RPZ: bug fix and code update

changed all paths from `/var/ipfire/rpz/` to `/var/ipfire/dns/rpz/`
(thank you to Adolf!)

rpz-config:
 - bug: corrected "Type" test from block to allow
 - removed verbose parameter from various commands

rpz-metrics:
 - bug: corrected grep for rpz name count
 - bug: fixed divide by zero error (thank you Peppe!)

install/uninstall:
 - bug: corrected scripts (thank you Bernhard!)

Signed-off-by: Jon Murphy <jon.murphy@ipfire.org>

diff --git a/config/backup/includes/rpz b/config/backup/includes/rpz
index 4d59bb40cc15ecc7cbdb67fdebb41407ead5c286..8c7410ebd85003b76344782668bfa889082490fd 100644 (file)
--- a/config/backup/includes/rpz
+++ b/config/backup/includes/rpz
@@ -1,5 +1,5 @@
-/var/ipfire/rpz/allowlist
-/var/ipfire/rpz/blocklist
+/var/ipfire/dns/rpz/allowlist
+/var/ipfire/dns/rpz/blocklist
 /etc/unbound/zonefiles/allow.rpz
 /etc/unbound/zonefiles/block.rpz
 /etc/unbound/local.d/*rpz.conf

diff --git a/config/rootfiles/packages/rpz b/config/rootfiles/packages/rpz
index 2ffa715ddbbc173839d7f8dd93510c4aa54d89b3..18382536293e348a32b672bb9283ff763ec180d3 100644 (file)
--- a/config/rootfiles/packages/rpz
+++ b/config/rootfiles/packages/rpz
@@ -6,6 +6,6 @@ usr/sbin/rpz-config
 usr/sbin/rpz-metrics
 usr/sbin/rpz-sleep
 var/ipfire/backup/addons/includes/rpz
-var/ipfire/rpz
-var/ipfire/rpz/allowlist
-var/ipfire/rpz/blocklist
+var/ipfire/dns/rpz
+var/ipfire/dns/rpz/allowlist
+var/ipfire/dns/rpz/blocklist

diff --git a/config/rpz/rpz-config b/config/rpz/rpz-config
index 98dc0a4ca84aa9decb49085351656832d82eff4c..a24a5c13271c8edb55bf53a08919c73299ca0094 100644 (file)
--- a/config/rpz/rpz-config
+++ b/config/rpz/rpz-config
@@ -19,7 +19,7 @@
 #                                                                             #
 ###############################################################################
 
-#      v22 - 2024-07-12
+#      v23 - 2024-07-30
 
 ###############     Functions     ###############
 
@@ -54,11 +54,11 @@ check_unbound_conf () {
 make_rpz_file () {
        local theType="${1}"    #       allow or block
 
-       theList="/var/ipfire/rpz/${theType}list"                                #       input user list of domains
+       theList="/var/ipfire/dns/rpz/${theType}list"                    #       input custom list of domains
        theZoneFile="/etc/unbound/zonefiles/${theType}.rpz"             #       output file for RPZ
 
        theAction='.'
-       if [[ "${theType}" =~ "block" ]] ; then
+       if [[ "${theType}" =~ "allow" ]] ; then
                theAction='rpz-passthru.'
        fi
 
@@ -131,8 +131,8 @@ case "${theAction}" in
                #       set-up zone file
                /usr/bin/touch "${rpzFile}"
                #       unbound requires these settings for rpz files
-               /bin/chown --verbose nobody:nobody "${rpzFile}"
-               /bin/chmod --verbose 644 "${rpzFile}"
+               /bin/chown nobody:nobody "${rpzFile}"
+               /bin/chmod 644 "${rpzFile}"
                ;;
 
        #       trash config file & rpz file
@@ -143,8 +143,8 @@ case "${theAction}" in
                fi
 
                msg_log "info: rpz: remove config file & rpz file \"${theName}\""
-               /bin/rm --verbose "${rpzConfig}"
-               /bin/rm --verbose "${rpzFile}"
+               /bin/rm "${rpzConfig}"
+               /bin/rm "${rpzFile}"
 
                check_unbound_conf
                ;;

diff --git a/config/rpz/rpz-metrics b/config/rpz/rpz-metrics
index 0f97c7911fd0182adf96a9500b21bbe955dffc97..4d932726e5e5f82b2e24ff7151f27ffd60ce7dc4 100644 (file)
--- a/config/rpz/rpz-metrics
+++ b/config/rpz/rpz-metrics
@@ -19,7 +19,7 @@
 #                                                                             #
 ###############################################################################
 
-#      v18 on 2024-07-05
+#      v19 on 2024-07-30
 
 ###############       Main        ###############
 
@@ -33,7 +33,7 @@ messageLogs=$( find /var/log/messages* -type f |
 
 #      get the list of RPZ names & counts from the message log(s)
 rpzNameCount=$( for logf in ${messageLogs} ; do
-       /usr/bin/zgrep --text --fixed-strings 'info: rpz: applied' "${logf}" |
+       /usr/bin/zgrep --text --extended-regexp 'info: rpz: applied.* A IN$' "${logf}" |
        /usr/bin/awk '$10 ~ /\[\w*]/ { print $10 }' ;
        done | /usr/bin/sort | /usr/bin/uniq --count )
 
@@ -107,8 +107,9 @@ do
                theLines=$( /bin/echo "${output}" | /usr/bin/awk '{ print $1 }' )
                totalLines=$(( totalLines + theLines ))
 
-               #hitsPerLine=$( echo "scale=0 ; $theHits / $theLines" | bc )
-               hitsPerLine=$(( 100 * theHits / theLines ))
+               if [[ "${theLines}" -gt 2 ]] ; then
+                       hitsPerLine=$(( 100 * theHits / theLines ))
+               fi
        fi
 
        #       get modification date

diff --git a/lfs/rpz b/lfs/rpz
index 319c10b7f304712f6e76afa28242fe3dcdd56ba4..73f6f2b1bfe5ee4a2f35e2e9a0d8465599cfabfb 100644 (file)
--- a/lfs/rpz
+++ b/lfs/rpz
@@ -67,9 +67,9 @@ $(TARGET) :
          $(DIR_CONF)/rpz/{rpz-config,rpz-metrics,rpz-sleep} -t /usr/sbin
 
        # Install settings folder and two empty files
-       mkdir -pv /var/ipfire/rpz
-       touch /var/ipfire/rpz/allowlist
-       touch /var/ipfire/rpz/blocklist
+       mkdir -pv /var/ipfire/dns/rpz
+       touch /var/ipfire/dns/rpz/allowlist
+       touch /var/ipfire/dns/rpz/blocklist
 
        # Add conf file to /etc directory
        cp -vf $(DIR_CONF)/rpz/00-rpz.conf /etc/unbound/local.d

diff --git a/src/paks/rpz/install.sh b/src/paks/rpz/install.sh
new file mode 100644 (file)
index 0000000..0a797e1
--- /dev/null
+++ b/src/paks/rpz/install.sh
@@ -0,0 +1,27 @@
+#!/bin/bash
+###############################################################################
+#                                                                             #
+#  IPFire.org - A linux based firewall                                        #
+#  Copyright (C) 2024  IPFire Team  <info@ipfire.org>                         #
+#                                                                             #
+#  This program is free software: you can redistribute it and/or modify       #
+#  it under the terms of the GNU General Public License as published by       #
+#  the Free Software Foundation, either version 3 of the License, or          #
+#  (at your option) any later version.                                        #
+#                                                                             #
+#  This program is distributed in the hope that it will be useful,            #
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of             #
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the              #
+#  GNU General Public License for more details.                               #
+#                                                                             #
+#  You should have received a copy of the GNU General Public License          #
+#  along with this program.  If not, see <http://www.gnu.org/licenses/>.      #
+#                                                                             #
+###############################################################################
+#
+. /opt/pakfire/lib/functions.sh
+extract_files
+restore_backup ${NAME}
+
+#  restart unbound to load config file
+/etc/init.d/unbound restart

diff --git a/src/paks/rpz/uninstall.sh b/src/paks/rpz/uninstall.sh
new file mode 100644 (file)
index 0000000..4fb20e1
--- /dev/null
+++ b/src/paks/rpz/uninstall.sh
@@ -0,0 +1,31 @@
+#!/bin/bash
+###############################################################################
+#                                                                             #
+#  IPFire.org - A linux based firewall                                        #
+#  Copyright (C) 2024  IPFire Team  <info@ipfire.org>                         #
+#                                                                             #
+#  This program is free software: you can redistribute it and/or modify       #
+#  it under the terms of the GNU General Public License as published by       #
+#  the Free Software Foundation, either version 3 of the License, or          #
+#  (at your option) any later version.                                        #
+#                                                                             #
+#  This program is distributed in the hope that it will be useful,            #
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of             #
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the              #
+#  GNU General Public License for more details.                               #
+#                                                                             #
+#  You should have received a copy of the GNU General Public License          #
+#  along with this program.  If not, see <http://www.gnu.org/licenses/>.      #
+#                                                                             #
+###############################################################################
+#
+. /opt/pakfire/lib/functions.sh
+
+#  stop unbound to delete RPZ conf file
+/etc/init.d/unbound stop
+
+make_backup ${NAME}
+remove_files
+
+#  start unbound to load unbound config file
+/etc/init.d/unbound start

diff --git a/src/paks/rpz/update.sh b/src/paks/rpz/update.sh
new file mode 100644 (file)
index 0000000..938a93a
--- /dev/null
+++ b/src/paks/rpz/update.sh
@@ -0,0 +1,25 @@
+#!/bin/bash
+###############################################################################
+#                                                                             #
+#  IPFire.org - A linux based firewall                                        #
+#  Copyright (C) 2024  IPFire Team  <info@ipfire.org>                         #
+#                                                                             #
+#  This program is free software: you can redistribute it and/or modify       #
+#  it under the terms of the GNU General Public License as published by       #
+#  the Free Software Foundation, either version 3 of the License, or          #
+#  (at your option) any later version.                                        #
+#                                                                             #
+#  This program is distributed in the hope that it will be useful,            #
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of             #
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the              #
+#  GNU General Public License for more details.                               #
+#                                                                             #
+#  You should have received a copy of the GNU General Public License          #
+#  along with this program.  If not, see <http://www.gnu.org/licenses/>.      #
+#                                                                             #
+###############################################################################
+#
+. /opt/pakfire/lib/functions.sh
+extract_backup_includes
+./uninstall.sh
+./install.sh