<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<span style="font-size: 12px;">Hello,</span></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<span style="font-size: 12px;"><br>
</span></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<span style="font-size: 12px;">I have been testing the edns-client-subnet support branch with the latest sync (thanks for the recent trunk sync) and there appears to be an issue when the subnet enabled query results in a CNAME response pointing to an A record
that does not have client subnet information with it.</span></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<span style="font-size: 12px;"><br>
</span></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<span style="font-size: 12px;">In my current setup I am running:</span></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<div><font face="Courier" style="font-size: 10px;">version: 1.5.4</font></div>
<div><font face="Courier" style="font-size: 10px;">verbosity: 3</font></div>
<div><font face="Courier" style="font-size: 10px;">threads: 2</font></div>
<div><font face="Courier" style="font-size: 10px;">modules: 3 [ subnet validator iterator ]</font></div>
<div><font face="Courier" style="font-size: 10px;">uptime: 1471 seconds</font></div>
<div><font face="Courier" style="font-size: 10px;">options: control(ssl)</font></div>
<div><font face="Courier" style="font-size: 10px;">unbound (pid 3307) is running...</font></div>
</div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<span style="font-size: 12px;"><br>
</span></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif;"><font face="Calibri,sans-serif"><span style="font-size: 12px;">My unbound.conf contains:</span></font></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<div><font face="Courier" style="font-size: 10px;"> send-client-subnet: 156.154.64.0/24</font></div>
<div><font face="Courier" style="font-size: 10px;"> send-client-subnet: 156.154.65.0/24</font></div>
<div><font face="Courier" style="font-size: 10px;"> send-client-subnet: 156.154.66.0/24</font></div>
<div><font face="Courier" style="font-size: 10px;"> send-client-subnet: 156.154.67.0/24</font></div>
<div><font face="Courier" style="font-size: 10px;"> send-client-subnet: 156.154.68.0/24</font></div>
<div><font face="Courier" style="font-size: 10px;"> send-client-subnet: 156.154.69.0/24</font></div>
<div><font face="Courier" style="font-size: 10px;"> send-client-subnet: 2001:0502:F3FF::0000/48</font></div>
<div><font face="Courier" style="font-size: 10px;"> send-client-subnet: 2610:00A1:1014::0000/48</font></div>
<div><font face="Courier" style="font-size: 10px;"> send-client-subnet: 2610:00A1:1015::0000/48</font></div>
<div><font face="Courier" style="font-size: 10px;"> send-client-subnet: 2610:00A1:1016::0000/48</font></div>
<div><font face="Courier" style="font-size: 10px;"> send-client-subnet: 2610:00A1:1017::0000/48</font></div>
<div><font face="Courier" style="font-size: 10px;"> send-client-subnet: 2001:0502:4612::0000/48</font></div>
<div><font face="Courier" style="font-size: 10px;"><br>
</font></div>
<div><font face="Courier" style="font-size: 10px;"> client-subnet-opcode: 8</font></div>
<div><font face="Courier" style="font-size: 10px;"> max-client-subnet-ipv6: 48</font></div>
<div><font face="Courier" style="font-size: 10px;"> max-client-subnet-ipv4: 24</font></div>
</div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<span style="font-size: 12px;"><br>
</span></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<span style="font-size: 12px;"><br>
</span></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<span style="font-size: 12px;">When performing a dig against a hostname that returns a CNAME I see that the scope netmask is set to 0:</span></div>
<div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<font face="Courier" style="font-size: 10px;">; <<>> DiG 9.10.1-P1 <<>> @127.0.0.1 +subnet=4.34.119.15 whereami.ultradns.net</font></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<font face="Courier" style="font-size: 10px;">; (1 server found)</font></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<font face="Courier" style="font-size: 10px;">;; global options: +cmd</font></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<font face="Courier" style="font-size: 10px;">;; Got answer:</font></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<font face="Courier" style="font-size: 10px;">;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6362</font></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<font face="Courier" style="font-size: 10px;">;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 6, ADDITIONAL: 1</font></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<font face="Courier" style="font-size: 10px;"><br>
</font></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<font face="Courier" style="font-size: 10px;">;; OPT PSEUDOSECTION:</font></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<font face="Courier" style="font-size: 10px;">; EDNS: version: 0, flags:; udp: 4096</font></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<font face="Courier" style="font-size: 10px;">; CLIENT-SUBNET: 4.34.119.0/24/0</font></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<font face="Courier" style="font-size: 10px;">;; QUESTION SECTION:</font></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<font face="Courier" style="font-size: 10px;">;whereami.ultradns.net.<span class="Apple-tab-span" style="white-space:pre">
</span>IN<span class="Apple-tab-span" style="white-space:pre"> </span>A</font></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<font face="Courier" style="font-size: 10px;"><br>
</font></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<font face="Courier" style="font-size: 10px;">;; ANSWER SECTION:</font></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<font face="Courier" style="font-size: 10px;">whereami.ultradns.net.<span class="Apple-tab-span" style="white-space:pre">
</span>60<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre">
</span>CNAME<span class="Apple-tab-span" style="white-space:pre"> </span>US-NY-New-York.ipi.ultrasupport.net.</font></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<font face="Courier" style="font-size: 10px;">US-NY-New-York.ipi.ultrasupport.net. 3600 IN A<span class="Apple-tab-span" style="white-space:pre">
</span>127.0.0.2</font></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<font face="Courier" style="font-size: 10px;"><br>
</font></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<font face="Courier" style="font-size: 10px;">;; AUTHORITY SECTION:</font></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<font face="Courier" style="font-size: 10px;">ipi.ultrasupport.net.<span class="Apple-tab-span" style="white-space:pre">
</span>3600<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre">
</span>NS<span class="Apple-tab-span" style="white-space:pre"> </span>pdns196.ultradns.co.uk.</font></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<font face="Courier" style="font-size: 10px;">ipi.ultrasupport.net.<span class="Apple-tab-span" style="white-space:pre">
</span>3600<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre">
</span>NS<span class="Apple-tab-span" style="white-space:pre"> </span>pdns196.ultradns.com.</font></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<font face="Courier" style="font-size: 10px;">ipi.ultrasupport.net.<span class="Apple-tab-span" style="white-space:pre">
</span>3600<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre">
</span>NS<span class="Apple-tab-span" style="white-space:pre"> </span>pdns196.ultradns.net.</font></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<font face="Courier" style="font-size: 10px;">ipi.ultrasupport.net.<span class="Apple-tab-span" style="white-space:pre">
</span>3600<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre">
</span>NS<span class="Apple-tab-span" style="white-space:pre"> </span>pdns196.ultradns.biz.</font></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<font face="Courier" style="font-size: 10px;">ipi.ultrasupport.net.<span class="Apple-tab-span" style="white-space:pre">
</span>3600<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre">
</span>NS<span class="Apple-tab-span" style="white-space:pre"> </span>pdns196.ultradns.org.</font></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<font face="Courier" style="font-size: 10px;">ipi.ultrasupport.net.<span class="Apple-tab-span" style="white-space:pre">
</span>3600<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre">
</span>NS<span class="Apple-tab-span" style="white-space:pre"> </span>pdns196.ultradns.info.</font></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<font face="Courier" style="font-size: 10px;"><br>
</font></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<font face="Courier" style="font-size: 10px;">;; Query time: 1121 msec</font></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<font face="Courier" style="font-size: 10px;">;; SERVER: 127.0.0.1#53(127.0.0.1)</font></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<font face="Courier" style="font-size: 10px;">;; WHEN: Wed May 06 13:47:55 UTC 2015</font></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<font face="Courier" style="font-size: 10px;">;; MSG SIZE rcvd: 318</font></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<font face="Courier" style="font-size: 10px;"><br>
</font></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif;"><span style="font-size: 12px;">Some pcap analysis – attached – shows that the query for the CNAME responds with the correct scope netmask of 24. Unbound then goes to chase the CNAME and gets an
A record response that does not contain client subnet information and the final response to the client sets the scope netmask to 0 which is what is shown in the dig result above. This response is optimized for the subnet that was sent but since the end scope
netmask has been set to 0 all subsequent lookups, possibly from other clients, will get a cached answer that may not be optimal for that client. For example the next dig from a different subnet (Amsterdam) is answered from cache with an answer that is sub-optimal.
This behavior is identical when the cname points to an address in zone as well.</span></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif;"><br>
</div>
<div>
<div><font face="Courier" style="font-size: 10px;">; <<>> DiG 9.10.1-P1 <<>> @127.0.0.1 +subnet=212.72.53.207 whereami.ultradns.net</font></div>
<div><font face="Courier" style="font-size: 10px;">; (1 server found)</font></div>
<div><font face="Courier" style="font-size: 10px;">;; global options: +cmd</font></div>
<div><font face="Courier" style="font-size: 10px;">;; Got answer:</font></div>
<div><font face="Courier" style="font-size: 10px;">;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33629</font></div>
<div><font face="Courier" style="font-size: 10px;">;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 6, ADDITIONAL: 1</font></div>
<div><font face="Courier" style="font-size: 10px;"><br>
</font></div>
<div><font face="Courier" style="font-size: 10px;">;; OPT PSEUDOSECTION:</font></div>
<div><font face="Courier" style="font-size: 10px;">; EDNS: version: 0, flags:; udp: 4096</font></div>
<div><font face="Courier" style="font-size: 10px;">; CLIENT-SUBNET: 212.72.53.207/32/0</font></div>
<div><font face="Courier" style="font-size: 10px;">;; QUESTION SECTION:</font></div>
<div><font face="Courier" style="font-size: 10px;">;whereami.ultradns.net.<span class="Apple-tab-span" style="white-space:pre">
</span>IN<span class="Apple-tab-span" style="white-space:pre"> </span>A</font></div>
<div><font face="Courier" style="font-size: 10px;"><br>
</font></div>
<div><font face="Courier" style="font-size: 10px;">;; ANSWER SECTION:</font></div>
<div><font face="Courier" style="font-size: 10px;">whereami.ultradns.net.<span class="Apple-tab-span" style="white-space:pre">
</span>46<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre">
</span>CNAME<span class="Apple-tab-span" style="white-space:pre"> </span>US-NY-New-York.ipi.ultrasupport.net.</font></div>
<div><font face="Courier" style="font-size: 10px;">US-NY-New-York.ipi.ultrasupport.net. 3586 IN A<span class="Apple-tab-span" style="white-space:pre">
</span>127.0.0.2</font></div>
<div><font face="Courier" style="font-size: 10px;"><br>
</font></div>
<div><font face="Courier" style="font-size: 10px;">;; AUTHORITY SECTION:</font></div>
<div><font face="Courier" style="font-size: 10px;">ipi.ultrasupport.net.<span class="Apple-tab-span" style="white-space:pre">
</span>3586<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre">
</span>NS<span class="Apple-tab-span" style="white-space:pre"> </span>pdns196.ultradns.co.uk.</font></div>
<div><font face="Courier" style="font-size: 10px;">ipi.ultrasupport.net.<span class="Apple-tab-span" style="white-space:pre">
</span>3586<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre">
</span>NS<span class="Apple-tab-span" style="white-space:pre"> </span>pdns196.ultradns.com.</font></div>
<div><font face="Courier" style="font-size: 10px;">ipi.ultrasupport.net.<span class="Apple-tab-span" style="white-space:pre">
</span>3586<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre">
</span>NS<span class="Apple-tab-span" style="white-space:pre"> </span>pdns196.ultradns.net.</font></div>
<div><font face="Courier" style="font-size: 10px;">ipi.ultrasupport.net.<span class="Apple-tab-span" style="white-space:pre">
</span>3586<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre">
</span>NS<span class="Apple-tab-span" style="white-space:pre"> </span>pdns196.ultradns.biz.</font></div>
<div><font face="Courier" style="font-size: 10px;">ipi.ultrasupport.net.<span class="Apple-tab-span" style="white-space:pre">
</span>3586<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre">
</span>NS<span class="Apple-tab-span" style="white-space:pre"> </span>pdns196.ultradns.org.</font></div>
<div><font face="Courier" style="font-size: 10px;">ipi.ultrasupport.net.<span class="Apple-tab-span" style="white-space:pre">
</span>3586<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre">
</span>NS<span class="Apple-tab-span" style="white-space:pre"> </span>pdns196.ultradns.info.</font></div>
<div><font face="Courier" style="font-size: 10px;"><br>
</font></div>
<div><font face="Courier" style="font-size: 10px;">;; Query time: 1 msec</font></div>
<div><font face="Courier" style="font-size: 10px;">;; SERVER: 127.0.0.1#53(127.0.0.1)</font></div>
<div><font face="Courier" style="font-size: 10px;">;; WHEN: Wed May 06 16:43:10 UTC 2015</font></div>
<div><font face="Courier" style="font-size: 10px;">;; MSG SIZE rcvd: 319</font></div>
</div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<span style="font-size: 12px;"><br>
</span></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif;"><span style="font-size: 12px;">The draft, as far as I can tell , doesn’t say anything about chasing the CNAME so is this the expected behavior for Unbound? It would seem that the final response
should use the client subnet information from the original CNAME response.</span></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif;"><span style="font-size: 12px;"><br>
</span></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif;"><span style="font-size: 12px;">On the other hand all of the tests where the response is a plain A or AAAA record appear to be working well.</span></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<span style="font-size: 12px;"><br>
</span></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<span style="font-size: 12px;">Thanks</span></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<span style="font-size: 12px;">Steve</span></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">
<br>
</div>
</div>
</body>
</html>