47 lines
1.2 KiB
Django/Jinja
47 lines
1.2 KiB
Django/Jinja
#!/bin/sh
|
|
# {{ ansible_managed }}
|
|
# Rebuilds the geo sets of table inet host from ipdeny. Any failed download or
|
|
# check exits before the swap, so the previous file stays in place.
|
|
set -eu
|
|
|
|
out=/etc/nftables.d/host-geo.nft
|
|
countries="{{ firewall.geo_countries | join(' ') }}"
|
|
prefix='^[0-9a-f.:]+/[0-9]+$'
|
|
|
|
tmp=$(mktemp -d)
|
|
trap 'rm -rf "$tmp"' EXIT
|
|
|
|
fetch() {
|
|
curl -fsS --retry 3 --max-time 120 -o "$2" "$1"
|
|
grep -Eq "$prefix" "$2" || { echo "no prefixes in $1" >&2; exit 1; }
|
|
}
|
|
|
|
for cc in $countries; do
|
|
fetch "https://www.ipdeny.com/ipblocks/data/aggregated/$cc-aggregated.zone" "$tmp/$cc.v4"
|
|
fetch "https://www.ipdeny.com/ipv6/ipaddresses/aggregated/$cc-aggregated.zone" "$tmp/$cc.v6"
|
|
done
|
|
|
|
elements() {
|
|
cat "$@" | grep -E "$prefix" | sed 's/$/,/'
|
|
}
|
|
|
|
{
|
|
echo "# Generated by $0, do not edit."
|
|
echo 'table inet host {'
|
|
echo ' set geo_v4 { type ipv4_addr; flags interval; auto-merge; elements = {'
|
|
elements "$tmp"/*.v4
|
|
echo ' } }'
|
|
echo ' set geo_v6 { type ipv6_addr; flags interval; auto-merge; elements = {'
|
|
elements "$tmp"/*.v6
|
|
echo ' } }'
|
|
echo '}'
|
|
} >"$tmp/host-geo.nft"
|
|
|
|
nft -c -f "$tmp/host-geo.nft"
|
|
install -m 0644 "$tmp/host-geo.nft" "$out.new"
|
|
mv -f "$out.new" "$out"
|
|
|
|
if systemctl -q is-active nft-host.service; then
|
|
systemctl reload nft-host.service
|
|
fi
|