Does script fw-addr-lists support IPv6?

[netravnen]

File: https://github.com/eworm-de/routeros-scripts/blob/main/fw-addr-lists.rsc

I can see there is validation for IPv6 addresses and subnets in the script. But nowhere can I read the logic that would enable the script to walk entries under /ipv6/firewall/address-list/*.:( Only logic for walking /ip/firewall/address-list/* seems to be present.

My overlay config for testing this is currently this

:global FwAddrLists {
  "allow"={
    { url="https://eworm.de/ros/fw-addr-lists/allow"; cert="E1"; timeout=1w };
  };
  "github-git"={
    { url="https://saasedl.paloaltonetworks.com/feeds/github/git/ipv6"; cert="GTS Root R1"; timeout=3d };
    { url="https://saasedl.paloaltonetworks.com/feeds/github/git/ipv4"; cert="GTS Root R1"; timeout=3d };
  };
  "block"={
    { url="https://eworm.de/ros/fw-addr-lists/block"; cert="E1" };
    { url="https://www.dshield.org/block.txt"; cidr="/24"; cert="R3" };
    { url="https://www.spamhaus.org/drop/drop.txt"; cert="Cloudflare Inc ECC CA-3" };
    { url="https://www.spamhaus.org/drop/edrop.txt"; cert="Cloudflare Inc ECC CA-3" };
  };

};
:global FwAddrListTimeOut 1d;

list github-git is created under the IPv4 context. Nothing under the IPv6 context.

[routeros-7.13] > /ipv6/firewall/address-list/print count-only where list=github-git  
0

[routeros-7.13] > /ip/firewall/address-list/print count-only where list=github-git  
26

[eworm-de]

Currently it does not... I already thought about adding IPv6 support there.

Looks like I should... 😁

[eworm-de]

Please switch you script to the next branch, then give it a try...

[netravnen]

Switched fw-addr-lists to the next branch,

[admin@routeros] > /system/script print where name=fw-addr-lists                               
Flags: I - invalid 
 0   ;;; url-suffix=?h=next
     name="fw-addr-lists" owner="fw-addr-lists" policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon dont-require-permissions=no last-started=2024-02-26 15:42:26 run-count=19 
     source=
       :local 0 [ :jobname ];
       :global GlobalFunctionsReady;
       :while ($GlobalFunctionsReady != true) do={ :delay 500ms; }
       
       :global FetchUserAgent;
       :global FwAddrLists;
       :global FwAddrListTimeOut;
       
       :global CertificateAvailable;
       :global EitherOr;
       :global LogPrintExit2;
       :global LogPrintOnce;
       :global ScriptLock;
       :global WaitFullyConnected;
       
       :local FindDelim do={
         :local ValidChars "0123456789./ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz-";
         :for I from=0 to=[ :len $1 ] do={
           :if ([ :typeof [ :find $ValidChars [ :pick ($1 . " ") $I ] ] ] != "num") do={
             :return $I;
           }
         }
       }
       
       $ScriptLock $0;
       $WaitFullyConnected;
       
       :local ListComment ("managed by " . $0);
       
       :foreach FwListName,FwList in=$FwAddrLists do={
         :local CntAdd 0;
         :local CntRenew 0;
         :local CntRemove 0;
         :local IPv4Addresses ({});
         :local IPv6Addresses ({});
--- cropped ---

Cannot see a difference...

[admin@routeros] > /ip/firewall/address-list/print count-only where list=github-git
26
[admin@routeros] > /ipv6/firewall/address-list/print count-only where list=github-git
0

The allow list now contains an entry... 😕

[admin@routeros] > /ipv6/firewall/address-list/print count-only where list=block
0
[admin@routeros] > /ipv6/firewall/address-list/print count-only where list=allow
2

2

[admin@routeros] > /ipv6/firewall/address-list/print where list=allow
Flags: D - DYNAMIC
Columns: LIST, ADDRESS, TIMEOUT
 #   LIST   ADDRESS                    TIMEOUT
;;; managed by fw-addr-lists
51 D allow  git.eworm.de               6d23h51m45s
;;; git.eworm.de
52 D allow  2a01:4f8:222:1e83::80/128

[netravnen]

How to I enable the $LogPrintExit2 debug outputs? Cannot seem to locate anything specific about this in the global-config file or the README.md file... 😖

[eworm-de]

Missed a little detail... Please update and try again.

You can enable debug output with:

:set PrintDebug true

But you are right, this is not documented. Its primary use for me to debug the code.

[netravnen]

Now it works. :) 💯 🤘 7aad21b

[admin@routeros] > /ipv6/firewall/address-list/print count-only where list=allow
2
[admin@routeros] > /ipv6/firewall/address-list/print count-only where list=block
0
[admin@routeros] > /ipv6/firewall/address-list/print count-only where list=github-git 
2
[admin@routeros] > /ip/firewall/address-list/print count-only where list=allow
2
[admin@routeros] > /ip/firewall/address-list/print count-only where list=block
1330
[admin@routeros] > /ip/firewall/address-list/print count-only where list=github-git
26
[admin@routeros] > /ipv6/firewall/address-list/print where list=github-git
Flags: D - DYNAMIC
Columns: LIST, ADDRESS, TIMEOUT
#   LIST        ADDRESS         TIMEOUT   
;;; managed by fw-addr-lists
0 D github-git  2606:50c0::/32  2d23h57m6s
;;; managed by fw-addr-lists
1 D github-git  2a0a:a440::/29  2d23h57m6s

[netravnen]

Will add a few additional address-list's to verify the observed behaviour is working as expected. :D

[netravnen]

Apart from the truncating kicking in for large >=63000B lists. It seems to works flawlessly, IMO. --> Note the IPv6 count for the block list.

[admin@routeros] > /ipv6/firewall/address-list/print count-only where list=allow
2
[admin@routeros] > /ip/firewall/address-list/print count-only where list=allow
2
[admin@routeros] > /ipv6/firewall/address-list/print count-only where list=github-git
2
[admin@routeros] > /ip/firewall/address-list/print count-only where list=github-git
26
[admin@routeros] > /ipv6/firewall/address-list/print count-only where list=block
0
[admin@routeros] > /ip/firewall/address-list/print count-only where list=block
20735
[admin@routeros] > /ipv6/firewall/address-list/print count-only where list=microsoft-365
50
[admin@routeros] > /ip/firewall/address-list/print count-only where list=microsoft-365
34
[admin@routeros] > /ipv6/firewall/address-list/print count-only where list=microsoft-teams
33
[admin@routeros] > /ip/firewall/address-list/print count-only where list=microsoft-teams
16
[admin@routeros] > /ipv6/firewall/address-list/print count-only where list=microsoft-sharepoint
33
[admin@routeros] > /ip/firewall/address-list/print count-only where list=microsoft-sharepoint
15
[admin@routeros] > /ipv6/firewall/address-list/print count-only where list=microsoft-exchange
43
[admin@routeros] > /ip/firewall/address-list/print count-only where list=microsoft-exchange
26
[admin@routeros] > /ipv6/firewall/address-list/print count-only where list=akamai
3
[admin@routeros] > /ip/firewall/address-list/print count-only where list=akamai
19
[admin@routeros] > /ipv6/firewall/address-list/print count-only where list=google-workspace
11
[admin@routeros] > /ip/firewall/address-list/print count-only where list=google-workspace
74
[admin@routeros] > /ipv6/firewall/address-list/print count-only where list=datadog
1
[admin@routeros] > /ip/firewall/address-list/print count-only where list=datadog
83
[admin@routeros] > /ipv6/firewall/address-list/print count-only where list=zoom
1
[admin@routeros] > /ip/firewall/address-list/print count-only where list=zoom
308
[admin@routeros] > /ipv6/firewall/address-list/print count-only where list=github-all
635
[admin@routeros] > /ip/firewall/address-list/print count-only where list=github-all
2395

— cropped —
  "block"={
    { url="https://eworm.de/ros/fw-addr-lists/block"; cert="E1" };
    { url="https://www.dshield.org/block.txt"; cidr="/24"; cert="R3" };
    { url="https://www.spamhaus.org/drop/drop.txt"; cert="Cloudflare Inc ECC CA-3" };
    { url="https://www.spamhaus.org/drop/edrop.txt"; cert="Cloudflare Inc ECC CA-3" };
    { url="https://iplists.firehol.org/files/firehol_level1.netset" };
    { url="https://iplists.firehol.org/files/botscout_30d.ipset" };
    { url="https://iplists.firehol.org/files/feodo.ipset" };
    { url="https://iplists.firehol.org/files/sslbl.ipset" };
    { url="https://iplists.firehol.org/files/zeus_badips.ipset" };
    { url="https://iplists.firehol.org/files/bambenek_c2.ipset" };
    { url="https://iplists.firehol.org/files/maxmind_proxy_fraud.ipset" };
    { url="https://iplists.firehol.org/files/firehol_level2.netset" };
    { url="https://iplists.firehol.org/files/firehol_level3.netset" };
    { url="https://iplists.firehol.org/files/firehol_level4.netset" };
  };
— cropped —

[netravnen]

#58

[netravnen]

You can enable debug output with:

:set PrintDebug true

But you are right, this is not documented. Its primary use for me to debug the code.

in my opinion, this would be helpful to have documented. Especially if I want to debug further, before making a bug report in this repo. ;-)