Merge pull request #5254 from jd82k/domain-group

T8963: policy-route: trigger domain resolver for domain groups

1 files changed, 43 insertions, 0 deletions

diff --git a/src/conf_mode/policy_route.py b/src/conf_mode/policy_route.py
index 64915632c..ca12ebe7b 100755
--- a/src/conf_mode/policy_route.py
+++ b/src/conf_mode/policy_route.py
@@ -16,6 +16,7 @@
 
 import os
 
+from glob import glob
 from json import loads
 from sys import exit
 
@@ -25,6 +26,8 @@ from vyos.configdiff import Diff, get_config_diff
 from vyos.template import render
 from vyos.utils.dict import dict_search_args
 from vyos.utils.dict import dict_search_recursive
+from vyos.utils.file import write_file
+from vyos.utils.process import call
 from vyos.utils.process import cmd
 from vyos.utils.process import run
 from vyos.utils.network import get_vrf_tableid
@@ -38,6 +41,8 @@ airbag.enable()
 
 mark_offset = 0x7FFFFFFF
 nftables_conf = '/run/nftables_policy.conf'
+domain_resolver_usage = '/run/use-vyos-domain-resolver-policy-route'
+domain_resolver_usage_glob = '/run/use-vyos-domain-resolver*'
 
 valid_groups = [
     'address_group',
@@ -197,6 +202,42 @@ def generate(policy):
     render(nftables_conf, 'firewall/nftables-policy.j2', policy)
     return None
 
+def domain_group_used(policy):
+    for route in ['route', 'route6']:
+        if route not in policy:
+            continue
+
+        for pol_conf in policy[route].values():
+            if 'rule' not in pol_conf:
+                continue
+
+            for rule_conf in pol_conf['rule'].values():
+                if 'disable' in rule_conf:
+                    continue
+
+                for side in ['destination', 'source']:
+                    if dict_search_args(rule_conf, side, 'group', 'domain_group') is not None:
+                        return True
+
+    return False
+
+def update_domain_resolver(policy):
+    domain_action = None
+
+    if domain_group_used(policy):
+        text = '# Automatically generated by policy_route.py\nThis file indicates that vyos-domain-resolver service is used by policy_route.\n'
+        write_file(domain_resolver_usage, text)
+        domain_action = 'restart'
+    elif os.path.exists(domain_resolver_usage):
+        os.unlink(domain_resolver_usage)
+        domain_action = 'restart'
+
+        if not glob(domain_resolver_usage_glob):
+            domain_action = 'stop'
+
+    if domain_action:
+        call(f'systemctl {domain_action} vyos-domain-resolver.service')
+
 def apply_table_marks(policy):
     for route in ['route', 'route6']:
         if route in policy:
@@ -250,6 +291,8 @@ def apply(policy):
 
     apply_table_marks(policy)
 
+    update_domain_resolver(policy)
+
     if policy['geoip_sets']['name'] or policy['geoip_sets']['ipv6_name']:
         if policy['geoip_updated'] or not geoip_refresh():
             print('Updating GeoIP. Please wait...')