From e990b2f4c045f5d1be02915ec7d8869d5475ed4e Mon Sep 17 00:00:00 2001 From: Viacheslav Hletenko Date: Tue, 17 May 2022 21:30:50 +0000 Subject: firewall: T970: Add firewall group domain-group Domain group allows to filter addresses by domain main Resolved addresses as elements are stored to named "nft set" that used in the nftables rules Also added a dynamic "resolver" systemd daemon vyos-domain-group-resolve.service which starts python script for the domain-group addresses resolving by timeout 300 sec set firewall group domain-group DOMAINS address 'example.com' set firewall group domain-group DOMAINS address 'example.org' set firewall name FOO rule 10 action 'drop' set firewall name FOO rule 10 source group domain-group 'DOMAINS' set interfaces ethernet eth0 firewall local name 'FOO' nft list table ip filter table ip filter { set DOMAINS { type ipv4_addr flags interval elements = { 192.0.2.1, 192.0.2.85, 203.0.113.55, 203.0.113.58 } } chain NAME_FOO { ip saddr @DOMAINS counter packets 0 bytes 0 drop comment "FOO-10" counter packets 0 bytes 0 return comment "FOO default-action accept" } } --- src/conf_mode/firewall.py | 27 +++++++++++++- src/helpers/vyos-domain-group-resolve.py | 54 +++++++++++++++++++++++++++ src/systemd/vyos-domain-group-resolve.service | 11 ++++++ 3 files changed, 91 insertions(+), 1 deletion(-) create mode 100755 src/helpers/vyos-domain-group-resolve.py create mode 100644 src/systemd/vyos-domain-group-resolve.service (limited to 'src') diff --git a/src/conf_mode/firewall.py b/src/conf_mode/firewall.py index 6924bf555..3c6aff386 100755 --- a/src/conf_mode/firewall.py +++ b/src/conf_mode/firewall.py @@ -1,6 +1,6 @@ #!/usr/bin/env python3 # -# Copyright (C) 2021 VyOS maintainers and contributors +# Copyright (C) 2021-2022 VyOS maintainers and contributors # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License version 2 or later as @@ -26,7 +26,13 @@ from vyos.config import Config from vyos.configdict import dict_merge from vyos.configdict import node_changed from vyos.configdiff import get_config_diff, Diff +from vyos.firewall import get_ips_domains_dict +from vyos.firewall import nft_add_set_elements +from vyos.firewall import nft_flush_set +from vyos.firewall import nft_init_set +from vyos.firewall import nft_update_set_elements from vyos.template import render +from vyos.util import call from vyos.util import cmd from vyos.util import dict_search_args from vyos.util import process_named_running @@ -408,6 +414,25 @@ def apply(firewall): if install_result == 1: raise ConfigError('Failed to apply firewall') + # set fireall group domain-group xxx + if 'group' in firewall: + if 'domain_group' in firewall['group']: + # T970 Enable a resolver (systemd daemon) that checks + # domain-group addresses and update entries for domains by timeout + # If router loaded without internet connection or for synchronization + call('systemctl restart vyos-domain-group-resolve.service') + for group, group_config in firewall['group']['domain_group'].items(): + domains = [] + for address in group_config['address']: + domains.append(address) + # Add elements to domain-group, try to resolve domain => ip + # and add elements to nft set + elements = get_ips_domains_dict(domains) + nft_init_set(group) + nft_add_set_elements(group, elements) + else: + call('systemctl stop vyos-domain-group-resolve.service') + if 'state_policy' in firewall and not state_policy_rule_exists(): for chain in ['VYOS_FW_FORWARD', 'VYOS_FW_OUTPUT', 'VYOS_FW_LOCAL']: cmd(f'nft insert rule ip filter {chain} jump VYOS_STATE_POLICY') diff --git a/src/helpers/vyos-domain-group-resolve.py b/src/helpers/vyos-domain-group-resolve.py new file mode 100755 index 000000000..ebb2057ec --- /dev/null +++ b/src/helpers/vyos-domain-group-resolve.py @@ -0,0 +1,54 @@ +#!/usr/bin/env python3 +# +# Copyright (C) 2022 VyOS maintainers and contributors +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 or later as +# published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + + +import time + +from vyos.configquery import ConfigTreeQuery +from vyos.firewall import get_ips_domains_dict +from vyos.firewall import nft_add_set_elements +from vyos.firewall import nft_flush_set +from vyos.firewall import nft_init_set +from vyos.firewall import nft_update_set_elements +from vyos.util import call + + +base = ['firewall', 'group', 'domain-group'] +check_required = True +count_failed = 0 +# Timeout in sec between checks +timeout = 300 + + +if __name__ == '__main__': + + while check_required: + config = ConfigTreeQuery() + if config.exists(base): + domain_groups = config.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True) + for set_name, domain_config in domain_groups.items(): + list_domains = domain_config['address'] + elements = get_ips_domains_dict(list_domains) + # Resolve successful + if bool(elements): + nft_update_set_elements(set_name, elements) + count_failed = 0 + else: + count_failed += 1 + # Domains not resolved 3 times by timeout + if count_failed >= timeout * 3: + nft_flush_set(set_name) + time.sleep(timeout) diff --git a/src/systemd/vyos-domain-group-resolve.service b/src/systemd/vyos-domain-group-resolve.service new file mode 100644 index 000000000..29628fddb --- /dev/null +++ b/src/systemd/vyos-domain-group-resolve.service @@ -0,0 +1,11 @@ +[Unit] +Description=VyOS firewall domain-group resolver +After=vyos-router.service + +[Service] +Type=simple +Restart=always +ExecStart=/usr/bin/python3 /usr/libexec/vyos/vyos-domain-group-resolve.py + +[Install] +WantedBy=multi-user.target -- cgit v1.2.3 From d1bdf2b9d80d2e34b7370823d6f684102d7c9f4e Mon Sep 17 00:00:00 2001 From: sarthurdev <965089+sarthurdev@users.noreply.github.com> Date: Sun, 5 Jun 2022 10:59:47 +0200 Subject: firewall: T970: Maintain a domain state to fallback if resolution fails --- python/vyos/firewall.py | 9 ++++----- src/conf_mode/firewall.py | 3 ++- src/helpers/vyos-domain-group-resolve.py | 24 +++++++++++++++--------- 3 files changed, 21 insertions(+), 15 deletions(-) (limited to 'src') diff --git a/python/vyos/firewall.py b/python/vyos/firewall.py index 8a1237ca9..b962c4f18 100644 --- a/python/vyos/firewall.py +++ b/python/vyos/firewall.py @@ -26,21 +26,20 @@ def get_ips_domains_dict(list_domains): """ Get list of IPv4 addresses by list of domains Ex: get_ips_domains_dict(['ex1.com', 'ex2.com']) - ['192.0.2.1', '192.0.2.2', '192.0.2.3'] + {'ex1.com': ['192.0.2.1'], 'ex2.com': ['192.0.2.2', '192.0.2.3']} """ from socket import gethostbyname_ex from socket import gaierror - ip_list = [] + ip_dict = {} for domain in list_domains: try: _, _, ips = gethostbyname_ex(domain) - for entry in ips: - ip_list.append(entry) + ip_dict[domain] = ips except gaierror: pass - return ip_list + return ip_dict def nft_init_set(group_name, table="filter", family="ip"): """ diff --git a/src/conf_mode/firewall.py b/src/conf_mode/firewall.py index 3c6aff386..335098bf1 100755 --- a/src/conf_mode/firewall.py +++ b/src/conf_mode/firewall.py @@ -427,7 +427,8 @@ def apply(firewall): domains.append(address) # Add elements to domain-group, try to resolve domain => ip # and add elements to nft set - elements = get_ips_domains_dict(domains) + ip_dict = get_ips_domains_dict(domains) + elements = sum(ip_dict.values(), []) nft_init_set(group) nft_add_set_elements(group, elements) else: diff --git a/src/helpers/vyos-domain-group-resolve.py b/src/helpers/vyos-domain-group-resolve.py index ebb2057ec..e8501cfc6 100755 --- a/src/helpers/vyos-domain-group-resolve.py +++ b/src/helpers/vyos-domain-group-resolve.py @@ -28,10 +28,11 @@ from vyos.util import call base = ['firewall', 'group', 'domain-group'] check_required = True -count_failed = 0 +# count_failed = 0 # Timeout in sec between checks timeout = 300 +domain_state = {} if __name__ == '__main__': @@ -41,14 +42,19 @@ if __name__ == '__main__': domain_groups = config.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True) for set_name, domain_config in domain_groups.items(): list_domains = domain_config['address'] - elements = get_ips_domains_dict(list_domains) + elements = [] + ip_dict = get_ips_domains_dict(list_domains) + + for domain in list_domains: + # Resolution succeeded, update domain state + if domain in ip_dict: + domain_state[domain] = ip_dict[domain] + elements += ip_dict[domain] + # Resolution failed, use previous domain state + elif domain in domain_state: + elements += domain_state[domain] + # Resolve successful - if bool(elements): + if elements: nft_update_set_elements(set_name, elements) - count_failed = 0 - else: - count_failed += 1 - # Domains not resolved 3 times by timeout - if count_failed >= timeout * 3: - nft_flush_set(set_name) time.sleep(timeout) -- cgit v1.2.3