<html><head><style type="text/css">.style1 {font-family: "Times New Roman";}</style></head><body><div dir="ltr">Oh I see why this happens... my bad sry.<div><br></div><div>The conf file used "local dbr = ....", once I removed the local I can see the rule as expected!</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Aug 24, 2023 at 2:09 PM Ben Kaplan <<a href="mailto:ben.kaplan@redis.com">ben.kaplan@redis.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">That's great info! thank you Remi,<div><br></div><div>We have rules set by the dnsdist.conf file and we want to be able to query the config and change it via the console without restarting.</div><div>> dbr:toString()<br></div><div>works perfectly if the dbr object was also created in the console.</div><div><br></div><div>Is there a way to check the dynamic config that was set when the service started?</div><div>Regarding the second question, running addDynBlocks from the console will *modify* the rules set from configuration files (assuming the <span style="color:rgb(0,0,0)">existing rule expiration is shorter</span>)?</div><div><br></div><div>Thanks again for your help</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Aug 24, 2023 at 12:58 PM Remi Gacogne via dnsdist <<a href="mailto:dnsdist@mailman.powerdns.com" target="_blank">dnsdist@mailman.powerdns.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hi,<br>
<br>
On 24/08/2023 11:47, Ben Kaplan via dnsdist wrote:<br>
> 1. We're searching for how to query the current values of<br>
> dynBlockRulesGroup (using ebpf) via the console.<br>
> Once the rule kicks in we can see the IP blocked and the warning<br>
> message when running "showDynBlocks()".<br>
> However, we can't find any way to query for the actual values and<br>
> rules configured in "function maintenance()".<br>
<br>
The dynBlockRulesGroup class has a 'toString' method which describes the <br>
current configuration [1]. So if you have declared it with, for example:<br>
<br>
dbr = dynBlockRulesGroup()<br>
dbr:setRCodeRate(DNSRCode.NXDOMAIN, 5, 5, "Exceeded NXD rate", 60)<br>
<br>
you can later retrieve the current configuration via:<br>
<br>
> dbr:toString()<br>
Query rate rule:<br>
Response rate rule:<br>
SuffixMatch rule:<br>
RCode rules:<br>
- Non-Existent domain: Apply the global DynBlock action for 60 seconds <br>
when over 5 during the last 5 seconds, reason: 'Exceeded NXD rate'<br>
QType rules:<br>
Excluded Subnets:<br>
Excluded Domains:<br>
<br>
> 2. When running "addDynBlocks(addresses, message[, seconds=10[,<br>
> action]])" from the console when dnsdist already has the same rule<br>
> configured. will this create a second rule or modify the value of<br>
> the existing rule?<br>
<br>
Modify, unless the existing rule was still valid for a longer time than <br>
the one you are trying to insert.<br>
<br>
[1]: <a href="https://dnsdist.org/reference/config.html#DynBlockRulesGroup:toString" rel="noreferrer" target="_blank">https://dnsdist.org/reference/config.html#DynBlockRulesGroup:toString</a><br>
<br>
Best regards,<br>
-- <br>
Remi Gacogne<br>
PowerDNS.COM BV - <a href="https://www.powerdns.com/" rel="noreferrer" target="_blank">https://www.powerdns.com/</a><br>
<br>
_______________________________________________<br>
dnsdist mailing list<br>
<a href="mailto:dnsdist@mailman.powerdns.com" target="_blank">dnsdist@mailman.powerdns.com</a><br>
<a href="https://mailman.powerdns.com/mailman/listinfo/dnsdist" rel="noreferrer" target="_blank">https://mailman.powerdns.com/mailman/listinfo/dnsdist</a><br>
</blockquote></div>
</blockquote></div>
<br><br><p style="font-family: Verdana; font-size:10pt; color:#666666;"><b>Disclaimer</b></p><p style="font-family: Verdana; font-size:8pt; color:#666666;">The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful.<br></p></body></html>