net/adblock/files/adblock-helper.sh

   1 #!/bin/sh
   2 # function library used by adblock-update.sh
   3 # written by Dirk Brenken (openwrt@brenken.org)
   4
   5 # f_envload: load adblock environment
   6 #
   7 f_envload()
   8 {
   9     # source in openwrt function library
  10     #
  11     if [ -r "/lib/functions.sh" ]
  12     then
  13         . "/lib/functions.sh"
  14     else
  15         rc=110
  16         f_log "openwrt function library not found" "${rc}"
  17         f_exit
  18     fi
  19
  20     # source in openwrt network library
  21     #
  22     if [ -r "/lib/functions/network.sh" ]
  23     then
  24         . "/lib/functions/network.sh"
  25     else
  26         rc=115
  27         f_log "openwrt network library not found" "${rc}"
  28         f_exit
  29     fi
  30
  31     # set initial defaults,
  32     # may be overwritten by setting appropriate adblock config options in global section of /etc/config/adblock
  33     #
  34     adb_lanif="lan"
  35     adb_nullport="65535"
  36     adb_nullipv4="192.0.2.1"
  37     adb_nullipv6="::ffff:c000:0201"
  38     adb_whitelist="/etc/adblock/adblock.whitelist"
  39     adb_whitelist_rset="\$1 ~/^([A-Za-z0-9_-]+\.){1,}[A-Za-z]+/{print tolower(\$1)}"
  40     adb_forcedns=1
  41
  42     # function to parse global section by callback
  43     #
  44     config_cb()
  45     {
  46         local type="${1}"
  47         if [ "${type}" = "adblock" ]
  48         then
  49             option_cb()
  50             {
  51                 local option="${1}"
  52                 local value="${2}"
  53                 eval "${option}=\"${value}\""
  54             }
  55         else
  56             reset_cb
  57         fi
  58     }
  59
  60     # function to parse 'service' and 'source' sections
  61     #
  62     parse_config()
  63     {
  64         local value opt section="${1}" options="adb_dir adb_src adb_src_rset adb_src_cat"
  65         config_get switch "${section}" "enabled"
  66         if [ "${switch}" = "1" ]
  67         then
  68             if [ "${section}" != "backup" ]
  69             then
  70                 eval "adb_sources=\"${adb_sources} ${section}\""
  71             fi
  72             for opt in ${options}
  73             do
  74                 config_get value "${section}" "${opt}"
  75                 if [ -n "${value}" ]
  76                 then
  77                     eval "${opt}_${section}=\"${value}\""
  78                 fi
  79             done
  80         fi
  81     }
  82
  83     # check opkg availability
  84     #
  85     if [ -r "/var/lock/opkg.lock" ]
  86     then
  87         rc=-1
  88         f_log "adblock installation finished successfully, 'opkg' currently locked by package installer"
  89         f_exit
  90     fi
  91
  92     # get list with all installed openwrt packages
  93     #
  94     pkg_list="$(opkg list-installed)"
  95     if [ -z "${pkg_list}" ]
  96     then
  97         rc=120
  98         f_log "empty openwrt package list" "${rc}"
  99         f_exit
 100     fi
 101
 102     # load adblock config and start parsing functions
 103     #
 104     config_load adblock
 105     config_foreach parse_config service
 106     config_foreach parse_config source
 107
 108     # check 'enabled' & 'version' config options
 109     #
 110     if [ -z "${adb_enabled}" ] || [ -z "${adb_cfgversion}" ] || [ "${adb_cfgversion}" != "${adb_scriptver%.*}" ]
 111     then
 112         rc=125
 113         f_log "outdated adblock configuration found, please use latest version from '/etc/adblock/adblock.conf.default'" "${rc}"
 114         f_exit
 115     fi
 116     if [ $((adb_enabled)) -ne 1 ]
 117     then
 118         rc=-1
 119         f_log "adblock is currently disabled, please set adblock.global.adb_enabled=1' to use this service"
 120         f_exit
 121     fi
 122
 123     # set more script defaults (can't be overwritten by adblock config options)
 124     #
 125     adb_minspace=12000
 126     adb_tmpfile="$(mktemp -tu)"
 127     adb_tmpdir="$(mktemp -p /tmp -d)"
 128     adb_dnsdir="/tmp/dnsmasq.d"
 129     adb_dnsprefix="adb_list"
 130     adb_fetch="/usr/bin/wget"
 131     adb_uci="/sbin/uci"
 132     unset adb_srclist adb_revsrclist adb_errsrclist
 133
 134     # get lan ip addresses
 135     #
 136     network_get_ipaddr adb_ipv4 "${adb_lanif}"
 137     network_get_ipaddr6 adb_ipv6 "${adb_lanif}"
 138     if [ -z "${adb_ipv4}" ] && [ -z "${adb_ipv6}" ]
 139     then
 140         rc=135
 141         f_log "no valid IPv4/IPv6 configuration found (${adb_lanif}), please set 'adb_lanif' manually" "${rc}"
 142         f_exit
 143     fi
 144 }
 145
 146 # f_envcheck: check/set environment prerequisites
 147 #
 148 f_envcheck()
 149 {
 150     local check
 151
 152     # check logical update interfaces (with default route)
 153     #
 154     network_find_wan adb_wanif4
 155     network_find_wan6 adb_wanif6
 156     if [ -z "${adb_wanif4}" ] && [ -z "${adb_wanif6}" ]
 157     then
 158         adb_wanif4="true"
 159         f_log "no valid IPv4/IPv6 interface with default route found, IPv4 mode will be assumed"
 160     fi
 161
 162     # check general package dependencies
 163     #
 164     f_depend "uhttpd"
 165     f_depend "wget"
 166     f_depend "iptables"
 167     f_depend "kmod-ipt-nat"
 168
 169     # check ipv6 related package dependencies
 170     #
 171     if [ -n "${adb_wanif6}" ]
 172     then
 173         check="$(printf "${pkg_list}" | grep "^ip6tables -")"
 174         if [ -z "${check}" ]
 175         then
 176             f_log "package 'ip6tables' not found, IPv6 support will be disabled"
 177             unset adb_wanif6
 178         else
 179             check="$(printf "${pkg_list}" | grep "^kmod-ipt-nat6 -")"
 180             if [ -z "${check}" ]
 181             then
 182                 f_log "package 'kmod-ipt-nat6' not found, IPv6 support will be disabled"
 183                 unset adb_wanif6
 184             fi
 185         fi
 186     fi
 187
 188     # check ca-certificates package and set fetch parms accordingly
 189     #
 190     fetch_parm="--no-config --quiet --tries=1 --no-cache --no-cookies --max-redirect=0 --dns-timeout=5 --connect-timeout=5 --read-timeout=5"
 191     check="$(printf "${pkg_list}" | grep "^ca-certificates -")"
 192     if [ -z "${check}" ]
 193     then
 194         fetch_parm="${fetch_parm} --no-check-certificate"
 195     fi
 196
 197     # check adblock temp directory
 198     #
 199     if [ -n "${adb_tmpdir}" ] && [ -d "${adb_tmpdir}" ]
 200     then
 201         f_space "${adb_tmpdir}"
 202         if [ "${space_ok}" = "false" ]
 203         then
 204             if [ $((av_space)) -le 2000 ]
 205             then
 206                 rc=140
 207                 f_log "not enough free space in '${adb_tmpdir}' (avail. ${av_space} kb)" "${rc}"
 208                 f_exit
 209             else
 210                 f_log "not enough free space to handle all adblock list sources at once in '${adb_tmpdir}' (avail. ${av_space} kb)"
 211             fi
 212         fi
 213     else
 214         rc=145
 215         f_log "temp directory not found" "${rc}"
 216         f_exit
 217     fi
 218
 219     # check memory
 220     #
 221     mem_total="$(awk '$1 ~ /^MemTotal/ {printf $2}' "/proc/meminfo")"
 222     mem_free="$(awk '$1 ~ /^MemFree/ {printf $2}' "/proc/meminfo")"
 223     mem_swap="$(awk '$1 ~ /^SwapTotal/ {printf $2}' "/proc/meminfo")"
 224     if [ $((mem_total)) -le 64000 ] && [ $((mem_swap)) -eq 0 ]
 225     then
 226         mem_ok="false"
 227         f_log "not enough free memory, overall sort processing will be disabled (total: ${mem_total}, free: ${mem_free}, swap: ${mem_swap})"
 228     else
 229         mem_ok="true"
 230     fi
 231
 232     # check backup configuration
 233     #
 234     if [ -n "${adb_dir_backup}" ] && [ -d "${adb_dir_backup}" ]
 235     then
 236         f_space "${adb_dir_backup}"
 237         if [ "${space_ok}" = "false" ]
 238         then
 239             f_log "not enough free space in '${adb_dir_backup}'(avail. ${av_space} kb), backup/restore will be disabled"
 240             backup_ok="false"
 241         else
 242             f_log "backup/restore will be enabled"
 243             backup_ok="true"
 244         fi
 245     else
 246         backup_ok="false"
 247         f_log "backup/restore will be disabled"
 248     fi
 249
 250     # check running dnsmasq instance & set defaults
 251     #
 252     rc="$(ps | grep -q "[d]nsmasq"; printf ${?})"
 253     if [ $((rc)) -eq 0 ]
 254     then
 255         if [ -n "${adb_wanif4}" ] && [ -n "${adb_wanif6}" ]
 256         then
 257             adb_dnsformat="awk -v ipv4="${adb_nullipv4}" -v ipv6="${adb_nullipv6}" '{print \"address=/\"\$0\"/\"ipv4\"\n\"\"address=/\"\$0\"/\"ipv6}'"
 258         elif [ -n "${adb_wanif4}" ]
 259         then
 260             adb_dnsformat="awk -v ipv4="${adb_nullipv4}" '{print \"address=/\"\$0\"/\"ipv4}'"
 261         else
 262             adb_dnsformat="awk -v ipv6="${adb_nullipv6}" '{print \"address=/\"\$0\"/\"ipv6}'"
 263         fi
 264     else
 265         rc=150
 266         f_log "please enable the local dns server to use adblock" "${rc}"
 267         f_exit
 268     fi
 269
 270     # check running firewall
 271     #
 272     check="$(/usr/sbin/iptables -vnL | grep -F "DROP")"
 273     if [ -z "${check}" ]
 274     then
 275         rc=155
 276         f_log "please enable the local firewall to use adblock" "${rc}"
 277         f_exit
 278     fi
 279
 280     # check ipv4/iptables configuration
 281     #
 282     if [ -n "${adb_wanif4}" ]
 283     then
 284         f_firewall "IPv4" "nat" "A" "prerouting_rule" "adb-nat" "-p tcp -d ${adb_nullipv4} -m multiport --dports 80,443 -j DNAT --to-destination ${adb_ipv4}:${adb_nullport}"
 285         f_firewall "IPv4" "filter" "A" "forwarding_rule" "adb-fwd" "-p tcp -d ${adb_nullipv4} -j REJECT --reject-with tcp-reset"
 286         f_firewall "IPv4" "filter" "A" "forwarding_rule" "adb-fwd" "-d ${adb_nullipv4} -j REJECT --reject-with icmp-host-unreachable"
 287         f_firewall "IPv4" "filter" "A" "output_rule" "adb-out" "-p tcp -d ${adb_nullipv4} -j REJECT --reject-with tcp-reset"
 288         f_firewall "IPv4" "filter" "A" "output_rule" "adb-out" "-d ${adb_nullipv4} -j REJECT --reject-with icmp-host-unreachable"
 289         if [ $((adb_forcedns)) -eq 1 ]
 290         then
 291             f_firewall "IPv4" "nat" "A" "prerouting_rule" "adb-dns" "-p udp --dport 53 -j DNAT --to-destination ${adb_ipv4}:53"
 292             f_firewall "IPv4" "nat" "A" "prerouting_rule" "adb-dns" "-p tcp --dport 53 -j DNAT --to-destination ${adb_ipv4}:53"
 293         fi
 294         if [ "${fw_done}" = "true" ]
 295         then
 296             f_log "created volatile IPv4 firewall ruleset"
 297             fw_done="false"
 298         fi
 299     fi
 300
 301     # check ipv6/ip6tables configuration
 302     #
 303     if [ -n "${adb_wanif6}" ]
 304     then
 305         f_firewall "IPv6" "nat" "A" "PREROUTING" "adb-nat" "-p tcp -d ${adb_nullipv6} -m multiport --dports 80,443 -j DNAT --to-destination [${adb_ipv6}]:${adb_nullport}"
 306         f_firewall "IPv6" "filter" "A" "forwarding_rule" "adb-fwd" "-p tcp -d ${adb_nullipv6} -j REJECT --reject-with tcp-reset"
 307         f_firewall "IPv6" "filter" "A" "forwarding_rule" "adb-fwd" "-d ${adb_nullipv6} -j REJECT --reject-with icmp6-addr-unreachable"
 308         f_firewall "IPv6" "filter" "A" "output_rule" "adb-out" "-p tcp -d ${adb_nullipv6} -j REJECT --reject-with tcp-reset"
 309         f_firewall "IPv6" "filter" "A" "output_rule" "adb-out" "-d ${adb_nullipv6} -j REJECT --reject-with icmp6-addr-unreachable"
 310         if [ $((adb_forcedns)) -eq 1 ]
 311         then
 312             f_firewall "IPv6" "nat" "A" "PREROUTING" "adb-dns" "-p udp --dport 53 -j DNAT --to-destination [${adb_ipv6}]:53"
 313             f_firewall "IPv6" "nat" "A" "PREROUTING" "adb-dns" "-p tcp --dport 53 -j DNAT --to-destination [${adb_ipv6}]:53"
 314         fi
 315         if [ "${fw_done}" = "true" ]
 316         then
 317             f_log "created volatile IPv6 firewall ruleset"
 318             fw_done="false"
 319         fi
 320     fi
 321
 322     # check volatile adblock uhttpd instance configuration
 323     #
 324     rc="$(ps | grep -q "[u]httpd.*\-h /www/adblock"; printf ${?})"
 325     if [ $((rc)) -ne 0 ]
 326     then
 327         if [ -n "${adb_wanif4}" ] && [ -n "${adb_wanif6}" ]
 328         then
 329             uhttpd -h "/www/adblock" -k 0 -N 100 -t 0 -T 1 -D -S -E "/index.html" -p "${adb_ipv4}:${adb_nullport}" -p "[${adb_ipv6}]:${adb_nullport}"
 330             rc=${?}
 331         elif [ -n "${adb_wanif4}" ]
 332         then
 333             uhttpd -h "/www/adblock" -k 0 -N 100 -t 0 -T 1 -D -S -E "/index.html" -p "${adb_ipv4}:${adb_nullport}"
 334             rc=${?}
 335         else
 336             uhttpd -h "/www/adblock" -k 0 -N 100 -t 0 -T 1 -D -S -E "/index.html" -p "[${adb_ipv6}]:${adb_nullport}"
 337             rc=${?}
 338         fi
 339         if [ $((rc)) -eq 0 ]
 340         then
 341             f_log "created volatile uhttpd instance"
 342         else
 343             f_log "failed to initialize volatile uhttpd instance" "${rc}"
 344             f_restore
 345         fi
 346     fi
 347
 348     # check whitelist entries
 349     #
 350     if [ -s "${adb_whitelist}" ]
 351     then
 352         awk "${adb_whitelist_rset}" "${adb_whitelist}" > "${adb_tmpdir}/tmp.whitelist"
 353     fi
 354
 355     # remove no longer used opkg package list
 356     #
 357     unset pkg_list
 358 }
 359
 360 # f_depend: check package dependencies
 361 #
 362 f_depend()
 363 {
 364     local check
 365     local package="${1}"
 366
 367     check="$(printf "${pkg_list}" | grep "^${package} -")"
 368     if [ -z "${check}" ]
 369     then
 370         rc=160
 371         f_log "package '${package}' not found" "${rc}"
 372         f_exit
 373     fi
 374 }
 375
 376 # f_firewall: set iptables rules for ipv4/ipv6
 377 #
 378 f_firewall()
 379 {
 380     local ipt
 381     local iptv4="/usr/sbin/iptables"
 382     local iptv6="/usr/sbin/ip6tables"
 383     local proto="${1}"
 384     local table="${2}"
 385     local ctype="${3}"
 386     local chain="${4}"
 387     local notes="${5}"
 388     local rules="${6}"
 389
 390     # select appropriate iptables executable
 391     #
 392     if [ "${proto}" = "IPv4" ]
 393     then
 394         ipt="${iptv4}"
 395     else
 396         ipt="${iptv6}"
 397     fi
 398
 399     # check whether iptables rule already applied and proceed accordingly
 400     #
 401     rc="$("${ipt}" -w -t "${table}" -C "${chain}" -m comment --comment "${notes}" ${rules}; printf ${?})"
 402     if [ $((rc)) -ne 0 ]
 403     then
 404         "${ipt}" -w -t "${table}" -"${ctype}" "${chain}" -m comment --comment "${notes}" ${rules}
 405         rc=${?}
 406         if [ $((rc)) -eq 0 ]
 407         then
 408             fw_done="true"
 409         else
 410             f_log "failed to initialize volatile ${proto} firewall rule '${notes}'" "${rc}"
 411             f_exit
 412         fi
 413     fi
 414 }
 415
 416 # f_log: log messages to stdout and syslog
 417 #
 418 f_log()
 419 {
 420     local log_parm
 421     local log_msg="${1}"
 422     local log_rc="${2}"
 423     local class="info "
 424
 425     # check for terminal session
 426     #
 427     if [ -t 1 ]
 428     then
 429         log_parm="-s"
 430     fi
 431
 432     # log to different output devices and set log class accordingly
 433     #
 434     if [ -n "${log_msg}" ]
 435     then
 436         if [ $((log_rc)) -gt 0 ]
 437         then
 438             class="error"
 439             log_rc=", rc: ${log_rc}"
 440             log_msg="${log_msg}${log_rc}"
 441         fi
 442         /usr/bin/logger ${log_parm} -t "adblock[${adb_pid}] ${class}" "${log_msg}" 2>&1
 443     fi
 444 }
 445
 446 ################################################
 447 # f_space: check mount points/space requirements
 448 #
 449 f_space()
 450 {
 451     local mp="${1}"
 452
 453     if [ -d "${mp}" ]
 454     then
 455         av_space="$(df "${mp}" | tail -n1 | awk '{printf $4}')"
 456         if [ $((av_space)) -lt $((adb_minspace)) ]
 457         then
 458             space_ok="false"
 459         fi
 460     fi
 461 }
 462
 463 # f_cntconfig: calculate counters in config
 464 #
 465 f_cntconfig()
 466 {
 467     local list
 468     local src_name
 469     local count=0
 470     local count_sum=0
 471
 472     for list in $(ls -ASr "${adb_dnsdir}/${adb_dnsprefix}."*)
 473     do
 474         src_name="${list/*./}"
 475         count="$(wc -l < "${list}")"
 476         if [ -n "${adb_wanif4}" ] && [ -n "${adb_wanif6}" ]
 477         then
 478             count=$((count / 2))
 479         fi
 480         ${adb_uci} -q set "adblock.${src_name}.adb_src_count=${count}"
 481         count_sum=$((count_sum + count))
 482     done
 483     ${adb_uci} -q set "adblock.global.adb_overall_count=${count_sum}"
 484 }
 485
 486 # f_rmconfig: remove counters & timestamps in given config sections
 487 #
 488 f_rmconfig()
 489 {
 490     local rm_done="${1}"
 491
 492     for list in ${rm_done}
 493     do
 494         src_name="${list/*./}"
 495         if [ -n "${restore_done}" ]
 496         then
 497             ${adb_uci} -q set "adblock.${src_name}.adb_src_timestamp=list restored"
 498         else
 499             ${adb_uci} -q delete "adblock.${src_name}.adb_src_count"
 500             ${adb_uci} -q delete "adblock.${src_name}.adb_src_timestamp"
 501         fi
 502     done
 503     unset restore_done
 504 }
 505
 506 # f_restore: restore last adblock list backups and restart dnsmasq
 507 #
 508 f_restore()
 509 {
 510     local rm_done
 511     local restore_done
 512
 513     # remove bogus adblock lists
 514     #
 515     if [ -n "${adb_revsrclist}" ]
 516     then
 517         rm_done="$(find "${adb_dnsdir}" -maxdepth 1 -type f \( ${adb_revsrclist} \) -print -exec rm -f "{}" \;)"
 518         rc=${?}
 519         if [ $((rc)) -eq 0 ] && [ -n "${rm_done}" ]
 520         then
 521             f_rmconfig "${rm_done}"
 522             f_log "all bogus adblock lists removed"
 523         elif [ $((rc)) -ne 0 ]
 524         then
 525             f_log "error during removal of bogus adblock lists" "${rc}"
 526             f_exit
 527         fi
 528     fi
 529
 530     # restore backups
 531     #
 532     if [ "${backup_ok}" = "true" ]
 533     then
 534         restore_done="$(find "${adb_dir_backup}" -maxdepth 1 -type f -name "${adb_dnsprefix}.*" -print -exec cp -pf "{}" "${adb_dnsdir}" \;)"
 535         rc=${?}
 536         if [ $((rc)) -eq 0 ] && [ -n "${restore_done}" ]
 537         then
 538             f_log "all available backups restored"
 539         elif [ $((rc)) -ne 0 ] && [ -n "${restore_done}" ]
 540         then
 541             f_log "error during restore of adblock lists" "${rc}"
 542             f_exit
 543         fi
 544     else
 545         f_log "backup service disabled, nothing to restore"
 546     fi
 547
 548     # (re-)try dnsmasq restart without bogus adblock lists / with backups
 549     #
 550     if [ -n "${restore_done}" ] || [ -n "${rm_done}" ]
 551     then
 552         /etc/init.d/dnsmasq restart
 553         sleep 1
 554         rc="$(ps | grep -q "[d]nsmasq"; printf ${?})"
 555         if [ $((rc)) -eq 0 ]
 556         then
 557             rc=0
 558             f_cntconfig
 559             f_log "adblock lists with overall ${adb_count} domains loaded"
 560         else
 561             rc=165
 562             f_log "dnsmasq restart failed, please check 'logread' output" "${rc}"
 563         fi
 564     fi
 565     f_exit
 566 }
 567
 568 # f_exit: delete (temporary) files, generate statistics and exit
 569 #
 570 f_exit()
 571 {
 572     local ipv4_adblock=0
 573     local ipv6_adblock=0
 574     local iptv4="/usr/sbin/iptables"
 575     local iptv6="/usr/sbin/ip6tables"
 576
 577     # delete temporary files & directories
 578     #
 579     if [ -f "${adb_tmpfile}" ]
 580     then
 581        rm -f "${adb_tmpfile}"
 582     fi
 583     if [ -d "${adb_tmpdir}" ]
 584     then
 585        rm -rf "${adb_tmpdir}"
 586     fi
 587
 588     # final log message and iptables statistics
 589     #
 590     if [ $((rc)) -eq 0 ]
 591     then
 592         if [ -n "${adb_wanif4}" ]
 593         then
 594             ipv4_adblock="$(${iptv4} -t nat -vnL | awk '$11 ~ /^adb-nat$/ {sum += $1} END {printf sum}')"
 595             ipv4_adblock="$((${ipv4_adblock} + $(${iptv4} -vnL | awk '$11 ~ /^adb-(fwd|out)$/ {sum += $1} END {printf sum}')))"
 596         fi
 597         if [ -n "${adb_wanif6}" ]
 598         then
 599             ipv6_adblock="$(${iptv6} -t nat -vnL | awk '$10 ~ /^adb-nat$/ {sum += $1} END {printf sum}')"
 600             ipv6_adblock="$((${ipv6_adblock} + $(${iptv6} -vnL | awk '$10 ~ /^adb-(fwd|out)$/ {sum += $1} END {printf sum}')))"
 601         fi
 602         if [ -n "$(${adb_uci} -q changes adblock)" ]
 603         then
 604             ${adb_uci} -q commit "adblock"
 605         fi
 606         f_log "firewall statistics (IPv4/IPv6): ${ipv4_adblock}/${ipv6_adblock} ad related packets blocked"
 607         f_log "domain adblock processing finished successfully (${adb_scriptver}, ${openwrt_version}, $(/bin/date "+%d.%m.%Y %H:%M:%S"))"
 608     elif [ $((rc)) -gt 0 ]
 609     then
 610         if [ -n "$(${adb_uci} -q changes adblock)" ]
 611         then
 612             ${adb_uci} -q revert "adblock"
 613         fi
 614         f_log "domain adblock processing failed (${adb_scriptver}, ${openwrt_version}, $(/bin/date "+%d.%m.%Y %H:%M:%S"))"
 615     else
 616         rc=0
 617     fi
 618     rm -f "${adb_pidfile}"
 619     exit ${rc}
 620 }