From: Mark Andrews <marka@isc.org>
Date: Thu, 17 Sep 2015 04:20:32 +0000 (+1000)
Subject: 4212.   [func]          Re-query if we get a bad client cookie returned over
X-Git-Tag: v9.11.0a1~469
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=741b63c8695bab0582e3f9f308993ab53a60b377;p=thirdparty%2Fbind9.git

4212.   [func]          Re-query if we get a bad client cookie returned over
                        UDP. [RT #40748]
---

diff --git a/CHANGES b/CHANGES
index edf9ef97974..6198b5ba5d9 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+4212.	[func]		Re-query if we get a bad client cookie returned over
+			UDP. [RT #40748]
+
 4211.	[bug]		Ensure that lwresd gets at least one task to work
 			with if enabled. [RT #40652]
 
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 17f60b77f07..d987316325d 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -7756,8 +7756,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	if (opt != NULL)
 		process_opt(query, opt);
 
-#ifdef notyet
-	if (message->cc_bad) {
+	if (message->cc_bad && (options & DNS_FETCHOPT_TCP) == 0) {
 		/*
 		 * If the COOKIE is bad assume it is a attack and retry.
 		 */
@@ -7766,7 +7765,6 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 		FCTXTRACE("bad cookie");
 		goto done;
 	}
-#endif
 
 	/*
 	 * If the message is signed, check the signature.  If not, this