groove/routeros-scripts
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge branch 'fw-addr-lists' into next

Browse source
This commit is contained in:
Christian Hesse 2025-03-08 10:29:05 +01:00
commit 79a4b369cb
1 changed files with 59 additions and 38 deletions
Download patch file Download diff file Expand all files Collapse all files

97
fw-addr-lists.rsc
View file

@ -24,6 +24,7 @@
:global HumanReadableNum; :global HumanReadableNum;
:global LogPrint; :global LogPrint;
:global LogPrintOnce; :global LogPrintOnce;
:global LogPrintVerbose;
:global ScriptLock; :global ScriptLock;
:global WaitFullyConnected; :global WaitFullyConnected;
@ -36,6 +37,11 @@
} }
} }
:local GetBranch do={
:global EitherOr;
:return [ :pick [ :convert transform=md5 to=hex [ :pick $1 0 [ $EitherOr [ :find $1 "/" ] [ :len $1 ] ] ] ] 0 2 ];
}
:if ([ $ScriptLock $ScriptName ] = false) do={ :if ([ $ScriptLock $ScriptName ] = false) do={
:set ExitOK true; :set ExitOK true;
:error false; :error false;
@ -99,17 +105,24 @@
:set Address ([ :pick $Line 0 [ $FindDelim $Line ] ] . ($List->"cidr")); :set Address ([ :pick $Line 0 [ $FindDelim $Line ] ] . ($List->"cidr"));
} }
:do { :do {
:local Branch [ $GetBranch $Address ];
:if ($Address ~ "^[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}(/[0-9]{1,2})?\$") do={ :if ($Address ~ "^[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}(/[0-9]{1,2})?\$") do={
:set ($IPv4Addresses->$Address) $TimeOut; :if ($Address ~ "/32\$") do={
:set Address [ :pick $Address 0 ([ :len $Address ] - 3) ];
}
:set ($IPv4Addresses->$Branch->$Address) $TimeOut;
:error true; :error true;
} }
:if ($Address ~ "^[0-9a-zA-Z]*:[0-9a-zA-Z:\\.]+(/[0-9]{1,3})?\$") do={ :if ($Address ~ "^[0-9a-zA-Z]*:[0-9a-zA-Z:\\.]+(/[0-9]{1,3})?\$") do={
:set ($IPv6Addresses->$Address) $TimeOut; :if ($Address ~ "/128\$") do={
:set Address [ :pick $Address 0 ([ :len $Address ] - 4) ];
}
:set ($IPv6Addresses->$Branch->$Address) $TimeOut;
:error true; :error true;
} }
:if ($Address ~ "^[\\.a-zA-Z0-9-]+\\.[a-zA-Z]{2,}\$") do={ :if ($Address ~ "^[\\.a-zA-Z0-9-]+\\.[a-zA-Z]{2,}\$") do={
:set ($IPv4Addresses->$Address) $TimeOut; :set ($IPv4Addresses->$Branch->$Address) $TimeOut;
:set ($IPv6Addresses->$Address) $TimeOut; :set ($IPv6Addresses->$Branch->$Address) $TimeOut;
:error true; :error true;
} }
} on-error={ } } on-error={ }
@ -119,15 +132,17 @@
:foreach Entry in=[ /ip/firewall/address-list/find where \ :foreach Entry in=[ /ip/firewall/address-list/find where \
list=$FwListName comment=$ListComment ] do={ list=$FwListName comment=$ListComment ] do={
:local Address [ /ip/firewall/address-list/get $Entry address ]; :local Address [ /ip/firewall/address-list/get $Entry address ];
:if ([ :typeof ($IPv4Addresses->$Address) ] = "time") do={ :local Branch [ $GetBranch $Address ];
$LogPrint debug $ScriptName ("Renewing IPv4 address in list '" . $FwListName . \ :local TimeOut ($IPv4Addresses->$Branch->$Address);
"' with " . ($IPv4Addresses->$Address) . ": " . $Address); :if ([ :typeof $TimeOut ] = "time") do={
/ip/firewall/address-list/set $Entry timeout=($IPv4Addresses->$Address); $LogPrintVerbose debug $ScriptName ("Renewing IPv4 address in list '" . $FwListName . \
:set ($IPv4Addresses->$Address); "' with " . $TimeOut . ": " . $Address);
/ip/firewall/address-list/set $Entry timeout=$TimeOut;
:set ($IPv4Addresses->$Branch->$Address);
:set CntRenew ($CntRenew + 1); :set CntRenew ($CntRenew + 1);
} else={ } else={
:if ($Failure = false) do={ :if ($Failure = false) do={
$LogPrint debug $ScriptName ("Removing IPv4 address from list '" . $FwListName . \ $LogPrintVerbose debug $ScriptName ("Removing IPv4 address from list '" . $FwListName . \
"': " . $Address); "': " . $Address);
/ip/firewall/address-list/remove $Entry; /ip/firewall/address-list/remove $Entry;
:set CntRemove ($CntRemove + 1); :set CntRemove ($CntRemove + 1);
@ -138,15 +153,17 @@
:foreach Entry in=[ /ipv6/firewall/address-list/find where \ :foreach Entry in=[ /ipv6/firewall/address-list/find where \
list=$FwListName comment=$ListComment ] do={ list=$FwListName comment=$ListComment ] do={
:local Address [ /ipv6/firewall/address-list/get $Entry address ]; :local Address [ /ipv6/firewall/address-list/get $Entry address ];
:if ([ :typeof ($IPv6Addresses->$Address) ] = "time") do={ :local Branch [ $GetBranch $Address ];
$LogPrint debug $ScriptName ("Renewing IPv6 address in list '" . $FwListName . \ :local TimeOut ($IPv6Addresses->$Branch->$Address);
"' with " . ($IPv6Addresses->$Address) . ": " . $Address); :if ([ :typeof $TimeOut ] = "time") do={
/ipv6/firewall/address-list/set $Entry timeout=($IPv6Addresses->$Address); $LogPrintVerbose debug $ScriptName ("Renewing IPv6 address in list '" . $FwListName . \
:set ($IPv6Addresses->$Address); "' with " . $TimeOut . ": " . $Address);
/ipv6/firewall/address-list/set $Entry timeout=$TimeOut;
:set ($IPv6Addresses->$Branch->$Address);
:set CntRenew ($CntRenew + 1); :set CntRenew ($CntRenew + 1);
} else={ } else={
:if ($Failure = false) do={ :if ($Failure = false) do={
$LogPrint debug $ScriptName ("Removing IPv6 address from list '" . $FwListName . \ $LogPrintVerbose debug $ScriptName ("Removing IPv6 address from list '" . $FwListName . \
"': " . $Address); "': " . $Address);
/ipv6/firewall/address-list/remove $Entry; /ipv6/firewall/address-list/remove $Entry;
:set CntRemove ($CntRemove + 1); :set CntRemove ($CntRemove + 1);
@ -154,31 +171,35 @@
} }
} }
:foreach Address,Timeout in=$IPv4Addresses do={ :foreach BranchName,Branch in=$IPv4Addresses do={
$LogPrint debug $ScriptName ("Adding IPv4 address to list '" . $FwListName . \ $LogPrintVerbose debug $ScriptName ("Handling branch: " . $BranchName);
"' with " . $Timeout . ": " . $Address); :foreach Address,Timeout in=$Branch do={
:do { $LogPrintVerbose debug $ScriptName ("Adding IPv4 address to list '" . $FwListName . \
/ip/firewall/address-list/add list=$FwListName comment=$ListComment \ "' with " . $Timeout . ": " . $Address);
address=$Address timeout=$Timeout; :do {
:set ($IPv4Addresses->$Address); /ip/firewall/address-list/add list=$FwListName comment=$ListComment \
:set CntAdd ($CntAdd + 1); address=$Address timeout=$Timeout;
} on-error={ :set CntAdd ($CntAdd + 1);
$LogPrint warning $ScriptName ("Failed to add IPv4 address to list '" . $FwListName . \ } on-error={
"': " . $Address); $LogPrint warning $ScriptName ("Failed to add IPv4 address to list '" . $FwListName . \
"': " . $Address);
}
} }
} }
:foreach Address,Timeout in=$IPv6Addresses do={ :foreach BranchName,Branch in=$IPv6Addresses do={
$LogPrint debug $ScriptName ("Adding IPv6 address to list '" . $FwListName . \ $LogPrintVerbose debug $ScriptName ("Handling branch: " . $BranchName);
"' with " . $Timeout . ": " . $Address); :foreach Address,Timeout in=$Branch do={
:do { $LogPrintVerbose debug $ScriptName ("Adding IPv6 address to list '" . $FwListName . \
/ipv6/firewall/address-list/add list=$FwListName comment=$ListComment \ "' with " . $Timeout . ": " . $Address);
address=$Address timeout=$Timeout; :do {
:set ($IPv6Addresses->$Address); /ipv6/firewall/address-list/add list=$FwListName comment=$ListComment \
:set CntAdd ($CntAdd + 1); address=$Address timeout=$Timeout;
} on-error={ :set CntAdd ($CntAdd + 1);
$LogPrint warning $ScriptName ("Failed to add IPv6 address to list '" . $FwListName . \ } on-error={
"': " . $Address); $LogPrint warning $ScriptName ("Failed to add IPv6 address to list '" . $FwListName . \
"': " . $Address);
}
} }
} }