firewall: final transition to lightweight bogon.txz set

src/etc/rc.update_bogons

@@ -9,34 +9,10 @@ if [ -n "${CORE_ABI}" -a -n "${SYS_ABI}" ]; then
 	URL="${URL}/${SYS_ABI}/${CORE_ABI}"
 fi
 
-URL4="${URL}/bogons/fullbogons-ipv4.txt"
-URL6="${URL}/bogons/fullbogons-ipv6.txt"
+URL="${URL}/sets/bogons.txz"
 
 proc_error=
 
-process_url()
-{
-    local file=$1
-    local url=$2
-
-    /usr/bin/fetch -a -T 30 -q -o ${file}.sig "${url}.sig"
-    /usr/bin/fetch -a -T 30 -q -o ${file} "${url}"
-
-    if [ ! -f ${file} ]; then
-        echo "Could not download ${url}" | logger
-        proc_error="true"
-        return 1
-    fi
-
-    if ! opnsense-verify -q ${file}; then
-        echo "Could not verify ${url}" | logger
-        proc_error="true"
-        return 1
-    fi
-
-    return 0
-}
-
 echo "rc.update_bogons is starting up." | logger
 
 # Sleep for some time, unless an argument is specified.
@@ -49,48 +25,21 @@ fi
 
 echo "rc.update_bogons is beginning the update cycle." | logger
 
-if process_url /tmp/bogons "${URL4}"; then
-    ENTRIES_MAX=`pfctl -s memory | awk '/table-entries/ { print $4 }'`
-    ENTRIES_TOT=`pfctl -vvsTables | awk '/Addresses/ {s+=$2}; END {print s}'`
-    ENTRIES_V4=`pfctl -vvsTables | awk '/-\tbogons$/ {getline; print $2}'`
-    LINES_V4=`wc -l /tmp/bogons | awk '{ print $1 }'`
-    if [ $ENTRIES_MAX -gt $((2*ENTRIES_TOT-${ENTRIES_V4:-0}+LINES_V4)) ]; then
-        # These bogons are removed as they are private.  I'm not going
-        # to question this now, adding a big WARNING instead.  Here be
-        # dragons...
-        egrep -v "^100.64.0.0/10|^192.168.0.0/16|^172.16.0.0/12|^10.0.0.0/8" /tmp/bogons > /usr/local/etc/bogons
-        RESULT=`/sbin/pfctl -t bogons -T replace -f /usr/local/etc/bogons 2>&1`
-        echo "$RESULT" | awk '{ print "Bogons V4 file downloaded: " $0 }' | logger
-    else
-        echo "Not updating IPv4 bogons (increase table-entries limit)" | logger
-    fi
-    rm /tmp/bogons*
-fi
-
-if process_url /tmp/bogonsv6 "${URL6}"; then
-    ENTRIES_MAX=`pfctl -s memory | awk '/table-entries/ { print $4 }'`
-    ENTRIES_TOT=`pfctl -vvsTables | awk '/Addresses/ {s+=$2}; END {print s}'`
-    BOGONS_V6_TABLE_COUNT=`pfctl -sTables | grep ^bogonsv6$ | wc -l | awk '{ print $1 }'`
-    ENTRIES_TOT=`pfctl -vvsTables | awk '/Addresses/ {s+=$2}; END {print s}'`
-    LINES_V6=`wc -l /tmp/bogonsv6 | awk '{ print $1 }'`
-    if [ $BOGONS_V6_TABLE_COUNT -gt 0 ]; then
-        ENTRIES_V6=`pfctl -vvsTables | awk '/-\tbogonsv6$/ {getline; print $2}'`
-        if [ $ENTRIES_MAX -gt $((2*ENTRIES_TOT-${ENTRIES_V6:-0}+LINES_V6)) ]; then
-            egrep -iv "^fc00::/7" /tmp/bogonsv6 > /usr/local/etc/bogonsv6
-            RESULT=`/sbin/pfctl -t bogonsv6 -T replace -f /usr/local/etc/bogonsv6 2>&1`
-            echo "$RESULT" | awk '{ print "Bogons V6 file downloaded: " $0 }' | logger
-        else
-            echo "Not saving or updating IPv6 bogons (increase table-entries limit)" | logger
-        fi
-    else
-        if [ $ENTRIES_MAX -gt $((2*ENTRIES_TOT+LINES_V6)) ]; then
-            egrep -iv "^fc00::/7" /tmp/bogonsv6 > /usr/local/etc/bogonsv6
-            echo "Bogons V6 file downloaded but not updating IPv6 bogons table because IPv6 Allow is off" | logger
-        else
-            echo "Not saving IPv6 bogons table (IPv6 Allow is off and table-entries limit is potentially too low)" | logger
-        fi
-    fi
-    rm /tmp/bogonsv6*
+rm -rf /tmp/bogons
+mkdir -p /tmp/bogons
+
+fetch -a -T 30 -q -o /tmp/bogons/bogons.txz.sig "${URL}.sig"
+fetch -a -T 30 -q -o /tmp/bogons/bogons.txz "${URL}"
+
+if [ ! -f /tmp/bogons/bogons.txz ]; then
+    echo "Could not download ${URL}" | logger
+    proc_error="true"
+elif ! opnsense-verify -q /tmp/bogons/bogons.txz; then
+    echo "Could not verify ${URL}" | logger
+    proc_error="true"
+elif ! tar -C /tmp/bogons -xJf /tmp/bogons/bogons.txz; then
+    echo "Could not extract ${URL}" | logger
+    proc_error="true"
 fi
 
 if [ -n "${proc_error}" ]; then
@@ -99,4 +48,42 @@ if [ -n "${proc_error}" ]; then
     exit
 fi
 
+ENTRIES_MAX=`pfctl -s memory | awk '/table-entries/ { print $4 }'`
+ENTRIES_TOT=`pfctl -vvsTables | awk '/Addresses/ {s+=$2}; END {print s}'`
+ENTRIES_V4=`pfctl -vvsTables | awk '/-\tbogons$/ {getline; print $2}'`
+LINES_V4=`wc -l /tmp/bogons/fullbogons-ipv4.txt | awk '{ print $1 }'`
+if [ $ENTRIES_MAX -gt $((2*ENTRIES_TOT-${ENTRIES_V4:-0}+LINES_V4)) ]; then
+    # These bogons are removed as they are private.  I'm not going
+    # to question this now, adding a big WARNING instead.  Here be
+    # dragons...
+    egrep -v "^100.64.0.0/10|^192.168.0.0/16|^172.16.0.0/12|^10.0.0.0/8" /tmp/bogons/fullbogons-ipv4.txt > /usr/local/etc/bogons
+    RESULT=`/sbin/pfctl -t bogons -T replace -f /usr/local/etc/bogons 2>&1`
+    echo "$RESULT" | awk '{ print "Bogons V4 file downloaded: " $0 }' | logger
+else
+    echo "Not updating IPv4 bogons (increase table-entries limit)" | logger
+fi
+
+ENTRIES_MAX=`pfctl -s memory | awk '/table-entries/ { print $4 }'`
+ENTRIES_TOT=`pfctl -vvsTables | awk '/Addresses/ {s+=$2}; END {print s}'`
+BOGONS_V6_TABLE_COUNT=`pfctl -sTables | grep ^bogonsv6$ | wc -l | awk '{ print $1 }'`
+ENTRIES_TOT=`pfctl -vvsTables | awk '/Addresses/ {s+=$2}; END {print s}'`
+LINES_V6=`wc -l /tmp/bogons/fullbogons-ipv6.txt | awk '{ print $1 }'`
+if [ $BOGONS_V6_TABLE_COUNT -gt 0 ]; then
+    ENTRIES_V6=`pfctl -vvsTables | awk '/-\tbogonsv6$/ {getline; print $2}'`
+    if [ $ENTRIES_MAX -gt $((2*ENTRIES_TOT-${ENTRIES_V6:-0}+LINES_V6)) ]; then
+        egrep -iv "^fc00::/7" /tmp/bogons/fullbogons-ipv6.txt > /usr/local/etc/bogonsv6
+        RESULT=`/sbin/pfctl -t bogonsv6 -T replace -f /usr/local/etc/bogonsv6 2>&1`
+        echo "$RESULT" | awk '{ print "Bogons V6 file downloaded: " $0 }' | logger
+    else
+        echo "Not saving or updating IPv6 bogons (increase table-entries limit)" | logger
+    fi
+else
+    if [ $ENTRIES_MAX -gt $((2*ENTRIES_TOT+LINES_V6)) ]; then
+        egrep -iv "^fc00::/7" /tmp/bogons/fullbogons-ipv6.txt > /usr/local/etc/bogonsv6
+        echo "Bogons V6 file downloaded but not updating IPv6 bogons table because IPv6 Allow is off" | logger
+    else
+        echo "Not saving IPv6 bogons table (IPv6 Allow is off and table-entries limit is potentially too low)" | logger
+    fi
+fi
+
 echo "rc.update_bogons is ending the update cycle." | logger