| 1 |
14f9c43f
|
Scott Ullrich
|
#!/bin/sh
|
| 2 |
|
|
|
| 3 |
|
|
# Update bogons file
|
| 4 |
|
|
# Part of the pfSense project
|
| 5 |
5775f324
|
Chris Buechler
|
# https://www.pfsense.org
|
| 6 |
14f9c43f
|
Scott Ullrich
|
|
| 7 |
7c05f800
|
bcyrill
|
# Global variables
|
| 8 |
|
|
proc_error=""
|
| 9 |
|
|
|
| 10 |
|
|
# Download and extract if necessary
|
| 11 |
c98951ce
|
bcyrill
|
process_url() {
|
| 12 |
7c05f800
|
bcyrill
|
local file=$1
|
| 13 |
|
|
local url=$2
|
| 14 |
|
|
local filename=${url##*/}
|
| 15 |
|
|
local ext=${filename#*.}
|
| 16 |
|
|
|
| 17 |
690b557c
|
Chris Buechler
|
/usr/bin/fetch -a -w 600 -T 30 -q -o $file "${url}"
|
| 18 |
7c05f800
|
bcyrill
|
|
| 19 |
|
|
if [ ! -f $file ]; then
|
| 20 |
|
|
echo "Could not download ${url}" | logger
|
| 21 |
|
|
proc_error="true"
|
| 22 |
|
|
fi
|
| 23 |
|
|
|
| 24 |
|
|
case "$ext" in
|
| 25 |
|
|
tar)
|
| 26 |
|
|
mv $file $file.tmp
|
| 27 |
|
|
/usr/bin/tar -xf $file.tmp -O > $file 2> /dev/null
|
| 28 |
|
|
;;
|
| 29 |
|
|
tar.gz)
|
| 30 |
c98951ce
|
bcyrill
|
mv $file $file.tmp
|
| 31 |
|
|
/usr/bin/tar -xzf $file.tmp -O > $file 2> /dev/null
|
| 32 |
|
|
;;
|
| 33 |
7c05f800
|
bcyrill
|
tgz)
|
| 34 |
|
|
mv $file $file.tmp
|
| 35 |
|
|
/usr/bin/tar -xzf $file.tmp -O > $file 2> /dev/null
|
| 36 |
|
|
;;
|
| 37 |
|
|
tar.bz2)
|
| 38 |
|
|
mv $file $file.tmp
|
| 39 |
|
|
/usr/bin/tar -xjf $file.tmp -O > $file 2> /dev/null
|
| 40 |
|
|
;;
|
| 41 |
|
|
*)
|
| 42 |
|
|
;;
|
| 43 |
|
|
esac
|
| 44 |
|
|
|
| 45 |
|
|
if [ -f $file.tmp ]; then
|
| 46 |
|
|
rm $file.tmp
|
| 47 |
|
|
fi
|
| 48 |
|
|
|
| 49 |
|
|
if [ ! -f $file ]; then
|
| 50 |
|
|
echo "Could not extract ${filename}" | logger
|
| 51 |
|
|
proc_error="true"
|
| 52 |
|
|
fi
|
| 53 |
|
|
}
|
| 54 |
|
|
|
| 55 |
9c9b1833
|
Scott Ullrich
|
echo "rc.update_bogons.sh is starting up." | logger
|
| 56 |
|
|
|
| 57 |
342a2f18
|
Phil Davis
|
# Sleep for some time, unless an argument is specified.
|
| 58 |
5de28171
|
Scott Ullrich
|
if [ "$1" = "" ]; then
|
| 59 |
9dbb93ba
|
Chris Buechler
|
# Grab a random value
|
| 60 |
|
|
value=`od -A n -d -N2 /dev/random | awk '{ print $1 }'`
|
| 61 |
|
|
echo "rc.update_bogons.sh is sleeping for $value" | logger
|
| 62 |
|
|
sleep $value
|
| 63 |
fc1e7d9f
|
Chris Buechler
|
fi
|
| 64 |
38b65b80
|
Scott Ullrich
|
|
| 65 |
9c9b1833
|
Scott Ullrich
|
echo "rc.update_bogons.sh is beginning the update cycle." | logger
|
| 66 |
|
|
|
| 67 |
92276df6
|
bcyrill
|
# Load custom bogon configuration
|
| 68 |
|
|
if [ -f /var/etc/bogon_custom ]; then
|
| 69 |
|
|
. /var/etc/bogon_custom
|
| 70 |
|
|
fi
|
| 71 |
|
|
|
| 72 |
|
|
# Set default values if not overriden
|
| 73 |
375fce94
|
Chris Buechler
|
v4url=${v4url:-"https://files.pfsense.org/lists/fullbogons-ipv4.txt"}
|
| 74 |
|
|
v6url=${v6url:-"https://files.pfsense.org/lists/fullbogons-ipv6.txt"}
|
| 75 |
92276df6
|
bcyrill
|
v4urlcksum=${v4urlcksum:-"${v4url}.md5"}
|
| 76 |
|
|
v6urlcksum=${v6urlcksum:-"${v6url}.md5"}
|
| 77 |
|
|
|
| 78 |
7c05f800
|
bcyrill
|
process_url /tmp/bogons "${v4url}"
|
| 79 |
|
|
process_url /tmp/bogonsv6 "${v6url}"
|
| 80 |
4a41dff7
|
smos
|
|
| 81 |
7c05f800
|
bcyrill
|
if [ "$proc_error" != "" ]; then
|
| 82 |
7de4359a
|
Seth Mos
|
# Relaunch and sleep
|
| 83 |
7c05f800
|
bcyrill
|
sh /etc/rc.update_bogons.sh &
|
| 84 |
7de4359a
|
Seth Mos
|
exit
|
| 85 |
|
|
fi
|
| 86 |
|
|
|
| 87 |
2076dc46
|
Ermal
|
BOGON_V4_CKSUM=`/usr/bin/fetch -T 30 -q -o - "${v4urlcksum}" | awk '{ print $4 }'`
|
| 88 |
92276df6
|
bcyrill
|
ON_DISK_V4_CKSUM=`md5 /tmp/bogons | awk '{ print $4 }'`
|
| 89 |
2076dc46
|
Ermal
|
BOGON_V6_CKSUM=`/usr/bin/fetch -T 30 -q -o - "${v6urlcksum}" | awk '{ print $4 }'`
|
| 90 |
92276df6
|
bcyrill
|
ON_DISK_V6_CKSUM=`md5 /tmp/bogonsv6 | awk '{ print $4 }'`
|
| 91 |
342a2f18
|
Phil Davis
|
|
| 92 |
92276df6
|
bcyrill
|
if [ "$BOGON_V4_CKSUM" = "$ON_DISK_V4_CKSUM" ] || [ "$BOGON_V6_CKSUM" = "$ON_DISK_V6_CKSUM" ]; then
|
| 93 |
7c05f800
|
bcyrill
|
# At least one of the downloaded checksums matches, so mount RW
|
| 94 |
342a2f18
|
Phil Davis
|
/etc/rc.conf_mount_rw
|
| 95 |
3cde94cf
|
bcyrill
|
|
| 96 |
45bc16b9
|
bcyrill
|
ENTRIES_MAX=`pfctl -s memory | awk '/table-entries/ { print $4 }'`
|
| 97 |
3cde94cf
|
bcyrill
|
|
| 98 |
|
|
if [ "$BOGON_V4_CKSUM" = "$ON_DISK_V4_CKSUM" ]; then
|
| 99 |
45bc16b9
|
bcyrill
|
ENTRIES_TOT=`pfctl -vvsTables | awk '/Addresses/ {s+=$2}; END {print s}'`
|
| 100 |
|
|
ENTRIES_V4=`pfctl -vvsTables | awk '/-\tbogons$/ {getline; print $2}'`
|
| 101 |
|
|
LINES_V4=`wc -l /tmp/bogons | awk '{ print $1 }'`
|
| 102 |
|
|
if [ $ENTRIES_MAX -gt $((2*ENTRIES_TOT-${ENTRIES_V4:-0}+LINES_V4)) ]; then
|
| 103 |
|
|
egrep -v "^192.168.0.0/16|^172.16.0.0/12|^10.0.0.0/8" /tmp/bogons > /etc/bogons
|
| 104 |
|
|
RESULT=`/sbin/pfctl -t bogons -T replace -f /etc/bogons 2>&1`
|
| 105 |
|
|
echo "$RESULT" | awk '{ print "Bogons V4 file downloaded: " $0 }' | logger
|
| 106 |
|
|
else
|
| 107 |
|
|
echo "Not updating IPv4 bogons (increase table-entries limit)" | logger
|
| 108 |
|
|
fi
|
| 109 |
3cde94cf
|
bcyrill
|
rm /tmp/bogons
|
| 110 |
|
|
else
|
| 111 |
|
|
echo "Could not download ${v4url} (checksum mismatch)" | logger
|
| 112 |
|
|
checksum_error="true"
|
| 113 |
|
|
fi
|
| 114 |
342a2f18
|
Phil Davis
|
|
| 115 |
3cde94cf
|
bcyrill
|
if [ "$BOGON_V6_CKSUM" = "$ON_DISK_V6_CKSUM" ]; then
|
| 116 |
8550a21c
|
phildd
|
BOGONS_V6_TABLE_COUNT=`pfctl -sTables | grep ^bogonsv6$ | wc -l | awk '{ print $1 }'`
|
| 117 |
45bc16b9
|
bcyrill
|
ENTRIES_TOT=`pfctl -vvsTables | awk '/Addresses/ {s+=$2}; END {print s}'`
|
| 118 |
|
|
LINES_V6=`wc -l /tmp/bogonsv6 | awk '{ print $1 }'`
|
| 119 |
8550a21c
|
phildd
|
if [ $BOGONS_V6_TABLE_COUNT -gt 0 ]; then
|
| 120 |
c858c609
|
phildd
|
ENTRIES_V6=`pfctl -vvsTables | awk '/-\tbogonsv6$/ {getline; print $2}'`
|
| 121 |
|
|
if [ $ENTRIES_MAX -gt $((2*ENTRIES_TOT-${ENTRIES_V6:-0}+LINES_V6)) ]; then
|
| 122 |
9b0adf13
|
N0YB
|
egrep -iv "^fc00::/7" /tmp/bogonsv6 > /etc/bogonsv6
|
| 123 |
c858c609
|
phildd
|
RESULT=`/sbin/pfctl -t bogonsv6 -T replace -f /etc/bogonsv6 2>&1`
|
| 124 |
|
|
echo "$RESULT" | awk '{ print "Bogons V6 file downloaded: " $0 }' | logger
|
| 125 |
|
|
else
|
| 126 |
|
|
echo "Not saving or updating IPv6 bogons (increase table-entries limit)" | logger
|
| 127 |
|
|
fi
|
| 128 |
45bc16b9
|
bcyrill
|
else
|
| 129 |
c858c609
|
phildd
|
if [ $ENTRIES_MAX -gt $((2*ENTRIES_TOT+LINES_V6)) ]; then
|
| 130 |
9b0adf13
|
N0YB
|
egrep -iv "^fc00::/7" /tmp/bogonsv6 > /etc/bogonsv6
|
| 131 |
c858c609
|
phildd
|
echo "Bogons V6 file downloaded but not updating IPv6 bogons table because IPv6 Allow is off" | logger
|
| 132 |
|
|
else
|
| 133 |
|
|
echo "Not saving IPv6 bogons table (IPv6 Allow is off and table-entries limit is potentially too low)" | logger
|
| 134 |
|
|
fi
|
| 135 |
3cde94cf
|
bcyrill
|
fi
|
| 136 |
|
|
rm /tmp/bogonsv6
|
| 137 |
|
|
else
|
| 138 |
|
|
echo "Could not download ${v6url} (checksum mismatch)" | logger
|
| 139 |
|
|
checksum_error="true"
|
| 140 |
|
|
fi
|
| 141 |
|
|
|
| 142 |
342a2f18
|
Phil Davis
|
# We mounted RW, so switch back to RO
|
| 143 |
|
|
/etc/rc.conf_mount_ro
|
| 144 |
|
|
fi
|
| 145 |
|
|
|
| 146 |
7c05f800
|
bcyrill
|
if [ "$checksum_error" != "" ]; then
|
| 147 |
7de4359a
|
Seth Mos
|
# Relaunch and sleep
|
| 148 |
342a2f18
|
Phil Davis
|
sh /etc/rc.update_bogons.sh &
|
| 149 |
|
|
exit
|
| 150 |
7de4359a
|
Seth Mos
|
fi
|
| 151 |
|
|
|
| 152 |
48e29ac9
|
sullrich
|
echo "rc.update_bogons.sh is ending the update cycle." | logger
|