From 09db828b4fd02380e8d317d09afe6f7f3c484caf Mon Sep 17 00:00:00 2001 From: Nataliia Solomko Date: Fri, 30 Oct 2026 15:00:02 +0200 Subject: firewall: T9544: Fix fqdn match in prerouting raw rules A prerouting raw rule with a source or destination fqdn failed to commit: the rule referenced an FQDN set that was never declared, and the domain resolver never added addresses to it. Prerouting is now handled like the other hooks for both IPv4 and IPv6, so the set is created and filled with the resolved addresses. Added a smoketest covering both address families. --- python/vyos/firewall.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'python') diff --git a/python/vyos/firewall.py b/python/vyos/firewall.py index 5cc6cc3db..81c5a27b8 100755 --- a/python/vyos/firewall.py +++ b/python/vyos/firewall.py @@ -59,9 +59,10 @@ def fqdn_config_parse(config, node): suffix = path[5][0] set_name = f'{hook_name}_{priority}_{rule}_{suffix}' - if (path[0] == 'ipv4') and (path[1] == 'forward' or path[1] == 'input' or path[1] == 'output' or path[1] == 'name'): + fqdn_hooks = ['forward', 'input', 'output', 'prerouting', 'name'] + if (path[0] == 'ipv4') and (path[1] in fqdn_hooks): config['ip_fqdn'][set_name] = domain - elif (path[0] == 'ipv6') and (path[1] == 'forward' or path[1] == 'input' or path[1] == 'output' or path[1] == 'name'): + elif (path[0] == 'ipv6') and (path[1] in fqdn_hooks): if path[1] == 'name': set_name = f'name6_{priority}_{rule}_{suffix}' config['ip6_fqdn'][set_name] = domain -- cgit v1.2.3