From 08ecabb27ccce3f61fbfee0698d82b67b57d0621 Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Wed, 15 Oct 2025 10:47:56 +0200 Subject: [PATCH 01/12] fw-addr-lists: normalize the address in list --- fw-addr-lists.rsc | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/fw-addr-lists.rsc b/fw-addr-lists.rsc index cd136f95..b653ea0f 100644 --- a/fw-addr-lists.rsc +++ b/fw-addr-lists.rsc @@ -122,14 +122,8 @@ :error true; } :if ($Address ~ "^[0-9a-zA-Z]*:[0-9a-zA-Z:\\.]+(/[0-9]{1,3})?\$") do={ - :local Net $Address; - :local Cidr 64; - :local Slash [ :find $Address "/" ]; - :if ([ :typeof $Slash ] = "num") do={ - :set Net [ :toip6 [ :pick $Address 0 $Slash ] ] - :set Cidr [ $MIN [ :pick $Address ($Slash + 1) [ :len $Address ] ] 64 ]; - } - :set Address (([ :toip6 $Net ] & ffff:ffff:ffff:ffff::) . "/" . $Cidr); + /ipv6/firewall/address-list/add dynamic=yes list=$Address address=$Address timeout=1s; + :set Address [ /ipv6/firewall/address-list/get [ find where dynamic=yes list=$Address ] address ]; :set Branch [ $GetBranch $Address ]; :set ($IPv6Addresses->$Branch->$Address) $TimeOut; :error true; From 69f78e06abf18b80c30b9ec577548a762fbe89f1 Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Wed, 15 Oct 2025 11:00:17 +0200 Subject: [PATCH 02/12] fw-addr-lists: also normalize IPv4 addresses --- fw-addr-lists.rsc | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/fw-addr-lists.rsc b/fw-addr-lists.rsc index b653ea0f..bef4616c 100644 --- a/fw-addr-lists.rsc +++ b/fw-addr-lists.rsc @@ -114,9 +114,8 @@ :do { :local Branch; :if ($Address ~ "^[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}(/[0-9]{1,2})?\$") do={ - :if ($Address ~ "/32\$") do={ - :set Address [ :pick $Address 0 ([ :len $Address ] - 3) ]; - } + /ip/firewall/address-list/add dynamic=yes list=$Address address=$Address timeout=1s; + :set Address [ /ip/firewall/address-list/get [ find where dynamic=yes list=$Address ] address ]; :set Branch [ $GetBranch $Address ]; :set ($IPv4Addresses->$Branch->$Address) $TimeOut; :error true; From 2a63a80791f1ab4481da7c67b70680f34703f3a2 Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Wed, 15 Oct 2025 11:30:26 +0200 Subject: [PATCH 03/12] fw-addr-lists: masks in array --- fw-addr-lists.rsc | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/fw-addr-lists.rsc b/fw-addr-lists.rsc index bef4616c..8fc4f318 100644 --- a/fw-addr-lists.rsc +++ b/fw-addr-lists.rsc @@ -56,6 +56,18 @@ } :local ListComment ("managed by " . $ScriptName); + :local Maskv4 ({}); + :for I from=0 to=32 do={ + :local List ("mask-" . $I); + /ip/firewall/address-list/add dynamic=yes timeout=1s list=$List address=("255.255.255.255/" . $I); + :set ($Maskv4->$I) [ /ip/firewall/address-list/get [ find where dynamic=yes list=$List ] address ]; + } + :local Maskv6 ({}); + :for I from=0 to=128 do={ + :local List ("mask-" . $I); + /ipv6/firewall/address-list/add dynamic=yes timeout=1s list=$List address=("ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff/" . $I); + :set ($Maskv4->$I) [ /ipv6/firewall/address-list/get [ find where dynamic=yes list=$List ] address ]; + } :foreach FwListName,FwList in=$FwAddrLists do={ :local CntAdd 0; @@ -114,15 +126,13 @@ :do { :local Branch; :if ($Address ~ "^[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}(/[0-9]{1,2})?\$") do={ - /ip/firewall/address-list/add dynamic=yes list=$Address address=$Address timeout=1s; - :set Address [ /ip/firewall/address-list/get [ find where dynamic=yes list=$Address ] address ]; + :set Address :set Branch [ $GetBranch $Address ]; :set ($IPv4Addresses->$Branch->$Address) $TimeOut; :error true; } :if ($Address ~ "^[0-9a-zA-Z]*:[0-9a-zA-Z:\\.]+(/[0-9]{1,3})?\$") do={ - /ipv6/firewall/address-list/add dynamic=yes list=$Address address=$Address timeout=1s; - :set Address [ /ipv6/firewall/address-list/get [ find where dynamic=yes list=$Address ] address ]; + :set Address :set Branch [ $GetBranch $Address ]; :set ($IPv6Addresses->$Branch->$Address) $TimeOut; :error true; From 3da600d489980fcb05ff99b9a3955152c385d104 Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Wed, 15 Oct 2025 11:35:33 +0200 Subject: [PATCH 04/12] fw-addr-lists: calc from mask --- fw-addr-lists.rsc | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/fw-addr-lists.rsc b/fw-addr-lists.rsc index 8fc4f318..3a92aede 100644 --- a/fw-addr-lists.rsc +++ b/fw-addr-lists.rsc @@ -60,13 +60,15 @@ :for I from=0 to=32 do={ :local List ("mask-" . $I); /ip/firewall/address-list/add dynamic=yes timeout=1s list=$List address=("255.255.255.255/" . $I); - :set ($Maskv4->$I) [ /ip/firewall/address-list/get [ find where dynamic=yes list=$List ] address ]; + :local Address [ /ip/firewall/address-list/get [ find where dynamic=yes list=$List ] address ]; + :set ($Maskv4->$I) [ :toip [ :pick $Address 0 [ :find Address "/" ] ] ]; } :local Maskv6 ({}); :for I from=0 to=128 do={ :local List ("mask-" . $I); /ipv6/firewall/address-list/add dynamic=yes timeout=1s list=$List address=("ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff/" . $I); - :set ($Maskv4->$I) [ /ipv6/firewall/address-list/get [ find where dynamic=yes list=$List ] address ]; + :local Address [ /ipv6/firewall/address-list/get [ find where dynamic=yes list=$List ] address ]; + :set ($Maskv4->$I) [ :toip6 [ :pick $Address 0 [ :find Address "/" ] ] ]; } :foreach FwListName,FwList in=$FwAddrLists do={ @@ -132,7 +134,14 @@ :error true; } :if ($Address ~ "^[0-9a-zA-Z]*:[0-9a-zA-Z:\\.]+(/[0-9]{1,3})?\$") do={ - :set Address + :local Net $Address; + :local Cidr 64; + :local Slash [ :find $Address "/" ]; + :if ([ :typeof $Slash ] = "num") do={ + :set Net [ :toip6 [ :pick $Address 0 $Slash ] ] + :set Cidr [ $MIN [ :pick $Address ($Slash + 1) [ :len $Address ] ] 64 ]; + } + :set Address (([ :toip6 $Net ] & ($Maskv6->$Cidr)) . "/" . $Cidr); :set Branch [ $GetBranch $Address ]; :set ($IPv6Addresses->$Branch->$Address) $TimeOut; :error true; From 87a6e60765e4301aad1b40bf3c84eee6b7ff704a Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Wed, 15 Oct 2025 10:47:56 +0200 Subject: [PATCH 05/12] fw-addr-lists: normalize the address in list --- fw-addr-lists.rsc | 34 ++++++++++++++++++++++++++++------ 1 file changed, 28 insertions(+), 6 deletions(-) diff --git a/fw-addr-lists.rsc b/fw-addr-lists.rsc index cd136f95..787d2752 100644 --- a/fw-addr-lists.rsc +++ b/fw-addr-lists.rsc @@ -21,11 +21,11 @@ :global CertificateAvailable; :global EitherOr; :global FetchHuge; + :global GetRandom20CharAlNum; :global HumanReadableNum; :global LogPrint; :global LogPrintOnce; :global LogPrintVerbose; - :global MIN; :global ScriptLock; :global WaitFullyConnected; @@ -56,6 +56,23 @@ } :local ListComment ("managed by " . $ScriptName); + :local GenList ($ScriptName . "-" . [ $GetRandom20CharAlNum ]); + :local Maskv4 ({}); + :for I from=0 to=31 do={ + /ip/firewall/address-list/add dynamic=yes timeout=30s list=$GenList address=("255.255.255.255/" . $I) comment=$I; + } + :foreach AddressList in=[ /ip/firewall/address-list/find where list=$GenList ] do={ + :local Address [ /ip/firewall/address-list/get $AddressList ]; + :set ($Maskv4->($Address->"comment")) [ :toip [ :pick ($Address->"address") 0 [ :find ($Address->"address") "/" ] ] ]; + } + :local Maskv6 ({}); + :for I from=0 to=128 do={ + /ipv6/firewall/address-list/add dynamic=yes timeout=30s list=$GenList address=("ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff/" . $I) comment=$I; + } + :foreach AddressList in=[ /ipv6/firewall/address-list/find where list=$GenList ] do={ + :local Address [ /ipv6/firewall/address-list/get $AddressList ]; + :set ($Maskv6->($Address->"comment")) [ :toip6 [ :pick ($Address->"address") 0 [ :find ($Address->"address") "/" ] ] ]; + } :foreach FwListName,FwList in=$FwAddrLists do={ :local CntAdd 0; @@ -114,8 +131,13 @@ :do { :local Branch; :if ($Address ~ "^[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}(/[0-9]{1,2})?\$") do={ - :if ($Address ~ "/32\$") do={ - :set Address [ :pick $Address 0 ([ :len $Address ] - 3) ]; + :local Net $Address; + :local Cidr 32; + :local Slash [ :find $Address "/" ]; + :if ([ :typeof $Slash ] = "num") do={ + :set Net [ :toip [ :pick $Address 0 $Slash ] ] + :set Cidr [ :pick $Address ($Slash + 1) [ :len $Address ] ]; + :set Address (([ :toip $Net ] & ($Maskv4->$Cidr)) . "/" . $Cidr); } :set Branch [ $GetBranch $Address ]; :set ($IPv4Addresses->$Branch->$Address) $TimeOut; @@ -123,13 +145,13 @@ } :if ($Address ~ "^[0-9a-zA-Z]*:[0-9a-zA-Z:\\.]+(/[0-9]{1,3})?\$") do={ :local Net $Address; - :local Cidr 64; + :local Cidr 128; :local Slash [ :find $Address "/" ]; :if ([ :typeof $Slash ] = "num") do={ :set Net [ :toip6 [ :pick $Address 0 $Slash ] ] - :set Cidr [ $MIN [ :pick $Address ($Slash + 1) [ :len $Address ] ] 64 ]; + :set Cidr [ :pick $Address ($Slash + 1) [ :len $Address ] ]; } - :set Address (([ :toip6 $Net ] & ffff:ffff:ffff:ffff::) . "/" . $Cidr); + :set Address (([ :toip6 $Net ] & ($Maskv6->$Cidr)) . "/" . $Cidr); :set Branch [ $GetBranch $Address ]; :set ($IPv6Addresses->$Branch->$Address) $TimeOut; :error true; From f55770b6a680b4e2f17805b28427be741ebd853b Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Wed, 15 Oct 2025 17:20:30 +0200 Subject: [PATCH 06/12] FIXUP --- fw-addr-lists.rsc | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fw-addr-lists.rsc b/fw-addr-lists.rsc index 787d2752..1bc8a9c7 100644 --- a/fw-addr-lists.rsc +++ b/fw-addr-lists.rsc @@ -23,6 +23,7 @@ :global FetchHuge; :global GetRandom20CharAlNum; :global HumanReadableNum; + :global IfThenElse; :global LogPrint; :global LogPrintOnce; :global LogPrintVerbose; @@ -137,7 +138,7 @@ :if ([ :typeof $Slash ] = "num") do={ :set Net [ :toip [ :pick $Address 0 $Slash ] ] :set Cidr [ :pick $Address ($Slash + 1) [ :len $Address ] ]; - :set Address (([ :toip $Net ] & ($Maskv4->$Cidr)) . "/" . $Cidr); + :set Address (([ :toip $Net ] & ($Maskv4->$Cidr)) . [ $IfThenElse ($Cidr < 32) ("/" . $Cidr) ]); } :set Branch [ $GetBranch $Address ]; :set ($IPv4Addresses->$Branch->$Address) $TimeOut; From fef1b7dc47c7113859d1b4fb4c3f185c18e83adb Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Wed, 15 Oct 2025 17:23:04 +0200 Subject: [PATCH 07/12] FIXUP --- fw-addr-lists.rsc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fw-addr-lists.rsc b/fw-addr-lists.rsc index 1bc8a9c7..39ee8090 100644 --- a/fw-addr-lists.rsc +++ b/fw-addr-lists.rsc @@ -59,7 +59,7 @@ :local ListComment ("managed by " . $ScriptName); :local GenList ($ScriptName . "-" . [ $GetRandom20CharAlNum ]); :local Maskv4 ({}); - :for I from=0 to=31 do={ + :for I from=0 to=32 do={ /ip/firewall/address-list/add dynamic=yes timeout=30s list=$GenList address=("255.255.255.255/" . $I) comment=$I; } :foreach AddressList in=[ /ip/firewall/address-list/find where list=$GenList ] do={ From 738a64d7a8140abea9f0dfa17b19b9a0de579ccf Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Wed, 15 Oct 2025 17:27:58 +0200 Subject: [PATCH 08/12] FIXUP --- fw-addr-lists.rsc | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/fw-addr-lists.rsc b/fw-addr-lists.rsc index 39ee8090..883e1e98 100644 --- a/fw-addr-lists.rsc +++ b/fw-addr-lists.rsc @@ -58,14 +58,17 @@ :local ListComment ("managed by " . $ScriptName); :local GenList ($ScriptName . "-" . [ $GetRandom20CharAlNum ]); + :local Maskv4 ({}); - :for I from=0 to=32 do={ + :for I from=0 to=31 do={ /ip/firewall/address-list/add dynamic=yes timeout=30s list=$GenList address=("255.255.255.255/" . $I) comment=$I; } :foreach AddressList in=[ /ip/firewall/address-list/find where list=$GenList ] do={ :local Address [ /ip/firewall/address-list/get $AddressList ]; :set ($Maskv4->($Address->"comment")) [ :toip [ :pick ($Address->"address") 0 [ :find ($Address->"address") "/" ] ] ]; } + :set ($Maskv4->32) 255.255.255.255; + :local Maskv6 ({}); :for I from=0 to=128 do={ /ipv6/firewall/address-list/add dynamic=yes timeout=30s list=$GenList address=("ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff/" . $I) comment=$I; From 638c8cb8b1256caf19210382da754e9abbbd8873 Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Wed, 15 Oct 2025 18:02:47 +0200 Subject: [PATCH 09/12] FIXUP --- fw-addr-lists.rsc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fw-addr-lists.rsc b/fw-addr-lists.rsc index 883e1e98..bffbf100 100644 --- a/fw-addr-lists.rsc +++ b/fw-addr-lists.rsc @@ -67,7 +67,7 @@ :local Address [ /ip/firewall/address-list/get $AddressList ]; :set ($Maskv4->($Address->"comment")) [ :toip [ :pick ($Address->"address") 0 [ :find ($Address->"address") "/" ] ] ]; } - :set ($Maskv4->32) 255.255.255.255; + :set ($Maskv4->"32") 255.255.255.255; :local Maskv6 ({}); :for I from=0 to=128 do={ From 349b3d502807d38eed4987ec07c2f15e83e205de Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Wed, 15 Oct 2025 19:28:12 +0200 Subject: [PATCH 10/12] FIXUP --- fw-addr-lists.rsc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fw-addr-lists.rsc b/fw-addr-lists.rsc index bffbf100..c93d36ea 100644 --- a/fw-addr-lists.rsc +++ b/fw-addr-lists.rsc @@ -141,7 +141,7 @@ :if ([ :typeof $Slash ] = "num") do={ :set Net [ :toip [ :pick $Address 0 $Slash ] ] :set Cidr [ :pick $Address ($Slash + 1) [ :len $Address ] ]; - :set Address (([ :toip $Net ] & ($Maskv4->$Cidr)) . [ $IfThenElse ($Cidr < 32) ("/" . $Cidr) ]); + :set Address [ :tostr (([ :toip $Net ] & ($Maskv4->$Cidr)) . [ $IfThenElse ($Cidr < 32) ("/" . $Cidr) ]) ]; } :set Branch [ $GetBranch $Address ]; :set ($IPv4Addresses->$Branch->$Address) $TimeOut; From d2f7a6dcef5cce30b1a93c8736f564a11ffd0148 Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Wed, 15 Oct 2025 19:42:05 +0200 Subject: [PATCH 11/12] FIXUP --- fw-addr-lists.rsc | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/fw-addr-lists.rsc b/fw-addr-lists.rsc index c93d36ea..5e0aaf3b 100644 --- a/fw-addr-lists.rsc +++ b/fw-addr-lists.rsc @@ -59,20 +59,19 @@ :local ListComment ("managed by " . $ScriptName); :local GenList ($ScriptName . "-" . [ $GetRandom20CharAlNum ]); - :local Maskv4 ({}); :for I from=0 to=31 do={ /ip/firewall/address-list/add dynamic=yes timeout=30s list=$GenList address=("255.255.255.255/" . $I) comment=$I; } + :local Maskv4 ({ "32"=255.255.255.255; }); :foreach AddressList in=[ /ip/firewall/address-list/find where list=$GenList ] do={ :local Address [ /ip/firewall/address-list/get $AddressList ]; :set ($Maskv4->($Address->"comment")) [ :toip [ :pick ($Address->"address") 0 [ :find ($Address->"address") "/" ] ] ]; } - :set ($Maskv4->"32") 255.255.255.255; - :local Maskv6 ({}); - :for I from=0 to=128 do={ + :for I from=0 to=127 do={ /ipv6/firewall/address-list/add dynamic=yes timeout=30s list=$GenList address=("ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff/" . $I) comment=$I; } + :local Maskv6 ({ "128"=ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff; }); :foreach AddressList in=[ /ipv6/firewall/address-list/find where list=$GenList ] do={ :local Address [ /ipv6/firewall/address-list/get $AddressList ]; :set ($Maskv6->($Address->"comment")) [ :toip6 [ :pick ($Address->"address") 0 [ :find ($Address->"address") "/" ] ] ]; @@ -155,6 +154,8 @@ :set Net [ :toip6 [ :pick $Address 0 $Slash ] ] :set Cidr [ :pick $Address ($Slash + 1) [ :len $Address ] ]; } + :put ("Net: " . $Net); + :put ("Mask: " . ($Maskv6->$Cidr)); :set Address (([ :toip6 $Net ] & ($Maskv6->$Cidr)) . "/" . $Cidr); :set Branch [ $GetBranch $Address ]; :set ($IPv6Addresses->$Branch->$Address) $TimeOut; From e3de876f860b1ecf69fd8f1d75b2869e0f47c966 Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Wed, 15 Oct 2025 19:45:50 +0200 Subject: [PATCH 12/12] FIXUP --- fw-addr-lists.rsc | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/fw-addr-lists.rsc b/fw-addr-lists.rsc index 5e0aaf3b..c0061e06 100644 --- a/fw-addr-lists.rsc +++ b/fw-addr-lists.rsc @@ -135,7 +135,7 @@ :local Branch; :if ($Address ~ "^[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}(/[0-9]{1,2})?\$") do={ :local Net $Address; - :local Cidr 32; + :local Cidr "32"; :local Slash [ :find $Address "/" ]; :if ([ :typeof $Slash ] = "num") do={ :set Net [ :toip [ :pick $Address 0 $Slash ] ] @@ -148,14 +148,12 @@ } :if ($Address ~ "^[0-9a-zA-Z]*:[0-9a-zA-Z:\\.]+(/[0-9]{1,3})?\$") do={ :local Net $Address; - :local Cidr 128; + :local Cidr "128"; :local Slash [ :find $Address "/" ]; :if ([ :typeof $Slash ] = "num") do={ :set Net [ :toip6 [ :pick $Address 0 $Slash ] ] :set Cidr [ :pick $Address ($Slash + 1) [ :len $Address ] ]; } - :put ("Net: " . $Net); - :put ("Mask: " . ($Maskv6->$Cidr)); :set Address (([ :toip6 $Net ] & ($Maskv6->$Cidr)) . "/" . $Cidr); :set Branch [ $GetBranch $Address ]; :set ($IPv6Addresses->$Branch->$Address) $TimeOut;