From: Remi Gacogne <remi.gacogne@powerdns.com>
Date: Thu, 7 Mar 2024 16:08:33 +0000 (+0100)
Subject: dnsdist: Simplify the handling of rule chains
X-Git-Tag: rec-5.1.0-alpha1~128^2~1
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3fc92d6773102be94d84a1f041a260afe8d7a9e6;p=thirdparty%2Fpdns.git

dnsdist: Simplify the handling of rule chains

This PR creates a list of response rule chains so we can deal with
them using a loop instead of having to take care of them one by one.
It makes the code easier to read and reduces the likelihood of introducing
a bug when implementing a new chain.
---

diff --git a/pdns/dnsdistdist/Makefile.am b/pdns/dnsdistdist/Makefile.am
index faaeefd379..4488d46d4c 100644
--- a/pdns/dnsdistdist/Makefile.am
+++ b/pdns/dnsdistdist/Makefile.am
@@ -197,6 +197,7 @@ dnsdist_SOURCES = \
 	dnsdist-random.cc dnsdist-random.hh \
 	dnsdist-resolver.cc dnsdist-resolver.hh \
 	dnsdist-rings.cc dnsdist-rings.hh \
+	dnsdist-rule-chains.cc dnsdist-rule-chains.hh \
 	dnsdist-rules.cc dnsdist-rules.hh \
 	dnsdist-secpoll.cc dnsdist-secpoll.hh \
 	dnsdist-session-cache.cc dnsdist-session-cache.hh \
@@ -302,6 +303,7 @@ testrunner_SOURCES = \
 	dnsdist-random.cc dnsdist-random.hh \
 	dnsdist-resolver.cc dnsdist-resolver.hh \
 	dnsdist-rings.cc dnsdist-rings.hh \
+	dnsdist-rule-chains.cc dnsdist-rule-chains.hh \
 	dnsdist-rules.cc dnsdist-rules.hh \
 	dnsdist-session-cache.cc dnsdist-session-cache.hh \
 	dnsdist-svc.cc dnsdist-svc.hh \
diff --git a/pdns/dnsdistdist/dnsdist-lua-actions.cc b/pdns/dnsdistdist/dnsdist-lua-actions.cc
index ea0c57edd9..d728b28104 100644
--- a/pdns/dnsdistdist/dnsdist-lua-actions.cc
+++ b/pdns/dnsdistdist/dnsdist-lua-actions.cc
@@ -32,6 +32,7 @@
 #include "dnsdist-protobuf.hh"
 #include "dnsdist-proxy-protocol.hh"
 #include "dnsdist-kvs.hh"
+#include "dnsdist-rule-chains.hh"
 #include "dnsdist-svc.hh"
 
 #include "dnstap.hh"
@@ -2476,8 +2477,8 @@ void setupLuaActions(LuaContext& luaCtx)
     checkAllParametersConsumed("newRuleAction", params);
 
     auto rule = makeRule(dnsrule, "newRuleAction");
-    DNSDistRuleAction ruleaction({std::move(rule), std::move(action), std::move(name), uuid, creationOrder});
-    return std::make_shared<DNSDistRuleAction>(ruleaction);
+    dnsdist::rules::RuleAction ruleaction({std::move(rule), std::move(action), std::move(name), uuid, creationOrder});
+    return std::make_shared<dnsdist::rules::RuleAction>(ruleaction);
   });
 
   luaCtx.writeFunction("addAction", [](const luadnsrule_t& var, boost::variant<std::shared_ptr<DNSAction>, std::shared_ptr<DNSResponseAction>> era, boost::optional<luaruleparams_t> params) {
@@ -2485,40 +2486,19 @@ void setupLuaActions(LuaContext& luaCtx)
       throw std::runtime_error("addAction() can only be called with query-related actions, not response-related ones. Are you looking for addResponseAction()?");
     }
 
-    addAction(&g_ruleactions, var, boost::get<std::shared_ptr<DNSAction>>(era), params);
+    addAction(&dnsdist::rules::g_ruleactions, var, boost::get<std::shared_ptr<DNSAction>>(era), params);
   });
 
-  luaCtx.writeFunction("addResponseAction", [](const luadnsrule_t& var, boost::variant<std::shared_ptr<DNSAction>, std::shared_ptr<DNSResponseAction>> era, boost::optional<luaruleparams_t> params) {
-    if (era.type() != typeid(std::shared_ptr<DNSResponseAction>)) {
-      throw std::runtime_error("addResponseAction() can only be called with response-related actions, not query-related ones. Are you looking for addAction()?");
-    }
-
-    addAction(&g_respruleactions, var, boost::get<std::shared_ptr<DNSResponseAction>>(era), params);
-  });
-
-  luaCtx.writeFunction("addCacheHitResponseAction", [](const luadnsrule_t& var, boost::variant<std::shared_ptr<DNSAction>, std::shared_ptr<DNSResponseAction>> era, boost::optional<luaruleparams_t> params) {
-    if (era.type() != typeid(std::shared_ptr<DNSResponseAction>)) {
-      throw std::runtime_error("addCacheHitResponseAction() can only be called with response-related actions, not query-related ones. Are you looking for addAction()?");
-    }
-
-    addAction(&g_cachehitrespruleactions, var, boost::get<std::shared_ptr<DNSResponseAction>>(era), params);
-  });
-
-  luaCtx.writeFunction("addCacheInsertedResponseAction", [](const luadnsrule_t& var, boost::variant<std::shared_ptr<DNSAction>, std::shared_ptr<DNSResponseAction>> era, boost::optional<luaruleparams_t> params) {
-    if (era.type() != typeid(std::shared_ptr<DNSResponseAction>)) {
-      throw std::runtime_error("addCacheInsertedResponseAction() can only be called with response-related actions, not query-related ones. Are you looking for addAction()?");
-    }
-
-    addAction(&g_cacheInsertedRespRuleActions, var, boost::get<std::shared_ptr<DNSResponseAction>>(era), params);
-  });
-
-  luaCtx.writeFunction("addSelfAnsweredResponseAction", [](const luadnsrule_t& var, boost::variant<std::shared_ptr<DNSAction>, std::shared_ptr<DNSResponseAction>> era, boost::optional<luaruleparams_t> params) {
-    if (era.type() != typeid(std::shared_ptr<DNSResponseAction>)) {
-      throw std::runtime_error("addSelfAnsweredResponseAction() can only be called with response-related actions, not query-related ones. Are you looking for addAction()?");
-    }
+  for (const auto& chain : dnsdist::rules::getResponseRuleChains()) {
+    const auto fullName = std::string("add") + chain.prefix + std::string("ResponseAction");
+    luaCtx.writeFunction(fullName, [&fullName, &chain](const luadnsrule_t& var, boost::variant<std::shared_ptr<DNSAction>, std::shared_ptr<DNSResponseAction>> era, boost::optional<luaruleparams_t> params) {
+      if (era.type() != typeid(std::shared_ptr<DNSResponseAction>)) {
+        throw std::runtime_error(fullName + "() can only be called with response-related actions, not query-related ones. Are you looking for addAction()?");
+      }
 
-    addAction(&g_selfansweredrespruleactions, var, boost::get<std::shared_ptr<DNSResponseAction>>(era), params);
-  });
+      addAction(&chain.holder, var, boost::get<std::shared_ptr<DNSResponseAction>>(era), params);
+    });
+  }
 
   luaCtx.registerFunction<void (DNSAction::*)() const>("printStats", [](const DNSAction& action) {
     setLuaNoSideEffect();
@@ -2538,7 +2518,7 @@ void setupLuaActions(LuaContext& luaCtx)
   luaCtx.writeFunction("getAction", [](unsigned int num) {
     setLuaNoSideEffect();
     boost::optional<std::shared_ptr<DNSAction>> ret;
-    auto ruleactions = g_ruleactions.getCopy();
+    auto ruleactions = dnsdist::rules::g_ruleactions.getCopy();
     if (num < ruleactions.size()) {
       ret = ruleactions[num].d_action;
     }
diff --git a/pdns/dnsdistdist/dnsdist-lua-rules.cc b/pdns/dnsdistdist/dnsdist-lua-rules.cc
index c02a9f38d1..6209a54ac4 100644
--- a/pdns/dnsdistdist/dnsdist-lua-rules.cc
+++ b/pdns/dnsdistdist/dnsdist-lua-rules.cc
@@ -22,6 +22,7 @@
 #include "dnsdist.hh"
 #include "dnsdist-lua.hh"
 #include "dnsdist-rules.hh"
+#include "dnsdist-rule-chains.hh"
 #include "dns_random.hh"
 
 std::shared_ptr<DNSRule> makeRule(const luadnsrule_t& var, const std::string& calledFrom)
@@ -324,100 +325,67 @@ void setupLuaRules(LuaContext& luaCtx)
 
   luaCtx.registerFunction<uint64_t (std::shared_ptr<DNSRule>::*)() const>("getMatches", [](const std::shared_ptr<DNSRule>& rule) { return rule->d_matches.load(); });
 
-  luaCtx.registerFunction<std::shared_ptr<DNSRule> (DNSDistRuleAction::*)() const>("getSelector", [](const DNSDistRuleAction& rule) { return rule.d_rule; });
+  luaCtx.registerFunction<std::shared_ptr<DNSRule> (dnsdist::rules::RuleAction::*)() const>("getSelector", [](const dnsdist::rules::RuleAction& rule) { return rule.d_rule; });
 
-  luaCtx.registerFunction<std::shared_ptr<DNSAction> (DNSDistRuleAction::*)() const>("getAction", [](const DNSDistRuleAction& rule) { return rule.d_action; });
+  luaCtx.registerFunction<std::shared_ptr<DNSAction> (dnsdist::rules::RuleAction::*)() const>("getAction", [](const dnsdist::rules::RuleAction& rule) { return rule.d_action; });
 
-  luaCtx.registerFunction<std::shared_ptr<DNSRule> (DNSDistResponseRuleAction::*)() const>("getSelector", [](const DNSDistResponseRuleAction& rule) { return rule.d_rule; });
+  luaCtx.registerFunction<std::shared_ptr<DNSRule> (dnsdist::rules::ResponseRuleAction::*)() const>("getSelector", [](const dnsdist::rules::ResponseRuleAction& rule) { return rule.d_rule; });
 
-  luaCtx.registerFunction<std::shared_ptr<DNSResponseAction> (DNSDistResponseRuleAction::*)() const>("getAction", [](const DNSDistResponseRuleAction& rule) { return rule.d_action; });
+  luaCtx.registerFunction<std::shared_ptr<DNSResponseAction> (dnsdist::rules::ResponseRuleAction::*)() const>("getAction", [](const dnsdist::rules::ResponseRuleAction& rule) { return rule.d_action; });
 
-  luaCtx.writeFunction("showResponseRules", [](boost::optional<ruleparams_t> vars) {
-    showRules(&g_respruleactions, vars);
-  });
-
-  luaCtx.writeFunction("rmResponseRule", [](const boost::variant<unsigned int, std::string>& identifier) {
-    rmRule(&g_respruleactions, identifier);
-  });
-
-  luaCtx.writeFunction("mvResponseRuleToTop", []() {
-    moveRuleToTop(&g_respruleactions);
-  });
-
-  luaCtx.writeFunction("mvResponseRule", [](unsigned int from, unsigned int dest) {
-    mvRule(&g_respruleactions, from, dest);
-  });
-
-  luaCtx.writeFunction("showCacheHitResponseRules", [](boost::optional<ruleparams_t> vars) {
-    showRules(&g_cachehitrespruleactions, vars);
-  });
-
-  luaCtx.writeFunction("rmCacheHitResponseRule", [](const boost::variant<unsigned int, std::string>& identifier) {
-    rmRule(&g_cachehitrespruleactions, identifier);
-  });
-
-  luaCtx.writeFunction("mvCacheHitResponseRuleToTop", []() {
-    moveRuleToTop(&g_cachehitrespruleactions);
-  });
-
-  luaCtx.writeFunction("mvCacheHitResponseRule", [](unsigned int from, unsigned int dest) {
-    mvRule(&g_cachehitrespruleactions, from, dest);
-  });
-
-  luaCtx.writeFunction("showCacheInsertedResponseRules", [](boost::optional<ruleparams_t> vars) {
-    showRules(&g_cacheInsertedRespRuleActions, vars);
-  });
-
-  luaCtx.writeFunction("rmCacheInsertedResponseRule", [](const boost::variant<unsigned int, std::string>& identifier) {
-    rmRule(&g_cacheInsertedRespRuleActions, identifier);
-  });
-
-  luaCtx.writeFunction("mvCacheInsertedResponseRuleToTop", []() {
-    moveRuleToTop(&g_cacheInsertedRespRuleActions);
-  });
-
-  luaCtx.writeFunction("mvCacheInsertedResponseRule", [](unsigned int from, unsigned int dest) {
-    mvRule(&g_cacheInsertedRespRuleActions, from, dest);
-  });
-
-  luaCtx.writeFunction("showSelfAnsweredResponseRules", [](boost::optional<ruleparams_t> vars) {
-    showRules(&g_selfansweredrespruleactions, vars);
-  });
-
-  luaCtx.writeFunction("rmSelfAnsweredResponseRule", [](const boost::variant<unsigned int, std::string>& identifier) {
-    rmRule(&g_selfansweredrespruleactions, identifier);
-  });
+  for (const auto& chain : dnsdist::rules::getResponseRuleChains()) {
+    luaCtx.writeFunction("show" + chain.prefix + "ResponseRules", [&chain](boost::optional<ruleparams_t> vars) {
+      showRules(&chain.holder, vars);
+    });
+    luaCtx.writeFunction("rm" + chain.prefix + "ResponseRule", [&chain](const boost::variant<unsigned int, std::string>& identifier) {
+      rmRule(&chain.holder, identifier);
+    });
+    luaCtx.writeFunction("mv" + chain.prefix + "ResponseRuleToTop", [&chain]() {
+      moveRuleToTop(&chain.holder);
+    });
+    luaCtx.writeFunction("mv" + chain.prefix + "ResponseRule", [&chain](unsigned int from, unsigned int dest) {
+      mvRule(&chain.holder, from, dest);
+    });
+    luaCtx.writeFunction("get" + chain.prefix + "ResponseRule", [&chain](const boost::variant<int, std::string>& selector) -> boost::optional<dnsdist::rules::ResponseRuleAction> {
+      auto rules = chain.holder.getLocal();
+      return getRuleFromSelector(*rules, selector);
+    });
 
-  luaCtx.writeFunction("mvSelfAnsweredResponseRuleToTop", []() {
-    moveRuleToTop(&g_selfansweredrespruleactions);
-  });
+    luaCtx.writeFunction("getTop" + chain.prefix + "ResponseRules", [&chain](boost::optional<unsigned int> top) {
+      setLuaNoSideEffect();
+      auto rules = chain.holder.getLocal();
+      return toLuaArray(getTopRules(*rules, (top ? *top : 10)));
+    });
 
-  luaCtx.writeFunction("mvSelfAnsweredResponseRule", [](unsigned int from, unsigned int dest) {
-    mvRule(&g_selfansweredrespruleactions, from, dest);
-  });
+    luaCtx.writeFunction("top" + chain.prefix + "ResponseRules", [&chain](boost::optional<unsigned int> top, boost::optional<ruleparams_t> vars) {
+      setLuaNoSideEffect();
+      auto rules = chain.holder.getLocal();
+      return rulesToString(getTopRules(*rules, (top ? *top : 10)), vars);
+    });
+  }
 
   luaCtx.writeFunction("rmRule", [](const boost::variant<unsigned int, std::string>& identifier) {
-    rmRule(&g_ruleactions, identifier);
+    rmRule(&dnsdist::rules::g_ruleactions, identifier);
   });
 
   luaCtx.writeFunction("mvRuleToTop", []() {
-    moveRuleToTop(&g_ruleactions);
+    moveRuleToTop(&dnsdist::rules::g_ruleactions);
   });
 
   luaCtx.writeFunction("mvRule", [](unsigned int from, unsigned int dest) {
-    mvRule(&g_ruleactions, from, dest);
+    mvRule(&dnsdist::rules::g_ruleactions, from, dest);
   });
 
   luaCtx.writeFunction("clearRules", []() {
     setLuaSideEffect();
-    g_ruleactions.modify([](decltype(g_ruleactions)::value_type& ruleactions) {
+    dnsdist::rules::g_ruleactions.modify([](decltype(dnsdist::rules::g_ruleactions)::value_type& ruleactions) {
       ruleactions.clear();
     });
   });
 
-  luaCtx.writeFunction("setRules", [](const LuaArray<std::shared_ptr<DNSDistRuleAction>>& newruleactions) {
+  luaCtx.writeFunction("setRules", [](const LuaArray<std::shared_ptr<dnsdist::rules::RuleAction>>& newruleactions) {
     setLuaSideEffect();
-    g_ruleactions.modify([newruleactions](decltype(g_ruleactions)::value_type& gruleactions) {
+    dnsdist::rules::g_ruleactions.modify([newruleactions](decltype(dnsdist::rules::g_ruleactions)::value_type& gruleactions) {
       gruleactions.clear();
       for (const auto& pair : newruleactions) {
         const auto& newruleaction = pair.second;
@@ -429,88 +397,20 @@ void setupLuaRules(LuaContext& luaCtx)
     });
   });
 
-  luaCtx.writeFunction("getRule", [](const boost::variant<int, std::string>& selector) -> boost::optional<DNSDistRuleAction> {
-    auto rules = g_ruleactions.getLocal();
+  luaCtx.writeFunction("getRule", [](const boost::variant<int, std::string>& selector) -> boost::optional<dnsdist::rules::RuleAction> {
+    auto rules = dnsdist::rules::g_ruleactions.getLocal();
     return getRuleFromSelector(*rules, selector);
   });
 
   luaCtx.writeFunction("getTopRules", [](boost::optional<unsigned int> top) {
     setLuaNoSideEffect();
-    auto rules = g_ruleactions.getLocal();
+    auto rules = dnsdist::rules::g_ruleactions.getLocal();
     return toLuaArray(getTopRules(*rules, (top ? *top : 10)));
   });
 
   luaCtx.writeFunction("topRules", [](boost::optional<unsigned int> top, boost::optional<ruleparams_t> vars) {
     setLuaNoSideEffect();
-    auto rules = g_ruleactions.getLocal();
-    return rulesToString(getTopRules(*rules, (top ? *top : 10)), vars);
-  });
-
-  luaCtx.writeFunction("getCacheHitResponseRule", [](const boost::variant<int, std::string>& selector) -> boost::optional<DNSDistResponseRuleAction> {
-    auto rules = g_cachehitrespruleactions.getLocal();
-    return getRuleFromSelector(*rules, selector);
-  });
-
-  luaCtx.writeFunction("getTopCacheHitResponseRules", [](boost::optional<unsigned int> top) {
-    setLuaNoSideEffect();
-    auto rules = g_cachehitrespruleactions.getLocal();
-    return toLuaArray(getTopRules(*rules, (top ? *top : 10)));
-  });
-
-  luaCtx.writeFunction("topCacheHitResponseRules", [](boost::optional<unsigned int> top, boost::optional<ruleparams_t> vars) {
-    setLuaNoSideEffect();
-    auto rules = g_cachehitrespruleactions.getLocal();
-    return rulesToString(getTopRules(*rules, (top ? *top : 10)), vars);
-  });
-
-  luaCtx.writeFunction("getCacheInsertedResponseRule", [](const boost::variant<int, std::string>& selector) -> boost::optional<DNSDistResponseRuleAction> {
-    auto rules = g_cacheInsertedRespRuleActions.getLocal();
-    return getRuleFromSelector(*rules, selector);
-  });
-
-  luaCtx.writeFunction("getTopCacheInsertedResponseRules", [](boost::optional<unsigned int> top) {
-    setLuaNoSideEffect();
-    auto rules = g_cacheInsertedRespRuleActions.getLocal();
-    return toLuaArray(getTopRules(*rules, (top ? *top : 10)));
-  });
-
-  luaCtx.writeFunction("topCacheInsertedResponseRules", [](boost::optional<unsigned int> top, boost::optional<ruleparams_t> vars) {
-    setLuaNoSideEffect();
-    auto rules = g_cacheInsertedRespRuleActions.getLocal();
-    return rulesToString(getTopRules(*rules, (top ? *top : 10)), vars);
-  });
-
-  luaCtx.writeFunction("getResponseRule", [](const boost::variant<int, std::string>& selector) -> boost::optional<DNSDistResponseRuleAction> {
-    auto rules = g_respruleactions.getLocal();
-    return getRuleFromSelector(*rules, selector);
-  });
-
-  luaCtx.writeFunction("getTopResponseRules", [](boost::optional<unsigned int> top) {
-    setLuaNoSideEffect();
-    auto rules = g_respruleactions.getLocal();
-    return toLuaArray(getTopRules(*rules, (top ? *top : 10)));
-  });
-
-  luaCtx.writeFunction("topResponseRules", [](boost::optional<unsigned int> top, boost::optional<ruleparams_t> vars) {
-    setLuaNoSideEffect();
-    auto rules = g_respruleactions.getLocal();
-    return rulesToString(getTopRules(*rules, (top ? *top : 10)), vars);
-  });
-
-  luaCtx.writeFunction("getSelfAnsweredResponseRule", [](const boost::variant<int, std::string>& selector) -> boost::optional<DNSDistResponseRuleAction> {
-    auto rules = g_selfansweredrespruleactions.getLocal();
-    return getRuleFromSelector(*rules, selector);
-  });
-
-  luaCtx.writeFunction("getTopSelfAnsweredResponseRules", [](boost::optional<unsigned int> top) {
-    setLuaNoSideEffect();
-    auto rules = g_selfansweredrespruleactions.getLocal();
-    return toLuaArray(getTopRules(*rules, (top ? *top : 10)));
-  });
-
-  luaCtx.writeFunction("topSelfAnsweredResponseRules", [](boost::optional<unsigned int> top, boost::optional<ruleparams_t> vars) {
-    setLuaNoSideEffect();
-    auto rules = g_selfansweredrespruleactions.getLocal();
+    auto rules = dnsdist::rules::g_ruleactions.getLocal();
     return rulesToString(getTopRules(*rules, (top ? *top : 10)), vars);
   });
 
@@ -728,7 +628,7 @@ void setupLuaRules(LuaContext& luaCtx)
   });
 
   luaCtx.writeFunction("showRules", [](boost::optional<ruleparams_t> vars) {
-    showRules(&g_ruleactions, vars);
+    showRules(&dnsdist::rules::g_ruleactions, vars);
   });
 
   luaCtx.writeFunction("RDRule", []() {
diff --git a/pdns/dnsdistdist/dnsdist-rule-chains.cc b/pdns/dnsdistdist/dnsdist-rule-chains.cc
new file mode 100644
index 0000000000..fd736aeedb
--- /dev/null
+++ b/pdns/dnsdistdist/dnsdist-rule-chains.cc
@@ -0,0 +1,49 @@
+/*
+ * This file is part of PowerDNS or dnsdist.
+ * Copyright -- PowerDNS.COM B.V. and its contributors
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * In addition, for the avoidance of any doubt, permission is granted to
+ * link this program with OpenSSL and to (re)distribute the binaries
+ * produced as the result of such linking.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#include "dnsdist-rule-chains.hh"
+
+namespace dnsdist::rules
+{
+GlobalStateHolder<std::vector<RuleAction>> g_ruleactions;
+GlobalStateHolder<std::vector<ResponseRuleAction>> s_respruleactions;
+GlobalStateHolder<std::vector<ResponseRuleAction>> s_cachehitrespruleactions;
+GlobalStateHolder<std::vector<ResponseRuleAction>> s_selfansweredrespruleactions;
+GlobalStateHolder<std::vector<ResponseRuleAction>> s_cacheInsertedRespRuleActions;
+
+static const std::vector<ResponseRuleChainDescription> s_responseRuleChains{
+  {"", "response-rules", s_respruleactions},
+  {"CacheHit", "cache-hit-response-rules", s_cachehitrespruleactions},
+  {"CacheInserted", "cache-inserted-response-rules", s_selfansweredrespruleactions},
+  {"SelfAnswered", "self-answered-response-rules", s_cacheInsertedRespRuleActions},
+};
+
+const std::vector<ResponseRuleChainDescription>& getResponseRuleChains()
+{
+  return s_responseRuleChains;
+}
+
+GlobalStateHolder<std::vector<ResponseRuleAction>>& getResponseRuleChainHolder(ResponseRuleChain chain)
+{
+  return s_responseRuleChains.at(static_cast<size_t>(chain)).holder;
+}
+}
diff --git a/pdns/dnsdistdist/dnsdist-rule-chains.hh b/pdns/dnsdistdist/dnsdist-rule-chains.hh
new file mode 100644
index 0000000000..1d1a93dee6
--- /dev/null
+++ b/pdns/dnsdistdist/dnsdist-rule-chains.hh
@@ -0,0 +1,76 @@
+/*
+ * This file is part of PowerDNS or dnsdist.
+ * Copyright -- PowerDNS.COM B.V. and its contributors
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * In addition, for the avoidance of any doubt, permission is granted to
+ * link this program with OpenSSL and to (re)distribute the binaries
+ * produced as the result of such linking.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+#pragma once
+
+#include <memory>
+#include <string>
+#include <vector>
+
+#include "sholder.hh"
+#include "uuid-utils.hh"
+
+class DNSRule;
+class DNSAction;
+class DNSResponseAction;
+
+namespace dnsdist::rules
+{
+enum class ResponseRuleChain : uint8_t
+{
+  ResponseRules = 0,
+  CacheHitResponseRules = 1,
+  CacheInsertedResponseRules = 2,
+  SelfAnsweredResponseRules = 3,
+  ResponseRuleChainsCount = 4
+};
+
+struct RuleAction
+{
+  std::shared_ptr<DNSRule> d_rule;
+  std::shared_ptr<DNSAction> d_action;
+  std::string d_name;
+  boost::uuids::uuid d_id;
+  uint64_t d_creationOrder;
+};
+
+struct ResponseRuleAction
+{
+  std::shared_ptr<DNSRule> d_rule;
+  std::shared_ptr<DNSResponseAction> d_action;
+  std::string d_name;
+  boost::uuids::uuid d_id;
+  uint64_t d_creationOrder;
+};
+
+struct ResponseRuleChainDescription
+{
+  std::string prefix;
+  std::string metricName;
+  GlobalStateHolder<std::vector<ResponseRuleAction>>& holder;
+};
+
+extern GlobalStateHolder<std::vector<RuleAction>> g_ruleactions;
+
+const std::vector<ResponseRuleChainDescription>& getResponseRuleChains();
+GlobalStateHolder<std::vector<ResponseRuleAction>>& getResponseRuleChainHolder(ResponseRuleChain chain);
+
+}
diff --git a/pdns/dnsdistdist/dnsdist-tcp-upstream.hh b/pdns/dnsdistdist/dnsdist-tcp-upstream.hh
index c6410df0c9..052d9e43c9 100644
--- a/pdns/dnsdistdist/dnsdist-tcp-upstream.hh
+++ b/pdns/dnsdistdist/dnsdist-tcp-upstream.hh
@@ -10,13 +10,13 @@ class TCPClientThreadData
 {
 public:
   TCPClientThreadData():
-    localRespRuleActions(g_respruleactions.getLocal()), localCacheInsertedRespRuleActions(g_cacheInsertedRespRuleActions.getLocal()), mplexer(std::unique_ptr<FDMultiplexer>(FDMultiplexer::getMultiplexerSilent()))
+    localRespRuleActions(dnsdist::rules::getResponseRuleChainHolder(dnsdist::rules::ResponseRuleChain::ResponseRules).getLocal()), localCacheInsertedRespRuleActions(dnsdist::rules::getResponseRuleChainHolder(dnsdist::rules::ResponseRuleChain::CacheInsertedResponseRules).getLocal()), mplexer(std::unique_ptr<FDMultiplexer>(FDMultiplexer::getMultiplexerSilent()))
   {
   }
 
   LocalHolders holders;
-  LocalStateHolder<vector<DNSDistResponseRuleAction>> localRespRuleActions;
-  LocalStateHolder<vector<DNSDistResponseRuleAction>> localCacheInsertedRespRuleActions;
+  LocalStateHolder<vector<dnsdist::rules::ResponseRuleAction>> localRespRuleActions;
+  LocalStateHolder<vector<dnsdist::rules::ResponseRuleAction>> localCacheInsertedRespRuleActions;
   std::unique_ptr<FDMultiplexer> mplexer{nullptr};
   pdns::channel::Receiver<ConnectionInfo> queryReceiver;
   pdns::channel::Receiver<CrossProtocolQuery> crossProtocolQueryReceiver;
diff --git a/pdns/dnsdistdist/dnsdist-web.cc b/pdns/dnsdistdist/dnsdist-web.cc
index 12bedb622e..696915017f 100644
--- a/pdns/dnsdistdist/dnsdist-web.cc
+++ b/pdns/dnsdistdist/dnsdist-web.cc
@@ -37,6 +37,7 @@
 #include "dnsdist-metrics.hh"
 #include "dnsdist-prometheus.hh"
 #include "dnsdist-rings.hh"
+#include "dnsdist-rule-chains.hh"
 #include "dnsdist-web.hh"
 #include "dolog.hh"
 #include "gettime.hh"
@@ -891,11 +892,10 @@ static void handlePrometheus(const YaHTTP::Request& req, YaHTTP::Response& resp)
 
   output << "# HELP dnsdist_rule_hits " << "Number of hits of that rule" << "\n";
   output << "# TYPE dnsdist_rule_hits " << "counter" << "\n";
-  addRulesToPrometheusOutput(output, g_ruleactions);
-  addRulesToPrometheusOutput(output, g_respruleactions);
-  addRulesToPrometheusOutput(output, g_cachehitrespruleactions);
-  addRulesToPrometheusOutput(output, g_cacheInsertedRespRuleActions);
-  addRulesToPrometheusOutput(output, g_selfansweredrespruleactions);
+  addRulesToPrometheusOutput(output, dnsdist::rules::g_ruleactions);
+  for (const auto& chain : dnsdist::rules::getResponseRuleChains()) {
+    addRulesToPrometheusOutput(output, chain.holder);
+  }
 
 #ifndef DISABLE_DYNBLOCKS
   output << "# HELP dnsdist_dynblocks_nmg_top_offenders_hits_per_second " << "Number of hits per second blocked by Dynamic Blocks (netmasks) for the top offenders, averaged over the last 60s" << "\n";
@@ -1269,7 +1269,7 @@ static void handleStats(const YaHTTP::Request& req, YaHTTP::Response& resp)
   /* unfortunately DNSActions have getStats(),
      and DNSResponseActions do not. */
   {
-    auto localRules = g_ruleactions.getLocal();
+    auto localRules = dnsdist::rules::g_ruleactions.getLocal();
     num = 0;
     rules.reserve(localRules->size());
     for (const auto& lrule : *localRules) {
@@ -1285,10 +1285,6 @@ static void handleStats(const YaHTTP::Request& req, YaHTTP::Response& resp)
       rules.emplace_back(std::move(rule));
     }
   }
-  auto responseRules = someResponseRulesToJson(&g_respruleactions);
-  auto cacheHitResponseRules = someResponseRulesToJson(&g_cachehitrespruleactions);
-  auto cacheInsertedResponseRules = someResponseRulesToJson(&g_cacheInsertedRespRuleActions);
-  auto selfAnsweredResponseRules = someResponseRulesToJson(&g_selfansweredrespruleactions);
 
   string acl;
   {
@@ -1319,23 +1315,24 @@ static void handleStats(const YaHTTP::Request& req, YaHTTP::Response& resp)
   Json::object stats;
   addStatsToJSONObject(stats);
 
-  Json responseObject(Json::object({{"daemon_type", "dnsdist"},
-                                    {"version", VERSION},
-                                    {"servers", std::move(servers)},
-                                    {"frontends", std::move(frontends)},
-                                    {"pools", std::move(pools)},
-                                    {"rules", std::move(rules)},
-                                    {"response-rules", std::move(responseRules)},
-                                    {"cache-hit-response-rules", std::move(cacheHitResponseRules)},
-                                    {"cache-inserted-response-rules", std::move(cacheInsertedResponseRules)},
-                                    {"self-answered-response-rules", std::move(selfAnsweredResponseRules)},
-                                    {"acl", std::move(acl)},
-                                    {"local", std::move(localaddressesStr)},
-                                    {"dohFrontends", std::move(dohs)},
-                                    {"statistics", std::move(stats)}}));
+  Json::object responseObject{{"daemon_type", "dnsdist"},
+                              {"version", VERSION},
+                              {"servers", std::move(servers)},
+                              {"frontends", std::move(frontends)},
+                              {"pools", std::move(pools)},
+                              {"rules", std::move(rules)},
+                              {"acl", std::move(acl)},
+                              {"local", std::move(localaddressesStr)},
+                              {"dohFrontends", std::move(dohs)},
+                              {"statistics", std::move(stats)}};
+
+  for (const auto& chain : dnsdist::rules::getResponseRuleChains()) {
+    auto responseRules = someResponseRulesToJson(&chain.holder);
+    responseObject[chain.metricName] = std::move(responseRules);
+  }
 
   resp.headers["Content-Type"] = "application/json";
-  resp.body = responseObject.dump();
+  resp.body = Json(responseObject).dump();
 }
 
 static void handlePoolStats(const YaHTTP::Request& req, YaHTTP::Response& resp)
@@ -1402,25 +1399,25 @@ static void handleStatsOnly(const YaHTTP::Request& req, YaHTTP::Response& resp)
       }
 
       if (const auto& val = std::get_if<pdns::stat_t*>(&item.d_value)) {
-        doc.push_back(Json::object{
+        doc.emplace_back(Json::object{
           {"type", "StatisticItem"},
           {"name", item.d_name},
           {"value", (double)(*val)->load()}});
       }
       else if (const auto& adval = std::get_if<pdns::stat_t_trait<double>*>(&item.d_value)) {
-        doc.push_back(Json::object{
+        doc.emplace_back(Json::object{
           {"type", "StatisticItem"},
           {"name", item.d_name},
           {"value", (*adval)->load()}});
       }
       else if (const auto& dval = std::get_if<double*>(&item.d_value)) {
-        doc.push_back(Json::object{
+        doc.emplace_back(Json::object{
           {"type", "StatisticItem"},
           {"name", item.d_name},
           {"value", (**dval)}});
       }
       else if (const auto& func = std::get_if<dnsdist::metrics::Stats::statfunction_t>(&item.d_value)) {
-        doc.push_back(Json::object{
+        doc.emplace_back(Json::object{
           {"type", "StatisticItem"},
           {"name", item.d_name},
           {"value", (double)(*func)(item.d_name)}});
@@ -1458,19 +1455,19 @@ static void handleConfigDump(const YaHTTP::Request& req, YaHTTP::Response& resp)
     {"verbose-health-checks", g_verboseHealthChecks}};
   for (const auto& item : configEntries) {
     if (const auto& bval = boost::get<bool>(&item.second)) {
-      doc.push_back(Json::object{
+      doc.emplace_back(Json::object{
         {"type", "ConfigSetting"},
         {"name", item.first},
         {"value", *bval}});
     }
     else if (const auto& sval = boost::get<string>(&item.second)) {
-      doc.push_back(Json::object{
+      doc.emplace_back(Json::object{
         {"type", "ConfigSetting"},
         {"name", item.first},
         {"value", *sval}});
     }
     else if (const auto& dval = boost::get<double>(&item.second)) {
-      doc.push_back(Json::object{
+      doc.emplace_back(Json::object{
         {"type", "ConfigSetting"},
         {"name", item.first},
         {"value", *dval}});
diff --git a/pdns/dnsdistdist/dnsdist-xsk.cc b/pdns/dnsdistdist/dnsdist-xsk.cc
index 058e381908..8ef59833a1 100644
--- a/pdns/dnsdistdist/dnsdist-xsk.cc
+++ b/pdns/dnsdistdist/dnsdist-xsk.cc
@@ -39,8 +39,8 @@ void XskResponderThread(std::shared_ptr<DownstreamState> dss, std::shared_ptr<Xs
 {
   try {
     setThreadName("dnsdist/XskResp");
-    auto localRespRuleActions = g_respruleactions.getLocal();
-    auto localCacheInsertedRespRuleActions = g_cacheInsertedRespRuleActions.getLocal();
+    auto localRespRuleActions = dnsdist::rules::getResponseRuleChainHolder(dnsdist::rules::ResponseRuleChain::ResponseRules).getLocal();
+    auto localCacheInsertedRespRuleActions = dnsdist::rules::getResponseRuleChainHolder(dnsdist::rules::ResponseRuleChain::CacheInsertedResponseRules).getLocal();
     auto pollfds = getPollFdsForWorker(*xskInfo);
     while (!dss->isStopped()) {
       poll(pollfds.data(), pollfds.size(), -1);
diff --git a/pdns/dnsdistdist/dnsdist.cc b/pdns/dnsdistdist/dnsdist.cc
index 3147fe3cf8..423091b584 100644
--- a/pdns/dnsdistdist/dnsdist.cc
+++ b/pdns/dnsdistdist/dnsdist.cc
@@ -138,12 +138,6 @@ std::vector<uint32_t> g_TCPFastOpenKey;
    IDs are assigned by atomic increments of the socket offset.
  */
 
-GlobalStateHolder<vector<DNSDistRuleAction>> g_ruleactions;
-GlobalStateHolder<vector<DNSDistResponseRuleAction>> g_respruleactions;
-GlobalStateHolder<vector<DNSDistResponseRuleAction>> g_cachehitrespruleactions;
-GlobalStateHolder<vector<DNSDistResponseRuleAction>> g_cacheInsertedRespRuleActions;
-GlobalStateHolder<vector<DNSDistResponseRuleAction>> g_selfansweredrespruleactions;
-
 Rings g_rings;
 QueryCount g_qcount;
 
@@ -520,7 +514,7 @@ static bool encryptResponse(PacketBuffer& response, size_t maximumSize, bool tcp
 }
 #endif /* HAVE_DNSCRYPT */
 
-static bool applyRulesToResponse(const std::vector<DNSDistResponseRuleAction>& respRuleActions, DNSResponse& dnsResponse)
+static bool applyRulesToResponse(const std::vector<dnsdist::rules::ResponseRuleAction>& respRuleActions, DNSResponse& dnsResponse)
 {
   DNSResponseAction::Action action = DNSResponseAction::Action::None;
   std::string ruleresult;
@@ -570,7 +564,7 @@ static bool applyRulesToResponse(const std::vector<DNSDistResponseRuleAction>& r
   return true;
 }
 
-bool processResponseAfterRules(PacketBuffer& response, const std::vector<DNSDistResponseRuleAction>& cacheInsertedRespRuleActions, DNSResponse& dnsResponse, bool muted)
+bool processResponseAfterRules(PacketBuffer& response, const std::vector<dnsdist::rules::ResponseRuleAction>& cacheInsertedRespRuleActions, DNSResponse& dnsResponse, bool muted)
 {
   bool zeroScope = false;
   if (!fixUpResponse(response, dnsResponse.ids.qname, dnsResponse.ids.origFlags, dnsResponse.ids.ednsAdded, dnsResponse.ids.ecsAdded, dnsResponse.ids.useZeroScope ? &zeroScope : nullptr)) {
@@ -626,7 +620,7 @@ bool processResponseAfterRules(PacketBuffer& response, const std::vector<DNSDist
   return true;
 }
 
-bool processResponse(PacketBuffer& response, const std::vector<DNSDistResponseRuleAction>& respRuleActions, const std::vector<DNSDistResponseRuleAction>& cacheInsertedRespRuleActions, DNSResponse& dnsResponse, bool muted)
+bool processResponse(PacketBuffer& response, const std::vector<dnsdist::rules::ResponseRuleAction>& respRuleActions, const std::vector<dnsdist::rules::ResponseRuleAction>& cacheInsertedRespRuleActions, DNSResponse& dnsResponse, bool muted)
 {
   if (!applyRulesToResponse(respRuleActions, dnsResponse)) {
     return false;
@@ -713,7 +707,7 @@ void handleResponseSent(const DNSName& qname, const QType& qtype, double udiff,
   doLatencyStats(incomingProtocol, udiff);
 }
 
-static void handleResponseForUDPClient(InternalQueryState& ids, PacketBuffer& response, const std::vector<DNSDistResponseRuleAction>& respRuleActions, const std::vector<DNSDistResponseRuleAction>& cacheInsertedRespRuleActions, const std::shared_ptr<DownstreamState>& backend, bool isAsync, bool selfGenerated)
+static void handleResponseForUDPClient(InternalQueryState& ids, PacketBuffer& response, const std::vector<dnsdist::rules::ResponseRuleAction>& respRuleActions, const std::vector<dnsdist::rules::ResponseRuleAction>& cacheInsertedRespRuleActions, const std::shared_ptr<DownstreamState>& backend, bool isAsync, bool selfGenerated)
 {
   DNSResponse dnsResponse(ids, response, backend);
 
@@ -776,7 +770,7 @@ static void handleResponseForUDPClient(InternalQueryState& ids, PacketBuffer& re
   }
 }
 
-bool processResponderPacket(std::shared_ptr<DownstreamState>& dss, PacketBuffer& response, const std::vector<DNSDistResponseRuleAction>& localRespRuleActions, const std::vector<DNSDistResponseRuleAction>& cacheInsertedRespRuleActions, InternalQueryState&& ids)
+bool processResponderPacket(std::shared_ptr<DownstreamState>& dss, PacketBuffer& response, const std::vector<dnsdist::rules::ResponseRuleAction>& localRespRuleActions, const std::vector<dnsdist::rules::ResponseRuleAction>& cacheInsertedRespRuleActions, InternalQueryState&& ids)
 {
 
   const dnsheader_aligned dnsHeader(response.data());
@@ -817,8 +811,8 @@ void responderThread(std::shared_ptr<DownstreamState> dss)
 {
   try {
     setThreadName("dnsdist/respond");
-    auto localRespRuleActions = g_respruleactions.getLocal();
-    auto localCacheInsertedRespRuleActions = g_cacheInsertedRespRuleActions.getLocal();
+    auto localRespRuleActions = dnsdist::rules::getResponseRuleChainHolder(dnsdist::rules::ResponseRuleChain::ResponseRules).getLocal();
+    auto localCacheInsertedRespRuleActions = dnsdist::rules::getResponseRuleChainHolder(dnsdist::rules::ResponseRuleChain::CacheInsertedResponseRules).getLocal();
     const size_t initialBufferSize = getInitialUDPPacketBufferSize(false);
     /* allocate one more byte so we can detect truncation */
     PacketBuffer response(initialBufferSize + 1);
@@ -1603,8 +1597,8 @@ public:
 
     auto& ids = response.d_idstate;
 
-    static thread_local LocalStateHolder<vector<DNSDistResponseRuleAction>> localRespRuleActions = g_respruleactions.getLocal();
-    static thread_local LocalStateHolder<vector<DNSDistResponseRuleAction>> localCacheInsertedRespRuleActions = g_cacheInsertedRespRuleActions.getLocal();
+    static thread_local LocalStateHolder<vector<dnsdist::rules::ResponseRuleAction>> localRespRuleActions = dnsdist::rules::getResponseRuleChainHolder(dnsdist::rules::ResponseRuleChain::ResponseRules).getLocal();
+    static thread_local LocalStateHolder<vector<dnsdist::rules::ResponseRuleAction>> localCacheInsertedRespRuleActions = dnsdist::rules::getResponseRuleChainHolder(dnsdist::rules::ResponseRuleChain::CacheInsertedResponseRules).getLocal();
 
     handleResponseForUDPClient(ids, response.d_buffer, *localRespRuleActions, *localCacheInsertedRespRuleActions, response.d_ds, response.isAsync(), response.d_idstate.selfGenerated);
   }
@@ -2746,10 +2740,10 @@ static void cleanupLuaObjects()
 {
   /* when our coverage mode is enabled, we need to make sure
      that the Lua objects are destroyed before the Lua contexts. */
-  g_ruleactions.setState({});
-  g_respruleactions.setState({});
-  g_cachehitrespruleactions.setState({});
-  g_selfansweredrespruleactions.setState({});
+  dnsdist::rules::g_ruleactions.setState({});
+  for (const auto& chain : dnsdist::rules::getResponseRuleChains()) {
+    chain.holder.setState({});
+  }
   g_dstates.setState({});
   g_policy.setState(ServerPolicy());
   g_pools.setState({});
diff --git a/pdns/dnsdistdist/dnsdist.hh b/pdns/dnsdistdist/dnsdist.hh
index 7c5d77a7c5..a725f7de51 100644
--- a/pdns/dnsdistdist/dnsdist.hh
+++ b/pdns/dnsdistdist/dnsdist.hh
@@ -1147,35 +1147,12 @@ enum ednsHeaderFlags
   EDNS_HEADER_FLAG_DO = 32768
 };
 
-struct DNSDistRuleAction
-{
-  std::shared_ptr<DNSRule> d_rule;
-  std::shared_ptr<DNSAction> d_action;
-  std::string d_name;
-  boost::uuids::uuid d_id;
-  uint64_t d_creationOrder;
-};
-
-struct DNSDistResponseRuleAction
-{
-  std::shared_ptr<DNSRule> d_rule;
-  std::shared_ptr<DNSResponseAction> d_action;
-  std::string d_name;
-  boost::uuids::uuid d_id;
-  uint64_t d_creationOrder;
-};
-
 extern GlobalStateHolder<SuffixMatchTree<DynBlock>> g_dynblockSMT;
 extern DNSAction::Action g_dynBlockAction;
 
 extern GlobalStateHolder<ServerPolicy> g_policy;
 extern GlobalStateHolder<servers_t> g_dstates;
 extern GlobalStateHolder<pools_t> g_pools;
-extern GlobalStateHolder<vector<DNSDistRuleAction>> g_ruleactions;
-extern GlobalStateHolder<vector<DNSDistResponseRuleAction>> g_respruleactions;
-extern GlobalStateHolder<vector<DNSDistResponseRuleAction>> g_cachehitrespruleactions;
-extern GlobalStateHolder<vector<DNSDistResponseRuleAction>> g_selfansweredrespruleactions;
-extern GlobalStateHolder<vector<DNSDistResponseRuleAction>> g_cacheInsertedRespRuleActions;
 extern GlobalStateHolder<NetmaskGroup> g_ACL;
 
 extern ComboAddress g_serverControl; // not changed during runtime
@@ -1210,25 +1187,6 @@ extern uint32_t g_socketUDPRecvBuffer;
 extern shared_ptr<BPFFilter> g_defaultBPFFilter;
 extern std::vector<std::shared_ptr<DynBPFFilter>> g_dynBPFFilters;
 
-struct LocalHolders
-{
-  LocalHolders() :
-    acl(g_ACL.getLocal()), policy(g_policy.getLocal()), ruleactions(g_ruleactions.getLocal()), cacheHitRespRuleactions(g_cachehitrespruleactions.getLocal()), cacheInsertedRespRuleActions(g_cacheInsertedRespRuleActions.getLocal()), selfAnsweredRespRuleactions(g_selfansweredrespruleactions.getLocal()), servers(g_dstates.getLocal()), dynNMGBlock(g_dynblockNMG.getLocal()), dynSMTBlock(g_dynblockSMT.getLocal()), pools(g_pools.getLocal())
-  {
-  }
-
-  LocalStateHolder<NetmaskGroup> acl;
-  LocalStateHolder<ServerPolicy> policy;
-  LocalStateHolder<vector<DNSDistRuleAction>> ruleactions;
-  LocalStateHolder<vector<DNSDistResponseRuleAction>> cacheHitRespRuleactions;
-  LocalStateHolder<vector<DNSDistResponseRuleAction>> cacheInsertedRespRuleActions;
-  LocalStateHolder<vector<DNSDistResponseRuleAction>> selfAnsweredRespRuleactions;
-  LocalStateHolder<servers_t> servers;
-  LocalStateHolder<NetmaskTree<DynBlock, AddressAndPortRange>> dynNMGBlock;
-  LocalStateHolder<SuffixMatchTree<DynBlock>> dynSMTBlock;
-  LocalStateHolder<pools_t> pools;
-};
-
 void tcpAcceptorThread(const std::vector<ClientState*>& states);
 
 void setLuaNoSideEffect(); // if nothing has been declared, set that there are no side effects
@@ -1261,12 +1219,34 @@ enum class ProcessQueryResult : uint8_t
   PassToBackend,
   Asynchronous
 };
+
+#include "dnsdist-rule-chains.hh"
+
+struct LocalHolders
+{
+  LocalHolders() :
+    acl(g_ACL.getLocal()), policy(g_policy.getLocal()), ruleactions(dnsdist::rules::g_ruleactions.getLocal()), cacheHitRespRuleactions(dnsdist::rules::getResponseRuleChainHolder(dnsdist::rules::ResponseRuleChain::CacheHitResponseRules).getLocal()), cacheInsertedRespRuleActions(dnsdist::rules::getResponseRuleChainHolder(dnsdist::rules::ResponseRuleChain::CacheInsertedResponseRules).getLocal()), selfAnsweredRespRuleactions(dnsdist::rules::getResponseRuleChainHolder(dnsdist::rules::ResponseRuleChain::SelfAnsweredResponseRules).getLocal()), servers(g_dstates.getLocal()), dynNMGBlock(g_dynblockNMG.getLocal()), dynSMTBlock(g_dynblockSMT.getLocal()), pools(g_pools.getLocal())
+  {
+  }
+
+  LocalStateHolder<NetmaskGroup> acl;
+  LocalStateHolder<ServerPolicy> policy;
+  LocalStateHolder<vector<dnsdist::rules::RuleAction>> ruleactions;
+  LocalStateHolder<vector<dnsdist::rules::ResponseRuleAction>> cacheHitRespRuleactions;
+  LocalStateHolder<vector<dnsdist::rules::ResponseRuleAction>> cacheInsertedRespRuleActions;
+  LocalStateHolder<vector<dnsdist::rules::ResponseRuleAction>> selfAnsweredRespRuleactions;
+  LocalStateHolder<servers_t> servers;
+  LocalStateHolder<NetmaskTree<DynBlock, AddressAndPortRange>> dynNMGBlock;
+  LocalStateHolder<SuffixMatchTree<DynBlock>> dynSMTBlock;
+  LocalStateHolder<pools_t> pools;
+};
+
 ProcessQueryResult processQuery(DNSQuestion& dnsQuestion, LocalHolders& holders, std::shared_ptr<DownstreamState>& selectedBackend);
 ProcessQueryResult processQueryAfterRules(DNSQuestion& dnsQuestion, LocalHolders& holders, std::shared_ptr<DownstreamState>& selectedBackend);
-bool processResponse(PacketBuffer& response, const std::vector<DNSDistResponseRuleAction>& respRuleActions, const std::vector<DNSDistResponseRuleAction>& insertedRespRuleActions, DNSResponse& dnsResponse, bool muted);
+bool processResponse(PacketBuffer& response, const std::vector<dnsdist::rules::ResponseRuleAction>& respRuleActions, const std::vector<dnsdist::rules::ResponseRuleAction>& insertedRespRuleActions, DNSResponse& dnsResponse, bool muted);
 bool processRulesResult(const DNSAction::Action& action, DNSQuestion& dnsQuestion, std::string& ruleresult, bool& drop);
-bool processResponseAfterRules(PacketBuffer& response, const std::vector<DNSDistResponseRuleAction>& cacheInsertedRespRuleActions, DNSResponse& dnsResponse, bool muted);
-bool processResponderPacket(std::shared_ptr<DownstreamState>& dss, PacketBuffer& response, const std::vector<DNSDistResponseRuleAction>& localRespRuleActions, const std::vector<DNSDistResponseRuleAction>& cacheInsertedRespRuleActions, InternalQueryState&& ids);
+bool processResponseAfterRules(PacketBuffer& response, const std::vector<dnsdist::rules::ResponseRuleAction>& cacheInsertedRespRuleActions, DNSResponse& dnsResponse, bool muted);
+bool processResponderPacket(std::shared_ptr<DownstreamState>& dss, PacketBuffer& response, const std::vector<dnsdist::rules::ResponseRuleAction>& localRespRuleActions, const std::vector<dnsdist::rules::ResponseRuleAction>& cacheInsertedRespRuleActions, InternalQueryState&& ids);
 
 bool assignOutgoingUDPQueryToBackend(std::shared_ptr<DownstreamState>& downstream, uint16_t queryID, DNSQuestion& dnsQuestion, PacketBuffer& query, bool actuallySend = true);
 
diff --git a/pdns/dnsdistdist/doh.cc b/pdns/dnsdistdist/doh.cc
index 5ecdd00f6f..aecb627bdb 100644
--- a/pdns/dnsdistdist/doh.cc
+++ b/pdns/dnsdistdist/doh.cc
@@ -503,8 +503,8 @@ public:
     memcpy(&cleartextDH, dr.getHeader().get(), sizeof(cleartextDH));
 
     if (!response.isAsync()) {
-      static thread_local LocalStateHolder<vector<DNSDistResponseRuleAction>> localRespRuleActions = g_respruleactions.getLocal();
-      static thread_local LocalStateHolder<vector<DNSDistResponseRuleAction>> localCacheInsertedRespRuleActions = g_cacheInsertedRespRuleActions.getLocal();
+      static thread_local LocalStateHolder<vector<dnsdist::rules::ResponseRuleAction>> localRespRuleActions = dnsdist::rules::getResponseRuleChainHolder(dnsdist::rules::ResponseRuleChain::ResponseRules).getLocal();
+      static thread_local LocalStateHolder<vector<dnsdist::rules::ResponseRuleAction>> localCacheInsertedRespRuleActions = dnsdist::rules::getResponseRuleChainHolder(dnsdist::rules::ResponseRuleChain::CacheInsertedResponseRules).getLocal();
 
       dr.ids.du = std::move(dohUnit);
 
@@ -1649,8 +1649,8 @@ void DOHUnit::handleUDPResponse(PacketBuffer&& udpResponse, InternalQueryState&&
     }
   }
   if (!dohUnit->truncated) {
-    static thread_local LocalStateHolder<vector<DNSDistResponseRuleAction>> localRespRuleActions = g_respruleactions.getLocal();
-    static thread_local LocalStateHolder<vector<DNSDistResponseRuleAction>> localCacheInsertedRespRuleActions = g_cacheInsertedRespRuleActions.getLocal();
+    static thread_local LocalStateHolder<vector<dnsdist::rules::ResponseRuleAction>> localRespRuleActions = dnsdist::rules::getResponseRuleChainHolder(dnsdist::rules::ResponseRuleChain::ResponseRules).getLocal();
+    static thread_local LocalStateHolder<vector<dnsdist::rules::ResponseRuleAction>> localCacheInsertedRespRuleActions = dnsdist::rules::getResponseRuleChainHolder(dnsdist::rules::ResponseRuleChain::CacheInsertedResponseRules).getLocal();
 
     DNSResponse dnsResponse(dohUnit->ids, udpResponse, dohUnit->downstream);
     dnsheader cleartextDH{};
diff --git a/pdns/dnsdistdist/doh3.cc b/pdns/dnsdistdist/doh3.cc
index d5216aa640..26b3cf5686 100644
--- a/pdns/dnsdistdist/doh3.cc
+++ b/pdns/dnsdistdist/doh3.cc
@@ -141,8 +141,8 @@ public:
 
     if (!response.isAsync()) {
 
-      static thread_local LocalStateHolder<vector<DNSDistResponseRuleAction>> localRespRuleActions = g_respruleactions.getLocal();
-      static thread_local LocalStateHolder<vector<DNSDistResponseRuleAction>> localCacheInsertedRespRuleActions = g_cacheInsertedRespRuleActions.getLocal();
+      static thread_local LocalStateHolder<vector<dnsdist::rules::ResponseRuleAction>> localRespRuleActions = dnsdist::rules::getResponseRuleChainHolder(dnsdist::rules::ResponseRuleChain::ResponseRules).getLocal();
+      static thread_local LocalStateHolder<vector<dnsdist::rules::ResponseRuleAction>> localCacheInsertedRespRuleActions = dnsdist::rules::getResponseRuleChainHolder(dnsdist::rules::ResponseRuleChain::CacheInsertedResponseRules).getLocal();
 
       dnsResponse.ids.doh3u = std::move(unit);
 
diff --git a/pdns/dnsdistdist/doq.cc b/pdns/dnsdistdist/doq.cc
index 247b67a004..b6a3da6cb7 100644
--- a/pdns/dnsdistdist/doq.cc
+++ b/pdns/dnsdistdist/doq.cc
@@ -135,8 +135,8 @@ public:
 
     if (!response.isAsync()) {
 
-      static thread_local LocalStateHolder<vector<DNSDistResponseRuleAction>> localRespRuleActions = g_respruleactions.getLocal();
-      static thread_local LocalStateHolder<vector<DNSDistResponseRuleAction>> localCacheInsertedRespRuleActions = g_cacheInsertedRespRuleActions.getLocal();
+      static thread_local LocalStateHolder<vector<dnsdist::rules::ResponseRuleAction>> localRespRuleActions = dnsdist::rules::getResponseRuleChainHolder(dnsdist::rules::ResponseRuleChain::ResponseRules).getLocal();
+      static thread_local LocalStateHolder<vector<dnsdist::rules::ResponseRuleAction>> localCacheInsertedRespRuleActions = dnsdist::rules::getResponseRuleChainHolder(dnsdist::rules::ResponseRuleChain::CacheInsertedResponseRules).getLocal();
 
       dnsResponse.ids.doqu = std::move(unit);
 
diff --git a/pdns/dnsdistdist/test-dnsdist_cc.cc b/pdns/dnsdistdist/test-dnsdist_cc.cc
index 79fcd5e8fc..130e57f59f 100644
--- a/pdns/dnsdistdist/test-dnsdist_cc.cc
+++ b/pdns/dnsdistdist/test-dnsdist_cc.cc
@@ -48,7 +48,7 @@ ProcessQueryResult processQueryAfterRules(DNSQuestion& dnsQuestion, LocalHolders
   return ProcessQueryResult::Drop;
 }
 
-bool processResponseAfterRules(PacketBuffer& response, const std::vector<DNSDistResponseRuleAction>& cacheInsertedRespRuleActions, DNSResponse& dnsResponse, bool muted)
+bool processResponseAfterRules(PacketBuffer& response, const std::vector<dnsdist::rules::ResponseRuleAction>& cacheInsertedRespRuleActions, DNSResponse& dnsResponse, bool muted)
 {
   return false;
 }
@@ -84,7 +84,7 @@ bool XskProcessQuery(ClientState& clientState, LocalHolders& holders, XskPacket&
 }
 }
 
-bool processResponderPacket(std::shared_ptr<DownstreamState>& dss, PacketBuffer& response, const std::vector<DNSDistResponseRuleAction>& localRespRuleActions, const std::vector<DNSDistResponseRuleAction>& cacheInsertedRespRuleActions, InternalQueryState&& ids)
+bool processResponderPacket(std::shared_ptr<DownstreamState>& dss, PacketBuffer& response, const std::vector<dnsdist::rules::ResponseRuleAction>& localRespRuleActions, const std::vector<dnsdist::rules::ResponseRuleAction>& cacheInsertedRespRuleActions, InternalQueryState&& ids)
 {
   return false;
 }
diff --git a/pdns/dnsdistdist/test-dnsdisttcp_cc.cc b/pdns/dnsdistdist/test-dnsdisttcp_cc.cc
index 22a27c692c..ca0a5bc522 100644
--- a/pdns/dnsdistdist/test-dnsdisttcp_cc.cc
+++ b/pdns/dnsdistdist/test-dnsdisttcp_cc.cc
@@ -35,11 +35,7 @@
 #include "dnsdist-tcp-upstream.hh"
 
 GlobalStateHolder<NetmaskGroup> g_ACL;
-GlobalStateHolder<vector<DNSDistRuleAction> > g_ruleactions;
-GlobalStateHolder<vector<DNSDistResponseRuleAction> > g_respruleactions;
-GlobalStateHolder<vector<DNSDistResponseRuleAction> > g_cachehitrespruleactions;
-GlobalStateHolder<vector<DNSDistResponseRuleAction> > g_cacheInsertedRespRuleActions;
-GlobalStateHolder<vector<DNSDistResponseRuleAction> > g_selfansweredrespruleactions;
+GlobalStateHolder<std::vector<dnsdist::rules::RuleAction> > g_ruleactions;
 GlobalStateHolder<servers_t> g_dstates;
 
 QueryCount g_qcount;
@@ -83,7 +79,7 @@ bool responseContentMatches(const PacketBuffer& response, const DNSName& qname,
 
 static std::function<bool(PacketBuffer& response, DNSResponse& dr, bool muted)> s_processResponse;
 
-bool processResponse(PacketBuffer& response, const std::vector<DNSDistResponseRuleAction>& localRespRuleActions, const std::vector<DNSDistResponseRuleAction>& localCacheInsertedRespRuleActions, DNSResponse& dr, bool muted)
+bool processResponse(PacketBuffer& response, const std::vector<dnsdist::rules::ResponseRuleAction>& localRespRuleActions, const std::vector<dnsdist::rules::ResponseRuleAction>& localCacheInsertedRespRuleActions, DNSResponse& dr, bool muted)
 {
   if (s_processResponse) {
     return s_processResponse(response, dr, muted);