Per-local zone ipset declarations with TTLs

[Kilrain, Jack]

Hi all,

I recently raised a PR to add support for per-local-zone ipset specification, allowing for more than one ipset to be used and set TTLs on the ipset entries based on RRSet timeout field values which can be conditionally enabled (implementation details, config examples and reasoning can be found on the PR): https://github.com/NLnetLabs/unbound/pull/1162

I wanted to discuss a few things here:

  1.  Asking for reviews and opinions on it, plus any assistance I can give to get it into a state that is mergable
  2.  Necessary changes for the Debian package to add the CAP_NET_ADMIN support conditionally on compilation with --enable-ipset (possibly detect this based on env vars set from the configure script) to update the apparmor profile with the capability
  3.  BSD’s packet filter framework has no support for per-entry TTLs into a table, i.e. can only evict entries from a table based on a delta invoked on the table itself, implying no automatic eviction. If someone more familiar with BSD than I has any idea on this, would be great to hear about a potential solution.

In terms of use case, we are looking to use Unbound as a forwarding DNS server which conditionally adds resolved addresses into ipsets for firewall passthru. Essentially a DNS firewall. Given we have services that talk over various ports and protocols, the restriction of a single global ipset makes it impossible to distinguish entries on a per-port/protocol/etc basis from a single ipset.

Would be great to hear some feedback, opinions etc on this. Open to anything.

Cheers,
Jack

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.nlnetlabs.nl/pipermail/unbound-users/attachments/20241114/9ca3e9ff/attachment.htm>