22 Pro
2021
22 Pro
'21
13:07
Hi,
i have knot dns setup with dns cookie module enabled but if i check with
dnsviz.net i always get:
The server appears to support DNS cookies but did not return a COOKIE
option.
Relevant parts of my knot.conf:
template:
- id: default storage: "/var/lib/knot"
dnssec-signing: on
dnssec-policy: rsa2048
global-module: [ "mod-cookies", "mod-rrl/default" ]
mod-rrl:
- id: default
rate-limit: 200
slip: 2
- domain: mydomain.de
file: "/etc/knot/zones/mydomain.de.zone"
notify: secondary
acl: acl_secondary
zonefile-load: difference
I thought about maybe it's the slip: 2, but that didn't change anything
if set to 1
Do you guys see anything obvious causing this "issue"?
Thanks for your time
Juergen
22 Pro
22 Pro
13:25
Hi Juergen,
The warning usually appears if the configuration of all nameservers is inconsistent.
For example cookies are enabled on some nameservers only.
Daniel
On 12/22/21 1:07 PM, J. Echter wrote:
Hi,
i have knot dns setup with dns cookie module enabled but if i check with
dnsviz.net i always get:
The server appears to support DNS cookies but did not return a COOKIE
option.
Relevant parts of my knot.conf:
template:
- id: default storage: "/var/lib/knot"
dnssec-signing: on
dnssec-policy: rsa2048
global-module: [ "mod-cookies", "mod-rrl/default" ]
mod-rrl:
- id: default
rate-limit: 200
slip: 2
- domain: mydomain.de
file: "/etc/knot/zones/mydomain.de.zone"
notify: secondary
acl: acl_secondary
zonefile-load: difference
I thought about maybe it's the slip: 2, but that didn't change anything
if set to 1
Do you guys see anything obvious causing this "issue"?
Thanks for your time
Juergen
--
13:36
Hi Daniel,
i have the same template settings in my master and slave (except for the
dnssec-signing/dnssec-policy on the slave) and no template set explicit
on the zones.
For example:
ns1:
template:
- id: default
storage: "/var/lib/knot"
dnssec-signing: on
dnssec-policy: rsa2048
global-module: [ "mod-cookies", "mod-rrl/default" ]
ns2:
template:
- id: default
storage: "/var/lib/knot"
global-module: [ "mod-cookies", "mod-rrl/default" ]
If this is the inconsistency, then i was wrong about signing enabled
only on the master?
Thanks for your fast respone.
Juergen
Am 22.12.21 um 13:25 schrieb Daniel Salzman:
Hi Juergen,
The warning usually appears if the configuration of all nameservers is inconsistent.
For example cookies are enabled on some nameservers only.
Daniel
On 12/22/21 1:07 PM, J. Echter wrote:
> Hi,
>
> i have knot dns setup with dns cookie module enabled but if i check with
> dnsviz.net i always get:
>
> The server appears to support DNS cookies but did not return a COOKIE
> option.
>
> Relevant parts of my knot.conf:
>
> template:
>
> - id: default storage: "/var/lib/knot"
>
> dnssec-signing: on
>
> dnssec-policy: rsa2048
>
> global-module: [ "mod-cookies", "mod-rrl/default" ]
>
>
> mod-rrl:
>
> - id: default
>
> rate-limit: 200
>
> slip: 2
>
>
> - domain: mydomain.de
>
> file: "/etc/knot/zones/mydomain.de.zone"
>
> notify: secondary
>
> acl: acl_secondary
>
> zonefile-load: difference
>
>
> I thought about maybe it's the slip: 2, but that didn't change anything
> if set to 1
>
>
> Do you guys see anything obvious causing this "issue"?
>
>
> Thanks for your time
>
> Juergen
>
>
> --
>
13:55
On 12/22/21 1:36 PM, J. Echter wrote:
Hi Daniel,
i have the same template settings in my master and slave (except for the
dnssec-signing/dnssec-policy on the slave) and no template set explicit
on the zones.
For example:
ns1:
template:
- id: default
storage: "/var/lib/knot"
dnssec-signing: on
dnssec-policy: rsa2048
global-module: [ "mod-cookies", "mod-rrl/default" ]
ns2:
template:
- id: default
storage: "/var/lib/knot"
global-module: [ "mod-cookies", "mod-rrl/default" ]
If this is the inconsistency, then i was wrong about signing enabled
only on the master?
No, the signing is configured correctly.
I have tried almost the same configuration and dnsviz didn't complain. It's
strange.
Daniel
Thanks for your fast respone.
Juergen
Am 22.12.21 um 13:25 schrieb Daniel Salzman:
Hi Juergen,
The warning usually appears if the configuration of all nameservers is inconsistent.
For example cookies are enabled on some nameservers only.
Daniel
On 12/22/21 1:07 PM, J. Echter wrote:
> Hi,
>
> i have knot dns setup with dns cookie module enabled but if i check with
> dnsviz.net i always get:
>
> The server appears to support DNS cookies but did not return a COOKIE
> option.
>
> Relevant parts of my knot.conf:
>
> template:
>
> - id: default storage: "/var/lib/knot"
>
> dnssec-signing: on
>
> dnssec-policy: rsa2048
>
> global-module: [ "mod-cookies", "mod-rrl/default" ]
>
>
> mod-rrl:
>
> - id: default
>
> rate-limit: 200
>
> slip: 2
>
>
> - domain: mydomain.de
>
> file: "/etc/knot/zones/mydomain.de.zone"
>
> notify: secondary
>
> acl: acl_secondary
>
> zonefile-load: difference
>
>
> I thought about maybe it's the slip: 2, but that didn't change anything
> if set to 1
>
>
> Do you guys see anything obvious causing this "issue"?
>
>
> Thanks for your time
>
> Juergen
>
>
> --
>
23 Pro
23 Pro
10:19
On Wed, 22 Dec 2021 13:07:34 +0100
"J. Echter" <j.echter(a)gmx.de> wrote:
Relevant parts of my knot.conf:
template:
- id: default storage: "/var/lib/knot"
dnssec-signing: on
dnssec-policy: rsa2048
global-module: [ "mod-cookies", "mod-rrl/default" ]
I don't have such problem. but I have configuration for mod-cookies and
so I load it differently.
mod-cookies:
- id: default
secret-lifetime: 26h
badcookie-slip: 1
And in default template:
global-module: [ mod-cookies/default, mod-rrl/default ]
--
Tuomo Soini <tis(a)foobar.fi>
Foobar Linux services
+358 40 5240030
Foobar Oy <https://foobar.fi/>
10:43
Hi,
i just tried your configuration and it throws the same error.
Daniel told me there may be something not exactly right in the behaviour
of knot regarding cookie handling.
Maybe the problem goes away in a new version.
Am 23.12.21 um 10:19 schrieb Tuomo Soini:
On Wed, 22 Dec 2021 13:07:34 +0100
"J. Echter" <j.echter(a)gmx.de> wrote:
Relevant parts of my knot.conf:
template:
- id: default storage: "/var/lib/knot"
dnssec-signing: on
dnssec-policy: rsa2048
global-module: [ "mod-cookies", "mod-rrl/default" ]
I
don't have such problem. but I have configuration for mod-cookies and
so I load it differently.
mod-cookies:
- id: default
secret-lifetime: 26h
badcookie-slip: 1
And in default template:
global-module: [ mod-cookies/default, mod-rrl/default ]
11:14
On Thu, 23 Dec 2021 10:43:16 +0100
"J. Echter" <j.echter(a)gmx.de> wrote:
Hi,
i just tried your configuration and it throws the same error.
Daniel told me there may be something not exactly right in the
behaviour of knot regarding cookie handling.
Maybe the problem goes away in a new version.
How about telling us version you are running? This has been working for
ages.
--
Tuomo Soini <tis(a)foobar.fi>
Foobar Linux services
+358 40 5240030
Foobar Oy <https://foobar.fi/>
11:17
On 23/12/2021 11.14, Tuomo Soini wrote:
DNSViz complains about knotd not doing cookies *on TCP* connections,
which is so in the latest releases. And it's now planned to resolve
that in future.
--Vladimir
Maybe the
problem goes away in a new version.
How about telling us version you are running?
This has been working for
ages. 
19:47
Hello List,
Am Donnerstag, 23. Dezember 2021, 10:19:01 CET schrieb Tuomo Soini:
On Wed, 22 Dec 2021 13:07:34 +0100
"J. Echter" <j.echter(a)gmx.de> wrote:
the DS Problem on dnsviz is with your config gon but now I have this Error
4gjn.com/TXT: The response had an invalid RCODE (SERVFAIL). (89.26.108.11,
2001:470:1f0b:371::221, UDP_-_NOEDNS_)
I have Version3.1.,5
--
mit freundlichen Grüßen / best regards
Günther J. Niederwimmer
Relevant parts of my knot.conf:
template:
- id: default storage: "/var/lib/knot"
dnssec-signing: on
dnssec-policy: rsa2048
global-module: [ "mod-cookies", "mod-rrl/default" ]
I don't have such problem. but I have configuration for mod-cookies and
so I load it differently.
mod-cookies:
- id: default
secret-lifetime: 26h
badcookie-slip: 1
And in default template:
global-module: [ mod-cookies/default, mod-rrl/default ]
8 Úno
8 Úno
20:42
Hi,
release from today fixed the issue.
Thanks and have a nice evening/day!
Juergen
Am 22.12.21 um 13:55 schrieb Daniel Salzman:
On 12/22/21 1:36 PM, J. Echter wrote:
Hi Daniel,
i have the same template settings in my master and slave (except for the
dnssec-signing/dnssec-policy on the slave) and no template set explicit
on the zones.
For example:
ns1:
template:
- id: default
storage: "/var/lib/knot"
dnssec-signing: on
dnssec-policy: rsa2048
global-module: [ "mod-cookies", "mod-rrl/default" ]
ns2:
template:
- id: default
storage: "/var/lib/knot"
global-module: [ "mod-cookies", "mod-rrl/default" ]
If this is the inconsistency, then i was wrong about signing enabled
only on the master?
No, the signing is configured correctly.
I have tried almost the same configuration and dnsviz didn't complain. It's
strange.
Daniel
> Thanks for your fast respone.
>
> Juergen
>
> Am 22.12.21 um 13:25 schrieb Daniel Salzman:
>> Hi Juergen,
>>
>> The warning usually appears if the configuration of all nameservers is
inconsistent.
>> For example cookies are enabled on some nameservers only.
>>
>> Daniel
>>
>> On 12/22/21 1:07 PM, J. Echter wrote:
>>> Hi,
>>>
>>> i have knot dns setup with dns cookie module enabled but if i check with
>>> dnsviz.net i always get:
>>>
>>> The server appears to support DNS cookies but did not return a COOKIE
>>> option.
>>>
>>> Relevant parts of my knot.conf:
>>>
>>> template:
>>>
>>> - id: default storage: "/var/lib/knot"
>>>
>>> dnssec-signing: on
>>>
>>> dnssec-policy: rsa2048
>>>
>>> global-module: [ "mod-cookies", "mod-rrl/default" ]
>>>
>>>
>>> mod-rrl:
>>>
>>> - id: default
>>>
>>> rate-limit: 200
>>>
>>> slip: 2
>>>
>>>
>>> - domain: mydomain.de
>>>
>>> file: "/etc/knot/zones/mydomain.de.zone"
>>>
>>> notify: secondary
>>>
>>> acl: acl_secondary
>>>
>>> zonefile-load: difference
>>>
>>>
>>> I thought about maybe it's the slip: 2, but that didn't change
anything
>>> if set to 1
>>>
>>>
>>> Do you guys see anything obvious causing this "issue"?
>>>
>>>
>>> Thanks for your time
>>>
>>> Juergen
>>>
>>>
>>> --
>>>
830
days inactive
878
days old
9 comments
5 participants
participants (5)
-
Daniel Salzman -
Günther J. Niederwimmer -
J. Echter -
Tuomo Soini -
Vladimír Čunát