reduce the max-recursion-queries default to 32

the number of iterative queries that can be sent to resolve a
name now defaults to 32 rather than 100.

(cherry picked from commit 7e3b425dc283df66df9c46002307ab676e10e4fd)

diff --git a/bin/named/config.c b/bin/named/config.c
index 3ad700a887374a330ffdeedefe642e9e0b38a25f..9b34b896c189653c69121f2d1f586368af909850 100644 (file)
--- a/bin/named/config.c
+++ b/bin/named/config.c
@@ -170,7 +170,7 @@ options {\n\
        max-clients-per-query 100;\n\
        max-ncache-ttl 10800; /* 3 hours */\n\
        max-recursion-depth 7;\n\
-       max-recursion-queries 100;\n\
+       max-recursion-queries 32;\n\
        max-stale-ttl 86400; /* 1 day */\n\
        message-compression yes;\n\
        min-ncache-ttl 0; /* 0 hours */\n\

diff --git a/bin/tests/system/reclimit/ns3/named1.conf.in b/bin/tests/system/reclimit/ns3/named1.conf.in
index 7771d834a2e5f6937094a6fed07250e3099acd4e..295eae0864b61e9c6869e036ecf2c4075a1f9c90 100644 (file)
--- a/bin/tests/system/reclimit/ns3/named1.conf.in
+++ b/bin/tests/system/reclimit/ns3/named1.conf.in
@@ -22,6 +22,7 @@ options {
        listen-on-v6 { none; };
        servfail-ttl 0;
        qname-minimization disabled;
+       max-recursion-queries 50;
        max-recursion-depth 12;
        recursion yes;
        dnssec-validation yes;

diff --git a/bin/tests/system/resolver/ns1/named.conf.in b/bin/tests/system/resolver/ns1/named.conf.in
index d212869fa3e4793454e6021763b139576973a57f..3352b760ba1f869e62dcf75044ec9b5258a203ea 100644 (file)
--- a/bin/tests/system/resolver/ns1/named.conf.in
+++ b/bin/tests/system/resolver/ns1/named.conf.in
@@ -30,6 +30,7 @@ options {
        max-zone-ttl unlimited;
        resolver-query-timeout 5000; # 5 seconds
        attach-cache "globalcache";
+       max-recursion-queries 50;
 };
 
 trust-anchors { };

diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
index a1b3e2e2a71c79f490329c81a5f880b99dd7544b..b1a54621290fd8341241121f5858add63eb8d1f7 100644 (file)
--- a/doc/arm/reference.rst
+++ b/doc/arm/reference.rst
@@ -4594,9 +4594,12 @@ Tuning
    :tags: server, query
    :short: Sets the maximum number of iterative queries while servicing a recursive query.
 
-   This sets the maximum number of iterative queries that may be sent while
-   servicing a recursive query. If more queries are sent, the recursive
-   query is terminated and returns SERVFAIL. The default is 100.
+   This sets the maximum number of iterative queries that may be sent
+   by a resolver while looking up a single name. If more queries than this
+   need to be sent before an answer is reached, then recursion is terminated
+   and a SERVFAIL response is returned to the client. (Note: if the answer
+   is a CNAME, then the subsequent lookup for the target of the CNAME is
+   counted separately.) The default is 32.
 
 .. namedconf:statement:: notify-delay
    :tags: transfer, zone

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 2e625e7e0f4cb625ec95ed992a73a25ac7477ce0..78e0634aabca5be7fa4306a3bbe4385f1b018072 100644 (file)
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -215,7 +215,7 @@
 
 /* The default maximum number of iterative queries to allow before giving up. */
 #ifndef DEFAULT_MAX_QUERIES
-#define DEFAULT_MAX_QUERIES 100
+#define DEFAULT_MAX_QUERIES 50
 #endif /* ifndef DEFAULT_MAX_QUERIES */
 
 /*