Un-deprecate the answer-cookie option

diff --git a/CHANGES b/CHANGES
index 2440bd53abb5fc737a841e23dba29cae13fab53f..80800b8c6298ffddaf9460cbe3f38c32c0c30c64 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+4983.  [cleanup]       Remove the deprecated flag from "answer-cookie";
+                       it will be allowed to persist into 9.13. [GL #275].
+
 4982.  [cleanup]       Return FORMERR if the question section is empty
                        and no COOKIE option is present; this restores
                        older behavior except in the newly specified

diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
index 37513b98c7e44848614ae847dbd61af51f699c2c..3ecdc046d0ae5c51913294e08913280e6767f778 100644 (file)
--- a/doc/arm/Bv9ARM-book.xml
+++ b/doc/arm/Bv9ARM-book.xml
@@ -6183,19 +6183,16 @@ options {
                  options level, not per-view.
                </para>
                <para>
-                 <command>answer-cookie</command> is only available
-                 as a temporary measure, for use when
-                 <command>named</command> shares an IP address
-                 with other servers that do not yet support DNS
-                 COOKIE.  A mismatch between servers on the same
-                 address is not expected to cause operational
-                 problems, but the option to disable COOKIE responses
-                 so that all servers have the same behavior is
-                 provided out of an abundance of caution. DNS COOKIE
-                 is an important security mechanism and should not be
-                 disabled unless absolutely necessary.  The
-                 <command>answer-cookie</command> option is obsolete
-                 as of BIND 9.13.
+                 <command>answer-cookie no</command> is only intended as a
+                 temporary measure, for use when <command>named</command>
+                 shares an IP address with other servers that do not yet
+                 support DNS COOKIE.  A mismatch between servers on the
+                 same address is not expected to cause operational
+                 problems, but the option to disable COOKIE responses so
+                 that all servers have the same behavior is provided out
+                 of an abundance of caution. DNS COOKIE is an important
+                 security mechanism, and should not be disabled unless
+                 absolutely necessary.
                </para>
              </listitem>
            </varlistentry>

diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
index 5b24aac99497253c81f7a556eeda96b5189d2b81..0cebfe9290e89d9cbe1eee0a7f84f588341342ce 100644 (file)
--- a/doc/arm/notes.xml
+++ b/doc/arm/notes.xml
@@ -118,8 +118,7 @@
          servers have the same behavior is provided out of an
          abundance of caution. DNS COOKIE is an important security
          mechanism and should not be disabled unless absolutely
-         necessary.  The <command>answer-cookie</command> option
-         is obsolete as of BIND 9.13.
+         necessary.
        </para>
       </listitem>
     </itemizedlist>
@@ -135,6 +134,26 @@
          using (now obsolete) idnkit-1 library.
        </para>
       </listitem>
+      <listitem>
+       <para>
+         Add the ability to not return a DNS COOKIE option when one
+         is present in the request.  To prevent a cookie being returned
+         add <command>answer-cookie no;</command> to
+         <filename>named.conf</filename>. [GL #173]
+       </para>
+       <para>
+         <command>answer-cookie no</command> is only intended as a
+         temporary measure, for use when <command>named</command>
+         shares an IP address with other servers that do not yet
+         support DNS COOKIE.  A mismatch between servers on the
+         same address is not expected to cause operational problems,
+         but the option to disable COOKIE responses so that all
+         servers have the same behavior is provided out of an
+         abundance of caution. DNS COOKIE is an important security
+         mechanism, and should not be disabled unless absolutely
+         necessary.
+       </para>
+      </listitem>
     </itemizedlist>
   </section>
 

diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
index ecd5920647901addddd5ef9fb6a2bb26ea2d4292..8d496ff9ce9a4ce232278ed5e9ecfc8b2b415ddf 100644 (file)
--- a/lib/isccfg/namedconf.c
+++ b/lib/isccfg/namedconf.c
@@ -1024,7 +1024,7 @@ static cfg_type_t cfg_type_fstrm_model = {
  */
 static cfg_clausedef_t
 options_clauses[] = {
-       { "answer-cookie", &cfg_type_boolean, CFG_CLAUSEFLAG_DEPRECATED },
+       { "answer-cookie", &cfg_type_boolean, 0 },
        { "automatic-interface-scan", &cfg_type_boolean, 0 },
        { "avoid-v4-udp-ports", &cfg_type_bracketed_portlist, 0 },
        { "avoid-v6-udp-ports", &cfg_type_bracketed_portlist, 0 },