aboutsummaryrefslogtreecommitdiffstats
path: root/fw-addr-lists.rsc
blob: 7ab575cd82ddab3ac4d00987a5a952c22dfbbe5c (about) (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
#!rsc by RouterOS
# RouterOS script: fw-addr-lists
# Copyright (c) 2023-2024 Christian Hesse <mail@eworm.de>
# https://git.eworm.de/cgit/routeros-scripts/about/COPYING.md
#
# requires RouterOS, version=7.12
#
# download, import and update firewall address-lists
# https://git.eworm.de/cgit/routeros-scripts/about/doc/fw-addr-lists.md

:local 0 [ :jobname ];
:global GlobalFunctionsReady;
:while ($GlobalFunctionsReady != true) do={ :delay 500ms; }

:global FetchUserAgent;
:global FwAddrLists;
:global FwAddrListTimeOut;

:global CertificateAvailable;
:global EitherOr;
:global LogPrintExit2;
:global LogPrintOnce;
:global ScriptLock;
:global WaitFullyConnected;

:local FindDelim do={
  :local ValidChars "0123456789./ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz-";
  :for I from=0 to=[ :len $1 ] do={
    :if ([ :typeof [ :find $ValidChars [ :pick ($1 . " ") $I ] ] ] != "num") do={
      :return $I;
    }
  }
}

$ScriptLock $0;
$WaitFullyConnected;

:local ListComment ("managed by " . $0);

:foreach FwListName,FwList in=$FwAddrLists do={
  :local Addresses ({});
  :local CntAdd 0;
  :local CntRenew 0;
  :local CntRemove 0;
  :local Failure false;

  :foreach List in=$FwList do={
    :local CheckCertificate "no";
    :local Data false;
    :local TimeOut [ $EitherOr [ :totime ($List->"timeout") ] $FwAddrListTimeOut ];

    :if ([ :len ($List->"cert") ] > 0) do={
      :set CheckCertificate "yes-without-crl";
      :if ([ $CertificateAvailable ($List->"cert") ] = false) do={
        $LogPrintExit2 warning $0 ("Downloading required certificate failed, trying anyway.") false;
      }
    }

    :for I from=1 to=4 do={
      :if ($Data = false) do={
        :do {
          :set Data ([ /tool/fetch check-certificate=$CheckCertificate output=user \
            http-header-field=({ $FetchUserAgent }) ($List->"url") as-value ]->"data");
        } on-error={
          :if ($I < 4) do={
            $LogPrintExit2 debug $0 ("Failed downloading, " . $I . ". try: " . $List->"url") false;
            :delay (($I * $I) . "s");
          }
        }
      }
    }

    :if ($Data = false) do={
      :set Data "";
      :set Failure true;
      $LogPrintExit2 warning $0 ("Failed downloading list from: " . $List->"url") false;
    }

    :if ([ :len $Data ] > 63000) do={
      $LogPrintOnce warning $0 ("The list is huge and may be truncated: " . $List->"url") false;
    }

    :while ([ :len $Data ] != 0) do={
      :local Line [ :pick $Data 0 [ :find $Data "\n" ] ];
      :local Address ([ :pick $Line 0 [ $FindDelim $Line ] ] . ($List->"cidr"));
      :if ($Address ~ "^[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}(/[0-9]{1,2})?\$" || \
           $Address ~ "^[\\.a-zA-Z0-9-]+\\.[a-zA-Z]{2,}\$") do={
        :set ($Addresses->$Address) $TimeOut;
      }
      :set Data [ :pick $Data ([ :len $Line ] + 1) [ :len $Data ] ];
    }
  }

  :foreach Entry in=[ /ip/firewall/address-list/find where list=$FwListName comment=$ListComment ] do={
    :local Address [ /ip/firewall/address-list/get $Entry address ];
    :if ([ :typeof ($Addresses->$Address) ] = "time") do={
      $LogPrintExit2 debug $0 ("Renewing address for " . ($Addresses->$Address) . ": " . $Address) false;
      /ip/firewall/address-list/set $Entry timeout=($Addresses->$Address);
      :set ($Addresses->$Address);
      :set CntRenew ($CntRenew + 1);
    } else={
      :if ($Failure = false) do={
        $LogPrintExit2 debug $0 ("Removing address: " . $Address) false;
        /ip/firewall/address-list/remove $Entry;
        :set CntRemove ($CntRemove + 1);
      }
    }
  }

  :foreach Address,Timeout in=$Addresses do={
    $LogPrintExit2 debug $0 ("Adding address for " . $Timeout . ": " . $Address) false;
    :do {
      /ip/firewall/address-list/add list=$FwListName comment=$ListComment address=$Address timeout=$Timeout;
      :set ($Addresses->$Address);
      :set CntAdd ($CntAdd + 1);
    } on-error={
      $LogPrintExit2 warning $0 ("Failed to add address " . $Address . " to list '" . $FwListName . "'.") false;
    }
  }

  $LogPrintExit2 info $0 ("list: " . $FwListName . " -- added: " . $CntAdd . " - renewed: " . $CntRenew . " - removed: " . $CntRemove) false;
}