2 # dns based ad/abuse domain blocking
3 # written by Dirk Brenken (dev@brenken.org)
5 # This is free software, licensed under the GNU General Public License v3.
6 # You should have received a copy of the GNU General Public License
7 # along with this program. If not, see <http://www.gnu.org/licenses/>.
12 PATH
="/usr/sbin:/usr/bin:/sbin:/bin"
14 adb_sysver
="$(ubus -S call system board | jsonfilter -e '@.release.description')"
23 adb_whitelist
="/etc/adblock/adblock.whitelist"
24 adb_whitelist_rset
="\$1 ~/^([A-Za-z0-9_-]+\.){1,}[A-Za-z]+/{print tolower(\"^\"\$1\"\\\|[.]\"\$1)}"
25 adb_fetch
="/usr/bin/wget"
26 adb_fetchparm
="--quiet --no-cache --no-cookies --max-redirect=0 --timeout=10 --no-check-certificate -O"
27 adb_dnslist
="dnsmasq unbound named kresd"
28 adb_dnsprefix
="adb_list"
29 adb_dnsfile
="${adb_dnsprefix}.overall"
30 adb_rtfile
="/tmp/adb_runtime.json"
35 # f_envload: load adblock environment
39 local services dns_up cnt
=0
41 # source in system libraries
43 if [ -r "/lib/functions.sh" ] && [ -r "/usr/share/libubox/jshn.sh" ]
46 .
"/usr/share/libubox/jshn.sh"
48 f_log
"error" "system libraries not found"
51 # parse global section by callback
56 if [ "${type}" = "adblock" ]
62 eval "${option}=\"${value}\""
69 # parse 'source' sections
73 local value opt section
="${1}" options
="enabled adb_src adb_src_rset adb_src_cat"
74 eval "adb_sources=\"${adb_sources} ${section}\""
77 config_get value
"${section}" "${opt}"
80 eval "${opt}_${section}=\"${value}\""
88 config_foreach parse_config
source
90 # set dns backend environment
92 while [ ${cnt} -le 20 ]
94 services
="$(ubus -S call service list 2>/dev/null)"
95 if [ -n "${services}" ]
97 for dns
in ${adb_dnslist}
99 dns_up
="$(printf "%s
" "${services}" | jsonfilter -l1 -e "@.
${dns}.instances.
*.running
")"
100 if [ "${dns_up}" = "true" ]
105 adb_dnsdir
="${adb_dnsdir:="/tmp/dnsmasq.d"}"
106 adb_dnshidedir
="${adb_dnsdir}/.adb_hidden"
107 adb_dnsformat
="awk '{print \"local=/\"\$0\"/\"}'"
112 adb_dnsdir
="${adb_dnsdir:="/var/lib/unbound"}"
113 adb_dnshidedir
="${adb_dnsdir}/.adb_hidden"
114 adb_dnsformat
="awk '{print \"local-zone: \042\"\$0\"\042 static\"}'"
119 adb_dnsdir
="${adb_dnsdir:="/var/lib/bind"}"
120 adb_dnshidedir
="${adb_dnsdir}/.adb_hidden"
121 adb_dnsformat
="awk '{print \"\"\$0\" IN CNAME .\n*.\"\$0\" IN CNAME .\"}'"
126 adb_dnsdir
="${adb_dnsdir:="/tmp/kresd"}"
127 adb_dnshidedir
="${adb_dnsdir}/.adb_hidden"
128 adb_dnsformat
="awk '{print \"\"\$0\" CNAME .\n*.\"\$0\" CNAME .\"}'"
138 if [ -z "${adb_dns}" ] || [ -z "${adb_dnsformat}" ] || [ ! -x "$(command -v ${adb_dns})" ] || [ ! -d "${adb_dnsdir}" ]
140 f_log
"error" "no active/supported DNS backend found"
143 # force dns to local resolver
145 if [ ${adb_forcedns} -eq 1 ] && [ -z "$(uci -q get firewall.adblock_dns)" ]
147 uci
-q set firewall.adblock_dns
="redirect"
148 uci
-q set firewall.adblock_dns.name
="Adblock DNS"
149 uci
-q set firewall.adblock_dns.src
="lan"
150 uci
-q set firewall.adblock_dns.proto
="tcp udp"
151 uci
-q set firewall.adblock_dns.src_dport
="53"
152 uci
-q set firewall.adblock_dns.dest_port
="53"
153 uci
-q set firewall.adblock_dns.target
="DNAT"
154 elif [ ${adb_forcedns} -eq 0 ] && [ -n "$(uci -q get firewall.adblock_dns)" ]
156 uci
-q delete firewall.adblock_dns
158 if [ -n "$(uci -q changes firewall)" ]
160 uci
-q commit firewall
161 if [ $
(/etc
/init.d
/firewall enabled
; printf "%u" ${?}) -eq 0 ]
163 /etc
/init.d
/firewall reload
>/dev
/null
2>&1
168 # f_envcheck: check/set environment prerequisites
174 # check 'enabled' option
176 if [ ${adb_enabled} -ne 1 ]
178 if [ -s "${adb_dnsdir}/${adb_dnsfile}" ]
183 f_log
"info " "adblock is currently disabled, please set adb_enabled to '1' to use this service"
187 # check fetch utility
190 if [ -x "${adb_fetch}" ]
192 if [ "$(readlink -fn "${adb_fetch}")" = "/usr/bin/wget-nossl" ]
194 adb_fetchparm
="--quiet --no-cache --no-cookies --max-redirect=0 --timeout=10 -O"
195 elif [ "$(readlink -fn "/bin
/wget
")" = "/bin/busybox" ] ||
[ "$(readlink -fn "${adb_fetch}")" = "/bin/busybox" ]
197 adb_fetch
="/bin/busybox"
198 adb_fetchparm
="-q -O"
203 if [ ! -x "${adb_fetch}" ] && [ "$(readlink -fn "/bin
/wget
")" = "/bin/uclient-fetch" ]
205 adb_fetch
="/bin/uclient-fetch"
206 if [ -f "/lib/libustream-ssl.so" ]
208 adb_fetchparm
="-q --timeout=10 --no-check-certificate -O"
209 ssl_lib
="libustream-ssl"
211 adb_fetchparm
="-q --timeout=10 -O"
214 if [ ! -x "${adb_fetch}" ] || [ -z "${adb_fetch}" ] || [ -z "${adb_fetchparm}" ]
216 f_log
"error" "no download utility found, please install 'uclient-fetch' with 'libustream-mbedtls' or the full 'wget' package"
218 adb_fetchinfo
="${adb_fetch##*/} (${ssl_lib})"
220 # create dns hideout directory
222 if [ ! -d "${adb_dnshidedir}" ]
224 mkdir
-p -m 660 "${adb_dnshidedir}"
225 chown
-R "${adb_dns}":"${adb_dns}" "${adb_dnshidedir}" 2>/dev
/null
227 rm -f "${adb_dnshidedir}/${adb_dnsprefix}"*
230 # create adblock temp file/directory
232 adb_tmpload
="$(mktemp -tu)"
233 adb_tmpfile
="$(mktemp -tu)"
234 adb_tmpdir
="$(mktemp -p /tmp -d)"
236 # prepare whitelist entries
238 if [ -s "${adb_whitelist}" ]
240 awk "${adb_whitelist_rset}" "${adb_whitelist}" > "${adb_tmpdir}/tmp.whitelist"
244 # f_rmtemp: remove temporary files & directories
248 if [ -d "${adb_tmpdir}" ]
250 rm -f "${adb_tmpload}"
251 rm -f "${adb_tmpfile}"
252 rm -rf "${adb_tmpdir}"
256 # f_rmdns: remove dns related files & directories
260 if [ -n "${adb_dns}" ]
262 rm -f "${adb_dnsdir}/${adb_dnsprefix}"*
263 rm -f "${adb_backupdir}/${adb_dnsprefix}"*.gz
264 rm -rf "${adb_dnshidedir}"
269 # f_dnsrestart: restart the dns backend
273 local dns_up mem_free cnt
=0
275 "/etc/init.d/${adb_dns}" restart
>/dev
/null
2>&1
276 while [ ${cnt} -le 10 ]
278 dns_up
="$(ubus -S call service list "{\"name
\":\"${adb_dns}\"}" | jsonfilter -l1 -e "@.
${adb_dns}.instances.
*.running
")"
279 if [ "${dns_up}" = "true" ]
281 mem_free
="$(awk '/^MemFree/ {print int($2/1000)}' "/proc
/meminfo
")"
282 if [ ${mem_free} -ge ${adb_minfree} ]
293 # f_list: backup/restore/remove block lists
297 local mode
="${1}" in_rc
="${adb_rc}" cnt
=0
301 cnt
="$(wc -l < "${adb_tmpfile}")"
302 if [ ${adb_backup} -eq 1 ] && [ -d "${adb_backupdir}" ]
304 gzip -cf "${adb_tmpfile}" > "${adb_backupdir}/${adb_dnsprefix}.${src_name}.gz"
309 if [ ${adb_backup} -eq 1 ] && [ -d "${adb_backupdir}" ] &&
310 [ -f "${adb_backupdir}/${adb_dnsprefix}.${src_name}.gz" ]
312 gunzip
-cf "${adb_backupdir}/${adb_dnsprefix}.${src_name}.gz" > "${adb_tmpfile}"
317 if [ -d "${adb_backupdir}" ]
319 rm -f "${adb_backupdir}/${adb_dnsprefix}.${src_name}.gz"
324 if [ -s "${adb_tmpfile}" ]
326 cat "${adb_tmpfile}" >> "${adb_tmpdir}/${adb_dnsfile}"
331 if [ -s "${adb_tmpdir}/tmp.whitelist" ]
333 grep -vf "${adb_tmpdir}/tmp.whitelist" "${adb_tmpdir}/${adb_dnsfile}" | eval "${adb_dnsformat}" > "${adb_dnsdir}/${adb_dnsfile}"
335 eval "${adb_dnsformat}" "${adb_tmpdir}/${adb_dnsfile}" > "${adb_dnsdir}/${adb_dnsfile}"
340 f_log
"debug" "name: ${src_name}, mode: ${mode}, count: ${cnt}, in_rc: ${in_rc}, out_rc: ${adb_rc}"
343 # f_tldcompression: top level domain compression
347 local source="${1}" temp
="${adb_tmpload}"
349 awk -F "." '{for(f=NF;f > 1;f--) printf "%s.", $f;print $1}' "${source}" 2>/dev
/null |
sort -u > "${temp}"
350 awk '{if(NR==1){tld=$NF};while(getline){if($NF !~ tld"\\."){print tld;tld=$NF}}print tld}' "${temp}" 2>/dev
/null
> "${source}"
351 awk -F "." '{for(f=NF;f > 1;f--) printf "%s.", $f;print $1}' "${source}" 2>/dev
/null
> "${temp}"
352 sort -u "${temp}" > "${source}"
355 # f_switch: suspend/resume adblock processing
359 local source target status mode
="${1}"
361 if [ -d "${adb_dnshidedir}" ]
363 if [ -s "${adb_dnsdir}/${adb_dnsfile}" ] && [ "${mode}" = "suspend" ]
365 source="${adb_dnsdir}/${adb_dnsfile}"
366 target
="${adb_dnshidedir}"
368 elif [ -s "${adb_dnshidedir}/${adb_dnsfile}" ] && [ "${mode}" = "resume" ]
370 source="${adb_dnshidedir}/${adb_dnsfile}"
371 target
="${adb_dnsdir}"
374 if [ -n "${status}" ]
376 mv -f "${source}"* "${target}"
378 f_log
"info " "adblock processing ${status}"
383 # f_query: query block list for certain (sub-)domains
387 local search result cnt
389 local tld
="${domain#*.}"
391 if [ ! -s "${adb_dnsdir}/${adb_dnsfile}" ]
393 printf "%s\n" "::: no active block list found, please start / resume adblock first"
394 elif [ -z "${domain}" ] || [ "${domain}" = "${tld}" ]
396 printf "%s\n" "::: invalid domain input, please submit a specific (sub-)domain, e.g. 'www.abc.xyz'"
399 while [ "${domain}" != "${tld}" ]
401 search
="${domain//./\.}"
402 result
="$(grep -Hm5 "[/\"\.
]${search}[/\"]" "${adb_dnsfile}" | awk -F ':|=|/|\"' '{printf(" + %s\n",$4)}')"
403 printf "%s\n" "::: results for (sub-)domain '${domain}' (max. 5)"
404 printf "%s\n" "${result:=" - no match"}"
411 # f_status: output runtime information
415 local key keylist value
417 if [ -s "${adb_rtfile}" ]
419 if [ -s "${adb_dnsdir}/${adb_dnsfile}" ]
423 value="no domains blocked"
425 printf "%s\n" "::: adblock runtime information"
426 printf " %-15s : %s\n" "status" "${value}"
427 json_load "$(cat "${adb_rtfile}" 2>/dev/null)"
429 json_get_keys keylist
430 for key in ${keylist}
432 json_get_var value "${key}"
433 printf " %-15s : %s\n" "${key}" "${value}"
438 # f_log: write to syslog, exit on error
442 local class="${1}" log_msg="${2}"
444 if [ -n "${log_msg}" ] && ([ "${class}" != "debug" ] || [ ${adb_debug} -eq 1 ])
446 logger -t "adblock-[${adb_ver}] ${class}" "${log_msg}"
447 if [ "${class}" = "error" ]
449 logger -t "adblock-[${adb_ver}] ${class}" "Please check 'https://github.com/openwrt/packages/blob/master/net/adblock/files/README.md' (${adb_sysver})"
451 if [ -s "${adb_dnsdir}/${adb_dnsfile}" ]
461 # main function for block list processing
465 local src_name src_rset shalla_archive enabled url hash_old hash_new cnt=0
466 local mem_total="$(awk '/^MemTotal
/ {print int
($2/1000)}' "/proc/meminfo")"
468 f_log "info " "start adblock processing ..."
469 f_log "debug" "action: ${adb_action}, manual_mode:${adb_manmode}, backup: ${adb_backup}, dns: ${adb_dns}, fetch: ${adb_fetchinfo}, mem_total: ${mem_total}, force_srt/_dns: ${adb_forcesrt}/${adb_forcedns}"
471 for src_name in ${adb_sources}
473 eval "enabled=\"\${enabled_${src_name}}\""
474 eval "url=\"\${adb_src_${src_name}}\""
475 eval "src_rset=\"\${adb_src_rset_${src_name}}\""
482 f_log "debug" "name: ${src_name}, enabled: ${enabled}, url: ${url}, rset: ${src_rset}"
483 if [ "${enabled}" != "1" ] || [ -z "${url}" ] || [ -z "${src_rset}" ]
489 # manual / backup mode
491 if [ ${adb_manmode} -eq 1 ] && [ -z "${adb_action}" ] && [ "${src_name}" != "blacklist" ]
494 if [ ${adb_rc} -eq 0 ] && [ -s "${adb_tmpfile}" ]
501 # download block list
503 if [ "${src_name}" = "blacklist" ] && [ -s "${url}" ]
505 cat "${url}" > "${adb_tmpload}"
507 elif [ "${src_name}" = "shalla" ]
509 shalla_archive="${adb_tmpdir}/shallalist.tar.gz"
510 "${adb_fetch}" ${adb_fetchparm} "${shalla_archive}" "${url}" 2>/dev/null
512 if [ ${adb_rc} -eq 0 ]
514 for category in ${adb_src_cat_shalla}
516 tar -xOzf "${shalla_archive}" "BL/${category}/domains" >> "${adb_tmpload}"
518 if [ ${adb_rc} -ne 0 ]
524 rm -f "${shalla_archive}"
525 rm -rf "${adb_tmpdir}/BL"
527 "${adb_fetch}" ${adb_fetchparm} "${adb_tmpload}" "${url}" 2>/dev/null
531 # check download result and prepare list output (incl. tld compression, list backup & restore)
533 if [ ${adb_rc} -eq 0 ] && [ -s "${adb_tmpload}" ]
535 awk "${src_rset}" "${adb_tmpload}" 2>/dev/null > "${adb_tmpfile}"
536 if [ -s "${adb_tmpfile}" ]
538 f_tldcompression "${adb_tmpfile}"
549 if [ ${adb_rc} -eq 0 ] && [ -s "${adb_tmpfile}" ]
552 if [ ${adb_rc} -ne 0 ]
561 # hash preparation, whitelist removal and overall sort
563 if [ -f "${adb_dnsdir}/${adb_dnsfile}" ]
565 hash_old="$(sha256sum "${adb_dnsdir}/${adb_dnsfile}" | awk '{print $1}')"
567 if [ -s "${adb_tmpdir}/${adb_dnsfile}" ]
569 if [ ${mem_total} -ge 64 ] || [ ${adb_forcesrt} -eq 1 ]
571 f_tldcompression "${adb_tmpdir}/${adb_dnsfile}"
575 > "${adb_dnsdir}/${adb_dnsfile}"
577 hash_new="$
(sha256sum
"${adb_dnsdir}/${adb_dnsfile}" | awk '{print $1}')"
578 cnt
="$(wc -l < "${adb_dnsdir}/${adb_dnsfile}")"
580 # conditional restart of the dns backend and runtime information export
582 chown
"${adb_dns}":"${adb_dns}" "${adb_dnsdir}/${adb_dnsfile}" 2>/dev
/null
584 if [ "${hash_old}" != "${hash_new}" ]
591 json_add_object
"data"
592 json_add_string
"adblock_version" "${adb_ver}"
593 json_add_string
"blocked_domains" "${cnt}"
594 json_add_string
"fetch_info" "${adb_fetchinfo}"
595 json_add_string
"dns_backend" "${adb_dns}"
596 json_add_string
"last_rundate" "$(/bin/date "+%d.
%m.
%Y
%H
:%M
:%S
")"
597 json_add_string
"system" "${adb_sysver}"
599 json_dump
> "${adb_rtfile}"
600 f_log
"info " "block list with overall ${cnt} domains loaded successfully (${adb_sysver})"
602 f_log
"error" "dns backend restart with active block list failed"
606 # handle different adblock actions
609 case "${adb_action}" in