firewall: T970: Add firewall group domain-group

Domain group allows to filter addresses by domain main
Resolved addresses as elements are stored to named "nft set"
that used in the nftables rules
Also added a dynamic "resolver" systemd daemon
vyos-domain-group-resolve.service which starts python script
for the domain-group addresses resolving by timeout 300 sec

set firewall group domain-group DOMAINS address 'example.com'
set firewall group domain-group DOMAINS address 'example.org'
set firewall name FOO rule 10 action 'drop'
set firewall name FOO rule 10 source group domain-group 'DOMAINS'
set interfaces ethernet eth0 firewall local name 'FOO'

nft list table ip filter
table ip filter {
  set DOMAINS {
    type ipv4_addr
    flags interval
    elements = { 192.0.2.1, 192.0.2.85,
	         203.0.113.55, 203.0.113.58 }
  }
  chain NAME_FOO {
    ip saddr @DOMAINS counter packets 0 bytes 0 drop comment "FOO-10"
    counter packets 0 bytes 0 return comment "FOO default-action accept"
  }
}

1 files changed, 26 insertions, 1 deletions

diff --git a/src/conf_mode/firewall.py b/src/conf_mode/firewall.py
index 6924bf555..3c6aff386 100755
--- a/src/conf_mode/firewall.py
+++ b/src/conf_mode/firewall.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021 VyOS maintainers and contributors
+# Copyright (C) 2021-2022 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -26,7 +26,13 @@ from vyos.config import Config
 from vyos.configdict import dict_merge
 from vyos.configdict import node_changed
 from vyos.configdiff import get_config_diff, Diff
+from vyos.firewall import get_ips_domains_dict
+from vyos.firewall import nft_add_set_elements
+from vyos.firewall import nft_flush_set
+from vyos.firewall import nft_init_set
+from vyos.firewall import nft_update_set_elements
 from vyos.template import render
+from vyos.util import call
 from vyos.util import cmd
 from vyos.util import dict_search_args
 from vyos.util import process_named_running
@@ -408,6 +414,25 @@ def apply(firewall):
     if install_result == 1:
         raise ConfigError('Failed to apply firewall')
 
+    # set fireall group domain-group xxx
+    if 'group' in firewall:
+        if 'domain_group' in firewall['group']:
+            # T970 Enable a resolver (systemd daemon) that checks
+            # domain-group addresses and update entries for domains by timeout
+            # If router loaded without internet connection or for synchronization
+            call('systemctl restart vyos-domain-group-resolve.service')
+            for group, group_config in firewall['group']['domain_group'].items():
+                domains = []
+                for address in group_config['address']:
+                    domains.append(address)
+                # Add elements to domain-group, try to resolve domain => ip
+                # and add elements to nft set
+                elements = get_ips_domains_dict(domains)
+                nft_init_set(group)
+                nft_add_set_elements(group, elements)
+        else:
+            call('systemctl stop vyos-domain-group-resolve.service')
+
     if 'state_policy' in firewall and not state_policy_rule_exists():
         for chain in ['VYOS_FW_FORWARD', 'VYOS_FW_OUTPUT', 'VYOS_FW_LOCAL']:
             cmd(f'nft insert rule ip filter {chain} jump VYOS_STATE_POLICY')