Change nsec3-max-iterations default to 150

diff --git a/pdns/pdns_recursor.cc b/pdns/pdns_recursor.cc
index d5ff654fdfd7dedcd8cb55d9cb2b1e41d0235f48..c21a8a805a9045bc5df53ee8e25561a0f139215a 100644 (file)
--- a/pdns/pdns_recursor.cc
+++ b/pdns/pdns_recursor.cc
@@ -5718,7 +5718,7 @@ int main(int argc, char **argv)
 
     ::arg().set("tcp-fast-open", "Enable TCP Fast Open support on the listening sockets, using the supplied numerical value as the queue size")="0";
     ::arg().set("tcp-fast-open-connect", "Enable TCP Fast Open support on outgoing sockets")="no";
-    ::arg().set("nsec3-max-iterations", "Maximum number of iterations allowed for an NSEC3 record")="2500";
+    ::arg().set("nsec3-max-iterations", "Maximum number of iterations allowed for an NSEC3 record")="150";
 
     ::arg().set("cpu-map", "Thread to CPU mapping, space separated thread-id=cpu1,cpu2..cpuN pairs")="";
 

diff --git a/pdns/recursordist/docs/settings.rst b/pdns/recursordist/docs/settings.rst
index 3beb32f2b9455219a3da429e01050b0ba1847c25..7b18b624e274c92feb52f918f1ab3389eed3ca8c 100644 (file)
--- a/pdns/recursordist/docs/settings.rst
+++ b/pdns/recursordist/docs/settings.rst
@@ -1363,11 +1363,15 @@ without consulting authoritative servers.
 .. versionadded:: 4.1.0
 
 -  Integer
--  Default: 2500
+-  Default: 150
 
 Maximum number of iterations allowed for an NSEC3 record.
 If an answer containing an NSEC3 record with more iterations is received, its DNSSEC validation status is treated as Insecure.
 
+.. versionchanged:: 4.6.0
+
+   Default is now 150, was 2500 before.
+
 .. _setting-packetcache-ttl:
 
 ``packetcache-ttl``

diff --git a/pdns/recursordist/docs/upgrade.rst b/pdns/recursordist/docs/upgrade.rst
index 7bc05e4a1aba1349197eba7365f47a687123a6e4..7c26187d29e74b7cc18bff0a7a9cc6efaac3bcc1 100644 (file)
--- a/pdns/recursordist/docs/upgrade.rst
+++ b/pdns/recursordist/docs/upgrade.rst
@@ -4,9 +4,16 @@ Upgrade Guide
 Before upgrading, it is advised to read the :doc:`changelog/index`.
 When upgrading several versions, please read **all** notes applying to the upgrade.
 
-4.4.x to 4.5.0 or master
+4.5.x to 4.6.0 or master
 ------------------------
 
+Deprecated and changed settings
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+- The :ref:`setting-nsec3-max-iterations` default value has been changed from 2500 to 150.
+
+4.4.x to 4.5.1
+--------------
+
 Offensive language
 ^^^^^^^^^^^^^^^^^^
 Synonyms for various settings names containing ``master``, ``slave``,