#!/bin/sh
-##############################################
-# function library used by adblock-update.sh #
-# written by Dirk Brenken (dirk@brenken.org) #
-##############################################
+# function library used by adblock-update.sh
+# written by Dirk Brenken (dev@brenken.org)
+
+# set initial defaults
+#
+LC_ALL=C
+PATH="/usr/sbin:/usr/bin:/sbin:/bin"
+adb_lanif="lan"
+adb_nullport="65534"
+adb_nullportssl="65535"
+adb_nullipv4="198.18.0.1"
+adb_nullipv6="::ffff:c612:0001"
+adb_whitelist="/etc/adblock/adblock.whitelist"
+adb_whitelist_rset="\$1 ~/^([A-Za-z0-9_-]+\.){1,}[A-Za-z]+/{print tolower(\"^\"\$1\"\\\|[.]\"\$1)}"
+adb_dnsdir="/tmp/dnsmasq.d"
+adb_dnshidedir="${adb_dnsdir}/.adb_hidden"
+adb_dnsprefix="adb_list"
+adb_count=0
+adb_minspace=12000
+adb_forcedns=1
+adb_fetchttl=5
+adb_restricted=0
+adb_fetch="$(which wget)"
+adb_uci="$(which uci)"
+unset adb_revsrclist
-#####################################
# f_envload: load adblock environment
#
f_envload()
{
- # source in openwrt function library
+ # source in system function library
#
if [ -r "/lib/functions.sh" ]
then
- . /lib/functions.sh
+ . "/lib/functions.sh"
else
- /usr/bin/logger -t "adblock[${pid}]" "error: openwrt function library not found"
- f_deltemp
- exit 10
+ rc=-10
+ f_log "system function library not found, please check your installation"
+ f_exit
fi
- # source in openwrt json helpers library
+ # source in system network library
#
- if [ -r "/usr/share/libubox/jshn.sh" ]
+ if [ -r "/lib/functions/network.sh" ]
then
- . "/usr/share/libubox/jshn.sh"
+ . "/lib/functions/network.sh"
else
- /usr/bin/logger -t "adblock[${pid}]" "error: openwrt json helpers library not found"
- f_deltemp
- exit 15
+ rc=-10
+ f_log "system network library not found, please check your installation"
+ f_exit
fi
- # get list with all installed openwrt packages
+ # check opkg availability
#
- pkg_list="$(opkg list-installed 2>/dev/null)"
- if [ -z "${pkg_list}" ]
+ if [ -r "/var/lock/opkg.lock" ]
then
- /usr/bin/logger -t "adblock[${pid}]" "error: empty openwrt package list"
- f_deltemp
- exit 20
+ rc=-10
+ f_log "adblock installation finished successfully, 'opkg' currently locked by package installer"
+ f_exit
fi
-}
-######################################################
-# f_envparse: parse adblock config and set environment
-#
-f_envparse()
-{
- # function to read/set global options by callback,
- # prepare list items and build option list for all others
+ # uci function to parse global section by callback
#
config_cb()
{
local type="${1}"
- local name="${2}"
if [ "${type}" = "adblock" ]
then
option_cb()
eval "${option}=\"${value}\""
}
else
- option_cb()
- {
- local option="${1}"
- local value="${2}"
- local opt_out="$(printf "${option}" | sed -n '/.*_ITEM[0-9]$/p; /.*_LENGTH$/p; /enabled/p')"
- if [ -z "${opt_out}" ]
- then
- all_options="${all_options} ${option}"
- fi
- }
- list_cb()
- {
- local list="${1}"
- local value="${2}"
- if [ "${list}" = "adb_wanlist" ]
- then
- adb_wandev="${adb_wandev} ${value}"
- elif [ "${list}" = "adb_ntplist" ]
- then
- adb_ntpsrv="${adb_ntpsrv} ${value}"
- elif [ "${list}" = "adb_catlist" ]
- then
- adb_cat_shalla="${adb_cat_shalla} ${value}"
- fi
- }
+ reset_cb
fi
}
- # function to iterate through option list, read/set all options in "enabled" sections
+ # uci function to parse 'service' and 'source' sections
#
parse_config()
{
- local config="${1}"
- config_get switch "${config}" "enabled"
- if [ "${switch}" = "1" ]
+ local value opt section="${1}" options="enabled adb_dir adb_src adb_src_rset adb_src_cat"
+ if [ "${section}" != "backup" ]
then
- for option in ${all_options}
- do
- config_get value "${config}" "${option}"
- if [ -n "${value}" ]
- then
- local opt_src="$(printf "${option}" | sed -n '/^adb_src_[a-z0-9]*$/p')"
- if [ -n "${opt_src}" ]
- then
- adb_sources="${adb_sources} ${value}"
- else
- eval "${option}=\"${value}\""
- fi
- fi
- done
- elif [ "${config}" = "wancheck" ]
- then
- unset adb_wandev
- elif [ "${config}" = "ntpcheck" ]
- then
- unset adb_ntpsrv
- elif [ "${config}" = "shalla" ]
- then
- unset adb_cat_shalla
+ eval "adb_sources=\"${adb_sources} ${section}\""
fi
+ for opt in ${options}
+ do
+ config_get value "${section}" "${opt}"
+ if [ -n "${value}" ]
+ then
+ eval "${opt}_${section}=\"${value}\""
+ fi
+ done
}
# load adblock config and start parsing functions
config_foreach parse_config service
config_foreach parse_config source
- # set temp variables and counter
+ # get ip addresses & logical wan devices
#
- adb_tmpfile="$(mktemp -tu)"
- adb_tmpdir="$(mktemp -d)"
- cnt=0
- max_cnt=30
- max_time=60
-
- # set adblock source ruleset definitions
- #
- rset_start="sed -r 's/[[:space:]]|[\[!#/:;_].*|[0-9\.]*localhost//g; s/[\^#/:;_\.\t ]*$//g'"
- rset_end="sed '/^[#/:;_\s]*$/d'"
- rset_default="${rset_start} | ${rset_end}"
- rset_yoyo="${rset_start} | sed 's/,/\n/g' | ${rset_end}"
- rset_shalla="${rset_start} | sed 's/\([0-9]\{1,3\}\.\)\{3\}[0-9]\{1,3\}$//g' | ${rset_end}"
- rset_spam404="${rset_start} | sed 's/^\|\|//g' | ${rset_end}"
- rset_winhelp="${rset_start} | sed 's/\([0-9]\{1,3\}\.\)\{3\}[0-1]\{1,1\}//g' | ${rset_end}"
+ network_get_ipaddr adb_ipv4 "${adb_lanif}"
+ network_get_ipaddr6 adb_ipv6 "${adb_lanif}"
+ network_find_wan adb_wanif4
+ network_find_wan6 adb_wanif6
- # set adblock/dnsmasq destination file and format
+ # set restricted mode
#
- adb_dnsfile="/tmp/dnsmasq.d/adlist.conf"
- adb_dnsformat="sed 's/^/address=\//;s/$/\/'${adb_ip}'/'"
+ if [ "${adb_restricted}" = "1" ]
+ then
+ adb_uci="$(which true)"
+ restricted_ok="true"
+ fi
}
-#############################################
-# f_envcheck: check environment prerequisites
+# f_envcheck: check/set environment prerequisites
#
f_envcheck()
{
- # check adblock network device configuration
+ local check
+
+ # check 'enabled' & 'version' config options
#
- if [ ! -d "/sys/class/net/${adb_dev}" ]
+ if [ -z "${adb_enabled}" ] || [ -z "${adb_cfgver}" ] || [ "${adb_cfgver%%.*}" != "${adb_mincfgver%%.*}" ]
then
- /usr/bin/logger -t "adblock[${pid}]" "error: invalid adblock network device input (${adb_dev})"
- f_deltemp
- exit 25
+ rc=-1
+ f_log "outdated adblock config (${adb_mincfgver} vs. ${adb_cfgver}), please run '/etc/init.d/adblock cfgup' to update your configuration"
+ f_exit
+ elif [ "${adb_cfgver#*.}" != "${adb_mincfgver#*.}" ]
+ then
+ outdate_ok="true"
+ fi
+ if [ "${adb_enabled}" != "1" ]
+ then
+ rc=-1
+ f_log "adblock is currently disabled, please set adblock.global.adb_enabled=1' to use this service"
+ f_exit
fi
- # check adblock network interface configuration
+ # get list with all installed packages
#
- check_if="$(printf "${adb_if}" | sed -n '/[^_0-9A-Za-z]/p')"
- banned_if="$(printf "${adb_if}" | sed -n '/.*lan.*\|.*wan.*\|.*switch.*\|main\|globals\|loopback\|px5g/p')"
- if [ -n "${check_if}" ] || [ -n "${banned_if}" ]
+ pkg_list="$(opkg list-installed)"
+ if [ -z "${pkg_list}" ]
then
- /usr/bin/logger -t "adblock[${pid}]" "error: invalid adblock network interface input (${adb_if})"
- f_deltemp
- exit 30
+ rc=-1
+ f_log "empty 'opkg' package list, please check your installation"
+ f_exit
fi
+ adb_sysver="$(printf "${pkg_list}" | grep "^base-files -")"
+ adb_sysver="${adb_sysver##*-}"
- # check adblock ip address configuration
+ # get lan ip addresses
#
- check_ip="$(printf "${adb_ip}" | sed -n '/\([0-9]\{1,3\}\.\)\{3\}[0-9]\{1,3\}/p')"
- if [ -z "${check_ip}" ]
+ if [ -z "${adb_ipv4}" ] && [ -z "${adb_ipv6}" ]
then
- /usr/bin/logger -t "adblock[${pid}]" "error: invalid adblock ip address input (${adb_ip})"
- f_deltemp
- exit 35
+ rc=-1
+ f_log "no valid IPv4/IPv6 configuration found (${adb_lanif}), please set 'adb_lanif' manually"
+ f_exit
+ else
+ network_get_device adb_landev4 "${adb_lanif}"
+ network_get_device adb_landev6 "${adb_lanif}"
fi
- # check adblock blacklist/whitelist configuration
+ # check logical update interfaces (with default route)
#
- if [ ! -r "${adb_blacklist}" ]
- then
- /usr/bin/logger -t "adblock[${pid}]" "error: adblock blacklist not found"
- f_deltemp
- exit 40
- elif [ ! -r "${adb_whitelist}" ]
+ if [ -z "${adb_wanif4}" ] && [ -z "${adb_wanif6}" ]
then
- /usr/bin/logger -t "adblock[${pid}]" "error: adblock whitelist not found"
- f_deltemp
- exit 45
+ adb_wanif4="${adb_lanif}"
fi
- # check wan update configuration
+ # check AP mode
#
- if [ -n "${adb_wandev}" ]
+ if [ "${adb_wanif4}" = "${adb_lanif}" ] || [ "${adb_wanif6}" = "${adb_lanif}" ]
then
- wan_ok="true"
+ adb_nullipv4="${adb_ipv4}"
+ adb_nullipv6="${adb_ipv6}"
+ if [ "$(${adb_uci} -q get uhttpd.main.listen_http | grep -Fo "80")" = "80" ] ||
+ [ "$(${adb_uci} -q get uhttpd.main.listen_https | grep -Fo "443")" = "443" ]
+ then
+ rc=-1
+ f_log "AP mode detected, please set local LuCI instance to ports <> 80/443"
+ f_exit
+ elif [ -z "$(pgrep -f "dnsmasq")" ]
+ then
+ rc=-1
+ f_log "please enable the local dnsmasq instance to use adblock"
+ f_exit
+ elif [ -z "$(iptables -w -vnL | grep -Fo "DROP")" ]
+ then
+ rc=-1
+ f_log "please enable the local firewall to use adblock"
+ f_exit
+ else
+ apmode_ok="true"
+ fi
else
- wan_ok="false"
- /usr/bin/logger -t "adblock[${pid}]" "info: wan update check will be disabled"
+ apmode_ok="false"
+ check="$(${adb_uci} -q get bcp38.@bcp38[0].enabled)"
+ if [ "${check}" = "1" ]
+ then
+ check="$(${adb_uci} -q get bcp38.@bcp38[0].match | grep -Fo "${adb_nullipv4%.*}")"
+ if [ -n "${check}" ]
+ then
+ rc=-1
+ f_log "please whitelist '${adb_nullipv4}' in your bcp38 configuration to use adblock"
+ f_exit
+ fi
+ fi
fi
- # check ntp sync configuration
+ # start normal processing/logging
+ #
+ f_log "domain adblock processing started (${adb_scriptver}, ${adb_sysver}, $(/bin/date "+%d.%m.%Y %H:%M:%S"))"
+
+ # log partially outdated config
#
- if [ -n "${adb_ntpsrv}" ]
+ if [ "${outdate_ok}" = "true" ]
then
- ntp_ok="true"
- else
- ntp_ok="false"
- /usr/bin/logger -t "adblock[${pid}]" "info: ntp time sync will be disabled"
+ f_log "partially outdated adblock config (${adb_mincfgver} vs. ${adb_cfgver}), please run '/etc/init.d/adblock cfgup' to update your configuration"
fi
- # check backup configuration
+ # log ap mode
#
- adb_backupdir="${adb_backupfile%/*}"
- if [ -n "${adb_backupdir}" ] && [ -d "${adb_backupdir}" ]
+ if [ "${apmode_ok}" = "true" ]
then
- backup_ok="true"
- adb_mounts="${adb_backupdir} ${adb_tmpdir}"
- else
- backup_ok="false"
- /usr/bin/logger -t "adblock[${pid}]" "info: backup/restore will be disabled"
+ f_log "AP mode enabled"
fi
- # check error log configuration
+ # log restricted mode
#
- adb_logdir="${adb_logfile%/*}"
- if [ -n "${adb_logfile}" ] && [ "${adb_logfile}" = "/dev/stdout" ]
+ if [ "${restricted_ok}" = "true" ]
then
- log_ok="true"
- adb_logfile="/proc/self/fd/1"
- elif [ -n "${adb_logdir}" ] && [ -d "${adb_logdir}" ] && [ "${ntp_ok}" = "true" ]
- then
- log_ok="true"
- adb_mounts="${adb_mounts} ${adb_logdir}"
- else
- log_ok="false"
- adb_logfile="/dev/null"
- /usr/bin/logger -t "adblock[${pid}]" "info: error logging will be disabled"
+ f_log "Restricted mode enabled"
fi
- # check dns query log configuration
+ # check general package dependencies
+ #
+ f_depend "busybox"
+ f_depend "uci"
+ f_depend "uhttpd"
+ f_depend "wget"
+ f_depend "iptables"
+ f_depend "kmod-ipt-nat"
+
+ # check ipv6 related package dependencies
#
- adb_querydir="${adb_queryfile%/*}"
- query_pid="/var/run/adb_query.pid"
- if [ -n "${adb_querydir}" ] && [ -d "${adb_querydir}" ]
+ if [ -n "${adb_wanif6}" ]
then
- # check find capabilities
- #
- check="$(find --help 2>&1 | grep "mtime")"
+ check="$(printf "${pkg_list}" | grep "^ip6tables -")"
if [ -z "${check}" ]
then
- query_ok="false"
- /usr/bin/logger -t "adblock[${pid}]" "info: busybox without 'find/mtime' support (min. r47362), dns query logging will be disabled"
+ f_log "package 'ip6tables' not found, IPv6 support will be disabled"
+ unset adb_wanif6
else
- query_ok="true"
- query_name="${adb_queryfile##*/}"
- query_ip="${adb_ip//./\\.}"
- adb_mounts="${adb_mounts} ${adb_querydir}"
+ check="$(printf "${pkg_list}" | grep "^kmod-ipt-nat6 -")"
+ if [ -z "${check}" ]
+ then
+ f_log "package 'kmod-ipt-nat6' not found, IPv6 support will be disabled"
+ unset adb_wanif6
+ fi
fi
+ fi
+
+ # check dns hideout directory
+ #
+ if [ -d "${adb_dnshidedir}" ]
+ then
+ mv_done="$(find "${adb_dnshidedir}" -maxdepth 1 -type f -name "${adb_dnsprefix}*" -print -exec mv -f "{}" "${adb_dnsdir}" \;)"
else
- query_ok="false"
- if [ -s "${query_pid}" ]
- then
- kill -9 $(< "${query_pid}") 2>/dev/null
- > "${query_pid}"
- /usr/bin/logger -t "adblock[${pid}]" "info: remove old dns query log background process"
- fi
- /usr/bin/logger -t "adblock[${pid}]" "info: dns query logging will be disabled"
+ mkdir -p -m 660 "${adb_dnshidedir}"
fi
- # check mount points & space requirements
+ # check ca-certificates package and set fetch parms accordingly
#
- adb_mounts="${adb_mounts} ${adb_tmpdir}"
- for mp in ${adb_mounts}
- do
- df "${mp}" 2>/dev/null |\
- tail -n1 |\
- while read filesystem overall used available scrap
- do
- av_space="${available}"
- if [ $((av_space)) -eq 0 ]
- then
- /usr/bin/logger -t "adblock[${pid}]" "error: no space left on device/not mounted (${mp})"
- exit 50
- elif [ $((av_space)) -lt $((adb_minspace)) ]
+ fetch_parm="--no-config --quiet --tries=1 --no-cache --no-cookies --max-redirect=0 --dns-timeout=${adb_fetchttl} --connect-timeout=${adb_fetchttl} --read-timeout=${adb_fetchttl}"
+ check="$(printf "${pkg_list}" | grep "^ca-certificates -")"
+ if [ -z "${check}" ]
+ then
+ fetch_parm="${fetch_parm} --no-check-certificate"
+ fi
+
+ # check adblock temp directory
+ #
+ adb_tmpfile="$(mktemp -tu)"
+ adb_tmpdir="$(mktemp -p /tmp -d)"
+ if [ -n "${adb_tmpdir}" ] && [ -d "${adb_tmpdir}" ]
+ then
+ f_space "${adb_tmpdir}"
+ if [ "${space_ok}" = "false" ]
+ then
+ if [ $((av_space)) -le 2000 ]
then
- /usr/bin/logger -t "adblock[${pid}]" "error: not enough space left on device (${mp})"
- exit 55
+ rc=105
+ f_log "not enough free space in '${adb_tmpdir}' (avail. ${av_space} kb)"
+ f_exit
+ else
+ f_log "not enough free space to handle all block list sources at once in '${adb_tmpdir}' (avail. ${av_space} kb)"
fi
- done
- # subshell return code handling
- #
- rc=$?
- if [ $((rc)) -ne 0 ]
+ fi
+ else
+ rc=110
+ f_log "temp directory not found"
+ f_exit
+ fi
+
+ # check memory
+ #
+ mem_total="$(awk '$1 ~ /^MemTotal/ {printf $2}' "/proc/meminfo")"
+ mem_free="$(awk '$1 ~ /^MemFree/ {printf $2}' "/proc/meminfo")"
+ mem_swap="$(awk '$1 ~ /^SwapTotal/ {printf $2}' "/proc/meminfo")"
+ if [ $((mem_total)) -le 64000 ] && [ $((mem_swap)) -eq 0 ]
+ then
+ mem_ok="false"
+ f_log "not enough free memory, overall sort processing will be disabled (total: ${mem_total}, free: ${mem_free}, swap: ${mem_swap})"
+ else
+ mem_ok="true"
+ fi
+
+ # check backup configuration
+ #
+ if [ "${enabled_backup}" = "1" ] && [ -d "${adb_dir_backup}" ]
+ then
+ f_space "${adb_dir_backup}"
+ if [ "${space_ok}" = "false" ]
then
- f_deltemp
- exit ${rc}
+ f_log "not enough free space in '${adb_dir_backup}'(avail. ${av_space} kb), backup/restore will be disabled"
+ backup_ok="false"
+ else
+ f_log "backup/restore will be enabled"
+ backup_ok="true"
fi
- done
+ else
+ backup_ok="false"
+ f_log "backup/restore will be disabled"
+ fi
- # check curl package dependency
+ # set dnsmasq defaults
#
- check="$(printf "${pkg_list}" | grep "^curl")"
- if [ -z "${check}" ]
+ if [ -n "${adb_wanif4}" ] && [ -n "${adb_wanif6}" ]
then
- /usr/bin/logger -t "adblock[${pid}]" "error: curl package not found"
- f_deltemp
- exit 60
+ adb_dnsformat="awk -v ipv4="${adb_nullipv4}" -v ipv6="${adb_nullipv6}" '{print \"address=/\"\$0\"/\"ipv4\"\n\"\"address=/\"\$0\"/\"ipv6}'"
+ elif [ -n "${adb_wanif4}" ]
+ then
+ adb_dnsformat="awk -v ipv4="${adb_nullipv4}" '{print \"address=/\"\$0\"/\"ipv4}'"
+ else
+ adb_dnsformat="awk -v ipv6="${adb_nullipv6}" '{print \"address=/\"\$0\"/\"ipv6}'"
fi
- # check wget package dependency
+ # check volatile iptables configuration
#
- check="$(printf "${pkg_list}" | grep "^wget")"
- if [ -z "${check}" ]
+ if [ -n "${adb_wanif4}" ]
+ then
+ check="$(iptables -w -t nat -vnL | grep -Fo "adb-")"
+ if [ -z "${check}" ]
+ then
+ if [ "${adb_forcedns}" = "1" ] && [ -n "${adb_landev4}" ]
+ then
+ f_firewall "IPv4" "nat" "prerouting_rule" "prerouting_rule" "0" "dns" "-i ${adb_landev4} -p udp --dport 53 -j DNAT --to-destination ${adb_ipv4}:53"
+ f_firewall "IPv4" "nat" "prerouting_rule" "prerouting_rule" "0" "dns" "-i ${adb_landev4} -p tcp --dport 53 -j DNAT --to-destination ${adb_ipv4}:53"
+ fi
+ f_firewall "IPv4" "nat" "prerouting_rule" "adb-nat" "1" "nat" "-p tcp --dport 80 -j DNAT --to-destination ${adb_ipv4}:${adb_nullport}"
+ f_firewall "IPv4" "nat" "prerouting_rule" "adb-nat" "2" "nat" "-p tcp --dport 443 -j DNAT --to-destination ${adb_ipv4}:${adb_nullportssl}"
+ if [ "${apmode_ok}" = "false" ]
+ then
+ f_firewall "IPv4" "filter" "forwarding_rule" "adb-fwd" "1" "fwd" "-p tcp -j REJECT --reject-with tcp-reset"
+ f_firewall "IPv4" "filter" "forwarding_rule" "adb-fwd" "2" "fwd" "-j REJECT --reject-with icmp-host-unreachable"
+ f_firewall "IPv4" "filter" "output_rule" "adb-out" "1" "out" "-p tcp -j REJECT --reject-with tcp-reset"
+ f_firewall "IPv4" "filter" "output_rule" "adb-out" "2" "out" "-j REJECT --reject-with icmp-host-unreachable"
+ fi
+ fi
+ fi
+ if [ -n "${adb_wanif6}" ]
+ then
+ check="$(ip6tables -w -t nat -vnL | grep -Fo "adb-")"
+ if [ -z "${check}" ]
+ then
+ if [ "${adb_forcedns}" = "1" ] && [ -n "${adb_landev6}" ]
+ then
+ f_firewall "IPv6" "nat" "PREROUTING" "PREROUTING" "0" "dns" "-i ${adb_landev6} -p udp --dport 53 -j DNAT --to-destination [${adb_ipv6}]:53"
+ f_firewall "IPv6" "nat" "PREROUTING" "PREROUTING" "0" "dns" "-i ${adb_landev6} -p tcp --dport 53 -j DNAT --to-destination [${adb_ipv6}]:53"
+ fi
+ f_firewall "IPv6" "nat" "PREROUTING" "adb-nat" "1" "nat" "-p tcp --dport 80 -j DNAT --to-destination [${adb_ipv6}]:${adb_nullport}"
+ f_firewall "IPv6" "nat" "PREROUTING" "adb-nat" "2" "nat" "-p tcp --dport 443 -j DNAT --to-destination [${adb_ipv6}]:${adb_nullportssl}"
+ if [ "${apmode_ok}" = "false" ]
+ then
+ f_firewall "IPv6" "filter" "forwarding_rule" "adb-fwd" "1" "fwd" "-p tcp -j REJECT --reject-with tcp-reset"
+ f_firewall "IPv6" "filter" "forwarding_rule" "adb-fwd" "2" "fwd" "-j REJECT --reject-with icmp6-addr-unreachable"
+ f_firewall "IPv6" "filter" "output_rule" "adb-out" "1" "out" "-p tcp -j REJECT --reject-with tcp-reset"
+ f_firewall "IPv6" "filter" "output_rule" "adb-out" "2" "out" "-j REJECT --reject-with icmp6-addr-unreachable"
+ fi
+ fi
+ fi
+ if [ "${fw_done}" = "true" ]
then
- /usr/bin/logger -t "adblock[${pid}]" "error: wget package not found"
- f_deltemp
- exit 65
+ f_log "created volatile firewall rulesets"
+ fw_done="false"
fi
- # check dynamic/volatile adblock network interface configuration
+ # check volatile uhttpd instance configuration
#
- rc="$(ifstatus "${adb_if}" >/dev/null 2>&1; printf $?)"
- if [ $((rc)) -ne 0 ]
+ check="$(pgrep -f "uhttpd -h /www/adblock")"
+ if [ -z "${check}" ]
then
- json_init
- json_add_string name "${adb_if}"
- json_add_string ifname "${adb_dev}"
- json_add_string proto "static"
- json_add_array ipaddr
- json_add_string "" "${adb_ip}"
- json_close_array
- json_close_object
- ubus call network add_dynamic "$(json_dump)"
- /usr/bin/logger -t "adblock[${pid}]" "info: created new dynamic/volatile network interface (${adb_if}, ${adb_ip})"
+ if [ -n "${adb_wanif4}" ] && [ -n "${adb_wanif6}" ]
+ then
+ f_uhttpd "adbIPv4+6_80" "1" "-p ${adb_ipv4}:${adb_nullport} -p [${adb_ipv6}]:${adb_nullport}"
+ f_uhttpd "adbIPv4+6_443" "0" "-p ${adb_ipv4}:${adb_nullportssl} -p [${adb_ipv6}]:${adb_nullportssl}"
+ elif [ -n "${adb_wanif4}" ]
+ then
+ f_uhttpd "adbIPv4_80" "1" "-p ${adb_ipv4}:${adb_nullport}"
+ f_uhttpd "adbIPv4_443" "0" "-p ${adb_ipv4}:${adb_nullportssl}"
+ else
+ f_uhttpd "adbIPv6_80" "1" "-p [${adb_ipv6}]:${adb_nullport}"
+ f_uhttpd "adbIPv6_443" "0" "-p [${adb_ipv6}]:${adb_nullportssl}"
+ fi
+ if [ "${uhttpd_done}" = "true" ]
+ then
+ f_log "created volatile uhttpd instances"
+ uhttpd_done="false"
+ fi
fi
- # check dynamic/volatile adblock uhttpd instance configuration
+ # check whitelist entries
#
- rc="$(ps | grep "[u]httpd.*\-r ${adb_if}" >/dev/null 2>&1; printf $?)"
- if [ $((rc)) -ne 0 ]
+ if [ -s "${adb_whitelist}" ]
then
- uhttpd -h "/www/adblock" -r "${adb_if}" -E "/adblock.html" -p "${adb_ip}:80"
- /usr/bin/logger -t "adblock[${pid}]" "info: created new dynamic/volatile uhttpd instance (${adb_if}, ${adb_ip})"
+ awk "${adb_whitelist_rset}" "${adb_whitelist}" > "${adb_tmpdir}/tmp.whitelist"
fi
+
+ # remove temporary package list
+ #
+ unset pkg_list
}
-###################################################
-# f_deltemp: delete temporary files and directories
+# f_depend: check package dependencies
#
-f_deltemp()
+f_depend()
{
- if [ -f "${adb_tmpfile}" ]
- then
- rm -f "${adb_tmpfile}" 2>/dev/null
- fi
- if [ -d "${adb_tmpdir}" ]
+ local check
+ local package="${1}"
+
+ check="$(printf "${pkg_list}" | grep "^${package} -")"
+ if [ -z "${check}" ]
then
- rm -rf "${adb_tmpdir}" 2>/dev/null
+ rc=115
+ f_log "package '${package}' not found"
+ f_exit
fi
}
-################################################################
-# f_remove: remove temporary files, start and maintain query log
+# f_firewall: set iptables rules for ipv4/ipv6
#
-f_remove()
+f_firewall()
{
- # delete temporary files and directories
+ local ipt="iptables"
+ local nullip="${adb_nullipv4}"
+ local proto="${1}"
+ local table="${2}"
+ local chsrc="${3}"
+ local chain="${4}"
+ local chpos="${5}"
+ local notes="adb-${6}"
+ local rules="${7}"
+
+ # select appropriate iptables executable for IPv6
#
- f_deltemp
+ if [ "${proto}" = "IPv6" ]
+ then
+ ipt="ip6tables"
+ nullip="${adb_nullipv6}"
+ fi
+
+ # check whether iptables chain already exist
+ #
+ rc="$("${ipt}" -w -t "${table}" -nL "${chain}" >/dev/null 2>&1; printf ${?})"
+ if [ $((rc)) -ne 0 ]
+ then
+ "${ipt}" -w -t "${table}" -N "${chain}"
+ "${ipt}" -w -t "${table}" -A "${chain}" -m comment --comment "${notes}" -j RETURN
+ "${ipt}" -w -t "${table}" -A "${chsrc}" -d "${nullip}" -m comment --comment "${notes}" -j "${chain}"
+ fi
- # remove existing domain query log background process,
- # do housekeeping and start a new process on daily basis
+ # check whether iptables rule already exist
#
- if [ "${query_ok}" = "true" ] && [ "${ntp_ok}" = "true" ]
+ rc="$("${ipt}" -w -t "${table}" -C "${chain}" -m comment --comment "${notes}" ${rules} >/dev/null 2>&1; printf ${?})"
+ if [ $((rc)) -ne 0 ]
then
- query_date="$(date "+%Y%m%d")"
- if [ -s "${query_pid}" ] && [ ! -f "${adb_queryfile}.${query_date}" ]
+ if [ $((chpos)) -eq 0 ]
then
- kill -9 $(< "${query_pid}") 2>/dev/null
- > "${query_pid}"
- find "${adb_backupdir}" -maxdepth 1 -type f -mtime +${adb_queryhistory} -name "${query_name}.*" -exec rm -f {} \; 2>/dev/null
- /usr/bin/logger -t "adblock[${pid}]" "info: remove old dns query log background process and do logfile housekeeping"
+ "${ipt}" -w -t "${table}" -A "${chain}" -m comment --comment "${notes}" ${rules}
+ else
+ "${ipt}" -w -t "${table}" -I "${chain}" "${chpos}" -m comment --comment "${notes}" ${rules}
fi
- if [ ! -s "${query_pid}" ]
+ rc=${?}
+ if [ $((rc)) -eq 0 ]
then
- ( logread -f 2>/dev/null & printf -n "$!" > "${query_pid}" ) | egrep -o "(query\[A\].*)|([a-z0-9\.\-]* is ${query_ip}$)" >> "${adb_queryfile}.${query_date}" &
- /usr/bin/logger -t "adblock[${pid}]" "info: start new domain query log background process"
+ fw_done="true"
+ else
+ f_log "failed to initialize volatile ${proto} firewall rule '${notes}'"
+ f_exit
fi
fi
-
- # final log entry
- #
- /usr/bin/logger -t "adblock[${pid}]" "info: domain adblock processing finished (${adb_version})"
}
-#####################################################
-# f_restore: if available, restore last adlist backup
+# f_uhttpd: start uhttpd instances
#
-f_restore()
+f_uhttpd()
{
- if [ -z "${restore_msg}" ]
+ local realm="${1}"
+ local timeout="${2}"
+ local ports="${3}"
+ uhttpd -h "/www/adblock" -N 25 -T "${timeout}" -r "${realm}" -k 0 -t 0 -R -D -S -E "/index.html" ${ports}
+ rc=${?}
+ if [ $((rc)) -eq 0 ]
then
- restore_msg="unknown"
+ uhttpd_done="true"
+ else
+ f_log "failed to initialize volatile uhttpd instance (${realm})"
+ f_exit
fi
+}
- if [ "${backup_ok}" = "true" ] && [ -f "${adb_backupfile}" ]
+# f_space: check mount points/space requirements
+#
+f_space()
+{
+ local mp="${1}"
+
+ if [ -d "${mp}" ]
then
- cp -f "${adb_backupfile}" "${adb_dnsfile}" 2>/dev/null
- /usr/bin/logger -t "adblock[${pid}]" "error: ${restore_msg}, adlist backup restored"
- printf "$(/bin/date "+%d.%m.%Y %H:%M:%S") - error: ${restore_msg}, adlist backup restored" >> "${adb_logfile}"
- else
- > "${adb_dnsfile}"
- /usr/bin/logger -t "adblock[${pid}]" "error: ${restore_msg}, empty adlist generated"
- printf "$(/bin/date "+%d.%m.%Y %H:%M:%S") - error: ${restore_msg}, empty adlist generated" >> "${adb_logfile}"
+ av_space="$(df "${mp}" | tail -n1 | awk '{printf $4}')"
+ if [ $((av_space)) -lt $((adb_minspace)) ]
+ then
+ space_ok="false"
+ fi
fi
+}
- # restart dnsmasq
- #
- /etc/init.d/dnsmasq restart >/dev/null 2>&1
+# f_cntconfig: calculate counters in config
+#
+f_cntconfig()
+{
+ local src_name
+ local count=0
- # remove files and exit
- #
- f_remove
- exit 100
+ for src_name in $(ls -ASr "${adb_dnsdir}/${adb_dnsprefix}"*)
+ do
+ count="$(wc -l < "${src_name}")"
+ src_name="${src_name##*.}"
+ if [ -n "${adb_wanif4}" ] && [ -n "${adb_wanif6}" ]
+ then
+ count=$((count / 2))
+ fi
+ "${adb_uci}" -q set "adblock.${src_name}.adb_src_count=${count}"
+ adb_count=$((adb_count + count))
+ done
+ "${adb_uci}" -q set "adblock.global.adb_overall_count=${adb_count}"
}
-#######################################################
-# f_wancheck: check for usable adblock update interface
+# f_rmconfig: remove volatile config entries
#
-f_wancheck()
+f_rmconfig()
{
- if [ "${wan_ok}" = "true" ]
+ local opt
+ local options="adb_src_timestamp adb_src_count"
+ local section="${1}"
+
+ rm_cfg="${adb_lastrun}"
+ if [ -n "${rm_cfg}" ]
then
- # wait for wan update interface(s)
- #
- while [ $((cnt)) -le $((max_cnt)) ]
+ "${adb_uci}" -q delete "adblock.global.adb_overall_count"
+ "${adb_uci}" -q delete "adblock.global.adb_dnstoggle"
+ "${adb_uci}" -q delete "adblock.global.adb_percentage"
+ "${adb_uci}" -q delete "adblock.global.adb_lastrun"
+ for opt in ${options}
do
- for dev in ${adb_wandev}
- do
- if [ -d "/sys/class/net/${dev}" ]
- then
- dev_out=$(< /sys/class/net/${dev}/operstate 2>/dev/null)
- if [ "${dev_out}" = "up" ]
- then
- /usr/bin/logger -t "adblock[${pid}]" "info: get wan/update interface: ${dev}, after ${cnt} loops"
- break 2
- fi
- fi
- if [ $((cnt)) -eq $((max_cnt)) ]
- then
- /usr/bin/logger -t "adblock[${pid}]" "error: no wan/update interface(s) found (${adb_wandev})"
- printf "$(/bin/date "+%d.%m.%Y %H:%M:%S") - error: no wan/update interface(s) found (${adb_wandev})" >> "${adb_logfile}"
- restore_msg="no wan/update interface(s)"
- f_restore
- fi
- done
- sleep 1
- cnt=$((cnt + 1))
+ "${adb_uci}" -q delete "adblock.${section}.${opt}"
done
fi
}
-#####################################
-# f_ntpcheck: check/get ntp time sync
+# f_rmdns: remove dns block lists and backups
#
-f_ntpcheck()
+f_rmdns()
{
- if [ "${ntp_ok}" = "true" ]
+ rm_dns="$(find "${adb_dnsdir}" -maxdepth 1 -type f -name "${adb_dnsprefix}*" -print -exec rm -f "{}" \;)"
+ if [ -n "${rm_dns}" ]
then
- # prepare ntp server pool
- #
- unset ntp_pool
- for srv in ${adb_ntpsrv}
- do
- ntp_pool="${ntp_pool} -p ${srv}"
- done
+ rm -rf "${adb_dnshidedir}"
+ if [ "${enabled_backup}" = "1" ] && [ -d "${adb_dir_backup}" ]
+ then
+ rm -f "${adb_dir_backup}/${adb_dnsprefix}"*.gz
+ fi
+ /etc/init.d/dnsmasq restart
+ fi
+}
- # wait for ntp time sync
- #
- while [ $((cnt)) -le $((max_cnt)) ]
+# f_rmuhttpd: remove uhttpd instances
+#
+f_rmuhttpd()
+{
+ rm_uhttpd="$(pgrep -f "uhttpd -h /www/adblock")"
+ if [ -n "${rm_uhttpd}" ]
+ then
+ for pid in ${rm_uhttpd}
do
- /usr/sbin/ntpd -nq ${ntp_pool} >/dev/null 2>&1
- rc=$?
- if [ $((rc)) -eq 0 ]
- then
- /usr/bin/logger -t "adblock[${pid}]" "info: get ntp time sync (${adb_ntpsrv}), after ${cnt} loops"
- break
- fi
- if [ $((cnt)) -eq $((max_cnt)) ]
- then
- ntp_ok="false"
- /usr/bin/logger -t "adblock[${pid}]" "error: ntp time sync failed (${adb_ntpsrv})"
- printf "$(/bin/date "+%d.%m.%Y %H:%M:%S") - error: ntp time sync failed (${adb_ntpsrv})" >> "${adb_logfile}"
- restore_msg="time sync failed"
- f_restore
- fi
- sleep 1
- cnt=$((cnt + 1))
+ kill -9 "${pid}"
done
fi
}
-#################################################################
-# f_dnscheck: dnsmasq health check with newly generated blocklist
+# f_rmfirewall: remove firewall rulsets
#
-f_dnscheck()
+f_rmfirewall()
{
- # check 1: dnsmasq startup
+ rm_fw="$(iptables -w -t nat -vnL | grep -Fo "adb-")"
+ if [ -n "${rm_fw}" ]
+ then
+ iptables-save -t nat | grep -Fv -- "adb-" | iptables-restore
+ iptables-save -t filter | grep -Fv -- "adb-" | iptables-restore
+ if [ -n "$(lsmod | grep -Fo "ip6table_nat")" ]
+ then
+ ip6tables-save -t nat | grep -Fv -- "adb-" | ip6tables-restore
+ ip6tables-save -t filter | grep -Fv -- "adb-" | ip6tables-restore
+ fi
+ fi
+}
+
+# f_log: log messages to stdout and syslog
+#
+f_log()
+{
+ local log_parm
+ local log_msg="${1}"
+ local class="info "
+ local lastrun="$(date "+%d.%m.%Y %H:%M:%S")"
+
+ # check for terminal session
#
- dns_status="$(logread -l 20 -e "dnsmasq" -e "FAILED to start up")"
- if [ -z "${dns_status}" ]
+ if [ -t 1 ]
then
- # check 2: nslookup probe
+ log_parm="-s"
+ fi
+
+ # log to different output devices and set log class accordingly
+ #
+ if [ -n "${log_msg}" ]
+ then
+ if [ $((rc)) -gt 0 ]
+ then
+ class="error"
+ fi
+ logger ${log_parm} -t "adblock[${adb_pid}] ${class}" "${log_msg}" 2>&1
+
+ # clean exit on error
#
- dns_status="$(nslookup "${adb_domain}" 2>/dev/null | grep "${adb_ip}")"
- if [ -z "${dns_status}" ]
+ if [ $((rc)) -eq -1 ] || [ $((rc)) -gt 0 ]
then
- # create backup of new block list only, if both checks are OK and backup enabled
- #
- if [ "${backup_ok}" = "true" ]
- then
- cp -f "${adb_dnsfile}" "${adb_backupfile}" 2>/dev/null
- /usr/bin/logger -t "adblock[${pid}]" "info: new block list with ${adb_count} domains loaded, backup generated"
- else
- /usr/bin/logger -t "adblock[${pid}]" "info: new block list with ${adb_count} domains loaded, no backup"
- fi
- else
- restore_msg="nslookup probe failed"
- f_restore
+ f_rmdns
+ f_rmuhttpd
+ f_rmfirewall
+ config_foreach f_rmconfig source
+ "${adb_uci}" -q set "adblock.global.adb_lastrun=${lastrun} => runtime error, please check the log!"
+ "${adb_uci}" -q commit "adblock"
fi
- else
- restore_msg="dnsmasq probe failed"
- f_restore
fi
}
-##########################################################
-# f_footer: write footer with a few statistics to dns file
+# f_statistics: adblock runtime statistics
+f_statistics()
+{
+ local ipv4_blk=0 ipv4_all=0 ipv4_pct=0
+ local ipv6_blk=0 ipv6_all=0 ipv6_pct=0
+
+ if [ -n "${adb_wanif4}" ]
+ then
+ ipv4_blk="$(iptables -t nat -vnL adb-nat | awk '$3 ~ /^DNAT$/ {sum += $1} END {printf sum}')"
+ ipv4_all="$(iptables -t nat -vnL PREROUTING | awk '$3 ~ /^prerouting_rule$/ {sum += $1} END {printf sum}')"
+ if [ $((ipv4_all)) -gt 0 ] && [ $((ipv4_blk)) -gt 0 ] && [ $((ipv4_all)) -gt $((ipv4_blk)) ]
+ then
+ ipv4_pct="$(printf "${ipv4_blk}" | awk -v all="${ipv4_all}" '{printf( "%5.2f\n",$1/all*100)}')"
+ fi
+ fi
+ if [ -n "${adb_wanif6}" ]
+ then
+ ipv6_blk="$(ip6tables -t nat -vnL adb-nat | awk '$3 ~ /^DNAT$/ {sum += $1} END {printf sum}')"
+ ipv6_all="$(ip6tables -t nat -vnL PREROUTING | awk '$3 ~ /^(adb-nat|DNAT)$/ {sum += $1} END {printf sum}')"
+ if [ $((ipv6_all)) -gt 0 ] && [ $((ipv6_blk)) -gt 0 ] && [ $((ipv6_all)) -gt $((ipv6_blk)) ]
+ then
+ ipv6_pct="$(printf "${ipv6_blk}" | awk -v all="${ipv6_all}" '{printf( "%5.2f\n",$1/all*100)}')"
+ fi
+ fi
+ "${adb_uci}" -q set "adblock.global.adb_percentage=${ipv4_pct}%/${ipv6_pct}%"
+ f_log "firewall statistics (IPv4/IPv6): ${ipv4_pct}%/${ipv6_pct}% of all packets in prerouting chain are ad related & blocked"
+}
+
+# f_exit: delete temporary files, generate statistics and exit
#
-f_footer()
+f_exit()
{
- adb_count="$(wc -l < "${adb_dnsfile}")"
- printf "%s\n" "###################################################" >> "${adb_dnsfile}"
- printf "%s\n" "# last adblock file update: $(date +"%d.%m.%Y - %T")" >> "${adb_dnsfile}"
- printf "%s\n" "# ${0##*/} (${adb_version}) - ${adb_count} ad/abuse domains blocked" >> "${adb_dnsfile}"
- printf "%s\n" "# domain blacklist sources:" >> "${adb_dnsfile}"
- for src in ${adb_sources}
- do
- url="${src//\&ruleset=*/}"
- printf "%s\n" "# ${url}" >> "${adb_dnsfile}"
- done
- printf "%s\n" "###################################################" >> "${adb_dnsfile}"
- printf "%s\n" "# domain whitelist source:" >> "${adb_dnsfile}"
- printf "%s\n" "# ${adb_whitelist}" >> "${adb_dnsfile}"
- printf "%s\n" "###################################################" >> "${adb_dnsfile}"
+ local lastrun="$(date "+%d.%m.%Y %H:%M:%S")"
+
+ rm -f "${adb_tmpfile}"
+ rm -rf "${adb_tmpdir}"
+
+ # final log message and iptables statistics
+ #
+ if [ $((rc)) -eq 0 ]
+ then
+ f_statistics
+ "${adb_uci}" -q set "adblock.global.adb_lastrun=${lastrun}"
+ "${adb_uci}" -q commit "adblock"
+ f_log "domain adblock processing finished successfully (${adb_scriptver}, ${adb_sysver}, ${lastrun})"
+ elif [ $((rc)) -gt 0 ]
+ then
+ f_log "domain adblock processing failed (${adb_scriptver}, ${adb_sysver}, ${lastrun})"
+ else
+ rc=0
+ fi
+ rm -f "${adb_pidfile}"
+ exit ${rc}
}
projects / feed / packages.git / blobdiff