[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
bin/53845: "bad cookie" in authoritative DNS server since bind 9.12 import
>Synopsis: "bad cookie" in authoritative DNS server since bind 9.12 import
>Arrival-Date: Tue Jan 08 21:55:00 +0000 2019
>Originator: Anthony Mallet
NetBSD 8.99.25: Fri Nov 9 00:44:50 CET 2018
Since the import of bind 9.12, I am getting loads of "bad cookie from ..." syslog message from my recursive named resolver. This delays all requests a lot (and sometimes even leads to a SERVFAIL).
I figured out that this comes from the CPPFLAGS used to build
bind/lib/dns/resolver.c (and probably other files as well).
Looking at bind/include/config.h, line #153
it can be seen that NetBSD does _not_ define AES_CC
However, the file bind/dist/lib/dns/resolver.c, line #2211
defines the "compute_cc" function according to this #define AES_CC
(in a rather awful way IMHO, but anyway)
This compute_cc is used line #7657 to set cc_bad=1 if the expected "edns cookie" does not match the response.
And cc_bad is checked line #7135 to display the infamous "bad cookie from ..." message.
The attached patch adds an hardcoded CPPFLAGS+=-DAES_CC to the global bind Makefile. I'm not sure if this is the proper way to fix this (e.g. why is the #define AEC_CC disabled in bind/include/config.h for NetBSD ?). It still fixes the issue for me.
Also, I'm wondering how it works if the "cookie-algorithm" is set to something else than AES in named.conf (e.g. sha256), but I could check that my patch still works in this case.
So, if someone could have a look at this and either commit the patch or find "the right fix", my DNS and I would be very grateful! :)
Set up recent named (9.12) as a recursive resolver.
Query any host, e.g:
# host example.com
and watch /var/log/named for "bad cookie" message.
RCS file: /cvsroot/src/external/mpl/bind/Makefile.inc,v
retrieving revision 1.2
diff -u -r1.2 Makefile.inc
--- Makefile.inc 16 Aug 2018 16:34:33 -0000 1.2
+++ Makefile.inc 8 Jan 2019 21:42:42 -0000
@@ -50,6 +50,7 @@
Main Index |
Thread Index |