firewall: rework for signed bogons sets

src/etc/rc.update_bogons

 #!/bin/sh
 
-# Global variables
-proc_error=""
+CORE_ABI=$(cat /usr/local/opnsense/version/opnsense.abi 2> /dev/null)
+SYS_ABI=$(opnsense-verify -a 2> /dev/null)
+URL="https://pkg.opnsense.org"
 
-# Download and extract if necessary
-process_url() {
-	local file=$1
-	local url=$2
-	local filename=${url##*/}
-	local ext=${filename#*.}
-
-	/usr/bin/fetch -a -T 30 -q -o $file "${url}"
-
-	if [ ! -f $file ]; then
-		echo "Could not download ${url}" | logger
-		proc_error="true"
-	fi
-
-	case "$ext" in
-		tar)
-			mv $file $file.tmp
-			/usr/bin/tar -xf $file.tmp -O > $file 2> /dev/null
-			;;
-		tar.gz)
-			mv $file $file.tmp
-			/usr/bin/tar -xzf $file.tmp -O > $file 2> /dev/null
-			;;
-		tgz)
-			mv $file $file.tmp
-			/usr/bin/tar -xzf $file.tmp -O > $file 2> /dev/null
-			;;
-		tar.bz2)
-			mv $file $file.tmp
-			/usr/bin/tar -xjf $file.tmp -O > $file 2> /dev/null
-			;;
-		*)
-			;;
-	esac
+if [ -n "${CORE_ABI}" -a -n "${SYS_ABI}" ]; then
+	# expand url to new mirror layout per release
+	URL="${URL}/${SYS_ABI}/${CORE_ABI}"
+fi
 
-	if [ -f $file.tmp ]; then
-		rm $file.tmp
-	fi
+URL="${URL}/sets/bogons.txz"
 
-	if [ ! -f $file ]; then
-		echo "Could not extract ${filename}" | logger
-		proc_error="true"
-	fi
-}
+proc_error=
 
 echo "rc.update_bogons is starting up." | logger
 
 # Sleep for some time, unless an argument is specified.
-if [ "$1" = "" ]; then
+if [ -z "$1" ]; then
     # Grab a random value
     value=`od -A n -d -N2 /dev/random | awk '{ print $1 }'`
     echo "rc.update_bogons is sleeping for $value" | logger
@@ -60,83 +25,65 @@ fi
 
 echo "rc.update_bogons is beginning the update cycle." | logger
 
-# Set default values if not overriden
-v4url=${v4url:-"https://pkg.opnsense.org/bogons/fullbogons-ipv4.txt"}
-v6url=${v6url:-"https://pkg.opnsense.org/bogons/fullbogons-ipv6.txt"}
-v4urlcksum=${v4urlcksum:-"${v4url}.md5"}
-v6urlcksum=${v6urlcksum:-"${v6url}.md5"}
+rm -rf /tmp/bogons
+mkdir -p /tmp/bogons
+
+fetch -a -T 30 -q -o /tmp/bogons/bogons.txz.sig "${URL}.sig"
+fetch -a -T 30 -q -o /tmp/bogons/bogons.txz "${URL}"
 
-process_url /tmp/bogons "${v4url}"
-process_url /tmp/bogonsv6 "${v6url}"
+if [ ! -f /tmp/bogons/bogons.txz ]; then
+    echo "Could not download ${URL}" | logger
+    proc_error="true"
+elif ! opnsense-verify -q /tmp/bogons/bogons.txz; then
+    echo "Could not verify ${URL}" | logger
+    proc_error="true"
+elif ! tar -C /tmp/bogons -xJf /tmp/bogons/bogons.txz; then
+    echo "Could not extract ${URL}" | logger
+    proc_error="true"
+fi
 
-if [ "$proc_error" != "" ]; then
+if [ -n "${proc_error}" ]; then
     # Relaunch and sleep
     sh /usr/local/etc/rc.update_bogons &
     exit
 fi
 
-BOGON_V4_CKSUM=`/usr/bin/fetch -T 30 -q -o - "${v4urlcksum}" | awk '{ print $4 }'`
-ON_DISK_V4_CKSUM=`md5 /tmp/bogons | awk '{ print $4 }'`
-BOGON_V6_CKSUM=`/usr/bin/fetch -T 30 -q -o - "${v6urlcksum}" | awk '{ print $4 }'`
-ON_DISK_V6_CKSUM=`md5 /tmp/bogonsv6 | awk '{ print $4 }'`
-
-if [ "$BOGON_V4_CKSUM" = "$ON_DISK_V4_CKSUM" ] || [ "$BOGON_V6_CKSUM" = "$ON_DISK_V6_CKSUM" ]; then
-
-	ENTRIES_MAX=`pfctl -s memory | awk '/table-entries/ { print $4 }'`
-
-	if [ "$BOGON_V4_CKSUM" = "$ON_DISK_V4_CKSUM" ]; then
-		ENTRIES_TOT=`pfctl -vvsTables | awk '/Addresses/ {s+=$2}; END {print s}'`
-		ENTRIES_V4=`pfctl -vvsTables | awk '/-\tbogons$/ {getline; print $2}'`
-		LINES_V4=`wc -l /tmp/bogons | awk '{ print $1 }'`
-		if [ $ENTRIES_MAX -gt $((2*ENTRIES_TOT-${ENTRIES_V4:-0}+LINES_V4)) ]; then
+ENTRIES_MAX=`pfctl -s memory | awk '/table-entries/ { print $4 }'`
+ENTRIES_TOT=`pfctl -vvsTables | awk '/Addresses/ {s+=$2}; END {print s}'`
+ENTRIES_V4=`pfctl -vvsTables | awk '/-\tbogons$/ {getline; print $2}'`
+LINES_V4=`wc -l /tmp/bogons/fullbogons-ipv4.txt | awk '{ print $1 }'`
+if [ $ENTRIES_MAX -gt $((2*ENTRIES_TOT-${ENTRIES_V4:-0}+LINES_V4)) ]; then
     # These bogons are removed as they are private.  I'm not going
     # to question this now, adding a big WARNING instead.  Here be
     # dragons...
-			egrep -v "^100.64.0.0/10|^192.168.0.0/16|^172.16.0.0/12|^10.0.0.0/8" /tmp/bogons > /usr/local/etc/bogons
+    egrep -v "^100.64.0.0/10|^192.168.0.0/16|^172.16.0.0/12|^10.0.0.0/8" /tmp/bogons/fullbogons-ipv4.txt > /usr/local/etc/bogons
     RESULT=`/sbin/pfctl -t bogons -T replace -f /usr/local/etc/bogons 2>&1`
     echo "$RESULT" | awk '{ print "Bogons V4 file downloaded: " $0 }' | logger
-		else
+else
     echo "Not updating IPv4 bogons (increase table-entries limit)" | logger
-		fi
-		rm /tmp/bogons
-	else
-		echo "Could not download ${v4url} (checksum mismatch)" | logger
-		checksum_error="true"
-	fi
+fi
 
-	if [ "$BOGON_V6_CKSUM" = "$ON_DISK_V6_CKSUM" ]; then
-		BOGONS_V6_TABLE_COUNT=`pfctl -sTables | grep ^bogonsv6$ | wc -l | awk '{ print $1 }'`
-		ENTRIES_TOT=`pfctl -vvsTables | awk '/Addresses/ {s+=$2}; END {print s}'`
-		LINES_V6=`wc -l /tmp/bogonsv6 | awk '{ print $1 }'`
-		if [ $BOGONS_V6_TABLE_COUNT -gt 0 ]; then
+ENTRIES_MAX=`pfctl -s memory | awk '/table-entries/ { print $4 }'`
+ENTRIES_TOT=`pfctl -vvsTables | awk '/Addresses/ {s+=$2}; END {print s}'`
+BOGONS_V6_TABLE_COUNT=`pfctl -sTables | grep ^bogonsv6$ | wc -l | awk '{ print $1 }'`
+ENTRIES_TOT=`pfctl -vvsTables | awk '/Addresses/ {s+=$2}; END {print s}'`
+LINES_V6=`wc -l /tmp/bogons/fullbogons-ipv6.txt | awk '{ print $1 }'`
+if [ $BOGONS_V6_TABLE_COUNT -gt 0 ]; then
     ENTRIES_V6=`pfctl -vvsTables | awk '/-\tbogonsv6$/ {getline; print $2}'`
     if [ $ENTRIES_MAX -gt $((2*ENTRIES_TOT-${ENTRIES_V6:-0}+LINES_V6)) ]; then
-				egrep -iv "^fc00::/7" /tmp/bogonsv6 > /usr/local/etc/bogonsv6
+        egrep -iv "^fc00::/7" /tmp/bogons/fullbogons-ipv6.txt > /usr/local/etc/bogonsv6
         RESULT=`/sbin/pfctl -t bogonsv6 -T replace -f /usr/local/etc/bogonsv6 2>&1`
         echo "$RESULT" | awk '{ print "Bogons V6 file downloaded: " $0 }' | logger
     else
         echo "Not saving or updating IPv6 bogons (increase table-entries limit)" | logger
     fi
-		else
+else
     if [ $ENTRIES_MAX -gt $((2*ENTRIES_TOT+LINES_V6)) ]; then
-				egrep -iv "^fc00::/7" /tmp/bogonsv6 > /usr/local/etc/bogonsv6
+        egrep -iv "^fc00::/7" /tmp/bogons/fullbogons-ipv6.txt > /usr/local/etc/bogonsv6
         echo "Bogons V6 file downloaded but not updating IPv6 bogons table because IPv6 Allow is off" | logger
     else
         echo "Not saving IPv6 bogons table (IPv6 Allow is off and table-entries limit is potentially too low)" | logger
     fi
-		fi
-		rm /tmp/bogonsv6
-	else
-		echo "Could not download ${v6url} (checksum mismatch)" | logger
-		checksum_error="true"
-	fi
-
-fi
-
-if [ "$checksum_error" != "" ]; then
-	# Relaunch and sleep
-	sh /usr/local/etc/rc.update_bogons &
-	exit
 fi
 
 echo "rc.update_bogons is ending the update cycle." | logger