Merge b199e48 into ac8898f

PowerDNS · Nov 10, 2023 · fa188ff · fa188ff
2 parents ac8898f + b199e48
commit fa188ff
Show file tree

Hide file tree

Showing 3 changed files with 7 additions and 5 deletions.
diff --git a/pdns/recursordist/settings/table.py b/pdns/recursordist/settings/table.py
@@ -1811,14 +1811,15 @@
         'name' : 'nsec3_max_iterations',
         'section' : 'dnssec',
         'type' : LType.Uint64,
-        'default' : '150',
+        'default' : '50',
         'help' : 'Maximum number of iterations allowed for an NSEC3 record',
         'doc' : '''
 Maximum number of iterations allowed for an NSEC3 record.
-If an answer containing an NSEC3 record with more iterations is received, its DNSSEC validation status is treated as Insecure.
+If an answer containing an NSEC3 record with more iterations is received, its DNSSEC validation status is treated as ``Insecure``.
  ''',
         'versionadded': '4.1.0',
-        'versionchanged': ('4.5.2', 'Default is now 150, was 2500 before.')
+        'versionchanged': [('4.5.2', 'Default is now 150, was 2500 before.'),
+                           ('5.0.0', 'Default is now 50, was 150 before.')]
     },
     {
         'name' : 'ttl',

diff --git a/regression-tests.recursor-dnssec/test_AggressiveNSECCache.py b/regression-tests.recursor-dnssec/test_AggressiveNSECCache.py
@@ -16,6 +16,7 @@ class AggressiveNSECCacheBase(RecursorTest):
     _config_template = """
     dnssec=validate
     aggressive-nsec-cache-size=10000
+    nsec3-max-iterations=150
     webserver=yes
     webserver-port=%d
     webserver-address=127.0.0.1

diff --git a/regression-tests.recursor-dnssec/test_basicNSEC3.py b/regression-tests.recursor-dnssec/test_basicNSEC3.py
@@ -34,10 +34,10 @@ def secureZone(cls, confdir, zonename, key=None):
         except subprocess.CalledProcessError as e:
             raise AssertionError('%s failed (%d): %s' % (pdnsutilCmd, e.returncode, e.output))
 
-        params = "1 0 100 AABBCCDDEEFF112233"
+        params = "1 0 50 AABBCCDDEEFF112233"
 
         if zone == "optout.example":
-            params = "1 1 100 AABBCCDDEEFF112233"
+            params = "1 1 50 AABBCCDDEEFF112233"
 
         pdnsutilCmd = [os.environ['PDNSUTIL'],
                        '--config-dir=%s' % confdir,