From: Ondřej Surý Date: Thu, 22 Aug 2024 09:32:16 +0000 (+0000) Subject: [9.11] new: usr: Tighten 'max-recursion-queries' and add 'max-query-restarts' option X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c5d5267d72f4ea0012f3941a406c0a7c7ba48255;p=thirdparty%2Fbind9.git [9.11] new: usr: Tighten 'max-recursion-queries' and add 'max-query-restarts' option There were cases in resolver.c when the `max-recursion-queries` quota was ineffective. It was possible to craft zones that would cause a resolver to waste resources by sending excessive queries while attempting to resolve a name. This has been addressed by correcting errors in the implementation of `max-recursion-queries`, and by reducing the default value from 100 to 32. In addition, a new `max-query-restarts` option has been added which limits the number of times a recursive server will follow CNAME or DNAME records before terminating resolution. This was previously a hard-coded limit of 16, and now defaults to 11. Closes #4741 Backport of MR !9281 Merge branch 'backport-4741-reclimit-restarts-9.11' into 'bind-9.11' See merge request isc-projects/bind9!9285 --- c5d5267d72f4ea0012f3941a406c0a7c7ba48255