diff options
| author | Christian Breunig <christian@breunig.cc> | 2024-09-30 17:27:17 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-09-30 17:27:17 +0200 |
| commit | e663fc49edc3043d63b648b482b633c1ff233ac4 (patch) | |
| tree | df2ba35456a772222de1dd475d8ff21faf883571 /src/conf_mode/nat.py | |
| parent | 2cd0baa50e244529462e3aed064b923c6cbab859 (diff) | |
| parent | 8dcb042bb2352717395ba3c17bc5437534c83af5 (diff) | |
| download | vyos-1x-e663fc49edc3043d63b648b482b633c1ff233ac4.tar.gz vyos-1x-e663fc49edc3043d63b648b482b633c1ff233ac4.zip | |
Merge pull request #4113 from vyos/mergify/bp/circinus/pr-4024
T6687: add fqdn support to nat rules. (backport #4024)
Diffstat (limited to 'src/conf_mode/nat.py')
| -rwxr-xr-x | src/conf_mode/nat.py | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/src/conf_mode/nat.py b/src/conf_mode/nat.py index 39803fa02..98b2f3f29 100755 --- a/src/conf_mode/nat.py +++ b/src/conf_mode/nat.py @@ -26,10 +26,13 @@ from vyos.template import is_ip_network from vyos.utils.kernel import check_kmod from vyos.utils.dict import dict_search from vyos.utils.dict import dict_search_args +from vyos.utils.file import write_file from vyos.utils.process import cmd from vyos.utils.process import run +from vyos.utils.process import call from vyos.utils.network import is_addr_assigned from vyos.utils.network import interface_exists +from vyos.firewall import fqdn_config_parse from vyos import ConfigError from vyos import airbag @@ -39,6 +42,8 @@ k_mod = ['nft_nat', 'nft_chain_nat'] nftables_nat_config = '/run/nftables_nat.conf' nftables_static_nat_conf = '/run/nftables_static-nat-rules.nft' +domain_resolver_usage = '/run/use-vyos-domain-resolver-nat' +domain_resolver_usage_firewall = '/run/use-vyos-domain-resolver-firewall' valid_groups = [ 'address_group', @@ -71,6 +76,8 @@ def get_config(config=None): if 'dynamic_group' in nat['firewall_group']: del nat['firewall_group']['dynamic_group'] + fqdn_config_parse(nat, 'nat') + return nat def verify_rule(config, err_msg, groups_dict): @@ -251,6 +258,19 @@ def apply(nat): call_dependents() + # DOMAIN RESOLVER + if nat and 'deleted' not in nat: + domain_action = 'restart' + if nat['ip_fqdn'].items(): + text = f'# Automatically generated by nat.py\nThis file indicates that vyos-domain-resolver service is used by nat.\n' + write_file(domain_resolver_usage, text) + elif os.path.exists(domain_resolver_usage): + os.unlink(domain_resolver_usage) + if not os.path.exists(domain_resolver_usage_firewall): + # Firewall not using domain resolver + domain_action = 'stop' + call(f'systemctl {domain_action} vyos-domain-resolver.service') + return None if __name__ == '__main__': |