From 3ff1472a8a8d38b18965a0457e1ec49384f965ad Mon Sep 17 00:00:00 2001
From: Viet Huynh <xa.lach@yahoo.com>
Date: Mon, 4 Sep 2023 19:13:46 +0700
Subject: [PATCH] updated gateway rule to block subdomains

---
 cf_gateway_rule_create.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cf_gateway_rule_create.js b/cf_gateway_rule_create.js
index 9b70f75..f33bae9 100644
--- a/cf_gateway_rule_create.js
+++ b/cf_gateway_rule_create.js
@@ -30,7 +30,7 @@ async function getZeroTrustLists() {
 
     // Build the wirefilter expression
     for (const list of filtered_lists) {
-        wirefilter_expression += `dns.fqdn in \$${list.id} or `;
+        wirefilter_expression += `any(dns.domains[*] in \$${list.id}) or `;
     }
     // Remove the trailing ' or '
     if (wirefilter_expression.endsWith(' or ')) {