2 ###############################################################################
4 # IPFire.org - A linux based firewall #
5 # Copyright (C) 2007-2022 IPFire Team <info@ipfire.org> #
7 # This program is free software: you can redistribute it and/or modify #
8 # it under the terms of the GNU General Public License as published by #
9 # the Free Software Foundation, either version 3 of the License, or #
10 # (at your option) any later version. #
12 # This program is distributed in the hope that it will be useful, #
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of #
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15 # GNU General Public License for more details. #
17 # You should have received a copy of the GNU General Public License #
18 # along with this program. If not, see <http://www.gnu.org/licenses/>. #
20 ###############################################################################
25 # Load perl module to talk to the kernel syslog.
26 use Sys
::Syslog
qw(:DEFAULT setlogsock);
28 require '/var/ipfire/general-functions.pl';
29 require "${General::swroot}/ipblocklist-functions.pl";
30 require "${General::swroot}/lang.pl";
32 # Hash to store the settings.
35 # The user and group name as which this script should be run.
36 my $run_as = 'nobody';
38 # Get user and group id of the user.
39 my ( $uid, $gid ) = ( getpwnam $run_as )[ 2, 3 ];
41 # Check if the script currently runs as root.
43 # Drop privileges and switch to the specified user and group.
44 POSIX
::setgid
( $gid );
45 POSIX
::setuid
( $uid );
48 # Establish the connection to the syslog service.
49 openlog
('ipblocklist', 'cons', 'user');
51 # Grab the configured providers.
52 &General
::readhash
("${General::swroot}/ipblocklist/settings", \
%settings);
54 # Check if the blocklist feature is enabled.
55 unless ($settings{'ENABLE'} eq "on") {
60 # Check if the red device is active.
61 unless (-e
"${General::swroot}/red/active") {
63 &_log_to_syslog
("<ERROR> Could not update any blocklist - The system is offline!");
69 # Get all available blocklists.
70 my @blocklists = &IPblocklist
::get_blocklists
();
72 # Array to store successfully update blocklists.
73 # They need to be reloaded.
74 my @updated_blocklists = ();
76 # Gather the details, when a list got modified last time.
79 # Read-in data if the file exists.
80 &General
::readhash
($IPblocklist::modified_file
, \
%modified ) if (-e
$IPblocklist::modified_file
);
82 # Loop through the array of blocklists.
83 foreach my $blocklist (@blocklists) {
84 # Skip if the blocklist is not enabled.
85 next if($settings{$blocklist} ne "on");
90 # Get time, when the blocklist has been downloaded last.
91 my $last_download_time = $modified{$blocklist};
93 # Get the holdoff rate in seconds for the current processed blocklist.
94 my $rate_time = &IPblocklist
::get_holdoff_rate
($blocklist);
96 # Calculate holdoff time.
97 my $holdoff_time = $last_download_time + $rate_time;
99 # Check if enough time has passed since the last download of the list.
100 if ($time <= $holdoff_time) {
101 # To frequent updates, log to syslog.
102 &_log_to_syslog
("<INFO> Skipping $blocklist blocklist - Too frequent update attempts!");
104 # Skip this provider.
108 # Try to download and update the blocklist.
109 my $return = &IPblocklist
::download_and_create_blocklist
($blocklist);
111 # Check if we got a return code.
113 # Handle different return codes.
114 if ($return eq "not_modified") {
115 # Log notice to syslog.
116 &_log_to_syslog
("<INFO> Skipping $blocklist blocklist - It has not been modified!");
117 } elsif ($return eq "dl_error") {
118 # Log error to the syslog.
119 &_log_to_syslog
("<ERROR> Could not update $blocklist blocklist - Download error\!");
121 # Log error to syslog.
122 &_log_to_syslog
("<ERROR> Could not update $blocklist blocklist - Unexpected error\!");
125 # Log successfull update.
126 &_log_to_syslog
("<INFO> Successfully updated $blocklist blocklist.");
128 # Add the list to the array of updated blocklists.
129 push(@updated_blocklists, $blocklist);
133 # Check if a blocklist has been updated and therefore needs to be reloaded.
134 if (@updated_blocklists) {
135 # Loop through the array.
136 foreach my $updated_blocklist (@updated_blocklists) {
137 # Get the blocklist file.
138 my $ipset_db_file = &IPblocklist
::get_ipset_db_file
($updated_blocklist);
140 # Call safe system function to reload/update the blocklist.
141 &General
::system("ipset", "restore", "-f", "$ipset_db_file");
146 # Close connection to syslog.
151 # Tiny function to sent the error message to the syslog.
153 sub _log_to_syslog
($) {
156 # The syslog function works best with an array based input,
157 # so generate one before passing the message details to syslog.
158 my @syslog = ("ERR", "$message");
160 # Send the log message.