iterate: reduce CNAME length limit: 40 -> 13

Unbound has limit 10, and practically useful numbers are way lower.

NEWS

@@ -15,6 +15,7 @@ Improvements
 - watchdog module: support testing a DNS query (and switch C -> lua; !878)
 - performance: use sendmmsg syscall towards clients by default (!877)
 - daemon now attempts to drop all capabilities (!896)
+- reduce CNAME chain length limit - now <= 12 (!899)
 
 
 Knot Resolver 4.2.2 (2019-10-07)

lib/defines.h

@@ -61,7 +61,7 @@ static inline int KR_COLD kr_error(int x) {
 #define KR_CONN_RETRY 200    /* Retry interval for network activity */
 #define KR_ITER_LIMIT 100    /* Built-in iterator limit */
 #define KR_RESOLVE_TIME_LIMIT 10000 /* Upper limit for resolution time of single query, ms */
-#define KR_CNAME_CHAIN_LIMIT 40 /* Built-in maximum CNAME chain length */
+#define KR_CNAME_CHAIN_LIMIT 13 /* Built-in maximum CNAME chain length */
 #define KR_TIMEOUT_LIMIT 4   /* Maximum number of retries after timeout. */
 #define KR_QUERY_NSRETRY_LIMIT 4 /* Maximum number of retries per query. */