1 files changed, 62 insertions, 41 deletions
diff --git a/fw-addr-lists.rsc b/fw-addr-lists.rsc
index a195c89..f0940fe 100644
--- a/fw-addr-lists.rsc
+++ b/fw-addr-lists.rsc
@@ -1,12 +1,12 @@
 #!rsc by RouterOS
 # RouterOS script: fw-addr-lists
-# Copyright (c) 2023-2024 Christian Hesse <mail@eworm.de>
-# https://git.eworm.de/cgit/routeros-scripts/about/COPYING.md
+# Copyright (c) 2023-2025 Christian Hesse <mail@eworm.de>
+# https://rsc.eworm.de/COPYING.md
 #
 # requires RouterOS, version=7.16
 #
 # download, import and update firewall address-lists
-# https://git.eworm.de/cgit/routeros-scripts/about/doc/fw-addr-lists.md
+# https://rsc.eworm.de/doc/fw-addr-lists.md
 
 :global GlobalFunctionsReady;
 :while ($GlobalFunctionsReady != true) do={ :delay 500ms; }
@@ -24,6 +24,7 @@
   :global HumanReadableNum;
   :global LogPrint;
   :global LogPrintOnce;
+  :global LogPrintVerbose;
   :global ScriptLock;
   :global WaitFullyConnected;
 
@@ -36,6 +37,11 @@
     }
   }
 
+  :local GetBranch do={
+    :global EitherOr;
+    :return [ :pick [ :convert transform=md5 to=hex [ :pick $1 0 [ $EitherOr [ :find $1 "/" ] [ :len $1 ] ] ] ] 0 2 ];
+  }
+
   :if ([ $ScriptLock $ScriptName ] = false) do={
     :set ExitOK true;
     :error false;
@@ -99,17 +105,24 @@
           :set Address ([ :pick $Line 0 [ $FindDelim $Line ] ] . ($List->"cidr"));
         }
         :do {
+          :local Branch [ $GetBranch $Address ];
           :if ($Address ~ "^[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}(/[0-9]{1,2})?\$") do={
-            :set ($IPv4Addresses->$Address) $TimeOut;
+            :if ($Address ~ "/32\$") do={
+              :set Address [ :pick $Address 0 ([ :len $Address ] - 3) ];
+            }
+            :set ($IPv4Addresses->$Branch->$Address) $TimeOut;
             :error true;
           }
           :if ($Address ~ "^[0-9a-zA-Z]*:[0-9a-zA-Z:\\.]+(/[0-9]{1,3})?\$") do={
-            :set ($IPv6Addresses->$Address) $TimeOut;
+            :if ($Address ~ "/128\$") do={
+              :set Address [ :pick $Address 0 ([ :len $Address ] - 4) ];
+            }
+            :set ($IPv6Addresses->$Branch->$Address) $TimeOut;
             :error true;
           }
           :if ($Address ~ "^[\\.a-zA-Z0-9-]+\\.[a-zA-Z]{2,}\$") do={
-            :set ($IPv4Addresses->$Address) $TimeOut;
-            :set ($IPv6Addresses->$Address) $TimeOut;
+            :set ($IPv4Addresses->$Branch->$Address) $TimeOut;
+            :set ($IPv6Addresses->$Branch->$Address) $TimeOut;
             :error true;
           }
         } on-error={ }
@@ -119,15 +132,17 @@
     :foreach Entry in=[ /ip/firewall/address-list/find where \
         list=$FwListName comment=$ListComment ] do={
       :local Address [ /ip/firewall/address-list/get $Entry address ];
-      :if ([ :typeof ($IPv4Addresses->$Address) ] = "time") do={
-        $LogPrint debug $ScriptName ("Renewing IPv4 address in list '" . $FwListName . \
-            "' with " . ($IPv4Addresses->$Address) . ": " . $Address);
-        /ip/firewall/address-list/set $Entry timeout=($IPv4Addresses->$Address);
-        :set ($IPv4Addresses->$Address);
+      :local Branch [ $GetBranch $Address ];
+      :local TimeOut ($IPv4Addresses->$Branch->$Address);
+      :if ([ :typeof $TimeOut ] = "time") do={
+        $LogPrintVerbose debug $ScriptName ("Renewing IPv4 address in list '" . $FwListName . \
+            "' with " . $TimeOut . ": " . $Address);
+        /ip/firewall/address-list/set $Entry timeout=$TimeOut;
+        :set ($IPv4Addresses->$Branch->$Address);
         :set CntRenew ($CntRenew + 1);
       } else={
         :if ($Failure = false) do={
-          $LogPrint debug $ScriptName ("Removing IPv4 address from list '" . $FwListName . \
+          $LogPrintVerbose debug $ScriptName ("Removing IPv4 address from list '" . $FwListName . \
               "': " . $Address);
           /ip/firewall/address-list/remove $Entry;
           :set CntRemove ($CntRemove + 1);
@@ -138,15 +153,17 @@
     :foreach Entry in=[ /ipv6/firewall/address-list/find where \
         list=$FwListName comment=$ListComment ] do={
       :local Address [ /ipv6/firewall/address-list/get $Entry address ];
-      :if ([ :typeof ($IPv6Addresses->$Address) ] = "time") do={
-        $LogPrint debug $ScriptName ("Renewing IPv6 address in list '" . $FwListName . \
-            "' with " . ($IPv6Addresses->$Address) . ": " . $Address);
-        /ipv6/firewall/address-list/set $Entry timeout=($IPv6Addresses->$Address);
-        :set ($IPv6Addresses->$Address);
+      :local Branch [ $GetBranch $Address ];
+      :local TimeOut ($IPv6Addresses->$Branch->$Address);
+      :if ([ :typeof $TimeOut ] = "time") do={
+        $LogPrintVerbose debug $ScriptName ("Renewing IPv6 address in list '" . $FwListName . \
+            "' with " . $TimeOut . ": " . $Address);
+        /ipv6/firewall/address-list/set $Entry timeout=$TimeOut;
+        :set ($IPv6Addresses->$Branch->$Address);
         :set CntRenew ($CntRenew + 1);
       } else={
         :if ($Failure = false) do={
-          $LogPrint debug $ScriptName ("Removing IPv6 address from list '" . $FwListName . \
+          $LogPrintVerbose debug $ScriptName ("Removing IPv6 address from list '" . $FwListName . \
               "': " . $Address);
           /ipv6/firewall/address-list/remove $Entry;
           :set CntRemove ($CntRemove + 1);
@@ -154,31 +171,35 @@
       }
     }
 
-    :foreach Address,Timeout in=$IPv4Addresses do={
-      $LogPrint debug $ScriptName ("Adding IPv4 address to list '" . $FwListName . \
-          "' with " . $Timeout . ": " . $Address);
-      :do {
-        /ip/firewall/address-list/add list=$FwListName comment=$ListComment \
-            address=$Address timeout=$Timeout;
-        :set ($IPv4Addresses->$Address);
-        :set CntAdd ($CntAdd + 1);
-      } on-error={
-        $LogPrint warning $ScriptName ("Failed to add IPv4 address to list '" . $FwListName . \
-            "': " . $Address);
+    :foreach BranchName,Branch in=$IPv4Addresses do={
+      $LogPrintVerbose debug $ScriptName ("Handling branch: " . $BranchName);
+      :foreach Address,Timeout in=$Branch do={
+        $LogPrintVerbose debug $ScriptName ("Adding IPv4 address to list '" . $FwListName . \
+            "' with " . $Timeout . ": " . $Address);
+        :do {
+          /ip/firewall/address-list/add list=$FwListName comment=$ListComment \
+              address=$Address timeout=$Timeout;
+          :set CntAdd ($CntAdd + 1);
+        } on-error={
+          $LogPrint warning $ScriptName ("Failed to add IPv4 address to list '" . $FwListName . \
+              "': " . $Address);
+        }
       }
     }
 
-    :foreach Address,Timeout in=$IPv6Addresses do={
-      $LogPrint debug $ScriptName ("Adding IPv6 address to list '" . $FwListName . \
-          "' with " . $Timeout . ": " . $Address);
-      :do {
-        /ipv6/firewall/address-list/add list=$FwListName comment=$ListComment \
-            address=$Address timeout=$Timeout;
-        :set ($IPv6Addresses->$Address);
-        :set CntAdd ($CntAdd + 1);
-      } on-error={
-        $LogPrint warning $ScriptName ("Failed to add IPv6 address to list '" . $FwListName . \
-            "': " . $Address);
+    :foreach BranchName,Branch in=$IPv6Addresses do={
+      $LogPrintVerbose debug $ScriptName ("Handling branch: " . $BranchName);
+      :foreach Address,Timeout in=$Branch do={
+        $LogPrintVerbose debug $ScriptName ("Adding IPv6 address to list '" . $FwListName . \
+            "' with " . $Timeout . ": " . $Address);
+        :do {
+          /ipv6/firewall/address-list/add list=$FwListName comment=$ListComment \
+              address=$Address timeout=$Timeout;
+          :set CntAdd ($CntAdd + 1);
+        } on-error={
+          $LogPrint warning $ScriptName ("Failed to add IPv6 address to list '" . $FwListName . \
+              "': " . $Address);
+        }
       }
     }