<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /></head><body style='font-size: 10pt; font-family: Verdana,Geneva,sans-serif'>
<p>Hi Phil,</p>
<p>Thanks for the update. That's an interesting idea, I've had a good read around and I'm not sure if the view will work in our scenario (maybe I haven't understood them properly!).</p>
<p>We will have a large number of Clients, Locations and IP addresses and we also have multiple Unbound servers in different datacenters. The servers share data using a MariaDB Galeria Cluster. Client access is currently controlled using the firewalls on the servers, if a client adds a new location and IP address (using the web control panel) it's pushed into a firewall zone using the firewalld python module. The python module is filtering the requests based on the location and rule set that the client has set in the admin area, so they can filter categories of sites from over 4 million sites in the DB. </p>
<p>I think the issue may be with my version of Unbound as I've just read that "qstate.no_cache_store = 1" was only added in version 1.6.0. I will build the new version and see if that helps!</p>
<p>Thanks for the heads up regarding views, I will have a play with them to see if they make a bit more sense when implemented!</p>
<div> </div>
<p> </p>
<p>On 07/02/2017 00:21, Phil Pennock wrote:</p>
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0"><!-- html ignored --><!-- head ignored --><!-- meta ignored -->
<div class="pre" style="margin: 0; padding: 0; font-family: monospace">On 2017-02-06 at 22:43 +0000, Matt Nelson via Unbound-users wrote:
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">I have built a DNS filtering service using the pythonmod for unbound.<br /> Everything is working as it should apart from the cache. I want to<br /> disable the cache completely as I am filtering the results based on the<br /> incoming IP address. As an example anyone from 192.168.30.20 can access<br /> social media sites, but anyone from 192.168.30.30 is returned the IP<br /> address of the server instead which shows a "blocked" message.</blockquote>
<br /> Sounds like you want to be using Views, with a `view:` block which has<br /> `view-first: yes` set, local-data: in the view providing the IP address<br /> of the server, and a set of `access-control-view:` directives putting<br /> individual IPs into that view.<br /> <br /> I'm not seeing anything under<br /> <a href="http://unbound.net/documentation/pythonmod/index.html">http://unbound.net/documentation/pythonmod/index.html</a> which shows the<br /> access-control or view directives being exposed to Python.<br /> <br /> Assuming that the list of IPs is fairly dynamic, have you considered<br /> using an include directive such as:<br /> <br /> include: "/etc/unbound/python-managed.d/*.conf"<br /> <br /> and then having your Python be a standalone service to<br /> modify/create/delete one or more files in that directory based upon your<br /> site integrations, and use unbound-control to<br /> dump_cache/reload/load_cache ?<br /> <br /> I don't see unbound-control options to directly change<br /> access-control-view: options without doing a full reload. :\<br /> <br /> -Phil<br /> </div>
</blockquote>
</body></html>