1
|
#!/bin/sh
|
2
|
|
3
|
# Update bogons file
|
4
|
# Part of the pfSense project
|
5
|
# https://www.pfsense.org
|
6
|
|
7
|
# Global variables
|
8
|
proc_error=""
|
9
|
|
10
|
# Download and extract if necessary
|
11
|
process_url() {
|
12
|
local file=$1
|
13
|
local url=$2
|
14
|
local filename=${url##*/}
|
15
|
local ext=${filename#*.}
|
16
|
|
17
|
/usr/bin/fetch -a -T 30 -q -o $file "${url}"
|
18
|
|
19
|
if [ ! -f $file ]; then
|
20
|
echo "Could not download ${url}" | logger
|
21
|
proc_error="true"
|
22
|
fi
|
23
|
|
24
|
case "$ext" in
|
25
|
tar)
|
26
|
mv $file $file.tmp
|
27
|
/usr/bin/tar -xf $file.tmp -O > $file 2> /dev/null
|
28
|
;;
|
29
|
tar.gz)
|
30
|
mv $file $file.tmp
|
31
|
/usr/bin/tar -xzf $file.tmp -O > $file 2> /dev/null
|
32
|
;;
|
33
|
tgz)
|
34
|
mv $file $file.tmp
|
35
|
/usr/bin/tar -xzf $file.tmp -O > $file 2> /dev/null
|
36
|
;;
|
37
|
tar.bz2)
|
38
|
mv $file $file.tmp
|
39
|
/usr/bin/tar -xjf $file.tmp -O > $file 2> /dev/null
|
40
|
;;
|
41
|
*)
|
42
|
;;
|
43
|
esac
|
44
|
|
45
|
if [ -f $file.tmp ]; then
|
46
|
rm $file.tmp
|
47
|
fi
|
48
|
|
49
|
if [ ! -f $file ]; then
|
50
|
echo "Could not extract ${filename}" | logger
|
51
|
proc_error="true"
|
52
|
fi
|
53
|
}
|
54
|
|
55
|
echo "rc.update_bogons.sh is starting up." | logger
|
56
|
|
57
|
# Sleep for some time, unless an argument is specified.
|
58
|
if [ "$1" = "" ]; then
|
59
|
# Grab a random value
|
60
|
value=`od -A n -d -N2 /dev/random | awk '{ print $1 }'`
|
61
|
echo "rc.update_bogons.sh is sleeping for $value" | logger
|
62
|
sleep $value
|
63
|
fi
|
64
|
|
65
|
echo "rc.update_bogons.sh is beginning the update cycle." | logger
|
66
|
|
67
|
# Load custom bogon configuration
|
68
|
if [ -f /var/etc/bogon_custom ]; then
|
69
|
. /var/etc/bogon_custom
|
70
|
fi
|
71
|
|
72
|
# Set default values if not overriden
|
73
|
v4url=${v4url:-"http://files.pfsense.org/lists/fullbogons-ipv4.txt"}
|
74
|
v6url=${v6url:-"http://files.pfsense.org/lists/fullbogons-ipv6.txt"}
|
75
|
v4urlcksum=${v4urlcksum:-"${v4url}.md5"}
|
76
|
v6urlcksum=${v6urlcksum:-"${v6url}.md5"}
|
77
|
|
78
|
process_url /tmp/bogons "${v4url}"
|
79
|
process_url /tmp/bogonsv6 "${v6url}"
|
80
|
|
81
|
if [ "$proc_error" != "" ]; then
|
82
|
# Relaunch and sleep
|
83
|
sh /etc/rc.update_bogons.sh &
|
84
|
exit
|
85
|
fi
|
86
|
|
87
|
BOGON_V4_CKSUM=`/usr/bin/fetch -T 30 -q -o - "${v4urlcksum}" | awk '{ print $4 }'`
|
88
|
ON_DISK_V4_CKSUM=`md5 /tmp/bogons | awk '{ print $4 }'`
|
89
|
BOGON_V6_CKSUM=`/usr/bin/fetch -T 30 -q -o - "${v6urlcksum}" | awk '{ print $4 }'`
|
90
|
ON_DISK_V6_CKSUM=`md5 /tmp/bogonsv6 | awk '{ print $4 }'`
|
91
|
|
92
|
if [ "$BOGON_V4_CKSUM" = "$ON_DISK_V4_CKSUM" ] || [ "$BOGON_V6_CKSUM" = "$ON_DISK_V6_CKSUM" ]; then
|
93
|
# At least one of the downloaded checksums matches, so mount RW
|
94
|
/etc/rc.conf_mount_rw
|
95
|
|
96
|
ENTRIES_MAX=`pfctl -s memory | awk '/table-entries/ { print $4 }'`
|
97
|
|
98
|
if [ "$BOGON_V4_CKSUM" = "$ON_DISK_V4_CKSUM" ]; then
|
99
|
ENTRIES_TOT=`pfctl -vvsTables | awk '/Addresses/ {s+=$2}; END {print s}'`
|
100
|
ENTRIES_V4=`pfctl -vvsTables | awk '/-\tbogons$/ {getline; print $2}'`
|
101
|
LINES_V4=`wc -l /tmp/bogons | awk '{ print $1 }'`
|
102
|
if [ $ENTRIES_MAX -gt $((2*ENTRIES_TOT-${ENTRIES_V4:-0}+LINES_V4)) ]; then
|
103
|
egrep -v "^192.168.0.0/16|^172.16.0.0/12|^10.0.0.0/8" /tmp/bogons > /etc/bogons
|
104
|
RESULT=`/sbin/pfctl -t bogons -T replace -f /etc/bogons 2>&1`
|
105
|
echo "$RESULT" | awk '{ print "Bogons V4 file downloaded: " $0 }' | logger
|
106
|
else
|
107
|
echo "Not updating IPv4 bogons (increase table-entries limit)" | logger
|
108
|
fi
|
109
|
rm /tmp/bogons
|
110
|
else
|
111
|
echo "Could not download ${v4url} (checksum mismatch)" | logger
|
112
|
checksum_error="true"
|
113
|
fi
|
114
|
|
115
|
if [ "$BOGON_V6_CKSUM" = "$ON_DISK_V6_CKSUM" ]; then
|
116
|
BOGONS_V6_TABLE_COUNT=`pfctl -sTables | grep ^bogonsv6$ | wc -l | awk '{ print $1 }'`
|
117
|
ENTRIES_TOT=`pfctl -vvsTables | awk '/Addresses/ {s+=$2}; END {print s}'`
|
118
|
LINES_V6=`wc -l /tmp/bogonsv6 | awk '{ print $1 }'`
|
119
|
if [ $BOGONS_V6_TABLE_COUNT -gt 0 ]; then
|
120
|
ENTRIES_V6=`pfctl -vvsTables | awk '/-\tbogonsv6$/ {getline; print $2}'`
|
121
|
if [ $ENTRIES_MAX -gt $((2*ENTRIES_TOT-${ENTRIES_V6:-0}+LINES_V6)) ]; then
|
122
|
egrep -iv "^fc00::/7" /tmp/bogonsv6 > /etc/bogonsv6
|
123
|
RESULT=`/sbin/pfctl -t bogonsv6 -T replace -f /etc/bogonsv6 2>&1`
|
124
|
echo "$RESULT" | awk '{ print "Bogons V6 file downloaded: " $0 }' | logger
|
125
|
else
|
126
|
echo "Not saving or updating IPv6 bogons (increase table-entries limit)" | logger
|
127
|
fi
|
128
|
else
|
129
|
if [ $ENTRIES_MAX -gt $((2*ENTRIES_TOT+LINES_V6)) ]; then
|
130
|
egrep -iv "^fc00::/7" /tmp/bogonsv6 > /etc/bogonsv6
|
131
|
echo "Bogons V6 file downloaded but not updating IPv6 bogons table because IPv6 Allow is off" | logger
|
132
|
else
|
133
|
echo "Not saving IPv6 bogons table (IPv6 Allow is off and table-entries limit is potentially too low)" | logger
|
134
|
fi
|
135
|
fi
|
136
|
rm /tmp/bogonsv6
|
137
|
else
|
138
|
echo "Could not download ${v6url} (checksum mismatch)" | logger
|
139
|
checksum_error="true"
|
140
|
fi
|
141
|
|
142
|
# We mounted RW, so switch back to RO
|
143
|
/etc/rc.conf_mount_ro
|
144
|
fi
|
145
|
|
146
|
if [ "$checksum_error" != "" ]; then
|
147
|
# Relaunch and sleep
|
148
|
sh /etc/rc.update_bogons.sh &
|
149
|
exit
|
150
|
fi
|
151
|
|
152
|
echo "rc.update_bogons.sh is ending the update cycle." | logger
|