--- /dev/null
+---
+- name: "allow"
+ description: "Let these packets go through"
+- name: "continue"
+ description: "Execute the specified action and override its return with None, making it possible to continue the processing. Subsequent rules are processed after this action"
+ skip-cpp: true
+ skip-rust: true
+ skip-serde: true
+ parameters:
+ - name: "action"
+ type: "Action"
+- name: "delay"
+ description: "Delay the response by the specified amount of milliseconds (UDP-only). Note that the sending of the query to the backend, if needed, is not delayed. Only the sending of the response to the client will be delayed. Subsequent rules are processed after this action"
+ parameters:
+ - name: "msec"
+ type: "u32"
+- name: "DnstapLog"
+ skip-cpp: true
+ skip-rust: true
+ description: "Send the current query to a remote logger as a dnstap message. ``alter-function`` is a callback, receiving a :class:`DNSQuestion` and a :class:`DnstapMessage`, that can be used to modify the message. Subsequent rules are processed after this action"
+ parameters:
+ - name: "identity"
+ type: "String"
+ - name: "logger-name"
+ type: "String"
+ - name: "alter-function"
+ type: "dnsdist::actions::DnstapAlterFunction"
+ rust-type: "String"
+ default: ""
+- name: "drop"
+ description: "Drop the packet"
+- name: "SetEDNSOption"
+ description: "Add arbitrary EDNS option and data to the query. Any existing EDNS content with the same option code will be overwritten. Subsequent rules are processed after this action"
+ parameters:
+ - name: "code"
+ type: "u32"
+ - name: "data"
+ type: "String"
+- name: "ERCode"
+ description: "Reply immediately by turning the query into a response with the specified EDNS extended rcode"
+ skip-cpp: true
+ parameters:
+ - name: "rcode"
+ type: "u8"
+ - name: "vars"
+ type: "ResponseConfig"
+ default: true
+- name: "HTTPStatus"
+ description: "Return an HTTP response with a status code of ``status``. For HTTP redirects, ``body`` should be the redirect URL"
+ skip-cpp: true
+ parameters:
+ - name: "status"
+ type: "u16"
+ - name: "body"
+ rust-type: "String"
+ type: "PacketBuffer"
+ - name: "content-type"
+ type: "String"
+ default: ""
+ - name: "vars"
+ type: "ResponseConfig"
+ default: true
+- name: "KeyValueStoreLookup"
+ description: "Does a lookup into the key value store using the key returned by ``lookup-key-name``, and storing the result if any into the tag named ``destination-tag``. The store can be a ``CDB`` or a ``LMDB`` database. The key can be based on the qname, source IP or the value of an existing tag. Subsequent rules are processed after this action. Note that the tag is always created, even if there was no match, but in that case the content is empty"
+ skip-cpp: true
+ skip-rust: true
+ parameters:
+ - name: "kvs-name"
+ type: "String"
+ - name: "lookup-key-name"
+ type: "String"
+ - name: "destination-tag"
+ type: "String"
+- name: "KeyValueStoreRangeLookup"
+ description: "Does a range-based lookup into the key value store using the key returned by ``lookup-key-name``, and storing the result if any into the tag named ``destination-tag``. This assumes that there is a key in network byte order for the last element of the range (for example ``2001:0db8:ffff:ffff:ffff:ffff:ffff:ffff`` for ``2001:db8::/32``) which contains the first element of the range (``2001:0db8:0000:0000:0000:0000:0000:0000``) (optionally followed by any data) as value, also in network byte order, and that there is no overlapping ranges in the database. This requires that the underlying store supports ordered keys, which is true for LMDB but not for CDB"
+ skip-cpp: true
+ skip-rust: true
+ parameters:
+ - name: "kvs-name"
+ type: "String"
+ - name: "lookup-key-name"
+ type: "String"
+ - name: "destination-tag"
+ type: "String"
+- name: "log"
+ description: "Log a line for each query, to the specified file if any, to the console (require verbose) if the empty string is given as filename.
+If an empty string is supplied in the file name, the logging is done to stdout, and only in verbose mode by default. This can be changed by setting ``verbose-only`` to ``false``.
+When logging to a file, the ``binary`` parameter specifies whether we log in binary form (default) or in textual form. The ``append`` parameter specifies whether we open the file for appending or truncate each time (default). The ``buffered`` parameter specifies whether writes to the file are buffered (default) or not.
+Subsequent rules are processed after this action"
+ parameters:
+ - name: "file-name"
+ type: "String"
+ default: ""
+ cpp-optional: false
+ - name: "binary"
+ type: "bool"
+ default: "true"
+ cpp-optional: false
+ - name: "append"
+ type: "bool"
+ default: "false"
+ cpp-optional: false
+ - name: "buffered"
+ type: "bool"
+ default: "false"
+ cpp-optional: false
+ - name: "verbose-only"
+ type: "bool"
+ default: "true"
+ cpp-optional: false
+ - name: "include-timestamp"
+ type: "bool"
+ default: "false"
+ cpp-optional: false
+- name: "lua"
+ description: "Invoke a Lua function that accepts a :class:`DNSQuestion`. The function should return a :ref:`DNSAction`. If the Lua code fails, ``ServFail`` is returned"
+ parameters:
+ - name: "function"
+ type: "dnsdist::actions::LuaActionFunction"
+ rust-type: "String"
+- name: "LuaFFI"
+ description: "Invoke a Lua function that accepts a pointer to a ``dnsdist_ffi_dnsquestion_t`` object, whose bindings are defined in ``dnsdist-lua-ffi-interface.h``. The function should return a :ref:`DNSAction`. If the Lua code fails, ``ServFail`` is returned"
+ parameters:
+ - name: "function"
+ type: "dnsdist::actions::LuaActionFFIFunction"
+ rust-type: "String"
+- name: "LuaFFIPerThread"
+ description: "Invoke a Lua function that accepts a pointer to a ``dnsdist_ffi_dnsquestion_t`` object, whose bindings are defined in ``dnsdist-lua-ffi-interface.h``. The function should return a :ref:`DNSAction`. If the Lua code fails, ``ServFail`` is returned.
+The function will be invoked in a per-thread Lua state, without access to the global Lua state. All constants (:ref:`DNSQType`, :ref:`DNSRCode`, ...) are available in that per-thread context, as well as all FFI functions. Objects and their bindings that are not usable in a FFI context (:class:`DNSQuestion`, :class:`DNSDistProtoBufMessage`, :class:`PacketCache`, ...) are not available."
+ parameters:
+ - name: "code"
+ type: "String"
+- name: "NegativeAndSOA"
+ description: "Turn a question into a response, either a ``NXDOMAIN`` or a ``NODATA`` one based on ``nxd``, setting the ``QR`` bit to ``1`` and adding a ``SOA`` record in the additional section"
+ skip-cpp: true
+ parameters:
+ - name: "nxd"
+ type: "bool"
+ - name: "zone"
+ type: "DNSName"
+ rust-type: "String"
+ - name: "ttl"
+ type: "u32"
+ - name: "mname"
+ type: "DNSName"
+ rust-type: "String"
+ - name: "rname"
+ type: "DNSName"
+ rust-type: "String"
+ - name: "soa-parameters"
+ type: "SOAParams"
+ - name: "soa-in-authority"
+ type: "bool"
+ default: "false"
+ - name: "vars"
+ type: "ResponseConfig"
+ default: true
+- name: "none"
+ description: "Does nothing. Subsequent rules are processed after this action"
+- name: "pool"
+ description: "Send the packet into the specified pool. If ``stop-processing`` is set to ``false``, subsequent rules will be processed after this action"
+ parameters:
+ - name: "pool-name"
+ type: "String"
+ - name: "stop-processing"
+ type: "bool"
+ default: "true"
+ cpp-optional: false
+- name: "QPS"
+ description: "Drop a packet if it does exceed the ``limit`` queries per second limit. Letting the subsequent rules apply otherwise"
+ parameters:
+ - name: "limit"
+ type: "u32"
+- name: "QPSPool"
+ description: "Send the packet into the specified pool only if it does not exceed the ``limit`` queries per second limit. If ``stop-processing`` is set to ``false``, subsequent rules will be processed after this action. Letting the subsequent rules apply otherwise"
+ parameters:
+ - name: "limit"
+ type: "u32"
+ - name: "pool-name"
+ type: "String"
+ - name: "stop-processing"
+ type: "bool"
+ default: "true"
+ cpp-optional: false
+- name: "RCode"
+ description: "Reply immediately by turning the query into a response with the specified rcode"
+ skip-cpp: true
+ parameters:
+ - name: "rcode"
+ type: "u8"
+ - name: "vars"
+ type: "ResponseConfig"
+ default: true
+- name: "RemoteLog"
+ skip-cpp: true
+ skip-rust: true
+ description: "Send the current query to a remote logger as a Protocol Buffer message. ``alter-function`` is a callback, receiving a :class:`DNSQuestion` and a :class:`DNSDistProtoBufMessage`, that can be used to modify the message, for example for anonymization purposes. Subsequent rules are processed after this action"
+ parameters:
+ - name: "logger-name"
+ type: "String"
+ - name: "alter-function"
+ type: "dnsdist::actions::ProtobufAlterFunction"
+ rust-type: "String"
+ default: ""
+ - name: "server-id"
+ type: "String"
+ default: ""
+ - name: "ip-encrypt-key"
+ type: "String"
+ default: ""
+ - name: "export-tags"
+ type: "Vec<String>"
+ default: true
+ - name: "metas"
+ type: "Vec<ProtoBufMetaConfiguration>"
+ default: true
+- name: "SetAdditionalProxyProtocolValue"
+ description: "Add a Proxy-Protocol Type-Length value to be sent to the server along with this query. It does not replace any existing value with the same type but adds a new value. Be careful that Proxy Protocol values are sent once at the beginning of the TCP connection for TCP and DoT queries. That means that values received on an incoming TCP connection will be inherited by subsequent queries received over the same incoming TCP connection, if any, but values set to a query will not be inherited by subsequent queries. Subsequent rules
+are processed after this action"
+ parameters:
+ - name: "proxy-type"
+ type: "u8"
+ - name: "value"
+ type: "String"
+- name: "SetDisableECS"
+ description: "Disable the sending of ECS to the backend. Subsequent rules are processed after this action"
+- name: "SetDisableValidation"
+ description: "Set the CD bit in the query and let it go through. Subsequent rules are processed after this action"
+- name: "SetECS"
+ description: "Set the ECS prefix and prefix length sent to backends to an arbitrary value. If both IPv4 and IPv6 masks are supplied the IPv4 one will be used for IPv4 clients and the IPv6 one for IPv6 clients. Otherwise the first mask is used for both, and can actually be an IPv6 mask. Subsequent rules are processed after this action"
+ skip-cpp: true
+ parameters:
+ - name: "ipv4"
+ type: "String"
+ - name: "ipv6"
+ type: "String"
+ default: ""
+ cpp-optional: false
+- name: "SetECSOverride"
+ description: "Whether an existing EDNS Client Subnet value should be overridden (true) or not (false). Subsequent rules are processed after this action"
+ parameters:
+ - name: "override-existing"
+ type: "bool"
+- name: "SetECSPrefixLength"
+ description: "Set the ECS prefix length. Subsequent rules are processed after this action"
+ parameters:
+ - name: "ipv4"
+ type: "u16"
+ - name: "ipv6"
+ type: "u16"
+- name: "SetExtendedDNSError"
+ description: "Set an Extended DNS Error status that will be added to the response corresponding to the current query. Subsequent rules are processed after this action"
+ parameters:
+ - name: "info-code"
+ type: "u16"
+ - name: "extra-text"
+ type: "String"
+ default: ""
+ cpp-optional: false
+- name: "SetMacAddr"
+ description: "Add the source MAC address to the query as EDNS0 option option. This action is currently only supported on Linux. Subsequent rules are processed after this action"
+ parameters:
+ - name: "code"
+ type: "u32"
+- name: "SetMaxReturnedTTL"
+ description: "Cap the TTLs of the response to the given maximum, but only after inserting the response into the packet cache with the initial TTL value"
+ skip-cpp: true
+ parameters:
+ - name: "max"
+ type: "u32"
+- name: "SetNoRecurse"
+ description: "Strip RD bit from the question, let it go through. Subsequent rules are processed after this action"
+- name: "SetProxyProtocolValues"
+ description: "Set the Proxy-Protocol Type-Length values to be sent to the server along with this query to values. Subsequent rules are processed after this action"
+ skip-cpp: true
+ skip-rust: true
+ parameters:
+ - name: "values"
+ type: "Vec<ProxyProtocolValueConfiguration>"
+ default: true
+- name: "SetSkipCache"
+ description: "Don’t lookup the cache for this query, don’t store the answer. Subsequent rules are processed after this action."
+- name: "SetTag"
+ description: "Associate a tag named ``tag`` with a value of ``value`` to this query, that will be passed on to the response. This function will overwrite any existing tag value. Subsequent rules are processed after this action"
+ parameters:
+ - name: "tag"
+ type: "String"
+ - name: "value"
+ type: "String"
+- name: "SetTempFailureCacheTTL"
+ description: "Set the cache TTL to use for ServFail and Refused replies. TTL is not applied for successful replies. Subsequent rules are processed after this action"
+ parameters:
+ - name: "maxTTL"
+ type: "u32"
+- name: "SNMPTrap"
+ description: "Send an SNMP trap, adding the message string as the query description. Subsequent rules are processed after this action"
+ parameters:
+ - name: "reason"
+ type: "String"
+ default: ""
+ cpp-optional: false
+- name: "Spoof"
+ description: "Forge a response with the specified IPv4 (for an A query) or IPv6 (for an AAAA) addresses. If you specify multiple addresses, all that match the query type (A, AAAA or ANY) will get spoofed in"
+ skip-cpp: true
+ skip-rust: true
+ parameters:
+ - name: "ips"
+ type: "Vec<String>"
+ - name: "vars"
+ type: "ResponseConfig"
+ default: true
+- name: "SpoofCNAME"
+ description: "Forge a response with the specified CNAME value. Please be aware that DNSdist will not chase the target of the CNAME, so it will not be present in the response which might be a problem for stub resolvers that do not know how to follow a CNAME"
+ skip-cpp: true
+ skip-rust: true
+ parameters:
+ - name: "cname"
+ type: "String"
+ - name: "vars"
+ type: "ResponseConfig"
+ default: true
+- name: "SpoofPacket"
+ description: "Spoof a raw self-generated answer"
+ skip-cpp: true
+ skip-rust: true
+ parameters:
+ - name: "response"
+ type: "String"
+ - name: "len"
+ type: "u32"
+- name: "SpoofRaw"
+ description: "Forge a response with the specified raw bytes as record data"
+ skip-cpp: true
+ skip-rust: true
+ parameters:
+ - name: "answers"
+ type: "Vec<String>"
+ - name: "qtype-for-any"
+ type: "String"
+ default: ""
+ - name: "vars"
+ type: "ResponseConfig"
+ default: true
+- name: "SpoofSVC"
+ description: "Forge a response with the specified ``SVC`` record data. If the list contains more than one ``SVC`` parameter, they are all returned, and should have different priorities. The hints provided in the SVC parameters, if any, will also be added as ``A``/``AAAA`` records in the additional section, using the target name present in the parameters as owner name if it’s not empty (root) and the qname instead"
+ skip-cpp: true
+ parameters:
+ - name: "parameters"
+ type: "Vec<SVCRecordParameters>"
+ - name: "vars"
+ type: "ResponseConfig"
+ default: true
+- name: "TC"
+ description: "Create answer to query with the ``TC`` bit set, and the ``RA`` bit set to the value of ``RD`` in the query, to force the client to TCP"
+- name: "tee"
+ description: "Send copy of query to remote, keep stats on responses. If ``add-ecs`` is set to true, EDNS Client Subnet information will be added to the query. If ``add-proxy-protocol`` is set to true, a Proxy Protocol v2 payload will be prepended in front of the query. The payload will contain the protocol the initial query was received over (UDP or TCP), as well as the initial source and destination addresses and ports. If ``lca`` has provided a value like “192.0.2.53”, dnsdist will try binding that address as local address when sending the queries. Subsequent rules are processed after this action"
+ skip-cpp: true
+ parameters:
+ - name: "rca"
+ type: "ComboAddress"
+ rust-type: "String"
+ - name: "lca"
+ type: "ComboAddress"
+ rust-type: "String"
+ default: ""
+ - name: "add-ecs"
+ type: "bool"
+ default: "false"
+ - name: "add-proxy-protocol"
+ type: "bool"
+ default: "false"
--- /dev/null
+---
+- name: "allow"
+ description: "Let these packets go through."
+- name: "ClearRecordTypes"
+ description: "Removes given type(s) records from the response. Beware you can accidentally turn the answer into a NODATA response without a SOA record in the additional section in which case you may want to use NegativeAndSOAAction() to generate an answer, see example below. Subsequent rules are processed after this action."
+ skip-cpp: true
+ skip-rust: true
+ parameters:
+ - name: "types"
+ type: "Vec<u16>"
+ default: true
+ description: "List of types to remove"
+- name: "delay"
+ description: "Delay the response by the specified amount of milliseconds (UDP-only). Note that the sending of the query to the backend, if needed, is not delayed. Only the sending of the response to the client will be delayed. Subsequent rules are processed after this action"
+ parameters:
+ - name: "msec"
+ type: "u32"
+- name: "DnstapLog"
+ description: "Send the current response to a remote logger as a dnstap message. ``alter-function`` is a callback, receiving a :class:`DNSResponse` and a :class:`DnstapMessage`, that can be used to modify the message. Subsequent rules are processed after this action"
+ skip-cpp: true
+ skip-rust: true
+ parameters:
+ - name: "identity"
+ type: "String"
+ - name: "logger-name"
+ type: "String"
+ - name: "alter-function"
+ type: "dnsdist::actions::DnstapAlterResponseFunction"
+ rust-type: "String"
+ default: ""
+- name: "drop"
+ description: "Drop the packet"
+- name: "LimitTTL"
+ description: "Cap the TTLs of the response to the given boundaries"
+ skip-cpp: true
+ skip-rust: true
+ parameters:
+ - name: "min"
+ type: "u32"
+ - name: "max"
+ type: "u32"
+ - name: "types"
+ type: "Vec<u16>"
+ default: true
+- name: "log"
+ description: "Log a line for each response, to the specified file if any, to the console (require verbose) if the empty string is given as filename.
+If an empty string is supplied in the file name, the logging is done to stdout, and only in verbose mode by default. This can be changed by setting ``verbose-only`` to ``false``.
+When logging to a file, the ``binary`` parameter specifies whether we log in binary form (default) or in textual form. The ``append`` parameter specifies whether we open the file for appending or truncate each time (default). The ``buffered`` parameter specifies whether writes to the file are buffered (default) or not.
+Subsequent rules are processed after this action"
+ parameters:
+ - name: "file-name"
+ type: "String"
+ default: ""
+ cpp-optional: false
+ - name: "append"
+ type: "bool"
+ default: "false"
+ cpp-optional: false
+ - name: "buffered"
+ type: "bool"
+ default: "false"
+ cpp-optional: false
+ - name: "verbose-only"
+ type: "bool"
+ default: "true"
+ cpp-optional: false
+ - name: "include-timestamp"
+ type: "bool"
+ default: "false"
+ cpp-optional: false
+- name: "lua"
+ description: "Invoke a Lua function that accepts a :class:`DNSResponse`. The function should return a :ref:`DNSResponseAction`. If the Lua code fails, ``ServFail`` is returned"
+ parameters:
+ - name: "function"
+ type: "dnsdist::actions::LuaResponseActionFunction"
+ rust-type: "String"
+- name: "LuaFFI"
+ description: "Invoke a Lua function that accepts a pointer to a ``dnsdist_ffi_dnsquestion_t`` object, whose bindings are defined in ``dnsdist-lua-ffi-interface.h``. The function should return a :ref:`DNSResponseAction`. If the Lua code fails, ``ServFail`` is returned"
+ parameters:
+ - name: "function"
+ type: "dnsdist::actions::LuaResponseActionFFIFunction"
+ rust-type: "String"
+- name: "LuaFFIPerThread"
+ description: "Invoke a Lua function that accepts a pointer to a ``dnsdist_ffi_dnsquestion_t`` object, whose bindings are defined in ``dnsdist-lua-ffi-interface.h``. The function should return a :ref:`DNSResponseAction`. If the Lua code fails, ``ServFail`` is returned.
+The function will be invoked in a per-thread Lua state, without access to the global Lua state. All constants (:ref:`DNSQType`, :ref:`DNSRCode`, ...) are available in that per-thread context, as well as all FFI functions. Objects and their bindings that are not usable in a FFI context (:class:`DNSQuestion`, :class:`DNSDistProtoBufMessage`, :class:`PacketCache`, ...) are not available."
+ parameters:
+ - name: "code"
+ type: "String"
+- name: "RemoteLog"
+ description: "Send the current response to a remote logger as a Protocol Buffer message. ``alter-function`` is a callback, receiving a :class:`DNSResponse` and a :class:`DNSDistProtoBufMessage`, that can be used to modify the message, for example for anonymization purposes. Subsequent rules are processed after this action"
+ skip-cpp: true
+ skip-rust: true
+ parameters:
+ - name: "logger-name"
+ type: "String"
+ - name: "alter-function"
+ type: "dnsdist::actions::ProtobufAlterResponseFunction"
+ rust-type: "String"
+ default: ""
+ - name: "server-id"
+ type: "String"
+ default: ""
+ - name: "ip-encrypt-key"
+ type: "String"
+ default: ""
+ - name: "include-cname"
+ type: "bool"
+ default: "false"
+ - name: "export-tags"
+ type: "Vec<String>"
+ default: true
+ - name: "export-extended-errors-to-meta"
+ type: "String"
+ default: ""
+ - name: "metas"
+ type: "Vec<ProtoBufMetaConfiguration>"
+ default: true
+- name: "SetExtendedDNSError"
+ description: "Set an Extended DNS Error status that will be added to the response. Subsequent rules are processed after this action"
+ parameters:
+ - name: "info-code"
+ type: "u16"
+ - name: "extra-text"
+ type: "String"
+ default: ""
+ cpp-optional: false
+- name: "SetMaxReturnedTTL"
+ description: "Cap the TTLs of the response to the given maximum, but only after inserting the response into the packet cache with the initial TTL values"
+ skip-cpp: true
+ parameters:
+ - name: "max"
+ type: "u32"
+- name: "SetMaxTTL"
+ description: "Cap the TTLs of the response to the given maximum"
+ skip-cpp: true
+ skip-rust: true
+ parameters:
+ - name: "max"
+ type: "u32"
+- name: "SetMinTTL"
+ description: "Cap the TTLs of the response to the given minimum"
+ skip-cpp: true
+ skip-rust: true
+ parameters:
+ - name: "min"
+ type: "u32"
+- name: "SetReducedTTL"
+ description: "Reduce the TTL of records in a response to a percentage of the original TTL. For example, passing 50 means that the original TTL will be cut in half. Subsequent rules are processed after this action"
+ parameters:
+ - name: "percentage"
+ type: "u8"
+- name: "SetSkipCache"
+ description: "Don’t store this answer in the cache. Subsequent rules are processed after this action."
+- name: "SetTag"
+ description: "Associate a tag named ``tag`` with a value of ``value`` to this response. This function will overwrite any existing tag value. Subsequent rules are processed after this action"
+ parameters:
+ - name: "tag"
+ type: "String"
+ - name: "value"
+ type: "String"
+- name: "SNMPTrap"
+ description: "Send an SNMP trap, adding the message string as the query description. Subsequent rules are processed after this action"
+ parameters:
+ - name: "reason"
+ type: "String"
+ default: ""
+ cpp-optional: false
+- name: "TC"
+ description: "Truncate an existing answer, to force the client to TCP. Only applied to answers that will be sent to the client over TCP. In addition to the TC bit being set, all records are removed from the answer, authority and additional sections"
--- /dev/null
+---
+- name: "all"
+ description: "Matches all traffic"
+- name: "And"
+ skip-cpp: true
+ skip-rust: true
+ skip-serde: true
+ description: "Matches traffic if all selectors match"
+ parameters:
+ - name: "selectors"
+ type: "Vec<Selector>"
+ default: true
+- name: "ByName"
+ skip-cpp: true
+ skip-rust: true
+ no-lua-equivalent: true
+ description: "References an already declared selector by its name"
+ parameters:
+ - name: "selector-name"
+ type: "String"
+- name: "DNSSEC"
+ description: "Matches queries with the DO flag set"
+- name: "DSTPort"
+ description: "Matches questions received to the destination port"
+ parameters:
+ - name: "port"
+ type: "u16"
+- name: "EDNSOption"
+ description: "Matches queries or responses with the specified EDNS option present"
+ parameters:
+ - name: "option-code"
+ type: "u16"
+- name: "EDNSVersion"
+ description: "Matches queries or responses with an OPT record whose EDNS version is greater than the specified EDNS version"
+ parameters:
+ - name: "version"
+ type: "u8"
+- name: "ERCode"
+ description: "Matches queries or responses with the specified rcode. The full 16bit RCode will be matched. If no EDNS OPT RR is present, the upper 12 bits are treated as 0"
+ parameters:
+ - name: "rcode"
+ type: "u64"
+- name: "HTTPHeader"
+ description: "Matches DNS over HTTPS queries with a HTTP header name whose content matches the supplied regular expression. It is necessary to set the ``keepIncomingHeaders`` to :func:`addDOHLocal()` to use this rule"
+ parameters:
+ - name: "header"
+ type: "String"
+ - name: "expression"
+ type: "String"
+- name: "HTTPPath"
+ description: "Matches DNS over HTTPS queries with a specific HTTP path"
+ parameters:
+ - name: "path"
+ type: "String"
+- name: "HTTPPathRegex"
+ description: "Matches DNS over HTTPS queries with a path matching the supplied regular expression"
+ parameters:
+ - name: "expression"
+ type: "String"
+- name: "KeyValueStoreLookup"
+ skip-cpp: true
+ skip-rust: true
+ description: "Matches if the key returned by ``lookup-key-name`` exists in the key value store"
+ parameters:
+ - name: "kvs-name"
+ type: "String"
+ - name: "lookup-key-name"
+ type: "String"
+- name: "KeyValueStoreRangeLookup"
+ skip-cpp: true
+ skip-rust: true
+ description: "Does a range-based lookup into the key value store using the key returned by ``lookup-key-name`` and matches if there is a range covering that key.
+This assumes that there is a key, in network byte order, for the last element of the range (for example ``2001:0db8:ffff:ffff:ffff:ffff:ffff:ffff`` for ``2001:db8::/32``) which contains the first element of the range (``2001:0db8:0000:0000:0000:0000:0000:0000``) (optionally followed by any data) as value, still in network byte order, and that there is no overlapping ranges in the database. This requires that the underlying store supports ordered keys, which is true for ``LMDB`` but not for ``CDB``"
+ parameters:
+ - name: "kvs-name"
+ type: "String"
+ - name: "lookup-key-name"
+ type: "String"
+- name: "lua"
+ description: "Invoke a Lua function that accepts a :class:`DNSQuestion` object. The function should return true if the query matches, or false otherwise. If the Lua code fails, false is returned"
+ parameters:
+ - name: "function"
+ type: "dnsdist::selectors::LuaSelectorFunction"
+ rust-type: "String"
+- name: "LuaFFI"
+ description: "Invoke a Lua FFI function that accepts a pointer to a ``dnsdist_ffi_dnsquestion_t`` object, whose bindings are defined in ``dnsdist-lua-ffi-interface.h``. The function should return true if the query matches, or false otherwise. If the Lua code fails, false is returned"
+ parameters:
+ - name: "function"
+ type: "dnsdist::selectors::LuaSelectorFFIFunction"
+ rust-type: "String"
+- name: "LuaFFIPerThread"
+ description: "Invoke a Lua FFI function that accepts a pointer to a ``dnsdist_ffi_dnsquestion_t`` object, whose bindings are defined in ``dnsdist-lua-ffi-interface.h``. The function should return true if the query matches, or false otherwise. If the Lua code fails, false is returned.
+
+The function will be invoked in a per-thread Lua state, without access to the global Lua state. All constants (:ref:`DNSQType`, :ref:`DNSRCode`, ...) are available in that per-thread context, as well as all FFI functions. Objects and their bindings that are not usable in a FFI context (:class:`DNSQuestion`, :class:`DNSDistProtoBufMessage`, :class:`PacketCache`, ...) are not available"
+ parameters:
+ - name: "code"
+ type: "String"
+- name: "MaxQPS"
+ description: "Matches traffic not exceeding this qps limit. If e.g. this is set to 50, starting at the 51st query of the current second traffic stops being matched. This can be used to enforce a global QPS limit"
+ parameters:
+ - name: "qps"
+ type: "u32"
+ - name: "burst"
+ type: "u32"
+ default: 0
+- name: "MaxQPSIP"
+ description: "Matches traffic for a subnet specified by the v4 or v6 mask exceeding ``qps`` queries per second up to ``burst`` allowed. This rule keeps track of QPS by netmask or source IP. This state is cleaned up regularly if ``cleanup-delay`` is greater than zero, removing existing netmasks or IP addresses that have not been seen in the last ``expiration`` seconds."
+ parameters:
+ - name: "qps"
+ type: "u32"
+ - name: "ipv4-mask"
+ type: "u8"
+ default: 32
+ - name: "ipv6-mask"
+ type: "u8"
+ default: 64
+ - name: "burst"
+ type: "u32"
+ default: 0
+ - name: "expiration"
+ type: "u32"
+ default: 300
+ - name: "cleanup-delay"
+ type: "u32"
+ default: 60
+ - name: "scan-fraction"
+ type: "u32"
+ default: 10
+ - name: "shards"
+ type: "u32"
+ default: 10
+- name: "NetmaskGroup"
+ skip-cpp: true
+ skip-rust: true
+ description: "Matches traffic from/to the network range specified in either the supplied :class:`NetmaskGroup` object or the list of ``netmasks``.
+Set the ``source`` parameter to ``false`` to match against destination address instead of source address. This can be used to differentiate between clients"
+ parameters:
+ - name: "netmask-group-name"
+ type: "String"
+ default: ""
+ - name: "netmasks"
+ type: "Vec<String>"
+ default: true
+ - name: "source"
+ type: "bool"
+ default: "true"
+ - name: "quiet"
+ type: "bool"
+ default: "false"
+- name: "Not"
+ description: "Matches the traffic if the selector rule does not match"
+ skip-cpp: true
+ skip-rust: true
+ skip-serde: true
+ parameters:
+ - name: "selector"
+ type: "Selector"
+- name: "opcode"
+ description: "Matches queries with opcode equals to ``code``"
+ parameters:
+ - name: "code"
+ type: "u8"
+- name: "Or"
+ description: "Matches the traffic if one or more of the selectors Rules does match"
+ skip-cpp: true
+ skip-rust: true
+ skip-serde: true
+ parameters:
+ - name: "selectors"
+ type: "Vec<Selector>"
+ default: true
+- name: "PayloadSize"
+ description: "Matches queries or responses whose DNS payload size fits the given comparison"
+ parameters:
+ - name: "comparison"
+ type: "String"
+ - name: "size"
+ type: "u16"
+- name: "PoolAvailable"
+ description: "Check whether a pool has any servers available to handle queries"
+ parameters:
+ - name: "pool"
+ type: "String"
+- name: "PoolOutstanding"
+ description: "Check whether a pool has total outstanding queries above limit"
+ parameters:
+ - name: "pool"
+ type: "String"
+ - name: "max-outstanding"
+ type: "u64"
+- name: "proba"
+ description: "Matches queries with a given probability. 1.0 means \"always\""
+ parameters:
+ - name: "probability"
+ type: "f64"
+- name: "ProxyProtocolValue"
+ description: "Matches queries that have a proxy protocol TLV value of the specified type. If ``option-value`` is set, the content of the value should also match the content of value"
+ parameters:
+ - name: "option-type"
+ type: "u8"
+ - name: "option-value"
+ type: "String"
+ default: ""
+- name: "QClass"
+ description: "Matches queries with the specified qclass. The class can be specified as a numerical value or as a string"
+ skip-cpp: true
+ parameters:
+ - name: "qclass"
+ type: "String"
+ default: ""
+ - name: "numeric-value"
+ type: "u16"
+ default: 0
+- name: "QName"
+ description: "Matches queries with the specified qname exactly"
+ skip-cpp: true
+ skip-rust: true
+ parameters:
+ - name: "qname"
+ type: "String"
+- name: "QNameLabelsCount"
+ description: "Matches if the qname has less than ``min-labels-count`` or more than ``max-labels-count`` labels"
+ parameters:
+ - name: "min-labels-count"
+ type: "u16"
+ - name: "max-labels-count"
+ type: "u16"
+- name: "QNameSet"
+ description: "Matches if the set contains exact qname. To match subdomain names, see :ref:`yaml-settings-QNameSuffixSelector`"
+ skip-cpp: true
+ skip-rust: true
+ parameters:
+ - name: "qnames"
+ type: "Vec<String>"
+- name: "QNameSuffix"
+ description: "Matches based on a group of domain suffixes for rapid testing of membership. Pass true to ``quiet`` to prevent listing of all domains matched in the console or the web interface"
+ skip-cpp: true
+ skip-rust: true
+ parameters:
+ - name: "suffixes"
+ type: "Vec<String>"
+ - name: "quiet"
+ type: "bool"
+ default: "false"
+- name: "QNameWireLength"
+ description: "Matches if the qname’s length on the wire is less than ``min`` or more than ``max`` bytes."
+ parameters:
+ - name: "min"
+ type: "u16"
+ - name: "max"
+ type: "u16"
+- name: "QType"
+ description: "Matches queries with the specified qtype, which can be supplied as a String or as a numerical value"
+ skip-cpp: true
+ parameters:
+ - name: "qtype"
+ type: "String"
+ - name: "numeric-value"
+ type: "u16"
+ default: 0
+- name: "RCode"
+ description: "Matches queries or responses with the specified rcode"
+ parameters:
+ - name: "rcode"
+ type: "u64"
+- name: "RD"
+ description: "Matches queries with the RD flag set"
+- name: "RE2"
+ description: "Matches the query name against the supplied regex using the RE2 engine"
+ parameters:
+ - name: "expression"
+ type: "String"
+- name: "RecordsCount"
+ description: "Matches if there is at least ``minimum`` and at most ``maximum`` records in the ``section`` section. ``section`` is specified as an integer with ``0`` being the question section, ``1`` answer, ``2`` authority and ``3`` additional"
+ parameters:
+ - name: "section"
+ type: "u8"
+ - name: "minimum"
+ type: "u16"
+ - name: "maximum"
+ type: "u16"
+- name: "RecordsTypeCount"
+ description: "Matches if there is at least ``minimum`` and at most ``maximum`` records of type ``record-type`` in the section ``section``. ``section`` is specified as an integer with ``0`` being the question section, ``1`` answer, ``2`` authority and ``3`` additional"
+ parameters:
+ - name: "section"
+ type: "u8"
+ - name: "record-type"
+ type: "u16"
+ - name: "minimum"
+ type: "u16"
+ - name: "maximum"
+ type: "u16"
+- name: "regex"
+ description: "Matches the query name against the supplied regular expression"
+ parameters:
+ - name: "expression"
+ type: "String"
+- name: "SNI"
+ description: "Matches against the TLS Server Name Indication value sent by the client, if any. Only makes sense for DoT or DoH, and for that last one matching on the HTTP Host header using :ref:`yaml-settings-HTTPHeaderSelector` might provide more consistent results"
+ parameters:
+ - name: "server-name"
+ type: "String"
+- name: "Tag"
+ description: "Matches question or answer with a tag named ``tag`` set. If ``value`` is specified, the existing tag value should match too"
+ parameters:
+ - name: "tag"
+ type: "String"
+ - name: "value"
+ type: "String"
+ default: ""
+- name: "TCP"
+ description: "Matches question received over TCP if ``tcp`` is true, over UDP otherwise"
+ parameters:
+ - name: "tcp"
+ type: "bool"
+- name: "TrailingData"
+ description: "Matches if the query has trailing data"
projects / thirdparty / pdns.git / commitdiff
