2 # function library used by adblock-update.sh
3 # written by Dirk Brenken (dev@brenken.org)
5 # f_envload: load adblock environment
9 # source in system function library
11 if [ -r "/lib/functions.sh" ]
16 f_log
"system function library not found, please check your installation"
20 # source in system network library
22 if [ -r "/lib/functions/network.sh" ]
24 .
"/lib/functions/network.sh"
27 f_log
"system network library not found, please check your installation"
31 # set initial defaults,
32 # may be overwritten by setting appropriate adblock config options in global section of /etc/config/adblock
36 adb_nullipv4
="192.0.2.1"
37 adb_nullipv6
="::ffff:c000:0201"
38 adb_whitelist
="/etc/adblock/adblock.whitelist"
39 adb_whitelist_rset
="\$1 ~/^([A-Za-z0-9_-]+\.){1,}[A-Za-z]+/{print tolower(\$1)}"
44 # function to parse global section by callback
49 if [ "${type}" = "adblock" ]
55 eval "${option}=\"${value}\""
62 # function to parse 'service' and 'source' sections
66 local value opt section
="${1}" options
="adb_dir adb_src adb_src_rset adb_src_cat"
67 config_get switch
"${section}" "enabled"
68 if [ "${switch}" = "1" ]
70 if [ "${section}" != "backup" ]
72 eval "adb_sources=\"${adb_sources} ${section}\""
76 config_get value
"${section}" "${opt}"
79 eval "${opt}_${section}=\"${value}\""
85 # check opkg availability
87 if [ -r "/var/lock/opkg.lock" ]
90 f_log
"adblock installation finished successfully, 'opkg' currently locked by package installer"
94 # get list with all installed packages
96 pkg_list
="$(opkg list-installed)"
97 if [ -z "${pkg_list}" ]
100 f_log
"empty package list, please check your installation"
104 # load adblock config and start parsing functions
107 config_foreach parse_config service
108 config_foreach parse_config
source
110 # set more script defaults (can't be overwritten by adblock config options)
113 adb_tmpfile
="$(mktemp -tu)"
114 adb_tmpdir
="$(mktemp -p /tmp -d)"
115 adb_dnsdir
="/tmp/dnsmasq.d"
116 adb_dnshidedir
="${adb_dnsdir}/.adb_hidden"
117 adb_dnsprefix
="adb_list"
118 adb_iptv4
="$(which iptables)"
119 adb_iptv6
="$(which ip6tables)"
120 adb_fetch
="$(which wget)"
121 adb_uci
="$(which uci)"
122 adb_date
="$(which date)"
123 unset adb_srclist adb_revsrclist adb_errsrclist
125 # check 'enabled' & 'version' config options
127 if [ -z "${adb_enabled}" ] || [ -z "${adb_cfgver}" ] || [ "${adb_cfgver%%.*}" != "${adb_mincfgver%%.*}" ]
130 f_log
"outdated adblock config (${adb_mincfgver} vs. ${adb_cfgver}), please run '/etc/init.d/adblock cfgup' to update your configuration"
132 elif [ "${adb_cfgver#*.}" != "${adb_mincfgver#*.}" ]
136 if [ $
((adb_enabled
)) -ne 1 ]
139 f_log
"adblock is currently disabled, please set adblock.global.adb_enabled=1' to use this service"
143 # check running dnsmasq instance
145 check
="$(ps | pgrep -f "dnsmasq
")"
149 f_log
"please enable the local dnsmasq instance to use adblock"
153 # check running firewall
155 check
="$(${adb_iptv4} -vnL | grep -F "DROP
")"
159 f_log
"please enable the local firewall to use adblock"
163 # get lan ip addresses
165 network_get_ipaddr adb_ipv4
"${adb_lanif}"
166 network_get_ipaddr6 adb_ipv6
"${adb_lanif}"
167 if [ -z "${adb_ipv4}" ] && [ -z "${adb_ipv6}" ]
170 f_log
"no valid IPv4/IPv6 configuration found (${adb_lanif}), please set 'adb_lanif' manually"
173 network_get_device adb_landev4
"${adb_lanif}"
174 network_get_device adb_landev6
"${adb_lanif}"
177 # check logical update interfaces (with default route)
179 network_find_wan adb_wanif4
180 network_find_wan6 adb_wanif6
181 if [ -z "${adb_wanif4}" ] && [ -z "${adb_wanif6}" ]
183 adb_wanif4
="${adb_lanif}"
188 if [ "${adb_wanif4}" = "${adb_lanif}" ] || [ "${adb_wanif6}" = "${adb_lanif}" ]
190 adb_nullipv4
="${adb_ipv4}"
191 adb_nullipv6
="${adb_ipv6}"
192 if [ "$(${adb_uci} get uhttpd.main.listen_http | grep -Fo "80")" = "80" ] ||
193 [ "$(${adb_uci} get uhttpd.main.listen_https | grep -Fo "443")" = "443" ]
196 f_log
"AP mode detected, set local LuCI instance to ports <> 80/443"
203 # get system release level
205 adb_sysver
="$(printf "${pkg_list}" | grep "^base-files
-")"
206 adb_sysver
="${adb_sysver##*-}"
209 # f_envcheck: check/set environment prerequisites
215 # log partially outdated config
217 if [ "${outdate_ok}" = "true" ]
219 f_log
"partially outdated adblock config (${adb_mincfgver} vs. ${adb_cfgver}), please run '/etc/init.d/adblock cfgup' to update your configuration"
224 if [ "${apmode_ok}" = "true" ]
226 f_log
"AP mode enabled"
229 # set & log restricted mode
231 if [ $
((adb_restricted
)) -eq 1 ]
233 adb_uci
="$(which true)"
234 f_log
"Restricted mode enabled"
237 # check general package dependencies
244 f_depend
"kmod-ipt-nat"
246 # check ipv6 related package dependencies
248 if [ -n "${adb_wanif6}" ]
250 check
="$(printf "${pkg_list}" | grep "^ip6tables
-")"
253 f_log
"package 'ip6tables' not found, IPv6 support will be disabled"
256 check
="$(printf "${pkg_list}" | grep "^kmod-ipt-nat6
-")"
259 f_log
"package 'kmod-ipt-nat6' not found, IPv6 support will be disabled"
265 # check dns hideout directory
267 if [ -d "${adb_dnshidedir}" ]
269 mv_done
="$(find "${adb_dnshidedir}" -maxdepth 1 -type f -name "${adb_dnsprefix}*" -print -exec mv -f "{}" "${adb_dnsdir}" \;)"
271 mkdir
-p -m 660 "${adb_dnshidedir}"
274 # check ca-certificates package and set fetch parms accordingly
276 fetch_parm
="--no-config --quiet --tries=1 --no-cache --no-cookies --max-redirect=0 --dns-timeout=${adb_fetchttl} --connect-timeout=${adb_fetchttl} --read-timeout=${adb_fetchttl}"
277 check
="$(printf "${pkg_list}" | grep "^ca-certificates
-")"
280 fetch_parm
="${fetch_parm} --no-check-certificate"
283 # check adblock temp directory
285 if [ -n "${adb_tmpdir}" ] && [ -d "${adb_tmpdir}" ]
287 f_space
"${adb_tmpdir}"
288 if [ "${space_ok}" = "false" ]
290 if [ $
((av_space
)) -le 2000 ]
293 f_log
"not enough free space in '${adb_tmpdir}' (avail. ${av_space} kb)" "${rc}"
296 f_log
"not enough free space to handle all adblock list sources at once in '${adb_tmpdir}' (avail. ${av_space} kb)"
301 f_log
"temp directory not found" "${rc}"
307 mem_total
="$(awk '$1 ~ /^MemTotal/ {printf $2}' "/proc
/meminfo
")"
308 mem_free
="$(awk '$1 ~ /^MemFree/ {printf $2}' "/proc
/meminfo
")"
309 mem_swap
="$(awk '$1 ~ /^SwapTotal/ {printf $2}' "/proc
/meminfo
")"
310 if [ $
((mem_total
)) -le 64000 ] && [ $
((mem_swap
)) -eq 0 ]
313 f_log
"not enough free memory, overall sort processing will be disabled (total: ${mem_total}, free: ${mem_free}, swap: ${mem_swap})"
318 # check backup configuration
320 if [ -n "${adb_dir_backup}" ] && [ -d "${adb_dir_backup}" ]
322 f_space
"${adb_dir_backup}"
323 if [ "${space_ok}" = "false" ]
325 f_log
"not enough free space in '${adb_dir_backup}'(avail. ${av_space} kb), backup/restore will be disabled"
328 f_log
"backup/restore will be enabled"
333 f_log
"backup/restore will be disabled"
336 # set dnsmasq defaults
338 if [ -n "${adb_wanif4}" ] && [ -n "${adb_wanif6}" ]
340 adb_dnsformat
="awk -v ipv4="${adb_nullipv4}" -v ipv6="${adb_nullipv6}" '{print \"address=/\"\$0\"/\"ipv4\"\n\"\"address=/\"\$0\"/\"ipv6}'"
341 elif [ -n "${adb_wanif4}" ]
343 adb_dnsformat="awk -v ipv4="${adb_nullipv4}" '{print
\"address
=/\"\
$0\"/\"ipv4
}'"
345 adb_dnsformat="awk -v ipv6="${adb_nullipv6}" '{print
\"address
=/\"\
$0\"/\"ipv6
}'"
348 # check ipv4/iptables configuration
350 if [ -n "${adb_wanif4}" ]
352 f_firewall "IPv4" "nat" "A" "prerouting_rule" "adb-nat" "-p tcp -d ${adb_nullipv4} -m multiport --dports 80,443 -j DNAT --to-destination ${adb_ipv4}:${adb_nullport}"
353 f_firewall "IPv4" "filter" "A" "forwarding_rule" "adb-fwd" "-p tcp -d ${adb_nullipv4} -j REJECT --reject-with tcp-reset"
354 f_firewall "IPv4" "filter" "A" "forwarding_rule" "adb-fwd" "-d ${adb_nullipv4} -j REJECT --reject-with icmp-host-unreachable"
355 f_firewall "IPv4" "filter" "A" "output_rule" "adb-out" "-p tcp -d ${adb_nullipv4} -j REJECT --reject-with tcp-reset"
356 f_firewall "IPv4" "filter" "A" "output_rule" "adb-out" "-d ${adb_nullipv4} -j REJECT --reject-with icmp-host-unreachable"
357 if [ $((adb_forcedns)) -eq 1 ] && [ -n "${adb_landev4}" ]
359 f_firewall "IPv4" "nat" "A" "prerouting_rule" "adb-dns" "-i ${adb_landev4} -p udp --dport 53 -j DNAT --to-destination ${adb_ipv4}:53"
360 f_firewall "IPv4" "nat" "A" "prerouting_rule" "adb-dns" "-i ${adb_landev4} -p tcp --dport 53 -j DNAT --to-destination ${adb_ipv4}:53"
362 if [ "${fw_done}" = "true" ]
364 f_log "created volatile IPv4 firewall ruleset"
369 # check ipv6/ip6tables configuration
371 if [ -n "${adb_wanif6}" ]
373 f_firewall "IPv6" "nat" "A" "PREROUTING" "adb-nat" "-p tcp -d ${adb_nullipv6} -m multiport --dports 80,443 -j DNAT --to-destination [${adb_ipv6}]:${adb_nullport}"
374 f_firewall "IPv6" "filter" "A" "forwarding_rule" "adb-fwd" "-p tcp -d ${adb_nullipv6} -j REJECT --reject-with tcp-reset"
375 f_firewall "IPv6" "filter" "A" "forwarding_rule" "adb-fwd" "-d ${adb_nullipv6} -j REJECT --reject-with icmp6-addr-unreachable"
376 f_firewall "IPv6" "filter" "A" "output_rule" "adb-out" "-p tcp -d ${adb_nullipv6} -j REJECT --reject-with tcp-reset"
377 f_firewall "IPv6" "filter" "A" "output_rule" "adb-out" "-d ${adb_nullipv6} -j REJECT --reject-with icmp6-addr-unreachable"
378 if [ $((adb_forcedns)) -eq 1 ] && [ -n "${adb_landev6}" ]
380 f_firewall "IPv6" "nat" "A" "PREROUTING" "adb-dns" "-i ${adb_landev6} -p udp --dport 53 -j DNAT --to-destination [${adb_ipv6}]:53"
381 f_firewall "IPv6" "nat" "A" "PREROUTING" "adb-dns" "-i ${adb_landev6} -p tcp --dport 53 -j DNAT --to-destination [${adb_ipv6}]:53"
383 if [ "${fw_done}" = "true" ]
385 f_log "created volatile IPv6 firewall ruleset"
390 # check volatile adblock uhttpd instance configuration
392 check="$(ps | pgrep -f "uhttpd -h /www/adblock")"
395 if [ -n "${adb_wanif4}" ] && [ -n "${adb_wanif6}" ]
397 uhttpd -h "/www/adblock" -k 0 -N 100 -t 0 -T 1 -D -S -E "/index.html" -p "${adb_ipv4}:${adb_nullport}" -p "[${adb_ipv6}]:${adb_nullport}"
399 elif [ -n "${adb_wanif4}" ]
401 uhttpd -h "/www/adblock" -k 0 -N 100 -t 0 -T 1 -D -S -E "/index.html" -p "${adb_ipv4}:${adb_nullport}"
404 uhttpd -h "/www/adblock" -k 0 -N 100 -t 0 -T 1 -D -S -E "/index.html" -p "[${adb_ipv6}]:${adb_nullport}"
409 f_log "created volatile uhttpd instance"
411 f_log "failed to initialize volatile uhttpd instance" "${rc}"
416 # check whitelist entries
418 if [ -s "${adb_whitelist}" ]
420 awk "${adb_whitelist_rset}" "${adb_whitelist}" > "${adb_tmpdir}/tmp.whitelist"
423 # remove no longer used opkg package list
428 # f_depend: check package dependencies
435 check="$(printf "${pkg_list}" | grep "^${package} -")"
439 f_log "package '${package}' not found" "${rc}"
444 # f_firewall: set iptables rules for ipv4/ipv6
448 local ipt="${adb_iptv4}"
456 # select appropriate iptables executable for IPv6
458 if [ "${proto}" = "IPv6" ]
463 # check whether iptables rule already applied and proceed accordingly
465 rc="$("${ipt}" -w -t "${table}" -C "${chain}" -m comment --comment "${notes}" ${rules}; printf ${?})"
468 "${ipt}" -w -t "${table}" -"${ctype}" "${chain}" -m comment --comment "${notes}" ${rules}
474 f_log "failed to initialize volatile ${proto} firewall rule '${notes}'" "${rc}"
480 # f_log: log messages to stdout and syslog
489 # check for terminal session
496 # log to different output devices and set log class accordingly
498 if [ -n "${log_msg}" ]
500 if [ $((log_rc)) -gt 0 ]
503 log_rc=", rc: ${log_rc}"
504 log_msg="${log_msg}${log_rc}"
506 "${adb_log}" ${log_parm} -t "adblock[${adb_pid}] ${class}" "${log_msg}" 2>&1
510 ################################################
511 # f_space: check mount points/space requirements
519 av_space="$(df "${mp}" | tail -n1 | awk '{printf $4}')"
520 if [ $((av_space)) -lt $((adb_minspace)) ]
527 # f_cntconfig: calculate counters in config
535 for src_name in $(ls -ASr "${adb_dnsdir}/${adb_dnsprefix}"*)
537 count="$(wc -l < "${src_name}")"
538 src_name="${src_name##*.}"
539 if [ -n "${adb_wanif4}" ] && [ -n "${adb_wanif6}" ]
543 "${adb_uci}" -q set "adblock.${src_name}.adb_src_count=${count}"
544 count_sum=$((count_sum + count))
546 "${adb_uci}" -q set "adblock.global.adb_overall_count=${count_sum}"
549 # f_rmconfig: remove counters & timestamps in given config sections
555 local restore_done="${2:-false}"
557 for src_name in ${rm_done}
559 src_name="${src_name#*.}"
560 if [ "${restore_done}" = "true" ]
562 src_name="${src_name%.*}"
563 "${adb_uci}" -q set "adblock.${src_name}.adb_src_timestamp=list restored"
565 "${adb_uci}" -q delete "adblock.${src_name}.adb_src_count"
566 "${adb_uci}" -q delete "adblock.${src_name}.adb_src_timestamp"
571 # f_restore: restore last adblock list backups and restart dnsmasq
578 # remove bogus adblock lists
580 if [ -n "${adb_revsrclist}" ]
582 rm_done="$(find "${adb_dnsdir}" -maxdepth 1 -type f \( ${adb_revsrclist} \) -print -exec rm -f "{}" \;)"
584 if [ $((rc)) -eq 0 ] && [ -n "${rm_done}" ]
586 f_rmconfig "${rm_done}"
587 f_log "all bogus adblock lists removed"
588 elif [ $((rc)) -ne 0 ]
590 f_log "error during removal of bogus adblock lists" "${rc}"
597 if [ "${backup_ok}" = "true" ]
599 restore_done="$(find "${adb_dir_backup}" -maxdepth 1 -type f -name "${adb_dnsprefix}*.gz" -print -exec cp -pf "{}" "${adb_dnsdir}" \;)"
601 if [ $((rc)) -eq 0 ] && [ -n "${restore_done}" ]
603 find "${adb_dnsdir}" -maxdepth 1 -type f -name "${adb_dnsprefix}*.gz" -exec gunzip -f "{}" \;
604 f_log "all available backups restored"
605 elif [ $((rc)) -ne 0 ] && [ -n "${restore_done}" ]
607 f_log "error during restore of adblock lists" "${rc}"
611 f_log "backup service disabled, nothing to restore"
614 # (re-)try dnsmasq restart without bogus adblock lists / with backups
616 if [ -n "${restore_done}" ] || [ -n "${rm_done}" ]
618 /etc/init.d/dnsmasq restart
620 check="$(ps | pgrep -f "dnsmasq")"
625 f_log "adblock lists with overall ${adb_count} domains loaded"
628 f_log "dnsmasq restart failed, please check 'logread
' output" "${rc}"
634 # f_exit: delete (temporary) files, generate statistics and exit
640 local lastrun="$(${adb_date} "+%d.%m.%Y %H:%M:%S")"
642 # delete temporary files & directories
644 if [ -f "${adb_tmpfile}" ]
646 rm -f "${adb_tmpfile}"
648 if [ -d "${adb_tmpdir}" ]
650 rm -rf "${adb_tmpdir}"
653 # final log message and iptables statistics
657 if [ -n "${adb_wanif4}" ]
659 ipv4_adblock="$(${adb_iptv4} -t nat -vnL | awk '$11 ~
/^adb-nat$
/ {sum += $1} END
{printf sum}')"
660 ipv4_adblock="$((${ipv4_adblock} + $(${adb_iptv4} -vnL | awk '$11 ~ /^adb-(fwd|out)$/ {sum += $1} END {printf sum}')))"
662 if [ -n "${adb_wanif6}" ]
664 ipv6_adblock="$
(${adb_iptv6} -t nat
-vnL |
awk '$10 ~ /^adb-nat$/ {sum += $1} END {printf sum}')"
665 ipv6_adblock="$
((${ipv6_adblock} + $(${adb_iptv6} -vnL | awk '$10 ~ /^adb-(fwd|out)$/ {sum += $1} END
{printf sum}')))"
667 if [ -n "$(${adb_uci} -q changes adblock)" ]
669 "${adb_uci}" -q commit "adblock"
671 f_log "firewall statistics (IPv4/IPv6): ${ipv4_adblock}/${ipv6_adblock} ad related packets blocked"
672 f_log "domain adblock processing finished successfully (${adb_scriptver}, ${adb_sysver}, ${lastrun})"
673 elif [ $((rc)) -gt 0 ]
675 if [ -n "$(${adb_uci} -q changes adblock)" ]
677 "${adb_uci}" -q revert "adblock"
679 f_log "domain adblock processing failed (${adb_scriptver}, ${adb_sysver}, ${lastrun})"
683 rm -f "${adb_pidfile}"