From e990b2f4c045f5d1be02915ec7d8869d5475ed4e Mon Sep 17 00:00:00 2001
From: Viacheslav Hletenko <v.gletenko@vyos.io>
Date: Tue, 17 May 2022 21:30:50 +0000
Subject: firewall: T970: Add firewall group domain-group

Domain group allows to filter addresses by domain main
Resolved addresses as elements are stored to named "nft set"
that used in the nftables rules
Also added a dynamic "resolver" systemd daemon
vyos-domain-group-resolve.service which starts python script
for the domain-group addresses resolving by timeout 300 sec

set firewall group domain-group DOMAINS address 'example.com'
set firewall group domain-group DOMAINS address 'example.org'
set firewall name FOO rule 10 action 'drop'
set firewall name FOO rule 10 source group domain-group 'DOMAINS'
set interfaces ethernet eth0 firewall local name 'FOO'

nft list table ip filter
table ip filter {
  set DOMAINS {
    type ipv4_addr
    flags interval
    elements = { 192.0.2.1, 192.0.2.85,
	         203.0.113.55, 203.0.113.58 }
  }
  chain NAME_FOO {
    ip saddr @DOMAINS counter packets 0 bytes 0 drop comment "FOO-10"
    counter packets 0 bytes 0 return comment "FOO default-action accept"
  }
}
---
 .../include/firewall/source-destination-group.xml.i               | 8 ++++++++
 1 file changed, 8 insertions(+)

(limited to 'interface-definitions/include')

diff --git a/interface-definitions/include/firewall/source-destination-group.xml.i b/interface-definitions/include/firewall/source-destination-group.xml.i
index ab11e89e9..6ebee356c 100644
--- a/interface-definitions/include/firewall/source-destination-group.xml.i
+++ b/interface-definitions/include/firewall/source-destination-group.xml.i
@@ -12,6 +12,14 @@
         </completionHelp>
       </properties>
     </leafNode>
+    <leafNode name="domain-group">
+      <properties>
+        <help>Group of domains</help>
+        <completionHelp>
+          <path>firewall group domain-group</path>
+        </completionHelp>
+      </properties>
+    </leafNode>
     #include <include/firewall/mac-group.xml.i>
     <leafNode name="network-group">
       <properties>
-- 
cgit v1.2.3