From: Willy Tarreau <w@1wt.eu>
Date: Thu, 12 Nov 2026 15:12:11 +0000 (+0100)
Subject: BUG/MINOR: server: don't report dyncookie collision on same IP servers
X-Git-Tag: v3.5-dev12~20
X-Git-Url: https://git.kaiwu.me/%7B@url%7D?a=commitdiff_plain;h=a07d6f09bfbcbedcbf807c74c96cd1b6221e53a2;p=haproxy.git

BUG/MINOR: server: don't report dyncookie collision on same IP servers

When using "cookie dynamic", we detect cookie hash collisions and report
them. However, the test didn't take into account the fact that servers
could have the same addresses (e.g. server templates, DNS updates in
progress etc), and could produce lots of warning that the user couldn't
do anything with.

This patch adds an address check before reporting the warning: if two
servers have the same address, regardless of the cause, it is expected
that they will have the same cookie, so there's no point emitting a
warning.

In addition, there was no info about the servers causing the problem.
The only message was to ask to change the proxy's secret key. Let's
dump the server names so that the user may also correlate what's
happening with reports from other sources, or may even just delete or
readdress one of the offending servers if relevnt.

This can be backported to stable versions. Thanks to Nathan Wehrman
for the report.
---

diff --git a/src/server.c b/src/server.c
index afbe589e0..5ffc112d5 100644
--- a/src/server.c
+++ b/src/server.c
@@ -552,16 +552,41 @@ static inline void srv_check_for_dup_dyncookie(struct server *s)
 	struct proxy *p = s->proxy;
 	struct server *tmpserv;
 
+	/* no check for address-less servers */
+	if (s->addr.ss_family != AF_INET &&
+	    s->addr.ss_family != AF_INET6)
+		return;
+
+	/* address not configured => same */
+	if (!is_addr(&s->addr))
+		return;
+
 	list_for_each_entry(tmpserv, &p->servers, el_px) {
 		if (tmpserv == s)
 			continue;
 		if (tmpserv->next_admin & SRV_ADMF_FMAINT)
 			continue;
+
+		if (tmpserv->addr.ss_family != AF_INET &&
+		    tmpserv->addr.ss_family != AF_INET6)
+			continue;
+
+		if (!is_addr(&tmpserv->addr))
+			return;
+
+		/* servers with a similar address will produce a same cookie
+		 * and that is OK.
+		 */
+		if (ipcmp(&s->addr, &tmpserv->addr, 1) == 0)
+			continue;
+
 		if (tmpserv->cookie &&
 		    strcmp(tmpserv->cookie, s->cookie) == 0) {
-			ha_warning("We generated two equal cookies for two different servers.\n"
-				   "Please change the secret key for '%s'.\n",
-				   s->proxy->id);
+			ha_warning("We generated two equal cookies for two different servers in %s '%s' ('%s/%s' and '%s/%s').\n"
+			           "Please change the secret key for %s '%s'.\n",
+			           proxy_type_str(s->proxy), s->proxy->id,
+			           s->proxy->id, s->id, tmpserv->proxy->id, tmpserv->id,
+			           proxy_type_str(s->proxy), s->proxy->id);
 		}
 	}