From patchwork Thu Aug 1 18:45:39 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jon Murphy X-Patchwork-Id: 7935 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "R11" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4WZdFx5Pnsz3wwH for ; Thu, 1 Aug 2024 18:45:57 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) client-signature ECDSA (secp384r1)) (Client CN "mail02.haj.ipfire.org", Issuer "E5" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4WZdFt5CxJz1vr; Thu, 1 Aug 2024 18:45:54 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4WZdFt2mc3z34Gd; Thu, 1 Aug 2024 18:45:54 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "R11" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4WZdFp6Pp2z34DG for ; Thu, 1 Aug 2024 18:45:50 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4WZdFn5TY4z1tL; Thu, 1 Aug 2024 18:45:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1722537950; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=92ePKaKa6h/g39gzjSvKJF6tJNPTFMt0eIalM001GP0=; b=Ou3ZdwOB3S85TUlDCe0KzUHr03Ze3cPY+fKFLN/w3REPVnoyUx5kV61xwigOYddKYBh1hd zQca21MrTICi3WGUM/MixxKSAmSzHws5Q2WneKKFMVtcTYL49psCvVuKLmNNgCOYdZlE6K 5Y56Qwn06UScYy8lN44WZtN/RCw4tCF8PCig3VwZ1UYNl2r+kLCMXGFmeCZ7pOlVLpdw0I w5Fjn3HhFpLHYzsHXuPA3KPjO65OGc4GPZtbH4XsMluKiYW52F/9mciCO5JB5qBlL03cQd /78FxCv5tdMQHOAEgU47laNnSYjNrtQhqdympsDBJTRls9sgHyVIgEEjewyM0A== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1722537950; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=92ePKaKa6h/g39gzjSvKJF6tJNPTFMt0eIalM001GP0=; b=TxPmEs20h4klUuawqnVORi99SEltNDPuxP0ByUSs5mx0qwclRpfjJMy21YC0wBTjdS7F5/ +AXbHITaO4RA+6AA== From: Jon Murphy To: development@lists.ipfire.org Subject: [PATCH] RPZ: bug fix and code update Date: Thu, 1 Aug 2024 13:45:39 -0500 Message-Id: <20240801184539.2536658-1-jon.murphy@ipfire.org> MIME-Version: 1.0 Message-ID-Hash: RYLATCETVPQU46MPJPG2CLTMB67BI3HG X-Message-ID-Hash: RYLATCETVPQU46MPJPG2CLTMB67BI3HG X-MailFrom: jon.murphy@ipfire.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.8 Precedence: list List-Id: IPFire development talk Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: changed all paths from `/var/ipfire/rpz/` to `/var/ipfire/dns/rpz/` (thank you to Adolf!) rpz-config: - bug: corrected "Type" test from block to allow - removed verbose parameter from various commands rpz-metrics: - bug: corrected grep for rpz name count - bug: fixed divide by zero error (thank you Peppe!) install/uninstall: - bug: corrected scripts (thank you Bernhard!) Signed-off-by: Jon Murphy Reviewed-by: Bernhard Bitsch Tested-by: Bernhard Bitsch --- config/backup/includes/rpz | 4 ++-- config/rootfiles/packages/rpz | 6 +++--- config/rpz/rpz-config | 14 +++++++------- config/rpz/rpz-metrics | 9 +++++---- lfs/rpz | 6 +++--- src/paks/rpz/install.sh | 27 +++++++++++++++++++++++++++ src/paks/rpz/uninstall.sh | 31 +++++++++++++++++++++++++++++++ src/paks/rpz/update.sh | 25 +++++++++++++++++++++++++ 8 files changed, 103 insertions(+), 19 deletions(-) create mode 100644 src/paks/rpz/install.sh create mode 100644 src/paks/rpz/uninstall.sh create mode 100644 src/paks/rpz/update.sh diff --git a/config/backup/includes/rpz b/config/backup/includes/rpz index 4d59bb40c..8c7410ebd 100644 --- a/config/backup/includes/rpz +++ b/config/backup/includes/rpz @@ -1,5 +1,5 @@ -/var/ipfire/rpz/allowlist -/var/ipfire/rpz/blocklist +/var/ipfire/dns/rpz/allowlist +/var/ipfire/dns/rpz/blocklist /etc/unbound/zonefiles/allow.rpz /etc/unbound/zonefiles/block.rpz /etc/unbound/local.d/*rpz.conf diff --git a/config/rootfiles/packages/rpz b/config/rootfiles/packages/rpz index 2ffa715dd..183825362 100644 --- a/config/rootfiles/packages/rpz +++ b/config/rootfiles/packages/rpz @@ -6,6 +6,6 @@ usr/sbin/rpz-config usr/sbin/rpz-metrics usr/sbin/rpz-sleep var/ipfire/backup/addons/includes/rpz -var/ipfire/rpz -var/ipfire/rpz/allowlist -var/ipfire/rpz/blocklist +var/ipfire/dns/rpz +var/ipfire/dns/rpz/allowlist +var/ipfire/dns/rpz/blocklist diff --git a/config/rpz/rpz-config b/config/rpz/rpz-config index 98dc0a4ca..a24a5c132 100644 --- a/config/rpz/rpz-config +++ b/config/rpz/rpz-config @@ -19,7 +19,7 @@ # # ############################################################################### -# v22 - 2024-07-12 +# v23 - 2024-07-30 ############### Functions ############### @@ -54,11 +54,11 @@ check_unbound_conf () { make_rpz_file () { local theType="${1}" # allow or block - theList="/var/ipfire/rpz/${theType}list" # input user list of domains + theList="/var/ipfire/dns/rpz/${theType}list" # input custom list of domains theZoneFile="/etc/unbound/zonefiles/${theType}.rpz" # output file for RPZ theAction='.' - if [[ "${theType}" =~ "block" ]] ; then + if [[ "${theType}" =~ "allow" ]] ; then theAction='rpz-passthru.' fi @@ -131,8 +131,8 @@ case "${theAction}" in # set-up zone file /usr/bin/touch "${rpzFile}" # unbound requires these settings for rpz files - /bin/chown --verbose nobody:nobody "${rpzFile}" - /bin/chmod --verbose 644 "${rpzFile}" + /bin/chown nobody:nobody "${rpzFile}" + /bin/chmod 644 "${rpzFile}" ;; # trash config file & rpz file @@ -143,8 +143,8 @@ case "${theAction}" in fi msg_log "info: rpz: remove config file & rpz file \"${theName}\"" - /bin/rm --verbose "${rpzConfig}" - /bin/rm --verbose "${rpzFile}" + /bin/rm "${rpzConfig}" + /bin/rm "${rpzFile}" check_unbound_conf ;; diff --git a/config/rpz/rpz-metrics b/config/rpz/rpz-metrics index 0f97c7911..4d932726e 100644 --- a/config/rpz/rpz-metrics +++ b/config/rpz/rpz-metrics @@ -19,7 +19,7 @@ # # ############################################################################### -# v18 on 2024-07-05 +# v19 on 2024-07-30 ############### Main ############### @@ -33,7 +33,7 @@ messageLogs=$( find /var/log/messages* -type f | # get the list of RPZ names & counts from the message log(s) rpzNameCount=$( for logf in ${messageLogs} ; do - /usr/bin/zgrep --text --fixed-strings 'info: rpz: applied' "${logf}" | + /usr/bin/zgrep --text --extended-regexp 'info: rpz: applied.* A IN$' "${logf}" | /usr/bin/awk '$10 ~ /\[\w*]/ { print $10 }' ; done | /usr/bin/sort | /usr/bin/uniq --count ) @@ -107,8 +107,9 @@ do theLines=$( /bin/echo "${output}" | /usr/bin/awk '{ print $1 }' ) totalLines=$(( totalLines + theLines )) - #hitsPerLine=$( echo "scale=0 ; $theHits / $theLines" | bc ) - hitsPerLine=$(( 100 * theHits / theLines )) + if [[ "${theLines}" -gt 2 ]] ; then + hitsPerLine=$(( 100 * theHits / theLines )) + fi fi # get modification date diff --git a/lfs/rpz b/lfs/rpz index 319c10b7f..73f6f2b1b 100644 --- a/lfs/rpz +++ b/lfs/rpz @@ -67,9 +67,9 @@ $(TARGET) : $(DIR_CONF)/rpz/{rpz-config,rpz-metrics,rpz-sleep} -t /usr/sbin # Install settings folder and two empty files - mkdir -pv /var/ipfire/rpz - touch /var/ipfire/rpz/allowlist - touch /var/ipfire/rpz/blocklist + mkdir -pv /var/ipfire/dns/rpz + touch /var/ipfire/dns/rpz/allowlist + touch /var/ipfire/dns/rpz/blocklist # Add conf file to /etc directory cp -vf $(DIR_CONF)/rpz/00-rpz.conf /etc/unbound/local.d diff --git a/src/paks/rpz/install.sh b/src/paks/rpz/install.sh new file mode 100644 index 000000000..0a797e158 --- /dev/null +++ b/src/paks/rpz/install.sh @@ -0,0 +1,27 @@ +#!/bin/bash +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2024 IPFire Team # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see . # +# # +############################################################################### +# +. /opt/pakfire/lib/functions.sh +extract_files +restore_backup ${NAME} + +# restart unbound to load config file +/etc/init.d/unbound restart diff --git a/src/paks/rpz/uninstall.sh b/src/paks/rpz/uninstall.sh new file mode 100644 index 000000000..4fb20e127 --- /dev/null +++ b/src/paks/rpz/uninstall.sh @@ -0,0 +1,31 @@ +#!/bin/bash +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2024 IPFire Team # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see . # +# # +############################################################################### +# +. /opt/pakfire/lib/functions.sh + +# stop unbound to delete RPZ conf file +/etc/init.d/unbound stop + +make_backup ${NAME} +remove_files + +# start unbound to load unbound config file +/etc/init.d/unbound start diff --git a/src/paks/rpz/update.sh b/src/paks/rpz/update.sh new file mode 100644 index 000000000..938a93a40 --- /dev/null +++ b/src/paks/rpz/update.sh @@ -0,0 +1,25 @@ +#!/bin/bash +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2024 IPFire Team # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see . # +# # +############################################################################### +# +. /opt/pakfire/lib/functions.sh +extract_backup_includes +./uninstall.sh +./install.sh