From 8dcb042bb2352717395ba3c17bc5437534c83af5 Mon Sep 17 00:00:00 2001
From: Nicolas Fort <nicolasfort1988@gmail.com>
Date: Fri, 30 Aug 2024 17:54:17 +0000
Subject: T6687: add fqdn support to nat rules.

(cherry picked from commit 4c3d037f036e84c77333a400b35bb1a628a1a118)
---
 src/conf_mode/nat.py | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

(limited to 'src/conf_mode/nat.py')

diff --git a/src/conf_mode/nat.py b/src/conf_mode/nat.py
index 39803fa02..98b2f3f29 100755
--- a/src/conf_mode/nat.py
+++ b/src/conf_mode/nat.py
@@ -26,10 +26,13 @@ from vyos.template import is_ip_network
 from vyos.utils.kernel import check_kmod
 from vyos.utils.dict import dict_search
 from vyos.utils.dict import dict_search_args
+from vyos.utils.file import write_file
 from vyos.utils.process import cmd
 from vyos.utils.process import run
+from vyos.utils.process import call
 from vyos.utils.network import is_addr_assigned
 from vyos.utils.network import interface_exists
+from vyos.firewall import fqdn_config_parse
 from vyos import ConfigError
 
 from vyos import airbag
@@ -39,6 +42,8 @@ k_mod = ['nft_nat', 'nft_chain_nat']
 
 nftables_nat_config = '/run/nftables_nat.conf'
 nftables_static_nat_conf = '/run/nftables_static-nat-rules.nft'
+domain_resolver_usage = '/run/use-vyos-domain-resolver-nat'
+domain_resolver_usage_firewall = '/run/use-vyos-domain-resolver-firewall'
 
 valid_groups = [
     'address_group',
@@ -71,6 +76,8 @@ def get_config(config=None):
     if 'dynamic_group' in nat['firewall_group']:
         del nat['firewall_group']['dynamic_group']
 
+    fqdn_config_parse(nat, 'nat')
+
     return nat
 
 def verify_rule(config, err_msg, groups_dict):
@@ -251,6 +258,19 @@ def apply(nat):
 
     call_dependents()
 
+    # DOMAIN RESOLVER
+    if nat and 'deleted' not in nat:
+        domain_action = 'restart'
+        if nat['ip_fqdn'].items():
+            text = f'# Automatically generated by nat.py\nThis file indicates that vyos-domain-resolver service is used by nat.\n'
+            write_file(domain_resolver_usage, text)
+        elif os.path.exists(domain_resolver_usage):
+            os.unlink(domain_resolver_usage)
+            if not os.path.exists(domain_resolver_usage_firewall):
+                # Firewall not using domain resolver
+                domain_action = 'stop'
+        call(f'systemctl {domain_action} vyos-domain-resolver.service')
+
     return None
 
 if __name__ == '__main__':
-- 
cgit v1.2.3