net/adblock/files/adblock-helper.sh

   1 #!/bin/sh
   2 # function library used by adblock-update.sh
   3 # written by Dirk Brenken (dev@brenken.org)
   4
   5 # set initial defaults
   6 #
   7 LC_ALL=C
   8 PATH="/usr/sbin:/usr/bin:/sbin:/bin"
   9 adb_lanif="lan"
  10 adb_nullport="65534"
  11 adb_nullportssl="65535"
  12 adb_nullipv4="198.18.0.1"
  13 adb_nullipv6="::ffff:c612:0001"
  14 adb_whitelist="/etc/adblock/adblock.whitelist"
  15 adb_whitelist_rset="\$1 ~/^([A-Za-z0-9_-]+\.){1,}[A-Za-z]+/{print tolower(\"^\"\$1\"\\\|[.]\"\$1)}"
  16 adb_dnsdir="/tmp/dnsmasq.d"
  17 adb_dnshidedir="${adb_dnsdir}/.adb_hidden"
  18 adb_dnsprefix="adb_list"
  19 adb_count=0
  20 adb_minspace=12000
  21 adb_forcedns=1
  22 adb_fetchttl=5
  23 adb_restricted=0
  24 adb_uci="$(which uci)"
  25 unset adb_revsrclist
  26
  27 # f_envload: load adblock environment
  28 #
  29 f_envload()
  30 {
  31     # source in system function library
  32     #
  33     if [ -r "/lib/functions.sh" ]
  34     then
  35         . "/lib/functions.sh"
  36     else
  37         rc=-10
  38         f_log "system function library not found, please check your installation"
  39         f_exit
  40     fi
  41
  42     # source in system network library
  43     #
  44     if [ -r "/lib/functions/network.sh" ]
  45     then
  46         . "/lib/functions/network.sh"
  47     else
  48         rc=-10
  49         f_log "system network library not found, please check your installation"
  50         f_exit
  51     fi
  52
  53     # check opkg availability
  54     #
  55     if [ -r "/var/lock/opkg.lock" ]
  56     then
  57         rc=-10
  58         f_log "adblock installation finished successfully, 'opkg' currently locked by package installer"
  59         f_exit
  60     fi
  61
  62     # uci function to parse global section by callback
  63     #
  64     config_cb()
  65     {
  66         local type="${1}"
  67         if [ "${type}" = "adblock" ]
  68         then
  69             option_cb()
  70             {
  71                 local option="${1}"
  72                 local value="${2}"
  73                 eval "${option}=\"${value}\""
  74             }
  75         else
  76             reset_cb
  77         fi
  78     }
  79
  80     # uci function to parse 'service' and 'source' sections
  81     #
  82     parse_config()
  83     {
  84         local value opt section="${1}" options="enabled adb_dir adb_src adb_src_rset adb_src_cat"
  85         if [ "${section}" != "backup" ]
  86         then
  87             eval "adb_sources=\"${adb_sources} ${section}\""
  88         fi
  89         for opt in ${options}
  90         do
  91             config_get value "${section}" "${opt}"
  92             if [ -n "${value}" ]
  93             then
  94                 eval "${opt}_${section}=\"${value}\""
  95             fi
  96         done
  97     }
  98
  99     # load adblock config and start parsing functions
 100     #
 101     config_load adblock
 102     config_foreach parse_config service
 103     config_foreach parse_config source
 104
 105     # get network basics
 106     #
 107     network_get_ipaddr adb_ipv4 "${adb_lanif}"
 108     network_get_ipaddr6 adb_ipv6 "${adb_lanif}"
 109     network_get_device adb_landev "${adb_lanif}"
 110     network_find_wan adb_wanif4
 111     network_find_wan6 adb_wanif6
 112
 113     # set restricted mode
 114     #
 115     if [ "${adb_restricted}" = "1" ]
 116     then
 117         adb_uci="$(which true)"
 118         restricted_ok="true"
 119     fi
 120 }
 121
 122 # f_envcheck: check/set environment prerequisites
 123 #
 124 f_envcheck()
 125 {
 126     local check
 127
 128     # check 'enabled' & 'version' config options
 129     #
 130     if [ -z "${adb_enabled}" ] || [ -z "${adb_cfgver}" ] || [ "${adb_cfgver%%.*}" != "${adb_mincfgver%%.*}" ]
 131     then
 132         rc=-1
 133         f_log "outdated adblock config (${adb_mincfgver} vs. ${adb_cfgver}), please run '/etc/init.d/adblock cfgup' to update your configuration"
 134         f_exit
 135     elif [ "${adb_cfgver#*.}" != "${adb_mincfgver#*.}" ]
 136     then
 137         outdated_ok="true"
 138     fi
 139     if [ "${adb_enabled}" != "1" ]
 140     then
 141         rc=-1
 142         f_log "adblock is currently disabled, please set adblock.global.adb_enabled=1' to use this service"
 143         f_exit
 144     fi
 145
 146     # get list with all installed packages
 147     #
 148     pkg_list="$(opkg list-installed)"
 149     if [ -z "${pkg_list}" ]
 150     then
 151         rc=-1
 152         f_log "empty 'opkg' package list, please check your installation"
 153         f_exit
 154     fi
 155     adb_sysver="$(printf "${pkg_list}" | grep "^base-files -")"
 156     adb_sysver="${adb_sysver##*-}"
 157
 158     # get lan ip addresses
 159     #
 160     if [ -z "${adb_ipv4}" ] && [ -z "${adb_ipv6}" ]
 161     then
 162         rc=-1
 163         f_log "no valid IPv4/IPv6 configuration found (${adb_lanif}), please set 'adb_lanif' manually"
 164         f_exit
 165     fi
 166
 167     # check logical update interfaces (with default route)
 168     #
 169     if [ -z "${adb_wanif4}" ] && [ -z "${adb_wanif6}" ]
 170     then
 171         adb_wanif4="${adb_lanif}"
 172     fi
 173
 174     # check AP mode
 175     #
 176     if [ "${adb_wanif4}" = "${adb_lanif}" ] || [ "${adb_wanif6}" = "${adb_lanif}" ]
 177     then
 178         adb_nullipv4="${adb_ipv4}"
 179         adb_nullipv6="${adb_ipv6}"
 180         if [ "$(${adb_uci} -q get uhttpd.main.listen_http | grep -Fo "80")" = "80" ] ||
 181            [ "$(${adb_uci} -q get uhttpd.main.listen_https | grep -Fo "443")" = "443" ]
 182         then
 183             rc=-1
 184             f_log "AP mode detected, please set local LuCI instance to ports <> 80/443"
 185             f_exit
 186         elif [ -z "$(pgrep -f "dnsmasq")" ]
 187         then
 188             rc=-1
 189             f_log "please enable the local dnsmasq instance to use adblock"
 190             f_exit
 191         elif [ ! -f "/var/run/fw3.state" ]
 192         then
 193             rc=-1
 194             f_log "please enable the local firewall to use adblock"
 195             f_exit
 196         else
 197             apmode_ok="true"
 198         fi
 199     else
 200         apmode_ok="false"
 201         check="$(${adb_uci} -q get bcp38.@bcp38[0].enabled)"
 202         if [ "${check}" = "1" ]
 203         then
 204             check="$(${adb_uci} -q get bcp38.@bcp38[0].match | grep -Fo "${adb_nullipv4%.*}")"
 205             if [ -n "${check}" ]
 206             then
 207                 rc=-1
 208                 f_log "please whitelist '${adb_nullipv4}' in your bcp38 configuration to use adblock"
 209                 f_exit
 210             fi
 211         fi
 212     fi
 213
 214     # check general package dependencies
 215     #
 216     f_depend "busybox"
 217     f_depend "uci"
 218     f_depend "uhttpd"
 219     f_depend "iptables"
 220     f_depend "kmod-ipt-nat"
 221
 222     # check ipv6 related package dependencies
 223     #
 224     if [ -n "${adb_wanif6}" ]
 225     then
 226         f_depend "ip6tables" "true"
 227         if [ "${package_ok}" = "false" ]
 228         then
 229             f_log "package 'ip6tables' not found, IPv6 support will be disabled"
 230             unset adb_wanif6
 231         else
 232             f_depend "kmod-ipt-nat6" "true"
 233             if [ "${package_ok}" = "false" ]
 234             then
 235                 f_log "package 'kmod-ipt-nat6' not found, IPv6 support will be disabled"
 236                 unset adb_wanif6
 237             fi
 238         fi
 239     fi
 240
 241     # check uclient-fetch/wget dependencies
 242     #
 243     f_depend "uclient-fetch" "true"
 244     if [ "${package_ok}" = "true" ]
 245     then
 246         f_depend "libustream-polarssl" "true"
 247         if [ "${package_ok}" = "false" ]
 248         then
 249             adb_fetch="$(which uclient-fetch)"
 250             fetch_parm="-q --timeout=${adb_fetchttl}"
 251             response_parm="--spider"
 252         fi
 253     fi
 254     if [ -z "${adb_fetch}" ]
 255     then
 256         f_depend "wget" "true"
 257         if [ "${package_ok}" = "true" ]
 258         then
 259             adb_fetch="$(which wget)"
 260             fetch_parm="--no-config --quiet --tries=1 --no-cache --no-cookies --max-redirect=0 --dns-timeout=${adb_fetchttl} --connect-timeout=${adb_fetchttl} --read-timeout=${adb_fetchttl}"
 261             response_parm="--spider --server-response"
 262         else
 263             rc=-1
 264             f_log "please install 'uclient-fetch' or 'wget' with ssl support to use adblock"
 265             f_exit
 266         fi
 267     fi
 268
 269     # check ca-certificate package and set fetch parm accordingly
 270     #
 271     f_depend "ca-certificates" "true"
 272     if [ "${package_ok}" = "false" ]
 273     then
 274         fetch_parm="${fetch_parm} --no-check-certificate"
 275     fi
 276
 277     # start normal processing/logging
 278     #
 279     f_log "domain adblock processing started (${adb_scriptver}, ${adb_sysver}, $(/bin/date "+%d.%m.%Y %H:%M:%S"))"
 280
 281     # log partially outdated config
 282     #
 283     if [ "${outdated_ok}" = "true" ]
 284     then
 285         f_log "partially outdated adblock config (${adb_mincfgver} vs. ${adb_cfgver}), please run '/etc/init.d/adblock cfgup' to update your configuration"
 286     fi
 287
 288     # log ap mode
 289     #
 290     if [ "${apmode_ok}" = "true" ]
 291     then
 292         f_log "AP mode enabled"
 293     fi
 294
 295     # log restricted mode
 296     #
 297     if [ "${restricted_ok}" = "true" ]
 298     then
 299         f_log "Restricted mode enabled"
 300     fi
 301
 302     # check dns hideout directory
 303     #
 304     if [ -d "${adb_dnshidedir}" ]
 305     then
 306         mv_done="$(find "${adb_dnshidedir}" -maxdepth 1 -type f -name "${adb_dnsprefix}*" -print -exec mv -f "{}" "${adb_dnsdir}" \;)"
 307     else
 308         mkdir -p -m 660 "${adb_dnshidedir}"
 309     fi
 310
 311     # check adblock temp directory
 312     #
 313     adb_tmpfile="$(mktemp -tu)"
 314     adb_tmpdir="$(mktemp -p /tmp -d)"
 315     if [ -n "${adb_tmpdir}" ] && [ -d "${adb_tmpdir}" ]
 316     then
 317         f_space "${adb_tmpdir}"
 318         if [ "${space_ok}" = "false" ]
 319         then
 320             if [ $((av_space)) -le 2000 ]
 321             then
 322                 rc=105
 323                 f_log "not enough free space in '${adb_tmpdir}' (avail. ${av_space} kb)"
 324                 f_exit
 325             else
 326                 f_log "not enough free space to handle all block list sources at once in '${adb_tmpdir}' (avail. ${av_space} kb)"
 327             fi
 328         fi
 329     else
 330         rc=110
 331         f_log "temp directory not found"
 332         f_exit
 333     fi
 334
 335     # check memory
 336     #
 337     mem_total="$(awk '$1 ~ /^MemTotal/ {printf $2}' "/proc/meminfo")"
 338     mem_free="$(awk '$1 ~ /^MemFree/ {printf $2}' "/proc/meminfo")"
 339     mem_swap="$(awk '$1 ~ /^SwapTotal/ {printf $2}' "/proc/meminfo")"
 340     if [ $((mem_total)) -le 64000 ] && [ $((mem_swap)) -eq 0 ]
 341     then
 342         mem_ok="false"
 343         f_log "not enough free memory, overall sort processing will be disabled (total: ${mem_total}, free: ${mem_free}, swap: ${mem_swap})"
 344     else
 345         mem_ok="true"
 346     fi
 347
 348     # check backup configuration
 349     #
 350     if [ "${enabled_backup}" = "1" ] && [ -d "${adb_dir_backup}" ]
 351     then
 352         f_space "${adb_dir_backup}"
 353         if [ "${space_ok}" = "false" ]
 354         then
 355             f_log "not enough free space in '${adb_dir_backup}'(avail. ${av_space} kb), backup/restore will be disabled"
 356             backup_ok="false"
 357         else
 358             f_log "backup/restore will be enabled"
 359             backup_ok="true"
 360         fi
 361     else
 362         backup_ok="false"
 363         f_log "backup/restore will be disabled"
 364     fi
 365
 366     # set dnsmasq defaults
 367     #
 368     if [ -n "${adb_wanif4}" ] && [ -n "${adb_wanif6}" ]
 369     then
 370         adb_dnsformat="awk -v ipv4="${adb_nullipv4}" -v ipv6="${adb_nullipv6}" '{print \"address=/\"\$0\"/\"ipv4\"\n\"\"address=/\"\$0\"/\"ipv6}'"
 371     elif [ -n "${adb_wanif4}" ]
 372     then
 373         adb_dnsformat="awk -v ipv4="${adb_nullipv4}" '{print \"address=/\"\$0\"/\"ipv4}'"
 374     else
 375         adb_dnsformat="awk -v ipv6="${adb_nullipv6}" '{print \"address=/\"\$0\"/\"ipv6}'"
 376     fi
 377
 378     # check volatile iptables configuration
 379     #
 380     if [ -n "${adb_wanif4}" ]
 381     then
 382         if [ "${apmode_ok}" = "false" ]
 383         then
 384             if [ "${adb_forcedns}" = "1" ] && [ -n "${adb_landev}" ]
 385             then
 386                 f_firewall "IPv4" "nat" "prerouting_rule" "adb-dns" "1" "dns" "-p udp --dport 53 -j DNAT --to-destination ${adb_ipv4}:53"
 387                 f_firewall "IPv4" "nat" "prerouting_rule" "adb-dns" "2" "dns" "-p tcp --dport 53 -j DNAT --to-destination ${adb_ipv4}:53"
 388             fi
 389             f_firewall "IPv4" "filter" "forwarding_rule" "adb-fwd" "1" "fwd" "-p tcp -j REJECT --reject-with tcp-reset"
 390             f_firewall "IPv4" "filter" "forwarding_rule" "adb-fwd" "2" "fwd" "-j REJECT --reject-with icmp-host-unreachable"
 391             f_firewall "IPv4" "filter" "output_rule" "adb-out" "1" "out" "-p tcp -j REJECT --reject-with tcp-reset"
 392             f_firewall "IPv4" "filter" "output_rule" "adb-out" "2" "out" "-j REJECT --reject-with icmp-host-unreachable"
 393         fi
 394         f_firewall "IPv4" "nat" "prerouting_rule" "adb-nat" "1" "nat" "-p tcp --dport 80 -j DNAT --to-destination ${adb_ipv4}:${adb_nullport}"
 395         f_firewall "IPv4" "nat" "prerouting_rule" "adb-nat" "2" "nat" "-p tcp --dport 443 -j DNAT --to-destination ${adb_ipv4}:${adb_nullportssl}"
 396     fi
 397     if [ -n "${adb_wanif6}" ]
 398     then
 399         if [ "${apmode_ok}" = "false" ]
 400         then
 401             if [ "${adb_forcedns}" = "1" ] && [ -n "${adb_landev}" ]
 402             then
 403                 f_firewall "IPv6" "nat" "PREROUTING" "adb-dns" "1" "dns" "-p udp --dport 53 -j DNAT --to-destination [${adb_ipv6}]:53"
 404                 f_firewall "IPv6" "nat" "PREROUTING" "adb-dns" "2" "dns" "-p tcp --dport 53 -j DNAT --to-destination [${adb_ipv6}]:53"
 405             fi
 406             f_firewall "IPv6" "filter" "forwarding_rule" "adb-fwd" "1" "fwd" "-p tcp -j REJECT --reject-with tcp-reset"
 407             f_firewall "IPv6" "filter" "forwarding_rule" "adb-fwd" "2" "fwd" "-j REJECT --reject-with icmp6-addr-unreachable"
 408             f_firewall "IPv6" "filter" "output_rule" "adb-out" "1" "out" "-p tcp -j REJECT --reject-with tcp-reset"
 409             f_firewall "IPv6" "filter" "output_rule" "adb-out" "2" "out" "-j REJECT --reject-with icmp6-addr-unreachable"
 410         fi
 411         f_firewall "IPv6" "nat" "PREROUTING" "adb-nat" "1" "nat" "-p tcp --dport 80 -j DNAT --to-destination [${adb_ipv6}]:${adb_nullport}"
 412         f_firewall "IPv6" "nat" "PREROUTING" "adb-nat" "2" "nat" "-p tcp --dport 443 -j DNAT --to-destination [${adb_ipv6}]:${adb_nullportssl}"
 413     fi
 414     if [ "${firewall_ok}" = "true" ]
 415     then
 416         f_log "created volatile firewall rulesets"
 417     fi
 418
 419     # check volatile uhttpd instance configuration
 420     #
 421     check="$(pgrep -f "uhttpd -h /www/adblock")"
 422     if [ -z "${check}" ]
 423     then
 424         if [ -n "${adb_wanif4}" ] && [ -n "${adb_wanif6}" ]
 425         then
 426             f_uhttpd "adbIPv4+6_80" "1" "-p ${adb_ipv4}:${adb_nullport} -p [${adb_ipv6}]:${adb_nullport}"
 427             f_uhttpd "adbIPv4+6_443" "0" "-p ${adb_ipv4}:${adb_nullportssl} -p [${adb_ipv6}]:${adb_nullportssl}"
 428         elif [ -n "${adb_wanif4}" ]
 429         then
 430             f_uhttpd "adbIPv4_80" "1" "-p ${adb_ipv4}:${adb_nullport}"
 431             f_uhttpd "adbIPv4_443" "0" "-p ${adb_ipv4}:${adb_nullportssl}"
 432         else
 433             f_uhttpd "adbIPv6_80" "1" "-p [${adb_ipv6}]:${adb_nullport}"
 434             f_uhttpd "adbIPv6_443" "0" "-p [${adb_ipv6}]:${adb_nullportssl}"
 435         fi
 436         if [ "${uhttpd_ok}" = "true" ]
 437         then
 438             f_log "created volatile uhttpd instances"
 439         fi
 440     fi
 441
 442     # check whitelist entries
 443     #
 444     if [ -s "${adb_whitelist}" ]
 445     then
 446         awk "${adb_whitelist_rset}" "${adb_whitelist}" > "${adb_tmpdir}/tmp.whitelist"
 447     fi
 448
 449     # remove temporary package list
 450     #
 451     unset pkg_list
 452 }
 453
 454 # f_depend: check package dependencies
 455 #
 456 f_depend()
 457 {
 458     local check
 459     local package="${1}"
 460     local check_only="${2}"
 461     package_ok="true"
 462
 463     check="$(printf "${pkg_list}" | grep "^${package} -")"
 464     if [ "${check_only}" = "true" ] && [ -z "${check}" ]
 465     then
 466         package_ok="false"
 467     elif [ -z "${check}" ]
 468     then
 469         rc=-1
 470         package_ok="false"
 471         f_log "package '${package}' not found"
 472         f_exit
 473     fi
 474 }
 475
 476 # f_firewall: set iptables rules for ipv4/ipv6
 477 #
 478 f_firewall()
 479 {
 480     local ipt="iptables"
 481     local nullip="${adb_nullipv4}"
 482     local proto="${1}"
 483     local table="${2}"
 484     local chsrc="${3}"
 485     local chain="${4}"
 486     local chpos="${5}"
 487     local notes="adb-${6}"
 488     local rules="${7}"
 489     firewall_ok="true"
 490
 491     # select appropriate iptables executable for IPv6
 492     #
 493     if [ "${proto}" = "IPv6" ]
 494     then
 495         ipt="ip6tables"
 496         nullip="${adb_nullipv6}"
 497     fi
 498
 499     # check whether iptables chain already exist
 500     #
 501     rc="$("${ipt}" -w -t "${table}" -nL "${chain}" >/dev/null 2>&1; printf ${?})"
 502     if [ $((rc)) -ne 0 ]
 503     then
 504         "${ipt}" -w -t "${table}" -N "${chain}"
 505         "${ipt}" -w -t "${table}" -A "${chain}" -m comment --comment "${notes}" -j RETURN
 506         if [ "${chain}" = "adb-dns" ]
 507         then
 508             "${ipt}" -w -t "${table}" -A "${chsrc}" -i "${adb_landev}+" -m comment --comment "${notes}" -j "${chain}"
 509         else
 510             "${ipt}" -w -t "${table}" -A "${chsrc}" -d "${nullip}" -m comment --comment "${notes}" -j "${chain}"
 511         fi
 512         rc=${?}
 513         if [ $((rc)) -ne 0 ]
 514         then
 515             f_log "failed to initialize volatile ${proto} firewall chain '${chain}'"
 516             f_exit
 517         fi
 518     fi
 519
 520     # check whether iptables rule already exist
 521     #
 522     rc="$("${ipt}" -w -t "${table}" -C "${chain}" -m comment --comment "${notes}" ${rules} >/dev/null 2>&1; printf ${?})"
 523     if [ $((rc)) -ne 0 ]
 524     then
 525         "${ipt}" -w -t "${table}" -I "${chain}" "${chpos}" -m comment --comment "${notes}" ${rules}
 526         rc=${?}
 527         if [ $((rc)) -ne 0 ]
 528         then
 529             firewall_ok="false"
 530             f_log "failed to initialize volatile ${proto} firewall rule '${notes}'"
 531             f_exit
 532         fi
 533     fi
 534 }
 535
 536 # f_uhttpd: start uhttpd instances
 537 #
 538 f_uhttpd()
 539 {
 540     local realm="${1}"
 541     local timeout="${2}"
 542     local ports="${3}"
 543     uhttpd_ok="true"
 544
 545     uhttpd -h "/www/adblock" -N 25 -T "${timeout}" -r "${realm}" -k 0 -t 0 -R -D -S -E "/index.html" ${ports}
 546     rc=${?}
 547     if [ $((rc)) -ne 0 ]
 548     then
 549         uhttpd_ok="false"
 550         f_log "failed to initialize volatile uhttpd instance (${realm})"
 551         f_exit
 552     fi
 553 }
 554
 555 # f_space: check mount points/space requirements
 556 #
 557 f_space()
 558 {
 559     local mp="${1}"
 560     space_ok="true"
 561
 562     if [ -d "${mp}" ]
 563     then
 564         av_space="$(df "${mp}" | tail -n1 | awk '{printf $4}')"
 565         if [ $((av_space)) -lt $((adb_minspace)) ]
 566         then
 567             space_ok="false"
 568         fi
 569     else
 570         space_ok="false"
 571     fi
 572 }
 573
 574 # f_cntconfig: calculate counters in config
 575 #
 576 f_cntconfig()
 577 {
 578     local src_name
 579     local count=0
 580
 581     for src_name in $(ls -ASr "${adb_dnsdir}/${adb_dnsprefix}"*)
 582     do
 583         count="$(wc -l < "${src_name}")"
 584         src_name="${src_name##*.}"
 585         if [ -n "${adb_wanif4}" ] && [ -n "${adb_wanif6}" ]
 586         then
 587             count=$((count / 2))
 588         fi
 589         "${adb_uci}" -q set "adblock.${src_name}.adb_src_count=${count}"
 590         adb_count=$((adb_count + count))
 591     done
 592     "${adb_uci}" -q set "adblock.global.adb_overall_count=${adb_count}"
 593 }
 594
 595 # f_rmconfig: remove volatile config entries
 596 #
 597 f_rmconfig()
 598 {
 599     local opt
 600     local options="adb_src_timestamp adb_src_count"
 601     local section="${1}"
 602
 603     rm_cfg="${adb_lastrun}"
 604     if [ -n "${rm_cfg}" ]
 605     then
 606         "${adb_uci}" -q delete "adblock.global.adb_overall_count"
 607         "${adb_uci}" -q delete "adblock.global.adb_dnstoggle"
 608         "${adb_uci}" -q delete "adblock.global.adb_percentage"
 609         "${adb_uci}" -q delete "adblock.global.adb_lastrun"
 610         for opt in ${options}
 611         do
 612             "${adb_uci}" -q delete "adblock.${section}.${opt}"
 613         done
 614     fi
 615 }
 616
 617 # f_rmdns: remove dns block lists and backups
 618 #
 619 f_rmdns()
 620 {
 621     rm_dns="$(find "${adb_dnsdir}" -maxdepth 1 -type f -name "${adb_dnsprefix}*" -print -exec rm -f "{}" \;)"
 622     if [ -n "${rm_dns}" ]
 623     then
 624         rm -rf "${adb_dnshidedir}"
 625         if [ "${enabled_backup}" = "1" ] && [ -d "${adb_dir_backup}" ]
 626         then
 627             rm -f "${adb_dir_backup}/${adb_dnsprefix}"*.gz
 628         fi
 629         /etc/init.d/dnsmasq restart
 630     fi
 631 }
 632
 633 # f_rmuhttpd: remove uhttpd instances
 634 #
 635 f_rmuhttpd()
 636 {
 637     rm_uhttpd="$(pgrep -f "uhttpd -h /www/adblock")"
 638     if [ -n "${rm_uhttpd}" ]
 639     then
 640         for pid in ${rm_uhttpd}
 641         do
 642             kill -9 "${pid}"
 643         done
 644     fi
 645 }
 646
 647 # f_rmfirewall: remove firewall rulsets
 648 #
 649 f_rmfirewall()
 650 {
 651     rm_fw="$(iptables -w -t nat -vnL | grep -Fo "adb-")"
 652     if [ -n "${rm_fw}" ]
 653     then
 654         iptables-save -t nat | grep -Fv -- "adb-" | iptables-restore
 655         iptables-save -t filter | grep -Fv -- "adb-" | iptables-restore
 656         if [ -n "$(lsmod | grep -Fo "ip6table_nat")" ]
 657         then
 658             ip6tables-save -t nat | grep -Fv -- "adb-" | ip6tables-restore
 659             ip6tables-save -t filter | grep -Fv -- "adb-" | ip6tables-restore
 660         fi
 661     fi
 662 }
 663
 664 # f_log: log messages to stdout and syslog
 665 #
 666 f_log()
 667 {
 668     local log_parm
 669     local log_msg="${1}"
 670     local class="info "
 671     local lastrun="$(date "+%d.%m.%Y %H:%M:%S")"
 672
 673     # check for terminal session
 674     #
 675     if [ -t 1 ]
 676     then
 677         log_parm="-s"
 678     fi
 679
 680     # log to different output devices and set log class accordingly
 681     #
 682     if [ -n "${log_msg}" ]
 683     then
 684         if [ $((rc)) -gt 0 ]
 685         then
 686             class="error"
 687         fi
 688         logger ${log_parm} -t "adblock[${adb_pid}] ${class}" "${log_msg}" 2>&1
 689
 690         # clean exit on error
 691         #
 692         if [ $((rc)) -eq -1 ] || [ $((rc)) -gt 0 ]
 693         then
 694             f_rmdns
 695             f_rmuhttpd
 696             f_rmfirewall
 697             config_foreach f_rmconfig source
 698             "${adb_uci}" -q set "adblock.global.adb_lastrun=${lastrun} => runtime error, please check the log!"
 699             "${adb_uci}" -q commit "adblock"
 700         fi
 701     fi
 702 }
 703
 704 # f_statistics: adblock runtime statistics
 705 f_statistics()
 706 {
 707     local ipv4_blk=0 ipv4_all=0 ipv4_pct=0
 708     local ipv6_blk=0 ipv6_all=0 ipv6_pct=0
 709
 710     if [ -n "${adb_wanif4}" ]
 711     then
 712         ipv4_blk="$(iptables -t nat -vnL adb-nat | awk '$3 ~ /^DNAT$/ {sum += $1} END {printf sum}')"
 713         ipv4_all="$(iptables -t nat -vnL PREROUTING | awk '$3 ~ /^prerouting_rule$/ {sum += $1} END {printf sum}')"
 714         if [ $((ipv4_all)) -gt 0 ] && [ $((ipv4_blk)) -gt 0 ] && [ $((ipv4_all)) -gt $((ipv4_blk)) ]
 715         then
 716             ipv4_pct="$(printf "${ipv4_blk}" | awk -v all="${ipv4_all}" '{printf( "%5.2f\n",$1/all*100)}')"
 717         fi
 718     fi
 719     if [ -n "${adb_wanif6}" ]
 720     then
 721         ipv6_blk="$(ip6tables -t nat -vnL adb-nat | awk '$3 ~ /^DNAT$/ {sum += $1} END {printf sum}')"
 722         ipv6_all="$(ip6tables -t nat -vnL PREROUTING | awk '$3 ~ /^(adb-nat|DNAT)$/ {sum += $1} END {printf sum}')"
 723         if [ $((ipv6_all)) -gt 0 ] && [ $((ipv6_blk)) -gt 0 ] && [ $((ipv6_all)) -gt $((ipv6_blk)) ]
 724         then
 725             ipv6_pct="$(printf "${ipv6_blk}" | awk -v all="${ipv6_all}" '{printf( "%5.2f\n",$1/all*100)}')"
 726         fi
 727     fi
 728     "${adb_uci}" -q set "adblock.global.adb_percentage=${ipv4_pct}%/${ipv6_pct}%"
 729     f_log "firewall statistics (IPv4/IPv6): ${ipv4_pct}%/${ipv6_pct}% of all packets in prerouting chain are ad related & blocked"
 730 }
 731
 732 # f_exit: delete temporary files, generate statistics and exit
 733 #
 734 f_exit()
 735 {
 736     local lastrun="$(date "+%d.%m.%Y %H:%M:%S")"
 737
 738     rm -f "${adb_tmpfile}"
 739     rm -rf "${adb_tmpdir}"
 740
 741     # final log message and iptables statistics
 742     #
 743     if [ $((rc)) -eq 0 ]
 744     then
 745         f_statistics
 746         "${adb_uci}" -q set "adblock.global.adb_lastrun=${lastrun}"
 747         "${adb_uci}" -q commit "adblock"
 748         f_log "domain adblock processing finished successfully (${adb_scriptver}, ${adb_sysver}, ${lastrun})"
 749     elif [ $((rc)) -gt 0 ]
 750     then
 751         f_log "domain adblock processing failed (${adb_scriptver}, ${adb_sysver}, ${lastrun})"
 752     else
 753         rc=0
 754     fi
 755     rm -f "${adb_pidfile}"
 756     exit ${rc}
 757 }