net/adblock/files/adblock-helper.sh

   1 #!/bin/sh
   2 # function library used by adblock-update.sh
   3 # written by Dirk Brenken (dev@brenken.org)
   4
   5 # set initial defaults
   6 #
   7 LC_ALL=C
   8 PATH="/usr/sbin:/usr/bin:/sbin:/bin"
   9 adb_hotplugif=""
  10 adb_lanif="lan"
  11 adb_nullport="65534"
  12 adb_nullportssl="65535"
  13 adb_nullipv4="198.18.0.1"
  14 adb_nullipv6="::ffff:c612:0001"
  15 adb_whitelist="/etc/adblock/adblock.whitelist"
  16 adb_whitelist_rset="\$1 ~/^([A-Za-z0-9_-]+\.){1,}[A-Za-z]+/{print tolower(\"^\"\$1\"\\\|[.]\"\$1)}"
  17 adb_dnsdir="/tmp/dnsmasq.d"
  18 adb_dnshidedir="${adb_dnsdir}/.adb_hidden"
  19 adb_dnsprefix="adb_list"
  20 adb_count=0
  21 adb_minspace=12000
  22 adb_forcedns=1
  23 adb_fetchttl=5
  24 adb_restricted=0
  25 adb_uci="$(which uci)"
  26
  27 # f_envload: load adblock environment
  28 #
  29 f_envload()
  30 {
  31     # source in system function library
  32     #
  33     if [ -r "/lib/functions.sh" ]
  34     then
  35         . "/lib/functions.sh"
  36     else
  37         rc=-10
  38         f_log "system function library not found, please check your installation"
  39         f_exit
  40     fi
  41
  42     # source in system network library
  43     #
  44     if [ -r "/lib/functions/network.sh" ]
  45     then
  46         . "/lib/functions/network.sh"
  47     else
  48         rc=-10
  49         f_log "system network library not found, please check your installation"
  50         f_exit
  51     fi
  52
  53     # check opkg availability
  54     #
  55     if [ -f "/var/lock/opkg.lock" ]
  56     then
  57         rc=-10
  58         f_log "adblock installation finished successfully, 'opkg' currently locked by package installer"
  59         f_exit
  60     fi
  61
  62     # uci function to parse global section by callback
  63     #
  64     config_cb()
  65     {
  66         local type="${1}"
  67         if [ "${type}" = "adblock" ]
  68         then
  69             option_cb()
  70             {
  71                 local option="${1}"
  72                 local value="${2}"
  73                 eval "${option}=\"${value}\""
  74             }
  75         else
  76             reset_cb
  77         fi
  78     }
  79
  80     # uci function to parse 'service' and 'source' sections
  81     #
  82     parse_config()
  83     {
  84         local value opt section="${1}" options="enabled adb_dir adb_src adb_src_rset adb_src_cat"
  85         if [ "${section}" != "backup" ]
  86         then
  87             eval "adb_sources=\"${adb_sources} ${section}\""
  88         fi
  89         for opt in ${options}
  90         do
  91             config_get value "${section}" "${opt}"
  92             if [ -n "${value}" ]
  93             then
  94                 eval "${opt}_${section}=\"${value}\""
  95             fi
  96         done
  97     }
  98
  99     # load adblock config and start parsing functions
 100     #
 101     config_load adblock
 102     config_foreach parse_config service
 103     config_foreach parse_config source
 104
 105     # get network basics
 106     #
 107     network_get_ipaddr adb_ipv4 "${adb_lanif}"
 108     network_get_ipaddr6 adb_ipv6 "${adb_lanif}"
 109     network_get_device adb_landev "${adb_lanif}"
 110     network_find_wan adb_wanif4
 111     network_find_wan6 adb_wanif6
 112 }
 113
 114 # f_envcheck: check/set environment prerequisites
 115 #
 116 f_envcheck()
 117 {
 118     local check
 119
 120     # check 'enabled' & 'version' config options
 121     #
 122     if [ -z "${adb_enabled}" ] || [ -z "${adb_cfgver}" ] || [ "${adb_cfgver%%.*}" != "${adb_mincfgver%%.*}" ]
 123     then
 124         rc=-1
 125         f_log "outdated adblock config (${adb_mincfgver} vs. ${adb_cfgver}), please run '/etc/init.d/adblock cfgup' to update your configuration"
 126         f_exit
 127     elif [ "${adb_cfgver#*.}" != "${adb_mincfgver#*.}" ]
 128     then
 129         outdated_ok="true"
 130     fi
 131     if [ "${adb_enabled}" != "1" ]
 132     then
 133         rc=-10
 134         f_log "adblock is currently disabled, please set adblock.global.adb_enabled=1' to use this service"
 135         f_exit
 136     fi
 137
 138     # get list with all installed packages
 139     #
 140     pkg_list="$(opkg list-installed)"
 141     if [ -z "${pkg_list}" ]
 142     then
 143         rc=-1
 144         f_log "empty 'opkg' package list, please check your installation"
 145         f_exit
 146     fi
 147     adb_sysver="$(printf "${pkg_list}" | grep "^base-files -")"
 148     adb_sysver="${adb_sysver##*-}"
 149
 150     # get lan ip addresses
 151     #
 152     if [ -z "${adb_ipv4}" ] && [ -z "${adb_ipv6}" ]
 153     then
 154         rc=-1
 155         f_log "no valid IPv4/IPv6 configuration found (${adb_lanif}), please set 'adb_lanif' manually"
 156         f_exit
 157     fi
 158
 159     # check logical update interfaces (with default route)
 160     #
 161     if [ -z "${adb_wanif4}" ] && [ -z "${adb_wanif6}" ]
 162     then
 163         adb_wanif4="${adb_lanif}"
 164     fi
 165
 166     # check AP mode
 167     #
 168     if [ "${adb_wanif4}" = "${adb_lanif}" ] || [ "${adb_wanif6}" = "${adb_lanif}" ]
 169     then
 170         adb_nullipv4="${adb_ipv4}"
 171         adb_nullipv6="${adb_ipv6}"
 172         if [ -n "$(${adb_uci} -q get uhttpd.main.listen_http | grep -Fo "80")" ] ||
 173            [ -n "$(${adb_uci} -q get uhttpd.main.listen_https | grep -Fo "443")" ]
 174         then
 175             rc=-1
 176             f_log "AP mode detected, please set local LuCI instance to ports <> 80/443"
 177             f_exit
 178         elif [ ! -f "/etc/init.d/dnsmasq" ]
 179         then
 180             rc=-1
 181             f_log "please enable the local dnsmasq instance to use adblock"
 182             f_exit
 183         elif [ ! -f "/var/run/fw3.state" ]
 184         then
 185             rc=-1
 186             f_log "please enable the local firewall to use adblock"
 187             f_exit
 188         else
 189             apmode_ok="true"
 190         fi
 191     else
 192         apmode_ok="false"
 193         check="$(${adb_uci} -q get bcp38.@bcp38[0].enabled)"
 194         if [ "${check}" = "1" ]
 195         then
 196             if [ -n "$(${adb_uci} -q get bcp38.@bcp38[0].match | grep -Fo "${adb_nullipv4%.*}")" ]
 197             then
 198                 rc=-1
 199                 f_log "please whitelist '${adb_nullipv4}' in your bcp38 configuration to use adblock"
 200                 f_exit
 201             fi
 202         fi
 203     fi
 204
 205     # check general package dependencies
 206     #
 207     f_depend "busybox"
 208     f_depend "uci"
 209     f_depend "uhttpd"
 210     f_depend "iptables"
 211     f_depend "kmod-ipt-nat"
 212
 213     # check ipv6 related package dependencies
 214     #
 215     if [ -n "${adb_wanif6}" ]
 216     then
 217         f_depend "ip6tables" "true"
 218         if [ "${package_ok}" = "false" ]
 219         then
 220             f_log "package 'ip6tables' not found, IPv6 support will be disabled"
 221             unset adb_wanif6
 222         else
 223             f_depend "kmod-ipt-nat6" "true"
 224             if [ "${package_ok}" = "false" ]
 225             then
 226                 f_log "package 'kmod-ipt-nat6' not found, IPv6 support will be disabled"
 227                 unset adb_wanif6
 228             fi
 229         fi
 230     fi
 231
 232     # check uclient-fetch/wget dependencies
 233     #
 234     f_depend "uclient-fetch" "true"
 235     if [ "${package_ok}" = "true" ]
 236     then
 237         f_depend "libustream-polarssl" "true"
 238         if [ "${package_ok}" = "false" ]
 239         then
 240             f_depend "libustream-\(mbedtls\|openssl\|cyassl\)" "true"
 241             if [ "${package_ok}" = "true" ]
 242             then
 243                 adb_fetch="$(which uclient-fetch)"
 244                 fetch_parm="-q --timeout=${adb_fetchttl}"
 245                 response_parm="--spider"
 246             fi
 247         fi
 248     fi
 249     if [ -z "${adb_fetch}" ]
 250     then
 251         f_depend "wget" "true"
 252         if [ "${package_ok}" = "true" ]
 253         then
 254             adb_fetch="$(which wget)"
 255             fetch_parm="--no-config --quiet --tries=1 --no-cache --no-cookies --max-redirect=0 --dns-timeout=${adb_fetchttl} --connect-timeout=${adb_fetchttl} --read-timeout=${adb_fetchttl}"
 256             response_parm="--spider --server-response"
 257         else
 258             rc=-1
 259             f_log "please install 'uclient-fetch' or 'wget' with ssl support to use adblock"
 260             f_exit
 261         fi
 262     fi
 263
 264     # check ca-certificate package and set fetch parm accordingly
 265     #
 266     f_depend "ca-certificates" "true"
 267     if [ "${package_ok}" = "false" ]
 268     then
 269         fetch_parm="${fetch_parm} --no-check-certificate"
 270     fi
 271
 272     # start normal processing/logging
 273     #
 274     f_log "domain adblock processing started (${adb_scriptver}, ${adb_sysver}, $(/bin/date "+%d.%m.%Y %H:%M:%S"))"
 275
 276     # log partially outdated config
 277     #
 278     if [ "${outdated_ok}" = "true" ]
 279     then
 280         f_log "partially outdated adblock config (${adb_mincfgver} vs. ${adb_cfgver}), please run '/etc/init.d/adblock cfgup' to update your configuration"
 281     fi
 282
 283     # log ap mode
 284     #
 285     if [ "${apmode_ok}" = "true" ]
 286     then
 287         f_log "AP mode enabled"
 288     fi
 289
 290     # set/log restricted mode
 291     #
 292     if [ "${adb_restricted}" = "1" ]
 293     then
 294         adb_uci="$(which true)"
 295         f_log "Restricted mode enabled"
 296     fi
 297
 298     # check dns hideout directory
 299     #
 300     if [ -d "${adb_dnshidedir}" ]
 301     then
 302         mv_done="$(find "${adb_dnshidedir}" -maxdepth 1 -type f -name "${adb_dnsprefix}*" -print -exec mv -f "{}" "${adb_dnsdir}" \;)"
 303     else
 304         mkdir -p -m 660 "${adb_dnshidedir}"
 305     fi
 306
 307     # check adblock temp directory
 308     #
 309     adb_tmpfile="$(mktemp -tu)"
 310     adb_tmpdir="$(mktemp -p /tmp -d)"
 311     if [ -n "${adb_tmpdir}" ] && [ -d "${adb_tmpdir}" ]
 312     then
 313         f_space "${adb_tmpdir}"
 314         if [ "${space_ok}" = "false" ]
 315         then
 316             if [ $((av_space)) -le 2000 ]
 317             then
 318                 rc=105
 319                 f_log "not enough free space in '${adb_tmpdir}' (avail. ${av_space} kb)"
 320                 f_exit
 321             else
 322                 f_log "not enough free space to handle all block list sources at once in '${adb_tmpdir}' (avail. ${av_space} kb)"
 323             fi
 324         fi
 325     else
 326         rc=110
 327         f_log "temp directory not found"
 328         f_exit
 329     fi
 330
 331     # check memory
 332     #
 333     mem_total="$(awk '$1 ~ /^MemTotal/ {printf $2}' "/proc/meminfo")"
 334     mem_free="$(awk '$1 ~ /^MemFree/ {printf $2}' "/proc/meminfo")"
 335     mem_swap="$(awk '$1 ~ /^SwapTotal/ {printf $2}' "/proc/meminfo")"
 336     if [ $((mem_total)) -le 64000 ] && [ $((mem_swap)) -eq 0 ]
 337     then
 338         mem_ok="false"
 339         f_log "not enough free memory, overall sort processing will be disabled (total: ${mem_total}, free: ${mem_free}, swap: ${mem_swap})"
 340     else
 341         mem_ok="true"
 342     fi
 343
 344     # check backup configuration
 345     #
 346     if [ "${enabled_backup}" = "1" ] && [ -d "${adb_dir_backup}" ]
 347     then
 348         f_space "${adb_dir_backup}"
 349         if [ "${space_ok}" = "false" ]
 350         then
 351             f_log "not enough free space in '${adb_dir_backup}'(avail. ${av_space} kb), backup/restore will be disabled"
 352             backup_ok="false"
 353         else
 354             f_log "backup/restore will be enabled"
 355             backup_ok="true"
 356         fi
 357     else
 358         backup_ok="false"
 359         f_log "backup/restore will be disabled"
 360     fi
 361
 362     # set dnsmasq defaults
 363     #
 364     if [ -n "${adb_wanif4}" ] && [ -n "${adb_wanif6}" ]
 365     then
 366         adb_dnsformat="awk -v ipv4="${adb_nullipv4}" -v ipv6="${adb_nullipv6}" '{print \"address=/\"\$0\"/\"ipv4\"\n\"\"address=/\"\$0\"/\"ipv6}'"
 367     elif [ -n "${adb_wanif4}" ]
 368     then
 369         adb_dnsformat="awk -v ipv4="${adb_nullipv4}" '{print \"address=/\"\$0\"/\"ipv4}'"
 370     else
 371         adb_dnsformat="awk -v ipv6="${adb_nullipv6}" '{print \"address=/\"\$0\"/\"ipv6}'"
 372     fi
 373
 374     # check volatile iptables configuration
 375     #
 376     if [ -n "${adb_wanif4}" ]
 377     then
 378         if [ "${apmode_ok}" = "false" ]
 379         then
 380             if [ "${adb_forcedns}" = "1" ] && [ -n "${adb_landev}" ]
 381             then
 382                 f_firewall "IPv4" "nat" "prerouting_rule" "adb-dns" "1" "dns" "-p udp --dport 53 -j DNAT --to-destination ${adb_ipv4}:53"
 383                 f_firewall "IPv4" "nat" "prerouting_rule" "adb-dns" "2" "dns" "-p tcp --dport 53 -j DNAT --to-destination ${adb_ipv4}:53"
 384             fi
 385             f_firewall "IPv4" "filter" "forwarding_rule" "adb-fwd" "1" "fwd" "-p tcp -j REJECT --reject-with tcp-reset"
 386             f_firewall "IPv4" "filter" "forwarding_rule" "adb-fwd" "2" "fwd" "-j REJECT --reject-with icmp-host-unreachable"
 387             f_firewall "IPv4" "filter" "output_rule" "adb-out" "1" "out" "-p tcp -j REJECT --reject-with tcp-reset"
 388             f_firewall "IPv4" "filter" "output_rule" "adb-out" "2" "out" "-j REJECT --reject-with icmp-host-unreachable"
 389         fi
 390         f_firewall "IPv4" "nat" "prerouting_rule" "adb-nat" "1" "nat" "-p tcp --dport 80 -j DNAT --to-destination ${adb_ipv4}:${adb_nullport}"
 391         f_firewall "IPv4" "nat" "prerouting_rule" "adb-nat" "2" "nat" "-p tcp --dport 443 -j DNAT --to-destination ${adb_ipv4}:${adb_nullportssl}"
 392     fi
 393     if [ -n "${adb_wanif6}" ]
 394     then
 395         if [ "${apmode_ok}" = "false" ]
 396         then
 397             if [ "${adb_forcedns}" = "1" ] && [ -n "${adb_landev}" ]
 398             then
 399                 f_firewall "IPv6" "nat" "PREROUTING" "adb-dns" "1" "dns" "-p udp --dport 53 -j DNAT --to-destination [${adb_ipv6}]:53"
 400                 f_firewall "IPv6" "nat" "PREROUTING" "adb-dns" "2" "dns" "-p tcp --dport 53 -j DNAT --to-destination [${adb_ipv6}]:53"
 401             fi
 402             f_firewall "IPv6" "filter" "forwarding_rule" "adb-fwd" "1" "fwd" "-p tcp -j REJECT --reject-with tcp-reset"
 403             f_firewall "IPv6" "filter" "forwarding_rule" "adb-fwd" "2" "fwd" "-j REJECT --reject-with icmp6-addr-unreachable"
 404             f_firewall "IPv6" "filter" "output_rule" "adb-out" "1" "out" "-p tcp -j REJECT --reject-with tcp-reset"
 405             f_firewall "IPv6" "filter" "output_rule" "adb-out" "2" "out" "-j REJECT --reject-with icmp6-addr-unreachable"
 406         fi
 407         f_firewall "IPv6" "nat" "PREROUTING" "adb-nat" "1" "nat" "-p tcp --dport 80 -j DNAT --to-destination [${adb_ipv6}]:${adb_nullport}"
 408         f_firewall "IPv6" "nat" "PREROUTING" "adb-nat" "2" "nat" "-p tcp --dport 443 -j DNAT --to-destination [${adb_ipv6}]:${adb_nullportssl}"
 409     fi
 410     if [ "${firewall_ok}" = "true" ]
 411     then
 412         f_log "created volatile firewall rulesets"
 413     fi
 414
 415     # check volatile uhttpd instance configuration
 416     #
 417     if [ -n "${adb_wanif4}" ] && [ -n "${adb_wanif6}" ]
 418     then
 419         f_uhttpd "adbIPv4+6_80" "1" "-p ${adb_ipv4}:${adb_nullport} -p [${adb_ipv6}]:${adb_nullport}"
 420         f_uhttpd "adbIPv4+6_443" "0" "-p ${adb_ipv4}:${adb_nullportssl} -p [${adb_ipv6}]:${adb_nullportssl}"
 421     elif [ -n "${adb_wanif4}" ]
 422     then
 423         f_uhttpd "adbIPv4_80" "1" "-p ${adb_ipv4}:${adb_nullport}"
 424         f_uhttpd "adbIPv4_443" "0" "-p ${adb_ipv4}:${adb_nullportssl}"
 425     else
 426         f_uhttpd "adbIPv6_80" "1" "-p [${adb_ipv6}]:${adb_nullport}"
 427         f_uhttpd "adbIPv6_443" "0" "-p [${adb_ipv6}]:${adb_nullportssl}"
 428     fi
 429     if [ "${uhttpd_ok}" = "true" ]
 430     then
 431         f_log "created volatile uhttpd instances"
 432     fi
 433
 434     # check whitelist entries
 435     #
 436     if [ -s "${adb_whitelist}" ]
 437     then
 438         awk "${adb_whitelist_rset}" "${adb_whitelist}" > "${adb_tmpdir}/tmp.whitelist"
 439     fi
 440
 441     # remove temporary package list
 442     #
 443     unset pkg_list
 444 }
 445
 446 # f_depend: check package dependencies
 447 #
 448 f_depend()
 449 {
 450     local check
 451     local package="${1}"
 452     local check_only="${2}"
 453     package_ok="true"
 454
 455     check="$(printf "${pkg_list}" | grep "^${package} -")"
 456     if [ "${check_only}" = "true" ] && [ -z "${check}" ]
 457     then
 458         package_ok="false"
 459     elif [ -z "${check}" ]
 460     then
 461         rc=-1
 462         f_log "package '${package}' not found"
 463         f_exit
 464     fi
 465 }
 466
 467 # f_firewall: set iptables rules for ipv4/ipv6
 468 #
 469 f_firewall()
 470 {
 471     local ipt="iptables"
 472     local nullip="${adb_nullipv4}"
 473     local proto="${1}"
 474     local table="${2}"
 475     local chsrc="${3}"
 476     local chain="${4}"
 477     local chpos="${5}"
 478     local notes="adb-${6}"
 479     local rules="${7}"
 480
 481     # select appropriate iptables executable for IPv6
 482     #
 483     if [ "${proto}" = "IPv6" ]
 484     then
 485         ipt="ip6tables"
 486         nullip="${adb_nullipv6}"
 487     fi
 488
 489     # check whether iptables chain already exist
 490     #
 491     rc="$("${ipt}" -w -t "${table}" -nL "${chain}" >/dev/null 2>&1; printf ${?})"
 492     if [ $((rc)) -ne 0 ]
 493     then
 494         "${ipt}" -w -t "${table}" -N "${chain}"
 495         "${ipt}" -w -t "${table}" -A "${chain}" -m comment --comment "${notes}" -j RETURN
 496         if [ "${chain}" = "adb-dns" ]
 497         then
 498             "${ipt}" -w -t "${table}" -A "${chsrc}" -i "${adb_landev}+" -m comment --comment "${notes}" -j "${chain}"
 499         else
 500             "${ipt}" -w -t "${table}" -A "${chsrc}" -d "${nullip}" -m comment --comment "${notes}" -j "${chain}"
 501         fi
 502         rc=${?}
 503         if [ $((rc)) -ne 0 ]
 504         then
 505             f_log "failed to initialize volatile ${proto} firewall chain '${chain}'"
 506             f_exit
 507         fi
 508     fi
 509
 510     # check whether iptables rule already exist
 511     #
 512     rc="$("${ipt}" -w -t "${table}" -C "${chain}" -m comment --comment "${notes}" ${rules} >/dev/null 2>&1; printf ${?})"
 513     if [ $((rc)) -ne 0 ]
 514     then
 515         "${ipt}" -w -t "${table}" -I "${chain}" "${chpos}" -m comment --comment "${notes}" ${rules}
 516         rc=${?}
 517         if [ $((rc)) -eq 0 ]
 518         then
 519             firewall_ok="true"
 520         else
 521             f_log "failed to initialize volatile ${proto} firewall rule '${notes}'"
 522             f_exit
 523         fi
 524     fi
 525 }
 526
 527 # f_uhttpd: start uhttpd instances
 528 #
 529 f_uhttpd()
 530 {
 531     local check
 532     local realm="${1}"
 533     local timeout="${2}"
 534     local ports="${3}"
 535
 536     check="$(pgrep -f "uhttpd -h /www/adblock -N 25 -T ${timeout} -r ${realm}")"
 537     if [ -z "${check}" ]
 538     then
 539         uhttpd -h "/www/adblock" -N 25 -T "${timeout}" -r "${realm}" -k 0 -t 0 -R -D -S -E "/index.html" ${ports}
 540         rc=${?}
 541         if [ $((rc)) -eq 0 ]
 542         then
 543             uhttpd_ok="true"
 544         else
 545             f_log "failed to initialize volatile uhttpd instance (${realm})"
 546             f_exit
 547         fi
 548     fi
 549 }
 550
 551 # f_space: check mount points/space requirements
 552 #
 553 f_space()
 554 {
 555     local mp="${1}"
 556     space_ok="true"
 557
 558     if [ -d "${mp}" ]
 559     then
 560         av_space="$(df "${mp}" | tail -n1 | awk '{printf $4}')"
 561         if [ $((av_space)) -lt $((adb_minspace)) ]
 562         then
 563             space_ok="false"
 564         fi
 565     fi
 566 }
 567
 568 # f_cntconfig: calculate counters in config
 569 #
 570 f_cntconfig()
 571 {
 572     local src_name
 573     local count=0
 574
 575     for src_name in $(ls -ASr "${adb_dnsdir}/${adb_dnsprefix}"*)
 576     do
 577         count="$(wc -l < "${src_name}")"
 578         src_name="${src_name##*.}"
 579         if [ -n "${adb_wanif4}" ] && [ -n "${adb_wanif6}" ]
 580         then
 581             count=$((count / 2))
 582         fi
 583         "${adb_uci}" -q set "adblock.${src_name}.adb_src_count=${count}"
 584         adb_count=$((adb_count + count))
 585     done
 586     "${adb_uci}" -q set "adblock.global.adb_overall_count=${adb_count}"
 587 }
 588
 589 # f_rmconfig: remove volatile config entries
 590 #
 591 f_rmconfig()
 592 {
 593     local opt
 594     local options="adb_src_timestamp adb_src_count"
 595     local section="${1}"
 596
 597     "${adb_uci}" -q delete "adblock.global.adb_overall_count"
 598     "${adb_uci}" -q delete "adblock.global.adb_dnstoggle"
 599     "${adb_uci}" -q delete "adblock.global.adb_percentage"
 600     "${adb_uci}" -q delete "adblock.global.adb_lastrun"
 601     for opt in ${options}
 602     do
 603         "${adb_uci}" -q delete "adblock.${section}.${opt}"
 604     done
 605 }
 606
 607 # f_rmdns: remove dns block lists and backups
 608 #
 609 f_rmdns()
 610 {
 611     rm_dns="$(find "${adb_dnsdir}" -maxdepth 1 -type f -name "${adb_dnsprefix}*" -print -exec rm -f "{}" \;)"
 612     if [ -n "${rm_dns}" ]
 613     then
 614         rm -rf "${adb_dnshidedir}"
 615         if [ "${enabled_backup}" = "1" ] && [ -d "${adb_dir_backup}" ]
 616         then
 617             rm -f "${adb_dir_backup}/${adb_dnsprefix}"*.gz
 618         fi
 619         /etc/init.d/dnsmasq restart
 620     fi
 621 }
 622
 623 # f_rmuhttpd: remove uhttpd instances
 624 #
 625 f_rmuhttpd()
 626 {
 627     rm_uhttpd="$(pgrep -f "uhttpd -h /www/adblock")"
 628     if [ -n "${rm_uhttpd}" ]
 629     then
 630         for pid in ${rm_uhttpd}
 631         do
 632             kill -9 "${pid}"
 633         done
 634     fi
 635 }
 636
 637 # f_rmfirewall: remove firewall rulsets
 638 #
 639 f_rmfirewall()
 640 {
 641     rm_fw="$(iptables -w -t nat -vnL | grep -Fo "adb-")"
 642     if [ -n "${rm_fw}" ]
 643     then
 644         iptables-save -t nat | grep -Fv -- "adb-" | iptables-restore
 645         iptables-save -t filter | grep -Fv -- "adb-" | iptables-restore
 646         if [ -n "$(lsmod | grep -Fo "ip6table_nat")" ]
 647         then
 648             ip6tables-save -t nat | grep -Fv -- "adb-" | ip6tables-restore
 649             ip6tables-save -t filter | grep -Fv -- "adb-" | ip6tables-restore
 650         fi
 651     fi
 652 }
 653
 654 # f_log: log messages to stdout and syslog
 655 #
 656 f_log()
 657 {
 658     local log_parm
 659     local log_msg="${1}"
 660     local class="info "
 661
 662     # check for terminal session
 663     #
 664     if [ -t 1 ]
 665     then
 666         log_parm="-s"
 667     fi
 668
 669     # log to different output devices and set log class accordingly
 670     #
 671     if [ -n "${log_msg}" ]
 672     then
 673         if [ $((rc)) -gt 0 ]
 674         then
 675             class="error"
 676         fi
 677         logger ${log_parm} -t "adblock[${adb_pid}] ${class}" "${log_msg}" 2>&1
 678     fi
 679 }
 680
 681 # f_statistics: adblock runtime statistics
 682 f_statistics()
 683 {
 684     local ipv4_blk=0 ipv4_all=0 ipv4_pct=0
 685     local ipv6_blk=0 ipv6_all=0 ipv6_pct=0
 686
 687     if [ -n "${adb_wanif4}" ]
 688     then
 689         ipv4_blk="$(iptables -t nat -vxnL adb-nat | awk '$3 ~ /^DNAT$/ {sum += $1} END {printf sum}')"
 690         ipv4_all="$(iptables -t nat -vxnL PREROUTING | awk '$3 ~ /^(delegate_prerouting|prerouting_rule)$/ {sum += $1} END {printf sum}')"
 691         if [ $((ipv4_all)) -gt 0 ] && [ $((ipv4_blk)) -gt 0 ] && [ $((ipv4_all)) -gt $((ipv4_blk)) ]
 692         then
 693             ipv4_pct="$(printf "${ipv4_blk}" | awk -v all="${ipv4_all}" '{printf( "%5.2f\n",$1/all*100)}')"
 694         elif [ $((ipv4_all)) -lt $((ipv4_blk)) ]
 695         then
 696             iptables -t nat -Z adb-nat
 697         fi
 698     fi
 699     if [ -n "${adb_wanif6}" ]
 700     then
 701         ipv6_blk="$(ip6tables -t nat -vxnL adb-nat | awk '$3 ~ /^DNAT$/ {sum += $1} END {printf sum}')"
 702         ipv6_all="$(ip6tables -t nat -vxnL PREROUTING | awk '$3 ~ /^(adb-nat|DNAT)$/ {sum += $1} END {printf sum}')"
 703         if [ $((ipv6_all)) -gt 0 ] && [ $((ipv6_blk)) -gt 0 ] && [ $((ipv6_all)) -gt $((ipv6_blk)) ]
 704         then
 705             ipv6_pct="$(printf "${ipv6_blk}" | awk -v all="${ipv6_all}" '{printf( "%5.2f\n",$1/all*100)}')"
 706         elif [ $((ipv6_all)) -lt $((ipv6_blk)) ]
 707         then
 708             ip6tables -t nat -Z adb-nat
 709         fi
 710     fi
 711     "${adb_uci}" -q set "adblock.global.adb_percentage=${ipv4_pct}%/${ipv6_pct}%"
 712     f_log "firewall statistics (IPv4/IPv6): ${ipv4_pct}%/${ipv6_pct}% of all packets in prerouting chain are ad related & blocked"
 713 }
 714
 715 # f_exit: delete temporary files, generate statistics and exit
 716 #
 717 f_exit()
 718 {
 719     local lastrun="$(date "+%d.%m.%Y %H:%M:%S")"
 720
 721     if [ "${adb_restricted}" = "1" ]
 722     then
 723         adb_uci="$(which true)"
 724     fi
 725
 726     # delete temp files & directories
 727     #
 728     rm -f "${adb_tmpfile}"
 729     rm -rf "${adb_tmpdir}"
 730
 731     # tidy up on error
 732     #
 733     if [ $((rc)) -lt 0 ] || [ $((rc)) -gt 0 ]
 734     then
 735         f_rmdns
 736         f_rmuhttpd
 737         f_rmfirewall
 738         config_foreach f_rmconfig source
 739         if [ $((rc)) -eq -1 ]
 740         then
 741             "${adb_uci}" -q set "adblock.global.adb_lastrun=${lastrun} => runtime error, please check the log!"
 742         fi
 743     fi
 744
 745     # final log message and iptables statistics
 746     #
 747     if [ $((rc)) -eq 0 ]
 748     then
 749         f_statistics
 750         "${adb_uci}" -q set "adblock.global.adb_lastrun=${lastrun}"
 751         f_log "domain adblock processing finished successfully (${adb_scriptver}, ${adb_sysver}, ${lastrun})"
 752     elif [ $((rc)) -gt 0 ]
 753     then
 754         f_log "domain adblock processing failed (${adb_scriptver}, ${adb_sysver}, ${lastrun})"
 755     else
 756         rc=0
 757     fi
 758     "${adb_uci}" -q commit "adblock"
 759     rm -f "${adb_pidfile}"
 760     exit ${rc}
 761 }