Adjust default value of "max-recursion-queries"

Since the queries sent towards root and TLD servers are now included in
the count (as a result of the fix for CVE-2020-8616),
"max-recursion-queries" has a higher chance of being exceeded by
non-attack queries.  Increase its default value from 75 to 100.

(cherry picked from commit ab0bf492035c01687dfff8f546b78ac30739348c)

diff --git a/CHANGES b/CHANGES
index d21f65ec517421792acf2773fae1d0577f09b4c7..524e0731ebe72c3cf9e9a3dba3cd737a4fb5125e 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+5541.  [func]          Adjust the "max-recursion-queries" default from 75 to
+                       100. [GL #2305]
+
 5540.  [port]          Fix building with native PKCS#11 support for AEP Keyper.
                        [GL #2315]
 

diff --git a/bin/named/config.c b/bin/named/config.c
index b54a46bb361210d071e24cb3dadfac5989114027..1a787f3c57724044a9d349e314ef9a7206371a00 100644 (file)
--- a/bin/named/config.c
+++ b/bin/named/config.c
@@ -168,7 +168,7 @@ options {\n\
        max-clients-per-query 100;\n\
        max-ncache-ttl 10800; /* 3 hours */\n\
        max-recursion-depth 7;\n\
-       max-recursion-queries 75;\n\
+       max-recursion-queries 100;\n\
        max-stale-ttl 43200; /* 12 hours */\n\
        message-compression yes;\n\
        min-ncache-ttl 0; /* 0 hours */\n\

diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
index 92f5dff7b93933a62aefd1cc94bb6669fd2beb06..ce00f539a82f0f7aed3a69e17f4e2e675bc3691a 100644 (file)
--- a/doc/arm/reference.rst
+++ b/doc/arm/reference.rst
@@ -3500,7 +3500,7 @@ Tuning
 ``max-recursion-queries``
    This sets the maximum number of iterative queries that may be sent while
    servicing a recursive query. If more queries are sent, the recursive
-   query is terminated and returns SERVFAIL. The default is 75.
+   query is terminated and returns SERVFAIL. The default is 100.
 
 ``notify-delay``
    This sets the delay, in seconds, between sending sets of notify messages for a

diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index 6dca445a40e309a901f09698ab6cd7f8501a0ad9..89c3d027d8deabe2550a6603f4da08083a3dd9bc 100644 (file)
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -40,6 +40,12 @@ Feature Changes
   configuration. A new option 'nsec3param' can be used to set the desired
   NSEC3 parameters, and will detect collisions when resalting. [GL #1620].
 
+- Adjust the ``max-recursion-queries`` default from 75 to 100. Since the
+  queries sent towards root and TLD servers are now included in the
+  count (as a result of the fix for CVE-2020-8616), ``max-recursion-queries``
+  has a higher chance of being exceeded by non-attack queries, which is the
+  main reason for increasing its default value. [GL #2305]
+
 Bug Fixes
 ~~~~~~~~~
 

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index febe5106e6d5838c8e1f42ba57ccdf60b612843c..99c44868684768c6160a69d552764549dcfa891d 100644 (file)
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -181,7 +181,7 @@
 
 /* The default maximum number of iterative queries to allow before giving up. */
 #ifndef DEFAULT_MAX_QUERIES
-#define DEFAULT_MAX_QUERIES 75
+#define DEFAULT_MAX_QUERIES 100
 #endif /* ifndef DEFAULT_MAX_QUERIES */
 
 /*