NetBSD-Bugs archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

bin/53845: "bad cookie" in authoritative DNS server since bind 9.12 import

>Number:         53845
>Category:       bin
>Synopsis:       "bad cookie" in authoritative DNS server since bind 9.12 import
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Jan 08 21:55:00 +0000 2019
>Originator:     Anthony Mallet
>Release:        -current
NetBSD 8.99.25: Fri Nov  9 00:44:50 CET 2018 
Since the import of bind 9.12, I am getting loads of "bad cookie from ..." syslog message from my recursive named resolver. This delays all requests a lot (and sometimes even leads to a SERVFAIL).

I figured out that this comes from the CPPFLAGS used to build 
bind/lib/dns/resolver.c (and probably other files as well).

Looking at bind/include/config.h, line #153
it can be seen that NetBSD does _not_ define AES_CC

However, the file bind/dist/lib/dns/resolver.c, line #2211
defines the "compute_cc" function according to this #define AES_CC
(in a rather awful way IMHO, but anyway)

This compute_cc is used line #7657 to set cc_bad=1 if the expected "edns cookie" does not match the response.

And cc_bad is checked line #7135 to display the infamous "bad cookie from ..." message.

The attached patch adds an hardcoded CPPFLAGS+=-DAES_CC to the global bind Makefile. I'm not sure if this is the proper way to fix this (e.g. why is the #define AEC_CC disabled in bind/include/config.h for NetBSD ?). It still fixes the issue for me.

Also, I'm wondering how it works if the "cookie-algorithm" is set to something else than AES in named.conf (e.g. sha256), but I could check that my patch still works in this case.

So, if someone could have a look at this and either commit the patch or find "the right fix", my DNS and I would be very grateful! :)

Set up recent named (9.12) as a recursive resolver.
Query any host, e.g:
# host
and watch /var/log/named for "bad cookie" message.

RCS file: /cvsroot/src/external/mpl/bind/,v
retrieving revision 1.2
diff -u -r1.2
---        16 Aug 2018 16:34:33 -0000      1.2
+++        8 Jan 2019 21:42:42 -0000
@@ -50,6 +50,7 @@
 .if defined(HAVE_GCC)
 COPTS+=        -Wno-pointer-sign

Home | Main Index | Thread Index | Old Index