2 # dns based ad/abuse domain blocking
3 # written by Dirk Brenken (dev@brenken.org)
5 # This is free software, licensed under the GNU General Public License v3.
6 # You should have received a copy of the GNU General Public License
7 # along with this program. If not, see <http://www.gnu.org/licenses/>.
12 PATH
="/usr/sbin:/usr/bin:/sbin:/bin"
23 adb_fetch
="/usr/bin/wget"
24 adb_fetchparm
="--quiet --no-cache --no-cookies --max-redirect=0 --timeout=10 --no-check-certificate -O"
26 adb_dnsprefix
="adb_list"
27 adb_dnsfile
="${adb_dnsprefix}.overall"
28 adb_rtfile
="/tmp/adb_runtime.json"
29 adb_action
="${1:-"start"}"
33 # f_envload: load adblock environment
37 local dns_up sys_call sys_desc sys_model sys_ver cnt
=0
39 # get system information
41 sys_call
="$(ubus -S call system board 2>/dev/null)"
42 if [ -n "${sys_call}" ]
44 sys_desc
="$(printf '%s' "${sys_call}" | jsonfilter -e '@.release.description')"
45 sys_model
="$(printf '%s' "${sys_call}" | jsonfilter -e '@.model')"
46 sys_ver
="$(cat /etc/turris-version 2>/dev/null)"
47 if [ -n "${sys_ver}" ]
49 sys_desc
="${sys_desc}/${sys_ver}"
51 adb_sysver
="${sys_model}, ${sys_desc}"
54 # source in system libraries
56 if [ -r "/lib/functions.sh" ] && [ -r "/usr/share/libubox/jshn.sh" ]
59 .
"/usr/share/libubox/jshn.sh"
61 f_log
"error" "system libraries not found"
64 # parse global section by callback
69 if [ "${type}" = "adblock" ]
75 eval "${option}=\"${value}\""
82 # parse 'source' sections
86 local value opt section
="${1}" options
="enabled adb_src adb_src_rset adb_src_cat"
87 eval "adb_sources=\"${adb_sources} ${section}\""
90 config_get value
"${section}" "${opt}"
93 eval "${opt}_${section}=\"${value}\""
101 config_foreach parse_config
source
103 # set/check dns backend environment
107 adb_dnsuser
="${adb_dns}"
108 adb_dnsdir
="${adb_dnsdir:-"/tmp/dnsmasq.d"}"
109 adb_dnsformat
="awk '{print \"local=/\"\$0\"/\"}'"
112 adb_dnsuser
="${adb_dns}"
113 adb_dnsdir
="${adb_dnsdir:-"/var/lib/unbound"}"
114 adb_dnsformat
="awk '{print \"local-zone: \042\"\$0\"\042 static\"}'"
118 adb_dnsdir
="${adb_dnsdir:-"/var/lib/bind"}"
119 adb_dnsformat
="awk '{print \"\"\$0\" IN CNAME .\n*.\"\$0\" IN CNAME .\"}'"
123 adb_dnsdir
="${adb_dnsdir:-"/etc/kresd"}"
124 adb_dnsformat
="awk '{print \"\"\$0\" CNAME .\n*.\"\$0\" CNAME .\"}'"
125 adb_dnsheader
="\$TTL 2h"$
'\n'"@ IN SOA localhost. root.localhost. (2 6h 1h 1w 2h)"$
'\n'" IN NS localhost."
129 adb_dnsdir
="${adb_dnsdir:-"/tmp"}"
130 adb_dnsformat
="awk '{print \$0}'"
134 if [ -d "${adb_dnsdir}" ] && [ ! -f "${adb_dnsdir}/${adb_dnsfile}" ]
136 > "${adb_dnsdir}/${adb_dnsfile}"
139 case "${adb_action}" in
140 start|restart|reload
)
142 if [ "${adb_action}" = "start" ] && [ "${adb_trigger}" = "timed" ]
144 sleep ${adb_triggerdelay}
149 while [ ${cnt} -le 30 ]
151 dns_up
="$(ubus -S call service list "{\"name
\":\"${adb_dns}\"}" 2>/dev/null | jsonfilter -l1 -e "@
[\"${adb_dns}\"].instances.
*.running
" 2>/dev/null)"
152 if [ "${dns_up}" = "true" ]
160 if [ -z "${adb_dns}" ] || [ -z "${adb_dnsformat}" ] || [ ! -x "$(command -v ${adb_dns})" ] || [ ! -d "${adb_dnsdir}" ]
162 f_log
"error" "'${adb_dns}' not running, DNS backend not found"
165 # force dns to local resolver
167 if [ ${adb_forcedns} -eq 1 ] && [ -z "$(uci -q get firewall.adblock_dns)" ]
169 uci
-q set firewall.adblock_dns
="redirect"
170 uci
-q set firewall.adblock_dns.name
="Adblock DNS"
171 uci
-q set firewall.adblock_dns.src
="lan"
172 uci
-q set firewall.adblock_dns.proto
="tcp udp"
173 uci
-q set firewall.adblock_dns.src_dport
="53"
174 uci
-q set firewall.adblock_dns.dest_port
="53"
175 uci
-q set firewall.adblock_dns.target
="DNAT"
176 elif [ ${adb_forcedns} -eq 0 ] && [ -n "$(uci -q get firewall.adblock_dns)" ]
178 uci
-q delete firewall.adblock_dns
180 if [ -n "$(uci -q changes firewall)" ]
182 uci
-q commit firewall
183 if [ $
(/etc
/init.d
/firewall enabled
; printf "%u" ${?}) -eq 0 ]
185 /etc
/init.d
/firewall reload
>/dev
/null
2>&1
190 # f_envcheck: check/set environment prerequisites
196 # check 'enabled' option
198 if [ ${adb_enabled} -ne 1 ]
200 if [ -s "${adb_dnsdir}/${adb_dnsfile}" ]
206 f_log
"info " "adblock is currently disabled, please set adb_enabled to '1' to use this service"
210 # check fetch utility
213 if [ -x "${adb_fetch}" ]
215 if [ "$(readlink -fn "${adb_fetch}")" = "/usr/bin/wget-nossl" ]
217 adb_fetchparm
="--quiet --no-cache --no-cookies --max-redirect=0 --timeout=10 -O"
218 elif [ "$(readlink -fn "${adb_fetch}")" = "/bin/busybox" ] ||
219 ([ "$(readlink -fn "/bin
/wget
")" = "/bin/busybox" ] && [ "$(readlink -fn "${adb_fetch}")" != "/usr/bin/wget" ])
221 adb_fetch
="/bin/busybox"
222 adb_fetchparm
="-q -O"
227 if [ ! -x "${adb_fetch}" ] && [ "$(readlink -fn "/bin
/wget
")" = "/bin/uclient-fetch" ]
229 adb_fetch
="/bin/uclient-fetch"
230 if [ -f "/lib/libustream-ssl.so" ]
232 adb_fetchparm
="-q --timeout=10 --no-check-certificate -O"
233 ssl_lib
="libustream-ssl"
235 adb_fetchparm
="-q --timeout=10 -O"
238 if [ ! -x "${adb_fetch}" ] || [ -z "${adb_fetch}" ] || [ -z "${adb_fetchparm}" ]
240 f_log
"error" "no download utility found, please install 'uclient-fetch' with 'libustream-mbedtls' or the full 'wget' package"
242 adb_fetchinfo
="${adb_fetch##*/} (${ssl_lib})"
244 # create adblock temp file/directory
246 adb_tmpload
="$(mktemp -tu)"
247 adb_tmpfile
="$(mktemp -tu)"
248 adb_tmpdir
="$(mktemp -p /tmp -d)"
250 # prepare whitelist entries
252 if [ -s "${adb_whitelist}" ] && [ -n "${adb_whitelist_rset}" ]
254 awk "${adb_whitelist_rset}" "${adb_whitelist}" > "${adb_tmpdir}/tmp.whitelist"
258 # f_rmtemp: remove temporary files & directories
262 if [ -d "${adb_tmpdir}" ]
264 rm -f "${adb_tmpload}"
265 rm -f "${adb_tmpfile}"
266 rm -rf "${adb_tmpdir}"
270 # f_rmdns: remove dns related files & directories
274 if [ -n "${adb_dns}" ]
276 > "${adb_dnsdir}/${adb_dnsfile}"
278 rm -f "${adb_dnsdir}/.${adb_dnsfile}"
279 rm -f "${adb_backupdir}/${adb_dnsprefix}"*.gz
283 # f_dnsrestart: restart the dns backend
289 "/etc/init.d/${adb_dns}" restart
>/dev
/null
2>&1
290 while [ ${cnt} -le 10 ]
292 dns_up
="$(ubus -S call service list "{\"name
\":\"${adb_dns}\"}" | jsonfilter -l1 -e "@
[\"${adb_dns}\"].instances.
*.running
")"
293 if [ "${dns_up}" = "true" ]
303 # f_list: backup/restore/remove block lists
307 local mode
="${1}" in_rc
="${adb_rc}" cnt
=0
311 cnt
="$(wc -l < "${adb_tmpfile}")"
312 if [ ${adb_backup} -eq 1 ] && [ -d "${adb_backupdir}" ]
314 gzip -cf "${adb_tmpfile}" > "${adb_backupdir}/${adb_dnsprefix}.${src_name}.gz"
319 if [ ${adb_backup} -eq 1 ] && [ -d "${adb_backupdir}" ] &&
320 [ -f "${adb_backupdir}/${adb_dnsprefix}.${src_name}.gz" ]
322 gunzip
-cf "${adb_backupdir}/${adb_dnsprefix}.${src_name}.gz" > "${adb_tmpfile}"
327 if [ -d "${adb_backupdir}" ]
329 rm -f "${adb_backupdir}/${adb_dnsprefix}.${src_name}.gz"
334 if [ -s "${adb_tmpfile}" ]
336 cat "${adb_tmpfile}" >> "${adb_tmpdir}/${adb_dnsfile}"
341 if [ -s "${adb_tmpdir}/tmp.whitelist" ]
343 grep -vf "${adb_tmpdir}/tmp.whitelist" "${adb_tmpdir}/${adb_dnsfile}" | eval "${adb_dnsformat}" > "${adb_dnsdir}/${adb_dnsfile}"
345 eval "${adb_dnsformat}" "${adb_tmpdir}/${adb_dnsfile}" > "${adb_dnsdir}/${adb_dnsfile}"
347 if [ -n "${adb_dnsheader}" ]
349 printf '%s\n' "${adb_dnsheader}" | cat - "${adb_dnsdir}/${adb_dnsfile}" > "${adb_tmpdir}/${adb_dnsfile}"
350 cat "${adb_tmpdir}/${adb_dnsfile}" > "${adb_dnsdir}/${adb_dnsfile}"
355 f_log
"debug" "name: ${src_name}, mode: ${mode}, count: ${cnt}, in_rc: ${in_rc}, out_rc: ${adb_rc}"
358 # f_tldcompression: top level domain compression
362 local source="${1}" temp
="${adb_tmpload}"
364 awk -F "." '{for(f=NF;f > 1;f--) printf "%s.", $f;print $1}' "${source}" 2>/dev
/null |
sort -u > "${temp}"
365 awk '{if(NR==1){tld=$NF};while(getline){if($NF !~ tld"\\."){print tld;tld=$NF}}print tld}' "${temp}" 2>/dev
/null
> "${source}"
366 awk -F "." '{for(f=NF;f > 1;f--) printf "%s.", $f;print $1}' "${source}" 2>/dev
/null
> "${temp}"
367 sort -u "${temp}" > "${source}"
370 # f_switch: suspend/resume adblock processing
374 local source target status mode
="${1}"
376 if [ -s "${adb_dnsdir}/${adb_dnsfile}" ] && [ "${mode}" = "suspend" ]
378 source="${adb_dnsdir}/${adb_dnsfile}"
379 target
="${adb_dnsdir}/.${adb_dnsfile}"
381 elif [ -s "${adb_dnsdir}/.${adb_dnsfile}" ] && [ "${mode}" = "resume" ]
383 source="${adb_dnsdir}/.${adb_dnsfile}"
384 target
="${adb_dnsdir}/${adb_dnsfile}"
387 if [ -n "${status}" ]
389 cat "${source}" > "${target}"
393 f_log
"info " "adblock processing ${status}"
397 # f_query: query block list for certain (sub-)domains
401 local search result cnt
403 local tld
="${domain#*.}"
405 if [ ! -s "${adb_dnsdir}/${adb_dnsfile}" ]
407 printf "%s\n" "::: no active block list found, please start / resume adblock first"
408 elif [ -z "${domain}" ] || [ "${domain}" = "${tld}" ]
410 printf "%s\n" "::: invalid domain input, please submit a single domain, e.g. 'doubleclick.net'"
413 while [ "${domain}" != "${tld}" ]
415 search
="${domain//./\.}"
416 if [ "${adb_dns}" = "dnsmasq" ] ||
[ "${adb_dns}" = "unbound" ]
418 result
="$(awk -F '/|\"' "/[\
/\"\.
]${search}/{i
++;{printf(\" + %s
\n\",\
$2)};if(i
>9){exit}}" "${adb_dnsfile}")"
420 result
="$(awk "/(^
[^\
*][a-z
]*[\.
]+${search}|^${search})/{i++;{printf(\" + %s\n\",\$1)};if(i
>9){exit}}" "${adb_dnsfile}")"
422 printf "%s\n" "::: max. ten results for domain '${domain}'"
423 printf "%s\n" "${result:-" - no match"}"
430 # f_jsnupdate: update runtime information
434 local status rundate
="$(/bin/date "+%d.
%m.
%Y
%H
:%M
:%S
")"
436 if [ ${adb_rc} -gt 0 ]
439 elif [ ${adb_enabled} -ne 1 ]
442 elif [ -s "${adb_dnsdir}/.${adb_dnsfile}" ]
447 if [ -s "${adb_dnsdir}/${adb_dnsfile}" ]
449 if [ "${adb_dns}" = "named" ] ||
[ "${adb_dns}" = "kresd" ]
451 adb_cnt
="$(( ( $(wc -l < "${adb_dnsdir}/${adb_dnsfile}") - $(printf "%s" "${adb_dnsheader}" | grep -c "^
") ) / 2 ))"
453 adb_cnt
="$(( $(wc -l < "${adb_dnsdir}/${adb_dnsfile}") - $(printf "%s" "${adb_dnsheader}" | grep -c "^
") ))"
458 if [ -z "${adb_fetchinfo}" ] && [ -s "${adb_rtfile}" ]
460 json_load
"$(cat "${adb_rtfile}" 2>/dev/null)"
462 json_get_var adb_fetchinfo
"fetch_utility"
466 json_add_object
"data"
467 json_add_string
"adblock_status" "${status}"
468 json_add_string
"adblock_version" "${adb_ver}"
469 json_add_string
"blocked_domains" "${adb_cnt}"
470 json_add_string
"fetch_utility" "${adb_fetchinfo}"
471 json_add_string
"dns_backend" "${adb_dns} (${adb_dnsdir})"
472 json_add_string
"last_rundate" "${rundate}"
473 json_add_string
"system_release" "${adb_sysver}"
475 json_dump
> "${adb_rtfile}"
478 # f_status: output runtime information
482 local key keylist value
484 if [ -s "${adb_rtfile}" ]
486 printf "%s\n" "::: adblock runtime information"
487 json_load
"$(cat "${adb_rtfile}" 2>/dev/null)"
489 json_get_keys keylist
490 for key
in ${keylist}
492 json_get_var value
"${key}"
493 printf " + %-15s : %s\n" "${key}" "${value}"
498 # f_log: write to syslog, exit on error
502 local class
="${1}" log_msg
="${2}"
504 if [ -n "${log_msg}" ] && ([ "${class}" != "debug" ] || [ ${adb_debug} -eq 1 ])
506 logger -t "adblock-
[${adb_ver}] ${class}" "${log_msg}"
507 if [ "${class}" = "error
" ]
509 logger -t "adblock-
[${adb_ver}] ${class}" "Please check 'https://github.com/openwrt/packages/blob/master/net/adblock/files/README.md' (${adb_sysver})"
511 if [ -s "${adb_dnsdir}/${adb_dnsfile}" ]
523 # main function for block list processing
527 local src_name src_rset shalla_archive enabled url hash_old hash_new
528 local mem_total="$
(awk '/^MemTotal/ {print int($2/1000)}' "/proc/meminfo")"
530 f_log "info
" "start adblock processing ...
"
531 f_log "debug
" "action
: ${adb_action}, manual_mode:${adb_manmode}, backup: ${adb_backup}, dns: ${adb_dns}, fetch: ${adb_fetchinfo}, mem_total: ${mem_total}, force_srt/_dns: ${adb_forcesrt}/${adb_forcedns}"
533 for src_name in ${adb_sources}
535 eval "enabled
=\"\
${enabled_${src_name}}\""
536 eval "url
=\"\
${adb_src_${src_name}}\""
537 eval "src_rset
=\"\
${adb_src_rset_${src_name}}\""
544 f_log "debug
" "name
: ${src_name}, enabled: ${enabled}, url: ${url}, rset: ${src_rset}"
545 if [ "${enabled}" != "1" ] || [ -z "${url}" ] || [ -z "${src_rset}" ]
551 # manual / backup mode
553 if [ ${adb_manmode} -eq 1 ] && [ "${adb_action}" = "start" ] && [ "${src_name}" != "blacklist" ]
556 if [ ${adb_rc} -eq 0 ] && [ -s "${adb_tmpfile}" ]
563 # download block list
565 if [ "${src_name}" = "blacklist" ] && [ -s "${url}" ]
567 cat "${url}" > "${adb_tmpload}"
569 elif [ "${src_name}" = "shalla" ]
571 shalla_archive
="${adb_tmpdir}/shallalist.tar.gz"
572 "${adb_fetch}" ${adb_fetchparm} "${shalla_archive}" "${url}" 2>/dev
/null
574 if [ ${adb_rc} -eq 0 ]
576 for category
in ${adb_src_cat_shalla}
578 tar -xOzf "${shalla_archive}" "BL/${category}/domains" >> "${adb_tmpload}"
580 if [ ${adb_rc} -ne 0 ]
586 rm -f "${shalla_archive}"
587 rm -rf "${adb_tmpdir}/BL"
589 "${adb_fetch}" ${adb_fetchparm} "${adb_tmpload}" "${url}" 2>/dev
/null
593 # check download result and prepare list output (incl. tld compression, list backup & restore)
595 if [ ${adb_rc} -eq 0 ] && [ -s "${adb_tmpload}" ]
597 awk "${src_rset}" "${adb_tmpload}" 2>/dev/null > "${adb_tmpfile}"
598 if [ -s "${adb_tmpfile}" ]
600 f_tldcompression
"${adb_tmpfile}"
601 if [ "${src_name}" != "blacklist" ]
614 if [ ${adb_rc} -eq 0 ] && [ -s "${adb_tmpfile}" ]
617 if [ ${adb_rc} -ne 0 ]
626 # hash preparation, whitelist removal and overall sort
628 if [ -f "${adb_dnsdir}/${adb_dnsfile}" ]
630 hash_old
="$(sha256sum "${adb_dnsdir}/${adb_dnsfile}" 2>/dev/null | awk '{print $1}')"
632 if [ -s "${adb_tmpdir}/${adb_dnsfile}" ]
634 if [ ${mem_total} -ge 64 ] || [ ${adb_forcesrt} -eq 1 ]
636 f_tldcompression "${adb_tmpdir}/${adb_dnsfile}"
640 > "${adb_dnsdir}/${adb_dnsfile}"
642 chown "${adb_dnsuser}" "${adb_dnsdir}/${adb_dnsfile}" 2>/dev/null
645 # conditional restart of the dns backend and runtime information export
647 hash_new="$(sha256sum "${adb_dnsdir}/${adb_dnsfile}" 2>/dev/null | awk '{print $1}')"
648 if [ -z "${hash_old}" ] || [ -z "${hash_new}" ] || [ "${hash_old}" != "${hash_new}" ]
654 f_jsnupdate "${adb_cnt}"
655 f_log "info
" "block list with overall
${adb_cnt} domains loaded successfully
(${adb_sysver})"
657 f_log "error
" "dns backend restart with active block list failed
"
661 # handle different adblock actions
664 case "${adb_action}" in