firewall: rework bogons, use signatures, closes #1248

src/etc/rc.update_bogons

 #!/bin/sh
 
-# Global variables
-proc_error=""
+v4url="https://pkg.opnsense.org/bogons/fullbogons-ipv4.txt"
+v6url="https://pkg.opnsense.org/bogons/fullbogons-ipv6.txt"
+proc_error=
 
-# Download and extract if necessary
 process_url()
 {
     local file=$1
     local url=$2
 
-	/usr/bin/fetch -a -T 30 -q -o $file "${url}"
+    /usr/bin/fetch -a -T 30 -q -o ${file}.sig "${url}.sig"
+    /usr/bin/fetch -a -T 30 -q -o ${file} "${url}"
 
-	if [ ! -f $file ]; then
+    if [ ! -f ${file} ]; then
         echo "Could not download ${url}" | logger
         proc_error="true"
+        return 1
     fi
+
+    if opnsense-verify -q /tmp/bogons; then
+        echo "Could not verify ${url}" | logger
+        proc_error="true"
+        return 1
+    fi
+
+    return 0
 }
 
 echo "rc.update_bogons is starting up." | logger
 
 # Sleep for some time, unless an argument is specified.
-if [ "$1" = "" ]; then
+if [ -z "$1" ]; then
     # Grab a random value
     value=`od -A n -d -N2 /dev/random | awk '{ print $1 }'`
     echo "rc.update_bogons is sleeping for $value" | logger
@@ -29,28 +39,8 @@ fi
 
 echo "rc.update_bogons is beginning the update cycle." | logger
 
-v4url="https://pkg.opnsense.org/bogons/fullbogons-ipv4.txt"
-v6url="https://pkg.opnsense.org/bogons/fullbogons-ipv6.txt"
-
-process_url /tmp/bogons "${v4url}"
-process_url /tmp/bogonsv6 "${v6url}"
-
-if [ "$proc_error" != "" ]; then
-	# Relaunch and sleep
-	sh /usr/local/etc/rc.update_bogons &
-	exit
-fi
-
-BOGON_V4_CKSUM=`/usr/bin/fetch -T 30 -q -o - "${v4url}.md5" | awk '{ print $4 }'`
-ON_DISK_V4_CKSUM=`md5 /tmp/bogons | awk '{ print $4 }'`
-BOGON_V6_CKSUM=`/usr/bin/fetch -T 30 -q -o - "${v6url}.md5" | awk '{ print $4 }'`
-ON_DISK_V6_CKSUM=`md5 /tmp/bogonsv6 | awk '{ print $4 }'`
-
-if [ "$BOGON_V4_CKSUM" = "$ON_DISK_V4_CKSUM" ] || [ "$BOGON_V6_CKSUM" = "$ON_DISK_V6_CKSUM" ]; then
-
+if process_url /tmp/bogons "${v4url}"; then
     ENTRIES_MAX=`pfctl -s memory | awk '/table-entries/ { print $4 }'`
-
-	if [ "$BOGON_V4_CKSUM" = "$ON_DISK_V4_CKSUM" ]; then
     ENTRIES_TOT=`pfctl -vvsTables | awk '/Addresses/ {s+=$2}; END {print s}'`
     ENTRIES_V4=`pfctl -vvsTables | awk '/-\tbogons$/ {getline; print $2}'`
     LINES_V4=`wc -l /tmp/bogons | awk '{ print $1 }'`
@@ -64,13 +54,12 @@ if [ "$BOGON_V4_CKSUM" = "$ON_DISK_V4_CKSUM" ] || [ "$BOGON_V6_CKSUM" = "$ON_DIS
     else
         echo "Not updating IPv4 bogons (increase table-entries limit)" | logger
     fi
-		rm /tmp/bogons
-	else
-		echo "Could not download ${v4url} (checksum mismatch)" | logger
-		checksum_error="true"
-	fi
+    rm /tmp/bogons*
+fi
 
-	if [ "$BOGON_V6_CKSUM" = "$ON_DISK_V6_CKSUM" ]; then
+if process_url /tmp/bogonsv6 "${v6url}"; then
+    ENTRIES_MAX=`pfctl -s memory | awk '/table-entries/ { print $4 }'`
+    ENTRIES_TOT=`pfctl -vvsTables | awk '/Addresses/ {s+=$2}; END {print s}'`
     BOGONS_V6_TABLE_COUNT=`pfctl -sTables | grep ^bogonsv6$ | wc -l | awk '{ print $1 }'`
     ENTRIES_TOT=`pfctl -vvsTables | awk '/Addresses/ {s+=$2}; END {print s}'`
     LINES_V6=`wc -l /tmp/bogonsv6 | awk '{ print $1 }'`
@@ -91,15 +80,10 @@ if [ "$BOGON_V4_CKSUM" = "$ON_DISK_V4_CKSUM" ] || [ "$BOGON_V6_CKSUM" = "$ON_DIS
             echo "Not saving IPv6 bogons table (IPv6 Allow is off and table-entries limit is potentially too low)" | logger
         fi
     fi
-		rm /tmp/bogonsv6
-	else
-		echo "Could not download ${v6url} (checksum mismatch)" | logger
-		checksum_error="true"
-	fi
-
+    rm /tmp/bogonsv6*
 fi
 
-if [ "$checksum_error" != "" ]; then
+if [ -n "${proc_error}" ]; then
     # Relaunch and sleep
     sh /usr/local/etc/rc.update_bogons &
     exit