2 # function library used by adblock-update.sh
3 # written by Dirk Brenken (dev@brenken.org)
8 PATH
="/usr/sbin:/usr/bin:/sbin:/bin"
12 adb_nullportssl
="65535"
13 adb_nullipv4
="198.18.0.1"
14 adb_nullipv6
="::ffff:c612:0001"
15 adb_whitelist
="/etc/adblock/adblock.whitelist"
16 adb_whitelist_rset
="\$1 ~/^([A-Za-z0-9_-]+\.){1,}[A-Za-z]+/{print tolower(\"^\"\$1\"\\\|[.]\"\$1)}"
17 adb_dnsdir
="/tmp/dnsmasq.d"
18 adb_dnshidedir
="${adb_dnsdir}/.adb_hidden"
19 adb_dnsprefix
="adb_list"
25 adb_uci
="$(which uci)"
27 # f_envload: load adblock environment
31 # source in system function library
33 if [ -r "/lib/functions.sh" ]
38 f_log
"system function library not found, please check your installation"
42 # source in system network library
44 if [ -r "/lib/functions/network.sh" ]
46 .
"/lib/functions/network.sh"
49 f_log
"system network library not found, please check your installation"
53 # check opkg availability
55 if [ -f "/var/lock/opkg.lock" ]
58 f_log
"adblock installation finished successfully, 'opkg' currently locked by package installer"
62 # uci function to parse global section by callback
67 if [ "${type}" = "adblock" ]
73 eval "${option}=\"${value}\""
80 # uci function to parse 'service' and 'source' sections
84 local value opt section
="${1}" options
="enabled adb_dir adb_src adb_src_rset adb_src_cat"
85 if [ "${section}" != "backup" ]
87 eval "adb_sources=\"${adb_sources} ${section}\""
91 config_get value
"${section}" "${opt}"
94 eval "${opt}_${section}=\"${value}\""
99 # load adblock config and start parsing functions
102 config_foreach parse_config service
103 config_foreach parse_config
source
107 network_get_ipaddr adb_ipv4
"${adb_lanif}"
108 network_get_ipaddr6 adb_ipv6
"${adb_lanif}"
109 network_get_device adb_landev
"${adb_lanif}"
110 network_find_wan adb_wanif4
111 network_find_wan6 adb_wanif6
114 # f_envcheck: check/set environment prerequisites
120 # check 'enabled' & 'version' config options
122 if [ -z "${adb_enabled}" ] || [ -z "${adb_cfgver}" ] || [ "${adb_cfgver%%.*}" != "${adb_mincfgver%%.*}" ]
125 f_log
"outdated adblock config (${adb_mincfgver} vs. ${adb_cfgver}), please run '/etc/init.d/adblock cfgup' to update your configuration"
127 elif [ "${adb_cfgver#*.}" != "${adb_mincfgver#*.}" ]
131 if [ "${adb_enabled}" != "1" ]
134 f_log
"adblock is currently disabled, please set adblock.global.adb_enabled=1' to use this service"
138 # get list with all installed packages
140 pkg_list
="$(opkg list-installed)"
141 if [ -z "${pkg_list}" ]
144 f_log
"empty 'opkg' package list, please check your installation"
147 adb_sysver
="$(printf "${pkg_list}" | grep "^base-files
-")"
148 adb_sysver
="${adb_sysver##*-}"
150 # get lan ip addresses
152 if [ -z "${adb_ipv4}" ] && [ -z "${adb_ipv6}" ]
155 f_log
"no valid IPv4/IPv6 configuration found (${adb_lanif}), please set 'adb_lanif' manually"
159 # check logical update interfaces (with default route)
161 if [ -z "${adb_wanif4}" ] && [ -z "${adb_wanif6}" ]
163 adb_wanif4
="${adb_lanif}"
168 if [ "${adb_wanif4}" = "${adb_lanif}" ] || [ "${adb_wanif6}" = "${adb_lanif}" ]
170 adb_nullipv4
="${adb_ipv4}"
171 adb_nullipv6
="${adb_ipv6}"
172 if [ -n "$(${adb_uci} -q get uhttpd.main.listen_http | grep -Fo "80")" ] ||
173 [ -n "$(${adb_uci} -q get uhttpd.main.listen_https | grep -Fo "443")" ]
176 f_log
"AP mode detected, please set local LuCI instance to ports <> 80/443"
178 elif [ -z "$(pgrep -f "dnsmasq
")" ]
181 f_log
"please enable the local dnsmasq instance to use adblock"
183 elif [ ! -f "/var/run/fw3.state" ]
186 f_log
"please enable the local firewall to use adblock"
193 check
="$(${adb_uci} -q get bcp38.@bcp38[0].enabled)"
194 if [ "${check}" = "1" ]
196 if [ -n "$(${adb_uci} -q get bcp38.@bcp38[0].match | grep -Fo "${adb_nullipv4%.*}")" ]
199 f_log
"please whitelist '${adb_nullipv4}' in your bcp38 configuration to use adblock"
205 # check general package dependencies
211 f_depend
"kmod-ipt-nat"
213 # check ipv6 related package dependencies
215 if [ -n "${adb_wanif6}" ]
217 f_depend
"ip6tables" "true"
218 if [ "${package_ok}" = "false" ]
220 f_log
"package 'ip6tables' not found, IPv6 support will be disabled"
223 f_depend
"kmod-ipt-nat6" "true"
224 if [ "${package_ok}" = "false" ]
226 f_log
"package 'kmod-ipt-nat6' not found, IPv6 support will be disabled"
232 # check uclient-fetch/wget dependencies
234 f_depend
"uclient-fetch" "true"
235 if [ "${package_ok}" = "true" ]
237 f_depend
"libustream-polarssl" "true"
238 if [ "${package_ok}" = "false" ]
240 f_depend
"libustream-\(mbedtls\|openssl\|cyassl\)" "true"
241 if [ "${package_ok}" = "true" ]
243 adb_fetch
="$(which uclient-fetch)"
244 fetch_parm
="-q --timeout=${adb_fetchttl}"
245 response_parm
="--spider"
249 if [ -z "${adb_fetch}" ]
251 f_depend
"wget" "true"
252 if [ "${package_ok}" = "true" ]
254 adb_fetch
="$(which wget)"
255 fetch_parm
="--no-config --quiet --tries=1 --no-cache --no-cookies --max-redirect=0 --dns-timeout=${adb_fetchttl} --connect-timeout=${adb_fetchttl} --read-timeout=${adb_fetchttl}"
256 response_parm
="--spider --server-response"
259 f_log
"please install 'uclient-fetch' or 'wget' with ssl support to use adblock"
264 # check ca-certificate package and set fetch parm accordingly
266 f_depend
"ca-certificates" "true"
267 if [ "${package_ok}" = "false" ]
269 fetch_parm
="${fetch_parm} --no-check-certificate"
272 # start normal processing/logging
274 f_log
"domain adblock processing started (${adb_scriptver}, ${adb_sysver}, $(/bin/date "+%d.
%m.
%Y
%H
:%M
:%S
"))"
276 # log partially outdated config
278 if [ "${outdated_ok}" = "true" ]
280 f_log
"partially outdated adblock config (${adb_mincfgver} vs. ${adb_cfgver}), please run '/etc/init.d/adblock cfgup' to update your configuration"
285 if [ "${apmode_ok}" = "true" ]
287 f_log
"AP mode enabled"
290 # set/log restricted mode
292 if [ "${adb_restricted}" = "1" ]
294 adb_uci
="$(which true)"
295 f_log
"Restricted mode enabled"
298 # check dns hideout directory
300 if [ -d "${adb_dnshidedir}" ]
302 mv_done
="$(find "${adb_dnshidedir}" -maxdepth 1 -type f -name "${adb_dnsprefix}*" -print -exec mv -f "{}" "${adb_dnsdir}" \;)"
304 mkdir
-p -m 660 "${adb_dnshidedir}"
307 # check adblock temp directory
309 adb_tmpfile
="$(mktemp -tu)"
310 adb_tmpdir
="$(mktemp -p /tmp -d)"
311 if [ -n "${adb_tmpdir}" ] && [ -d "${adb_tmpdir}" ]
313 f_space
"${adb_tmpdir}"
314 if [ "${space_ok}" = "false" ]
316 if [ $
((av_space
)) -le 2000 ]
319 f_log
"not enough free space in '${adb_tmpdir}' (avail. ${av_space} kb)"
322 f_log
"not enough free space to handle all block list sources at once in '${adb_tmpdir}' (avail. ${av_space} kb)"
327 f_log
"temp directory not found"
333 mem_total
="$(awk '$1 ~ /^MemTotal/ {printf $2}' "/proc
/meminfo
")"
334 mem_free
="$(awk '$1 ~ /^MemFree/ {printf $2}' "/proc
/meminfo
")"
335 mem_swap
="$(awk '$1 ~ /^SwapTotal/ {printf $2}' "/proc
/meminfo
")"
336 if [ $
((mem_total
)) -le 64000 ] && [ $
((mem_swap
)) -eq 0 ]
339 f_log
"not enough free memory, overall sort processing will be disabled (total: ${mem_total}, free: ${mem_free}, swap: ${mem_swap})"
344 # check backup configuration
346 if [ "${enabled_backup}" = "1" ] && [ -d "${adb_dir_backup}" ]
348 f_space
"${adb_dir_backup}"
349 if [ "${space_ok}" = "false" ]
351 f_log
"not enough free space in '${adb_dir_backup}'(avail. ${av_space} kb), backup/restore will be disabled"
354 f_log
"backup/restore will be enabled"
359 f_log
"backup/restore will be disabled"
362 # set dnsmasq defaults
364 if [ -n "${adb_wanif4}" ] && [ -n "${adb_wanif6}" ]
366 adb_dnsformat
="awk -v ipv4="${adb_nullipv4}" -v ipv6="${adb_nullipv6}" '{print \"address=/\"\$0\"/\"ipv4\"\n\"\"address=/\"\$0\"/\"ipv6}'"
367 elif [ -n "${adb_wanif4}" ]
369 adb_dnsformat="awk -v ipv4="${adb_nullipv4}" '{print
\"address
=/\"\
$0\"/\"ipv4
}'"
371 adb_dnsformat="awk -v ipv6="${adb_nullipv6}" '{print
\"address
=/\"\
$0\"/\"ipv6
}'"
374 # check volatile iptables configuration
376 if [ -n "${adb_wanif4}" ]
378 if [ "${apmode_ok}" = "false" ]
380 if [ "${adb_forcedns}" = "1" ] && [ -n "${adb_landev}" ]
382 f_firewall "IPv4" "nat" "prerouting_rule" "adb-dns" "1" "dns" "-p udp --dport 53 -j DNAT --to-destination ${adb_ipv4}:53"
383 f_firewall "IPv4" "nat" "prerouting_rule" "adb-dns" "2" "dns" "-p tcp --dport 53 -j DNAT --to-destination ${adb_ipv4}:53"
385 f_firewall "IPv4" "filter" "forwarding_rule" "adb-fwd" "1" "fwd" "-p tcp -j REJECT --reject-with tcp-reset"
386 f_firewall "IPv4" "filter" "forwarding_rule" "adb-fwd" "2" "fwd" "-j REJECT --reject-with icmp-host-unreachable"
387 f_firewall "IPv4" "filter" "output_rule" "adb-out" "1" "out" "-p tcp -j REJECT --reject-with tcp-reset"
388 f_firewall "IPv4" "filter" "output_rule" "adb-out" "2" "out" "-j REJECT --reject-with icmp-host-unreachable"
390 f_firewall "IPv4" "nat" "prerouting_rule" "adb-nat" "1" "nat" "-p tcp --dport 80 -j DNAT --to-destination ${adb_ipv4}:${adb_nullport}"
391 f_firewall "IPv4" "nat" "prerouting_rule" "adb-nat" "2" "nat" "-p tcp --dport 443 -j DNAT --to-destination ${adb_ipv4}:${adb_nullportssl}"
393 if [ -n "${adb_wanif6}" ]
395 if [ "${apmode_ok}" = "false" ]
397 if [ "${adb_forcedns}" = "1" ] && [ -n "${adb_landev}" ]
399 f_firewall "IPv6" "nat" "PREROUTING" "adb-dns" "1" "dns" "-p udp --dport 53 -j DNAT --to-destination [${adb_ipv6}]:53"
400 f_firewall "IPv6" "nat" "PREROUTING" "adb-dns" "2" "dns" "-p tcp --dport 53 -j DNAT --to-destination [${adb_ipv6}]:53"
402 f_firewall "IPv6" "filter" "forwarding_rule" "adb-fwd" "1" "fwd" "-p tcp -j REJECT --reject-with tcp-reset"
403 f_firewall "IPv6" "filter" "forwarding_rule" "adb-fwd" "2" "fwd" "-j REJECT --reject-with icmp6-addr-unreachable"
404 f_firewall "IPv6" "filter" "output_rule" "adb-out" "1" "out" "-p tcp -j REJECT --reject-with tcp-reset"
405 f_firewall "IPv6" "filter" "output_rule" "adb-out" "2" "out" "-j REJECT --reject-with icmp6-addr-unreachable"
407 f_firewall "IPv6" "nat" "PREROUTING" "adb-nat" "1" "nat" "-p tcp --dport 80 -j DNAT --to-destination [${adb_ipv6}]:${adb_nullport}"
408 f_firewall "IPv6" "nat" "PREROUTING" "adb-nat" "2" "nat" "-p tcp --dport 443 -j DNAT --to-destination [${adb_ipv6}]:${adb_nullportssl}"
410 if [ "${firewall_ok}" = "true" ]
412 f_log "created volatile firewall rulesets"
415 # check volatile uhttpd instance configuration
417 if [ -n "${adb_wanif4}" ] && [ -n "${adb_wanif6}" ]
419 f_uhttpd "adbIPv4+6_80" "1" "-p ${adb_ipv4}:${adb_nullport} -p [${adb_ipv6}]:${adb_nullport}"
420 f_uhttpd "adbIPv4+6_443" "0" "-p ${adb_ipv4}:${adb_nullportssl} -p [${adb_ipv6}]:${adb_nullportssl}"
421 elif [ -n "${adb_wanif4}" ]
423 f_uhttpd "adbIPv4_80" "1" "-p ${adb_ipv4}:${adb_nullport}"
424 f_uhttpd "adbIPv4_443" "0" "-p ${adb_ipv4}:${adb_nullportssl}"
426 f_uhttpd "adbIPv6_80" "1" "-p [${adb_ipv6}]:${adb_nullport}"
427 f_uhttpd "adbIPv6_443" "0" "-p [${adb_ipv6}]:${adb_nullportssl}"
429 if [ "${uhttpd_ok}" = "true" ]
431 f_log "created volatile uhttpd instances"
434 # check whitelist entries
436 if [ -s "${adb_whitelist}" ]
438 awk "${adb_whitelist_rset}" "${adb_whitelist}" > "${adb_tmpdir}/tmp.whitelist"
441 # remove temporary package list
446 # f_depend: check package dependencies
452 local check_only="${2}"
455 check="$(printf "${pkg_list}" | grep "^${package} -")"
456 if [ "${check_only}" = "true" ] && [ -z "${check}" ]
459 elif [ -z "${check}" ]
462 f_log "package '${package}' not found"
467 # f_firewall: set iptables rules for ipv4/ipv6
472 local nullip="${adb_nullipv4}"
478 local notes="adb-${6}"
481 # select appropriate iptables executable for IPv6
483 if [ "${proto}" = "IPv6" ]
486 nullip="${adb_nullipv6}"
489 # check whether iptables chain already exist
491 rc="$("${ipt}" -w -t "${table}" -nL "${chain}" >/dev/null 2>&1; printf ${?})"
494 "${ipt}" -w -t "${table}" -N "${chain}"
495 "${ipt}" -w -t "${table}" -A "${chain}" -m comment --comment "${notes}" -j RETURN
496 if [ "${chain}" = "adb-dns" ]
498 "${ipt}" -w -t "${table}" -A "${chsrc}" -i "${adb_landev}+" -m comment --comment "${notes}" -j "${chain}"
500 "${ipt}" -w -t "${table}" -A "${chsrc}" -d "${nullip}" -m comment --comment "${notes}" -j "${chain}"
505 f_log "failed to initialize volatile ${proto} firewall chain '${chain}'"
510 # check whether iptables rule already exist
512 rc="$("${ipt}" -w -t "${table}" -C "${chain}" -m comment --comment "${notes}" ${rules} >/dev/null 2>&1; printf ${?})"
515 "${ipt}" -w -t "${table}" -I "${chain}" "${chpos}" -m comment --comment "${notes}" ${rules}
521 f_log "failed to initialize volatile ${proto} firewall rule '${notes}'"
527 # f_uhttpd: start uhttpd instances
536 check="$(pgrep -f "uhttpd -h /www/adblock -N 25 -T ${timeout} -r ${realm}")"
539 uhttpd -h "/www/adblock" -N 25 -T "${timeout}" -r "${realm}" -k 0 -t 0 -R -D -S -E "/index.html" ${ports}
545 f_log "failed to initialize volatile uhttpd instance (${realm})"
551 # f_space: check mount points/space requirements
560 av_space="$(df "${mp}" | tail -n1 | awk '{printf $4}')"
561 if [ $((av_space)) -lt $((adb_minspace)) ]
568 # f_cntconfig: calculate counters in config
575 for src_name in $(ls -ASr "${adb_dnsdir}/${adb_dnsprefix}"*)
577 count="$(wc -l < "${src_name}")"
578 src_name="${src_name##*.}"
579 if [ -n "${adb_wanif4}" ] && [ -n "${adb_wanif6}" ]
583 "${adb_uci}" -q set "adblock.${src_name}.adb_src_count=${count}"
584 adb_count=$((adb_count + count))
586 "${adb_uci}" -q set "adblock.global.adb_overall_count=${adb_count}"
589 # f_rmconfig: remove volatile config entries
594 local options="adb_src_timestamp adb_src_count"
597 "${adb_uci}" -q delete "adblock.global.adb_overall_count"
598 "${adb_uci}" -q delete "adblock.global.adb_dnstoggle"
599 "${adb_uci}" -q delete "adblock.global.adb_percentage"
600 "${adb_uci}" -q delete "adblock.global.adb_lastrun"
601 for opt in ${options}
603 "${adb_uci}" -q delete "adblock.${section}.${opt}"
607 # f_rmdns: remove dns block lists and backups
611 rm_dns="$(find "${adb_dnsdir}" -maxdepth 1 -type f -name "${adb_dnsprefix}*" -print -exec rm -f "{}" \;)"
612 if [ -n "${rm_dns}" ]
614 rm -rf "${adb_dnshidedir}"
615 if [ "${enabled_backup}" = "1" ] && [ -d "${adb_dir_backup}" ]
617 rm -f "${adb_dir_backup}/${adb_dnsprefix}"*.gz
619 /etc/init.d/dnsmasq restart
623 # f_rmuhttpd: remove uhttpd instances
627 rm_uhttpd="$(pgrep -f "uhttpd -h /www/adblock")"
628 if [ -n "${rm_uhttpd}" ]
630 for pid in ${rm_uhttpd}
637 # f_rmfirewall: remove firewall rulsets
641 rm_fw="$(iptables -w -t nat -vnL | grep -Fo "adb-")"
644 iptables-save -t nat | grep -Fv -- "adb-" | iptables-restore
645 iptables-save -t filter | grep -Fv -- "adb-" | iptables-restore
646 if [ -n "$(lsmod | grep -Fo "ip6table_nat")" ]
648 ip6tables-save -t nat | grep -Fv -- "adb-" | ip6tables-restore
649 ip6tables-save -t filter | grep -Fv -- "adb-" | ip6tables-restore
654 # f_log: log messages to stdout and syslog
662 # check for terminal session
669 # log to different output devices and set log class accordingly
671 if [ -n "${log_msg}" ]
677 logger ${log_parm} -t "adblock[${adb_pid}] ${class}" "${log_msg}" 2>&1
681 # f_statistics: adblock runtime statistics
684 local ipv4_blk=0 ipv4_all=0 ipv4_pct=0
685 local ipv6_blk=0 ipv6_all=0 ipv6_pct=0
687 if [ -n "${adb_wanif4}" ]
689 ipv4_blk="$(iptables -t nat -vxnL adb-nat | awk '$3 ~
/^DNAT$
/ {sum += $1} END
{printf sum}')"
690 ipv4_all="$(iptables -t nat -vxnL PREROUTING | awk '$3 ~
/^
(delegate_prerouting|prerouting_rule
)$
/ {sum += $1} END
{printf sum}')"
691 if [ $((ipv4_all)) -gt 0 ] && [ $((ipv4_blk)) -gt 0 ] && [ $((ipv4_all)) -gt $((ipv4_blk)) ]
693 ipv4_pct="$(printf "${ipv4_blk}" | awk -v all="${ipv4_all}" '{printf( "%5.2f\n",$1/all*100)}')"
694 elif [ $((ipv4_all)) -lt $((ipv4_blk)) ]
696 iptables -t nat -Z adb-nat
699 if [ -n "${adb_wanif6}" ]
701 ipv6_blk="$
(ip6tables
-t nat
-vxnL adb-nat |
awk '$3 ~ /^DNAT$/ {sum += $1} END {printf sum}')"
702 ipv6_all="$
(ip6tables
-t nat
-vxnL PREROUTING |
awk '$3 ~ /^(adb-nat|DNAT)$/ {sum += $1} END {printf sum}')"
703 if [ $((ipv6_all)) -gt 0 ] && [ $((ipv6_blk)) -gt 0 ] && [ $((ipv6_all)) -gt $((ipv6_blk)) ]
705 ipv6_pct="$
(printf "${ipv6_blk}" | awk -v all="${ipv6_all}" '{printf( "%5.2f\n",$1/all*100)}')"
706 elif [ $
((ipv6_all
)) -lt $
((ipv6_blk
)) ]
708 ip6tables
-t nat
-Z adb-nat
711 "${adb_uci}" -q set "adblock.global.adb_percentage=${ipv4_pct}%/${ipv6_pct}%"
712 f_log
"firewall statistics (IPv4/IPv6): ${ipv4_pct}%/${ipv6_pct}% of all packets in prerouting chain are ad related & blocked"
715 # f_exit: delete temporary files, generate statistics and exit
719 local lastrun
="$(date "+%d.
%m.
%Y
%H
:%M
:%S
")"
721 if [ "${adb_restricted}" = "1" ]
723 adb_uci
="$(which true)"
726 # delete temp files & directories
728 rm -f "${adb_tmpfile}"
729 rm -rf "${adb_tmpdir}"
733 if [ $
((rc
)) -lt 0 ] ||
[ $
((rc
)) -gt 0 ]
738 config_foreach f_rmconfig
source
739 if [ $
((rc
)) -eq -1 ]
741 "${adb_uci}" -q set "adblock.global.adb_lastrun=${lastrun} => runtime error, please check the log!"
745 # final log message and iptables statistics
750 "${adb_uci}" -q set "adblock.global.adb_lastrun=${lastrun}"
751 f_log
"domain adblock processing finished successfully (${adb_scriptver}, ${adb_sysver}, ${lastrun})"
752 elif [ $
((rc
)) -gt 0 ]
754 f_log
"domain adblock processing failed (${adb_scriptver}, ${adb_sysver}, ${lastrun})"
758 "${adb_uci}" -q commit
"adblock"
759 rm -f "${adb_pidfile}"