src/scripts/update-ipblocklists

   1 #!/usr/bin/perl
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2007-2022  IPFire Team  <info@ipfire.org>                     #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 use strict;
  23 use POSIX;
  24
  25 # Load perl module to talk to the kernel syslog.
  26 use Sys::Syslog qw(:DEFAULT setlogsock);
  27
  28 require '/var/ipfire/general-functions.pl';
  29 require "${General::swroot}/ipblocklist-functions.pl";
  30 require "${General::swroot}/lang.pl";
  31
  32 # Hash to store the settings.
  33 my %settings = ();
  34
  35 # The user and group name as which this script should be run.
  36 my $run_as = 'nobody';
  37
  38 # Get user and group id of the user.
  39 my ( $uid, $gid ) = ( getpwnam $run_as )[ 2, 3 ];
  40
  41 # Check if the script currently runs as root.
  42 if ( $> == 0 ) {
  43         # Drop privileges and switch to the specified user and group.
  44         POSIX::setgid( $gid );
  45         POSIX::setuid( $uid );
  46 }
  47
  48 # Establish the connection to the syslog service.
  49 openlog('ipblocklist', 'cons,pid', 'user');
  50
  51 # Grab the configured providers.
  52 &General::readhash("${General::swroot}/ipblocklist/settings", \%settings);
  53
  54 # Check if the blocklist feature is enabled.
  55 unless ($settings{'ENABLE'} eq "on") {
  56         # Exit.
  57         exit 0;
  58 }
  59
  60 # Check if the red device is active.
  61 unless (-e "${General::swroot}/red/active") {
  62         # Log to syslog.
  63         &_log_to_syslog("<ERROR> Could not update any blocklist - The system is offline!");
  64
  65         # Exit.
  66         exit 1;
  67 }
  68
  69 # Get all available blocklists.
  70 my @blocklists = &IPblocklist::get_blocklists();
  71
  72 # Array to store successfully update blocklists.
  73 # They need to be reloaded.
  74 my @updated_blocklists = ();
  75
  76 # Gather the details, when a list got modified last time.
  77 my %modified = ();
  78
  79 # Read-in data if the file exists.
  80 &General::readhash($IPblocklist::modified_file, \%modified ) if (-e $IPblocklist::modified_file);
  81
  82 # Loop through the array of blocklists.
  83 foreach my $blocklist (@blocklists) {
  84         # Skip if the blocklist is not enabled.
  85         next if($settings{$blocklist} ne "on");
  86
  87         # Get current time.
  88         my $time = time();
  89
  90         # Get time, when the blocklist has been downloaded last.
  91         my $last_download_time = $modified{$blocklist};
  92
  93         # Get the holdoff rate in seconds for the current processed blocklist.
  94         my $rate_time = &IPblocklist::get_holdoff_rate($blocklist);
  95
  96         # Calculate holdoff time.
  97         my $holdoff_time = $last_download_time + $rate_time;
  98
  99         # Check if enough time has passed since the last download of the list.
 100         if ($time <= $holdoff_time) {
 101                 # To frequent updates, log to syslog.
 102                 &_log_to_syslog("<INFO> Skipping $blocklist blocklist - Too frequent update attempts!");
 103
 104                 # Skip this provider.
 105                 next;
 106         }
 107
 108         # Try to download and update the blocklist.
 109         my $return = &IPblocklist::download_and_create_blocklist($blocklist);
 110
 111         # Check if we got a return code.
 112         if ($return) {
 113                 # Handle different return codes.
 114                 if ($return eq "not_modified") {
 115                         # Log notice to syslog.
 116                         &_log_to_syslog("<INFO> Skipping $blocklist blocklist - It has not been modified!");
 117                 } elsif ($return eq "dl_error") {
 118                         # Log error to the syslog.
 119                         &_log_to_syslog("<ERROR> Could not update $blocklist blocklist - Download error\!");
 120                 } else {
 121                         # Log error to syslog.
 122                         &_log_to_syslog("<ERROR> Could not update $blocklist blocklist - Unexpected error\!");
 123                 }
 124         } else {
 125                 # Log successfull update.
 126                 &_log_to_syslog("<INFO> Successfully updated $blocklist blocklist.");
 127
 128                 # Add the list to the array of updated blocklists.
 129                 push(@updated_blocklists, $blocklist);
 130         }
 131 }
 132
 133 # Check if a blocklist has been updated and therefore needs to be reloaded.
 134 if (@updated_blocklists) {
 135         # Loop through the array.
 136         foreach my $updated_blocklist (@updated_blocklists) {
 137                 # Get the blocklist file.
 138                 my $ipset_db_file = &IPblocklist::get_ipset_db_file($updated_blocklist);
 139
 140                 # Call safe system function to reload/update the blocklist.
 141                 &General::system("ipset", "restore", "-f", "$ipset_db_file");
 142         }
 143 }
 144
 145 END {
 146         # Close connection to syslog.
 147         closelog();
 148 }
 149
 150 #
 151 # Tiny function to sent the error message to the syslog.
 152 #
 153 sub _log_to_syslog($) {
 154         my ($message) = @_;
 155
 156         # The syslog function works best with an array based input,
 157         # so generate one before passing the message details to syslog.
 158         my @syslog = ("ERR", "$message");
 159
 160         # Send the log message.
 161         syslog(@syslog);
 162 }
 163
 164 1;