Re: [dnsdist] Number of Actions

2019-05-09 Thread Wang Jian
bert hubert 于2019年4月16日周二 上午3:23写道: > > > You can also create a SuffixMatchNode and fill it programatically and then > use a SuffixMatchNodeRule(smn) on it. > The usage you refer is undocumented, isn't it? The functionality has been there for quite some time, but few people know that. Even I

Re: [dnsdist] Number of Actions

2019-04-15 Thread Klaus Darilion
Hello Bert! Am 15.04.2019 um 21:23 schrieb bert hubert: > On Mon, Apr 15, 2019 at 08:39:30PM +0200, Klaus Darilion wrote: >> Hello! >> >> Is there a max number of actions, before there might be performance >> problems? > > Yes. The design goal is not to have hundreds of rules, but to have fewer,

Re: [dnsdist] Number of Actions

2019-04-15 Thread bert hubert
On Mon, Apr 15, 2019 at 08:39:30PM +0200, Klaus Darilion wrote: > Hello! > > Is there a max number of actions, before there might be performance > problems? Yes. The design goal is not to have hundreds of rules, but to have fewer, more powerful rules. For example, in your case, you can do:

[dnsdist] Number of Actions

2019-04-15 Thread Klaus Darilion
Hello! Is there a max number of actions, before there might be performance problems? During a random subdomain attack I would like to "whitelist" all real subdomains and then rate limit the rest, ie: -- Allow the following lables without limiting addAction(QNameRule("www.example.com"),