{
    "id":"/axapi/v3/ddos/template/dns/{name}",
    "type":"object",
    "node-type":"list",
    "title":"dns",
    "partition-visibility":"shared",
    "description":"DNS template Configuration",
    "properties":{
        "name":{
            "type":"string",
            "format":"string-rlx",
            "minLength":1,
            "maxLength":63,
            "partition-visibility":"shared",
            "optional":false
        },
        "action":{
            "type":"string",
            "format":"enum",
            "default":"drop",
            "partition-visibility":"shared",
            "description":"'drop': Drop packets (Default action); 'reset': Send Client RST for TCP connections; ",
            "enum":[
                "drop",
                "reset"
            ],
            "optional":true
        },
        "dns-any-check":{
            "type":"number",
            "format":"flag",
            "default":0,
            "partition-visibility":"shared",
            "description":"Drop DNS queries of Type ANY",
            "optional":true
        },
        "dns-auth-cfg":{
            "type":"object",
            "properties":{
                "dns-auth":{
                    "type":"number",
                    "format":"flag",
                    "default":0,
                    "partition-visibility":"shared",
                    "description":"DNS authentication"
                },
                "dns-auth-type":{
                    "type":"string",
                    "format":"enum",
                    "partition-visibility":"shared",
                    "description":"'udp': Drop DNS request and monitor client retry; 'force-tcp': Force DNS request over TCP; ",
                    "enum":[
                        "udp",
                        "force-tcp"
                    ]
                },
                "udp-timeout-val-only":{
                    "type":"number",
                    "format":"number",
                    "minimum":1,
                    "maximum":16,
                    "partition-visibility":"shared",
                    "description":"UDP authentication timeout in seconds"
                },
                "udp-timeout":{
                    "type":"number",
                    "format":"number",
                    "minimum":1,
                    "maximum":16,
                    "partition-visibility":"shared",
                    "description":"UDP authentication timeout in seconds"
                },
                "min-retry-gap":{
                    "type":"number",
                    "format":"number",
                    "minimum":1,
                    "maximum":80,
                    "partition-visibility":"shared",
                    "description":"Optional minimum sec gap in between 2 dns-udp packets for auth to pass, unit is specified by min-retry-gap-interval"
                },
                "min-retry-gap-interval":{
                    "type":"string",
                    "format":"enum",
                    "default":"1sec",
                    "partition-visibility":"shared",
                    "description":"'100ms': 100ms; '1sec': 1sec; ",
                    "enum":[
                        "100ms",
                        "1sec"
                    ]
                },
                "with-udp-auth":{
                    "type":"number",
                    "format":"flag",
                    "default":0,
                    "partition-visibility":"shared",
                    "description":"Monitor client retry"
                },
                "force-tcp-timeout":{
                    "type":"number",
                    "format":"number",
                    "minimum":1,
                    "maximum":16,
                    "partition-visibility":"shared",
                    "description":"TCP authentication timeout in seconds"
                },
                "force-tcp-min-retry-gap":{
                    "type":"number",
                    "format":"number",
                    "minimum":1,
                    "maximum":15,
                    "partition-visibility":"shared",
                    "description":"Minimum sec gap in between 2 dns-udp packets for auth to pass"
                },
                "force-tcp-ignore-client-source-port":{
                    "type":"number",
                    "format":"flag",
                    "default":0,
                    "partition-visibility":"shared",
                    "description":"Allow client to retransmit DNS request using different source port during udp-auth (supported in asymmetric mode only)"
                }
            }
        },
        "multi-pu-threshold-distribution":{
            "type":"object",
            "properties":{
                "multi-pu-threshold-distribution-value":{
                    "type":"number",
                    "format":"number",
                    "minimum":1,
                    "maximum":16000000,
                    "partition-visibility":"shared",
                    "not":"multi-pu-threshold-distribution-disable",
                    "description":"Destination side rate limit only. Default: 0"
                },
                "multi-pu-threshold-distribution-disable":{
                    "type":"string",
                    "format":"enum",
                    "partition-visibility":"shared",
                    "not":"multi-pu-threshold-distribution-value",
                    "description":"'disable': Destination side rate limit only. Default: Enable; ",
                    "enum":[
                        "disable"
                    ]
                }
            }
        },
        "fqdn-cfg":{
            "type":"array",
            "minItems":1,
            "items":{
                "type":"object"
            },
            "uniqueItems":true,
            "array":[
                {
                    "properties":{
                        "dns-fqdn-rate-limit":{
                            "type":"number",
                            "format":"flag",
                            "default":0,
                            "partition-visibility":"shared",
                            "description":"DNS Rate limiting on the basis of FQDN"
                        },
                        "dns-fqdn-rate":{
                            "type":"number",
                            "format":"number",
                            "minimum":5,
                            "maximum":16000000,
                            "partition-visibility":"shared",
                            "description":"Limiting rate (Range: 5-8000 for FQDN domain based rate limiting, 5-16000000 for FQDN label count based rate limiting)"
                        },
                        "per":{
                            "type":"string",
                            "format":"enum",
                            "partition-visibility":"shared",
                            "not":"by",
                            "description":"'domain-name': Domain Name; 'src-ip': Source IP address; 'label-count': FQDN label count; ",
                            "enum":[
                                "domain-name",
                                "src-ip",
                                "label-count"
                            ]
                        },
                        "per-domain-per-src-ip":{
                            "type":"number",
                            "format":"flag",
                            "default":0,
                            "partition-visibility":"shared",
                            "description":"Use both Domain Name and Source IP address for rate-limiting"
                        },
                        "fqdn-rate-suffix":{
                            "type":"number",
                            "format":"number",
                            "minimum":1,
                            "maximum":5,
                            "partition-visibility":"shared",
                            "description":"Suffix count"
                        },
                        "fqdn-rate-label-count":{
                            "type":"number",
                            "format":"number",
                            "minimum":1,
                            "maximum":8,
                            "partition-visibility":"shared",
                            "description":"FQDN label count (Range: 1-8)"
                        },
                        "by":{
                            "type":"string",
                            "format":"enum",
                            "partition-visibility":"shared",
                            "not":"per",
                            "description":"'domain-name': Domain Name; 'src-ip': Source IP address; 'both': Use both Domain Name and Source IP address for rate-limiting; ",
                            "enum":[
                                "domain-name",
                                "src-ip",
                                "both"
                            ]
                        },
                        "fqdn-rate-suffix-by":{
                            "type":"number",
                            "format":"number",
                            "minimum":1,
                            "maximum":5,
                            "partition-visibility":"shared",
                            "description":"Number of suffixes"
                        }
                    }
                }
            ]
        },
        "fqdn-label-len-cfg":{
            "type":"array",
            "minItems":1,
            "items":{
                "type":"object"
            },
            "uniqueItems":true,
            "array":[
                {
                    "properties":{
                        "fqdn-label-length":{
                            "type":"number",
                            "format":"flag",
                            "default":0,
                            "partition-visibility":"shared",
                            "description":"Maximum FQDN label length"
                        },
                        "label-length":{
                            "type":"number",
                            "format":"number",
                            "minimum":1,
                            "maximum":63,
                            "partition-visibility":"shared",
                            "description":"Maximum length of FQDN label"
                        },
                        "fqdn-label-suffix":{
                            "type":"number",
                            "format":"number",
                            "minimum":1,
                            "maximum":5,
                            "partition-visibility":"shared",
                            "description":"Number of suffixes"
                        }
                    }
                }
            ]
        },
        "fqdn-label-count":{
            "type":"number",
            "format":"number",
            "minimum":1,
            "maximum":10,
            "partition-visibility":"shared",
            "description":"Maximum number of length of FQDN labels",
            "optional":true
        },
        "nxdomain-cfg":{
            "type":"object",
            "properties":{
                "dns-nxdomain-rate-limit":{
                    "type":"number",
                    "format":"flag",
                    "default":0,
                    "partition-visibility":"shared",
                    "description":"DNS NXDOMAIN Rate Limiting (SRC support only)"
                },
                "dns-nxdomain-rate":{
                    "type":"number",
                    "format":"number",
                    "minimum":1,
                    "maximum":16000000,
                    "partition-visibility":"shared",
                    "description":"Limiting rate"
                },
                "dns-nxdomain-rate-limit-action":{
                    "type":"string",
                    "format":"enum",
                    "partition-visibility":"shared",
                    "description":"'drop': Drop queries if rate is exceeded; 'black-list': Black-List source if rate is exceeded; ",
                    "enum":[
                        "drop",
                        "black-list"
                    ]
                }
            }
        },
        "symtimeout-cfg":{
            "type":"object",
            "properties":{
                "sym-timeout":{
                    "type":"number",
                    "format":"flag",
                    "default":0,
                    "partition-visibility":"shared",
                    "description":"Timeout for DNS Symmetric session"
                },
                "sym-timeout-value":{
                    "type":"number",
                    "format":"number",
                    "minimum":1,
                    "maximum":31,
                    "partition-visibility":"shared",
                    "description":"Session timeout value in seconds"
                }
            }
        },
        "dns-request-rate-limit":{
            "type":"object",
            "properties":{
                "type":{
                    "type":"object",
                    "properties":{
                        "A-cfg":{
                            "type":"object",
                            "properties":{
                                "A":{
                                    "type":"number",
                                    "format":"flag",
                                    "default":0,
                                    "partition-visibility":"shared",
                                    "description":"Address record"
                                },
                                "dns-a-rate":{
                                    "type":"number",
                                    "format":"number",
                                    "minimum":1,
                                    "maximum":16000000,
                                    "partition-visibility":"shared"
                                }
                            }
                        },
                        "AAAA-cfg":{
                            "type":"object",
                            "properties":{
                                "AAAA":{
                                    "type":"number",
                                    "format":"flag",
                                    "default":0,
                                    "partition-visibility":"shared",
                                    "description":"IPv6 address record"
                                },
                                "dns-aaaa-rate":{
                                    "type":"number",
                                    "format":"number",
                                    "minimum":1,
                                    "maximum":16000000,
                                    "partition-visibility":"shared"
                                }
                            }
                        },
                        "CNAME-cfg":{
                            "type":"object",
                            "properties":{
                                "CNAME":{
                                    "type":"number",
                                    "format":"flag",
                                    "default":0,
                                    "partition-visibility":"shared",
                                    "description":"Canonical name record"
                                },
                                "dns-cname-rate":{
                                    "type":"number",
                                    "format":"number",
                                    "minimum":1,
                                    "maximum":16000000,
                                    "partition-visibility":"shared"
                                }
                            }
                        },
                        "MX-cfg":{
                            "type":"object",
                            "properties":{
                                "MX":{
                                    "type":"number",
                                    "format":"flag",
                                    "default":0,
                                    "partition-visibility":"shared",
                                    "description":"Mail exchange record"
                                },
                                "dns-mx-rate":{
                                    "type":"number",
                                    "format":"number",
                                    "minimum":1,
                                    "maximum":16000000,
                                    "partition-visibility":"shared"
                                }
                            }
                        },
                        "NS-cfg":{
                            "type":"object",
                            "properties":{
                                "NS":{
                                    "type":"number",
                                    "format":"flag",
                                    "default":0,
                                    "partition-visibility":"shared",
                                    "description":"Name server record"
                                },
                                "dns-ns-rate":{
                                    "type":"number",
                                    "format":"number",
                                    "minimum":1,
                                    "maximum":16000000,
                                    "partition-visibility":"shared"
                                }
                            }
                        },
                        "SRV-cfg":{
                            "type":"object",
                            "properties":{
                                "SRV":{
                                    "type":"number",
                                    "format":"flag",
                                    "default":0,
                                    "partition-visibility":"shared",
                                    "description":"Service locator"
                                },
                                "dns-srv-rate":{
                                    "type":"number",
                                    "format":"number",
                                    "minimum":1,
                                    "maximum":16000000,
                                    "partition-visibility":"shared",
                                    "description":"DNS request rate"
                                }
                            }
                        },
                        "dns-type-cfg":{
                            "type":"array",
                            "minItems":1,
                            "items":{
                                "type":"object"
                            },
                            "uniqueItems":true,
                            "array":[
                                {
                                    "properties":{
                                        "dns-request-type":{
                                            "type":"number",
                                            "format":"number",
                                            "minimum":1,
                                            "maximum":65535,
                                            "partition-visibility":"shared",
                                            "description":"Other type value"
                                        },
                                        "dns-request-type-rate":{
                                            "type":"number",
                                            "format":"number",
                                            "minimum":1,
                                            "maximum":16000000,
                                            "partition-visibility":"shared",
                                            "description":"request rate limit"
                                        }
                                    }
                                }
                            ]
                        }
                    }
                }
            }
        },
        "domain-group-name":{
            "type":"string",
            "format":"string-rlx",
            "minLength":1,
            "maxLength":128,
            "partition-visibility":"shared",
            "description":"Apply a domain-group to the DNS template",
            "optional":true
        },
        "on-no-match":{
            "type":"string",
            "format":"enum",
            "default":"deny",
            "partition-visibility":"shared",
            "description":"'permit': permit; 'deny': deny (default); ",
            "enum":[
                "permit",
                "deny"
            ],
            "optional":true
        },
        "domain-group-rate-exceed-action":{
            "type":"string",
            "format":"enum",
            "default":"drop",
            "partition-visibility":"shared",
            "description":"'drop': Drop the query (default); 'tunnel-encap-packet': Encapsulate the query and send on a tunnel; ",
            "enum":[
                "drop",
                "tunnel-encap-packet"
            ],
            "optional":true
        },
        "encap-template":{
            "type":"string",
            "format":"string-rlx",
            "minLength":1,
            "maxLength":63,
            "partition-visibility":"shared",
            "description":"DDOS encap template to sepcify the tunnel endpoint",
            "optional":true
        },
        "domain-group-rate-per-service":{
            "type":"number",
            "format":"flag",
            "default":0,
            "partition-visibility":"shared",
            "description":"Enable per service domain rate checking",
            "optional":true
        },
        "query-rate-threshold-for-cache-serving":{
            "type":"number",
            "format":"number",
            "minimum":1,
            "maximum":16000000,
            "partition-visibility":"shared",
            "description":"This is for DNS cache mode only, it sets a DNS query rate threshold such that queries under the rate threshold would be forward",
            "optional":true
        },
        "allow-query-class":{
            "type":"object",
            "properties":{
                "allow-internet-query-class":{
                    "type":"number",
                    "format":"flag",
                    "default":0,
                    "partition-visibility":"shared",
                    "description":"INTERNET query class"
                },
                "allow-csnet-query-class":{
                    "type":"number",
                    "format":"flag",
                    "default":0,
                    "partition-visibility":"shared",
                    "description":"CSNET query class"
                },
                "allow-chaos-query-class":{
                    "type":"number",
                    "format":"flag",
                    "default":0,
                    "partition-visibility":"shared",
                    "description":"CHAOS query class"
                },
                "allow-hesiod-query-class":{
                    "type":"number",
                    "format":"flag",
                    "default":0,
                    "partition-visibility":"shared",
                    "description":"HESIOD query class"
                },
                "allow-none-query-class":{
                    "type":"number",
                    "format":"flag",
                    "default":0,
                    "partition-visibility":"shared",
                    "description":"NONE query class"
                },
                "allow-any-query-class":{
                    "type":"number",
                    "format":"flag",
                    "default":0,
                    "partition-visibility":"shared",
                    "description":"ANY query class"
                }
            }
        },
        "allow-record-type":{
            "type":"object",
            "properties":{
                "allow-a-type":{
                    "type":"number",
                    "format":"flag",
                    "default":0,
                    "partition-visibility":"shared",
                    "description":"Address record"
                },
                "allow-aaaa-type":{
                    "type":"number",
                    "format":"flag",
                    "default":0,
                    "partition-visibility":"shared",
                    "description":"IPv6 address record"
                },
                "allow-cname-type":{
                    "type":"number",
                    "format":"flag",
                    "default":0,
                    "partition-visibility":"shared",
                    "description":"Canonical name record"
                },
                "allow-mx-type":{
                    "type":"number",
                    "format":"flag",
                    "default":0,
                    "partition-visibility":"shared",
                    "description":"Mail exchange record"
                },
                "allow-ns-type":{
                    "type":"number",
                    "format":"flag",
                    "default":0,
                    "partition-visibility":"shared",
                    "description":"Name server record"
                },
                "allow-srv-type":{
                    "type":"number",
                    "format":"flag",
                    "default":0,
                    "partition-visibility":"shared",
                    "description":"Service locator"
                },
                "record-num-cfg":{
                    "type":"array",
                    "minItems":1,
                    "items":{
                        "type":"object"
                    },
                    "uniqueItems":true,
                    "array":[
                        {
                            "properties":{
                                "allow-num-type":{
                                    "type":"number",
                                    "format":"number",
                                    "minimum":1,
                                    "maximum":65535,
                                    "partition-visibility":"shared",
                                    "description":"Other record type value"
                                }
                            }
                        }
                    ]
                }
            }
        },
        "uuid":{
            "type":"string",
            "format":"string",
            "minLength":1,
            "maxLength":64,
            "partition-visibility":"shared",
            "modify-not-allowed":1,
            "description":"uuid of the object",
            "optional":true
        },
        "user-tag":{
            "type":"string",
            "format":"string-rlx",
            "minLength":1,
            "maxLength":127,
            "partition-visibility":"shared",
            "description":"Customized tag",
            "optional":true
        },
        "malformed-query-check":{
            "type":"object",
            "$ref":"/axapi/v3/ddos/template/dns/{name}/malformed-query-check",
            "properties":{
                "validation-type":{
                    "type":"string",
                    "format":"enum",
                    "partition-visibility":"shared",
                    "description":"'basic-header-check': Basic header validation for DNS TCP/UDP queries; 'extended-header-check': Extended header/query validation for DNS TCP/UDP queries; 'disable': Disable Malform query validation for DNS TCP/UDP; ",
                    "enum":[
                        "basic-header-check",
                        "extended-header-check",
                        "disable"
                    ]
                },
                "non-query-opcode-check":{
                    "type":"string",
                    "format":"enum",
                    "partition-visibility":"shared",
                    "description":"'disable': When malform check is enabled, TPS always drops DNS query with non query opcode, this option disables this opcode check; ",
                    "enum":[
                        "disable"
                    ]
                },
                "skip-multi-packet-check":{
                    "type":"number",
                    "format":"flag",
                    "default":0,
                    "partition-visibility":"shared",
                    "description":"Bypass DNS fragmented and TCP segmented Queries(Default: dropped)"
                },
                "uuid":{
                    "type":"string",
                    "format":"string",
                    "minLength":1,
                    "maxLength":64,
                    "partition-visibility":"shared",
                    "modify-not-allowed":1,
                    "description":"uuid of the object"
                }
            }
        }
    },
    "object-keys":[
        "name"
    ],
    "required":[
        "name"
    ]
}