Merge pull request #1327 from sever-sever/T970

firewall: T970: Add firewall group domain-group

3 files changed, 98 insertions, 1 deletions

diff --git a/src/conf_mode/firewall.py b/src/conf_mode/firewall.py
index 6924bf555..335098bf1 100755
--- a/src/conf_mode/firewall.py
+++ b/src/conf_mode/firewall.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021 VyOS maintainers and contributors
+# Copyright (C) 2021-2022 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -26,7 +26,13 @@ from vyos.config import Config
 from vyos.configdict import dict_merge
 from vyos.configdict import node_changed
 from vyos.configdiff import get_config_diff, Diff
+from vyos.firewall import get_ips_domains_dict
+from vyos.firewall import nft_add_set_elements
+from vyos.firewall import nft_flush_set
+from vyos.firewall import nft_init_set
+from vyos.firewall import nft_update_set_elements
 from vyos.template import render
+from vyos.util import call
 from vyos.util import cmd
 from vyos.util import dict_search_args
 from vyos.util import process_named_running
@@ -408,6 +414,26 @@ def apply(firewall):
     if install_result == 1:
         raise ConfigError('Failed to apply firewall')
 
+    # set fireall group domain-group xxx
+    if 'group' in firewall:
+        if 'domain_group' in firewall['group']:
+            # T970 Enable a resolver (systemd daemon) that checks
+            # domain-group addresses and update entries for domains by timeout
+            # If router loaded without internet connection or for synchronization
+            call('systemctl restart vyos-domain-group-resolve.service')
+            for group, group_config in firewall['group']['domain_group'].items():
+                domains = []
+                for address in group_config['address']:
+                    domains.append(address)
+                # Add elements to domain-group, try to resolve domain => ip
+                # and add elements to nft set
+                ip_dict = get_ips_domains_dict(domains)
+                elements = sum(ip_dict.values(), [])
+                nft_init_set(group)
+                nft_add_set_elements(group, elements)
+        else:
+            call('systemctl stop vyos-domain-group-resolve.service')
+
     if 'state_policy' in firewall and not state_policy_rule_exists():
         for chain in ['VYOS_FW_FORWARD', 'VYOS_FW_OUTPUT', 'VYOS_FW_LOCAL']:
             cmd(f'nft insert rule ip filter {chain} jump VYOS_STATE_POLICY')
diff --git a/src/helpers/vyos-domain-group-resolve.py b/src/helpers/vyos-domain-group-resolve.py
new file mode 100755
index 000000000..e8501cfc6
--- /dev/null
+++ b/src/helpers/vyos-domain-group-resolve.py
@@ -0,0 +1,60 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2022 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+
+import time
+
+from vyos.configquery import ConfigTreeQuery
+from vyos.firewall import get_ips_domains_dict
+from vyos.firewall import nft_add_set_elements
+from vyos.firewall import nft_flush_set
+from vyos.firewall import nft_init_set
+from vyos.firewall import nft_update_set_elements
+from vyos.util import call
+
+
+base = ['firewall', 'group', 'domain-group']
+check_required = True
+# count_failed = 0
+# Timeout in sec between checks
+timeout = 300
+
+domain_state = {}
+
+if __name__ == '__main__':
+
+    while check_required:
+        config = ConfigTreeQuery()
+        if config.exists(base):
+            domain_groups = config.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True)
+            for set_name, domain_config in domain_groups.items():
+                list_domains = domain_config['address']
+                elements = []
+                ip_dict = get_ips_domains_dict(list_domains)
+
+                for domain in list_domains:
+                    # Resolution succeeded, update domain state
+                    if domain in ip_dict:
+                        domain_state[domain] = ip_dict[domain]
+                        elements += ip_dict[domain]
+                    # Resolution failed, use previous domain state
+                    elif domain in domain_state:
+                        elements += domain_state[domain]
+
+                # Resolve successful
+                if elements:
+                    nft_update_set_elements(set_name, elements)
+        time.sleep(timeout)
diff --git a/src/systemd/vyos-domain-group-resolve.service b/src/systemd/vyos-domain-group-resolve.service
new file mode 100644
index 000000000..29628fddb
--- /dev/null
+++ b/src/systemd/vyos-domain-group-resolve.service
@@ -0,0 +1,11 @@
+[Unit]
+Description=VyOS firewall domain-group resolver
+After=vyos-router.service
+
+[Service]
+Type=simple
+Restart=always
+ExecStart=/usr/bin/python3 /usr/libexec/vyos/vyos-domain-group-resolve.py
+
+[Install]
+WantedBy=multi-user.target