From 069959a4828c49bced9b82214ebf2b5443c0913e Mon Sep 17 00:00:00 2001 From: Miaosen Wang Date: Wed, 3 Jun 2026 14:31:50 -0700 Subject: T8963: policy-route: trigger domain resolver for domain groups Signed-off-by: Miaosen Wang --- src/conf_mode/policy_route.py | 43 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) (limited to 'src') diff --git a/src/conf_mode/policy_route.py b/src/conf_mode/policy_route.py index 3cfdad913..63b6ec257 100755 --- a/src/conf_mode/policy_route.py +++ b/src/conf_mode/policy_route.py @@ -16,6 +16,7 @@ import os +from glob import glob from json import loads from sys import exit @@ -25,6 +26,8 @@ from vyos.configdiff import Diff, get_config_diff from vyos.template import render from vyos.utils.dict import dict_search_args from vyos.utils.dict import dict_search_recursive +from vyos.utils.file import write_file +from vyos.utils.process import call from vyos.utils.process import cmd from vyos.utils.process import run from vyos.utils.network import get_vrf_tableid @@ -38,6 +41,8 @@ airbag.enable() mark_offset = 0x7FFFFFFF nftables_conf = '/run/nftables_policy.conf' +domain_resolver_usage = '/run/use-vyos-domain-resolver-policy-route' +domain_resolver_usage_glob = '/run/use-vyos-domain-resolver*' valid_groups = [ 'address_group', @@ -187,6 +192,42 @@ def generate(policy): render(nftables_conf, 'firewall/nftables-policy.j2', policy) return None +def domain_group_used(policy): + for route in ['route', 'route6']: + if route not in policy: + continue + + for pol_conf in policy[route].values(): + if 'rule' not in pol_conf: + continue + + for rule_conf in pol_conf['rule'].values(): + if 'disable' in rule_conf: + continue + + for side in ['destination', 'source']: + if dict_search_args(rule_conf, side, 'group', 'domain_group') is not None: + return True + + return False + +def update_domain_resolver(policy): + domain_action = None + + if domain_group_used(policy): + text = '# Automatically generated by policy_route.py\nThis file indicates that vyos-domain-resolver service is used by policy_route.\n' + write_file(domain_resolver_usage, text) + domain_action = 'restart' + elif os.path.exists(domain_resolver_usage): + os.unlink(domain_resolver_usage) + domain_action = 'restart' + + if not glob(domain_resolver_usage_glob): + domain_action = 'stop' + + if domain_action: + call(f'systemctl {domain_action} vyos-domain-resolver.service') + def apply_table_marks(policy): for route in ['route', 'route6']: if route in policy: @@ -240,6 +281,8 @@ def apply(policy): apply_table_marks(policy) + update_domain_resolver(policy) + if policy['geoip_sets']['name'] or policy['geoip_sets']['ipv6_name']: if policy['geoip_updated'] or not geoip_refresh(): print('Updating GeoIP. Please wait...') -- cgit v1.2.3