<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Aptos;
panose-1:2 11 0 4 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Aptos",sans-serif;
mso-ligatures:standardcontextual;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#467886;
text-decoration:underline;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:11.0pt;
mso-ligatures:none;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:511454244;
mso-list-template-ids:1146099198;}
@list l0:level1
{mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level2
{mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level3
{mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level4
{mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level5
{mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level6
{mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level7
{mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level8
{mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level9
{mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l1
{mso-list-id:1725175379;
mso-list-template-ids:1677765194;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style>
</head>
<body lang="EN-AU" link="#467886" vlink="#96607D" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Hi all,</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">I recently raised a PR to add support for per-local-zone ipset specification, allowing for more than one ipset to be used and set TTLs on the ipset entries based on RRSet timeout field values which can be conditionally enabled (implementation
details, config examples and reasoning can be found on the PR): <a href="https://github.com/NLnetLabs/unbound/pull/1162" title="https://github.com/NLnetLabs/unbound/pull/1162">https://github.com/NLnetLabs/unbound/pull/1162</a></p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">I wanted to discuss a few things here:</p>
<ol style="margin-top:0cm" start="1" type="1">
<li class="MsoNormal" style="mso-list:l0 level1 lfo3">Asking for reviews and opinions on it, plus any assistance I can give to get it into a state that is mergable</li><li class="MsoNormal" style="mso-list:l0 level1 lfo3">Necessary changes for the Debian package to add the CAP_NET_ADMIN support conditionally on compilation with --enable-ipset (possibly detect this based on env vars set from the configure script) to update
the apparmor profile with the capability</li><li class="MsoNormal" style="mso-list:l0 level1 lfo3">BSD’s packet filter framework has no support for per-entry TTLs into a table, i.e. can only evict entries from a table based on a delta invoked on the table itself, implying no automatic eviction. If someone
more familiar with BSD than I has any idea on this, would be great to hear about a potential solution.</li></ol>
<p class="MsoNormal"> </p>
<p class="MsoNormal">In terms of use case, we are looking to use Unbound as a forwarding DNS server which conditionally adds resolved addresses into ipsets for firewall passthru. Essentially a DNS firewall. Given we have services that talk over various ports
and protocols, the restriction of a single global ipset makes it impossible to distinguish entries on a per-port/protocol/etc basis from a single ipset.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Would be great to hear some feedback, opinions etc on this. Open to anything.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Cheers,</p>
<p class="MsoNormal">Jack</p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>