39 lines
1.1 KiB
Bash
Executable File
39 lines
1.1 KiB
Bash
Executable File
#!/bin/bash
|
|
# Keeps the address set of the time servers up to date, in one atomic
|
|
# nftables transaction. NTP pools answer with different addresses at each
|
|
# query, so the addresses chrony actually picked are added to those resolved
|
|
# here. Web traffic does not need addresses: the local proxy connects by name.
|
|
|
|
CONF=/etc/contest-firewall
|
|
TMP=$(mktemp)
|
|
mkdir -p /run/contest-firewall
|
|
|
|
# One run at a time (the timer and a manual run can overlap)
|
|
exec 9> /run/contest-firewall/lock
|
|
flock 9
|
|
|
|
entries() {
|
|
sed -e 's/#.*//' -e 's/[[:space:]]//g' "$1" | grep -v '^$'
|
|
}
|
|
|
|
ntp_addresses() {
|
|
{
|
|
for name in $(entries "$CONF/ntp_servers.txt"); do
|
|
dig +short A "$name"
|
|
done
|
|
chronyc -n sources 2>/dev/null | awk '/^\^/ {print $2}'
|
|
} | grep -E '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$' | sort -u
|
|
}
|
|
|
|
{
|
|
echo "flush set inet filter ntp_ips"
|
|
for ip in $(ntp_addresses); do
|
|
echo "add element inet filter ntp_ips { $ip }"
|
|
done
|
|
} > "$TMP"
|
|
|
|
# Apply atomically, then keep a copy of the active ruleset
|
|
nft -f "$TMP"
|
|
rm -f "$TMP"
|
|
nft list ruleset > /etc/nftables.rules
|