76 lines
1.9 KiB
Django/Jinja
76 lines
1.9 KiB
Django/Jinja
#!/bin/bash
|
|
|
|
# Update /etc/firewall/outbound_whitelist_ipv*.acl from /etc/firewall/outbound_whitelist.acl
|
|
|
|
resolve_hosts() {
|
|
local type="$1" out="$2"
|
|
local tmp=$(mktemp "$out.XXXXXX")
|
|
|
|
(
|
|
echo "# AUTO-GENERATED FROM outbound_whitelist.acl"
|
|
while read domain; do
|
|
case $domain in
|
|
"#"* | "") ;;
|
|
*)
|
|
(host -t "$type" "$domain" 2>&1 || true) | sort -n | while read line; do
|
|
case $line in
|
|
*"not found"*)
|
|
echo "$line" >&2
|
|
;;
|
|
*"has address"*)
|
|
ip="${line##* }"
|
|
case $ip in
|
|
13.108.*) ip="13.108.0.0/14" ;;
|
|
*) ip="${ip%.*}.0/24" ;;
|
|
esac
|
|
echo "$ip $domain"
|
|
;;
|
|
*"has IPv6 address"*)
|
|
ip="${line##* }"
|
|
case $ip in
|
|
2607:f8b0:*) ip="2607:f8b0::/32" ;;
|
|
*) ip=$(ipv6calc --addr_to_uncompressed "$ip" | cut -d: -f1-4)::/64 ;;
|
|
esac
|
|
echo "$ip $domain"
|
|
;;
|
|
esac
|
|
done
|
|
;;
|
|
esac
|
|
done < /etc/firewall/outbound_whitelist.acl | sort -n -u
|
|
) > "$tmp"
|
|
|
|
if [ $? -ne 0 ]; then
|
|
echo "Error writing to $out" >&2
|
|
rm -f "$tmp"
|
|
elif cmp -s "$tmp" "$out"; then
|
|
rm -f "$tmp"
|
|
else
|
|
echo "--- Differences in $(basename $out): ---"
|
|
echo
|
|
diff -u "$out" "$tmp" | grep -v '^\(+++\|---\)' | grep '^[+-]'
|
|
echo
|
|
mv -f "$tmp" "$out"
|
|
fi
|
|
}
|
|
|
|
load_ipset() {
|
|
local name="$1" family="$2" file="$3"
|
|
local tmp="$name-$$"
|
|
|
|
ipset -exist create "$name" hash:net family "$family" counters comment
|
|
|
|
ipset create "$tmp" hash:net family "$family" counters comment
|
|
grep -v '^#' "$file" | while read ip name; do
|
|
ipset -exist add "$tmp" "$ip" comment "$name"
|
|
done
|
|
ipset swap "$name" "$tmp"
|
|
ipset destroy "$tmp"
|
|
}
|
|
|
|
resolve_hosts A /etc/firewall/outbound_whitelist_ipv4.acl
|
|
resolve_hosts AAAA /etc/firewall/outbound_whitelist_ipv6.acl
|
|
|
|
load_ipset outbound-whitelist inet /etc/firewall/outbound_whitelist_ipv4.acl
|
|
load_ipset outbound-whitelist-ipv6 inet6 /etc/firewall/outbound_whitelist_ipv6.acl
|