DNS Filter

This extension may be referenced by the qualified name envoy.filters.udp_listener.dns_filter

Note

This extension is functional but has not had substantial production burn time, use only with this caveat.

This extension is intended to be robust against untrusted downstream traffic. It assumes that the upstream is trusted.

Tip

This extension extends and can be used with the following extension category:

DNS Filter configuration overview.

extensions.filters.udp.dns_filter.v3.DnsFilterConfig

[extensions.filters.udp.dns_filter.v3.DnsFilterConfig proto]

Configuration for the DNS filter.

  1. {
  2.   "stat_prefix": "...",
  3.   "server_config": "{...}",
  4.   "client_config": "{...}"
  5. }

stat_prefix

(string, REQUIRED) The stat prefix used when emitting DNS filter statistics

server_config

(extensions.filters.udp.dns_filter.v3.DnsFilterConfig.ServerContextConfig) Server context configuration contains the data that the filter uses to respond to DNS requests.

client_config

(extensions.filters.udp.dns_filter.v3.DnsFilterConfig.ClientContextConfig) Client context configuration controls Envoy’s behavior when it must use external resolvers to answer a query. This object is optional and if omitted instructs the filter to resolve queries from the data in the server_config

extensions.filters.udp.dns_filter.v3.DnsFilterConfig.ServerContextConfig

[extensions.filters.udp.dns_filter.v3.DnsFilterConfig.ServerContextConfig proto]

This message contains the configuration for the DNS Filter operating in a server context. This message will contain the virtual hosts and associated addresses with which Envoy will respond to queries

  1. {
  2.   "inline_dns_table": "{...}",
  3.   "external_dns_table": "{...}"
  4. }

inline_dns_table

(data.dns.v3.DnsTable) Load the configuration specified from the control plane

Precisely one of inline_dns_table, external_dns_table must be set.

external_dns_table

(config.core.v3.DataSource) Seed the filter configuration from an external path. This source is a yaml formatted file that contains the DnsTable driving Envoy’s responses to DNS queries

Precisely one of inline_dns_table, external_dns_table must be set.

extensions.filters.udp.dns_filter.v3.DnsFilterConfig.ClientContextConfig

[extensions.filters.udp.dns_filter.v3.DnsFilterConfig.ClientContextConfig proto]

This message contains the configuration for the DNS Filter operating in a client context. This message will contain the timeouts, retry, and forwarding configuration for Envoy to make DNS requests to other resolvers

  1. {
  2.   "resolver_timeout": "{...}",
  3.   "dns_resolution_config": "{...}",
  4.   "max_pending_lookups": "..."
  5. }

resolver_timeout

(Duration) Sets the maximum time we will wait for the upstream query to complete We allow 5s for the upstream resolution to complete, so the minimum value here is 1. Note that the total latency for a failed query is the number of retries multiplied by the resolver_timeout.

dns_resolution_config

(config.core.v3.DnsResolutionConfig) DNS resolution configuration which includes the underlying dns resolver addresses and options.

max_pending_lookups

(uint64) Controls how many outstanding external lookup contexts the filter tracks. The context structure allows the filter to respond to every query even if the external resolution times out or is otherwise unsuccessful