[FR] Runtime interface for dynamic DNS policy management

[TheBagarius]

Current behavior
Is there a current behavior that the feature relates to?

Unbound uses static configuration. An external application can change DNS policy only by changing the configuration and reloading Unbound.

If yes, would you wish the current behavior to change?

In modern systems network state changes at run time. eg. changing VPN settings, Split Tunneling ov VPN, Changing network interface, Network hopping (eg. Train and Airline WIFI)

Describe the desired feature
A clear and concise description of what the feature should be.

Provide a runtime interface to manage DNS policy.
The interface should allow an external application to add, update, or remove DNS policy while Unbound is running.
This interface does not override the default config, it just provides a volatile temporary change update.

Potential use-case
Describe how you see this feature being useful to other Unbound users.

Mainly desktop and mobile users that are using unbound as their local DNS resolver / coordinator, like me. use some network orchestrator eg. ConnMan, NetworkManager, etc.
I personally use NetworkManager + iwd on Artix (dinit). When I make changes in my connection setting eg. changing Enterpise VPN Network I am connecting to across clients, or sometimes when I am trying to work on a flight or train. Unbound looses sync with NetworkManager and needs to be manually restarted.

I feel like this is a feature that already exists in Unbound and I just haven't configured something properly.

[wcawijngaards]

There is unbound-control, and it can send a number of commands to unbound. Also it can change (some) config.

There is fast_reload that can restart unbound with little to no service interruption, and reload the config that way.

Some config changes need a restart, such as ones that changes the interfaces the server is listening on. But for changing addresses, of like forward and stub zones, the fast_reload works, and also the unbound-control commands that manage, add and remove forwards and stubs.

In the documentation, there are descriptions of what to do with unbound-control:
https://unbound.docs.nlnetlabs.nl/en/latest/getting-started/configuration.html#set-up-remote-control
https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound-control.html

The set_option is a feature for power users, that can change a lot of options, but not all work if they are post-processed into other memory areas. Perhaps use fast_reload that also has a wide range of options it can change in the running server.

[TheBagarius]

If i'm reading the documentation for unbound-control correctly, the remote control has the features to do forward-zone management? I think that's the section I would need to build around for the VPN connection switching.

[wcawijngaards]

That is with unbound-control commands forward, forward_add and forward_remove. It may need an insecure point, that is domain-insecure for the name, so that names there do not become DNSSEC bogus, with +i. You could also have an include: statement, possibly for like "dir/*.conf", and then drop a file in there with the extra settings and then use fast_reload. Then it would be stored and used on the next server start, as part of the config file.