Bug 1247 - unbound does not shorten source prefix length when forwarding ECS
unbound does not shorten source prefix length when forwarding ECS
Status: RESOLVED FIXED
Product: unbound
Classification: Unclassified
Component: server
unspecified
Other All
: P5 normal
Assigned To: unbound team
: 1251 (view as bug list)
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2017-04-06 02:06 CEST by JINMEI Tatuya
Modified: 2017-05-30 15:26 CEST (History)
3 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description JINMEI Tatuya 2017-04-06 02:06:05 CEST
I've tested this trunk rev 4088.

I built unbound with --enable-subnet and configured it with following lines:

server:
	module-config: "subnetcache validator iterator"
	max-client-subnet-ipv4: 24

If I send a query to unbound with an ECS option whose source prefix
length is larger than 24 (e.g. 31), unbound forwards the ECS option
without changing the source prefix length.  Is this intentional?  If
so, I think the documentation should clarify that max-client-subnet-ipv4
is different from the "server's maximum cacheable prefix length" as
described in the following part of RFC7871, Section 7.1.1:

   If the triggering query included an ECS option itself, it MUST be
   examined for its SOURCE PREFIX-LENGTH.  The Recursive Resolver's
   outgoing query MUST then set SOURCE PREFIX-LENGTH to the shorter of
   the incoming query's SOURCE PREFIX-LENGTH or the server's maximum
   cacheable prefix length.

Also, there seems to be a typo in unbound.conf.5:

.B max\-clienti-subnet\-ipv4: \fI<number>\fR

this should be

.B max\-client-subnet\-ipv4: \fI<number>\fR
Comment 1 Ralph Dolmans 2017-04-12 14:53:38 CEST
Hi Jinmei,

It was intentional in the initial (pre-RFC) implementation, and was never updated when that part was added to the document.

I have changed the code to be more RFC compliant, the ECS source prefix in queries is now always limited to the configured value.

Thanks for reporting.

-- Ralph
Comment 2 Manu Bretelle 2017-04-13 05:53:54 CEST
Damn, I fixed that in #1251 around the same time..... all is not lost, I have written a unittest for it that you can add to the collection. There is also a minor unbound.conf update along with it.
Comment 3 Manu Bretelle 2017-04-13 05:54:15 CEST
*** Bug 1251 has been marked as a duplicate of this bug. ***