020-8616),
<command>max-recursion-queries</command> has a higher
chance of being exceeded by non-attack queries, which is
the main reason for increasing its default value. [GL
#2305]
</para>
</listitem>
</itemizedlist>
+2 -2
View File
@@ -169,8 +169,8 @@
/* The default maximum number of iterative queries to allow before giving up. */
#ifndef DEFAULT_MAX_QUERIES
#define DEFAULT_MAX_QUERIES 75
#endif
#define DEFAULT_MAX_QUERIES 100
#endif /* ifndef DEFAULT_MAX_QUERIES */
/*
* After NS_FAIL_LIMIT attempts to fetch a name server address,