2 # dns based ad/abuse domain blocking
3 # written by Dirk Brenken (dev@brenken.org)
5 # This is free software, licensed under the GNU General Public License v3.
6 # You should have received a copy of the GNU General Public License
7 # along with this program. If not, see <http://www.gnu.org/licenses/>.
12 PATH
="/usr/sbin:/usr/bin:/sbin:/bin"
14 adb_sysver
="$(ubus -S call system board | jsonfilter -e '@.release.description')"
21 adb_whitelist
="/etc/adblock/adblock.whitelist"
22 adb_whitelist_rset
="\$1 ~/^([A-Za-z0-9_-]+\.){1,}[A-Za-z]+/{print tolower(\"^\"\$1\"\\\|[.]\"\$1)}"
23 adb_fetch
="/usr/bin/wget"
24 adb_fetchparm
="--no-config --quiet --no-cache --no-cookies --max-redirect=0 --timeout=10 --no-check-certificate -O"
25 adb_dnslist
="dnsmasq unbound"
26 adb_dnsprefix
="adb_list"
27 adb_rtfile
="/tmp/adb_runtime.json"
32 # f_envload: load adblock environment
38 # source in system library
40 if [ -r "/lib/functions.sh" ] && [ -r "/usr/share/libubox/jshn.sh" ]
43 .
"/usr/share/libubox/jshn.sh"
45 f_log
"error" "system libraries not found"
48 # set dns backend environment
50 while [ ${cnt} -le 20 ]
52 for dns
in ${adb_dnslist}
54 dns_up
="$(ubus -S call service list "{\"name
\":\"${dns}\"}" | jsonfilter -l1 -e "@.
${dns}.instances.
*.running
")"
55 if [ "${dns_up}" = "true" ]
60 adb_dnsdir
="/tmp/dnsmasq.d"
61 adb_dnshidedir
="${adb_dnsdir}/.adb_hidden"
62 adb_dnsformat
="awk '{print \"local=/\"\$0\"/\"}'"
67 adb_dnsdir
="/var/lib/unbound"
68 adb_dnshidedir
="${adb_dnsdir}/.adb_hidden"
69 adb_dnsformat
="awk '{print \"local-zone: \042\"\$0\"\042 static\"}'"
79 # parse global section by callback
84 if [ "${type}" = "adblock" ]
90 eval "${option}=\"${value}\""
97 # parse 'source' section
101 local value opt section
="${1}" options
="enabled adb_src adb_src_rset adb_src_cat"
102 eval "adb_sources=\"${adb_sources} ${section}\""
103 for opt
in ${options}
105 config_get value
"${section}" "${opt}"
108 eval "${opt}_${section}=\"${value}\""
113 # load adblock config
116 config_foreach parse_config
source
118 if [ -z "${adb_dns}" ] || [ -z "${adb_dnsformat}" ] || [ ! -x "$(command -v ${adb_dns})" ] || [ ! -d "${adb_dnsdir}" ]
120 f_log
"error" "no active/supported DNS backend found"
123 # force dns to local resolver
125 if [ ${adb_forcedns} -eq 1 ] && [ -z "$(uci -q get firewall.adblock_dns)" ]
127 uci
-q set firewall.adblock_dns
="redirect"
128 uci
-q set firewall.adblock_dns.name
="Adblock DNS"
129 uci
-q set firewall.adblock_dns.src
="lan"
130 uci
-q set firewall.adblock_dns.proto
="tcp udp"
131 uci
-q set firewall.adblock_dns.src_dport
="53"
132 uci
-q set firewall.adblock_dns.dest_port
="53"
133 uci
-q set firewall.adblock_dns.target
="DNAT"
134 elif [ ${adb_forcedns} -eq 0 ] && [ -n "$(uci -q get firewall.adblock_dns)" ]
136 uci
-q delete firewall.adblock_dns
138 if [ -n "$(uci -q changes firewall)" ]
140 uci
-q commit firewall
141 if [ $
(/etc
/init.d
/firewall enabled
; printf "%u" ${?}) -eq 0 ]
143 /etc
/init.d
/firewall reload
>/dev
/null
2>&1
148 # f_envcheck: check/set environment prerequisites
154 # check 'enabled' option
156 if [ ${adb_enabled} -ne 1 ]
158 if [ -n "$(ls -dA "${adb_dnsdir}/${adb_dnsprefix}"* 2>/dev/null)" ]
163 f_log
"info " "adblock is currently disabled, please set adb_enabled to '1' to use this service"
167 # check fetch utility
170 if [ -x "${adb_fetch}" ]
172 if [ "$(readlink -fn "${adb_fetch}")" = "/usr/bin/wget-nossl" ]
174 adb_fetchparm
="--no-config --quiet --no-cache --no-cookies --max-redirect=0 --timeout=10 -O"
175 elif [ "$(readlink -fn "/bin
/wget
")" = "/bin/busybox" ] ||
[ "$(readlink -fn "${adb_fetch}")" = "/bin/busybox" ]
177 adb_fetch
="/bin/busybox"
178 adb_fetchparm
="-q -O"
183 if [ ! -x "${adb_fetch}" ] && [ "$(readlink -fn "/bin
/wget
")" = "/bin/uclient-fetch" ]
185 adb_fetch
="/bin/uclient-fetch"
186 if [ -f "/lib/libustream-ssl.so" ]
188 adb_fetchparm
="-q --timeout=10 --no-check-certificate -O"
189 ssl_lib
="libustream-ssl"
191 adb_fetchparm
="-q --timeout=10 -O"
194 if [ ! -x "${adb_fetch}" ] || [ -z "${adb_fetch}" ] || [ -z "${adb_fetchparm}" ]
196 f_log
"error" "no download utility found, please install 'uclient-fetch' with 'libustream-mbedtls' or the full 'wget' package"
198 adb_fetchinfo
="${adb_fetch##*/} (${ssl_lib})"
200 # create dns hideout directory
202 if [ ! -d "${adb_dnshidedir}" ]
204 mkdir
-p -m 660 "${adb_dnshidedir}"
205 chown
-R "${adb_dns}":"${adb_dns}" "${adb_dnshidedir}" 2>/dev
/null
207 rm -f "${adb_dnshidedir}/${adb_dnsprefix}"*
210 # create adblock temp file/directory
212 adb_tmpload
="$(mktemp -tu)"
213 adb_tmpfile
="$(mktemp -tu)"
214 adb_tmpdir
="$(mktemp -p /tmp -d)"
216 # prepare whitelist entries
218 if [ -s "${adb_whitelist}" ]
220 awk "${adb_whitelist_rset}" "${adb_whitelist}" > "${adb_tmpdir}/tmp.whitelist"
224 # f_rmtemp: remove temporary files & directories
228 if [ -d "${adb_tmpdir}" ]
230 rm -f "${adb_tmpload}"
231 rm -f "${adb_tmpfile}"
232 rm -rf "${adb_tmpdir}"
236 # f_rmdns: remove dns related files & directories
240 if [ -n "${adb_dns}" ]
242 rm -f "${adb_dnsdir}/${adb_dnsprefix}"*
243 rm -f "${adb_backupdir}/${adb_dnsprefix}"*.gz
244 rm -rf "${adb_dnshidedir}"
249 # f_dnsrestart: restart the dns backend
255 "/etc/init.d/${adb_dns}" restart
>/dev
/null
2>&1
256 while [ ${cnt} -le 10 ]
258 adb_dnsup
="$(ubus -S call service list "{\"name
\":\"${adb_dns}\"}" | jsonfilter -l1 -e "@.
${adb_dns}.instances.
*.running
")"
259 if [ "${adb_dnsup}" = "true" ]
268 # f_list: backup/restore/remove block lists
272 local mode
="${1}" in_rc
="${adb_rc}" cnt
=0
276 cnt
="$(wc -l < "${adb_tmpfile}")"
277 if [ ${adb_backup} -eq 1 ] && [ -d "${adb_backupdir}" ]
279 gzip -cf "${adb_tmpfile}" > "${adb_backupdir}/${adb_dnsprefix}.${src_name}.gz"
284 if [ ${adb_backup} -eq 1 ] && [ -d "${adb_backupdir}" ]
286 rm -f "${adb_dnsdir}/${adb_dnsprefix}.${src_name}"
287 if [ -f "${adb_backupdir}/${adb_dnsprefix}.${src_name}.gz" ]
289 gunzip
-cf "${adb_backupdir}/${adb_dnsprefix}.${src_name}.gz" > "${adb_tmpfile}"
295 rm -f "${adb_dnsdir}/${adb_dnsprefix}.${src_name}"
296 if [ -d "${adb_backupdir}" ]
298 rm -f "${adb_backupdir}/${adb_dnsprefix}.${src_name}.gz"
303 f_log
"debug" "name: ${src_name}, mode: ${mode}, count: ${cnt}, in_rc: ${in_rc}, out_rc: ${adb_rc}"
306 # f_switch: suspend/resume adblock processing
310 if [ -d "${adb_dnshidedir}" ]
312 local source target status mode
="${1}"
313 local dns_active
="$(find "${adb_dnsdir}" -maxdepth 1 -type f -name "${adb_dnsprefix}*" -print)"
314 local dns_passive
="$(find "${adb_dnshidedir}" -maxdepth 1 -type f -name "${adb_dnsprefix}*" -print)"
316 if [ -n "${dns_active}" ] && [ "${mode}" = "suspend" ]
318 source="${adb_dnsdir}/${adb_dnsprefix}"
319 target
="${adb_dnshidedir}"
321 elif [ -n "${dns_passive}" ] && [ "${mode}" = "resume" ]
323 source="${adb_dnshidedir}/${adb_dnsprefix}"
324 target
="${adb_dnsdir}"
327 if [ -n "${status}" ]
329 mv -f "${source}"* "${target}"
331 f_log
"info " "adblock processing ${status}"
336 # f_query: query block lists for certain (sub-)domains
340 local search result cnt
342 local tld
="${domain#*.}"
343 local dns_active
="$(find "${adb_dnsdir}" -maxdepth 1 -type f -name "${adb_dnsprefix}*" -print)"
345 if [ -z "${dns_active}" ]
347 printf "%s\n" "::: no active block lists found, please start / resume adblock first"
348 elif [ -z "${domain}" ] || [ "${domain}" = "${tld}" ]
350 printf "%s\n" "::: invalid domain input, please submit a specific (sub-)domain, e.g. 'www.abc.xyz'"
353 while [ "${domain}" != "${tld}" ]
355 search
="${domain//./\.}"
356 result
="$(grep -Hm1 "[/\"\.
]${search}[/\"]" "${adb_dnsprefix}"* | awk -F ':|=|/|\"' '{printf(" %-20s : %s\n",$1,$4)}')"
357 printf "%s\n" "::: distinct results for domain '${domain}'"
358 printf "%s\n" "${result:=" no match"}"
365 # f_status: output runtime information
369 local key keylist value
371 if [ -s "${adb_rtfile}" ]
373 local dns_active="$(find "${adb_dnsdir}" -maxdepth 1 -type f -name "${adb_dnsprefix}*" -print)"
374 local dns_passive="$(find "${adb_dnshidedir}" -maxdepth 1 -type f -name "${adb_dnsprefix}*" -print)"
376 if [ -n "${dns_active}" ]
379 elif [ -n "${dns_passive}" ] || [ -z "${dns_active}" ]
381 value="no domains blocked"
383 printf "%s\n" "::: adblock runtime information"
384 printf " %-15s : %s\n" "status" "${value}"
385 json_load "$(cat "${adb_rtfile}" 2>/dev/null)"
387 json_get_keys keylist
388 for key in ${keylist}
390 json_get_var value "${key}"
391 printf " %-15s : %s\n" "${key}" "${value}"
396 # f_log: write to syslog, exit on error
400 local class="${1}" log_msg="${2}"
402 if [ -n "${log_msg}" ] && ([ "${class}" != "debug" ] || [ ${adb_debug} -eq 1 ])
404 logger -t "adblock-[${adb_ver}] ${class}" "${log_msg}"
405 if [ "${class}" = "error" ]
407 logger -t "adblock-[${adb_ver}] ${class}" "Please check 'https://github.com/openwrt/packages/blob/master/net/adblock/files/README.md' (${adb_sysver})"
409 if [ -n "$(ls -dA "${adb_dnsdir}/${adb_dnsprefix}"* 2>/dev/null)" ]
419 # main function for block list processing
423 local enabled url cnt sum_cnt=0 mem_total=0
424 local src_name src_rset shalla_archive
425 mem_total="$(awk '$1 ~
/^MemTotal
/ {printf $2}' "/proc/meminfo" 2>/dev/null)"
427 f_log "info " "start adblock processing ..."
428 f_log "debug" "action: ${adb_action}, backup: ${adb_backup}, dns: ${adb_dns}, fetch: ${adb_fetchinfo}, memory: ${mem_total}, force srt/dns: ${adb_forcesrt}/${adb_forcedns}"
430 for src_name in ${adb_sources}
432 eval "enabled=\"\${enabled_${src_name}}\""
433 eval "url=\"\${adb_src_${src_name}}\""
434 eval "src_rset=\"\${adb_src_rset_${src_name}}\""
435 adb_dnsfile="${adb_tmpdir}/${adb_dnsprefix}.${src_name}"
442 f_log "debug" "name: ${src_name}, enabled: ${enabled}, url: ${url}, rset: ${src_rset}"
443 if [ "${enabled}" != "1" ] || [ -z "${url}" ] || [ -z "${src_rset}" ]
449 # download block list
451 if [ "${src_name}" = "blacklist" ]
453 cat "${url}" 2>/dev/null > "${adb_tmpload}"
455 elif [ "${src_name}" = "shalla" ]
457 shalla_archive="${adb_tmpdir}/shallalist.tar.gz"
458 "${adb_fetch}" ${adb_fetchparm} "${shalla_archive}" "${url}" 2>/dev/null
460 if [ ${adb_rc} -eq 0 ]
462 for category in ${adb_src_cat_shalla}
464 tar -xOzf "${shalla_archive}" "BL/${category}/domains" >> "${adb_tmpload}"
466 if [ ${adb_rc} -ne 0 ]
472 rm -f "${shalla_archive}"
473 rm -rf "${adb_tmpdir}/BL"
475 "${adb_fetch}" ${adb_fetchparm} "${adb_tmpload}" "${url}" 2>/dev/null
479 # check download result and prepare domain output (incl. tld compression, list backup & restore)
481 if [ ${adb_rc} -eq 0 ] && [ -s "${adb_tmpload}" ]
483 awk "${src_rset}" "${adb_tmpload}" 2>/dev/null > "${adb_tmpfile}"
484 if [ -s "${adb_tmpfile}" ]
486 awk -F "." '{for(f
=NF
;f
> 1;f--
) printf "%s.", $f;print
$1}' "${adb_tmpfile}" 2>/dev/null | sort -u > "${adb_tmpload}"
487 awk '{if(NR
==1){tld
=$NF};while(getline
){if($NF !~ tld
"\\."){print tld
;tld
=$NF}}print tld
}' "${adb_tmpload}" 2>/dev/null > "${adb_tmpfile}"
488 awk -F "." '{for(f
=NF
;f
> 1;f--
) printf "%s.", $f;print
$1}' "${adb_tmpfile}" 2>/dev/null > "${adb_tmpload}"
489 mv -f "${adb_tmpload}" "${adb_tmpfile}"
498 # remove whitelist domains, final list preparation
500 if [ ${adb_rc} -eq 0 ] && [ -s "${adb_tmpfile}" ]
502 if [ -s "${adb_tmpdir}/tmp.whitelist" ]
504 grep -vf "${adb_tmpdir}/tmp.whitelist" "${adb_tmpfile}" 2>/dev/null | eval "${adb_dnsformat}" > "${adb_dnsfile}"
506 eval "${adb_dnsformat}" "${adb_tmpfile}" > "${adb_dnsfile}"
509 if [ ${adb_rc} -ne 0 ]
520 for src_name in $(ls -dASr "${adb_tmpdir}/${adb_dnsprefix}"* 2>/dev/null)
522 if [ ${mem_total} -ge 64000 ] || [ ${adb_forcesrt} -eq 1 ]
524 if [ -s "${adb_tmpdir}/blocklist.overall" ]
526 sort "${adb_tmpdir}/blocklist.overall" "${adb_tmpdir}/blocklist.overall" "${src_name}" | uniq -u > "${adb_tmpdir}/tmp.blocklist"
527 mv -f "${adb_tmpdir}/tmp.blocklist" "${src_name}"
529 cat "${src_name}" >> "${adb_tmpdir}/blocklist.overall"
531 cnt="$(wc -l < "${src_name}")"
532 sum_cnt=$((sum_cnt + cnt))
535 # restart the dns backend and export runtime information
537 mv -f "${adb_tmpdir}/${adb_dnsprefix}"* "${adb_dnsdir}" 2>/dev/null
538 chown "${adb_dns}":"${adb_dns}" "${adb_dnsdir}/${adb_dnsprefix}"* 2>/dev/null
541 if [ "${adb_dnsup}" = "true" ]
544 json_add_object "data"
545 json_add_string "adblock_version" "${adb_ver}"
546 json_add_string "blocked_domains" "${sum_cnt}"
547 json_add_string "fetch_info" "${adb_fetchinfo}"
548 json_add_string "dns_backend" "${adb_dns}"
549 json_add_string "last_rundate" "$(/bin/date "+%d.%m.%Y %H:%M:%S")"
550 json_add_string "system" "${adb_sysver}"
552 json_dump > "${adb_rtfile}"
553 f_log "info " "block lists with overall ${sum_cnt} domains loaded successfully (${adb_sysver})"
555 f_log "error" "dns backend restart with active block lists failed"
559 # handle different adblock actions
562 case "${adb_action}" in