adapt udp-truncation-threshold flag to the recursor and document it

diff --git a/pdns/docs/pdns.xml b/pdns/docs/pdns.xml
index 79cdf36d4db6c76b9118c60f6d82155cea5e2d95..be93af1faaebd002b0e632e30176867e7603238f 100755 (executable)
--- a/pdns/docs/pdns.xml
+++ b/pdns/docs/pdns.xml
@@ -14434,6 +14434,16 @@ sql> insert into domainmetadata (domain_id, kind, content) values (6, 'TSIG-ALLO
              </para>
            </listitem>
          </varlistentry>
+    <varlistentry>
+      <term>udp-truncation-threshold=...</term>
+      <listitem>
+        <para>
+    EDNS0 allows for large UDP response datagrams, which can potentially raise performance. Large responses however
+    also have downsides in terms of reflection attacks. This setting limits the
+    accepted size. Maximum value is 65535, but values above 4096 should probably not be attempted. Default is 1680.
+        </para>
+      </listitem>
+    </varlistentry>
          <varlistentry>
            <term>version</term>
            <listitem>

diff --git a/pdns/pdns_recursor.cc b/pdns/pdns_recursor.cc
index 84a70937ce435f48f29ce7a1cdd04c3d99d4220a..86bdb2f98c8d7ffa23c712ab0b9f69154098e285 100644 (file)
--- a/pdns/pdns_recursor.cc
+++ b/pdns/pdns_recursor.cc
@@ -76,6 +76,7 @@ unsigned int g_maxTCPPerClient;
 unsigned int g_networkTimeoutMsec;
 bool g_logCommonErrors;
 bool g_anyToTcp;
+uint16_t g_udpTruncationThreshold;
 __thread shared_ptr<RecursorLua>* t_pdl;
 __thread RemoteKeeper* t_remotes;
 __thread shared_ptr<Regex>* t_traceRegex;
@@ -498,7 +499,7 @@ void startDoResolve(void *p)
     uint32_t maxanswersize= dc->d_tcp ? 65535 : 512;
     EDNSOpts edo;
     if(getEDNSOpts(dc->d_mdp, &edo)) {
-      maxanswersize = min(edo.d_packetsize, (uint16_t) (dc->d_tcp ? 65535 : 1680));
+      maxanswersize = min(edo.d_packetsize, (uint16_t) (dc->d_tcp ? 65535 : g_udpTruncationThreshold));
     }
     
     vector<DNSResourceRecord> ret;
@@ -1789,7 +1790,8 @@ int serviceMain(int argc, char*argv[])
   g_logCommonErrors=::arg().mustDo("log-common-errors");
 
   g_anyToTcp = ::arg().mustDo("any-to-tcp");
-  
+  g_udpTruncationThreshold = ::arg().asNum("udp-truncation-threshold");
+
   makeUDPServerSockets();
   makeTCPServerSockets();
 
@@ -2064,6 +2066,8 @@ int main(int argc, char **argv)
     ::arg().setSwitch( "disable-packetcache", "Disable packetcache" )= "no"; 
     ::arg().setSwitch( "pdns-distributes-queries", "If PowerDNS itself should distribute queries over threads (EXPERIMENTAL)")="no";
     ::arg().setSwitch( "any-to-tcp","Answer ANY queries with tc=1, shunting to TCP" )="no";
+    ::arg().set("udp-truncation-threshold", "Maximum UDP response size before we truncate")="1680";
+
     ::arg().set("include-dir","Include *.conf files from this directory")="";
 
     ::arg().setCmd("help","Provide a helpful message");