From e990b2f4c045f5d1be02915ec7d8869d5475ed4e Mon Sep 17 00:00:00 2001
From: Viacheslav Hletenko <v.gletenko@vyos.io>
Date: Tue, 17 May 2022 21:30:50 +0000
Subject: firewall: T970: Add firewall group domain-group

Domain group allows to filter addresses by domain main
Resolved addresses as elements are stored to named "nft set"
that used in the nftables rules
Also added a dynamic "resolver" systemd daemon
vyos-domain-group-resolve.service which starts python script
for the domain-group addresses resolving by timeout 300 sec

set firewall group domain-group DOMAINS address 'example.com'
set firewall group domain-group DOMAINS address 'example.org'
set firewall name FOO rule 10 action 'drop'
set firewall name FOO rule 10 source group domain-group 'DOMAINS'
set interfaces ethernet eth0 firewall local name 'FOO'

nft list table ip filter
table ip filter {
  set DOMAINS {
    type ipv4_addr
    flags interval
    elements = { 192.0.2.1, 192.0.2.85,
	         203.0.113.55, 203.0.113.58 }
  }
  chain NAME_FOO {
    ip saddr @DOMAINS counter packets 0 bytes 0 drop comment "FOO-10"
    counter packets 0 bytes 0 return comment "FOO default-action accept"
  }
}
---
 interface-definitions/firewall.xml.in              | 24 ++++++++++++++++++++++
 .../firewall/source-destination-group.xml.i        |  8 ++++++++
 2 files changed, 32 insertions(+)

(limited to 'interface-definitions')

diff --git a/interface-definitions/firewall.xml.in b/interface-definitions/firewall.xml.in
index ff8d92a24..95b331e71 100644
--- a/interface-definitions/firewall.xml.in
+++ b/interface-definitions/firewall.xml.in
@@ -100,6 +100,30 @@
               #include <include/generic-description.xml.i>
             </children>
           </tagNode>
+          <tagNode name="domain-group">
+            <properties>
+              <help>Firewall domain-group</help>
+              <constraint>
+                <regex>[a-zA-Z0-9][\w\-\.]*</regex>
+              </constraint>
+            </properties>
+            <children>
+              <leafNode name="address">
+                <properties>
+                  <help>Domain-group member</help>
+                  <valueHelp>
+                    <format>txt</format>
+                    <description>Domain address to match</description>
+                  </valueHelp>
+                  <constraint>
+                    <regex>[a-z0-9]+([\-\.]{1}[a-z0-9]+)*\.[a-z]{2,5}?(\/.*)?</regex>
+                  </constraint>
+                  <multi/>
+                </properties>
+              </leafNode>
+              #include <include/generic-description.xml.i>
+            </children>
+          </tagNode>
           <tagNode name="ipv6-address-group">
             <properties>
               <help>Firewall ipv6-address-group</help>
diff --git a/interface-definitions/include/firewall/source-destination-group.xml.i b/interface-definitions/include/firewall/source-destination-group.xml.i
index ab11e89e9..6ebee356c 100644
--- a/interface-definitions/include/firewall/source-destination-group.xml.i
+++ b/interface-definitions/include/firewall/source-destination-group.xml.i
@@ -12,6 +12,14 @@
         </completionHelp>
       </properties>
     </leafNode>
+    <leafNode name="domain-group">
+      <properties>
+        <help>Group of domains</help>
+        <completionHelp>
+          <path>firewall group domain-group</path>
+        </completionHelp>
+      </properties>
+    </leafNode>
     #include <include/firewall/mac-group.xml.i>
     <leafNode name="network-group">
       <properties>
-- 
cgit v1.2.3