diff --git a/src/etc/rc.update_bogons b/src/etc/rc.update_bogons index 214060879..67b0defb9 100755 --- a/src/etc/rc.update_bogons +++ b/src/etc/rc.update_bogons @@ -1,26 +1,36 @@ #!/bin/sh -# Global variables -proc_error="" +v4url="https://pkg.opnsense.org/bogons/fullbogons-ipv4.txt" +v6url="https://pkg.opnsense.org/bogons/fullbogons-ipv6.txt" +proc_error= -# Download and extract if necessary process_url() { - local file=$1 - local url=$2 + local file=$1 + local url=$2 - /usr/bin/fetch -a -T 30 -q -o $file "${url}" + /usr/bin/fetch -a -T 30 -q -o ${file}.sig "${url}.sig" + /usr/bin/fetch -a -T 30 -q -o ${file} "${url}" - if [ ! -f $file ]; then - echo "Could not download ${url}" | logger - proc_error="true" - fi + if [ ! -f ${file} ]; then + echo "Could not download ${url}" | logger + proc_error="true" + return 1 + fi + + if opnsense-verify -q /tmp/bogons; then + echo "Could not verify ${url}" | logger + proc_error="true" + return 1 + fi + + return 0 } echo "rc.update_bogons is starting up." | logger # Sleep for some time, unless an argument is specified. -if [ "$1" = "" ]; then +if [ -z "$1" ]; then # Grab a random value value=`od -A n -d -N2 /dev/random | awk '{ print $1 }'` echo "rc.update_bogons is sleeping for $value" | logger @@ -29,80 +39,54 @@ fi echo "rc.update_bogons is beginning the update cycle." | logger -v4url="https://pkg.opnsense.org/bogons/fullbogons-ipv4.txt" -v6url="https://pkg.opnsense.org/bogons/fullbogons-ipv6.txt" - -process_url /tmp/bogons "${v4url}" -process_url /tmp/bogonsv6 "${v6url}" - -if [ "$proc_error" != "" ]; then - # Relaunch and sleep - sh /usr/local/etc/rc.update_bogons & - exit +if process_url /tmp/bogons "${v4url}"; then + ENTRIES_MAX=`pfctl -s memory | awk '/table-entries/ { print $4 }'` + ENTRIES_TOT=`pfctl -vvsTables | awk '/Addresses/ {s+=$2}; END {print s}'` + ENTRIES_V4=`pfctl -vvsTables | awk '/-\tbogons$/ {getline; print $2}'` + LINES_V4=`wc -l /tmp/bogons | awk '{ print $1 }'` + if [ $ENTRIES_MAX -gt $((2*ENTRIES_TOT-${ENTRIES_V4:-0}+LINES_V4)) ]; then + # These bogons are removed as they are private. I'm not going + # to question this now, adding a big WARNING instead. Here be + # dragons... + egrep -v "^100.64.0.0/10|^192.168.0.0/16|^172.16.0.0/12|^10.0.0.0/8" /tmp/bogons > /usr/local/etc/bogons + RESULT=`/sbin/pfctl -t bogons -T replace -f /usr/local/etc/bogons 2>&1` + echo "$RESULT" | awk '{ print "Bogons V4 file downloaded: " $0 }' | logger + else + echo "Not updating IPv4 bogons (increase table-entries limit)" | logger + fi + rm /tmp/bogons* fi -BOGON_V4_CKSUM=`/usr/bin/fetch -T 30 -q -o - "${v4url}.md5" | awk '{ print $4 }'` -ON_DISK_V4_CKSUM=`md5 /tmp/bogons | awk '{ print $4 }'` -BOGON_V6_CKSUM=`/usr/bin/fetch -T 30 -q -o - "${v6url}.md5" | awk '{ print $4 }'` -ON_DISK_V6_CKSUM=`md5 /tmp/bogonsv6 | awk '{ print $4 }'` - -if [ "$BOGON_V4_CKSUM" = "$ON_DISK_V4_CKSUM" ] || [ "$BOGON_V6_CKSUM" = "$ON_DISK_V6_CKSUM" ]; then - - ENTRIES_MAX=`pfctl -s memory | awk '/table-entries/ { print $4 }'` - - if [ "$BOGON_V4_CKSUM" = "$ON_DISK_V4_CKSUM" ]; then - ENTRIES_TOT=`pfctl -vvsTables | awk '/Addresses/ {s+=$2}; END {print s}'` - ENTRIES_V4=`pfctl -vvsTables | awk '/-\tbogons$/ {getline; print $2}'` - LINES_V4=`wc -l /tmp/bogons | awk '{ print $1 }'` - if [ $ENTRIES_MAX -gt $((2*ENTRIES_TOT-${ENTRIES_V4:-0}+LINES_V4)) ]; then - # These bogons are removed as they are private. I'm not going - # to question this now, adding a big WARNING instead. Here be - # dragons... - egrep -v "^100.64.0.0/10|^192.168.0.0/16|^172.16.0.0/12|^10.0.0.0/8" /tmp/bogons > /usr/local/etc/bogons - RESULT=`/sbin/pfctl -t bogons -T replace -f /usr/local/etc/bogons 2>&1` - echo "$RESULT" | awk '{ print "Bogons V4 file downloaded: " $0 }' | logger - else - echo "Not updating IPv4 bogons (increase table-entries limit)" | logger - fi - rm /tmp/bogons - else - echo "Could not download ${v4url} (checksum mismatch)" | logger - checksum_error="true" - fi - - if [ "$BOGON_V6_CKSUM" = "$ON_DISK_V6_CKSUM" ]; then - BOGONS_V6_TABLE_COUNT=`pfctl -sTables | grep ^bogonsv6$ | wc -l | awk '{ print $1 }'` - ENTRIES_TOT=`pfctl -vvsTables | awk '/Addresses/ {s+=$2}; END {print s}'` - LINES_V6=`wc -l /tmp/bogonsv6 | awk '{ print $1 }'` - if [ $BOGONS_V6_TABLE_COUNT -gt 0 ]; then - ENTRIES_V6=`pfctl -vvsTables | awk '/-\tbogonsv6$/ {getline; print $2}'` - if [ $ENTRIES_MAX -gt $((2*ENTRIES_TOT-${ENTRIES_V6:-0}+LINES_V6)) ]; then - egrep -iv "^fc00::/7" /tmp/bogonsv6 > /usr/local/etc/bogonsv6 - RESULT=`/sbin/pfctl -t bogonsv6 -T replace -f /usr/local/etc/bogonsv6 2>&1` - echo "$RESULT" | awk '{ print "Bogons V6 file downloaded: " $0 }' | logger - else - echo "Not saving or updating IPv6 bogons (increase table-entries limit)" | logger - fi - else - if [ $ENTRIES_MAX -gt $((2*ENTRIES_TOT+LINES_V6)) ]; then - egrep -iv "^fc00::/7" /tmp/bogonsv6 > /usr/local/etc/bogonsv6 - echo "Bogons V6 file downloaded but not updating IPv6 bogons table because IPv6 Allow is off" | logger - else - echo "Not saving IPv6 bogons table (IPv6 Allow is off and table-entries limit is potentially too low)" | logger - fi - fi - rm /tmp/bogonsv6 - else - echo "Could not download ${v6url} (checksum mismatch)" | logger - checksum_error="true" - fi - +if process_url /tmp/bogonsv6 "${v6url}"; then + ENTRIES_MAX=`pfctl -s memory | awk '/table-entries/ { print $4 }'` + ENTRIES_TOT=`pfctl -vvsTables | awk '/Addresses/ {s+=$2}; END {print s}'` + BOGONS_V6_TABLE_COUNT=`pfctl -sTables | grep ^bogonsv6$ | wc -l | awk '{ print $1 }'` + ENTRIES_TOT=`pfctl -vvsTables | awk '/Addresses/ {s+=$2}; END {print s}'` + LINES_V6=`wc -l /tmp/bogonsv6 | awk '{ print $1 }'` + if [ $BOGONS_V6_TABLE_COUNT -gt 0 ]; then + ENTRIES_V6=`pfctl -vvsTables | awk '/-\tbogonsv6$/ {getline; print $2}'` + if [ $ENTRIES_MAX -gt $((2*ENTRIES_TOT-${ENTRIES_V6:-0}+LINES_V6)) ]; then + egrep -iv "^fc00::/7" /tmp/bogonsv6 > /usr/local/etc/bogonsv6 + RESULT=`/sbin/pfctl -t bogonsv6 -T replace -f /usr/local/etc/bogonsv6 2>&1` + echo "$RESULT" | awk '{ print "Bogons V6 file downloaded: " $0 }' | logger + else + echo "Not saving or updating IPv6 bogons (increase table-entries limit)" | logger + fi + else + if [ $ENTRIES_MAX -gt $((2*ENTRIES_TOT+LINES_V6)) ]; then + egrep -iv "^fc00::/7" /tmp/bogonsv6 > /usr/local/etc/bogonsv6 + echo "Bogons V6 file downloaded but not updating IPv6 bogons table because IPv6 Allow is off" | logger + else + echo "Not saving IPv6 bogons table (IPv6 Allow is off and table-entries limit is potentially too low)" | logger + fi + fi + rm /tmp/bogonsv6* fi -if [ "$checksum_error" != "" ]; then - # Relaunch and sleep - sh /usr/local/etc/rc.update_bogons & - exit +if [ -n "${proc_error}" ]; then + # Relaunch and sleep + sh /usr/local/etc/rc.update_bogons & + exit fi echo "rc.update_bogons is ending the update cycle." | logger