bind9/bin
Ondřej Surý c1ba80169c
Introduce max-delegation-servers configuration option
Make the maximum number of processed delegation nameservers configurable
via the new 'max-delegation-servers' option (default: 13), replacing the
hardcoded NS_PROCESSING_LIMIT (20).

The default is reduced to 13 to precisely match the maximum number of
root servers that can fit into a classic 512-byte UDP payload.  This
provides a natural, historically sound cap that mitigates resource
exhaustion and amplification attacks from artificially inflated or
misconfigured delegations.

The configuration option is strictly bounded between 1 and 100 to ensure
resolver stability.
2026-03-04 16:13:49 +01:00
..
check cfg_parse_ API doesn't need memory context 2025-12-04 16:09:40 +01:00
confgen Change the 'isc_g_mctx' to be always available 2025-08-04 11:29:50 +02:00
delv Use const pointer with strchr of const pointer 2026-01-20 16:23:58 +11:00
dig Add examples to the dig man page 2026-02-22 11:03:10 -05:00
dnssec Importing invalid SKR file might overflow the stack buffer 2026-02-24 19:44:57 +01:00
include Introduce max-delegation-servers configuration option 2026-03-04 16:13:49 +01:00
named Introduce max-delegation-servers configuration option 2026-03-04 16:13:49 +01:00
nsupdate Rename isc_net_getudpportrange() to isc_net_getportrange() 2026-02-20 14:06:23 +01:00
plugins Apply the dns_rdataset_cleanup patch through the codebase 2025-12-17 15:19:55 +01:00
rndc List 'rndc dnssec' arguments in alphabetic order 2026-02-16 16:28:47 +00:00
tests Introduce max-delegation-servers configuration option 2026-03-04 16:13:49 +01:00
tools Rename isc_net_getudpportrange() to isc_net_getportrange() 2026-02-20 14:06:23 +01:00
meson.build replace the build system with meson 2025-06-11 10:30:12 +03:00