Increase the TCP timeout allowance to 3 second from 1

named now falls back to TCP if it doesn't get a DNS COOKIE response
when making recursive queries, TSIG queries excepted.  This can be
disabled by setting tcp-on-no-cookie to false.

CHANGES

@@ -1,3 +1,7 @@
+5658.	[func]		named now falls back to TCP if the remote server does
+			not support DNS COOKIE.  This can be overridden by the
+			server option tcp-on-no-cookie.  [GL #2766]
+
 5677.	[func]		Only accept FORMERR without a OPT record as an
 			indication that the server does net support EDNS.
 			This will break communication with servers that

bin/named/named.conf.rst

@@ -528,6 +528,7 @@ SERVER
   	request-nsid boolean;
   	send-cookie boolean;
   	tcp-keepalive boolean;
+  	tcp-on-no-cookie boolean;
   	tcp-only boolean;
   	transfer-format ( many-answers | one-answer );
   	transfer-source ( ipv4_address | * ) [ port ( integer | * ) ] [
@@ -836,6 +837,7 @@ VIEW
   		request-nsid boolean;
   		send-cookie boolean;
   		tcp-keepalive boolean;
+  		tcp-on-no-cookie boolean;
   		tcp-only boolean;
   		transfer-format ( many-answers | one-answer );
   		transfer-source ( ipv4_address | * ) [ port ( integer |

bin/named/server.c

@@ -1493,6 +1493,12 @@ configure_peer(const cfg_obj_t *cpeer, isc_mem_t *mctx, dns_peer_t **peerp) {
 		CHECK(dns_peer_setsendcookie(peer, cfg_obj_asboolean(obj)));
 	}
 
+	obj = NULL;
+	(void)cfg_map_get(cpeer, "tcp-on-no-cookie", &obj);
+	if (obj != NULL) {
+		CHECK(dns_peer_settcponnocookie(peer, cfg_obj_asboolean(obj)));
+	}
+
 	obj = NULL;
 	(void)cfg_map_get(cpeer, "edns", &obj);
 	if (obj != NULL) {

bin/tests/system/chain/ns7/named.conf.in

@@ -28,6 +28,14 @@ options {
 	};
 };
 
+server 10.53.0.3 {
+	tcp-on-no-cookie false;
+};
+
+server 10.53.0.4 {
+	tcp-on-no-cookie false;
+};
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm hmac-sha256;

bin/tests/system/chain/tests.sh

@@ -484,7 +484,7 @@ $DIG $DIGOPTS @10.53.0.7 test.domain.nil > dig.out.1.$n 2>&1
 sleep 1
 $DIG $DIGOPTS +noall +answer @10.53.0.7 cname1.domain.nil > dig.out.2.$n 2>&1
 ttl=`awk '{print $2}' dig.out.2.$n`
-[ "$ttl" -eq 86400 ] || ret=1
+[ "${ttl:-0}" -eq 86400 ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 

bin/tests/system/checkconf/clean.sh

@@ -15,3 +15,4 @@ rm -rf test.keydir
 rm -f checkconf.out*
 rm -f diff.out*
 rm -f ns*/named.lock
+rm -f good-server-christmas-tree.conf

bin/tests/system/checkconf/good-server-christmas-tree.conf.in

@@ -0,0 +1,50 @@
+key example {
+	algorithm hmac-sha256;
+	secret "aaaaaaaaaaaaaaaaaaaaaaaa";
+};
+
+server 0.0.0.0 {
+	bogus no;
+	edns no;
+	edns-udp-size 512;
+	edns-version 0;
+	keys example;
+	max-udp-size 512;
+	notify-source 0.0.0.0;
+	padding 512;
+	provide-ixfr no;
+	query-source 0.0.0.0;
+	request-expire no;
+	request-ixfr no;
+	request-nsid no;
+	send-cookie no;
+	tcp-keepalive no;
+	tcp-on-no-cookie no;
+	tcp-only no;
+	transfer-format one-answer;
+	transfer-source 0.0.0.0;
+	transfers 1;
+};
+
+server :: {
+	bogus no;
+	edns no;
+	edns-udp-size 512;
+	edns-version 0;
+	keys example;
+	max-udp-size 512;
+	notify-source-v6 ::;
+	padding 512;
+	provide-ixfr no;
+	query-source-v6 ::;
+	request-expire no;
+	request-ixfr no;
+	request-nsid no;
+	send-cookie no;
+	tcp-keepalive no;
+	tcp-on-no-cookie no;
+	tcp-only no;
+	transfer-format one-answer;
+	transfer-source-v6 ::;
+	transfers 1;
+};

bin/tests/system/checkconf/setup.sh

@@ -0,0 +1,10 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+cp -f good-server-christmas-tree.conf.in good-server-christmas-tree.conf

bin/tests/system/dnssec/ns4/named1.conf.in

@@ -37,6 +37,10 @@ options {
 	bindkeys-file "../../../../../bind.keys";
 };
 
+server 10.53.0.10 {
+	tcp-on-no-cookie false;
+};
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm hmac-sha256;

bin/tests/system/dnssec/ns4/named2.conf.in

@@ -31,6 +31,10 @@ key rndc_key {
 	algorithm hmac-sha256;
 };
 
+server 10.53.0.10 {
+	tcp-on-no-cookie false;
+};
+
 controls {
 	inet 10.53.0.4 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 };

bin/tests/system/dnssec/ns4/named3.conf.in

@@ -31,6 +31,10 @@ key rndc_key {
 	algorithm hmac-sha256;
 };
 
+server 10.53.0.10 {
+	tcp-on-no-cookie false;
+};
+
 controls {
 	inet 10.53.0.4 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 };

bin/tests/system/dnssec/ns4/named4.conf.in

@@ -21,6 +21,10 @@ options {
 	listen-on-v6 { none; };
 };
 
+server 10.53.0.10 {
+	tcp-on-no-cookie false;
+};
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm hmac-sha256;

bin/tests/system/dnssec/ns4/named5.conf.in

@@ -22,6 +22,10 @@ options {
 	bindkeys-file "managed.conf";
 };
 
+server 10.53.0.10 {
+	tcp-on-no-cookie false;
+};
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm hmac-sha256;

bin/tests/system/dnstap/ns3/named.conf.in

@@ -31,7 +31,18 @@ options {
 	qname-minimization disabled;
 };
 
-server 10.53.0.1 { tcp-only yes; };
+/*
+ * As we have send-cookie no; also disable tcp-on-no-cookie.
+ */
+server 0/0 {
+	tcp-on-no-cookie false;
+};
+
+server ::/0 {
+	tcp-on-no-cookie false;
+};
+
+server 10.53.0.1 { tcp-only yes; tcp-on-no-cookie false; };
 
 key rndc_key {
 	secret "1234abcd8765";

bin/tests/system/legacy/ns1/named1.conf.in

@@ -30,6 +30,14 @@ controls {
 	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 };
 
+server 10.53.0.5 {
+	tcp-on-no-cookie false;
+};
+
+server 10.53.0.7 {
+	tcp-on-no-cookie false;
+};
+
 zone "." {
 	type primary;
 	file "root.db";

bin/tests/system/legacy/ns1/named2.conf.in

@@ -21,6 +21,14 @@ options {
 	dnssec-validation yes;
 };
 
+server 10.53.0.5 {
+	tcp-on-no-cookie false;
+};
+
+server 10.53.0.7 {
+	tcp-on-no-cookie false;
+};
+
 zone "." {
 	type primary;
 	file "root.db";

bin/tests/system/qmin/ns1/named.conf.in

@@ -24,6 +24,18 @@ options {
 	dnssec-validation no;
 };
 
+server 10.53.0.2 {
+	tcp-on-no-cookie false;
+};
+
+server 10.53.0.3 {
+	tcp-on-no-cookie false;
+};
+
+server 10.53.0.4 {
+	tcp-on-no-cookie false;
+};
+
 zone "." {
 	type primary;
 	file "root.db";

bin/tests/system/qmin/ns5/named.conf.in

@@ -35,6 +35,30 @@ controls {
 	inet 10.53.0.5 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 };
 
+server 10.53.0.2 {
+	tcp-on-no-cookie false;
+};
+
+server 10.53.0.3 {
+	tcp-on-no-cookie false;
+};
+
+server 10.53.0.4 {
+	tcp-on-no-cookie false;
+};
+
+server fd92:7065:b8e:ffff::2 {
+	tcp-on-no-cookie false;
+};
+
+server fd92:7065:b8e:ffff::3 {
+	tcp-on-no-cookie false;
+};
+
+server fd92:7065:b8e:ffff::4 {
+	tcp-on-no-cookie false;
+};
+
 zone "." {
 	type hint;
 	file "../../common/root.hint";

bin/tests/system/qmin/ns6/named.conf.in

@@ -35,6 +35,30 @@ controls {
 	inet 10.53.0.6 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 };
 
+server 10.53.0.2 {
+	tcp-on-no-cookie false;
+};
+
+server 10.53.0.3 {
+	tcp-on-no-cookie false;
+};
+
+server 10.53.0.4 {
+	tcp-on-no-cookie false;
+};
+
+server fd92:7065:b8e:ffff::2 {
+	tcp-on-no-cookie false;
+};
+
+server fd92:7065:b8e:ffff::3 {
+	tcp-on-no-cookie false;
+};
+
+server fd92:7065:b8e:ffff::4 {
+	tcp-on-no-cookie false;
+};
+
 zone "." {
 	type hint;
 	file "../../common/root.hint";

bin/tests/system/qmin/ns7/named.conf.in

@@ -35,6 +35,30 @@ controls {
 	inet 10.53.0.7 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 };
 
+server 10.53.0.2 {
+	tcp-on-no-cookie false;
+};
+
+server 10.53.0.3 {
+	tcp-on-no-cookie false;
+};
+
+server 10.53.0.4 {
+	tcp-on-no-cookie false;
+};
+
+server fd92:7065:b8e:ffff::2 {
+	tcp-on-no-cookie false;
+};
+
+server fd92:7065:b8e:ffff::3 {
+	tcp-on-no-cookie false;
+};
+
+server fd92:7065:b8e:ffff::4 {
+	tcp-on-no-cookie false;
+};
+
 zone "." {
 	type hint;
 	file "../../common/root.hint";

bin/tests/system/reclimit/ns3/named1.conf.in

@@ -34,4 +34,16 @@ controls {
 	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 };
 
+server 10.53.0.2 {
+	tcp-on-no-cookie false;
+};
+
+server 10.53.0.4 {
+	tcp-on-no-cookie false;
+};
+
+server 10.53.0.7 {
+	tcp-on-no-cookie false;
+};
+
 zone "." { type hint; file "hints.db"; };

bin/tests/system/reclimit/ns3/named2.conf.in

@@ -34,4 +34,16 @@ controls {
 	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 };
 
+server 10.53.0.2 {
+	tcp-on-no-cookie false;
+};
+
+server 10.53.0.4 {
+	tcp-on-no-cookie false;
+};
+
+server 10.53.0.7 {
+	tcp-on-no-cookie false;
+};
+
 zone "." { type hint; file "hints.db"; };

bin/tests/system/reclimit/ns3/named3.conf.in

@@ -35,4 +35,16 @@ controls {
 	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 };
 
+server 10.53.0.2 {
+	tcp-on-no-cookie false;
+};
+
+server 10.53.0.4 {
+	tcp-on-no-cookie false;
+};
+
+server 10.53.0.7 {
+	tcp-on-no-cookie false;
+};
+
 zone "." { type hint; file "hints.db"; };

bin/tests/system/reclimit/ns3/named4.conf.in

@@ -35,4 +35,16 @@ controls {
 	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 };
 
+server 10.53.0.2 {
+	tcp-on-no-cookie false;
+};
+
+server 10.53.0.4 {
+	tcp-on-no-cookie false;
+};
+
+server 10.53.0.7 {
+	tcp-on-no-cookie false;
+};
+
 zone "." { type hint; file "hints.db"; };

bin/tests/system/resolver/ns5/named.conf.in

@@ -29,6 +29,10 @@ server 10.53.0.7 {
 	edns-version 0;
 };
 
+server 10.53.0.8 {
+	tcp-on-no-cookie false;
+};
+
 zone "." {
 	type hint;
 	file "root.hint";

bin/tests/system/serve-stale/ns1/named1.conf.in

@@ -35,6 +35,10 @@ options {
 	servfail-ttl 0;
 };
 
+server 10.53.0.2 {
+	tcp-on-no-cookie false;
+};
+
 zone "." {
 	type primary;
 	file "root.db";

bin/tests/system/serve-stale/ns1/named2.conf.in

@@ -34,6 +34,10 @@ options {
 	servfail-ttl 0;
 };
 
+server 10.53.0.2 {
+	tcp-on-no-cookie false;
+};
+
 zone "." {
 	type primary;
 	file "root.db";

bin/tests/system/serve-stale/ns1/named3.conf.in

@@ -35,6 +35,10 @@ options {
 	servfail-ttl 0;
 };
 
+server 10.53.0.2 {
+	tcp-on-no-cookie false;
+};
+
 zone "." {
 	type primary;
 	file "root.db";

bin/tests/system/serve-stale/ns3/named1.conf.in

@@ -31,6 +31,10 @@ options {
 	stale-cache-enable yes;
 };
 
+server 10.53.0.2 {
+	tcp-on-no-cookie false;
+};
+
 zone "." {
 	type secondary;
 	primaries { 10.53.0.1; };

bin/tests/system/serve-stale/ns3/named2.conf.in

@@ -42,6 +42,10 @@ options {
 	resolver-query-timeout 10;
 };
 
+server 10.53.0.2 {
+	tcp-on-no-cookie false;
+};
+
 zone "." {
 	type secondary;
 	primaries { 10.53.0.1; };

bin/tests/system/serve-stale/ns3/named3.conf.in

@@ -41,6 +41,10 @@ options {
 	resolver-query-timeout 10;
 };
 
+server 10.53.0.2 {
+	tcp-on-no-cookie false;
+};
+
 zone "." {
 	type hint;
 	file "root.db";

bin/tests/system/serve-stale/ns3/named4.conf.in

@@ -42,6 +42,10 @@ options {
 	max-stale-ttl 3600;
 };
 
+server 10.53.0.2 {
+	tcp-on-no-cookie false;
+};
+
 zone "." {
 	type hint;
 	file "root.db";

bin/tests/system/serve-stale/ns3/named5.conf.in

@@ -42,6 +42,10 @@ options {
 	max-stale-ttl 3600;
 };
 
+server 10.53.0.2 {
+	tcp-on-no-cookie false;
+};
+
 zone "." {
 	type hint;
 	file "root.db";

bin/tests/system/serve-stale/ns3/named6.conf.in

@@ -43,6 +43,10 @@ options {
 	max-stale-ttl 3600;
 };
 
+server 10.53.0.2 {
+	tcp-on-no-cookie false;
+};
+
 zone "." {
 	type hint;
 	file "root.db";

bin/tests/system/serve-stale/ns3/named7.conf.in

@@ -47,6 +47,10 @@ options {
 	max-stale-ttl 3600;
 };
 
+server 10.53.0.2 {
+	tcp-on-no-cookie false;
+};
+
 zone "." {
 	type secondary;
 	primaries { 10.53.0.1; };

bin/tests/system/serve-stale/ns3/named8.conf.in

@@ -37,6 +37,10 @@ options {
 	};
 };
 
+server 10.53.0.2 {
+	tcp-on-no-cookie false;
+};
+
 zone "." {
 	type secondary;
 	primaries { 10.53.0.1; };

bin/tests/system/serve-stale/ns4/named.conf.in

@@ -32,6 +32,10 @@ options {
 	stale-cache-enable yes;
 };
 
+server 10.53.0.2 {
+	tcp-on-no-cookie false;
+};
+
 zone "." {
 	type secondary;
 	primaries { 10.53.0.1; };

bin/tests/system/serve-stale/ns5/named.conf.in

@@ -33,6 +33,10 @@ options {
 	max-cache-ttl 24h;
 };
 
+server 10.53.0.2 {
+	tcp-on-no-cookie false;
+};
+
 zone "." {
 	type secondary;
 	primaries { 10.53.0.1; };

doc/arm/reference.rst

@@ -4636,6 +4636,10 @@ a COOKIE EDNS option to requests sent to the server. This overrides
 may determine that COOKIE is not supported by the remote server and not
 add a COOKIE EDNS option to requests.
 
+The ``tcp-on-no-cookie`` clause determines whether the local server
+falls back to TCP if it discovers that the remote server does not support
+the DNS COOKIE EDNS option. The default is ``yes``.
+
 .. _statschannels:
 
 ``statistics-channels`` Statement Grammar

doc/man/named.conf.5in

@@ -611,6 +611,7 @@ server netprefix {
       request\-nsid boolean;
       send\-cookie boolean;
       tcp\-keepalive boolean;
+      tcp\-on\-no\-cookie boolean;
       tcp\-only boolean;
       transfer\-format ( many\-answers | one\-answer );
       transfer\-source ( ipv4_address | * ) [ port ( integer | * ) ] [
@@ -939,6 +940,7 @@ view string [ class ] {
               request\-nsid boolean;
               send\-cookie boolean;
               tcp\-keepalive boolean;
+              tcp\-on\-no\-cookie boolean;
               tcp\-only boolean;
               transfer\-format ( many\-answers | one\-answer );
               transfer\-source ( ipv4_address | * ) [ port ( integer |

doc/misc/options

@@ -434,6 +434,7 @@ server <netprefix> {
         request-nsid <boolean>;
         send-cookie <boolean>;
         tcp-keepalive <boolean>;
+        tcp-on-no-cookie <boolean>;
         tcp-only <boolean>;
         transfer-format ( many-answers | one-answer );
         transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [
@@ -716,6 +717,7 @@ view <string> [ <class> ] {
                 request-nsid <boolean>;
                 send-cookie <boolean>;
                 tcp-keepalive <boolean>;
+                tcp-on-no-cookie <boolean>;
                 tcp-only <boolean>;
                 transfer-format ( many-answers | one-answer );
                 transfer-source ( <ipv4_address> | * ) [ port ( <integer> |

doc/misc/options.active

@@ -431,6 +431,7 @@ server <netprefix> {
         request-nsid <boolean>;
         send-cookie <boolean>;
         tcp-keepalive <boolean>;
+        tcp-on-no-cookie <boolean>;
         tcp-only <boolean>;
         transfer-format ( many-answers | one-answer );
         transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [
@@ -712,6 +713,7 @@ view <string> [ <class> ] {
                 request-nsid <boolean>;
                 send-cookie <boolean>;
                 tcp-keepalive <boolean>;
+                tcp-on-no-cookie <boolean>;
                 tcp-only <boolean>;
                 transfer-format ( many-answers | one-answer );
                 transfer-source ( <ipv4_address> | * ) [ port ( <integer> |

doc/misc/server.grammar.rst

@@ -24,6 +24,7 @@
   	request-nsid <boolean>;
   	send-cookie <boolean>;
   	tcp-keepalive <boolean>;
+  	tcp-on-no-cookie <boolean>;
   	tcp-only <boolean>;
   	transfer-format ( many-answers | one-answer );
   	transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [

doc/notes/notes-current.rst

@@ -32,6 +32,10 @@ New Features
   added to add a list of servers to a zone that can be used for checking DS
   presence. :gl:`#1126`
 
+- ``named`` now falls back to TCP if the remote server does not support DNS
+  COOKIE. This can be overridden by the ``server`` option ``tcp-on-no-cookie``.
+  :gl:`#2766`
+
 Removed Features
 ~~~~~~~~~~~~~~~~
 

lib/bind9/check.c

@@ -47,6 +47,7 @@
 #include <dns/fixedname.h>
 #include <dns/kasp.h>
 #include <dns/keyvalues.h>
+#include <dns/peer.h>
 #include <dns/rbt.h>
 #include <dns/rdataclass.h>
 #include <dns/rdatatype.h>
@@ -3640,6 +3641,21 @@ static struct {
 		{ "parental-source", "parental-source-v6" },
 		{ "query-source", "query-source-v6" },
 		{ NULL, NULL } };
+static struct {
+	const char *name;
+	isc_result_t (*set)(dns_peer_t *peer, bool newval);
+} bools[] = {
+	{ "bogus", dns_peer_setbogus },
+	{ "edns", dns_peer_setsupportedns },
+	{ "provide-ixfr", dns_peer_setprovideixfr },
+	{ "request-expire", dns_peer_setrequestexpire },
+	{ "request-ixfr", dns_peer_setrequestixfr },
+	{ "request-nsid", dns_peer_setrequestnsid },
+	{ "send-cookie", dns_peer_setsendcookie },
+	{ "tcp-keepalive", dns_peer_settcpkeepalive },
+	{ "tcp-on-no-cookie", dns_peer_settcponnocookie },
+	{ "tcp-only", dns_peer_setforcetcp },
+};
 
 /*
  * RNDC keys are not normalised unlike TSIG keys.
@@ -3670,7 +3686,7 @@ rndckey_exists(const cfg_obj_t *keylist, const char *keyname) {
 
 static isc_result_t
 check_servers(const cfg_obj_t *config, const cfg_obj_t *voptions,
-	      isc_symtab_t *symtab, isc_log_t *logctx) {
+	      isc_symtab_t *symtab, isc_mem_t *mctx, isc_log_t *logctx) {
 	dns_fixedname_t fname;
 	isc_result_t result = ISC_R_SUCCESS;
 	isc_result_t tresult;
@@ -3700,6 +3716,8 @@ check_servers(const cfg_obj_t *config, const cfg_obj_t *voptions,
 	}
 
 	for (e1 = cfg_list_first(servers); e1 != NULL; e1 = cfg_list_next(e1)) {
+		dns_peer_t *peer = NULL;
+		size_t i;
 		v1 = cfg_listelt_value(e1);
 		cfg_obj_asnetprefix(cfg_map_getname(v1), &n1, &p1);
 		/*
@@ -3778,6 +3796,24 @@ check_servers(const cfg_obj_t *config, const cfg_obj_t *voptions,
 				result = ISC_R_FAILURE;
 			}
 		}
+		(void)dns_peer_newprefix(mctx, &n1, p1, &peer);
+		for (i = 0; i < ARRAY_SIZE(bools); i++) {
+			const cfg_obj_t *opt = NULL;
+			cfg_map_get(v1, bools[i].name, &opt);
+			if (opt != NULL) {
+				tresult = (bools[i].set)(
+					peer, cfg_obj_asboolean(opt));
+				if (tresult != ISC_R_SUCCESS) {
+					cfg_obj_log(opt, logctx, ISC_LOG_ERROR,
+						    "setting server option "
+						    "'%s' failed: %s",
+						    bools[i].name,
+						    isc_result_totext(tresult));
+					result = ISC_R_FAILURE;
+				}
+			}
+		}
+		dns_peer_detach(&peer);
 	}
 	return (result);
 }
@@ -4680,7 +4716,8 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
 	/*
 	 * Global servers can refer to keys in views.
 	 */
-	if (check_servers(config, voptions, symtab, logctx) != ISC_R_SUCCESS) {
+	if (check_servers(config, voptions, symtab, mctx, logctx) !=
+	    ISC_R_SUCCESS) {
 		result = ISC_R_FAILURE;
 	}
 

lib/dns/include/dns/peer.h

@@ -138,6 +138,12 @@ dns_peer_gettcpkeepalive(dns_peer_t *peer, bool *retval);
 isc_result_t
 dns_peer_settcpkeepalive(dns_peer_t *peer, bool newval);
 
+isc_result_t
+dns_peer_gettcponnocookie(dns_peer_t *peer, bool *retval);
+
+isc_result_t
+dns_peer_settcponnocookie(dns_peer_t *peer, bool newval);
+
 isc_result_t
 dns_peer_getsupportedns(dns_peer_t *peer, bool *retval);
 

lib/dns/peer.c

@@ -57,7 +57,7 @@ struct dns_peer {
 	bool request_expire;
 	bool force_tcp;
 	bool tcp_keepalive;
-	bool check_axfr_id;
+	bool tcp_on_no_cookie;
 	dns_name_t *key;
 	isc_sockaddr_t *transfer_source;
 	isc_dscp_t transfer_dscp;
@@ -96,6 +96,7 @@ struct dns_peer {
 #define FORCE_TCP_BIT		   15
 #define SERVER_PADDING_BIT	   16
 #define REQUEST_TCP_KEEPALIVE_BIT  17
+#define TCP_ON_NO_COOKIE_BIT	   18
 
 static void
 peerlist_delete(dns_peerlist_t **list);
@@ -965,3 +966,30 @@ dns_peer_getednsversion(dns_peer_t *peer, uint8_t *ednsversion) {
 		return (ISC_R_NOTFOUND);
 	}
 }
+
+isc_result_t
+dns_peer_settcponnocookie(dns_peer_t *peer, bool newval) {
+	bool existed;
+
+	REQUIRE(DNS_PEER_VALID(peer));
+
+	existed = DNS_BIT_CHECK(TCP_ON_NO_COOKIE_BIT, &peer->bitflags);
+
+	peer->tcp_on_no_cookie = newval;
+	DNS_BIT_SET(TCP_ON_NO_COOKIE_BIT, &peer->bitflags);
+
+	return (existed ? ISC_R_EXISTS : ISC_R_SUCCESS);
+}
+
+isc_result_t
+dns_peer_gettcponnocookie(dns_peer_t *peer, bool *retval) {
+	REQUIRE(DNS_PEER_VALID(peer));
+	REQUIRE(retval != NULL);
+
+	if (DNS_BIT_CHECK(TCP_ON_NO_COOKIE_BIT, &peer->bitflags)) {
+		*retval = peer->tcp_on_no_cookie;
+		return (ISC_R_SUCCESS);
+	} else {
+		return (ISC_R_NOTFOUND);
+	}
+}

lib/dns/resolver.c

@@ -2035,12 +2035,12 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
 	srtt = addrinfo->srtt;
 
 	/*
-	 * Allow an additional second for the kernel to resend the SYN (or
-	 * SYN without ECN in the case of stupid firewalls blocking ECN
+	 * Allow an additional 3 seconds for the kernel to resend the SYN
+	 * (or SYN without ECN in the case of stupid firewalls blocking ECN
 	 * negotiation) over the current RTT estimate.
 	 */
 	if ((options & DNS_FETCHOPT_TCP) != 0) {
-		srtt += 1000000;
+		srtt += 3000000;
 	}
 
 	/*
@@ -7845,7 +7845,8 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	 */
 
 	/*
-	 * If we have had a server cookie and don't get one retry over TCP.
+	 * If we have had a server cookie and don't get one retry over TCP
+	 * or didn't get a DNS COOKIE response conditionally retry over TCP.
 	 * This may be a misconfigured anycast server or an attempt to send
 	 * a spoofed response.  Skip if we have a valid tsig.
 	 */
@@ -7871,11 +7872,26 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 			rctx.resend = true;
 			rctx_done(&rctx, result);
 			return;
+		} else if (fctx->res->view->peers != NULL) {
+			dns_peer_t *peer = NULL;
+			isc_netaddr_t ipaddr;
+			bool tcp_on_nocookie = true;
+
+			isc_netaddr_fromsockaddr(&ipaddr,
+						 &query->addrinfo->sockaddr);
+			dns_peerlist_peerbyaddr(fctx->res->view->peers, &ipaddr,
+						&peer);
+			if (peer != NULL) {
+				dns_peer_gettcponnocookie(peer,
+							  &tcp_on_nocookie);
+			}
+			if (tcp_on_nocookie) {
+				rctx.retryopts |= DNS_FETCHOPT_TCP;
+				rctx.resend = true;
+				rctx_done(&rctx, result);
+				return;
+			}
 		}
-		/*
-		 * XXXMPA When support for DNS COOKIE becomes ubiquitous, fall
-		 * back to TCP for all non-COOKIE responses.
-		 */
 	}
 
 	rctx_edns(&rctx);

lib/isccfg/namedconf.c

@@ -2475,6 +2475,7 @@ static cfg_clausedef_t server_clauses[] = {
 	{ "support-ixfr", NULL, CFG_CLAUSEFLAG_ANCIENT },
 	{ "tcp-keepalive", &cfg_type_boolean, 0 },
 	{ "tcp-only", &cfg_type_boolean, 0 },
+	{ "tcp-on-no-cookie", &cfg_type_boolean, 0 },
 	{ "transfer-format", &cfg_type_transferformat, 0 },
 	{ "transfer-source", &cfg_type_sockaddr4wild, 0 },
 	{ "transfer-source-v6", &cfg_type_sockaddr6wild, 0 },

util/copyrights

@@ -187,6 +187,7 @@
 ./bin/tests/system/checkconf/dnssec.1		X	2011,2016,2018,2019,2020,2021
 ./bin/tests/system/checkconf/dnssec.2		X	2011,2016,2018,2019,2020,2021
 ./bin/tests/system/checkconf/good.zonelist	X	2016,2017,2018,2019,2020,2021
+./bin/tests/system/checkconf/setup.sh		SH	2021
 ./bin/tests/system/checkconf/tests.sh		SH	2005,2007,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
 ./bin/tests/system/checkds/README		TXT.BRIEF	2021
 ./bin/tests/system/checkds/clean.sh		SH	2021