feat: add static CNAME responses (#44)

* feat: add static CNAME responses

* docs: clarify static CNAME behavior

Author: tuoro

README.md

@@ -358,6 +358,7 @@ The aliases and-not, andnot, or-not, and ornot are also accepted.
 | log | level (optional) | Emits a tracing event for the matched rule. Supported levels are trace, debug, info, warn, and error. |
 | static_response | rcode | Returns NOERROR, FORMERR, SERVFAIL, NXDOMAIN, NOTIMP, or REFUSED. |
 | static_ip_response | ip | Returns A or AAAA records matching the query type (both for ANY queries). Other query types, including HTTPS and SVCB, receive NODATA; this action does not synthesize IP hints. `ip` accepts one address or a comma-separated list of IPv4/IPv6 addresses (for example, `192.0.2.1,2001:db8::1`). Addresses are returned as-is; a very large list may exceed the UDP response size limit. |
+| static_cname_response | target, ttl (optional) | Returns a CNAME record for every query type that maps the queried name to `target`; ttl defaults to 300. The target is not resolved server-side and its address records are not included, so the client or resolver must follow the alias. Clients that do not follow a bare CNAME may report no data. Invalid owner or target names return SERVFAIL. |
 | static_txt_response | text, ttl (optional) | Returns a TXT response. text accepts a string or string array; ttl defaults to 300. |
 | jump_to_pipeline | pipeline | Starts processing the referenced pipeline. |
 | allow | none | Request phase: forward with the global default UDP upstream. Response phase: keep the current upstream response. |

README.zh-CN.md

@@ -357,6 +357,7 @@ Pipeline selector 支持上表全部类型；请求规则支持除 listener_labe
 | log | level（可选） | 输出匹配规则的 tracing 事件；支持 trace、debug、info、warn、error。 |
 | static_response | rcode | 返回 NOERROR、FORMERR、SERVFAIL、NXDOMAIN、NOTIMP 或 REFUSED。 |
 | static_ip_response | ip | 按查询类型返回 A 或 AAAA 记录（ANY 查询返回两者）；HTTPS、SVCB 等其他查询类型返回 NODATA，且不会合成 IP hints。`ip` 支持单个地址或逗号分隔的 IPv4/IPv6 地址列表（例如 `192.0.2.1,2001:db8::1`）。地址列表原样返回；列表过大时响应可能超过 UDP 大小限制。 |
+| static_cname_response | target、ttl（可选） | 对所有查询类型返回将查询域名映射到 `target` 的 CNAME 记录；ttl 默认 300。服务端不会继续解析目标域名，也不会附带目标地址记录，客户端或解析器必须自行追踪别名；不能追踪裸 CNAME 的客户端可能返回无数据。查询域名或目标域名无效时返回 SERVFAIL。 |
 | static_txt_response | text、ttl（可选） | 返回 TXT 响应；text 支持字符串或字符串数组，ttl 默认 300。 |
 | jump_to_pipeline | pipeline | 开始处理指定 Pipeline。 |
 | allow | 无 | 请求阶段：使用全局默认 UDP 上游；响应阶段：保留当前上游响应。 |

src/config.rs

@@ -526,6 +526,14 @@ pub enum Action {
     StaticResponse { rcode: String },
     /// 返回一个或逗号分隔的多个固定 IPv4/IPv6 地址。 / Return one or more comma-separated static IPv4/IPv6 addresses.
     StaticIpResponse { ip: String },
+    /// 返回固定 CNAME 记录。 / Return a static CNAME record.
+    StaticCnameResponse {
+        /// CNAME 目标域名 / Canonical target domain name
+        target: String,
+        /// TTL (可选，默认 300) / TTL (optional, default 300)
+        #[serde(default)]
+        ttl: Option<u32>,
+    },
     /// 返回固定 TXT 记录。支持单个字符串或字符串数组。 / Return static TXT record. Supports single string or string array.
     StaticTxtResponse {
         /// TXT 记录内容 / TXT record content

src/engine/execution.rs

@@ -1501,6 +1501,57 @@ mod tests {
         assert_response(RecordType::AAAA, &["2001:db8::1".parse().unwrap()]);
     }
 
+    #[tokio::test]
+    async fn static_cname_fast_path_maps_query_name_to_target() {
+        let raw = serde_json::json!({
+            "settings": { "default_upstream": "1.1.1.1:53" },
+            "pipelines": [{
+                "id": "static",
+                "rules": [{
+                    "name": "static-cname",
+                    "matchers": [{ "type": "domain_suffix", "value": "alias.example" }],
+                    "actions": [{
+                        "type": "static_cname_response",
+                        "target": "origin.example.",
+                        "ttl": 120
+                    }]
+                }]
+            }]
+        });
+        let cfg: crate::config::PipelineConfig = serde_json::from_value(raw).expect("parse config");
+        let runtime = RuntimePipelineConfig::from_config(cfg).expect("runtime config");
+        let engine = Engine::new(runtime, "test".to_string()).expect("initialize engine");
+        let peer = "127.0.0.1:53000".parse().unwrap();
+
+        let mut request = Message::new(0xCAFE, MessageType::Query, OpCode::Query);
+        request.metadata.recursion_desired = true;
+        request.add_query(Query::query(
+            Name::from_str("alias.example").unwrap(),
+            RecordType::A,
+        ));
+
+        let response = match engine
+            .handle_packet_fast(&request.to_vec().unwrap(), peer)
+            .expect("fast path")
+        {
+            Some(FastPathResponse::Direct(bytes)) => Message::from_bytes(&bytes).unwrap(),
+            other => panic!("expected direct fast-path response, got {other:?}"),
+        };
+
+        assert_eq!(response.metadata.response_code, ResponseCode::NoError);
+        assert_eq!(response.queries[0].query_type(), RecordType::A);
+        assert_eq!(response.answers.len(), 1);
+        assert_eq!(&response.answers[0].name, response.queries[0].name());
+        assert_eq!(response.answers[0].record_type(), RecordType::CNAME);
+        assert_eq!(response.answers[0].ttl, 120);
+        match &response.answers[0].data {
+            RData::CNAME(cname) => {
+                assert_eq!(cname.0, Name::from_str("origin.example.").unwrap());
+            }
+            other => panic!("unexpected static CNAME answer: {other:?}"),
+        }
+    }
+
     #[test]
     fn pipeline_select_picks_matching_pipeline() {
         // Arrange: Create configuration with pipeline selection rules
@@ -2076,6 +2127,56 @@ mod tests {
         }
     }
 
+    #[tokio::test]
+    async fn response_actions_static_cname_returns_configured_alias() {
+        let engine = build_test_engine();
+        let mut req = Message::new(0xCAFE, MessageType::Query, OpCode::Query);
+        req.add_query(Query::query(
+            Name::from_str("alias.example").unwrap(),
+            RecordType::A,
+        ));
+        let actions = [Action::StaticCnameResponse {
+            target: "origin.example.".to_string(),
+            ttl: Some(60),
+        }];
+        let response_matchers: Vec<RuntimeResponseMatcherWithOp> = Vec::new();
+        let packet = req.to_vec().unwrap();
+        let ctx = crate::engine::rules::ApplyResponseActionsContext {
+            engine: &engine,
+            actions: &actions,
+            ctx_opt: None,
+            req: &req,
+            packet: &packet,
+            upstream_timeout: Duration::from_secs(1),
+            response_matchers: &response_matchers,
+            qname: "alias.example",
+            qtype: RecordType::A,
+            qclass: DNSClass::IN,
+            client_ip: "10.0.0.1".parse().unwrap(),
+            upstream_default: TEST_UPSTREAM,
+            pipeline_id: "pipeline",
+            rule_name: "rule",
+            remaining_jumps: 10,
+        };
+
+        match apply_response_actions(ctx).await.expect("static cname") {
+            ResponseActionResult::Static { bytes, rcode, .. } => {
+                assert_eq!(rcode, ResponseCode::NoError);
+                let response = Message::from_bytes(&bytes).unwrap();
+                assert_eq!(response.answers.len(), 1);
+                assert_eq!(&response.answers[0].name, response.queries[0].name());
+                assert_eq!(response.answers[0].ttl, 60);
+                match &response.answers[0].data {
+                    RData::CNAME(cname) => {
+                        assert_eq!(cname.0, Name::from_str("origin.example.").unwrap());
+                    }
+                    other => panic!("unexpected static CNAME answer: {other:?}"),
+                }
+            }
+            _ => panic!("expected static result"),
+        }
+    }
+
     #[tokio::test]
     async fn static_decision_skips_dns_cache_when_pipeline_uses_client_ip() {
         // Arrange: Build engine, request packet, and a static IP answer

src/engine/mod.rs

@@ -19,7 +19,7 @@ pub use matcher_adapter::*;
 pub use pipeline::select_pipeline;
 pub use types::{EngineInner, FastPathResponse};
 
-pub(crate) use response::make_static_ip_answer;
 pub use response::{extract_ttl, extract_ttl_for_refresh};
+pub(crate) use response::{make_static_cname_answer, make_static_ip_answer};
 pub use rules::Decision;
 pub use utils::engine_helpers;

src/engine/pipeline.rs

@@ -19,11 +19,11 @@ use crate::matcher::{
 };
 
 use super::core::Engine;
-use super::make_static_ip_answer;
 use super::matcher_adapter::{MatcherContext, matcher_matches};
 use super::rules::Decision;
 use super::rules::{RuleCacheEntry, calculate_rule_hash, contains_continue, fast_hash_str};
 use super::types::EngineInner;
+use super::{make_static_cname_answer, make_static_ip_answer};
 
 /// Request and manager references required to select a runtime pipeline.
 pub struct PipelineSelectionContext<'a> {
@@ -395,6 +395,19 @@ impl Engine {
                             );
                             return d;
                         }
+                        Action::StaticCnameResponse { target, ttl } => {
+                            let (rcode, answers) =
+                                make_static_cname_answer(qname, target, ttl.unwrap_or(300));
+                            let d = Decision::Static { rcode, answers };
+                            self.insert_rule_cache(
+                                rule_hash,
+                                pipeline.id.clone(),
+                                request,
+                                d.clone(),
+                                include_ip,
+                            );
+                            return d;
+                        }
                         Action::JumpToPipeline { pipeline: target } => {
                             let d = Decision::Jump {
                                 pipeline: Arc::from(target.as_str()),

src/engine/response.rs

@@ -2,7 +2,7 @@ use bytes::Bytes;
 use hickory_proto::op::{Message, MessageType, OpCode, Query, ResponseCode};
 use hickory_proto::rr::{
     DNSClass, Name, RData, Record, RecordType,
-    rdata::{A, AAAA, TXT},
+    rdata::{A, AAAA, CNAME, TXT},
 };
 use hickory_proto::serialize::binary::{BinEncodable, BinEncoder};
 use std::net::IpAddr;
@@ -77,6 +77,25 @@ pub(crate) fn make_static_ip_answer(
     (ResponseCode::NoError, answers)
 }
 
+/// 创建静态 CNAME 记录响应 / Create a static CNAME record response
+pub(crate) fn make_static_cname_answer(
+    qname: &str,
+    target: &str,
+    ttl: u32,
+) -> (ResponseCode, Vec<Record>) {
+    let target = target.trim();
+    if target.is_empty() {
+        return (ResponseCode::ServFail, Vec::new());
+    }
+
+    let (Ok(name), Ok(target)) = (Name::from_str(qname), Name::from_str(target)) else {
+        return (ResponseCode::ServFail, Vec::new());
+    };
+
+    let record = Record::from_rdata(name, ttl, RData::CNAME(CNAME(target)));
+    (ResponseCode::NoError, vec![record])
+}
+
 /// 创建静态TXT记录响应 / Create static TXT record response
 ///
 /// RFC 1035 TXT记录规范:
@@ -176,6 +195,35 @@ mod tests {
     use super::*;
     use hickory_proto::rr::rdata::SOA;
 
+    #[test]
+    fn static_cname_answer_uses_configured_target_and_ttl() {
+        let (rcode, answers) = make_static_cname_answer("alias.example.", "origin.example.", 120);
+
+        assert_eq!(rcode, ResponseCode::NoError);
+        assert_eq!(answers.len(), 1);
+        assert_eq!(&answers[0].name, &Name::from_str("alias.example.").unwrap());
+        assert_eq!(answers[0].ttl, 120);
+        match &answers[0].data {
+            RData::CNAME(CNAME(target)) => {
+                assert_eq!(target, &Name::from_str("origin.example.").unwrap());
+            }
+            other => panic!("unexpected static CNAME answer: {other:?}"),
+        }
+    }
+
+    #[test]
+    fn static_cname_answer_rejects_invalid_names() {
+        for (qname, target) in [
+            ("invalid name", "origin.example."),
+            ("alias.example.", "invalid name"),
+            ("alias.example.", ""),
+        ] {
+            let (rcode, answers) = make_static_cname_answer(qname, target, 300);
+            assert_eq!(rcode, ResponseCode::ServFail);
+            assert!(answers.is_empty());
+        }
+    }
+
     #[test]
     fn test_extract_ttl_positive_response() {
         let mut msg = Message::new(0, MessageType::Query, OpCode::Query);

src/engine/rules.rs

@@ -17,7 +17,8 @@ use crate::engine::core::Engine;
 use crate::engine::matcher_adapter::log_match;
 use crate::engine::pipeline::RuleEvaluationContext;
 use crate::engine::response::{
-    extract_ttl, extract_ttl_for_refresh, make_static_ip_answer, make_static_txt_answer,
+    extract_ttl, extract_ttl_for_refresh, make_static_cname_answer, make_static_ip_answer,
+    make_static_txt_answer,
 };
 use crate::engine::types::EngineInner;
 use crate::engine::types::InflightMap;
@@ -276,6 +277,16 @@ pub(crate) async fn apply_response_actions(
                     source: "response_action",
                 });
             }
+            Action::StaticCnameResponse { target, ttl } => {
+                let (rcode, answers) =
+                    make_static_cname_answer(ctx.qname, target, ttl.unwrap_or(300));
+                let bytes = build_response(ctx.req, rcode, answers)?;
+                return Ok(ResponseActionResult::Static {
+                    bytes,
+                    rcode,
+                    source: "response_action",
+                });
+            }
             Action::StaticTxtResponse { text, ttl } => {
                 let ttl = ttl.unwrap_or(300);
                 let (rcode, answers) = make_static_txt_answer(ctx.qname, text, ttl);

src/matcher/advanced_rule.rs

@@ -10,7 +10,7 @@ use smallvec::SmallVec;
 
 use crate::config::{Action, MatchOperator};
 use crate::engine::utils::parse_rcode;
-use crate::engine::{Decision, make_static_ip_answer};
+use crate::engine::{Decision, make_static_cname_answer, make_static_ip_answer};
 use crate::matcher::eval_match_chain;
 use crate::matcher::{RuntimeMatcher, RuntimePipeline, RuntimePipelineConfig, RuntimeRule};
 
@@ -68,6 +68,7 @@ pub enum CompiledMatcher {
 pub enum PrecomputedAction {
     Static { rcode: ResponseCode },
     StaticIp { ip: String },
+    StaticCname { target: String, ttl: u32 },
 }
 
 #[derive(Debug, Clone, Default)]
@@ -254,6 +255,10 @@ fn precompute_action(rule: &RuntimeRule) -> Option<PrecomputedAction> {
             parse_rcode(rcode).map(|rc| PrecomputedAction::Static { rcode: rc })
         }
         Action::StaticIpResponse { ip } => Some(PrecomputedAction::StaticIp { ip: ip.clone() }),
+        Action::StaticCnameResponse { target, ttl } => Some(PrecomputedAction::StaticCname {
+            target: target.clone(),
+            ttl: ttl.unwrap_or(300),
+        }),
         Action::Deny => Some(PrecomputedAction::Static {
             rcode: ResponseCode::Refused,
         }),
@@ -294,6 +299,10 @@ pub(crate) fn fast_static_match(
                     let (rcode, answers) = make_static_ip_answer(qname, qtype, ip);
                     return Some(Decision::Static { rcode, answers });
                 }
+                PrecomputedAction::StaticCname { target, ttl } => {
+                    let (rcode, answers) = make_static_cname_answer(qname, target, *ttl);
+                    return Some(Decision::Static { rcode, answers });
+                }
             }
         } else {
             // 第一个匹配的规则不可预计算（如 Forward、Jump 等）