Skip to main content

Special Data Types

Certain configuration items use special values or have more complicated parsing rules. These values are explained here.

Duration​

# Examples
myvalue = "120" # Seconds by default
myvalue = "1 minute"
myvalue = "2 hours"

A String value, representing a time span. Units can be seconds, minutes, or hours. If a time unit is not specified, it will be treated as seconds.

Unit​

# Examples:
traffic-rate-bytes = "1 M"      # 1 MBps
traffic-rate-bytes = 1000000    # Also 1 MBps
traffic-rate-bytes = 1_000_000  # Also 1 MBps

Represents a number. Can be either a number or a string, where the string can use SI prefixes. The actual unit of measure should be described by each individual setting.

Supported prefixes are: k, M, G, T, P, E

Destination​

Examples:
destination = "detected"
destination = "detected-zone"
destination = "198.51.100.0/24"
destination = "2001:db8::/64"

Used for Actions including bgp and bgp-flowspec, determining the prefixes that will be sent by this action.

warning

When a whole zone is picked as a destination, Director will include every prefix configured for that zone. This will NOT subtract out smaller prefixes that may be allocated to other zones.

A destination can use any of the following values:

  • "detected": If triggered by a single IP, this will resolve to the prefix containing only that host. If triggered by a zone, this will resolve to all prefixes configured in rWeb for the zone (see the warning above.).
  • "detected-zone": See the warning above. If triggered by a single IP, this will resolve to the most specific zone matching that IP. If triggered by a zone, this will resolve to all prefixes configured in rWeb for that zone.
  • Hard-coded prefix: No matter what triggers this action, it will use this prefix.

BGP Community​

# Example:
communities = [
    "123:456",
    2063598024,
    0x7B0001C8,
    "BLACKHOLE",
]

Represents a standard 32 bit (NOT extended or large) community, accepting one of the following formats:

  • new-format: "123:456"
  • integer: 2063598024 or 2_063_598_024
  • hex: 0x7B0001C8
  • well-known: Additionally, we support a set of well-known communities from IANA: "GRACEFUL_SHUTDOWN" "ACCEPT_OWN" "ROUTE_FILTER_TRANSLATED_v4" "ROUTE_FILTER_v4" "ROUTE_FILTER_TRANSLATED_v6" "ROUTE_FILTER_v6" "LLGR_STALE" "NO_LLGR" "BLACKHOLE" "NO_EXPORT" "NO_ADVERTISE" "NO_EXPORT_SUBCONFED" "NOPEER"

BGP Flowspec Numeric​

# This example will match port 25 OR ports between 100 and 200.
port = "==25 | >100 & <200"

A String parsed as a series of numeric comparisons used for Flowspec. Formally, it should be one or more of:

COMBINER COMPARISON VALUE

with optional whitespace between each item.

  • COMBINER is &, |, or empty. & means this rule will include the previous one. | or an empty combiner will create an alternate set of rules. & takes priority over |.
  • COMPARISON is one of ==, !=, >=, <=, >, <.
  • VALUE is a number - the valid range will depend on the specific setting.

BGP Flowspec TCP Flags​

# Examples:
# Any of SYN or FIN or RST set
tcp-flags = "FIN+ACK+RST"

# A packet where either FIN is set OR SYN and ACK are set and PUSH is not set
tcp-flags = "=SYN+ACK & !=PSH | =FIN"

A String parsed as a matcher for TCP flags used for Flowspec. Formally, it is one or more of:

COMBINER MATCH FLAG[+FLAG...]

  • COMBINER is &, |, or empty. & means this rule will include the previous one. | or an empty combiner will create an alternate set of rules. & takes priority over |
  • MATCH is =, !=, !, or empty.
    • = matches when all FLAGs must be set.
    • != matches when all FLAGs must not be set.
    • ! matches when any of the FLAGs are not set
    • Empty matches when any of the FLAGs are set
  • FLAGs are one or more of the following separated by a +:
    • FIN
    • SYN
    • RST
    • PSH
    • ACK
    • URG
    • ECE
    • CWR
    • NS
    • A hex number: 0x01

BGP Flowspec Fragment​

# Examples:
# Any packet that is fragmented
fragment = "first-fragment+is-fragment"

# Any packet that is not fragmented
fragment = "!first-fragment+is-fragment"

# Packets that should not be fragmented but are
fragment = "=dont-fragment & is-fragment+first-fragment"

A String parsed as a matcher for fragmented packets used by Flowspec. Formally, it is one or more of:

COMBINER MATCH FLAG[+FLAG...]

  • COMBINER is &, |, or empty. & means this rule will include the previous one. | or an empty combiner will create an alternate set of rules. & takes priority over |.
  • MATCH is =, !=, !, or empty.
    • = matches when all FLAGs must be set.
    • != matches when all FLAGs must not be set.
    • ! matches when any of the FLAGs are not set.
    • Empty matches when any of the FLAGs are set.
  • FLAGs are one or more of the following separated by a '+'
    • dont-fragment: A packet with the Don't Fragment bit set.
    • is-fragment: A fragment OTHER THAN the first.
    • first-fragment: The beginning of a fragmented packet.
    • last-fragment: The last part of a fragmented packet.