From: Ondřej Surý Date: Thu, 22 Aug 2024 09:31:53 +0000 (+0000) Subject: [9.16] new: usr: Tighten 'max-recursion-queries' and add 'max-query-restarts' option X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5afaed14d32393ca41d1ce0ca0775bd58cd891c2;p=thirdparty%2Fbind9.git [9.16] new: usr: Tighten 'max-recursion-queries' and add 'max-query-restarts' option There were cases in resolver.c when the `max-recursion-queries` quota was ineffective. It was possible to craft zones that would cause a resolver to waste resources by sending excessive queries while attempting to resolve a name. This has been addressed by correcting errors in the implementation of `max-recursion-queries`, and by reducing the default value from 100 to 32. In addition, a new `max-query-restarts` option has been added which limits the number of times a recursive server will follow CNAME or DNAME records before terminating resolution. This was previously a hard-coded limit of 16, and now defaults to 11. Closes #4741 Backport of MR !9281 Merge branch 'backport-4741-reclimit-restarts-9.16' into 'bind-9.16' See merge request isc-projects/bind9!9284 --- 5afaed14d32393ca41d1ce0ca0775bd58cd891c2