blob: e7e56e2f9fb3517f167ef6463baef0c0f1d04f26 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
|
#!/bin/sh
# Update bogons file
# Part of the pfSense project
# www.pfsense.com
# Global variables
proc_error=""
# Download and extract if necessary
function process_url() {
local file=$1
local url=$2
local filename=${url##*/}
local ext=${filename#*.}
/usr/bin/fetch -q -o $file "${url}"
if [ ! -f $file ]; then
echo "Could not download ${url}" | logger
proc_error="true"
fi
case "$ext" in
tar)
mv $file $file.tmp
/usr/bin/tar -xf $file.tmp -O > $file 2> /dev/null
;;
tar.gz)
;&
tgz)
mv $file $file.tmp
/usr/bin/tar -xzf $file.tmp -O > $file 2> /dev/null
;;
tar.bz2)
mv $file $file.tmp
/usr/bin/tar -xjf $file.tmp -O > $file 2> /dev/null
;;
*)
;;
esac
if [ -f $file.tmp ]; then
rm $file.tmp
fi
if [ ! -f $file ]; then
echo "Could not extract ${filename}" | logger
proc_error="true"
fi
}
echo "rc.update_bogons.sh is starting up." | logger
# Sleep for some time, unless an argument is specified.
if [ "$1" = "" ]; then
# Grab a random value
value=`od -A n -d -N2 /dev/random | awk '{ print $1 }'`
echo "rc.update_bogons.sh is sleeping for $value" | logger
sleep $value
fi
echo "rc.update_bogons.sh is beginning the update cycle." | logger
# Load custom bogon configuration
if [ -f /var/etc/bogon_custom ]; then
. /var/etc/bogon_custom
fi
# Set default values if not overriden
v4url=${v4url:-"http://files.pfsense.org/lists/fullbogons-ipv4.txt"}
v6url=${v6url:-"http://files.pfsense.org/lists/fullbogons-ipv6.txt"}
v4urlcksum=${v4urlcksum:-"${v4url}.md5"}
v6urlcksum=${v6urlcksum:-"${v6url}.md5"}
process_url /tmp/bogons "${v4url}"
process_url /tmp/bogonsv6 "${v6url}"
if [ "$proc_error" != "" ]; then
# Relaunch and sleep
sh /etc/rc.update_bogons.sh &
exit
fi
BOGON_V4_CKSUM=`/usr/bin/fetch -q -o - "${v4urlcksum}" | awk '{ print $4 }'`
ON_DISK_V4_CKSUM=`md5 /tmp/bogons | awk '{ print $4 }'`
BOGON_V6_CKSUM=`/usr/bin/fetch -q -o - "${v6urlcksum}" | awk '{ print $4 }'`
ON_DISK_V6_CKSUM=`md5 /tmp/bogonsv6 | awk '{ print $4 }'`
if [ "$BOGON_V4_CKSUM" = "$ON_DISK_V4_CKSUM" ] || [ "$BOGON_V6_CKSUM" = "$ON_DISK_V6_CKSUM" ]; then
# At least one of the downloaded checksums matches, so mount RW
/etc/rc.conf_mount_rw
MAXENTRIES=`pfctl -s memory | awk '/table-entries/ { print $4 }'`
if [ "$BOGON_V4_CKSUM" = "$ON_DISK_V4_CKSUM" ]; then
egrep -v "^192.168.0.0/16|^172.16.0.0/12|^10.0.0.0/8" /tmp/bogons > /etc/bogons
RESULT=`/sbin/pfctl -t bogons -T replace -f /etc/bogons 2>&1`
echo "$RESULT" |awk '{ print "Bogons V4 file downloaded: " $0 }' | logger
rm /tmp/bogons
else
echo "Could not download ${v4url} (checksum mismatch)" | logger
checksum_error="true"
fi
if [ "$BOGON_V6_CKSUM" = "$ON_DISK_V6_CKSUM" ]; then
LINES=`wc -l /tmp/bogonsv6 | awk '{ print $1 }'`
if [ $MAXENTRIES -gt $((2*LINES)) ]; then
egrep -v "^fc00::/7" /tmp/bogonsv6 > /etc/bogonsv6
RESULT=`/sbin/pfctl -t bogonsv6 -T replace -f /etc/bogonsv6 2>&1`
echo "$RESULT" |awk '{ print "Bogons V6 file downloaded: " $0 }' | logger
fi
rm /tmp/bogonsv6
else
echo "Could not download ${v6url} (checksum mismatch)" | logger
checksum_error="true"
fi
# We mounted RW, so switch back to RO
/etc/rc.conf_mount_ro
fi
if [ "$checksum_error" != "" ]; then
# Relaunch and sleep
sh /etc/rc.update_bogons.sh &
exit
fi
echo "rc.update_bogons.sh is ending the update cycle." | logger
|
