mirror of
https://github.com/lucaspalomodevelop/core.git
synced 2026-03-19 19:15:22 +00:00
firewall: rework bogons, use signatures, closes #1248
This commit is contained in:
Franco Fichtner
parent
23744c595e
commit
ce27c194e7
@ -1,26 +1,36 @@
|
||||
#!/bin/sh
|
||||
|
||||
# Global variables
|
||||
proc_error=""
|
||||
v4url="https://pkg.opnsense.org/bogons/fullbogons-ipv4.txt"
|
||||
v6url="https://pkg.opnsense.org/bogons/fullbogons-ipv6.txt"
|
||||
proc_error=
|
||||
|
||||
# Download and extract if necessary
|
||||
process_url()
|
||||
{
|
||||
local file=$1
|
||||
local url=$2
|
||||
local file=$1
|
||||
local url=$2
|
||||
|
||||
/usr/bin/fetch -a -T 30 -q -o $file "${url}"
|
||||
/usr/bin/fetch -a -T 30 -q -o ${file}.sig "${url}.sig"
|
||||
/usr/bin/fetch -a -T 30 -q -o ${file} "${url}"
|
||||
|
||||
if [ ! -f $file ]; then
|
||||
echo "Could not download ${url}" | logger
|
||||
proc_error="true"
|
||||
fi
|
||||
if [ ! -f ${file} ]; then
|
||||
echo "Could not download ${url}" | logger
|
||||
proc_error="true"
|
||||
return 1
|
||||
fi
|
||||
|
||||
if opnsense-verify -q /tmp/bogons; then
|
||||
echo "Could not verify ${url}" | logger
|
||||
proc_error="true"
|
||||
return 1
|
||||
fi
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
echo "rc.update_bogons is starting up." | logger
|
||||
|
||||
# Sleep for some time, unless an argument is specified.
|
||||
if [ "$1" = "" ]; then
|
||||
if [ -z "$1" ]; then
|
||||
# Grab a random value
|
||||
value=`od -A n -d -N2 /dev/random | awk '{ print $1 }'`
|
||||
echo "rc.update_bogons is sleeping for $value" | logger
|
||||
@ -29,80 +39,54 @@ fi
|
||||
|
||||
echo "rc.update_bogons is beginning the update cycle." | logger
|
||||
|
||||
v4url="https://pkg.opnsense.org/bogons/fullbogons-ipv4.txt"
|
||||
v6url="https://pkg.opnsense.org/bogons/fullbogons-ipv6.txt"
|
||||
|
||||
process_url /tmp/bogons "${v4url}"
|
||||
process_url /tmp/bogonsv6 "${v6url}"
|
||||
|
||||
if [ "$proc_error" != "" ]; then
|
||||
# Relaunch and sleep
|
||||
sh /usr/local/etc/rc.update_bogons &
|
||||
exit
|
||||
if process_url /tmp/bogons "${v4url}"; then
|
||||
ENTRIES_MAX=`pfctl -s memory | awk '/table-entries/ { print $4 }'`
|
||||
ENTRIES_TOT=`pfctl -vvsTables | awk '/Addresses/ {s+=$2}; END {print s}'`
|
||||
ENTRIES_V4=`pfctl -vvsTables | awk '/-\tbogons$/ {getline; print $2}'`
|
||||
LINES_V4=`wc -l /tmp/bogons | awk '{ print $1 }'`
|
||||
if [ $ENTRIES_MAX -gt $((2*ENTRIES_TOT-${ENTRIES_V4:-0}+LINES_V4)) ]; then
|
||||
# These bogons are removed as they are private. I'm not going
|
||||
# to question this now, adding a big WARNING instead. Here be
|
||||
# dragons...
|
||||
egrep -v "^100.64.0.0/10|^192.168.0.0/16|^172.16.0.0/12|^10.0.0.0/8" /tmp/bogons > /usr/local/etc/bogons
|
||||
RESULT=`/sbin/pfctl -t bogons -T replace -f /usr/local/etc/bogons 2>&1`
|
||||
echo "$RESULT" | awk '{ print "Bogons V4 file downloaded: " $0 }' | logger
|
||||
else
|
||||
echo "Not updating IPv4 bogons (increase table-entries limit)" | logger
|
||||
fi
|
||||
rm /tmp/bogons*
|
||||
fi
|
||||
|
||||
BOGON_V4_CKSUM=`/usr/bin/fetch -T 30 -q -o - "${v4url}.md5" | awk '{ print $4 }'`
|
||||
ON_DISK_V4_CKSUM=`md5 /tmp/bogons | awk '{ print $4 }'`
|
||||
BOGON_V6_CKSUM=`/usr/bin/fetch -T 30 -q -o - "${v6url}.md5" | awk '{ print $4 }'`
|
||||
ON_DISK_V6_CKSUM=`md5 /tmp/bogonsv6 | awk '{ print $4 }'`
|
||||
|
||||
if [ "$BOGON_V4_CKSUM" = "$ON_DISK_V4_CKSUM" ] || [ "$BOGON_V6_CKSUM" = "$ON_DISK_V6_CKSUM" ]; then
|
||||
|
||||
ENTRIES_MAX=`pfctl -s memory | awk '/table-entries/ { print $4 }'`
|
||||
|
||||
if [ "$BOGON_V4_CKSUM" = "$ON_DISK_V4_CKSUM" ]; then
|
||||
ENTRIES_TOT=`pfctl -vvsTables | awk '/Addresses/ {s+=$2}; END {print s}'`
|
||||
ENTRIES_V4=`pfctl -vvsTables | awk '/-\tbogons$/ {getline; print $2}'`
|
||||
LINES_V4=`wc -l /tmp/bogons | awk '{ print $1 }'`
|
||||
if [ $ENTRIES_MAX -gt $((2*ENTRIES_TOT-${ENTRIES_V4:-0}+LINES_V4)) ]; then
|
||||
# These bogons are removed as they are private. I'm not going
|
||||
# to question this now, adding a big WARNING instead. Here be
|
||||
# dragons...
|
||||
egrep -v "^100.64.0.0/10|^192.168.0.0/16|^172.16.0.0/12|^10.0.0.0/8" /tmp/bogons > /usr/local/etc/bogons
|
||||
RESULT=`/sbin/pfctl -t bogons -T replace -f /usr/local/etc/bogons 2>&1`
|
||||
echo "$RESULT" | awk '{ print "Bogons V4 file downloaded: " $0 }' | logger
|
||||
else
|
||||
echo "Not updating IPv4 bogons (increase table-entries limit)" | logger
|
||||
fi
|
||||
rm /tmp/bogons
|
||||
else
|
||||
echo "Could not download ${v4url} (checksum mismatch)" | logger
|
||||
checksum_error="true"
|
||||
fi
|
||||
|
||||
if [ "$BOGON_V6_CKSUM" = "$ON_DISK_V6_CKSUM" ]; then
|
||||
BOGONS_V6_TABLE_COUNT=`pfctl -sTables | grep ^bogonsv6$ | wc -l | awk '{ print $1 }'`
|
||||
ENTRIES_TOT=`pfctl -vvsTables | awk '/Addresses/ {s+=$2}; END {print s}'`
|
||||
LINES_V6=`wc -l /tmp/bogonsv6 | awk '{ print $1 }'`
|
||||
if [ $BOGONS_V6_TABLE_COUNT -gt 0 ]; then
|
||||
ENTRIES_V6=`pfctl -vvsTables | awk '/-\tbogonsv6$/ {getline; print $2}'`
|
||||
if [ $ENTRIES_MAX -gt $((2*ENTRIES_TOT-${ENTRIES_V6:-0}+LINES_V6)) ]; then
|
||||
egrep -iv "^fc00::/7" /tmp/bogonsv6 > /usr/local/etc/bogonsv6
|
||||
RESULT=`/sbin/pfctl -t bogonsv6 -T replace -f /usr/local/etc/bogonsv6 2>&1`
|
||||
echo "$RESULT" | awk '{ print "Bogons V6 file downloaded: " $0 }' | logger
|
||||
else
|
||||
echo "Not saving or updating IPv6 bogons (increase table-entries limit)" | logger
|
||||
fi
|
||||
else
|
||||
if [ $ENTRIES_MAX -gt $((2*ENTRIES_TOT+LINES_V6)) ]; then
|
||||
egrep -iv "^fc00::/7" /tmp/bogonsv6 > /usr/local/etc/bogonsv6
|
||||
echo "Bogons V6 file downloaded but not updating IPv6 bogons table because IPv6 Allow is off" | logger
|
||||
else
|
||||
echo "Not saving IPv6 bogons table (IPv6 Allow is off and table-entries limit is potentially too low)" | logger
|
||||
fi
|
||||
fi
|
||||
rm /tmp/bogonsv6
|
||||
else
|
||||
echo "Could not download ${v6url} (checksum mismatch)" | logger
|
||||
checksum_error="true"
|
||||
fi
|
||||
|
||||
if process_url /tmp/bogonsv6 "${v6url}"; then
|
||||
ENTRIES_MAX=`pfctl -s memory | awk '/table-entries/ { print $4 }'`
|
||||
ENTRIES_TOT=`pfctl -vvsTables | awk '/Addresses/ {s+=$2}; END {print s}'`
|
||||
BOGONS_V6_TABLE_COUNT=`pfctl -sTables | grep ^bogonsv6$ | wc -l | awk '{ print $1 }'`
|
||||
ENTRIES_TOT=`pfctl -vvsTables | awk '/Addresses/ {s+=$2}; END {print s}'`
|
||||
LINES_V6=`wc -l /tmp/bogonsv6 | awk '{ print $1 }'`
|
||||
if [ $BOGONS_V6_TABLE_COUNT -gt 0 ]; then
|
||||
ENTRIES_V6=`pfctl -vvsTables | awk '/-\tbogonsv6$/ {getline; print $2}'`
|
||||
if [ $ENTRIES_MAX -gt $((2*ENTRIES_TOT-${ENTRIES_V6:-0}+LINES_V6)) ]; then
|
||||
egrep -iv "^fc00::/7" /tmp/bogonsv6 > /usr/local/etc/bogonsv6
|
||||
RESULT=`/sbin/pfctl -t bogonsv6 -T replace -f /usr/local/etc/bogonsv6 2>&1`
|
||||
echo "$RESULT" | awk '{ print "Bogons V6 file downloaded: " $0 }' | logger
|
||||
else
|
||||
echo "Not saving or updating IPv6 bogons (increase table-entries limit)" | logger
|
||||
fi
|
||||
else
|
||||
if [ $ENTRIES_MAX -gt $((2*ENTRIES_TOT+LINES_V6)) ]; then
|
||||
egrep -iv "^fc00::/7" /tmp/bogonsv6 > /usr/local/etc/bogonsv6
|
||||
echo "Bogons V6 file downloaded but not updating IPv6 bogons table because IPv6 Allow is off" | logger
|
||||
else
|
||||
echo "Not saving IPv6 bogons table (IPv6 Allow is off and table-entries limit is potentially too low)" | logger
|
||||
fi
|
||||
fi
|
||||
rm /tmp/bogonsv6*
|
||||
fi
|
||||
|
||||
if [ "$checksum_error" != "" ]; then
|
||||
# Relaunch and sleep
|
||||
sh /usr/local/etc/rc.update_bogons &
|
||||
exit
|
||||
if [ -n "${proc_error}" ]; then
|
||||
# Relaunch and sleep
|
||||
sh /usr/local/etc/rc.update_bogons &
|
||||
exit
|
||||
fi
|
||||
|
||||
echo "rc.update_bogons is ending the update cycle." | logger
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user