Prepare intel entity data earlier in the decision process

firewall/bypassing.go

@@ -23,10 +23,6 @@ func PreventBypassing(ctx context.Context, conn *network.Connection) (endpoints.
 			nsutil.NxDomain()
 	}
 
-	if !conn.Entity.LoadLists(ctx) {
-		return endpoints.Undeterminable, "", nil
-	}
-
 	if conn.Entity.MatchLists(resolverFilterLists) {
 		return endpoints.Denied,
 			"blocked rogue connection to DNS resolver",

firewall/master.go

@@ -94,6 +94,11 @@ func DecideOnConnection(ctx context.Context, conn *network.Connection, pkt packe
 		}
 	}
 
+	// prepare the entity and resolve all filterlist matches
+	conn.Entity.ResolveSubDomainLists(ctx, layeredProfile.FilterSubDomains())
+	conn.Entity.EnableCNAMECheck(ctx, layeredProfile.FilterCNAMEs())
+	conn.Entity.LoadLists(ctx)
+
 	// DNS request from the system resolver require a special decision process,
 	// because the original requesting process is not known. Here, we only check
 	// global-only and the most important per-app aspects. The resulting