2023-05-31 10:01:38 +02:00
|
|
|
#!rsc by RouterOS
|
|
|
|
# RouterOS script: fw-addr-lists
|
2024-01-01 15:25:25 +01:00
|
|
|
# Copyright (c) 2023-2024 Christian Hesse <mail@eworm.de>
|
2023-05-31 10:01:38 +02:00
|
|
|
# https://git.eworm.de/cgit/routeros-scripts/about/COPYING.md
|
|
|
|
#
|
2024-03-27 23:39:55 +01:00
|
|
|
# requires RouterOS, version=7.13
|
2023-11-15 21:31:18 +01:00
|
|
|
#
|
2023-05-31 10:01:38 +02:00
|
|
|
# download, import and update firewall address-lists
|
|
|
|
# https://git.eworm.de/cgit/routeros-scripts/about/doc/fw-addr-lists.md
|
|
|
|
|
|
|
|
:global GlobalFunctionsReady;
|
|
|
|
:while ($GlobalFunctionsReady != true) do={ :delay 500ms; }
|
|
|
|
|
2024-03-06 15:28:55 +01:00
|
|
|
:do {
|
|
|
|
:local ScriptName [ :jobname ];
|
2024-03-04 13:48:01 +01:00
|
|
|
|
|
|
|
:global FwAddrLists;
|
|
|
|
:global FwAddrListTimeOut;
|
|
|
|
|
|
|
|
:global CertificateAvailable;
|
|
|
|
:global EitherOr;
|
2024-03-27 23:39:55 +01:00
|
|
|
:global FetchHuge;
|
2024-04-04 19:37:38 +02:00
|
|
|
:global HumanReadableNum;
|
2024-03-08 12:45:38 +01:00
|
|
|
:global LogPrint;
|
2024-03-04 13:48:01 +01:00
|
|
|
:global LogPrintOnce;
|
|
|
|
:global ScriptLock;
|
|
|
|
:global WaitFullyConnected;
|
|
|
|
|
|
|
|
:local FindDelim do={
|
|
|
|
:local ValidChars "0123456789.:/ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz-";
|
|
|
|
:for I from=0 to=[ :len $1 ] do={
|
|
|
|
:if ([ :typeof [ :find $ValidChars [ :pick ($1 . " ") $I ] ] ] != "num") do={
|
|
|
|
:return $I;
|
|
|
|
}
|
2023-05-31 10:01:38 +02:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2024-03-05 16:12:36 +01:00
|
|
|
:if ([ $ScriptLock $ScriptName ] = false) do={
|
2024-03-06 15:28:55 +01:00
|
|
|
:error false;
|
2024-03-05 16:12:36 +01:00
|
|
|
}
|
2024-03-04 13:48:01 +01:00
|
|
|
$WaitFullyConnected;
|
2023-05-31 10:01:38 +02:00
|
|
|
|
2024-03-04 13:48:01 +01:00
|
|
|
:local ListComment ("managed by " . $ScriptName);
|
2023-05-31 10:01:38 +02:00
|
|
|
|
2024-03-04 13:48:01 +01:00
|
|
|
:foreach FwListName,FwList in=$FwAddrLists do={
|
|
|
|
:local CntAdd 0;
|
|
|
|
:local CntRenew 0;
|
|
|
|
:local CntRemove 0;
|
|
|
|
:local IPv4Addresses ({});
|
|
|
|
:local IPv6Addresses ({});
|
|
|
|
:local Failure false;
|
2023-05-31 10:01:38 +02:00
|
|
|
|
2024-03-04 13:48:01 +01:00
|
|
|
:foreach List in=$FwList do={
|
2024-03-27 23:39:55 +01:00
|
|
|
:local CheckCertificate false;
|
2024-03-04 13:48:01 +01:00
|
|
|
:local Data false;
|
|
|
|
:local TimeOut [ $EitherOr [ :totime ($List->"timeout") ] $FwAddrListTimeOut ];
|
2023-05-31 10:01:38 +02:00
|
|
|
|
2024-03-04 13:48:01 +01:00
|
|
|
:if ([ :len ($List->"cert") ] > 0) do={
|
2024-03-27 23:39:55 +01:00
|
|
|
:set CheckCertificate true;
|
2024-03-04 13:48:01 +01:00
|
|
|
:if ([ $CertificateAvailable ($List->"cert") ] = false) do={
|
2024-04-05 23:41:17 +02:00
|
|
|
$LogPrint warning $ScriptName ("Downloading required certificate (" . $FwListName . \
|
|
|
|
" / " . $List->"url" . ") failed, trying anyway.");
|
2024-03-04 13:48:01 +01:00
|
|
|
}
|
2023-05-31 10:01:38 +02:00
|
|
|
}
|
|
|
|
|
2024-03-26 08:37:07 +01:00
|
|
|
:for I from=1 to=5 do={
|
2024-03-04 13:48:01 +01:00
|
|
|
:if ($Data = false) do={
|
2024-03-27 23:39:55 +01:00
|
|
|
:set Data [ $FetchHuge $ScriptName ($List->"url") $CheckCertificate ];
|
|
|
|
:if ($Data = false) do={
|
2024-03-26 08:37:07 +01:00
|
|
|
:if ($I < 5) do={
|
2024-04-05 23:41:17 +02:00
|
|
|
$LogPrint debug $ScriptName ("Failed downloading for list '" . $FwListName . \
|
|
|
|
"', " . $I . ". try from: " . $List->"url");
|
2024-03-04 13:48:01 +01:00
|
|
|
:delay (($I * $I) . "s");
|
|
|
|
}
|
2023-10-19 21:15:23 +02:00
|
|
|
}
|
2023-06-23 09:35:00 +02:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2024-03-04 13:48:01 +01:00
|
|
|
:if ($Data = false) do={
|
|
|
|
:set Data "";
|
|
|
|
:set Failure true;
|
2024-04-05 23:41:17 +02:00
|
|
|
$LogPrint warning $ScriptName ("Failed downloading for list '" . $FwListName . \
|
|
|
|
"' from: " . $List->"url");
|
2024-04-04 19:37:38 +02:00
|
|
|
} else={
|
2024-04-05 23:41:17 +02:00
|
|
|
$LogPrint debug $ScriptName ("Downloaded " . [ $HumanReadableNum [ :len $Data ] 1024 ] . \
|
|
|
|
"B for list '" . $FwListName . "' from: " . $List->"url");
|
2024-03-04 13:48:01 +01:00
|
|
|
}
|
2023-12-13 15:57:28 +01:00
|
|
|
|
2024-03-04 13:48:01 +01:00
|
|
|
:while ([ :len $Data ] != 0) do={
|
|
|
|
:local Line [ :pick $Data 0 [ :find $Data "\n" ] ];
|
|
|
|
:local Address ([ :pick $Line 0 [ $FindDelim $Line ] ] . ($List->"cidr"));
|
2024-04-05 00:20:33 +02:00
|
|
|
:do {
|
|
|
|
:if ($Address ~ "^[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}(/[0-9]{1,2})?\$") do={
|
|
|
|
:set ($IPv4Addresses->$Address) $TimeOut;
|
|
|
|
:error true;
|
|
|
|
}
|
|
|
|
:if ($Address ~ "^[0-9a-zA-Z]*:[0-9a-zA-Z:\\.]+(/[0-9]{1,3})?\$") do={
|
|
|
|
:set ($IPv6Addresses->$Address) $TimeOut;
|
|
|
|
:error true;
|
|
|
|
}
|
|
|
|
:if ($Address ~ "^[\\.a-zA-Z0-9-]+\\.[a-zA-Z]{2,}\$") do={
|
|
|
|
:set ($IPv4Addresses->$Address) $TimeOut;
|
|
|
|
:set ($IPv6Addresses->$Address) $TimeOut;
|
|
|
|
:error true;
|
|
|
|
}
|
|
|
|
} on-error={ }
|
2024-03-04 13:48:01 +01:00
|
|
|
:set Data [ :pick $Data ([ :len $Line ] + 1) [ :len $Data ] ];
|
2024-02-23 11:19:56 +01:00
|
|
|
}
|
2023-05-31 10:01:38 +02:00
|
|
|
}
|
|
|
|
|
2024-04-05 23:53:05 +02:00
|
|
|
:foreach Entry in=[ /ip/firewall/address-list/find where \
|
|
|
|
list=$FwListName comment=$ListComment ] do={
|
2024-03-04 13:48:01 +01:00
|
|
|
:local Address [ /ip/firewall/address-list/get $Entry address ];
|
|
|
|
:if ([ :typeof ($IPv4Addresses->$Address) ] = "time") do={
|
2024-04-05 23:41:17 +02:00
|
|
|
$LogPrint debug $ScriptName ("Renewing IPv4 address in list '" . $FwListName . \
|
|
|
|
"' with " . ($IPv4Addresses->$Address) . ": " . $Address);
|
2024-03-04 13:48:01 +01:00
|
|
|
/ip/firewall/address-list/set $Entry timeout=($IPv4Addresses->$Address);
|
|
|
|
:set ($IPv4Addresses->$Address);
|
|
|
|
:set CntRenew ($CntRenew + 1);
|
|
|
|
} else={
|
|
|
|
:if ($Failure = false) do={
|
2024-04-05 23:41:17 +02:00
|
|
|
$LogPrint debug $ScriptName ("Removing IPv4 address from list '" . $FwListName . \
|
|
|
|
"': " . $Address);
|
2024-03-04 13:48:01 +01:00
|
|
|
/ip/firewall/address-list/remove $Entry;
|
|
|
|
:set CntRemove ($CntRemove + 1);
|
|
|
|
}
|
2023-05-31 10:01:38 +02:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2024-04-05 23:53:05 +02:00
|
|
|
:foreach Entry in=[ /ipv6/firewall/address-list/find where \
|
|
|
|
list=$FwListName comment=$ListComment ] do={
|
2024-03-04 13:48:01 +01:00
|
|
|
:local Address [ /ipv6/firewall/address-list/get $Entry address ];
|
|
|
|
:if ([ :typeof ($IPv6Addresses->$Address) ] = "time") do={
|
2024-04-05 23:41:17 +02:00
|
|
|
$LogPrint debug $ScriptName ("Renewing IPv6 address in list '" . $FwListName . \
|
|
|
|
"' with " . ($IPv6Addresses->$Address) . ": " . $Address);
|
2024-03-04 13:48:01 +01:00
|
|
|
/ipv6/firewall/address-list/set $Entry timeout=($IPv6Addresses->$Address);
|
|
|
|
:set ($IPv6Addresses->$Address);
|
|
|
|
:set CntRenew ($CntRenew + 1);
|
|
|
|
} else={
|
|
|
|
:if ($Failure = false) do={
|
2024-04-05 23:41:17 +02:00
|
|
|
$LogPrint debug $ScriptName ("Removing IPv6 address from list '" . $FwListName . \
|
|
|
|
"': " . $Address);
|
2024-03-04 13:48:01 +01:00
|
|
|
/ipv6/firewall/address-list/remove $Entry;
|
|
|
|
:set CntRemove ($CntRemove + 1);
|
|
|
|
}
|
2024-02-23 11:19:56 +01:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2024-03-04 13:48:01 +01:00
|
|
|
:foreach Address,Timeout in=$IPv4Addresses do={
|
2024-04-05 23:41:17 +02:00
|
|
|
$LogPrint debug $ScriptName ("Adding IPv4 address to list '" . $FwListName . \
|
|
|
|
"' with " . $Timeout . ": " . $Address);
|
2024-03-04 13:48:01 +01:00
|
|
|
:do {
|
2024-04-05 23:53:05 +02:00
|
|
|
/ip/firewall/address-list/add list=$FwListName comment=$ListComment \
|
|
|
|
address=$Address timeout=$Timeout;
|
2024-03-04 13:48:01 +01:00
|
|
|
:set ($IPv4Addresses->$Address);
|
|
|
|
:set CntAdd ($CntAdd + 1);
|
|
|
|
} on-error={
|
2024-04-05 23:41:17 +02:00
|
|
|
$LogPrint warning $ScriptName ("Failed to add IPv4 address to list '" . $FwListName . \
|
|
|
|
"': " . $Address);
|
2024-03-04 13:48:01 +01:00
|
|
|
}
|
2023-05-31 10:01:38 +02:00
|
|
|
}
|
|
|
|
|
2024-03-04 13:48:01 +01:00
|
|
|
:foreach Address,Timeout in=$IPv6Addresses do={
|
2024-04-05 23:41:17 +02:00
|
|
|
$LogPrint debug $ScriptName ("Adding IPv6 address to list '" . $FwListName . \
|
|
|
|
"' with " . $Timeout . ": " . $Address);
|
2024-03-04 13:48:01 +01:00
|
|
|
:do {
|
2024-04-05 23:53:05 +02:00
|
|
|
/ipv6/firewall/address-list/add list=$FwListName comment=$ListComment \
|
|
|
|
address=$Address timeout=$Timeout;
|
2024-03-04 13:48:01 +01:00
|
|
|
:set ($IPv6Addresses->$Address);
|
|
|
|
:set CntAdd ($CntAdd + 1);
|
|
|
|
} on-error={
|
2024-04-05 23:41:17 +02:00
|
|
|
$LogPrint warning $ScriptName ("Failed to add IPv6 address to list '" . $FwListName . \
|
|
|
|
"': " . $Address);
|
2024-03-04 13:48:01 +01:00
|
|
|
}
|
2024-02-23 11:19:56 +01:00
|
|
|
}
|
|
|
|
|
2024-04-07 20:54:41 +02:00
|
|
|
$LogPrint info $ScriptName ("list: " . $FwListName . \
|
2024-04-07 22:50:04 +02:00
|
|
|
" (" . [ $HumanReadableNum ($CntAdd + $CntRenew) 1000 ] . ")" . \
|
2024-04-07 20:54:41 +02:00
|
|
|
" -- added: " . [ $HumanReadableNum $CntAdd 1000 ] . \
|
|
|
|
" - renewed: " . [ $HumanReadableNum $CntRenew 1000 ] . \
|
|
|
|
" - removed: " . [ $HumanReadableNum $CntRemove 1000 ]);
|
2024-03-04 13:48:01 +01:00
|
|
|
}
|
2024-03-06 15:28:55 +01:00
|
|
|
} on-error={ }
|