oven-sh/bun · error · TypeError

UNNESTED_RESOURCE

UNNESTED_RESOURCE

Error message

UNNESTED_RESOURCE

What it means

CertError::UNNESTED_RESOURCE maps BoringSSL X509_V_ERR_UNNESTED_RESOURCE (verify code 46). It is an RPKI (RFC 3779) failure: a certificate's IP-address/AS-resource extension claims resources that are not a subset of its issuer's resources. Message: "RFC 3779 resource not subset of parent's resources".

Source

Thrown at src/http/error.rs:213

    #[error("INVALID_NON_CA")]
    INVALID_NON_CA,
    #[error("PROXY_PATH_LENGTH_EXCEEDED")]
    PROXY_PATH_LENGTH_EXCEEDED,
    #[error("KEYUSAGE_NO_DIGITAL_SIGNATURE")]
    KEYUSAGE_NO_DIGITAL_SIGNATURE,
    #[error("PROXY_CERTIFICATES_NOT_ALLOWED")]
    PROXY_CERTIFICATES_NOT_ALLOWED,
    #[error("INVALID_EXTENSION")]
    INVALID_EXTENSION,
    #[error("INVALID_POLICY_EXTENSION")]
    INVALID_POLICY_EXTENSION,
    #[error("NO_EXPLICIT_POLICY")]
    NO_EXPLICIT_POLICY,
    #[error("DIFFERENT_CRL_SCOPE")]
    DIFFERENT_CRL_SCOPE,
    #[error("UNSUPPORTED_EXTENSION_FEATURE")]
    UNSUPPORTED_EXTENSION_FEATURE,
    #[error("UNNESTED_RESOURCE")]
    UNNESTED_RESOURCE,
    #[error("PERMITTED_VIOLATION")]
    PERMITTED_VIOLATION,
    #[error("EXCLUDED_VIOLATION")]
    EXCLUDED_VIOLATION,
    #[error("SUBTREE_MINMAX")]
    SUBTREE_MINMAX,
    #[error("APPLICATION_VERIFICATION")]
    APPLICATION_VERIFICATION,
    #[error("UNSUPPORTED_CONSTRAINT_TYPE")]
    UNSUPPORTED_CONSTRAINT_TYPE,
    #[error("UNSUPPORTED_CONSTRAINT_SYNTAX")]
    UNSUPPORTED_CONSTRAINT_SYNTAX,
    #[error("UNSUPPORTED_NAME_SYNTAX")]
    UNSUPPORTED_NAME_SYNTAX,
    #[error("CRL_PATH_VALIDATION_ERROR")]
    CRL_PATH_VALIDATION_ERROR,
    #[error("SUITE_B_INVALID_VERSION")]

View on GitHub (pinned to 8c5296ac45)

Solutions

  1. Compare resources end-to-end: inspect the RFC 3779 extensions of the chain with openssl x509 -text (autonomousSystemIds / ipAddressBlocks sections)
  2. Reissue the child certificate with resources that are a subset of the parent's
  3. If the parent's allocation legitimately grew, reissue the parent first, then the child
  4. For BGP speakers, re-run krill/rpkicheck-style validation after reissuance to confirm the chain nests

Example fix

# before
# parent: AS blocks 64512-64520 ; child claims 64512-64530
[child_resources]
autonomousSystemIds = 64512-64530

# after: subset of parent
[child_resources]
autonomousSystemIds = 64512-64520
Defensive patterns

Strategy: try-catch

Validate before calling

// RPKI: assert child resources nest inside parent resources before deployment
import { execFileSync } from "node:child_process";
export function resourcesNest(childPem, parentPem) {
  const txt = (pem) => execFileSync("openssl", ["x509", "-noout", "-text"], { input: pem }).toString();
  const grab = (t) => new Set((t.match(/IPv4:[\d./]+|IPv6:[0-9a-f:/]+|AS\d+(?:-\d+)?/gi) ?? []).map((s) => s.toLowerCase()));
  const child = grab(txt(childPem)), parent = grab(txt(parentPem));
  for (const r of child) if (!parent.has(r)) return false;
  return true;
}

Type guard

export function isUnnestedResource(e): e is Error & { code: "UNNESTED_RESOURCE" } {
  return e instanceof Error && (e as any).code === "UNNESTED_RESOURCE";
}

Try / catch

try {
  await fetch(rpkiEndpoint);
} catch (e) {
  if (e?.code === "UNNESTED_RESOURCE") {
    // child cert claims IP/AS resources beyond its parent - reissue with a subset
    alertRpkiOperators(rpkiEndpoint);
  } else throw e;
}

Prevention

When it happens

Trigger: Chain validation of RPKI certificates (BGP router / CA certs carrying RFC 3779 extensions) where the child asserts prefixes or ASNs beyond the parent's allocation - e.g. parent holds 10.0.0.0/8 but child claims 192.0.2.0/24.

Common situations: RPKI CA operators over-allocating to a child; child certs left stale after the parent's allocation shrank (e.g. after an RIR transfer); mis-typed prefixes in allocation tooling.

Related errors

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/2532f2cde1da91e2. Report an issue: GitHub.