In that case, using the API is a better approach. Instead of asking each router to "pull" in changes by setting a script on them, you "push" the changes to them (no script inside necessary).

What's even better is that you don't really need to check whether the first value is an IP address (or subnet), since the API protocol ensures that the value will not "leak" into other arguments. Worst case scenario is that the "add" command would fail - no harm done.

Using PHP f.e.

Code: Select all

<?php
use PEAR2\Net\RouterOS;
require_once 'PEAR2_Net_RouterOS-1.0.0b5.phar';

//<config>
$url = 'http://feeds.dshield.org/topips.txt';
$listName = 'DShield_TOP';
$listTimeout = '1d';
$routers = array(
    array('192.168.88.1', 'admin', 'password'),
    array('192.168.88.2', 'admin', 'password'),
    //etc.
    array('192.168.88.254', 'admin', 'password')
);
//</config>

$addRequest = new RouterOS\Request('/ip firewall address-list add');
$addRequest
    ->setArgument('list', $listName)
    ->setArgument('timeout', $listTimeout);

foreach ($routers as $router) {
    $client = new RouterOS\Client($router[0], $router[1], $router[2]);
    foreach (file($url, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES) as $line) {
        $linePieces = preg_split('/\s+/', $line);
        if ($linePieces[0][0] === '#') {//Line is a comment; skip it
            continue;
        }

        $ip = $linePieces[0];
        $domain = isset($linePieces[1]) ? $linePieces[1] : null;

        $addRequest
            ->setArgument('address', $ip)
            ->setArgument('comment', $domain);

        $client->sendSync($addRequest);
    }
}

The same could be done analogously for Python too, or other languages.

(P.S. The script above is completely agnostic with regards to which one of all above URLs is used. Just switch it up, or make an array with all URLs and loop it to get all IPs of all lists)

Brian, the script you wrote to parse both works when writing to the output file but if you import into the mikrotik it probably wont import both the /32 and the /24 because in most cases the /32 addresses reside within the /24 subnets. The current OS only seems to take the /32 subnets on import instead of the /24 when they are on the same import list. I personally will continue to use the /24.

I love your adaptation but I'm not able to get it to work with the HPB list
$url = 'http://www.dshield.org/hpb.html?key=oiU ... XfZYxsXw==';
$listName = 'DShield_HPB';

        $ip = $linePieces[0];
        $domain = isset($linePieces[1]) ? $linePieces[1] : null; 

        if ($linePieces[0] === 'Start') {//Line is a header; skip it
            continue;
        }

        if (count($linePieces) >= 4) {//network-zerofilled, broadcast-zerofilled, mask, attacks(, name(, country(, email)?)?)?

            //Remove zerofill
            $ipPieces = explode('.', $linePieces[0]);
            for ($i=0, $c=count($ipPieces); $i<$c; ++$i) {
                $ipPieces[$i] = ltrim($ipPieces[$i], '0');
                if ('' === $ipPieces[$i]) {
                    $ipPieces[$i] = '0';
                }
            }

            $ip = implode('.', $ipPieces) . '/' . $linePieces[2];
            $domain = implode(' ; ', array_slice($linePieces, 3));//Use all meta data as the comment
        } else {//subnet(, dns)?
            $ip = $linePieces[0];
            $domain = isset($linePieces[1]) ? $linePieces[1] : null;
        } 

The topip list is so simple to parse you may as well do it with scripting alone.

Here's one code that I haven't actually tested, but should probably work.

Code: Select all

/system scheduler add name=DShield_top interval=1d on-event={
    :local addressListName "DShield_TOP";
    :local addressListTimeout 1d;

    /tool fetch keep-result=yes url="http://feeds.dshield.org/topips.txt";
#To ensure the file is readable
    :delay 2s;

    :local contents [/file get "topips.txt" contents];
    :while ($contents != "") do={
        :local ip [:pick $contents 0 [:find $contents " "]];
        /ip firewall address-list add address=$ip list=$addressListName timeout=$addressListTimeout;

        :set contents [:pick $contents ([:find $contents "\n"]+1)];
    };
};