From: Bob Halley <halley@dnspython.org>
Date: Sun, 28 Jun 2026 00:39:57 +0000 (-0700)
Subject: Unknown flag fixes.
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9823b9b25002e584a3e70c3b99515ac928cc43dd;p=thirdparty%2Fdnspython.git

Unknown flag fixes.

We now mask out opcode and rcode for (regular) flags,
and the extended rcode and version for EDNS flags.

We now test with unknown flag 0x0040 for flags, as
it is the only actually undefined flag bit.

We now test with unknown flags 0x0003 for EDNS, as
flag 0x2000 is expected to be used in DELEG.
---

diff --git a/dns/flags.py b/dns/flags.py
index 2757e62e..9fd1d0e6 100644
--- a/dns/flags.py
+++ b/dns/flags.py
@@ -50,6 +50,13 @@ class EDNSFlag(enum.IntFlag):
     CO = 0x4000
 
 
+# Flags Mask (excludes opcode and rcode)
+FLAGS_MASK = 0x87F0
+
+# EDNS Flags Mask (excludes extended rcode and version)
+EDNS_FLAGS_MASK = 0x0000FFFF
+
+
 def _from_text(text: str, enum_class: Any) -> int:
     flags = 0
     tokens = text.split()
@@ -100,7 +107,8 @@ def to_text(flags: int) -> str:
     :rtype: str
     """
 
-    return _to_text(flags, Flag)
+    # We & with 0xff0 to mask out rcode.
+    return _to_text(flags & FLAGS_MASK, Flag)
 
 
 def edns_from_text(text: str) -> int:
@@ -120,7 +128,7 @@ def edns_to_text(flags: int) -> str:
     :rtype: str
     """
 
-    return _to_text(flags, EDNSFlag)
+    return _to_text(flags & EDNS_FLAGS_MASK, EDNSFlag)
 
 
 ### BEGIN generated Flag constants
diff --git a/tests/test_flags.py b/tests/test_flags.py
index be5342bd..bbe6b85e 100644
--- a/tests/test_flags.py
+++ b/tests/test_flags.py
@@ -18,8 +18,8 @@
 import unittest
 
 import dns.flags
-import dns.rcode
 import dns.opcode
+import dns.rcode
 
 
 class FlagsTestCase(unittest.TestCase):
@@ -59,17 +59,17 @@ class FlagsTestCase(unittest.TestCase):
 
     def test_to_text_unknown_flag(self):
         # An unknown flag bit must not be silently dropped (issue #1264).
-        self.assertEqual(dns.flags.to_text(0x8000 | 0x0001), "QR FLAG0")
+        self.assertEqual(dns.flags.to_text(0x8000 | 0x0040), "QR FLAG6")
 
     def test_edns_to_text_unknown_flag(self):
         # EDNS flags behave the same: the unnamed 0x2000 bit is rendered.
-        self.assertEqual(dns.flags.edns_to_text(0x2000), "FLAG13")
-        self.assertEqual(dns.flags.edns_to_text(0x8000 | 0x2000), "DO FLAG13")
+        self.assertEqual(dns.flags.edns_to_text(0x0003), "FLAG0 FLAG1")
+        self.assertEqual(dns.flags.edns_to_text(0x8000 | 0x0001), "DO FLAG0")
 
     def test_unknown_flag_roundtrip(self):
-        for value in [0x0001, 0x8000 | 0x0001, 0x0400 | 0x0008]:
+        for value in [0x0040, 0x8000 | 0x0040]:
             self.assertEqual(dns.flags.from_text(dns.flags.to_text(value)), value)
-        for value in [0x2000, 0x8000 | 0x2000, 0x4000 | 0x2000]:
+        for value in [0x0003, 0x8000 | 0x0003]:
             self.assertEqual(
                 dns.flags.edns_from_text(dns.flags.edns_to_text(value)), value
             )