4152. [func] Implement DNS COOKIE option. This replaces the

experimental SIT option of BIND 9.10. The following named.conf directives are avaliable: send-cookie, cookie-secret, cookie-algorithm and nocookie-udp-size. The following dig options are available: +[no]cookie[=value] and +[no]badcookie. [RT #39928]
2015-07-06 09:44:24 +10:00
parent aa3bffca69
commit ce67023ae3
58 changed files with 1000 additions and 1080 deletions
@@ -1,3 +1,10 @@
+4152.	[func]		Implement DNS COOKIE option.  This replaces the
+			experimental SIT option of BIND 9.10.  The following
+			named.conf directives are avaliable: send-cookie,
+			cookie-secret, cookie-algorithm and nocookie-udp-size.
+			The following dig options are available:
+			+[no]cookie[=value] and +[no]badcookie.  [RT #39928]
+
 4151.	[bug]		'rndc flush' could cause a deadlock. [RT #39835]

 4150.	[bug]		win32: listen-on-v6 { any; }; was not working.  Apply
@@ -35,6 +35,7 @@
 #include <dns/masterdump.h>
 #include <dns/message.h>
 #include <dns/name.h>
+#include <dns/rcode.h>
 #include <dns/rdata.h>
 #include <dns/rdataset.h>
 #include <dns/rdatatype.h>
@@ -61,9 +62,7 @@ static char *argv0;
 static int addresscount = 0;

 static char domainopt[DNS_NAME_MAXTEXT];
-#ifdef ISC_PLATFORM_USESIT
-static char sitvalue[256];
-#endif
+static char hexcookie[81];

 static isc_boolean_t short_form = ISC_FALSE, printcmd = ISC_TRUE,
 	ip6_int = ISC_FALSE, plusquest = ISC_FALSE, pluscomm = ISC_FALSE,
@@ -92,43 +91,21 @@ static const char * const opcodetext[] = {
 	"RESERVED15"
 };

-/*% return code text */
-static const char * const rcodetext[] = {
-	"NOERROR",
-	"FORMERR",
-	"SERVFAIL",
-	"NXDOMAIN",
-	"NOTIMP",
-	"REFUSED",
-	"YXDOMAIN",
-	"YXRRSET",
-	"NXRRSET",
-	"NOTAUTH",
-	"NOTZONE",
-	"RESERVED11",
-	"RESERVED12",
-	"RESERVED13",
-	"RESERVED14",
-	"RESERVED15",
-	"BADVERS"
-};
+static const char *
+rcode_totext(dns_rcode_t rcode) {
+	static char buf[64];
+	isc_buffer_t b;
+	isc_result_t result;

-/*% safe rcodetext[] */
-static char *
-rcode_totext(dns_rcode_t rcode)
-{
-	static char buf[sizeof("?65535")];
-	union {
-		const char *consttext;
-		char *deconsttext;
-	} totext;
-
-	if (rcode >= (sizeof(rcodetext)/sizeof(rcodetext[0]))) {
-		snprintf(buf, sizeof(buf), "?%u", rcode);
-		totext.deconsttext = buf;
-	} else
-		totext.consttext = rcodetext[rcode];
-	return totext.deconsttext;
+	memset(buf, 0, sizeof(buf));
+	isc_buffer_init(&b, buf + 1, sizeof(buf) - 2);
+	result = dns_rcode_totext(rcode, &b);
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	if (strspn(buf + 1, "0123456789") == strlen(buf + 1)) {
+		buf[0] = '?';
+		return(buf);
+	}
+	return (buf + 1);
 }

 /*% print usage */
@@ -233,9 +210,8 @@ help(void) {
 "                 +[no]expire         (Request time to expire)\n"
 "                 +[no]nsid           (Request Name Server ID)\n"
 "                 +[no]header-only    (Send query without a question section)\n"
-#ifdef ISC_PLATFORM_USESIT
-"                 +[no]sit            (Request a Source Identity Token)\n"
-#endif
+"                 +[no]badcookie      (Retry BADCOOKIE responses)\n"
+"                 +[no]cookie         (Add a COOKIE option to the request)\n"
 #ifdef DIG_SIGCHASE
 "                 +[no]sigchase       (Chase DNSSEC signatures)\n"
 "                 +trusted-key=####   (Trusted Key when chasing DNSSEC sigs)\n"
@@ -767,9 +743,7 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 	char *cmd, *value, *ptr, *code;
 	isc_uint32_t num;
 	isc_boolean_t state = ISC_TRUE;
-#if defined(DIG_SIGCHASE) || defined(ISC_PLATFORM_USESIT)
 	size_t n;
-#endif

 	strncpy(option_store, option, sizeof(option_store));
 	option_store[sizeof(option_store)-1]=0;
@@ -846,6 +820,10 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 		break;
 	case 'b':
 		switch (cmd[1]) {
+		case 'a':/* badcookie */
+			FULLCHECK("badcookie");
+			lookup->besteffort = state;
+			break;
 		case 'e':/* besteffort */
 			FULLCHECK("besteffort");
 			lookup->besteffort = state;
@@ -889,10 +867,30 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 			printcmd = state;
 			break;
 		case 'o': /* comments */
-			FULLCHECK("comments");
-			lookup->comments = state;
-			if (lookup == default_lookup)
-				pluscomm = state;
+			switch (cmd[2]) {
+			case 'm':
+				FULLCHECK("comments");
+				lookup->comments = state;
+				if (lookup == default_lookup)
+					pluscomm = state;
+				break;
+			case 'o': /* cookie */
+				FULLCHECK("cookie");
+				if (state && lookup->edns == -1)
+					lookup->edns = 0;
+				lookup->sendcookie = state;
+				if (value != NULL) {
+					n = strlcpy(hexcookie, value,
+						    sizeof(hexcookie));
+					if (n >= sizeof(hexcookie))
+						fatal("COOKIE data too large");
+					lookup->cookie = hexcookie;
+				} else
+					lookup->cookie = NULL;
+				break;
+			default:
+				goto invalid_option;
+			}
 			break;
 		case 'r':
 			FULLCHECK("crypto");
@@ -1222,36 +1220,12 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 				goto invalid_option;
 			}
 			break;
-#if defined(DIG_SIGCHASE) || defined(ISC_PLATFORM_USESIT)
-		case 'i':
-			switch (cmd[2]) {
 #ifdef DIG_SIGCHASE
-			case 'g': /* sigchase */
-				FULLCHECK("sigchase");
-				lookup->sigchase = state;
-				if (lookup->sigchase)
-					lookup->dnssec = ISC_TRUE;
-				break;
-#endif
-#ifdef ISC_PLATFORM_USESIT
-			case 't': /* sit */
-				FULLCHECK("sit");
-				if (state && lookup->edns == -1)
-					lookup->edns = 0;
-				lookup->sit = state;
-				if (value != NULL) {
-					n = strlcpy(sitvalue, value,
-						    sizeof(sitvalue));
-					if (n >= sizeof(sitvalue))
-						fatal("SIT data too large");
-					lookup->sitvalue = sitvalue;
-				} else
-					lookup->sitvalue = NULL;
-				break;
-#endif
-			default:
-				goto invalid_option;
-			}
+		case 'i': /* sigchase */
+			FULLCHECK("sigchase");
+			lookup->sigchase = state;
+			if (lookup->sigchase)
+				lookup->dnssec = ISC_TRUE;
 			break;
 #endif
 		case 'p': /* split */
@@ -1353,6 +1327,7 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 					lookup->section_authority = ISC_TRUE;
 					lookup->section_question = ISC_FALSE;
 					lookup->dnssec = ISC_TRUE;
+					lookup->sendcookie = ISC_TRUE;
 					usesearch = ISC_FALSE;
 				}
 				break;
@@ -1789,6 +1764,7 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 		default_lookup = make_empty_lookup();
 		default_lookup->adflag = ISC_TRUE;
 		default_lookup->edns = 0;
+		default_lookup->sendcookie = ISC_TRUE;

 #ifndef NOPOSIX
 		/*
@@ -219,49 +219,49 @@

    <variablelist>
      <varlistentry>
-        <term>-4</term>
-        <listitem>
+	<term>-4</term>
+	<listitem>
 	  <para>
 	    Use IPv4 only.
 	  </para>
-        </listitem>
+	</listitem>
      </varlistentry>

      <varlistentry>
-        <term>-6</term>
-        <listitem>
+	<term>-6</term>
+	<listitem>
 	  <para>
 	    Use IPv6 only.
 	  </para>
-        </listitem>
+	</listitem>
      </varlistentry>

      <varlistentry>
-        <term>-b <replaceable class="parameter">address<optional>#port</optional></replaceable></term>
-        <listitem>
+	<term>-b <replaceable class="parameter">address<optional>#port</optional></replaceable></term>
+	<listitem>
 	  <para>
 	    Set the source IP address of the query.
 	    The <parameter>address</parameter> must be a valid address on
 	    one of the host's network interfaces, or "0.0.0.0" or "::". An
 	    optional port may be specified by appending "#&lt;port&gt;"
 	  </para>
-        </listitem>
+	</listitem>
      </varlistentry>

      <varlistentry>
-        <term>-c <replaceable class="parameter">class</replaceable></term>
-        <listitem>
+	<term>-c <replaceable class="parameter">class</replaceable></term>
+	<listitem>
 	  <para>
 	    Set the query class. The
 	    default <parameter>class</parameter> is IN; other classes
 	    are HS for Hesiod records or CH for Chaosnet records.
 	  </para>
-        </listitem>
+	</listitem>
      </varlistentry>

      <varlistentry>
-        <term>-f <replaceable class="parameter">file</replaceable></term>
-        <listitem>
+	<term>-f <replaceable class="parameter">file</replaceable></term>
+	<listitem>
 	  <para>
 	    Batch mode: <command>dig</command> reads a list of lookup
 	    requests to process from the
@@ -270,23 +270,23 @@
 	    presented as queries to
 	    <command>dig</command> using the command-line interface.
 	  </para>
-        </listitem>
+	</listitem>
      </varlistentry>

      <varlistentry>
-        <term>-i</term>
-        <listitem>
+	<term>-i</term>
+	<listitem>
 	  <para>
 	    Do reverse IPv6 lookups using the obsolete RFC1886 IP6.INT
 	    domain, which is no longer in use. Obsolete bit string
 	    label queries (RFC2874) are not attempted.
 	  </para>
-        </listitem>
+	</listitem>
      </varlistentry>

      <varlistentry>
-        <term>-k <replaceable class="parameter">keyfile</replaceable></term>
-        <listitem>
+	<term>-k <replaceable class="parameter">keyfile</replaceable></term>
+	<listitem>
 	  <para>
 	    Sign queries using TSIG using a key read from the given file.
 	    Key files can be generated using
@@ -300,45 +300,45 @@
 	    and <command>server</command> statements in
 	    <filename>named.conf</filename>.
 	  </para>
-        </listitem>
+	</listitem>
      </varlistentry>

      <varlistentry>
-        <term>-m</term>
-        <listitem>
+	<term>-m</term>
+	<listitem>
 	  <para>
 	    Enable memory usage debugging.
 	    <!-- It enables ISC_MEM_DEBUGTRACE and ISC_MEM_DEBUGRECORD
 		 documented in include/isc/mem.h -->
 	  </para>
-        </listitem>
+	</listitem>
      </varlistentry>

      <varlistentry>
-        <term>-p <replaceable class="parameter">port</replaceable></term>
-        <listitem>
+	<term>-p <replaceable class="parameter">port</replaceable></term>
+	<listitem>
 	  <para>
 	    Send the query to a non-standard port on the server,
 	    instead of the defaut port 53. This option would be used
 	    to test a name server that has been configured to listen
 	    for queries on a non-standard port number.
 	  </para>
-        </listitem>
+	</listitem>
      </varlistentry>

      <varlistentry>
-        <term>-q <replaceable class="parameter">name</replaceable></term>
-        <listitem>
+	<term>-q <replaceable class="parameter">name</replaceable></term>
+	<listitem>
 	  <para>
 	    The domain name to query. This is useful to distinguish
 	    the <parameter>name</parameter> from other arguments.
 	  </para>
-        </listitem>
+	</listitem>
      </varlistentry>

      <varlistentry>
-        <term>-t <replaceable class="parameter">type</replaceable></term>
-        <listitem>
+	<term>-t <replaceable class="parameter">type</replaceable></term>
+	<listitem>
 	  <para>
 	    The resource record type to query. It can be any valid query type
 	    which is
@@ -352,21 +352,21 @@
 	    record was
 	    <parameter>N</parameter>.
 	  </para>
-        </listitem>
+	</listitem>
      </varlistentry>

      <varlistentry>
-        <term>-v</term>
-        <listitem>
+	<term>-v</term>
+	<listitem>
 	  <para>
 	    Print the version number and exit.
 	  </para>
-        </listitem>
+	</listitem>
      </varlistentry>

      <varlistentry>
-        <term>-x <replaceable class="parameter">addr</replaceable></term>
-        <listitem>
+	<term>-x <replaceable class="parameter">addr</replaceable></term>
+	<listitem>
 	  <para>
 	    Simplified reverse lookups, for mapping addresses to
 	    names. The <parameter>addr</parameter> is an IPv4 address
@@ -383,12 +383,12 @@
 	    IP6.ARPA domain (but see also the <option>-i</option>
 	    option).
 	  </para>
-        </listitem>
+	</listitem>
      </varlistentry>

      <varlistentry>
-        <term>-y <replaceable class="parameter"><optional>hmac:</optional>keyname:secret</replaceable></term>
-        <listitem>
+	<term>-y <replaceable class="parameter"><optional>hmac:</optional>keyname:secret</replaceable></term>
+	<listitem>
 	  <para>
 	    Sign queries using TSIG with the given authentication key.
 	    <parameter>keyname</parameter> is the name of the key, and
@@ -407,11 +407,11 @@
 	    a command line argument in clear text. This may be visible
 	    in the output from
 	    <citerefentry>
-              <refentrytitle>ps</refentrytitle><manvolnum>1</manvolnum>
+	      <refentrytitle>ps</refentrytitle><manvolnum>1</manvolnum>
 	    </citerefentry>
 	    or in a history file maintained by the user's shell.
 	  </para>
-        </listitem>
+	</listitem>
      </varlistentry>

    </variablelist>
@@ -517,6 +517,16 @@
 	  </listitem>
 	</varlistentry>

+	<varlistentry>
+	  <term><option>+[no]badcookie</option></term>
+	  <listitem>
+	    <para>
+	      Retry lookup with the new server cookie if a
+	      BADCOOKIE response is received.
+	    </para>
+	  </listitem>
+	</varlistentry>
+
 	<varlistentry>
 	  <term><option>+[no]besteffort</option></term>
 	  <listitem>
@@ -585,6 +595,23 @@
 	  </listitem>
 	</varlistentry>

+	<varlistentry>
+	  <term><option>+[no]cookie<optional>=####</optional></option></term>
+	  <listitem>
+	    <para>
+	      Send a COOKIE EDNS option, with optional
+	      value.  Replaying a COOKIE from a previous response will
+	      allow the server to identify a previous client.  The
+	      default is <option>+cookie</option>.
+	    </para>
+	    <para>
+	      <command>+cookie</command> is also set when +trace
+	      is set to better emulate the default queries from a
+	      nameserver.
+	    </para>
+	  </listitem>
+	</varlistentry>
+
 	<varlistentry>
 	  <term><option>+[no]crypto</option></term>
 	  <listitem>
@@ -952,19 +979,6 @@
 	  </listitem>
 	</varlistentry>

-	<varlistentry>
-	  <term><option>+[no]sit<optional>=####</optional></option></term>
-	  <listitem>
-	    <para>
-	      Send a Source Identity Token EDNS option, with optional
-	      value.  Replaying a SIT from a previous response will
-	      allow the server to identify a previous client.  The
-	      default is <option>+nosit</option>.  Currently using
-	      experimental value 65001 for the option code.
-	    </para>
-	  </listitem>
-	</varlistentry>
-
 	<varlistentry>
 	  <term><option>+split=W</option></term>
 	  <listitem>
@@ -149,9 +149,7 @@ int ndots = -1;
 int tries = 3;
 int lookup_counter = 0;

-#ifdef ISC_PLATFORM_USESIT
-static char sitvalue[256];
-#endif
+static char servercookie[256];

 #ifdef WITH_IDN
 static void		initialize_idn(void);
@@ -792,9 +790,9 @@ make_empty_lookup(void) {
 	looknew->expire = ISC_FALSE;
 	looknew->nsid = ISC_FALSE;
 	looknew->header_only = ISC_FALSE;
-#ifdef ISC_PLATFORM_USESIT
-	looknew->sit = ISC_FALSE;
-#endif
+	looknew->sendcookie = ISC_FALSE;
+	looknew->seenbadcookie = ISC_FALSE;
+	looknew->badcookie = ISC_TRUE;
 #ifdef DIG_SIGCHASE
 	looknew->sigchase = ISC_FALSE;
 #if DIG_SIGCHASE_TD
@@ -833,9 +831,7 @@ make_empty_lookup(void) {
 	looknew->done_as_is = ISC_FALSE;
 	looknew->need_search = ISC_FALSE;
 	looknew->ecs_addr = NULL;
-#ifdef ISC_PLATFORM_USESIT
-	looknew->sitvalue = NULL;
-#endif
+	looknew->cookie = NULL;
 	looknew->ednsopts = NULL;
 	looknew->ednsoptscnt = 0;
 	looknew->ednsneg = ISC_TRUE;
@@ -891,10 +887,10 @@ clone_lookup(dig_lookup_t *lookold, isc_boolean_t servers) {
 	looknew->expire = lookold->expire;
 	looknew->nsid = lookold->nsid;
 	looknew->header_only = lookold->header_only;
-#ifdef ISC_PLATFORM_USESIT
-	looknew->sit = lookold->sit;
-	looknew->sitvalue = lookold->sitvalue;
-#endif
+	looknew->sendcookie = lookold->sendcookie;
+	looknew->seenbadcookie = lookold->seenbadcookie;
+	looknew->badcookie = lookold->badcookie;
+	looknew->cookie = lookold->cookie;
 	looknew->ednsopts = lookold->ednsopts;
 	looknew->ednsoptscnt = lookold->ednsoptscnt;
 	looknew->ednsneg = lookold->ednsneg;
@@ -1575,7 +1571,7 @@ save_opt(dig_lookup_t *lookup, char *code, char *value) {
 /*%
 * Add EDNS0 option record to a message.  Currently, the only supported
 * options are UDP buffer size, the DO bit, and EDNS options
- * (e.g., NSID, SIT, client-subnet)
+ * (e.g., NSID, COOKIE, client-subnet)
 */
 static void
 add_opt(dns_message_t *msg, isc_uint16_t udpsize, isc_uint16_t edns,
@@ -2174,14 +2170,12 @@ insert_soa(dig_lookup_t *lookup) {
 	dns_message_addname(lookup->sendmsg, soaname, DNS_SECTION_AUTHORITY);
 }

-#ifdef ISC_PLATFORM_USESIT
 static void
 compute_cookie(unsigned char *clientcookie, size_t len) {
 	/* XXXMPA need to fix, should be per server. */
 	INSIST(len >= 8U);
 	memmove(clientcookie, cookie_secret, 8);
 }
-#endif

 /*%
 * Setup the supplied lookup structure, making it ready to start sending
@@ -2200,9 +2194,7 @@ setup_lookup(dig_lookup_t *lookup) {
 	dns_compress_t cctx;
 	char store[MXNAME];
 	char ecsbuf[20];
-#ifdef ISC_PLATFORM_USESIT
-	char sitbuf[256];
-#endif
+	char cookiebuf[256];
 #ifdef WITH_IDN
 	idn_result_t mr;
 	char utf8_textname[MXNAME], utf8_origin[MXNAME], idn_textname[MXNAME];
@@ -2534,13 +2526,13 @@ setup_lookup(dig_lookup_t *lookup) {
 			i++;
 		}

-#ifdef ISC_PLATFORM_USESIT
-		if (lookup->sit) {
+		if (lookup->sendcookie) {
 			INSIST(i < DNS_EDNSOPTIONS);
-			opts[i].code = DNS_OPT_SIT;
-			if (lookup->sitvalue != NULL) {
-				isc_buffer_init(&b, sitbuf, sizeof(sitbuf));
-				result = isc_hex_decodestring(lookup->sitvalue,
+			opts[i].code = DNS_OPT_COOKIE;
+			if (lookup->cookie != NULL) {
+				isc_buffer_init(&b, cookiebuf,
+						sizeof(cookiebuf));
+				result = isc_hex_decodestring(lookup->cookie,
 							      &b);
 				check_result(result, "isc_hex_decodestring");
 				opts[i].value = isc_buffer_base(&b);
@@ -2552,7 +2544,6 @@ setup_lookup(dig_lookup_t *lookup) {
 			}
 			i++;
 		}
-#endif

 		if (lookup->expire) {
 			INSIST(i < DNS_EDNSOPTIONS);
@@ -3411,56 +3402,53 @@ check_for_more_data(dig_query_t *query, dns_message_t *msg,
 	return (ISC_TRUE);
 }

-#ifdef ISC_PLATFORM_USESIT
 static void
-process_sit(dig_lookup_t *l, dns_message_t *msg,
-	    isc_buffer_t *optbuf, size_t optlen)
+process_cookie(dig_lookup_t *l, dns_message_t *msg,
+	       isc_buffer_t *optbuf, size_t optlen)
 {
 	char bb[256];
 	isc_buffer_t hexbuf;
 	size_t len;
-	const unsigned char *sit;
-	isc_boolean_t copysit;
+	const unsigned char *sent;
+	isc_boolean_t copy = ISC_TRUE;
 	isc_result_t result;

-	if (l->sitvalue != NULL) {
+	if (l->cookie != NULL) {
 		isc_buffer_init(&hexbuf, bb, sizeof(bb));
-		result = isc_hex_decodestring(l->sitvalue, &hexbuf);
+		result = isc_hex_decodestring(l->cookie, &hexbuf);
 		check_result(result, "isc_hex_decodestring");
-		sit = isc_buffer_base(&hexbuf);
+		sent = isc_buffer_base(&hexbuf);
 		len = isc_buffer_usedlength(&hexbuf);
-		copysit = ISC_FALSE;
 	} else {
-		sit = cookie;
+		sent = cookie;
 		len = sizeof(cookie);
-		copysit = ISC_TRUE;
 	}

-	INSIST(msg->sitok == 0 && msg->sitbad == 0);
+	INSIST(msg->cc_ok == 0 && msg->cc_bad == 0);
 	if (optlen >= len && optlen >= 8U) {
-		if (memcmp(isc_buffer_current(optbuf), sit, 8) == 0) {
-			msg->sitok = 1;
+		if (memcmp(isc_buffer_current(optbuf), sent, 8) == 0) {
+			msg->cc_ok = 1;
 		} else {
-			printf(";; Warning: SIT client cookie mismatch\n");
-			msg->sitbad = 1;
-			copysit = ISC_FALSE;
+			printf(";; Warning: Client COOKIE mismatch\n");
+			msg->cc_bad = 1;
+			copy = ISC_FALSE;
 		}
 	} else {
-		printf(";; Warning: SIT bad token (too short)\n");
-		msg->sitbad = 1;
-		copysit = ISC_FALSE;
+		printf(";; Warning: COOKIE bad token (too short)\n");
+		msg->cc_bad = 1;
+		copy = ISC_FALSE;
 	}
-	if (copysit) {
+	if (copy) {
 		isc_region_t r;

 		r.base = isc_buffer_current(optbuf);
 		r.length = (unsigned int)optlen;
-		isc_buffer_init(&hexbuf, sitvalue, sizeof(sitvalue));
+		isc_buffer_init(&hexbuf, servercookie, sizeof(servercookie));
 		result = isc_hex_totext(&r, 2, "", &hexbuf);
 		check_result(result, "isc_hex_totext");
 		if (isc_buffer_availablelength(&hexbuf) > 0) {
 			isc_buffer_putuint8(&hexbuf, 0);
-			l->sitvalue = sitvalue;
+			l->cookie = servercookie;
 		}
 	}
 	isc_buffer_forward(optbuf, (unsigned int)optlen);
@@ -3484,8 +3472,8 @@ process_opt(dig_lookup_t *l, dns_message_t *msg) {
 			optcode = isc_buffer_getuint16(&optbuf);
 			optlen = isc_buffer_getuint16(&optbuf);
 			switch (optcode) {
-			case DNS_OPT_SIT:
-				process_sit(l, msg, &optbuf, optlen);
+			case DNS_OPT_COOKIE:
+				process_cookie(l, msg, &optbuf, optlen);
 				break;
 			default:
 				isc_buffer_forward(&optbuf, optlen);
@@ -3494,7 +3482,6 @@ process_opt(dig_lookup_t *l, dns_message_t *msg) {
 		}
 	}
 }
-#endif

 static int
 ednsvers(dns_rdataset_t *opt) {
@@ -3782,10 +3769,8 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 	}
 	if ((msg->flags & DNS_MESSAGEFLAG_TC) != 0 &&
 	    !l->ignore && !l->tcp_mode) {
-#ifdef ISC_PLATFORM_USESIT
-		if (l->sitvalue == NULL && l->sit && msg->opt != NULL)
+		if (l->cookie == NULL && l->sendcookie && msg->opt != NULL)
 			process_opt(l, msg);
-#endif
 		if (l->comments)
 			printf(";; Truncated, retrying in TCP mode.\n");
 		n = requeue_lookup(l, ISC_TRUE);
@@ -3799,6 +3784,27 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		UNLOCK_LOOKUP;
 		return;
 	}
+	if (msg->rcode == dns_rcode_badcookie && !l->tcp_mode &&
+	    l->sendcookie && l->badcookie) {
+		process_opt(l, msg);
+		if (msg->cc_ok) {
+			if (l->comments)
+				printf(";; BADCOOKIE, retrying%s.\n",
+				       l->seenbadcookie ? " in TCP mode" : "");
+			n = requeue_lookup(l, ISC_TRUE);
+			if (l->seenbadcookie)
+				n->tcp_mode = ISC_TRUE;
+			n->seenbadcookie = ISC_TRUE;
+			n->origin = query->lookup->origin;
+			dns_message_destroy(&msg);
+			isc_event_free(&event);
+			clear_query(query);
+			cancel_lookup(l);
+			check_next_lookup(l);
+			UNLOCK_LOOKUP;
+			return;
+		}
+	}
 	if ((msg->rcode == dns_rcode_servfail && !l->servfail_stops) ||
 	    (check_ra && (msg->flags & DNS_MESSAGEFLAG_RA) == 0 && l->recurse))
 	{
@@ -3887,16 +3893,13 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		}
 	}

-#ifdef ISC_PLATFORM_USESIT
-	if (l->sitvalue != NULL) {
+	if (l->cookie != NULL) {
 		if (msg->opt == NULL)
 			printf(";; expected opt record in response\n");
 		else
 			process_opt(l, msg);
-	} else if (l->sit && msg->opt != NULL)
+	} else if (l->sendcookie && msg->opt != NULL)
 		process_opt(l, msg);
-#endif
-
 	if (!l->doing_xfr || l->xfr_q == query) {
 		if (msg->rcode == dns_rcode_nxdomain &&
 		    (l->origin != NULL || l->need_search)) {
@@ -131,9 +131,9 @@ struct dig_lookup {
 		besteffort,
 		dnssec,
 		expire,
-#ifdef ISC_PLATFORM_USESIT
-		sit,
-#endif
+		sendcookie,
+		seenbadcookie,
+		badcookie,
 		nsid,   /*% Name Server ID (RFC 5001) */
 		header_only,
 		ednsneg;
@@ -191,9 +191,7 @@ isc_boolean_t	sigchase;
 	isc_uint32_t msgcounter;
 	dns_fixedname_t fdomain;
 	isc_sockaddr_t *ecs_addr;
-#ifdef ISC_PLATFORM_USESIT
-	char *sitvalue;
-#endif
+	char *cookie;
 	dns_ednsopt_t *ednsopts;
 	unsigned int ednsoptscnt;
 	isc_dscp_t dscp;
@@ -17,7 +17,9 @@

 #include <config.h>

+#include <isc/aes.h>
 #include <isc/formatcheck.h>
+#include <isc/hmacsha.h>
 #include <isc/mutex.h>
 #include <isc/once.h>
 #include <isc/platform.h>
@@ -32,12 +34,6 @@
 #include <isc/timer.h>
 #include <isc/util.h>

-#ifdef AES_SIT
-#include <isc/aes.h>
-#else
-#include <isc/hmacsha.h>
-#endif
-
 #include <dns/badcache.h>
 #include <dns/db.h>
 #include <dns/dispatch.h>
@@ -121,7 +117,7 @@
 */
 #endif

-#define SIT_SIZE 24U /* 8 + 4 + 4 + 8 */
+#define COOKIE_SIZE 24U /* 8 + 4 + 4 + 8 */
 #define ECS_SIZE 20U /* 2 + 1 + 1 + [0..16] */

 /*% nameserver client manager structure */
@@ -249,10 +245,8 @@ static isc_result_t get_worker(ns_clientmgr_t *manager, ns_interface_t *ifp,
 static inline isc_boolean_t
 allowed(isc_netaddr_t *addr, dns_name_t *signer, isc_netaddr_t *ecs_addr,
 	isc_uint8_t ecs_addrlen, isc_uint8_t *ecs_scope, dns_acl_t *acl);
-#ifdef ISC_PLATFORM_USESIT
-static void compute_sit(ns_client_t *client, isc_uint32_t when,
-			isc_uint32_t nonce, isc_buffer_t *buf);
-#endif
+static void compute_cookie(ns_client_t *client, isc_uint32_t when,
+			   isc_uint32_t nonce, isc_buffer_t *buf);

 void
 ns_client_recursing(ns_client_t *client) {
@@ -838,10 +832,9 @@ client_allocsendbuf(ns_client_t *client, isc_buffer_t *buffer,
 		}
 	} else {
 		data = sendbuf;
-#ifdef ISC_PLATFORM_USESIT
-		if ((client->attributes & NS_CLIENTATTR_HAVESIT) == 0) {
+		if ((client->attributes & NS_CLIENTATTR_HAVECOOKIE) == 0) {
 			if (client->view != NULL)
-				bufsize = client->view->situdp;
+				bufsize = client->view->nocookieudp;
 			else
 				bufsize = 512;
 		} else
@@ -850,12 +843,6 @@ client_allocsendbuf(ns_client_t *client, isc_buffer_t *buffer,
 			bufsize = client->udpsize;
 		if (bufsize > SEND_BUFFER_SIZE)
 			bufsize = SEND_BUFFER_SIZE;
-#else
-		if (client->udpsize < SEND_BUFFER_SIZE)
-			bufsize = client->udpsize;
-		else
-			bufsize = SEND_BUFFER_SIZE;
-#endif
 		if (length > bufsize) {
 			result = ISC_R_NOSPACE;
 			goto done;
@@ -1432,9 +1419,7 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
 {
 	unsigned char ecs[ECS_SIZE];
 	char nsid[BUFSIZ], *nsidp;
-#ifdef ISC_PLATFORM_USESIT
-	unsigned char sit[SIT_SIZE];
-#endif
+	unsigned char cookie[COOKIE_SIZE];
 	isc_result_t result;
 	dns_view_t *view;
 	dns_resolver_t *resolver;
@@ -1477,25 +1462,23 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
 		count++;
 	}
 no_nsid:
-#ifdef ISC_PLATFORM_USESIT
-	if ((client->attributes & NS_CLIENTATTR_WANTSIT) != 0) {
+	if ((client->attributes & NS_CLIENTATTR_WANTCOOKIE) != 0) {
 		isc_buffer_t buf;
 		isc_stdtime_t now;
 		isc_uint32_t nonce;

-		isc_buffer_init(&buf, sit, sizeof(sit));
+		isc_buffer_init(&buf, cookie, sizeof(cookie));
 		isc_stdtime_get(&now);
 		isc_random_get(&nonce);

-		compute_sit(client, now, nonce, &buf);
+		compute_cookie(client, now, nonce, &buf);

 		INSIST(count < DNS_EDNSOPTIONS);
-		ednsopts[count].code = DNS_OPT_SIT;
-		ednsopts[count].length = SIT_SIZE;
-		ednsopts[count].value = sit;
+		ednsopts[count].code = DNS_OPT_COOKIE;
+		ednsopts[count].length = COOKIE_SIZE;
+		ednsopts[count].value = cookie;
 		count++;
 	}
-#endif
 	if ((client->attributes & NS_CLIENTATTR_HAVEEXPIRE) != 0) {
 		isc_buffer_t buf;

@@ -1629,141 +1612,166 @@ ns_client_isself(dns_view_t *myview, dns_tsigkey_t *mykey,
 	return (ISC_TF(view == myview));
 }

-#ifdef ISC_PLATFORM_USESIT
 static void
-compute_sit(ns_client_t *client, isc_uint32_t when, isc_uint32_t nonce,
-	    isc_buffer_t *buf)
+compute_cookie(ns_client_t *client, isc_uint32_t when, isc_uint32_t nonce,
+	       isc_buffer_t *buf)
 {
-#ifdef AES_SIT
-	unsigned char digest[ISC_AES_BLOCK_LENGTH];
-	unsigned char input[4 + 4 + 16];
-	isc_netaddr_t netaddr;
-	unsigned char *cp;
-	unsigned int i;
+	switch (ns_g_server->cookiealg) {
+	case ns_cookiealg_aes: {
+		unsigned char digest[ISC_AES_BLOCK_LENGTH];
+		unsigned char input[4 + 4 + 16];
+		isc_netaddr_t netaddr;
+		unsigned char *cp;
+		unsigned int i;

-	memset(input, 0, sizeof(input));
-	cp = isc_buffer_used(buf);
-	isc_buffer_putmem(buf, client->cookie, 8);
-	isc_buffer_putuint32(buf, nonce);
-	isc_buffer_putuint32(buf, when);
-	memmove(input, cp, 16);
-	isc_aes128_crypt(ns_g_server->secret, input, digest);
-	for (i = 0; i < 8; i++)
-		input[i] = digest[i] ^ digest[i + 8];
-	isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
-	switch (netaddr.family) {
-	case AF_INET:
-		memmove(input + 8, (unsigned char *)&netaddr.type.in, 4);
-		memset(input + 12, 0, 4);
-		isc_aes128_crypt(ns_g_server->secret, input, digest);
-		break;
-	case AF_INET6:
-		memmove(input + 8, (unsigned char *)&netaddr.type.in6, 16);
+		memset(input, 0, sizeof(input));
+		cp = isc_buffer_used(buf);
+		isc_buffer_putmem(buf, client->cookie, 8);
+		isc_buffer_putuint32(buf, nonce);
+		isc_buffer_putuint32(buf, when);
+		memmove(input, cp, 16);
 		isc_aes128_crypt(ns_g_server->secret, input, digest);
 		for (i = 0; i < 8; i++)
-			input[i + 8] = digest[i] ^ digest[i + 8];
-		isc_aes128_crypt(ns_g_server->secret, input + 8, digest);
+			input[i] = digest[i] ^ digest[i + 8];
+		isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
+		switch (netaddr.family) {
+		case AF_INET:
+			cp = (unsigned char *)&netaddr.type.in;
+			memmove(input + 8, cp, 4);
+			memset(input + 12, 0, 4);
+			isc_aes128_crypt(ns_g_server->secret, input, digest);
+			break;
+		case AF_INET6:
+			cp = (unsigned char *)&netaddr.type.in6;
+			memmove(input + 8, cp, 16);
+			isc_aes128_crypt(ns_g_server->secret, input, digest);
+			for (i = 0; i < 8; i++)
+				input[i + 8] = digest[i] ^ digest[i + 8];
+			isc_aes128_crypt(ns_g_server->secret, input + 8,
+					 digest);
+			break;
+		}
+		for (i = 0; i < 8; i++)
+			digest[i] ^= digest[i + 8];
+		isc_buffer_putmem(buf, digest, 8);
 		break;
 	}
-	for (i = 0; i < 8; i++)
-		digest[i] ^= digest[i + 8];
-	isc_buffer_putmem(buf, digest, 8);
-#endif
-#ifdef HMAC_SHA1_SIT
-	unsigned char digest[ISC_SHA1_DIGESTLENGTH];
-	isc_netaddr_t netaddr;
-	unsigned char *cp;
-	isc_hmacsha1_t hmacsha1;

-	cp = isc_buffer_used(buf);
-	isc_buffer_putmem(buf, client->cookie, 8);
-	isc_buffer_putuint32(buf, nonce);
-	isc_buffer_putuint32(buf, when);
+	case ns_cookiealg_sha1: {
+		unsigned char digest[ISC_SHA1_DIGESTLENGTH];
+		isc_netaddr_t netaddr;
+		unsigned char *cp;
+		isc_hmacsha1_t hmacsha1;
+		size_t length;

-	isc_hmacsha1_init(&hmacsha1,
-			  ns_g_server->secret,
-			  ISC_SHA1_DIGESTLENGTH);
-	isc_hmacsha1_update(&hmacsha1, cp, 16);
-	isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
-	switch (netaddr.family) {
-	case AF_INET:
-		isc_hmacsha1_update(&hmacsha1,
-				    (unsigned char *)&netaddr.type.in, 4);
-		break;
-	case AF_INET6:
-		isc_hmacsha1_update(&hmacsha1,
-				    (unsigned char *)&netaddr.type.in6, 16);
+		cp = isc_buffer_used(buf);
+		isc_buffer_putmem(buf, client->cookie, 8);
+		isc_buffer_putuint32(buf, nonce);
+		isc_buffer_putuint32(buf, when);
+
+		isc_hmacsha1_init(&hmacsha1,
+				  ns_g_server->secret,
+				  ISC_SHA1_DIGESTLENGTH);
+		isc_hmacsha1_update(&hmacsha1, cp, 16);
+		isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
+		switch (netaddr.family) {
+		case AF_INET:
+			cp = (unsigned char *)&netaddr.type.in;
+			length = 4;
+			break;
+		case AF_INET6:
+			cp = (unsigned char *)&netaddr.type.in6;
+			length = 4;
+			break;
+		default:
+			INSIST(0);
+		}
+		isc_hmacsha1_update(&hmacsha1, cp, length);
+		isc_hmacsha1_update(&hmacsha1, client->cookie,
+				    sizeof(client->cookie));
+		isc_hmacsha1_sign(&hmacsha1, digest, sizeof(digest));
+		isc_buffer_putmem(buf, digest, 8);
+		isc_hmacsha1_invalidate(&hmacsha1);
 		break;
 	}
-	isc_hmacsha1_update(&hmacsha1, client->cookie, sizeof(client->cookie));
-	isc_hmacsha1_sign(&hmacsha1, digest, sizeof(digest));
-	isc_buffer_putmem(buf, digest, 8);
-	isc_hmacsha1_invalidate(&hmacsha1);
-#endif
-#ifdef HMAC_SHA256_SIT
-	unsigned char digest[ISC_SHA256_DIGESTLENGTH];
-	isc_netaddr_t netaddr;
-	unsigned char *cp;
-	isc_hmacsha256_t hmacsha256;

-	cp = isc_buffer_used(buf);
-	isc_buffer_putmem(buf, client->cookie, 8);
-	isc_buffer_putuint32(buf, nonce);
-	isc_buffer_putuint32(buf, when);
+	case ns_cookiealg_sha256: {
+		unsigned char digest[ISC_SHA256_DIGESTLENGTH];
+		isc_netaddr_t netaddr;
+		unsigned char *cp;
+		isc_hmacsha256_t hmacsha256;
+		size_t length;

-	isc_hmacsha256_init(&hmacsha256,
-			    ns_g_server->secret,
-			    ISC_SHA256_DIGESTLENGTH);
-	isc_hmacsha256_update(&hmacsha256, cp, 16);
-	isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
-	switch (netaddr.family) {
-	case AF_INET:
-		isc_hmacsha256_update(&hmacsha256,
-				      (unsigned char *)&netaddr.type.in, 4);
-		break;
-	case AF_INET6:
-		isc_hmacsha256_update(&hmacsha256,
-				      (unsigned char *)&netaddr.type.in6, 16);
+		cp = isc_buffer_used(buf);
+		isc_buffer_putmem(buf, client->cookie, 8);
+		isc_buffer_putuint32(buf, nonce);
+		isc_buffer_putuint32(buf, when);
+
+		isc_hmacsha256_init(&hmacsha256,
+				    ns_g_server->secret,
+				    ISC_SHA256_DIGESTLENGTH);
+		isc_hmacsha256_update(&hmacsha256, cp, 16);
+		isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
+		switch (netaddr.family) {
+		case AF_INET:
+			cp = (unsigned char *)&netaddr.type.in;
+			length = 4;
+			break;
+		case AF_INET6:
+			cp = (unsigned char *)&netaddr.type.in6;
+			length = 4;
+			break;
+		default:
+			INSIST(0);
+		}
+		isc_hmacsha256_update(&hmacsha256, cp, length);
+		isc_hmacsha256_update(&hmacsha256, client->cookie,
+				      sizeof(client->cookie));
+		isc_hmacsha256_sign(&hmacsha256, digest, sizeof(digest));
+		isc_buffer_putmem(buf, digest, 8);
+		isc_hmacsha256_invalidate(&hmacsha256);
 		break;
 	}
-	isc_hmacsha256_update(&hmacsha256, client->cookie,
-			      sizeof(client->cookie));
-	isc_hmacsha256_sign(&hmacsha256, digest, sizeof(digest));
-	isc_buffer_putmem(buf, digest, 8);
-	isc_hmacsha256_invalidate(&hmacsha256);
-#endif
+	default:
+		INSIST(0);
+	}
 }

 static void
-process_sit(ns_client_t *client, isc_buffer_t *buf, size_t optlen) {
-	unsigned char dbuf[SIT_SIZE];
+process_cookie(ns_client_t *client, isc_buffer_t *buf, size_t optlen) {
+	unsigned char dbuf[COOKIE_SIZE];
 	unsigned char *old;
 	isc_stdtime_t now;
 	isc_uint32_t when;
 	isc_uint32_t nonce;
 	isc_buffer_t db;

-	client->attributes |= NS_CLIENTATTR_WANTSIT;
+	/*
+	 * If we have already seen a cookie option skip this cookie option.
+	 */
+	if ((client->attributes & NS_CLIENTATTR_WANTCOOKIE) != 0) {
+		isc_buffer_forward(buf, (unsigned int)optlen);
+		return;
+	}

-	isc_stats_increment(ns_g_server->nsstats,
-			    dns_nsstatscounter_sitopt);
+	client->attributes |= NS_CLIENTATTR_WANTCOOKIE;

-	if (optlen != SIT_SIZE) {
+	isc_stats_increment(ns_g_server->nsstats, dns_nsstatscounter_cookiein);
+
+	if (optlen != COOKIE_SIZE) {
 		/*
 		 * Not our token.
 		 */
-		if (optlen >= 8U)
-			memmove(client->cookie, isc_buffer_current(buf), 8);
-		else
-			memset(client->cookie, 0, 8);
+		INSIST(optlen >= 8U);
+		memmove(client->cookie, isc_buffer_current(buf), 8);
 		isc_buffer_forward(buf, (unsigned int)optlen);

 		if (optlen == 8U)
 			isc_stats_increment(ns_g_server->nsstats,
-					    dns_nsstatscounter_sitnew);
+					    dns_nsstatscounter_cookienew);
 		else
 			isc_stats_increment(ns_g_server->nsstats,
-					    dns_nsstatscounter_sitbadsize);
+					    dns_nsstatscounter_cookiebadsize);
 		return;
 	}

@@ -1779,30 +1787,29 @@ process_sit(ns_client_t *client, isc_buffer_t *buf, size_t optlen) {

 	/*
 	 * Allow for a 5 minute clock skew between servers sharing a secret.
-	 * Only accept SIT if we have talked to the client in the last hour.
+	 * Only accept COOKIE if we have talked to the client in the last hour.
 	 */
 	isc_stdtime_get(&now);
 	if (isc_serial_gt(when, (now + 300)) ||		/* In the future. */
 	    isc_serial_lt(when, (now - 3600))) {	/* In the past. */
 		isc_stats_increment(ns_g_server->nsstats,
-				    dns_nsstatscounter_sitbadtime);
+				    dns_nsstatscounter_cookiebadtime);
 		return;
 	}

 	isc_buffer_init(&db, dbuf, sizeof(dbuf));
-	compute_sit(client, when, nonce, &db);
+	compute_cookie(client, when, nonce, &db);

-	if (memcmp(old, dbuf, SIT_SIZE) != 0) {
+	if (memcmp(old, dbuf, COOKIE_SIZE) != 0) {
 		isc_stats_increment(ns_g_server->nsstats,
-				    dns_nsstatscounter_sitnomatch);
+				    dns_nsstatscounter_cookienomatch);
 		return;
 	}
-	isc_stats_increment(ns_g_server->nsstats,
-			    dns_nsstatscounter_sitmatch);

-	client->attributes |= NS_CLIENTATTR_HAVESIT;
+	isc_stats_increment(ns_g_server->nsstats,
+			    dns_nsstatscounter_cookiematch);
+	client->attributes |= NS_CLIENTATTR_HAVECOOKIE;
 }
-#endif

 static isc_result_t
 process_ecs(ns_client_t *client, isc_buffer_t *buf, size_t optlen) {
@@ -1938,11 +1945,9 @@ process_opt(ns_client_t *client, dns_rdataset_t *opt) {
 				client->attributes |= NS_CLIENTATTR_WANTNSID;
 				isc_buffer_forward(&optbuf, optlen);
 				break;
-#ifdef ISC_PLATFORM_USESIT
-			case DNS_OPT_SIT:
-				process_sit(client, &optbuf, optlen);
+			case DNS_OPT_COOKIE:
+				process_cookie(client, &optbuf, optlen);
 				break;
-#endif
 			case DNS_OPT_EXPIRE:
 				isc_stats_increment(ns_g_server->nsstats,
 						  dns_nsstatscounter_expireopt);
@@ -2172,6 +2177,9 @@ client_request(isc_task_t *task, isc_event_t *event) {
 		 * Parsing the request failed.  Send a response
 		 * (typically FORMERR or SERVFAIL).
 		 */
+		if (result == DNS_R_OPTERR)
+			(void)ns_client_addopt(client, client->message,
+					       &client->opt);
 		ns_client_error(client, result);
 		goto cleanup;
 	}
@@ -2239,6 +2247,17 @@ client_request(isc_task_t *task, isc_event_t *event) {
 	}

 	if (client->message->rdclass == 0) {
+		if ((client->attributes & NS_CLIENTATTR_WANTCOOKIE) != 0 ||
+		    (client->message->opcode == dns_opcode_query &&
+		     client->message->counts[DNS_SECTION_QUESTION] == 0U)) {
+			result = dns_message_reply(client->message, ISC_TRUE);
+			if (result != ISC_R_SUCCESS) {
+				ns_client_error(client, result);
+				return;
+			}
+			ns_client_send(client);
+			return;
+		}
 		ns_client_log(client, NS_LOGCATEGORY_CLIENT,
 			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(1),
 			      "message class could not be determined");
@@ -53,6 +53,11 @@ options {\n\
 	automatic-interface-scan yes;\n\
 	bindkeys-file \"" NS_SYSCONFDIR "/bind.keys\";\n\
 #	blackhole {none;};\n"
+#if defined(HAVE_OPENSSL_AES) || defined(HAVE_OPENSSL_EVP_AES)
+"	cookie-algorithm aes;\n"
+#else
+"	cookie-algorithm sha256;\n"
+#endif
 #ifndef WIN32
 "	coresize default;\n\
 	datasize default;\n\
@@ -116,14 +121,8 @@ options {\n\
 	use-ixfr true;\n\
 	edns-udp-size 4096;\n\
 	max-udp-size 4096;\n\
-"
-#ifdef ISC_PLATFORM_USESIT
-"\
-	nosit-udp-size 4096;\n\
-	request-sit true;\n\
-"
-#endif
-"\
+	nocookie-udp-size 4096;\n\
+	send-cookie true;\n\
 	request-nsid false;\n\
 	reserved-sockets 512;\n\
 \n\
@@ -190,8 +190,8 @@ typedef ISC_LIST(ns_client_t) client_list_t;
 #define NS_CLIENTATTR_FILTER_AAAA_RC	0x0080 /*%< recursing for A against AAAA */
 #endif
 #define NS_CLIENTATTR_WANTAD		0x0100 /*%< want AD in response if possible */
-#define NS_CLIENTATTR_WANTSIT		0x0200 /*%< include SIT */
-#define NS_CLIENTATTR_HAVESIT		0x0400 /*%< has a valid SIT */
+#define NS_CLIENTATTR_WANTCOOKIE	0x0200 /*%< return a COOKIE */
+#define NS_CLIENTATTR_HAVECOOKIE	0x0400 /*%< has a valid COOKIE */
 #define NS_CLIENTATTR_WANTEXPIRE	0x0800 /*%< return seconds to expire */
 #define NS_CLIENTATTR_HAVEEXPIRE	0x1000 /*%< return seconds to expire */
 #define NS_CLIENTATTR_WANTOPT		0x2000 /*%< add opt to reply */
@@ -116,7 +116,8 @@ struct ns_server {
 	unsigned int		session_keyalg;
 	isc_uint16_t		session_keybits;
 	isc_boolean_t		interface_auto;
-	unsigned char		secret[32];	/*%< Source Identity Token */
+	unsigned char		secret[32];	/*%< Server Cookie Secret */
+	ns_cookiealg_t		cookiealg;

 	char *			lockfile;
 };
@@ -190,18 +191,15 @@ enum {
 	dns_nsstatscounter_nxdomainredirect = 47,
 	dns_nsstatscounter_nxdomainredirect_rlookup = 48,

-#ifdef ISC_PLATFORM_USESIT
-	dns_nsstatscounter_sitopt = 49,
-	dns_nsstatscounter_sitbadsize = 50,
-	dns_nsstatscounter_sitbadtime = 51,
-	dns_nsstatscounter_sitnomatch = 52,
-	dns_nsstatscounter_sitmatch = 53,
-	dns_nsstatscounter_sitnew = 54,
+	dns_nsstatscounter_cookiein = 49,
+	dns_nsstatscounter_cookiebadsize = 50,
+	dns_nsstatscounter_cookiebadtime = 51,
+	dns_nsstatscounter_cookienomatch = 52,
+	dns_nsstatscounter_cookiematch = 53,
+	dns_nsstatscounter_cookienew = 54,
+	dns_nsstatscounter_badcookie = 55,

-	dns_nsstatscounter_max = 55
-#else
-	dns_nsstatscounter_max = 49
-#endif
+	dns_nsstatscounter_max = 56
 };

 void
@@ -45,4 +45,11 @@ typedef struct ns_dispatch		ns_dispatch_t;
 typedef ISC_LIST(ns_dispatch_t)		ns_dispatchlist_t;
 typedef struct ns_statschannel		ns_statschannel_t;
 typedef ISC_LIST(ns_statschannel_t)	ns_statschannellist_t;
+
+typedef enum {
+	ns_cookiealg_aes,
+	ns_cookiealg_sha1,
+	ns_cookiealg_sha256
+} ns_cookiealg_t;
+
 #endif /* NAMED_TYPES_H */
@@ -93,20 +93,20 @@
 /*% Want Recursion? */
 #define WANTRECURSION(c)	(((c)->query.attributes & \
 				  NS_QUERYATTR_WANTRECURSION) != 0)
+/*% Is TCP? */
+#define TCP(c)			(((c)->attributes & NS_CLIENTATTR_TCP) != 0)
 /*% Want DNSSEC? */
 #define WANTDNSSEC(c)		(((c)->attributes & \
 				  NS_CLIENTATTR_WANTDNSSEC) != 0)
 /*% Want WANTAD? */
 #define WANTAD(c)		(((c)->attributes & \
 				  NS_CLIENTATTR_WANTAD) != 0)
-#ifdef ISC_PLATFORM_USESIT
-/*% Client presented a valid Source Identity Token. */
-#define HAVESIT(c)		(((c)->attributes & \
-				  NS_CLIENTATTR_HAVESIT) != 0)
-#else
-#define HAVESIT(c)		(0)
-#endif
-
+/*% Client presented a valid COOKIE. */
+#define HAVECOOKIE(c)		(((c)->attributes & \
+				  NS_CLIENTATTR_HAVECOOKIE) != 0)
+/*% Client presented a COOKIE. */
+#define WANTCOOKIE(c)		(((c)->attributes & \
+				  NS_CLIENTATTR_WANTCOOKIE) != 0)
 /*% No authority? */
 #define NOAUTHORITY(c)		(((c)->query.attributes & \
 				  NS_QUERYATTR_NOAUTHORITY) != 0)
@@ -251,8 +251,10 @@ query_send(ns_client_t *client) {
 				counter = dns_nsstatscounter_nxrrset;
 		} else
 			counter = dns_nsstatscounter_success;
-	} else if (client->message->rcode == dns_rcode_nxdomain)
+	} else if (client->message->rcode == dns_rcode_nxdomain) 
 		counter = dns_nsstatscounter_nxdomain;
+	else if (client->message->rcode == dns_rcode_badcookie)
+		counter = dns_nsstatscounter_badcookie;
 	else /* We end up here in case of YXDOMAIN, and maybe others */
 		counter = dns_nsstatscounter_failure;

@@ -3937,7 +3939,7 @@ query_prefetch(ns_client_t *client, dns_name_t *qname,
 	tmprdataset = query_newrdataset(client);
 	if (tmprdataset == NULL)
 		return;
-	if ((client->attributes & NS_CLIENTATTR_TCP) == 0)
+	if (!TCP(client))
 		peeraddr = &client->peeraddr;
 	else
 		peeraddr = NULL;
@@ -4023,7 +4025,7 @@ query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qname,
 			ns_client_killoldestquery(client);
 		}
 		if (result == ISC_R_SUCCESS && !client->mortal &&
-		    (client->attributes & NS_CLIENTATTR_TCP) == 0) {
+		    !TCP(client)) {
 			result = ns_client_replace(client);
 			if (result != ISC_R_SUCCESS) {
 				ns_client_log(client, NS_LOGCATEGORY_CLIENT,
@@ -4061,7 +4063,7 @@ query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qname,

 	if (client->query.timerset == ISC_FALSE)
 		ns_client_settimeout(client, 60);
-	if ((client->attributes & NS_CLIENTATTR_TCP) == 0)
+	if (!TCP(client))
 		peeraddr = &client->peeraddr;
 	else
 		peeraddr = NULL;
@@ -6779,7 +6781,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 		client->query.authdbset = ISC_TRUE;

 		/* Track TCP vs UDP stats per zone */
-		if ((client->attributes & NS_CLIENTATTR_TCP) != 0)
+		if (TCP(client))
 			inc_stats(client, dns_nsstatscounter_tcp);
 		else
 			inc_stats(client, dns_nsstatscounter_udp);
@@ -6838,7 +6840,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 	 * Don't mess with responses rewritten by RPZ
 	 * Count each response at most once.
 	 */
-	if (client->view->rrl != NULL && !HAVESIT(client) &&
+	if (client->view->rrl != NULL && !HAVECOOKIE(client) &&
 	    ((fname != NULL && dns_name_isabsolute(fname)) ||
 	     (result == ISC_R_NOTFOUND && !RECURSIONOK(client))) &&
 	    !(result == DNS_R_DELEGATION && !is_zone && RECURSIONOK(client)) &&
@@ -6904,10 +6906,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 			resp_result = ISC_R_SUCCESS;
 		}
 		rrl_result = dns_rrl(client->view, &client->peeraddr,
-				     ISC_TF((client->attributes
-					     & NS_CLIENTATTR_TCP) != 0),
-				     client->message->rdclass, qtype, tname,
-				     resp_result, client->now,
+				     TCP(client), client->message->rdclass,
+				     qtype, tname, resp_result, client->now,
 				     wouldlog, log_buf, sizeof(log_buf));
 		if (rrl_result != DNS_RRL_RESULT_OK) {
 			/*
@@ -6942,11 +6942,19 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 					 */
 					inc_stats(client,
 						dns_nsstatscounter_rateslipped);
-					client->message->flags |=
-						DNS_MESSAGEFLAG_TC;
-					if (resp_result == DNS_R_NXDOMAIN)
+					if (WANTCOOKIE(client)) {
+						client->message->flags &=
+							~DNS_MESSAGEFLAG_AD;
 						client->message->rcode =
-							dns_rcode_nxdomain;
+							   dns_rcode_badcookie;
+					} else {
+						client->message->flags |=
+							DNS_MESSAGEFLAG_TC;
+						if (resp_result ==
+						    DNS_R_NXDOMAIN)
+							client->message->rcode =
+							     dns_rcode_nxdomain;
+					}
 				}
 				goto cleanup;
 			}
@@ -6998,7 +7006,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 		if (rpz_st->m.policy != DNS_RPZ_POLICY_MISS &&
 		    rpz_st->m.policy != DNS_RPZ_POLICY_PASSTHRU &&
 		    (rpz_st->m.policy != DNS_RPZ_POLICY_TCP_ONLY ||
-		     (client->attributes & NS_CLIENTATTR_TCP) == 0) &&
+		     !TCP(client)) &&
 		    rpz_st->m.policy != DNS_RPZ_POLICY_ERROR)
 		{
 			/*
@@ -8723,13 +8731,13 @@ log_query(ns_client_t *client, unsigned int flags, unsigned int extflags) {
 			 client->ednsversion);

 	ns_client_log(client, NS_LOGCATEGORY_QUERIES, NS_LOGMODULE_QUERY,
-		      level, "query: %s %s %s %s%s%s%s%s%s (%s)", namebuf,
+		      level, "query: %s %s %s %s%s%s%s%s%s%s (%s)", namebuf,
 		      classname, typename, WANTRECURSION(client) ? "+" : "-",
 		      (client->signer != NULL) ? "S" : "", ednsbuf,
-		      ((client->attributes & NS_CLIENTATTR_TCP) != 0) ?
-				 "T" : "",
+		      TCP(client) ?  "T" : "",
 		      ((extflags & DNS_MESSAGEEXTFLAG_DO) != 0) ? "D" : "",
 		      ((flags & DNS_MESSAGEFLAG_CD) != 0) ? "C" : "",
+		      HAVECOOKIE(client) ? "V" : WANTCOOKIE(client) ? "K" : "",
 		      onbuf);
 }

@@ -8790,7 +8798,7 @@ ns_query_start(ns_client_t *client) {
 	/*
 	 * Test only.
 	 */
-	if (ns_g_clienttest && (client->attributes & NS_CLIENTATTR_TCP) == 0)
+	if (ns_g_clienttest && !TCP(client))
 		RUNTIME_CHECK(ns_client_replace(client) == ISC_R_SUCCESS);

 	/*
@@ -8917,8 +8925,7 @@ ns_query_start(ns_client_t *client) {
 	/*
 	 * Turn on minimal responses for EDNS/UDP bufsize 512 queries.
 	 */
-	if (client->ednsversion >= 0 && client->udpsize <= 512U &&
-	    (client->attributes & NS_CLIENTATTR_TCP) == 0)
+	if (client->ednsversion >= 0 && client->udpsize <= 512U && !TCP(client))
 		client->query.attributes |= (NS_QUERYATTR_NOAUTHORITY |
 					     NS_QUERYATTR_NOADDITIONAL);

@@ -26,6 +26,7 @@
 #include <sys/types.h>
 #include <sys/stat.h>

+#include <isc/aes.h>
 #include <isc/app.h>
 #include <isc/base64.h>
 #include <isc/dir.h>
@@ -33,6 +34,7 @@
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
+#include <isc/hmacsha.h>
 #include <isc/httpd.h>
 #include <isc/lex.h>
 #include <isc/parseint.h>
@@ -52,12 +54,6 @@
 #include <isc/util.h>
 #include <isc/xml.h>

-#ifdef AES_SIT
-#include <isc/aes.h>
-#else
-#include <isc/hmacsha.h>
-#endif
-
 #include <isccfg/grammar.h>
 #include <isccfg/namedconf.h>

@@ -1215,12 +1211,10 @@ configure_peer(const cfg_obj_t *cpeer, isc_mem_t *mctx, dns_peer_t **peerp) {
 	if (obj != NULL)
 		CHECK(dns_peer_setrequestnsid(peer, cfg_obj_asboolean(obj)));

-#ifdef ISC_PLATFORM_USESIT
 	obj = NULL;
-	(void)cfg_map_get(cpeer, "request-sit", &obj);
+	(void)cfg_map_get(cpeer, "send-cookie", &obj);
 	if (obj != NULL)
-		CHECK(dns_peer_setrequestsit(peer, cfg_obj_asboolean(obj)));
-#endif
+		CHECK(dns_peer_setsendcookie(peer, cfg_obj_asboolean(obj)));

 	obj = NULL;
 	(void)cfg_map_get(cpeer, "edns", &obj);
@@ -3092,20 +3086,18 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		udpsize = 4096;
 	view->maxudp = udpsize;

-#ifdef ISC_PLATFORM_USESIT
 	/*
-	 * Set the maximum UDP when a SIT is not provided.
+	 * Set the maximum UDP when a COOKIE is not provided.
 	 */
 	obj = NULL;
-	result = ns_config_get(maps, "nosit-udp-size", &obj);
+	result = ns_config_get(maps, "nocookie-udp-size", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	udpsize = cfg_obj_asuint32(obj);
 	if (udpsize < 128)
 		udpsize = 128;
 	if (udpsize > view->maxudp)
 		udpsize = view->maxudp;
-	view->situdp = udpsize;
-#endif
+	view->nocookieudp = udpsize;

 	/*
 	 * Set the maximum rsa exponent bits.
@@ -3477,12 +3469,10 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	INSIST(result == ISC_R_SUCCESS);
 	view->requestnsid = cfg_obj_asboolean(obj);

-#ifdef ISC_PLATFORM_USESIT
 	obj = NULL;
-	result = ns_config_get(maps, "request-sit", &obj);
+	result = ns_config_get(maps, "send-cookie", &obj);
 	INSIST(result == ISC_R_SUCCESS);
-	view->requestsit = cfg_obj_asboolean(obj);
-#endif
+	view->sendcookie = cfg_obj_asboolean(obj);

 	obj = NULL;
 	result = ns_config_get(maps, "max-clients-per-query", &obj);
@@ -6417,32 +6407,48 @@ load_configuration(const char *filename, ns_server_t *server,
 		server->flushonshutdown = ISC_FALSE;
 	}

-#ifdef ISC_PLATFORM_USESIT
 	obj = NULL;
-	result = ns_config_get(maps, "sit-secret", &obj);
+	result = ns_config_get(maps, "cookie-algorithm", &obj);
+	INSIST(result == ISC_R_SUCCESS);
+	if (strcasecmp(cfg_obj_asstring(obj), "aes") == 0)
+		server->cookiealg = ns_cookiealg_aes;
+	else if (strcasecmp(cfg_obj_asstring(obj), "sha1") == 0)
+		server->cookiealg = ns_cookiealg_sha1;
+	else if (strcasecmp(cfg_obj_asstring(obj), "sha256") == 0)
+		server->cookiealg = ns_cookiealg_sha256;
+	else
+		INSIST(0);
+
+	obj = NULL;
+	result = ns_config_get(maps, "cookie-secret", &obj);
 	if (result == ISC_R_SUCCESS) {
 		isc_buffer_t b;
+		unsigned int usedlength;

 		memset(server->secret, 0, sizeof(server->secret));
 		isc_buffer_init(&b, server->secret, sizeof(server->secret));
 		result = isc_hex_decodestring(cfg_obj_asstring(obj), &b);
 		if (result != ISC_R_SUCCESS && result != ISC_R_NOSPACE)
 			goto cleanup;
-#ifdef AES_SIT
-		if (isc_buffer_usedlength(&b) != ISC_AES128_KEYLENGTH)
-			CHECKM(ISC_R_RANGE,
-			       "AES sit-secret must be on 128 bits");
-#endif
-#ifdef HMAC_SHA1_SIT
-		if (isc_buffer_usedlength(&b) != ISC_SHA1_DIGESTLENGTH)
-			CHECKM(ISC_R_RANGE,
-			       "SHA1 sit-secret must be on 160 bits");
-#endif
-#ifdef HMAC_SHA256_SIT
-		if (isc_buffer_usedlength(&b) != ISC_SHA256_DIGESTLENGTH)
-			CHECKM(ISC_R_RANGE,
-			       "SHA256 sit-secret must be on 256 bits");
-#endif
+		
+		usedlength = isc_buffer_usedlength(&b);
+		switch (server->cookiealg) {
+		case ns_cookiealg_aes:
+			if (usedlength != ISC_AES128_KEYLENGTH)
+				CHECKM(ISC_R_RANGE,
+				       "AES cookie-secret must be 128 bits");
+			break;
+		case ns_cookiealg_sha1:
+			if (usedlength != ISC_SHA1_DIGESTLENGTH)
+				CHECKM(ISC_R_RANGE,
+				       "SHA1 cookie-secret must be 160 bits");
+			break;
+		case ns_cookiealg_sha256:
+			if (usedlength != ISC_SHA256_DIGESTLENGTH)
+				CHECKM(ISC_R_RANGE,
+				       "SHA256 cookie-secret must be 256 bits");
+			break;
+		}
 	} else {
 		result = isc_entropy_getdata(ns_g_entropy,
 					     server->secret,
@@ -6452,7 +6458,6 @@ load_configuration(const char *filename, ns_server_t *server,
 		if (result != ISC_R_SUCCESS)
 			goto cleanup;
 	}
-#endif

 	result = ISC_R_SUCCESS;

@@ -224,19 +224,12 @@ init_desc(void) {
 	SET_NSSTATDESC(nsidopt, "NSID option received", "NSIDOpt");
 	SET_NSSTATDESC(expireopt, "Expire option received", "ExpireOpt");
 	SET_NSSTATDESC(otheropt, "Other EDNS option received", "OtherOpt");
-#ifdef ISC_PLATFORM_USESIT
-	SET_NSSTATDESC(sitopt, "source identity token option received",
-		       "SitOpt");
-	SET_NSSTATDESC(sitnew, "new source identity token requested",
-		       "SitNew");
-	SET_NSSTATDESC(sitbadsize, "source identity token - bad size",
-		       "SitBadSize");
-	SET_NSSTATDESC(sitbadtime, "source identity token - bad time",
-		       "SitBadTime");
-	SET_NSSTATDESC(sitnomatch, "source identity token - no match",
-		       "SitNoMatch");
-	SET_NSSTATDESC(sitmatch, "source identity token - match", "SitMatch");
-#endif
+	SET_NSSTATDESC(cookiein, "COOKIE option received", "CookieIn");
+	SET_NSSTATDESC(cookienew, "COOKIE - client only", "CookieNew");
+	SET_NSSTATDESC(cookiebadsize, "COOKIE - bad size", "CookieBadSize");
+	SET_NSSTATDESC(cookiebadtime, "COOKIE - bad time", "CookieBadTime");
+	SET_NSSTATDESC(cookienomatch, "COOKIE - no match", "CookieNoMatch");
+	SET_NSSTATDESC(cookiematch, "COOKIE - match", "CookieMatch");
 	SET_NSSTATDESC(ecsopt, "EDNS client subnet option recieved", "ECSOpt");
 	SET_NSSTATDESC(nxdomainredirect,
 		"queries resulted in NXDOMAIN that were redirected",
@@ -245,6 +238,7 @@ init_desc(void) {
 		"queries resulted in NXDOMAIN that were redirected and "
 		"resulted in a successful remote lookup",
 		"QryNXRedirRLookup");
+	SET_NSSTATDESC(badcookie, "sent badcookie response", "QryBADCOOKIE");
 	INSIST(i == dns_nsstatscounter_max);

 	/* Initialize resolver statistics */
@@ -320,15 +314,14 @@ init_desc(void) {
 	SET_RESSTATDESC(nfetch, "active fetches", "NumFetch");
 	SET_RESSTATDESC(buckets, "bucket size", "BucketSize");
 	SET_RESSTATDESC(refused, "REFUSED received", "REFUSED");
-#ifdef ISC_PLATFORM_USESIT
-	SET_RESSTATDESC(sitcc, "SIT sent client cookie only",
-			"SitClientOut");
-	SET_RESSTATDESC(sitout, "SIT sent with client and server cookie",
-			"SitOut");
-	SET_RESSTATDESC(sitin, "SIT replies received", "SitIn");
-	SET_RESSTATDESC(sitok, "SIT client cookie ok", "SitClientOk");
-#endif
+	SET_RESSTATDESC(cookienew, "COOKIE send with client cookie only",
+			"ClientCookieOut");
+	SET_RESSTATDESC(cookieout, "COOKIE sent with client and server cookie",
+			"ServerCookieOut");
+	SET_RESSTATDESC(cookiein, "COOKIE replies received", "CookieIn");
+	SET_RESSTATDESC(cookieok, "COOKIE client ok", "CookieClientOk");
 	SET_RESSTATDESC(badvers, "bad EDNS version", "BadEDNSVersion");
+	SET_RESSTATDESC(badcookie, "bad cookie rcode", "BadCookieRcode");

 	INSIST(i == dns_resstatscounter_max);

@@ -66,17 +66,16 @@ RANDFILE=$TOP/bin/tests/system/random.data
 # v6synth
 SUBDIRS="acl additional allow_query addzone autosign builtin
 	 cacheclean case checkconf @CHECKDS@ checknames checkzone
-	 @COVERAGE@ database digdelv dlv dlvauto dlz dlzexternal dname
-	 dns64 dnssec dsdigest dscp ecdsa ednscompliance emptyzones
-	 filter-aaaa formerr forward geoip glue gost ixfr inline
-	 legacy limits logfileconfig lwresd
-	 masterfile masterformat metadata mkeys
-	 notify nslookup nsupdate pending pipelined @PKCS11_TEST@
-	 reclimit redirect resolver rndc rpz rpzrecurse
-         rrl rrchecker rrsetorder rsabigexponent runtime
-         sit sfcache smartsign sortlist spf
-	 staticstub statistics stub tcp tkey tsig tsiggss unknown
-	 upforwd verify views wildcard xfer xferquota zero zonechecks"
+	 cookie @COVERAGE@ database digdelv dlv dlvauto dlz dlzexternal
+	 dname dns64 dnssec dsdigest dscp ecdsa ednscompliance
+	 emptyzones filter-aaaa formerr forward geoip glue gost
+	 ixfr inline legacy limits logfileconfig lwresd masterfile
+	 masterformat metadata mkeys notify nslookup nsupdate pending
+	 pipelined @PKCS11_TEST@ reclimit redirect resolver rndc
+	 rpz rpzrecurse rrl rrchecker rrsetorder rsabigexponent
+	 runtime sfcache smartsign sortlist spf staticstub statistics
+	 stub tcp tkey tsig tsiggss unknown upforwd verify views
+	 wildcard xfer xferquota zero zonechecks"

 # Use the CONFIG_SHELL detected by configure for tests
 SHELL=@SHELL@
@@ -15,5 +15,5 @@
 */

 options {
-	sit-secret "012345678901234567890123456789012345678901234567890123456789012";
+	cookie-secret "012345678901234567890123456789012345678901234567890123456789012";
 };
@@ -15,5 +15,5 @@
 */

 options {
-	sit-secret "01234567890123456789012345678901234567890123456789012345678901234567890";
+	cookie-secret "01234567890123456789012345678901234567890123456789012345678901234567890";
 };
@@ -39,8 +39,8 @@ options {
 		except-from { "goodcname.example.net";
 			      "gooddname.example.net"; };
 	allow-query {!10.53.0.8; any; };
-	request-sit yes;
-	nosit-udp-size 512;
+	send-cookie yes;
+	nocookie-udp-size 512;
 };

 zone "." {
@@ -26,8 +26,8 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	acache-enable yes;
-	request-sit yes;
-	nosit-udp-size 512;
+	send-cookie yes;
+	nocookie-udp-size 512;
 };

 zone "." {
@@ -22,13 +22,13 @@ SYSTEMTESTTOP=..
 status=0
 n=0

-getsit() {
-	awk '$2 == "SIT:" {
+getcookie() {
+	awk '$2 == "COOKIE:" {
 		print $3;
 	}' < $1
 }

-fullsit() {
+fullcookie() {
 	awk 'BEGIN { n = 0 }
 	     // { v[n++] = length(); }
 	     END { print (v[1] == v[2]); }'
@@ -48,16 +48,16 @@ do
 done

 n=`expr $n + 1`
-echo "I:checking SIT token returned to empty SIT option ($n)"
+echo "I:checking COOKIE token returned to empty COOKIE option ($n)"
 ret=0
-$DIG +qr +sit version.bind txt ch @10.53.0.1 -p 5300 > dig.out.test$n
-grep SIT: dig.out.test$n > /dev/null || ret=1
+$DIG +qr +cookie version.bind txt ch @10.53.0.1 -p 5300 > dig.out.test$n
+grep COOKIE: dig.out.test$n > /dev/null || ret=1
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
-echo "I:checking response size without SIT ($n)"
+echo "I:checking response size without COOKIE ($n)"
 ret=0
 $DIG large.example txt @10.53.0.1 -p 5300 +ignore > dig.out.test$n
 havetc dig.out.test$n || ret=1
@@ -65,51 +65,51 @@ if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
-echo "I:checking response size without valid SIT ($n)"
+echo "I:checking response size without valid COOKIE ($n)"
 ret=0
-$DIG +sit large.example txt @10.53.0.1 -p 5300 +ignore > dig.out.test$n
+$DIG +cookie large.example txt @10.53.0.1 -p 5300 +ignore > dig.out.test$n
 havetc dig.out.test$n || ret=1
-grep "; SIT:.*(good)" dig.out.test$n > /dev/null || ret=1
+grep "; COOKIE:.*(good)" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
-echo "I:checking response size with SIT ($n)"
+echo "I:checking response size with COOKIE ($n)"
 ret=0
-$DIG +sit large.example txt @10.53.0.1 -p 5300 > dig.out.test$n.l
-sit=`getsit dig.out.test$n.l`
-$DIG +qr +sit=$sit large.example txt @10.53.0.1 -p 5300 +ignore > dig.out.test$n
+$DIG +cookie large.example txt @10.53.0.1 -p 5300 > dig.out.test$n.l
+cookie=`getcookie dig.out.test$n.l`
+$DIG +qr +cookie=$cookie large.example txt @10.53.0.1 -p 5300 +ignore > dig.out.test$n
 havetc dig.out.test$n && ret=1
-grep "; SIT:.*(good)" dig.out.test$n > /dev/null || ret=1
+grep "; COOKIE:.*(good)" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
-echo "I:checking response size with SIT recursive ($n)"
+echo "I:checking response size with COOKIE recursive ($n)"
 ret=0
-$DIG +qr +sit=$sit large.xxx txt @10.53.0.1 -p 5300 +ignore > dig.out.test$n
+$DIG +qr +cookie=$cookie large.xxx txt @10.53.0.1 -p 5300 +ignore > dig.out.test$n
 havetc dig.out.test$n && ret=1
-grep "; SIT:.*(good)" dig.out.test$n > /dev/null || ret=1
+grep "; COOKIE:.*(good)" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
-echo "I:checking SIT is learnt for TCP retry ($n)"
+echo "I:checking COOKIE is learnt for TCP retry ($n)"
 ret=0
-$DIG +qr +sit large.example txt @10.53.0.1 -p 5300 > dig.out.test$n
-linecount=`getsit dig.out.test$n | wc -l`
+$DIG +qr +cookie large.example txt @10.53.0.1 -p 5300 > dig.out.test$n
+linecount=`getcookie dig.out.test$n | wc -l`
 if [ $linecount != 3 ]; then ret=1; fi
-checkfull=`getsit dig.out.test$n | fullsit`
+checkfull=`getcookie dig.out.test$n | fullcookie`
 if [ $checkfull != 1 ]; then ret=1; fi
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
-echo "I:checking for SIT value in adb ($n)"
+echo "I:checking for COOKIE value in adb ($n)"
 ret=0
 $RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 dumpdb
 sleep 1
-grep "10.53.0.2.*\[sit=" ns1/named_dump.db > /dev/null|| ret=1
+grep "10.53.0.2.*\[cookie=" ns1/named_dump.db > /dev/null|| ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

@@ -35,11 +35,11 @@ then
 	echo "I:failed"; status=`expr $status + 1`;
 fi

-# this one arguable could be NOERORR.
+# this one is now NOERROR
 echo "I:no questions"
 $PERL formerr.pl -a 10.53.0.1 -p 5300 noquestions > noquestions.out
 ans=`grep got: noquestions.out`
-if [ "${ans}" != "got: 000080010000000000000000" ];
+if [ "${ans}" != "got: 000080000000000000000000" ];
 then
 	echo "I:failed"; status=`expr $status + 1`;
 fi
@@ -541,6 +541,7 @@ echo "I:check that unexpected opcodes are handled correctly (${n})"
 ret=0
 $DIG soa all-cnames @10.53.0.5 -p 5300 +opcode=status > dig.out.ns5.test${n} || ret=1
 grep "status: NOTIMP" dig.out.ns5.test${n} > /dev/null || ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

 echo "I:exit status: $status"
@@ -1,16 +0,0 @@
-# Copyright (C) 2014  Internet Systems Consortium, Inc. ("ISC")
-#
-# Permission to use, copy, modify, and/or distribute this software for any
-# purpose with or without fee is hereby granted, provided that the above
-# copyright notice and this permission notice appear in all copies.
-#
-# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
-# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
-# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
-# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-# PERFORMANCE OF THIS SOFTWARE.
-
-test "@HAVE_SIT@" = "" && exit 255
-exit 0
@@ -116,9 +116,7 @@ static in_port_t port = 53;
 static isc_dscp_t dscp = -1;
 static unsigned char cookie_secret[33];
 static int onfly = 0;
-#ifdef ISC_PLATFORM_USESIT
-static char sitvalue[256];
-#endif
+static char hexcookie[81];

 struct query {
 	char textname[MXNAME]; /*% Name we're going to be looking up */
@@ -130,10 +128,8 @@ struct query {
 	isc_boolean_t have_zflag;
 	isc_boolean_t dnssec;
 	isc_boolean_t expire;
-#ifdef ISC_PLATFORM_USESIT
-	isc_boolean_t sit;
-	char *sitvalue;
-#endif
+	isc_boolean_t send_cookie;
+	char *cookie;
 	isc_boolean_t nsid;
 	dns_rdatatype_t rdtype;
 	dns_rdataclass_t rdclass;
@@ -488,7 +484,7 @@ cleanup:
 /*%
 * Add EDNS0 option record to a message.  Currently, the only supported
 * options are UDP buffer size, the DO bit, and EDNS options
- * (e.g., NSID, SIT, client-subnet)
+ * (e.g., NSID, COOKIE, client-subnet)
 */
 static void
 add_opt(dns_message_t *msg, isc_uint16_t udpsize, isc_uint16_t edns,
@@ -504,14 +500,12 @@ add_opt(dns_message_t *msg, isc_uint16_t udpsize, isc_uint16_t edns,
 	CHECK("dns_message_setopt", result);
 }

-#ifdef ISC_PLATFORM_USESIT
 static void
 compute_cookie(unsigned char *cookie, size_t len) {
 	/* XXXMPA need to fix, should be per server. */
 	INSIST(len >= 8U);
 	memmove(cookie, cookie_secret, 8);
 }
-#endif

 static isc_result_t
 sendquery(struct query *query, isc_task_t *task)
@@ -574,10 +568,7 @@ sendquery(struct query *query, isc_task_t *task)
 		unsigned int flags;
 		int i = 0;
 		char ecsbuf[20];
-#ifdef ISC_PLATFORM_USESIT
-		unsigned char cookie[8];
-		char sitbuf[256];
-#endif
+		unsigned char cookie[40];

 		if (query->udpsize == 0)
 			query->udpsize = 4096;
@@ -633,27 +624,25 @@ sendquery(struct query *query, isc_task_t *task)
 			i++;
 		}

-#ifdef ISC_PLATFORM_USESIT
-		if (query->sit) {
+		if (query->send_cookie) {
 			INSIST(i < DNS_EDNSOPTIONS);
-			opts[i].code = DNS_OPT_SIT;
-			if (query->sitvalue != NULL) {
+			opts[i].code = DNS_OPT_COOKIE;
+			if (query->cookie != NULL) {
 				isc_buffer_t b;

-				isc_buffer_init(&b, sitbuf, sizeof(sitbuf));
-				result = isc_hex_decodestring(query->sitvalue,
+				isc_buffer_init(&b, cookie, sizeof(cookie));
+				result = isc_hex_decodestring(query->cookie,
 							      &b);
 				CHECK("isc_hex_decodestring", result);
 				opts[i].value = isc_buffer_base(&b);
 				opts[i].length = isc_buffer_usedlength(&b);
 			} else {
-				compute_cookie(cookie, sizeof(cookie));
+				compute_cookie(cookie, 8);
 				opts[i].length = 8;
 				opts[i].value = cookie;
 			}
 			i++;
 		}
-#endif

 		if (query->expire) {
 			INSIST(i < DNS_EDNSOPTIONS);
@@ -784,9 +773,7 @@ help(void) {
 "                 +[no]zflag          (Set Z flag in query)\n"
 "                 +[no]dnssec         (Request DNSSEC records)\n"
 "                 +[no]expire         (Request time to expire)\n"
-#ifdef ISC_PLATFORM_USESIT
-"                 +[no]sit[=###]      (Request a Source Identity Token)\n"
-#endif
+"                 +[no]cookie[=###]   (Send a COOKIE option)\n"
 "                 +[no]nsid           (Request Name Server ID)\n",
 	stdout);
 }
@@ -1034,9 +1021,7 @@ plus_option(char *option, struct query *query, isc_boolean_t global)
 	char *cmd, *value, *ptr, *code;
 	isc_uint32_t num;
 	isc_boolean_t state = ISC_TRUE;
-#ifdef ISC_PLATFORM_USESIT
 	size_t n;
-#endif

 	strncpy(option_store, option, sizeof(option_store));
 	option_store[sizeof(option_store) - 1] = 0;
@@ -1158,9 +1143,29 @@ plus_option(char *option, struct query *query, isc_boolean_t global)
 			display_class = state;
 			break;
 		case 'o': /* comments */
-			FULLCHECK("comments");
-			GLOBAL();
-			display_comments = state;
+			switch (cmd[2]) {
+			case 'm':
+				FULLCHECK("comments");
+				GLOBAL();
+				display_comments = state;
+				break;
+			case 'o':
+				FULLCHECK("cookie");
+				if (state && query->edns == -1)
+					query->edns = 0;
+				query->send_cookie = state;
+				if (value != NULL) {
+					n = strlcpy(hexcookie, value,
+						    sizeof(hexcookie));
+					if (n >= sizeof(hexcookie))
+						fatal("COOKIE data too large");
+					query->cookie = hexcookie;
+				} else
+					query->cookie = NULL;
+				break;
+			default:
+				goto invalid_option;
+			}
 			break;
 		case 'r':
 			FULLCHECK("crypto");
@@ -1338,21 +1343,6 @@ plus_option(char *option, struct query *query, isc_boolean_t global)
 				display_rrcomments = ISC_FALSE;
 			}
 			break;
-#ifdef ISC_PLATFORM_USESIT
-		case 'i':
-			FULLCHECK("sit");
-			if (state && query->edns == -1)
-				query->edns = 0;
-			query->sit = state;
-			if (value != NULL) {
-				n = strlcpy(sitvalue, value, sizeof(sitvalue));
-				if (n >= sizeof(sitvalue))
-					fatal("SIT data too large");
-				query->sitvalue = sitvalue;
-			} else
-				query->sitvalue = NULL;
-			break;
-#endif
 		case 'p': /* split */
 			FULLCHECK("split");
 			GLOBAL();
@@ -1704,10 +1694,8 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv)
 		default_query.have_zflag = ISC_FALSE;
 		default_query.dnssec = ISC_FALSE;
 		default_query.expire = ISC_FALSE;
-#ifdef ISC_PLATFORM_USESIT
-		default_query.sit = ISC_FALSE;
-		default_query.sitvalue = NULL;
-#endif
+		default_query.send_cookie = ISC_FALSE;
+		default_query.cookie = NULL;
 		default_query.nsid = ISC_FALSE;
 		default_query.rdtype = dns_rdatatype_a;
 		default_query.rdclass = dns_rdataclass_in;
@@ -484,6 +484,18 @@
          </listitem>
        </varlistentry>

+        <varlistentry>
+          <term><option>+[no]cookie<optional>=####</optional></option></term>
+	  <listitem>
+	    <para>
+	      Send a COOKIE EDNS option, with optional value.
+	      Replaying a COOKIE from a previous response will allow
+	      the server to identify a previous client.  The default
+	      is <option>+nocookie</option>.
+	    </para>
+	  </listitem>
+	</varlistentry>
+
        <varlistentry>
          <term><option>+[no]dnssec</option></term>
          <listitem>
@@ -575,19 +587,6 @@
          </listitem>
        </varlistentry>

-        <varlistentry>
-          <term><option>+[no]sit<optional>=####</optional></option></term>
-          <listitem>
-            <para>
-              Send a Source Identity Token EDNS option, with optional
-              value.  Replaying a SIT from a previous response will
-              allow the server to identify a previous client.  The
-              default is <option>+nosit</option>.  Currently using
-              experimental value 65001 for the option code.
-            </para>
-          </listitem>
-        </varlistentry>
-
        <varlistentry>
          <term><option>+[no]subnet=addr/prefix</option></term>
          <listitem>
@@ -150,8 +150,8 @@ int sigwait(const unsigned int *set, int *sig);
 /* Define if building universal (internal helper macro) */
 #undef AC_APPLE_UNIVERSAL_BUILD

-/* Use AES for Source Identity Token generation */
-#undef AES_SIT
+/* Use AES for Client Cookie generation */
+#undef AES_CC

 /* Define to enable the "filter-aaaa-on-v4" and "filter-aaaa-on-v6" options.
   */
@@ -458,11 +458,11 @@ int sigwait(const unsigned int *set, int *sig);
 /* HMAC_*() return ints */
 #undef HMAC_RETURN_INT

-/* Use HMAC-SHA1 for Source Identity Token generation */
-#undef HMAC_SHA1_SIT
+/* Use HMAC-SHA1 for Client Cookie generation */
+#undef HMAC_SHA1_CC

-/* Use HMAC-SHA256 for Source Identity Token generation */
-#undef HMAC_SHA256_SIT
+/* Use HMAC-SHA256 for Client Cookie generation */
+#undef HMAC_SHA256_CC

 /* return type of gai_strerror */
 #undef IRS_GAISTRERROR_RETURN_T
@@ -834,8 +834,6 @@ OPENSSLLINKOBJS
 OPENSSLGOSTLINKSRCS
 OPENSSLGOSTLINKOBJS
 DST_OPENSSL_INC
-HAVE_SIT
-ISC_PLATFORM_USESIT
 INSTALL_LIBRARY
 ISC_THREAD_DIR
 THREADOPTSRCS
@@ -1000,8 +998,7 @@ with_ecdsa
 with_gost
 with_aes
 enable_openssl_hash
-enable_sit
-with_sit_alg
+with_cc_alg
 enable_openssl_version_check
 with_libxml2
 with_libjson
@@ -1684,7 +1681,6 @@ Optional Features:
  --enable-threads        enable multithreading
  --enable-native-pkcs11  use native PKCS11 for all crypto [default=no]
  --enable-openssl-hash   use OpenSSL for hash functions [default=no]
-  --enable-sit            enable source identity token [default=no]
  --enable-openssl-version-check
                          check OpenSSL version [default=yes]
  --enable-largefile	  64-bit file support
@@ -1726,7 +1722,7 @@ Optional Packages:
  --with-ecdsa            Crypto ECDSA
  --with-gost             Crypto GOST yes|no|raw|asn1.
  --with-aes              Crypto AES
-  --with-sit-alg=ALG      choose the algorithm for SIT [aes|sha1|sha256]
+  --with-cc-alg=ALG      choose the algorithm for Client Cookie [aes|sha1|sha256]
  --with-libxml2=PATH     build with libxml2 library yes|no|path
  --with-libjson=PATH     build with libjson0 library yes|no|path
  --with-purify=PATH      use Rational purify
@@ -11444,7 +11440,6 @@ yes)
 	test "${enable_filter_aaaa+set}" = set || enable_filter_aaaa=yes
 	test "${with_dlz_filesystem+set}" = set || with_dlz_filesystem=yes
 	test "${enable_symtable+set}" = set || enable_symtable=all
-	test "${enable_sit+set}" = set || enable_sit=yes
 	test "${enable_warn_error+set}" = set || enable_warn_error=yes
 	test "${enable_warn_shadow+set}" = set || enable_warn_shadow=yes
 	;;
@@ -15459,7 +15454,7 @@ fi
 if test "${with_aes+set}" = set; then :
  withval=$with_aes; with_aes="$withval"
 else
-  with_aes="checksit"
+  with_aes="checkcc"
 fi


@@ -15470,80 +15465,44 @@ fi
 if test "${enable_openssl_hash+set}" = set; then :
  enableval=$enable_openssl_hash; want_openssl_hash="$enableval"
 else
-  want_openssl_hash="checksit"
+  want_openssl_hash="checkcc"
 fi


 #
-# Enable Source Identity Token support
+# Client Cookie algorithm choice
 #
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for Source Identity Token support" >&5
-$as_echo_n "checking for Source Identity Token support... " >&6; }
-# Check whether --enable-sit was given.
-if test "${enable_sit+set}" = set; then :
-  enableval=$enable_sit; enable_sit="$enableval"
+
+# Check whether --with-cc-alg was given.
+if test "${with_cc_alg+set}" = set; then :
+  withval=$with_cc_alg; with_cc_alg="$withval"
 else
-  enable_sit="no"
+  with_cc_alg="auto"
 fi

-HAVE_SIT=
-ISC_PLATFORM_USESIT="#undef ISC_PLATFORM_USESIT"

-case "$enable_sit" in
-yes)
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
-	ISC_PLATFORM_USESIT="#define ISC_PLATFORM_USESIT 1"
-	HAVE_SIT=1
-	;;
-no)
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
-	;;
-*)
-	as_fn_error $? "\"enable-sit requires yes or no\"" "$LINENO" 5
-	;;
+case $with_cc_alg in
+	*1)
+		with_cc_alg="sha1"
+		;;
+	*2*)
+		with_cc_alg="sha256"
+		;;
+	auto)
+		if test "$with_aes" != "no"
+		then
+			with_aes="yes"
+		fi
+		;;
+	*)
+		with_cc_alg="aes"
+		if test "$with_aes" != "no"
+		then
+			with_aes="yes"
+		fi
+		;;
 esac
-
-
-
-#
-# Source Identity Token algorithm choice
-#
-
-# Check whether --with-sit-alg was given.
-if test "${with_sit_alg+set}" = set; then :
-  withval=$with_sit_alg; with_sit_alg="$withval"
-else
-  with_sit_alg="auto"
-fi
-
-
-if test "$enable_sit" = "yes"
-then
-	case $with_sit_alg in
-		*1)
-			with_sit_alg="sha1"
-			;;
-		*2*)
-			with_sit_alg="sha256"
-			;;
-		auto)
-			if test "$with_aes" != "no"
-			then
-				with_aes="yes"
-			fi
-			;;
-		*)
-			with_sit_alg="aes"
-			if test "$with_aes" != "no"
-			then
-				with_aes="yes"
-			fi
-			;;
-	esac
-fi
-if test "with_aes" = "checksit"
+if test "with_aes" = "checkcc"
 then
 	with_aes="no"
 fi
@@ -16107,77 +16066,62 @@ fi


 #
-# Choose SIT algorithm
+# Choose Client Cookie algorithm
 #

-if test "$enable_sit" = "yes"
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for the Algorithm for Client Cookie" >&5
+$as_echo_n "checking for the Algorithm for Client Cookie... " >&6; }
+if test "$with_cc_alg" = "auto"
 then
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for the Algorithm for SIT" >&5
-$as_echo_n "checking for the Algorithm for SIT... " >&6; }
-	if test "$with_sit_alg" = "auto"
+	if test "$with_aes" = "yes"
 	then
-		if test "$with_aes" = "yes"
-		then
-			with_sit_alg="aes"
-		else
-			with_sit_alg="sha256"
-		fi
+		with_cc_alg="aes"
+	else
+		with_cc_alg="sha256"
 	fi
 fi
-case $with_sit_alg in
+case $with_cc_alg in
 	sha1)
-		if test "$enable_sit" != "yes"
-		then
-			as_fn_error $? "\"with-sit-alg requires enable-sit\"" "$LINENO" 5;
-		fi
 		{ $as_echo "$as_me:${as_lineno-$LINENO}: result: sha1" >&5
 $as_echo "sha1" >&6; }
 		if test "$CRYPTO" = "-DOPENSSL"
 		then
-			if test "$want_openssl_hash" = "checksit"
+			if test "$want_openssl_hash" = "checkcc"
 			then
 				want_openssl_hash="yes"
 			fi
 		fi

-$as_echo "#define HMAC_SHA1_SIT 1" >>confdefs.h
+$as_echo "#define HMAC_SHA1_CC 1" >>confdefs.h

 		;;
 	sha256)
-		if test "$enable_sit" != "yes"
-		then
-			as_fn_error $? "\"with-sit-alg requires enable-sit\"" "$LINENO" 5;
-		fi
 		{ $as_echo "$as_me:${as_lineno-$LINENO}: result: sha256" >&5
 $as_echo "sha256" >&6; }
 		if test "$CRYPTO" = "-DOPENSSL"
 		then
-			if test "$want_openssl_hash" = "checksit"
+			if test "$want_openssl_hash" = "checkcc"
 			then
 				want_openssl_hash="yes"
 			fi
 		fi

-$as_echo "#define HMAC_SHA256_SIT 1" >>confdefs.h
+$as_echo "#define HMAC_SHA256_CC 1" >>confdefs.h

 		;;
 	aes)
-		if test "$enable_sit" != "yes"
-		then
-			as_fn_error $? "\"with-sit-alg requires enable-sit\"" "$LINENO" 5;
-		fi
 		{ $as_echo "$as_me:${as_lineno-$LINENO}: result: aes" >&5
 $as_echo "aes" >&6; }
 		if test "$with_aes" != "yes"
 		then
-			as_fn_error $? "\"SIT wants to use unavailable AES\"" "$LINENO" 5;
+			as_fn_error $? "\"Client Cookie wants to use unavailable AES\"" "$LINENO" 5;
 		fi

-$as_echo "#define AES_SIT 1" >>confdefs.h
+$as_echo "#define AES_CC 1" >>confdefs.h

 		;;
 esac
-if test "$want_openssl_hash" = "checksit"
+if test "$want_openssl_hash" = "checkcc"
 then
 	want_openssl_hash="no"
 fi
@@ -22069,7 +22013,7 @@ ac_config_commands="$ac_config_commands chmod"
 # elsewhere if there's a good reason for doing so.
 #

-ac_config_files="$ac_config_files make/Makefile make/mkdep Makefile bin/Makefile bin/check/Makefile bin/confgen/Makefile bin/confgen/unix/Makefile bin/delv/Makefile bin/dig/Makefile bin/dnssec/Makefile bin/named/Makefile bin/named/unix/Makefile bin/nsupdate/Makefile bin/pkcs11/Makefile bin/python/Makefile bin/python/dnssec-checkds.py bin/python/dnssec-coverage.py bin/rndc/Makefile bin/tests/Makefile bin/tests/atomic/Makefile bin/tests/db/Makefile bin/tests/dst/Makefile bin/tests/dst/Kdh.+002+18602.key bin/tests/dst/Kdh.+002+18602.private bin/tests/dst/Kdh.+002+48957.key bin/tests/dst/Kdh.+002+48957.private bin/tests/dst/Ktest.+001+00002.key bin/tests/dst/Ktest.+001+54622.key bin/tests/dst/Ktest.+001+54622.private bin/tests/dst/Ktest.+003+23616.key bin/tests/dst/Ktest.+003+23616.private bin/tests/dst/Ktest.+003+49667.key bin/tests/dst/dst_2_data bin/tests/dst/t2_data_1 bin/tests/dst/t2_data_2 bin/tests/dst/t2_dsasig bin/tests/dst/t2_rsasig bin/tests/hashes/Makefile bin/tests/headerdep_test.sh bin/tests/master/Makefile bin/tests/mem/Makefile bin/tests/names/Makefile bin/tests/net/Makefile bin/tests/pkcs11/Makefile bin/tests/pkcs11/benchmarks/Makefile bin/tests/rbt/Makefile bin/tests/resolver/Makefile bin/tests/sockaddr/Makefile bin/tests/system/Makefile bin/tests/system/builtin/Makefile bin/tests/system/conf.sh bin/tests/system/dlz/prereq.sh bin/tests/system/dlzexternal/Makefile bin/tests/system/dlzexternal/ns1/named.conf bin/tests/system/filter-aaaa/Makefile bin/tests/system/geoip/Makefile bin/tests/system/inline/checkdsa.sh bin/tests/system/lwresd/Makefile bin/tests/system/pipelined/Makefile bin/tests/system/resolver/Makefile bin/tests/system/rndc/Makefile bin/tests/system/rpz/Makefile bin/tests/system/rsabigexponent/Makefile bin/tests/system/sit/prereq.sh bin/tests/system/tkey/Makefile bin/tests/system/tsiggss/Makefile bin/tests/tasks/Makefile bin/tests/timers/Makefile bin/tests/virtual-time/Makefile bin/tests/virtual-time/conf.sh bin/tools/Makefile contrib/scripts/check-secure-delegation.pl contrib/scripts/zone-edit.sh doc/Makefile doc/arm/Makefile doc/doxygen/Doxyfile doc/doxygen/Makefile doc/doxygen/doxygen-input-filter doc/misc/Makefile doc/xsl/Makefile doc/xsl/isc-docbook-chunk.xsl doc/xsl/isc-docbook-html.xsl doc/xsl/isc-docbook-latex.xsl doc/xsl/isc-manpage.xsl doc/xsl/isc-notes-html.xsl doc/xsl/isc-notes-latex.xsl isc-config.sh lib/Makefile lib/bind9/Makefile lib/bind9/include/Makefile lib/bind9/include/bind9/Makefile lib/dns/Makefile lib/dns/include/Makefile lib/dns/include/dns/Makefile lib/dns/include/dst/Makefile lib/dns/tests/Makefile lib/irs/Makefile lib/irs/include/Makefile lib/irs/include/irs/Makefile lib/irs/include/irs/netdb.h lib/irs/include/irs/platform.h lib/isc/$arch/Makefile lib/isc/$arch/include/Makefile lib/isc/$arch/include/isc/Makefile lib/isc/$thread_dir/Makefile lib/isc/$thread_dir/include/Makefile lib/isc/$thread_dir/include/isc/Makefile lib/isc/Makefile lib/isc/include/Makefile lib/isc/include/isc/Makefile lib/isc/include/isc/platform.h lib/isc/include/pk11/Makefile lib/isc/include/pkcs11/Makefile lib/isc/tests/Makefile lib/isc/nls/Makefile lib/isc/unix/Makefile lib/isc/unix/include/Makefile lib/isc/unix/include/isc/Makefile lib/isc/unix/include/pkcs11/Makefile lib/isccc/Makefile lib/isccc/include/Makefile lib/isccc/include/isccc/Makefile lib/isccfg/Makefile lib/isccfg/include/Makefile lib/isccfg/include/isccfg/Makefile lib/lwres/Makefile lib/lwres/include/Makefile lib/lwres/include/lwres/Makefile lib/lwres/include/lwres/netdb.h lib/lwres/include/lwres/platform.h lib/lwres/man/Makefile lib/lwres/tests/Makefile lib/lwres/unix/Makefile lib/lwres/unix/include/Makefile lib/lwres/unix/include/lwres/Makefile lib/tests/Makefile lib/tests/include/Makefile lib/tests/include/tests/Makefile lib/samples/Makefile lib/samples/Makefile-postinstall unit/Makefile unit/unittest.sh"
+ac_config_files="$ac_config_files make/Makefile make/mkdep Makefile bin/Makefile bin/check/Makefile bin/confgen/Makefile bin/confgen/unix/Makefile bin/delv/Makefile bin/dig/Makefile bin/dnssec/Makefile bin/named/Makefile bin/named/unix/Makefile bin/nsupdate/Makefile bin/pkcs11/Makefile bin/python/Makefile bin/python/dnssec-checkds.py bin/python/dnssec-coverage.py bin/rndc/Makefile bin/tests/Makefile bin/tests/atomic/Makefile bin/tests/db/Makefile bin/tests/dst/Makefile bin/tests/dst/Kdh.+002+18602.key bin/tests/dst/Kdh.+002+18602.private bin/tests/dst/Kdh.+002+48957.key bin/tests/dst/Kdh.+002+48957.private bin/tests/dst/Ktest.+001+00002.key bin/tests/dst/Ktest.+001+54622.key bin/tests/dst/Ktest.+001+54622.private bin/tests/dst/Ktest.+003+23616.key bin/tests/dst/Ktest.+003+23616.private bin/tests/dst/Ktest.+003+49667.key bin/tests/dst/dst_2_data bin/tests/dst/t2_data_1 bin/tests/dst/t2_data_2 bin/tests/dst/t2_dsasig bin/tests/dst/t2_rsasig bin/tests/hashes/Makefile bin/tests/headerdep_test.sh bin/tests/master/Makefile bin/tests/mem/Makefile bin/tests/names/Makefile bin/tests/net/Makefile bin/tests/pkcs11/Makefile bin/tests/pkcs11/benchmarks/Makefile bin/tests/rbt/Makefile bin/tests/resolver/Makefile bin/tests/sockaddr/Makefile bin/tests/system/Makefile bin/tests/system/builtin/Makefile bin/tests/system/conf.sh bin/tests/system/dlz/prereq.sh bin/tests/system/dlzexternal/Makefile bin/tests/system/dlzexternal/ns1/named.conf bin/tests/system/filter-aaaa/Makefile bin/tests/system/geoip/Makefile bin/tests/system/inline/checkdsa.sh bin/tests/system/lwresd/Makefile bin/tests/system/pipelined/Makefile bin/tests/system/resolver/Makefile bin/tests/system/rndc/Makefile bin/tests/system/rpz/Makefile bin/tests/system/rsabigexponent/Makefile bin/tests/system/tkey/Makefile bin/tests/system/tsiggss/Makefile bin/tests/tasks/Makefile bin/tests/timers/Makefile bin/tests/virtual-time/Makefile bin/tests/virtual-time/conf.sh bin/tools/Makefile contrib/scripts/check-secure-delegation.pl contrib/scripts/zone-edit.sh doc/Makefile doc/arm/Makefile doc/doxygen/Doxyfile doc/doxygen/Makefile doc/doxygen/doxygen-input-filter doc/misc/Makefile doc/xsl/Makefile doc/xsl/isc-docbook-chunk.xsl doc/xsl/isc-docbook-html.xsl doc/xsl/isc-docbook-latex.xsl doc/xsl/isc-manpage.xsl doc/xsl/isc-notes-html.xsl doc/xsl/isc-notes-latex.xsl isc-config.sh lib/Makefile lib/bind9/Makefile lib/bind9/include/Makefile lib/bind9/include/bind9/Makefile lib/dns/Makefile lib/dns/include/Makefile lib/dns/include/dns/Makefile lib/dns/include/dst/Makefile lib/dns/tests/Makefile lib/irs/Makefile lib/irs/include/Makefile lib/irs/include/irs/Makefile lib/irs/include/irs/netdb.h lib/irs/include/irs/platform.h lib/isc/$arch/Makefile lib/isc/$arch/include/Makefile lib/isc/$arch/include/isc/Makefile lib/isc/$thread_dir/Makefile lib/isc/$thread_dir/include/Makefile lib/isc/$thread_dir/include/isc/Makefile lib/isc/Makefile lib/isc/include/Makefile lib/isc/include/isc/Makefile lib/isc/include/isc/platform.h lib/isc/include/pk11/Makefile lib/isc/include/pkcs11/Makefile lib/isc/tests/Makefile lib/isc/nls/Makefile lib/isc/unix/Makefile lib/isc/unix/include/Makefile lib/isc/unix/include/isc/Makefile lib/isc/unix/include/pkcs11/Makefile lib/isccc/Makefile lib/isccc/include/Makefile lib/isccc/include/isccc/Makefile lib/isccfg/Makefile lib/isccfg/include/Makefile lib/isccfg/include/isccfg/Makefile lib/lwres/Makefile lib/lwres/include/Makefile lib/lwres/include/lwres/Makefile lib/lwres/include/lwres/netdb.h lib/lwres/include/lwres/platform.h lib/lwres/man/Makefile lib/lwres/tests/Makefile lib/lwres/unix/Makefile lib/lwres/unix/include/Makefile lib/lwres/unix/include/lwres/Makefile lib/tests/Makefile lib/tests/include/Makefile lib/tests/include/tests/Makefile lib/samples/Makefile lib/samples/Makefile-postinstall unit/Makefile unit/unittest.sh"


 #
@@ -23126,7 +23070,6 @@ do
    "bin/tests/system/rndc/Makefile") CONFIG_FILES="$CONFIG_FILES bin/tests/system/rndc/Makefile" ;;
    "bin/tests/system/rpz/Makefile") CONFIG_FILES="$CONFIG_FILES bin/tests/system/rpz/Makefile" ;;
    "bin/tests/system/rsabigexponent/Makefile") CONFIG_FILES="$CONFIG_FILES bin/tests/system/rsabigexponent/Makefile" ;;
-    "bin/tests/system/sit/prereq.sh") CONFIG_FILES="$CONFIG_FILES bin/tests/system/sit/prereq.sh" ;;
    "bin/tests/system/tkey/Makefile") CONFIG_FILES="$CONFIG_FILES bin/tests/system/tkey/Makefile" ;;
    "bin/tests/system/tsiggss/Makefile") CONFIG_FILES="$CONFIG_FILES bin/tests/system/tsiggss/Makefile" ;;
    "bin/tests/tasks/Makefile") CONFIG_FILES="$CONFIG_FILES bin/tests/tasks/Makefile" ;;
@@ -24514,11 +24457,8 @@ fi
 test "$use_tuning" = "large" && echo "    Large-system tuning (--with-tuning)"
 test "$use_geoip" = "no" || echo "    GeoIP access control (--with-geoip)"
 test "$use_gssapi" = "no" || echo "    GSS-API (--with-gssapi)"
-if test "$enable_sit" != "no"; then
-    echo "    Source Identity Token support (--enable-sit)"
-    if test "$enable_full_report" = "yes" -o "$with_sit_alg" != "aes"; then
-	echo "        Algorithm: $with_sit_alg"
-    fi
+if test "$enable_full_report" = "yes" -o "$with_cc_alg" != "aes"; then
+    echo "        Algorithm: $with_cc_alg"
 fi

 # these lines are only printed if run with --enable-full-report
@@ -24588,7 +24528,6 @@ test "$use_tuning" = "large" || echo "    Large-system tuning (--with-tuning)"

 test "$use_geoip" = "no" && echo "    GeoIP access control (--with-geoip)"
 test "$use_gssapi" = "no" && echo "    GSS-API (--with-gssapi)"
-test "$enable_sit" = "no" && echo "    Source Identity Token support (--enable-sit)"

 test "$enable_fixed" = "yes" || \
    echo "    Allow 'fixed' rrset-order (--enable-fixed-rrset)"
@@ -91,7 +91,6 @@ yes)
 	test "${enable_filter_aaaa+set}" = set || enable_filter_aaaa=yes
 	test "${with_dlz_filesystem+set}" = set || with_dlz_filesystem=yes
 	test "${enable_symtable+set}" = set || enable_symtable=all
-	test "${enable_sit+set}" = set || enable_sit=yes
 	test "${enable_warn_error+set}" = set || enable_warn_error=yes
 	test "${enable_warn_shadow+set}" = set || enable_warn_shadow=yes
 	;;
@@ -1314,73 +1313,44 @@ AC_ARG_WITH(ecdsa, [  --with-ecdsa            Crypto ECDSA],
 AC_ARG_WITH(gost, [  --with-gost             Crypto GOST [yes|no|raw|asn1].],
 	    with_gost="$withval", with_gost="auto")
 AC_ARG_WITH(aes, [  --with-aes              Crypto AES],
-	    with_aes="$withval", with_aes="checksit")
+	    with_aes="$withval", with_aes="checkcc")

 #
 # was --enable-openssl-hash specified?
 #
 AC_ARG_ENABLE(openssl-hash,
 	[  --enable-openssl-hash   use OpenSSL for hash functions [[default=no]]],
-	want_openssl_hash="$enableval", want_openssl_hash="checksit")
+	want_openssl_hash="$enableval", want_openssl_hash="checkcc")

 #
-# Enable Source Identity Token support
+# Client Cookie algorithm choice
 #
-AC_MSG_CHECKING(for Source Identity Token support)
-AC_ARG_ENABLE(sit,
-	[  --enable-sit            enable source identity token [[default=no]]],
-	enable_sit="$enableval", enable_sit="no")
-HAVE_SIT=
-ISC_PLATFORM_USESIT="#undef ISC_PLATFORM_USESIT"
+AC_ARG_WITH(cc-alg,
+	[  --with-cc-alg=ALG      choose the algorithm for Client Cookie [[aes|sha1|sha256]]],
+	with_cc_alg="$withval", with_cc_alg="auto")

-case "$enable_sit" in
-yes)
-	AC_MSG_RESULT(yes)
-	ISC_PLATFORM_USESIT="#define ISC_PLATFORM_USESIT 1"
-	HAVE_SIT=1
-	;;
-no)
-	AC_MSG_RESULT(no)
-	;;
-*)
-	AC_MSG_ERROR("enable-sit requires yes or no")
-	;;
+case $with_cc_alg in
+	*1)
+		with_cc_alg="sha1"
+		;;
+	*2*)
+		with_cc_alg="sha256"
+		;;
+	auto)
+		if test "$with_aes" != "no"
+		then
+			with_aes="yes"
+		fi
+		;;
+	*)
+		with_cc_alg="aes"
+		if test "$with_aes" != "no"
+		then
+			with_aes="yes"
+		fi
+		;;
 esac
-AC_SUBST(ISC_PLATFORM_USESIT)
-AC_SUBST(HAVE_SIT)
-
-#
-# Source Identity Token algorithm choice
-#
-AC_ARG_WITH(sit-alg,
-	[  --with-sit-alg=ALG      choose the algorithm for SIT [[aes|sha1|sha256]]],
-	with_sit_alg="$withval", with_sit_alg="auto")
-
-if test "$enable_sit" = "yes"
-then
-	case $with_sit_alg in
-		*1)
-			with_sit_alg="sha1"
-			;;
-		*2*)
-			with_sit_alg="sha256"
-			;;
-		auto)
-			if test "$with_aes" != "no"
-			then
-				with_aes="yes"
-			fi
-			;;
-		*)
-			with_sit_alg="aes"
-			if test "$with_aes" != "no"
-			then
-				with_aes="yes"
-			fi
-			;;
-	esac
-fi
-if test "with_aes" = "checksit"
+if test "with_aes" = "checkcc"
 then
 	with_aes="no"
 fi
@@ -1802,70 +1772,55 @@ fi
 AC_SUBST(ISC_PLATFORM_WANTAES)

 #
-# Choose SIT algorithm
+# Choose Client Cookie algorithm
 #

-if test "$enable_sit" = "yes"
+AC_MSG_CHECKING(for the Algorithm for Client Cookie)
+if test "$with_cc_alg" = "auto"
 then
-	AC_MSG_CHECKING(for the Algorithm for SIT)
-	if test "$with_sit_alg" = "auto"
+	if test "$with_aes" = "yes"
 	then
-		if test "$with_aes" = "yes"
-		then
-			with_sit_alg="aes"
-		else
-			with_sit_alg="sha256"
-		fi
+		with_cc_alg="aes"
+	else
+		with_cc_alg="sha256"
 	fi
 fi
-case $with_sit_alg in
+case $with_cc_alg in
 	sha1)
-		if test "$enable_sit" != "yes"
-		then
-			AC_MSG_ERROR("with-sit-alg requires enable-sit");
-		fi
 		AC_MSG_RESULT(sha1)
 		if test "$CRYPTO" = "-DOPENSSL"
 		then
-			if test "$want_openssl_hash" = "checksit"
+			if test "$want_openssl_hash" = "checkcc"
 			then
 				want_openssl_hash="yes"
 			fi
 		fi
-		AC_DEFINE(HMAC_SHA1_SIT, 1,
-			  [Use HMAC-SHA1 for Source Identity Token generation])
+		AC_DEFINE(HMAC_SHA1_CC, 1,
+			  [Use HMAC-SHA1 for Client Cookie generation])
 		;;
 	sha256)
-		if test "$enable_sit" != "yes"
-		then
-			AC_MSG_ERROR("with-sit-alg requires enable-sit");
-		fi
 		AC_MSG_RESULT(sha256)
 		if test "$CRYPTO" = "-DOPENSSL"
 		then
-			if test "$want_openssl_hash" = "checksit"
+			if test "$want_openssl_hash" = "checkcc"
 			then
 				want_openssl_hash="yes"
 			fi
 		fi
-		AC_DEFINE(HMAC_SHA256_SIT, 1,
-			  [Use HMAC-SHA256 for Source Identity Token generation])
+		AC_DEFINE(HMAC_SHA256_CC, 1,
+			  [Use HMAC-SHA256 for Client Cookie generation])
 		;;
 	aes)
-		if test "$enable_sit" != "yes"
-		then
-			AC_MSG_ERROR("with-sit-alg requires enable-sit");
-		fi
 		AC_MSG_RESULT(aes)
 		if test "$with_aes" != "yes"
 		then
-			AC_MSG_ERROR("SIT wants to use unavailable AES");
+			AC_MSG_ERROR("Client Cookie wants to use unavailable AES");
 		fi
-		AC_DEFINE(AES_SIT, 1,
-			  [Use AES for Source Identity Token generation])
+		AC_DEFINE(AES_CC, 1,
+			  [Use AES for Client Cookie generation])
 		;;
 esac
-if test "$want_openssl_hash" = "checksit"
+if test "$want_openssl_hash" = "checkcc"
 then
 	want_openssl_hash="no"
 fi
@@ -4700,7 +4655,6 @@ AC_CONFIG_FILES([
 	bin/tests/system/rndc/Makefile
 	bin/tests/system/rpz/Makefile
 	bin/tests/system/rsabigexponent/Makefile
-	bin/tests/system/sit/prereq.sh
 	bin/tests/system/tkey/Makefile
 	bin/tests/system/tsiggss/Makefile
 	bin/tests/tasks/Makefile
@@ -4815,11 +4769,8 @@ fi
 test "$use_tuning" = "large" && echo "    Large-system tuning (--with-tuning)"
 test "$use_geoip" = "no" || echo "    GeoIP access control (--with-geoip)"
 test "$use_gssapi" = "no" || echo "    GSS-API (--with-gssapi)"
-if test "$enable_sit" != "no"; then
-    echo "    Source Identity Token support (--enable-sit)"
-    if test "$enable_full_report" = "yes" -o "$with_sit_alg" != "aes"; then
-	echo "        Algorithm: $with_sit_alg"
-    fi
+if test "$enable_full_report" = "yes" -o "$with_cc_alg" != "aes"; then
+    echo "        Algorithm: $with_cc_alg"
 fi

 # these lines are only printed if run with --enable-full-report 
@@ -4889,7 +4840,6 @@ test "$use_tuning" = "large" || echo "    Large-system tuning (--with-tuning)"

 test "$use_geoip" = "no" && echo "    GeoIP access control (--with-geoip)"
 test "$use_gssapi" = "no" && echo "    GSS-API (--with-gssapi)"
-test "$enable_sit" = "no" && echo "    Source Identity Token support (--enable-sit)"

 test "$enable_fixed" = "yes" || \
    echo "    Allow 'fixed' rrset-order (--enable-fixed-rrset)"
@@ -4241,10 +4241,12 @@ category notify { null; };
 		      if not set), if the query was signed (S),
 		      EDNS was in used along with the EDNS version
 		      number (E(#)), if TCP was used (T), if DO
-		      (DNSSEC Ok) was set (D), or if CD (Checking
-		      Disabled) was set (C).  After this the
-		      destination address the query was sent to is
-		      reported.
+		      (DNSSEC Ok) was set (D), if CD (Checking
+		      Disabled) was set (C), if a valid DNS Server
+		      COOKIE was recieved (V), or if a DNS COOKIE
+		      option without a valid Server COOKIE was
+		      present (K).  After this the destination
+		      address the query was sent to is reported.
 		    </para>

 		    <para>
@@ -4804,8 +4806,9 @@ badresp:1,adberr:0,findfail:0,valfail:0]
    <optional> multiple-cnames <replaceable>yes_or_no</replaceable>; </optional>
    <optional> notify <replaceable>yes_or_no</replaceable> | <replaceable>explicit</replaceable> | <replaceable>master-only</replaceable>; </optional>
    <optional> recursion <replaceable>yes_or_no</replaceable>; </optional>
-    <optional> request-sit <replaceable>yes_or_no</replaceable>; </optional>
-    <optional> sit-secret <replaceable>secret_string</replaceable>; </optional>
+    <optional> send-cookie <replaceable>yes_or_no</replaceable>; </optional>
+    <optional> cookie-algorithm <replaceable>secret_string</replaceable>; </optional>
+    <optional> cookie-secret <replaceable>secret_string</replaceable>; </optional>
    <optional> request-nsid <replaceable>yes_or_no</replaceable>; </optional>
    <optional> rfc2308-type1 <replaceable>yes_or_no</replaceable>; </optional>
    <optional> use-id-pool <replaceable>yes_or_no</replaceable>; </optional>
@@ -6457,30 +6460,58 @@ options {
 	    </varlistentry>

 	    <varlistentry>
-	      <term><command>request-sit</command></term>
+              <term><command>request-nsid</command></term>
+	      <para>
+		This experimental option is obsolete.
+	      </para>
+	    </varlistentry>
+
+	    <varlistentry>
+	      <term><command>send-cookie</command></term>
 	      <listitem>
 		<para>
-		  If <userinput>yes</userinput>, then a SIT (Source
-		  Identity Token) EDNS option is sent along with
-		  the query.  If the resolver has previously talked
-		  to the server, the SIT returned in the previous
-		  transaction is sent. This is used by the server
-		  to determine whether the resolver has talked to
-		  it before. A resolver sending the correct SIT is
-		  assumed not to be an off-path attacker sending a
-		  spoofed-source query; the query is therefore
-		  unlikely to be part of a reflection/amplification
-		  attack, so resolvers sending a correct SIT option
-		  are not subject to response rate limiting (RRL).
-		  Resolvers which do not send a correct SIT option
-		  may be limited to receiving smaller responses via
-		  the <command>nosit-udp-size</command> option.
+		  If <userinput>yes</userinput>, then a COOKIE EDNS
+		  option is sent along with the query.  If the
+		  resolver has previously talked to the server, the
+		  COOKIE returned in the previous transaction is sent.
+		  This is used by the server to determine whether
+		  the resolver has talked to it before. A resolver
+		  sending the correct COOKIE is assumed not to be an
+		  off-path attacker sending a spoofed-source query;
+		  the query is therefore unlikely to be part of a
+		  reflection/amplification attack, so resolvers
+		  sending a correct COOKIE option are not subject to
+		  response rate limiting (RRL).  Resolvers which
+		  do not send a correct COOKIE option may be limited
+		  to receiving smaller responses via the
+		  <command>nocookie-udp-size</command> option.
 		</para>
 	      </listitem>
 	    </varlistentry>

 	    <varlistentry>
 	      <term><command>sit-secret</command></term>
+	      <listitem>
+		<para>
+		  This experimental option is obsolete.
+	    	</para>
+	      </listitem>
+	    </varlistentry>
+
+	    <varlistentry>
+	      <term><command>cookie-algorithm</command></term>
+	      <listitem>
+		<para>
+		  Set the algorithm to be used when generating the
+		  server cookie.  One of "aes", "sha1" or "sha256".
+		  The default is "aes" if supported by the cryptographic
+		  library or otherwise "sha256".
+		</para>
+	      </listitem>
+	    </varlistentry>
+
+	    <varlistentry>
+	      <term><command>cookie-secret</command></term>
 	      <listitem>
 		<para>
 		  If set, this is a shared secret used for generating
@@ -10572,11 +10603,11 @@ example.com                 CNAME   rpz-tcp-only.
    <optional> request-ixfr <replaceable>yes_or_no</replaceable> ; </optional>
    <optional> request-expire <replaceable>yes_or_no</replaceable> ; </optional>
    <optional> request-nsid <replaceable>yes_or_no</replaceable> ; </optional>
-    <optional> request-sit <replaceable>yes_or_no</replaceable> ; </optional>
+    <optional> send-cookie <replaceable>yes_or_no</replaceable> ; </optional>
    <optional> edns <replaceable>yes_or_no</replaceable> ; </optional>
    <optional> edns-udp-size <replaceable>number</replaceable> ; </optional>
    <optional> edns-version <replaceable>number</replaceable> ; </optional>
-    <optional> nosit-udp-size <replaceable>number</replaceable> ; </optional>
+    <optional> nocookie-udp-size <replaceable>number</replaceable> ; </optional>
    <optional> max-udp-size <replaceable>number</replaceable> ; </optional>
    <optional> tcp-only <replaceable>yes_or_no</replaceable> ; </optional>
    <optional> transfers <replaceable>number</replaceable> ; </optional>
@@ -10742,9 +10773,9 @@ example.com                 CNAME   rpz-tcp-only.
 	  </para>

 	  <para>
-	    The <command>nosit-udp-size</command> option sets the
+	    The <command>nocookie-udp-size</command> option sets the
 	    maximum size of UDP responses that will be sent to
-	    queries without a valid source identity token.  The command
+	    queries without a valid server COOKIE.  The command
 	    <command>max-udp-size</command> option may further limit
 	    the response size.
 	  </para>
@@ -10845,13 +10876,13 @@ example.com                 CNAME   rpz-tcp-only.
 	  </para>

 	  <para>
-	    The <command>request-sit</command> clause determines
-	    whether the local server will add a SIT EDNS option
+	    The <command>send-cookie</command> clause determines
+	    whether the local server will add a COOKIE EDNS option
 	    to requests sent to the server.  This overrides
-	    <command>request-sit</command> set at the view or
+	    <command>send-cookie</command> set at the view or
 	    option level.  The <command>named</command> server may
-	    determine that SIT is not supported by the remote server
-	    and not add a SIT EDNS option to requests.
+	    determine that COOKIE is not supported by the remote server
+	    and not add a COOKIE EDNS option to requests.
 	  </para>
 	</sect2>

@@ -485,10 +485,22 @@
      </listitem>
      <listitem>
 	<para>
-	  When retrying a query via TCP due to the first answer being
-	  truncated, <command>dig</command> will now correctly send
-	  the SIT (server identity token) value returned by the server
-	  in the prior response. [RT #39047]
+	  The experimental SIT option (code point 65001) of BIND
+	  9.10.0 through BIND 9.10.2 has be replace the COOKIE
+	  option (code point 10) and is no longer experimental and
+	  is sent by default.
+	</para>
+	<para>
+	  The SIT related named.conf options have been marked as
+	  obsolete and are otherwise ignored.
+	</para>
+      </listitem>
+      <listitem>
+	<para>
+	  When retrying a query via TCP due to the first answer
+	  being truncated, <command>dig</command> will now correctly
+	  send the Server COOKIE returned by the server in the prior
+	  response. [RT #39047]
 	</para>
      </listitem>
      <listitem>
@@ -21,6 +21,7 @@

 #include <stdlib.h>

+#include <isc/aes.h>
 #include <isc/base64.h>
 #include <isc/buffer.h>
 #include <isc/file.h>
@@ -32,23 +33,13 @@
 #include <isc/platform.h>
 #include <isc/region.h>
 #include <isc/result.h>
+#include <isc/sha1.h>
+#include <isc/sha2.h>
 #include <isc/sockaddr.h>
 #include <isc/string.h>
 #include <isc/symtab.h>
 #include <isc/util.h>

-#ifdef ISC_PLATFORM_USESIT
-#ifdef AES_SIT
-#include <isc/aes.h>
-#endif
-#ifdef HMAC_SHA1_SIT
-#include <isc/sha1.h>
-#endif
-#ifdef HMAC_SHA256_SIT
-#include <isc/sha2.h>
-#endif
-#endif
-
 #include <dns/acl.h>
 #include <dns/fixedname.h>
 #include <dns/rdataclass.h>
@@ -805,10 +796,13 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
 	dns_fixedname_t fixed;
 	const char *str;
 	dns_name_t *name;
-#ifdef ISC_PLATFORM_USESIT
 	isc_buffer_t b;
-#endif
 	isc_uint32_t lifetime = 3600;
+#if defined(HAVE_OPENSSL_AES) || defined(HAVE_OPENSSL_EVP_AES)
+	const char *ccalg = "aes";
+#else
+	const char *ccalg = "sha256";
+#endif

 	static intervaltable intervals[] = {
 	{ "cleaning-interval", 60, 28 * 24 * 60 },	/* 28 days */
@@ -1183,9 +1177,18 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
 				    "(%d seconds)", recheck, lifetime);
 	}

-#ifdef ISC_PLATFORM_USESIT
 	obj = NULL;
-	(void) cfg_map_get(options, "sit-secret", &obj);
+	(void) cfg_map_get(options, "cookie-algorithm,", &obj);
+	if (obj != NULL)
+		ccalg = cfg_obj_asstring(obj);
+#if !defined(HAVE_OPENSSL_AES) && !defined(HAVE_OPENSSL_EVP_AES)
+	if (strcasecmp(ccalg, "aes") == 0)
+		cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+			    "cookie-algorithm: '%s' not supported", ccalg);
+#endif
+
+	obj = NULL;
+	(void) cfg_map_get(options, "cookie-secret", &obj);
 	if (obj != NULL) {
 		unsigned char secret[32];

@@ -1194,39 +1197,36 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
 		tresult = isc_hex_decodestring(cfg_obj_asstring(obj), &b);
 		if (tresult == ISC_R_NOSPACE) {
 			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
-				    "sit-secret: too long");
+				    "cookie-secret: too long");
 		} else if (tresult != ISC_R_SUCCESS) {
 			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
-				    "sit-secret: invalid hex string");
+				    "cookie-secret: invalid hex string");
 		}
 		if (tresult != ISC_R_SUCCESS)
 			result = tresult;
-#ifdef AES_SIT
+		
 		if (tresult == ISC_R_SUCCESS &&
+		    strcasecmp(ccalg, "aes") != 0 &&
 		    isc_buffer_usedlength(&b) != ISC_AES128_KEYLENGTH) {
 			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
-				    "AES sit-secret must be on 128 bits");
+				    "AES cookie-secret must be on 128 bits");
 			result = ISC_R_RANGE;
 		}
-#endif
-#ifdef HMAC_SHA1_SIT
 		if (tresult == ISC_R_SUCCESS &&
+		    strcasecmp(ccalg, "sha1") != 0 &&
 		    isc_buffer_usedlength(&b) != ISC_SHA1_DIGESTLENGTH) {
 			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
-				    "SHA1 sit-secret must be on 160 bits");
+				    "SHA1 cookie-secret must be on 160 bits");
 			result = ISC_R_RANGE;
 		}
-#endif
-#ifdef HMAC_SHA256_SIT
 		if (tresult == ISC_R_SUCCESS &&
+		    strcasecmp(ccalg, "sha256") != 0 &&
 		    isc_buffer_usedlength(&b) != ISC_SHA256_DIGESTLENGTH) {
 			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
-				    "SHA256 sit-secret must be on 256 bits");
+				    "SHA256 cookie-secret must be on 256 bits");
 			result = ISC_R_RANGE;
 		}
-#endif
 	}
-#endif

 	return (result);
 }
@@ -3142,7 +3142,7 @@ bind9_check_namedconf(const cfg_obj_t *config, isc_log_t *logctx,
 			result = ISC_R_FAILURE;

 	/*
-	 * Use case insensitve comparision as not all file systems are
+	 * Use case insensitive comparision as not all file systems are
 	 * case sensitive. This will prevent people using FOO.DB and foo.db
 	 * on case sensitive file systems but that shouldn't be a major issue.
 	 */
@@ -256,8 +256,8 @@ struct dns_adbentry {
 	unsigned char			to1232;		/* IPv6 nofrag */
 	unsigned char			to512;		/* plain DNS */
 	isc_sockaddr_t                  sockaddr;
-	unsigned char *			sit;
-	isc_uint16_t			sitlen;
+	unsigned char *			cookie;
+	isc_uint16_t			cookielen;

 	isc_stdtime_t                   expires;
 	isc_stdtime_t			lastage;
@@ -1817,8 +1817,8 @@ new_adbentry(dns_adb_t *adb) {
 	e->to1432 = 0;
 	e->to1232 = 0;
 	e->to512 = 0;
-	e->sit = NULL;
-	e->sitlen = 0;
+	e->cookie = NULL;
+	e->cookielen = 0;
 	isc_random_get(&r);
 	e->srtt = (r & 0x1f) + 1;
 	e->lastage = 0;
@@ -1856,8 +1856,8 @@ free_adbentry(dns_adb_t *adb, dns_adbentry_t **entry) {

 	e->magic = 0;

-	if (e->sit != NULL)
-		isc_mem_put(adb->mctx, e->sit, e->sitlen);
+	if (e->cookie != NULL)
+		isc_mem_put(adb->mctx, e->cookie, e->cookielen);

 	li = ISC_LIST_HEAD(e->lameinfo);
 	while (li != NULL) {
@@ -3482,16 +3482,13 @@ dump_entry(FILE *f, dns_adbentry_t *entry, isc_boolean_t debug,
 		entry->to512, entry->plain, entry->plainto);
 	if (entry->udpsize != 0U)
 		fprintf(f, " [udpsize %u]", entry->udpsize);
-#ifdef ISC_PLATFORM_USESIT
-	if (entry->sit != NULL) {
+	if (entry->cookie != NULL) {
 		unsigned int i;
-		fprintf(f, " [sit=");
-		for (i = 0; i < entry->sitlen; i++)
-			fprintf(f, "%02x", entry->sit[i]);
+		fprintf(f, " [cookie=");
+		for (i = 0; i < entry->cookielen; i++)
+			fprintf(f, "%02x", entry->cookie[i]);
 		fprintf(f, "]");
 	}
-#endif
-
 	if (entry->expires != 0)
 		fprintf(f, " [ttl %d]", entry->expires - now);
 	fprintf(f, "\n");
@@ -4359,8 +4356,8 @@ dns_adb_probesize2(dns_adb_t *adb, dns_adbaddrinfo_t *addr, int lookups) {
 }

 void
-dns_adb_setsit(dns_adb_t *adb, dns_adbaddrinfo_t *addr,
-	       const unsigned char *sit, size_t len)
+dns_adb_setcookie(dns_adb_t *adb, dns_adbaddrinfo_t *addr,
+	          const unsigned char *cookie, size_t len)
 {
 	int bucket;

@@ -4370,27 +4367,28 @@ dns_adb_setsit(dns_adb_t *adb, dns_adbaddrinfo_t *addr,
 	bucket = addr->entry->lock_bucket;
 	LOCK(&adb->entrylocks[bucket]);

-	if (addr->entry->sit != NULL &&
-	    (sit == NULL || len != addr->entry->sitlen)) {
-		isc_mem_put(adb->mctx, addr->entry->sit, addr->entry->sitlen);
-		addr->entry->sit = NULL;
-		addr->entry->sitlen = 0;
+	if (addr->entry->cookie != NULL &&
+	    (cookie == NULL || len != addr->entry->cookielen)) {
+		isc_mem_put(adb->mctx, addr->entry->cookie,
+			    addr->entry->cookielen);
+		addr->entry->cookie = NULL;
+		addr->entry->cookielen = 0;
 	}

-	if (addr->entry->sit == NULL && sit != NULL && len != 0U) {
-		addr->entry->sit = isc_mem_get(adb->mctx, len);
-		if (addr->entry->sit != NULL)
-			addr->entry->sitlen = (isc_uint16_t)len;
+	if (addr->entry->cookie == NULL && cookie != NULL && len != 0U) {
+		addr->entry->cookie = isc_mem_get(adb->mctx, len);
+		if (addr->entry->cookie != NULL)
+			addr->entry->cookielen = (isc_uint16_t)len;
 	}

-	if (addr->entry->sit != NULL)
-		memmove(addr->entry->sit, sit, len);
+	if (addr->entry->cookie != NULL)
+		memmove(addr->entry->cookie, cookie, len);
 	UNLOCK(&adb->entrylocks[bucket]);
 }

 size_t
-dns_adb_getsit(dns_adb_t *adb, dns_adbaddrinfo_t *addr,
-	       unsigned char *sit, size_t len)
+dns_adb_getcookie(dns_adb_t *adb, dns_adbaddrinfo_t *addr,
+	          unsigned char *cookie, size_t len)
 {
 	int bucket;

@@ -4399,11 +4397,11 @@ dns_adb_getsit(dns_adb_t *adb, dns_adbaddrinfo_t *addr,

 	bucket = addr->entry->lock_bucket;
 	LOCK(&adb->entrylocks[bucket]);
-	if (sit != NULL && addr->entry->sit != NULL &&
-	    len >= addr->entry->sitlen)
+	if (cookie != NULL && addr->entry->cookie != NULL &&
+	    len >= addr->entry->cookielen)
 	{
-		memmove(sit, addr->entry->sit, addr->entry->sitlen);
-		len = addr->entry->sitlen;
+		memmove(cookie, addr->entry->cookie, addr->entry->cookielen);
+		len = addr->entry->cookielen;
 	} else
 		len = 0;
 	UNLOCK(&adb->entrylocks[bucket]);
@@ -750,11 +750,11 @@ dns_adb_flushnames(dns_adb_t *adb, dns_name_t *name);
 */

 void
-dns_adb_setsit(dns_adb_t *adb, dns_adbaddrinfo_t *addr,
-	       const unsigned char *sit, size_t len);
+dns_adb_setcookie(dns_adb_t *adb, dns_adbaddrinfo_t *addr,
+	          const unsigned char *cookie, size_t len);
 /*%<
- * Record the Source Identity Token (SIT) associated with this addresss.  If
- * sit is NULL or len is zero. The recorded SIT is cleared.
+ * Record the COOKIE associated with this addresss.  If
+ * cookie is NULL or len is zero the recorded COOKIE is cleared.
 *
 * Requires:
 *\li	'adb' is valid.
@@ -762,17 +762,18 @@ dns_adb_setsit(dns_adb_t *adb, dns_adbaddrinfo_t *addr,
 */

 size_t
-dns_adb_getsit(dns_adb_t *adb, dns_adbaddrinfo_t *addr,
-	       unsigned char *sit, size_t len);
+dns_adb_getcookie(dns_adb_t *adb, dns_adbaddrinfo_t *addr,
+	          unsigned char *cookie, size_t len);
 /*
- * Retieve the saved SIT value and store it in 'sit' which has size 'len'.
+ * Retieve the saved COOKIE value and store it in 'cookie' which has
+ * size 'len'.
 *
 * Requires:
 *\li	'adb' is valid.
 *\li	'addr' is valid.
 *
 * Returns:
- *	The size of the sit token or zero if it doesn't fit in the buffer
+ *	The size of the cookie or zero if it doesn't fit in the buffer
 *	or it doesn't exist.
 */

@@ -24,7 +24,7 @@
 #ifdef DRAFT_ANDREWS_EDNS1
 #undef DNS_EDNS_VERSION
 /*
- * Warning: this currently disables sending SIT requests in resolver.c
+ * Warning: this currently disables sending COOKIE requests in resolver.c
 */
 #define DNS_EDNS_VERSION 1 /* draft-andrews-edns1 */
 #endif
@@ -107,9 +107,9 @@
 #define DNS_OPT_NSID		0x0003		/*%< NSID opt code */
 #define DNS_OPT_CLIENT_SUBNET	0x0008		/*%< client subnet opt code */
 #define DNS_OPT_EXPIRE		0x0009		/*%< EXPIRE opt code */
+#define DNS_OPT_COOKIE		0x000a		/*%< COOKIE opt code */

 /*%< Experimental options [65001...65534] as per RFC6891 */
-#define DNS_OPT_SIT		65001		/*%< SIT opt code */

 /*%< The number of EDNS options we know about. */
 #define DNS_EDNSOPTIONS	5
@@ -219,8 +219,8 @@ struct dns_message {
 	unsigned int			verify_attempted : 1;
 	unsigned int			free_query : 1;
 	unsigned int			free_saved : 1;
-	unsigned int			sitok : 1;
-	unsigned int			sitbad : 1;
+	unsigned int			cc_ok : 1;
+	unsigned int			cc_bad : 1;

 	unsigned int			opt_reserved;
 	unsigned int			sig_reserved;
@@ -74,7 +74,7 @@ struct dns_peer {
 	isc_boolean_t		request_ixfr;
 	isc_boolean_t		support_edns;
 	isc_boolean_t		request_nsid;
-	isc_boolean_t		request_sit;
+	isc_boolean_t		send_cookie;
 	isc_boolean_t		request_expire;
 	isc_boolean_t		force_tcp;
 	dns_name_t	       *key;
@@ -164,10 +164,10 @@ isc_result_t
 dns_peer_getrequestnsid(dns_peer_t *peer, isc_boolean_t *retval);

 isc_result_t
-dns_peer_setrequestsit(dns_peer_t *peer, isc_boolean_t newval);
+dns_peer_setsendcookie(dns_peer_t *peer, isc_boolean_t newval);

 isc_result_t
-dns_peer_getrequestsit(dns_peer_t *peer, isc_boolean_t *retval);
+dns_peer_getsendcookie(dns_peer_t *peer, isc_boolean_t *retval);

 isc_result_t
 dns_peer_setrequestexpire(dns_peer_t *peer, isc_boolean_t newval);
@@ -156,8 +156,9 @@
 #define DNS_R_NTACOVERED		(ISC_RESULTCLASS_DNS + 110)
 #define DNS_R_BADCDS			(ISC_RESULTCLASS_DNS + 111)
 #define DNS_R_BADCDNSKEY		(ISC_RESULTCLASS_DNS + 112)
+#define DNS_R_OPTERR			(ISC_RESULTCLASS_DNS + 113)

-#define DNS_R_NRESULTS			113	/*%< Number of results */
+#define DNS_R_NRESULTS			114	/*%< Number of results */

 /*
 * DNS wire format rcodes.
@@ -66,18 +66,13 @@ enum {
 	dns_resstatscounter_dispreqtcp = 32,
 	dns_resstatscounter_buckets = 33,
 	dns_resstatscounter_refused = 34,
-#ifdef ISC_PLATFORM_USESIT
-	dns_resstatscounter_sitcc = 35,
-	dns_resstatscounter_sitout = 36,
-	dns_resstatscounter_sitin = 37,
-	dns_resstatscounter_sitok = 38,
-
+	dns_resstatscounter_cookienew = 35,
+	dns_resstatscounter_cookieout = 36,
+	dns_resstatscounter_cookiein = 37,
+	dns_resstatscounter_cookieok = 38,
 	dns_resstatscounter_badvers = 39,
-	dns_resstatscounter_max = 40,
-#else
-	dns_resstatscounter_badvers = 35,
-	dns_resstatscounter_max = 36,
-#endif
+	dns_resstatscounter_badcookie = 40,
+	dns_resstatscounter_max = 41,

 	/*
 	 * DNSSEC stats.
@@ -244,8 +244,11 @@ enum {
 	/*
 	 * Extended rcodes.
 	 */
-	dns_rcode_badvers = 16
+	dns_rcode_badvers = 16,
 #define dns_rcode_badvers		((dns_rcode_t)dns_rcode_badvers)
+	/* Private space [3841..4095] */
+	dns_rcode_badcookie = 3860 
+#define dns_rcode_badcookie		((dns_rcode_t)dns_rcode_badcookie)
 };

 /*%
@@ -147,7 +147,7 @@ struct dns_view {
 	dns_rrl_t *			rrl;
 	isc_boolean_t			provideixfr;
 	isc_boolean_t			requestnsid;
-	isc_boolean_t			requestsit;
+	isc_boolean_t			sendcookie;
 	dns_ttl_t			maxcachettl;
 	dns_ttl_t			maxncachettl;
 	isc_uint32_t			nta_lifetime;
@@ -166,7 +166,7 @@ struct dns_view {
 	dns_name_t *			dlv;
 	dns_fixedname_t			dlv_fixed;
 	isc_uint16_t			maxudp;
-	isc_uint16_t			situdp;
+	isc_uint16_t			nocookieudp;
 	unsigned int			maxbits;
 	dns_aaaa_t			v4_aaaa;
 	dns_aaaa_t			v6_aaaa;
@@ -444,8 +444,8 @@ msginit(dns_message_t *m) {
 	m->saved.base = NULL;
 	m->saved.length = 0;
 	m->free_saved = 0;
-	m->sitok = 0;
-	m->sitbad = 0;
+	m->cc_ok = 0;
+	m->cc_bad = 0;
 	m->querytsig = NULL;
 }

@@ -494,8 +494,8 @@ msgresetopt(dns_message_t *msg)
 		dns_rdataset_disassociate(msg->opt);
 		isc_mempool_put(msg->rdspool, msg->opt);
 		msg->opt = NULL;
-		msg->sitok = 0;
-		msg->sitbad = 0;
+		msg->cc_ok = 0;
+		msg->cc_bad = 0;
 	}
 }

@@ -3323,8 +3323,8 @@ dns_message_pseudosectiontotext(dns_message_t *msg,

 			if (optcode == DNS_OPT_NSID) {
 				ADD_STRING(target, "; NSID");
-			} else if (optcode == DNS_OPT_SIT) {
-				ADD_STRING(target, "; SIT");
+			} else if (optcode == DNS_OPT_COOKIE) {
+				ADD_STRING(target, "; COOKIE");
 			} else if (optcode == DNS_OPT_CLIENT_SUBNET) {
 				ADD_STRING(target, "; CLIENT-SUBNET: ");
 				render_ecs(&optbuf, target);
@@ -3357,7 +3357,7 @@ dns_message_pseudosectiontotext(dns_message_t *msg,
 				for (i = 0; i < optlen; i++) {
 					const char *sep;
 					switch (optcode) {
-					case DNS_OPT_SIT:
+					case DNS_OPT_COOKIE:
 						sep = "";
 						break;
 					default:
@@ -3371,17 +3371,17 @@ dns_message_pseudosectiontotext(dns_message_t *msg,

 				isc_buffer_forward(&optbuf, optlen);

-				if (optcode == DNS_OPT_SIT) {
-					if (msg->sitok)
+				if (optcode == DNS_OPT_COOKIE) {
+					if (msg->cc_ok)
 						ADD_STRING(target, " (good)");
-					if (msg->sitbad)
+					if (msg->cc_bad)
 						ADD_STRING(target, " (bad)");
 					ADD_STRING(target, "\n");
 					continue;
 				}

 				/*
-				 * For non-SIT options, add a printable
+				 * For non-COOKIE options, add a printable
 				 * version
 				 */
 				ADD_STRING(target, "(\"");
@@ -43,7 +43,7 @@
 #define SERVER_UDPSIZE_BIT		 6
 #define SERVER_MAXUDP_BIT		 7
 #define REQUEST_NSID_BIT                 8
-#define REQUEST_SIT_BIT                  9
+#define SEND_COOKIE_BIT                  9
 #define NOTIFY_DSCP_BIT                 10
 #define TRANSFER_DSCP_BIT               11
 #define QUERY_DSCP_BIT                 	12
@@ -455,26 +455,26 @@ dns_peer_getrequestnsid(dns_peer_t *peer, isc_boolean_t *retval) {
 }

 isc_result_t
-dns_peer_setrequestsit(dns_peer_t *peer, isc_boolean_t newval) {
+dns_peer_setsendcookie(dns_peer_t *peer, isc_boolean_t newval) {
 	isc_boolean_t existed;

 	REQUIRE(DNS_PEER_VALID(peer));

-	existed = DNS_BIT_CHECK(REQUEST_SIT_BIT, &peer->bitflags);
+	existed = DNS_BIT_CHECK(SEND_COOKIE_BIT, &peer->bitflags);

-	peer->request_sit = newval;
-	DNS_BIT_SET(REQUEST_SIT_BIT, &peer->bitflags);
+	peer->send_cookie = newval;
+	DNS_BIT_SET(SEND_COOKIE_BIT, &peer->bitflags);

 	return (existed ? ISC_R_EXISTS : ISC_R_SUCCESS);
 }

 isc_result_t
-dns_peer_getrequestsit(dns_peer_t *peer, isc_boolean_t *retval) {
+dns_peer_getsendcookie(dns_peer_t *peer, isc_boolean_t *retval) {
 	REQUIRE(DNS_PEER_VALID(peer));
 	REQUIRE(retval != NULL);

-	if (DNS_BIT_CHECK(REQUEST_SIT_BIT, &peer->bitflags)) {
-		*retval = peer->request_sit;
+	if (DNS_BIT_CHECK(SEND_COOKIE_BIT, &peer->bitflags)) {
+		*retval = peer->send_cookie;
 		return (ISC_R_SUCCESS);
 	} else
 		return (ISC_R_NOTFOUND);
@@ -68,6 +68,7 @@
 #define ERCODENAMES \
 	/* extended rcodes */ \
 	{ dns_rcode_badvers, "BADVERS", 0}, \
+	{ dns_rcode_badcookie, "BADCOOKIE", 0}, \
 	{ 0, NULL, 0 }

 #define TSIGRCODENAMES \
@@ -128,7 +128,7 @@ fromwire_opt(ARGS_FROMWIRE) {
 			isc_uint8_t addrbytes;

 			if (length < 4)
-				return (DNS_R_FORMERR);
+				return (DNS_R_OPTERR);
 			family = uint16_fromregion(&sregion);
 			isc_region_consume(&sregion, 2);
 			addrlen = uint8_fromregion(&sregion);
@@ -138,16 +138,18 @@ fromwire_opt(ARGS_FROMWIRE) {
 			switch (family) {
 			case 1:
 				if (addrlen > 32U || scope > 32U)
-					return (DNS_R_FORMERR);
+					return (DNS_R_OPTERR);
 				break;
 			case 2:
 				if (addrlen > 128U || scope > 128U)
-					return (DNS_R_FORMERR);
+					return (DNS_R_OPTERR);
 				break;
+			default:
+				return (DNS_R_OPTERR);
 			}
 			addrbytes = (addrlen + 7) / 8;
 			if (addrbytes + 4 != length)
-				return (DNS_R_FORMERR);
+				return (DNS_R_OPTERR);
 			isc_region_consume(&sregion, addrbytes);
 			break;
 		}
@@ -156,6 +158,11 @@ fromwire_opt(ARGS_FROMWIRE) {
 			 * Request has zero length.  Response is 32 bits.
 			 */
 			if (length != 0 && length != 4)
+				return (DNS_R_OPTERR);
+			isc_region_consume(&sregion, length);
+			break;
+		case DNS_OPT_COOKIE:
+			if (length != 8 && (length < 16 || length > 40))
 				return (DNS_R_FORMERR);
 			isc_region_consume(&sregion, length);
 			break;
@@ -32,7 +32,7 @@
 #include <isc/timer.h>
 #include <isc/util.h>

-#ifdef AES_SIT
+#ifdef AES_CC
 #include <isc/aes.h>
 #else
 #include <isc/hmacsha.h>
@@ -488,11 +488,12 @@ struct dns_resolver {
 * Private addrinfo flags.  These must not conflict with DNS_FETCHOPT_NOEDNS0
 * (0x008) which we also use as an addrinfo flag.
 */
-#define FCTX_ADDRINFO_MARK              0x0001
-#define FCTX_ADDRINFO_FORWARDER         0x1000
-#define FCTX_ADDRINFO_TRIED             0x2000
-#define FCTX_ADDRINFO_EDNSOK            0x4000
-#define FCTX_ADDRINFO_NOSIT             0x8000
+#define FCTX_ADDRINFO_MARK              0x00001
+#define FCTX_ADDRINFO_FORWARDER         0x01000
+#define FCTX_ADDRINFO_TRIED             0x02000
+#define FCTX_ADDRINFO_EDNSOK            0x04000
+#define FCTX_ADDRINFO_NOCOOKIE          0x08000
+#define FCTX_ADDRINFO_BADCOOKIE         0x10000

 #define UNMARKED(a)                     (((a)->flags & FCTX_ADDRINFO_MARK) \
 					 == 0)
@@ -500,10 +501,12 @@ struct dns_resolver {
 					 FCTX_ADDRINFO_FORWARDER) != 0)
 #define TRIED(a)                        (((a)->flags & \
 					 FCTX_ADDRINFO_TRIED) != 0)
-#define NOSIT(a)                        (((a)->flags & \
-					 FCTX_ADDRINFO_NOSIT) != 0)
+#define NOCOOKIE(a)                        (((a)->flags & \
+					 FCTX_ADDRINFO_NOCOOKIE) != 0)
 #define EDNSOK(a)                       (((a)->flags & \
 					 FCTX_ADDRINFO_EDNSOK) != 0)
+#define BADCOOKIE(a)                    (((a)->flags & \
+					 FCTX_ADDRINFO_BADCOOKIE) != 0)


 #define NXDOMAIN(r) (((r)->attributes & DNS_RDATASETATTR_NXDOMAIN) != 0)
@@ -1798,10 +1801,9 @@ add_triededns512(fetchctx_t *fctx, isc_sockaddr_t *address) {
 	ISC_LIST_INITANDAPPEND(fctx->edns512, tried, link);
 }

-#ifdef ISC_PLATFORM_USESIT
 static void
-compute_cc(resquery_t *query, unsigned char *sit, size_t len) {
-#ifdef AES_SIT
+compute_cc(resquery_t *query, unsigned char *cookie, size_t len) {
+#ifdef AES_CC
 	unsigned char digest[ISC_AES_BLOCK_LENGTH];
 	unsigned char input[16];
 	isc_netaddr_t netaddr;
@@ -1822,9 +1824,9 @@ compute_cc(resquery_t *query, unsigned char *sit, size_t len) {
 	isc_aes128_crypt(query->fctx->res->view->secret, input, digest);
 	for (i = 0; i < 8; i++)
 		digest[i] ^= digest[i + 8];
-	memmove(sit, digest, 8);
+	memmove(cookie, digest, 8);
 #endif
-#ifdef HMAC_SHA1_SIT
+#ifdef HMAC_SHA1_CC
 	unsigned char digest[ISC_SHA1_DIGESTLENGTH];
 	isc_netaddr_t netaddr;
 	isc_hmacsha1_t hmacsha1;
@@ -1845,10 +1847,10 @@ compute_cc(resquery_t *query, unsigned char *sit, size_t len) {
 		break;
 	}
 	isc_hmacsha1_sign(&hmacsha1, digest, sizeof(digest));
-	memmove(sit, digest, 8);
+	memmove(cookie, digest, 8);
 	isc_hmacsha1_invalidate(&hmacsha1);
 #endif
-#ifdef HMAC_SHA256_SIT
+#ifdef HMAC_SHA256_CC
 	unsigned char digest[ISC_SHA256_DIGESTLENGTH];
 	isc_netaddr_t netaddr;
 	isc_hmacsha256_t hmacsha256;
@@ -1869,11 +1871,10 @@ compute_cc(resquery_t *query, unsigned char *sit, size_t len) {
 		break;
 	}
 	isc_hmacsha256_sign(&hmacsha256, digest, sizeof(digest));
-	memmove(sit, digest, 8);
+	memmove(cookie, digest, 8);
 	isc_hmacsha256_invalidate(&hmacsha256);
 #endif
 }
-#endif

 static isc_result_t
 issecuredomain(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type,
@@ -2119,10 +2120,8 @@ resquery_send(resquery_t *query) {
 			unsigned int version = DNS_EDNS_VERSION;
 			unsigned int flags = query->addrinfo->flags;
 			isc_boolean_t reqnsid = res->view->requestnsid;
-#ifdef ISC_PLATFORM_USESIT
-			isc_boolean_t reqsit = res->view->requestsit;
-			unsigned char sit[64];
-#endif
+			isc_boolean_t sendcookie = res->view->sendcookie;
+			unsigned char cookie[64];

 			if ((flags & FCTX_ADDRINFO_EDNSOK) != 0 &&
 			    (query->options & DNS_FETCHOPT_EDNS512) == 0) {
@@ -2163,23 +2162,20 @@ resquery_send(resquery_t *query) {
 				version >>= DNS_FETCHOPT_EDNSVERSIONSHIFT;
 			}

-			/* Request NSID/SIT/VERSION for current peer? */
+			/* Request NSID/COOKIE/VERSION for current peer? */
 			if (peer != NULL) {
 				isc_uint8_t ednsversion;
 				(void) dns_peer_getrequestnsid(peer, &reqnsid);
-#ifdef ISC_PLATFORM_USESIT
-				(void) dns_peer_getrequestsit(peer, &reqsit);
-#endif
+				(void) dns_peer_getsendcookie(peer,
+							      &sendcookie);
 				result = dns_peer_getednsversion(peer,
 								 &ednsversion);
 				if (result == ISC_R_SUCCESS &&
 				    ednsversion < version)
 					version = ednsversion;
 			}
-#ifdef ISC_PLATFORM_USESIT
-			if (NOSIT(query->addrinfo))
-				reqsit = ISC_FALSE;
-#endif
+			if (NOCOOKIE(query->addrinfo))
+				sendcookie = ISC_FALSE;
 			if (reqnsid) {
 				INSIST(ednsopt < DNS_EDNSOPTIONS);
 				ednsopts[ednsopt].code = DNS_OPT_NSID;
@@ -2187,37 +2183,36 @@ resquery_send(resquery_t *query) {
 				ednsopts[ednsopt].value = NULL;
 				ednsopt++;
 			}
-#ifdef ISC_PLATFORM_USESIT
 #if DNS_EDNS_VERSION > 0
 			/*
 			 * Some EDNS(0) servers don't ignore unknown options
 			 * as it was not a explict requirement of RFC 2671.
-			 * Only send SIT to EDNS(1) servers.
+			 * Only send COOKIE to EDNS(1) servers.
 			 */
 			if (version < 1)
-				reqsit = ISC_FALSE;
+				sendcookie = ISC_FALSE;
 #endif
-			if (reqsit) {
+			if (sendcookie) {
 				INSIST(ednsopt < DNS_EDNSOPTIONS);
-				ednsopts[ednsopt].code = DNS_OPT_SIT;
+				ednsopts[ednsopt].code = DNS_OPT_COOKIE;
 				ednsopts[ednsopt].length = (isc_uint16_t)
-					dns_adb_getsit(fctx->adb,
-						       query->addrinfo,
-						       sit, sizeof(sit));
+					dns_adb_getcookie(fctx->adb,
+							  query->addrinfo,
+							  cookie,
+							  sizeof(cookie));
 				if (ednsopts[ednsopt].length != 0) {
-					ednsopts[ednsopt].value = sit;
+					ednsopts[ednsopt].value = cookie;
 					inc_stats(fctx->res,
-						  dns_resstatscounter_sitout);
+						dns_resstatscounter_cookieout);
 				} else {
-					compute_cc(query, sit, sizeof(sit));
-					ednsopts[ednsopt].value = sit;
+					compute_cc(query, cookie, 8);
+					ednsopts[ednsopt].value = cookie;
 					ednsopts[ednsopt].length = 8;
 					inc_stats(fctx->res,
-						  dns_resstatscounter_sitcc);
+						dns_resstatscounter_cookienew);
 				}
 				ednsopt++;
 			}
-#endif
 			query->ednsversion = version;
 			result = fctx_addopt(fctx->qmessage, version,
 					     udpsize, ednsopts, ednsopt);
@@ -7282,11 +7277,9 @@ process_opt(resquery_t *query, dns_rdataset_t *opt) {
 	isc_result_t result;
 	isc_uint16_t optcode;
 	isc_uint16_t optlen;
-#ifdef ISC_PLATFORM_USESIT
-	unsigned char *sit;
+	unsigned char *optvalue;
 	dns_adbaddrinfo_t *addrinfo;
 	unsigned char cookie[8];
-#endif

 	result = dns_rdataset_first(opt);
 	if (result == ISC_R_SUCCESS) {
@@ -7306,27 +7299,26 @@ process_opt(resquery_t *query, dns_rdataset_t *opt) {
 						 query->fctx->res->mctx);
 				isc_buffer_forward(&optbuf, optlen);
 				break;
-#ifdef ISC_PLATFORM_USESIT
-			case DNS_OPT_SIT:
-				sit = isc_buffer_current(&optbuf);
+			case DNS_OPT_COOKIE:
+				optvalue = isc_buffer_current(&optbuf);
 				compute_cc(query, cookie, sizeof(cookie));
-				INSIST(query->fctx->rmessage->sitbad == 0 &&
-				       query->fctx->rmessage->sitok == 0);
+				INSIST(query->fctx->rmessage->cc_bad == 0 &&
+				       query->fctx->rmessage->cc_ok == 0);
 				if (optlen >= 8U &&
-				    memcmp(cookie, sit, 8) == 0) {
-					query->fctx->rmessage->sitok = 1;
+				    memcmp(cookie, optvalue, 8) == 0) {
+					query->fctx->rmessage->cc_ok = 1;
 					inc_stats(query->fctx->res,
-						  dns_resstatscounter_sitok);
+						  dns_resstatscounter_cookieok);
 					addrinfo = query->addrinfo;
-					dns_adb_setsit(query->fctx->adb,
-						       addrinfo, sit, optlen);
+					dns_adb_setcookie(query->fctx->adb,
+						          addrinfo, optvalue,
+							  optlen);
 				} else
-					query->fctx->rmessage->sitbad = 1;
+					query->fctx->rmessage->cc_bad = 1;
 				isc_buffer_forward(&optbuf, optlen);
 				inc_stats(query->fctx->res,
-					  dns_resstatscounter_sitin);
+					  dns_resstatscounter_cookiein);
 				break;
-#endif
 			default:
 				isc_buffer_forward(&optbuf, optlen);
 				break;
@@ -7551,17 +7543,15 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 		process_opt(query, opt);

 #ifdef notyet
-#ifdef ISC_PLATFORM_USESIT
-	if (message->sitbad) {
+	if (message->cc_bad) {
 		/*
-		 * If the SIT is bad assume it is a attack and retry.
+		 * If the COOKIE is bad assume it is a attack and retry.
 		 */
 		resend = ISC_TRUE;
 		/* XXXMPA log it */
-		FCTXTRACE("bad sit");
+		FCTXTRACE("bad cookie");
 		goto done;
 	}
-#endif
 #endif

 	/*
@@ -7700,6 +7690,9 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 		case dns_rcode_badvers:
 			inc_stats(fctx->res, dns_resstatscounter_badvers);
 			break;
+		case dns_rcode_badcookie:
+			inc_stats(fctx->res, dns_resstatscounter_badcookie);
+			break;
 		default:
 			inc_stats(fctx->res, dns_resstatscounter_othererror);
 			break;
@@ -7713,29 +7706,26 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	    message->rcode != dns_rcode_nxdomain) {
 		isc_buffer_t b;
 		char code[64];
-#ifdef ISC_PLATFORM_USESIT
-		unsigned char sit[64];
+		unsigned char cookie[64];

 		/*
 		 * Some servers do not ignore unknown EDNS options.
 		 */
-		if (!NOSIT(query->addrinfo) &&
+		if (!NOCOOKIE(query->addrinfo) &&
 		    (message->rcode == dns_rcode_formerr ||
 		     message->rcode == dns_rcode_notimp ||
 		     message->rcode == dns_rcode_refused) &&
-		     dns_adb_getsit(fctx->adb, query->addrinfo,
-				   sit, sizeof(sit)) == 0U) {
+		     dns_adb_getcookie(fctx->adb, query->addrinfo,
+				       cookie, sizeof(cookie)) == 0U) {
 			dns_adb_changeflags(fctx->adb, query->addrinfo,
-					    FCTX_ADDRINFO_NOSIT,
-					    FCTX_ADDRINFO_NOSIT);
+					    FCTX_ADDRINFO_NOCOOKIE,
+					    FCTX_ADDRINFO_NOCOOKIE);
 			resend = ISC_TRUE;
-		} else
-#endif
-		if (((message->rcode == dns_rcode_formerr ||
-		      message->rcode == dns_rcode_notimp) ||
-		     (message->rcode == dns_rcode_servfail &&
-		      dns_message_getopt(message) == NULL)) &&
-		    (query->options & DNS_FETCHOPT_NOEDNS0) == 0) {
+		} else if ((message->rcode == dns_rcode_formerr ||
+		            message->rcode == dns_rcode_notimp ||
+		            (message->rcode == dns_rcode_servfail &&
+		             dns_message_getopt(message) == NULL)) &&
+		           (query->options & DNS_FETCHOPT_NOEDNS0) == 0) {
 			/*
 			 * It's very likely they don't like EDNS0.
 			 * If the response code is SERVFAIL, also check if the
@@ -7784,21 +7774,20 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 		} else if (message->rcode == dns_rcode_badvers) {
 			unsigned int flags, mask;
 			unsigned int version;
-#if defined(ISC_PLATFORM_USESIT) && DNS_EDNS_VERSION == 0
+
 			/*
 			 * Some servers return BADVERS to unknown
 			 * EDNS options.  This cannot be long term
-			 * strategy.  Do not disable SIT if we have
-			 * already have received a SIT from this
+			 * strategy.  Do not disable COOKIE if we have
+			 * already have received a COOKIE from this
 			 * server.
 			 */
-			if (dns_adb_getsit(fctx->adb, query->addrinfo,
-					   sit, sizeof(sit)) == 0U) {
+			if (dns_adb_getcookie(fctx->adb, query->addrinfo,
+					      cookie, sizeof(cookie)) == 0U) {
 				dns_adb_changeflags(fctx->adb, query->addrinfo,
-						    FCTX_ADDRINFO_NOSIT,
-						    FCTX_ADDRINFO_NOSIT);
+						    FCTX_ADDRINFO_NOCOOKIE,
+						    FCTX_ADDRINFO_NOCOOKIE);
 			}
-#endif

 			resend = ISC_TRUE;
 			INSIST(opt != NULL);
@@ -7824,7 +7813,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 			 * RFC 6891 is clear that that they should be ignored.
 			 * If we are supporting EDNS > 0 then perform strict
 			 * version checking of badvers responses.  We won't
-			 * be sending SIT etc. in that case.
+			 * be sending COOKIE etc. in that case.
 			 */
 #if DNS_EDNS_VERSION == 0
 			 /* Avoids a compiler warning with < 0 */
@@ -7839,6 +7828,15 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 				broken_server = DNS_R_BADVERS;
 				keep_trying = ISC_TRUE;
 			}
+		} else if (message->rcode == dns_rcode_badcookie &&
+			   message->cc_ok) {
+			/*
+			 * We have recorded the new cookie.
+			 */
+			if (BADCOOKIE(query->addrinfo))
+				query->options |= DNS_FETCHOPT_TCP;
+			query->addrinfo->flags |= FCTX_ADDRINFO_BADCOOKIE;
+			resend = ISC_TRUE;
 		} else {
 			/*
 			 * XXXRTH log.
@@ -162,9 +162,10 @@ static const char *text[DNS_R_NRESULTS] = {
 	"not dynamic",			       /*%< 108 DNS_R_NOTDYNAMIC */
 	"bad EUI",			       /*%< 109 DNS_R_BADEUI */

-	"covered by negative trust anchor",     /*%< 110 DNS_R_NTACOVERED */
+	"covered by negative trust anchor",    /*%< 110 DNS_R_NTACOVERED */
 	"bad CDS",			       /*%< 111 DNS_R_BADCSD */
-	"bad CDNSKEY"			       /*%< 112 DNS_R_BADCDNSKEY */
+	"bad CDNSKEY",			       /*%< 112 DNS_R_BADCDNSKEY */
+	"malformed OPT option"		       /*%< 113 DNS_R_OPTERR */
 };

 static const char *ids[DNS_R_NRESULTS] = {
@@ -389,6 +390,7 @@ dns_result_torcode(isc_result_t result) {
 		 */
 		return ((dns_rcode_t)((result) & 0xFFF));
 	}
+
 	/*
 	 * Try to supply an appropriate rcode.
 	 */
@@ -418,6 +420,7 @@ dns_result_torcode(isc_result_t result) {
 	case DNS_R_TSIGERRORSET:
 	case DNS_R_UNKNOWN:
 	case DNS_R_NAMETOOLONG:
+	case DNS_R_OPTERR:
 		rcode = dns_rcode_formerr;
 		break;
 	case DNS_R_DISALLOWED:
@@ -96,7 +96,7 @@ ATF_TC_BODY(edns_client_subnet, tc) {
 			  0x00, 0x08, 0x00, 0x04,
 			  0x00, 0x00, 0x00, 0x00
 			},
-			8, ISC_TRUE
+			8, ISC_FALSE
 		},
 		{
 			/* Option code family 1 (ipv4), source 0, scope 0 */
@@ -221,7 +221,7 @@ dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass,
 	view->flush = ISC_FALSE;
 	view->dlv = NULL;
 	view->maxudp = 0;
-	view->situdp = 0;
+	view->nocookieudp = 0;
 	view->maxbits = 0;
 	view->v4_aaaa = dns_aaaa_ok;
 	view->v6_aaaa = dns_aaaa_ok;
@@ -233,7 +233,7 @@ dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass,
 	view->redirectzone = NULL;
 	dns_fixedname_init(&view->redirectfixed);
 	view->requestnsid = ISC_FALSE;
-	view->requestsit = ISC_TRUE;
+	view->sendcookie = ISC_TRUE;
 	view->new_zone_file = NULL;
 	view->new_zone_config = NULL;
 	view->cfg_destroy = NULL;
@@ -52,16 +52,16 @@ dns_adb_flush
 dns_adb_flushname
 dns_adb_flushnames
 dns_adb_freeaddrinfo
+dns_adb_getcookie
 dns_adb_getudpsize
-dns_adb_getsit
 dns_adb_marklame
 dns_adb_noedns
 dns_adb_plainresponse
 dns_adb_probesize
 dns_adb_probesize2
 dns_adb_setadbsize
+dns_adb_setcookie
 dns_adb_setudpsize
-dns_adb_setsit
 dns_adb_shutdown
 dns_adb_timeout
 dns_adb_whenshutdown
@@ -452,10 +452,10 @@ dns_message_gettemprdataset
 dns_message_gettimeadjust
 dns_message_gettsig
 dns_message_gettsigkey
-dns_message_logpacket
-dns_message_logpacket2
 dns_message_logfmtpacket
 dns_message_logfmtpacket2
+dns_message_logpacket
+dns_message_logpacket2
 dns_message_movename
 dns_message_nextname
 dns_message_parse
@@ -566,8 +566,8 @@ dns_nsec_build
 dns_nsec_buildrdata
 dns_nsec_compressbitmap
 dns_nsec_isset
-dns_nsec_nseconly
 dns_nsec_noexistnodata
+dns_nsec_nseconly
 dns_nsec_setbit
 dns_nsec_typepresent
 dns_ntatable_add
@@ -603,7 +603,7 @@ dns_peer_getquerysource
 dns_peer_getrequestexpire
 dns_peer_getrequestixfr
 dns_peer_getrequestnsid
-dns_peer_getrequestsit
+dns_peer_getsendcookie
 dns_peer_getsupportedns
 dns_peer_gettransferdscp
 dns_peer_gettransferformat
@@ -626,7 +626,7 @@ dns_peer_setquerysource
 dns_peer_setrequestexpire
 dns_peer_setrequestixfr
 dns_peer_setrequestnsid
-dns_peer_setrequestsit
+dns_peer_setsendcookie
 dns_peer_setsupportedns
 dns_peer_settransferdscp
 dns_peer_settransferformat
@@ -662,9 +662,9 @@ dns_rbt_fullnamefromnode
 dns_rbt_hashsize
 dns_rbt_namefromnode
 dns_rbt_nodecount
-dns_rbt_printtext
 dns_rbt_printdot
 dns_rbt_printnodeinfo
+dns_rbt_printtext
 dns_rbt_root
 dns_rbt_serialize_align
 dns_rbt_serialize_tree
@@ -844,9 +844,9 @@ dns_resolver_reset_ds_digests
 dns_resolver_resetmustbesecure
 dns_resolver_setclientsperquery
 dns_resolver_setlamettl
-dns_resolver_setmustbesecure
 dns_resolver_setmaxdepth
 dns_resolver_setmaxqueries
+dns_resolver_setmustbesecure
 dns_resolver_setquerydscp4
 dns_resolver_setquerydscp6
 dns_resolver_settimeout
@@ -1151,8 +1151,8 @@ dns_zone_log
 dns_zone_logc
 dns_zone_maintenance
 dns_zone_markdirty
-dns_zone_mkey_hour
 dns_zone_mkey_day
+dns_zone_mkey_hour
 dns_zone_mkey_month
 dns_zone_name
 dns_zone_nameonly
@@ -335,11 +335,6 @@
@ISC_PLATFORM_NORETURN_PRE@
@ISC_PLATFORM_NORETURN_POST@

-/*
- * Defined if we are enabling SIT (Source Identity Token).
- */
-@ISC_PLATFORM_USESIT@
-
 /***
 ***	Windows dll support.
 ***/
@@ -321,7 +321,7 @@ pk11_initialize(isc_mem_t *mctx, const char *engine) {
 		result = PK11_R_NODIGESTSERVICE;
 		goto unlock;
 	}
-#if defined(ISC_PLATFORM_USESIT) && defined(AES_SIT)
+#if defined(AES_SIT)
 	if (aes_token == NULL) {
 		result = PK11_R_NOAESSERVICE;
 		goto unlock;
@@ -115,11 +115,6 @@
 */
@ISC_PLATFORM_NEEDSTRCASESTR@

-/*
- * Defined if we are enabling SIT (Source Identity Token).
- */
-@ISC_PLATFORM_USESIT@
-
 /*
 * Set up a macro for importing and exporting from the DLL
 */
@@ -884,6 +884,11 @@ static cfg_type_t cfg_type_bracketed_portlist = {
 	&cfg_rep_list, &cfg_type_portrange
 };

+static const char *cookiealg_enums[] = { "aes", "sha1", "sha256", NULL };
+static cfg_type_t cfg_type_cookiealg = {
+	"cookiealg", cfg_parse_enum, cfg_print_ustring, cfg_doc_enum,
+	&cfg_rep_string, &cookiealg_enums };
+
 /*%
 * Clauses that can be found within the top level of the named.conf
 * file only.
@@ -937,6 +942,8 @@ options_clauses[] = {
 	{ "avoid-v6-udp-ports", &cfg_type_bracketed_portlist, 0 },
 	{ "bindkeys-file", &cfg_type_qstring, 0 },
 	{ "blackhole", &cfg_type_bracketed_aml, 0 },
+	{ "cookie-secret", &cfg_type_sstring, 0 },
+	{ "cookie-algorithm", &cfg_type_cookiealg, 0 },
 	{ "coresize", &cfg_type_size, 0 },
 	{ "datasize", &cfg_type_size, 0 },
 	{ "session-keyfile", &cfg_type_qstringornone, 0 },
@@ -968,11 +975,7 @@ options_clauses[] = {
 	{ "listen-on", &cfg_type_listenon, CFG_CLAUSEFLAG_MULTI },
 	{ "listen-on-v6", &cfg_type_listenon, CFG_CLAUSEFLAG_MULTI },
 	{ "lock-file", &cfg_type_qstringornone, 0 },
-#ifdef ISC_PLATFORM_USESIT
-	{ "sit-secret", &cfg_type_sstring, 0 },
-#else
-	{ "sit-secret", &cfg_type_sstring, CFG_CLAUSEFLAG_NOTCONFIGURED },
-#endif
+	{ "sit-secret", &cfg_type_sstring, CFG_CLAUSEFLAG_OBSOLETE },
 	{ "managed-keys-directory", &cfg_type_qstring, 0 },
 	{ "match-mapped-addresses", &cfg_type_boolean, 0 },
 	{ "max-rsa-exponent-size", &cfg_type_uint32, 0 },
@@ -1513,11 +1516,8 @@ view_clauses[] = {
 	{ "fetch-glue", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
 	{ "ixfr-from-differences", &cfg_type_ixfrdifftype, 0 },
 	{ "lame-ttl", &cfg_type_ttlval, 0 },
-#ifdef ISC_PLATFORM_USESIT
-	{ "nosit-udp-size", &cfg_type_uint32, 0 },
-#else
-	{ "nosit-udp-size", &cfg_type_uint32, CFG_CLAUSEFLAG_NOTCONFIGURED },
-#endif
+	{ "nocookie-udp-size", &cfg_type_uint32, 0 },
+	{ "nosit-udp-size", &cfg_type_uint32, CFG_CLAUSEFLAG_OBSOLETE },
 	{ "max-acache-size", &cfg_type_sizenodefault, 0 },
 	{ "max-cache-size", &cfg_type_sizenodefault, 0 },
 	{ "max-cache-ttl", &cfg_type_uint32, 0 },
@@ -1545,16 +1545,13 @@ view_clauses[] = {
 	{ "queryport-pool-updateinterval", &cfg_type_uint32,
 	  CFG_CLAUSEFLAG_OBSOLETE },
 	{ "recursion", &cfg_type_boolean, 0 },
-#ifdef ISC_PLATFORM_USESIT
-	{ "request-sit", &cfg_type_boolean, 0 },
-#else
-	{ "request-sit", &cfg_type_boolean, CFG_CLAUSEFLAG_NOTCONFIGURED },
-#endif
+	{ "request-sit", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
 	{ "request-nsid", &cfg_type_boolean, 0 },
 	{ "resolver-query-timeout", &cfg_type_uint32, 0 },
 	{ "rfc2308-type1", &cfg_type_boolean, CFG_CLAUSEFLAG_NYI },
 	{ "root-delegation-only",  &cfg_type_optional_exclude, 0 },
 	{ "rrset-order", &cfg_type_rrsetorder, 0 },
+	{ "send-cookie", &cfg_type_boolean, 0 },
 	{ "servfail-ttl", &cfg_type_ttlval, 0 },
 	{ "sortlist", &cfg_type_bracketed_aml, 0 },
 	{ "suppress-initial-notify", &cfg_type_boolean, CFG_CLAUSEFLAG_NYI },
@@ -1827,11 +1824,8 @@ server_clauses[] = {
 	{ "request-expire", &cfg_type_boolean, 0 },
 	{ "request-ixfr", &cfg_type_boolean, 0 },
 	{ "request-nsid", &cfg_type_boolean, 0 },
-#ifdef ISC_PLATFORM_USESIT
-	{ "request-sit", &cfg_type_boolean, 0 },
-#else
-	{ "request-sit", &cfg_type_boolean, CFG_CLAUSEFLAG_NOTCONFIGURED },
-#endif
+	{ "request-sit", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
+	{ "send-cookie", &cfg_type_boolean, 0 },
 	{ "support-ixfr", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
 	{ "transfer-format", &cfg_type_transferformat, 0 },
 	{ "transfer-source", &cfg_type_sockaddr4wild, 0 },
@@ -988,6 +988,17 @@
 ./bin/tests/system/common/rndc.key		CONF-C	2011,2013
 ./bin/tests/system/common/root.hint		ZONE	2000,2001,2004,2007
 ./bin/tests/system/conf.sh.in			SH	2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015
+./bin/tests/system/cookie/.gitignore		X	2014
+./bin/tests/system/cookie/bad-sit-badhex.conf	CONF-C	2014
+./bin/tests/system/cookie/bad-sit-toolong.conf	CONF-C	2014
+./bin/tests/system/cookie/clean.sh		SH	2014
+./bin/tests/system/cookie/ns1/example.db	ZONE	2014
+./bin/tests/system/cookie/ns1/named.conf	CONF-C	2014
+./bin/tests/system/cookie/ns1/root.hint		ZONE	2014
+./bin/tests/system/cookie/ns2/named.conf	CONF-C	2014
+./bin/tests/system/cookie/ns2/root.db		ZONE	2014
+./bin/tests/system/cookie/prereq.sh.in		SH	2014
+./bin/tests/system/cookie/tests.sh		SH	2014,2015
 ./bin/tests/system/coverage/01-ksk-inactive/README	X	2013
 ./bin/tests/system/coverage/01-ksk-inactive/expect	X	2013
 ./bin/tests/system/coverage/02-zsk-inactive/README	X	2013
@@ -1894,17 +1905,6 @@
 ./bin/tests/system/sfcache/prereq.sh		SH	2014
 ./bin/tests/system/sfcache/setup.sh		SH	2014
 ./bin/tests/system/sfcache/tests.sh		SH	2014
-./bin/tests/system/sit/.gitignore		X	2014
-./bin/tests/system/sit/bad-sit-badhex.conf	CONF-C	2014
-./bin/tests/system/sit/bad-sit-toolong.conf	CONF-C	2014
-./bin/tests/system/sit/clean.sh			SH	2014
-./bin/tests/system/sit/ns1/example.db		ZONE	2014
-./bin/tests/system/sit/ns1/named.conf		CONF-C	2014
-./bin/tests/system/sit/ns1/root.hint		ZONE	2014
-./bin/tests/system/sit/ns2/named.conf		CONF-C	2014
-./bin/tests/system/sit/ns2/root.db		ZONE	2014
-./bin/tests/system/sit/prereq.sh.in		SH	2014
-./bin/tests/system/sit/tests.sh			SH	2014,2015
 ./bin/tests/system/smartsign/child.db		ZONE	2010
 ./bin/tests/system/smartsign/clean.sh		SH	2010,2012,2014
 ./bin/tests/system/smartsign/parent.db		ZONE	2010