Tag Incorrectly Applying for Other Interfaces Using the Same IP

[june128]

Describe the bug
Interface tags, set with interface-tag, get applied for queries on other interfaces. This happens when unbound listens on multiple interfaces and the interfaces have the same IP set, e.g. a link-local IPv6, and one then queries this IP existing on multiple interfaces.

To reproduce
Steps to reproduce the behavior:

1. Have multiple interfaces with the same IP set. E.g.:
   • vlan10 with IP: fe80::2/64
   • vlan50 with IP: fe80::2/64
2. Have unbound listen on those interfaces and configure an interface tag doing something for one interface. E.g.:

   server:
     define-tag: "meow"
     interface: vlan10
     interface: vlan50
     interface: lo
     interface-action: vlan10 allow
     interface-action: vlan50 allow
     interface-tag: vlan10 "meow"
     local-data: "meow.com. A 1.1.1.1"
     local-zone: meow.com transparent
     local-zone-tag: meow.com "meow"
   

3. Now query unbound from another computer on the non-tagged interface (e.g.: dig meow.com @fe80::2%vlan50) and observe that it returns the tagged local data.

Expected behavior
I expect interface tagging to just apply to the tagged interfaces.

System:

• Unbound version: 1.21.0
• OS: NixOS 24.05 (with unbound from NixOS unstable)
• unbound -V output:

  Version 1.21.0
  
  Configure line: --disable-static --prefix=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-unbound-1.21.0 --bindir=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-unbound-1.21.0/bin --sbindir=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-unbound-1.21.0/sbin --includedir=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-unbound-1.21.0/include --oldincludedir=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-unbound-1.21.0/include --mandir=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-unbound-1.21.0-man/share/man --infodir=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-unbound-1.21.0/share/info --docdir=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-unbound-1.21.0/share/doc/unbound --libdir=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-unbound-1.21.0-lib/lib --libexecdir=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-unbound-1.21.0-lib/libexec --localedir=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-unbound-1.21.0-lib/share/locale --with-ssl=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-openssl-3.0.14-dev --with-libexpat=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-expat-2.6.2-dev --with-libevent=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-libevent-2.1.12-dev --localstatedir=/var --sysconfdir=/etc --sbindir=${out}/bin --with-rootkey-file=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-dns-root-data-2024-06-20/root.key --enable-pie --enable-relro-now --enable-systemd
  Linked libs: libevent 2.1.12-stable (it uses epoll), OpenSSL 3.0.14 4 Jun 2024
  Linked modules: dns64 respip validator iterator
  
  BSD licensed, see LICENSE in source package for details.
  Report bugs to unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues
  

Additional information
It seems like this behavior also depends on other interface tags existing and the order of the interface-tag assignments.
For example having another interface tag and the interface-tag assignments like this (extending/rewriting the config used in the reproduction steps):

define-tag: "nya meow"
interface-tag: vlan50 "nya"
interface-tag: vlan10 "meow"

Then the fe80::2 wouldn't return the tagged data on any interface. Here it seems to me like the fe80::2 got already tagged through vlan50 and then doesn't get tagged again.

Looking through the source briefly, might it be that the tagging actually gets resolved to IPs and therefore this not working correctly?

[wcawijngaards]

The fix commit keeps track of the IPv6 scope id, and that makes it perform the correct tags. Thanks for the bug report!