# function library used by adblock-update.sh
# written by Dirk Brenken (dev@brenken.org)
+# set initial defaults
+#
+LC_ALL=C
+PATH="/usr/sbin:/usr/bin:/sbin:/bin"
+adb_lanif="lan"
+adb_nullport="65534"
+adb_nullportssl="65535"
+adb_nullipv4="198.18.0.1"
+adb_nullipv6="::ffff:c612:0001"
+adb_whitelist="/etc/adblock/adblock.whitelist"
+adb_whitelist_rset="\$1 ~/^([A-Za-z0-9_-]+\.){1,}[A-Za-z]+/{print tolower(\"^\"\$1\"\\\|[.]\"\$1)}"
+adb_dnsdir="/tmp/dnsmasq.d"
+adb_dnshidedir="${adb_dnsdir}/.adb_hidden"
+adb_dnsprefix="adb_list"
+adb_count=0
+adb_minspace=12000
+adb_forcedns=1
+adb_fetchttl=5
+adb_restricted=0
+adb_fetch="$(which wget)"
+adb_uci="$(which uci)"
+unset adb_revsrclist
+
# f_envload: load adblock environment
#
f_envload()
then
. "/lib/functions.sh"
else
- rc=-1
+ rc=-10
f_log "system function library not found, please check your installation"
f_exit
fi
then
. "/lib/functions/network.sh"
else
- rc=-1
+ rc=-10
f_log "system network library not found, please check your installation"
f_exit
fi
- # set initial defaults,
- # may be overwritten by setting appropriate adblock config options in global section of /etc/config/adblock
+ # check opkg availability
#
- adb_lanif="lan"
- adb_nullport="65535"
- adb_nullipv4="192.0.2.1"
- adb_nullipv6="::ffff:c000:0201"
- adb_whitelist="/etc/adblock/adblock.whitelist"
- adb_whitelist_rset="\$1 ~/^([A-Za-z0-9_-]+\.){1,}[A-Za-z]+/{print tolower(\$1)}"
- adb_forcedns=1
- adb_fetchttl=5
- adb_restricted=0
+ if [ -r "/var/lock/opkg.lock" ]
+ then
+ rc=-10
+ f_log "adblock installation finished successfully, 'opkg' currently locked by package installer"
+ f_exit
+ fi
- # function to parse global section by callback
+ # uci function to parse global section by callback
#
config_cb()
{
fi
}
- # function to parse 'service' and 'source' sections
+ # uci function to parse 'service' and 'source' sections
#
parse_config()
{
- local value opt section="${1}" options="adb_dir adb_src adb_src_rset adb_src_cat"
- config_get switch "${section}" "enabled"
- if [ "${switch}" = "1" ]
+ local value opt section="${1}" options="enabled adb_dir adb_src adb_src_rset adb_src_cat"
+ if [ "${section}" != "backup" ]
then
- if [ "${section}" != "backup" ]
+ eval "adb_sources=\"${adb_sources} ${section}\""
+ fi
+ for opt in ${options}
+ do
+ config_get value "${section}" "${opt}"
+ if [ -n "${value}" ]
then
- eval "adb_sources=\"${adb_sources} ${section}\""
+ eval "${opt}_${section}=\"${value}\""
fi
- for opt in ${options}
- do
- config_get value "${section}" "${opt}"
- if [ -n "${value}" ]
- then
- eval "${opt}_${section}=\"${value}\""
- fi
- done
- fi
+ done
}
- # check opkg availability
- #
- if [ -r "/var/lock/opkg.lock" ]
- then
- rc=-1
- f_log "adblock installation finished successfully, 'opkg' currently locked by package installer"
- f_exit
- fi
-
- # get list with all installed packages
- #
- pkg_list="$(opkg list-installed)"
- if [ -z "${pkg_list}" ]
- then
- rc=-1
- f_log "empty package list, please check your installation"
- f_exit
- fi
-
# load adblock config and start parsing functions
#
config_load adblock
config_foreach parse_config service
config_foreach parse_config source
- # set more script defaults (can't be overwritten by adblock config options)
+ # get ip addresses & logical wan devices
#
- adb_minspace=12000
- adb_tmpfile="$(mktemp -tu)"
- adb_tmpdir="$(mktemp -p /tmp -d)"
- adb_dnsdir="/tmp/dnsmasq.d"
- adb_dnshidedir="${adb_dnsdir}/.adb_hidden"
- adb_dnsprefix="adb_list"
- adb_iptv4="$(which iptables)"
- adb_iptv6="$(which ip6tables)"
- adb_fetch="$(which wget)"
- adb_uci="$(which uci)"
- adb_date="$(which date)"
- unset adb_srclist adb_revsrclist adb_errsrclist
+ network_get_ipaddr adb_ipv4 "${adb_lanif}"
+ network_get_ipaddr6 adb_ipv6 "${adb_lanif}"
+ network_find_wan adb_wanif4
+ network_find_wan6 adb_wanif6
+
+ # set restricted mode
+ #
+ if [ "${adb_restricted}" = "1" ]
+ then
+ adb_uci="$(which true)"
+ restricted_ok="true"
+ fi
+}
+
+# f_envcheck: check/set environment prerequisites
+#
+f_envcheck()
+{
+ local check
# check 'enabled' & 'version' config options
#
then
outdate_ok="true"
fi
- if [ $((adb_enabled)) -ne 1 ]
+ if [ "${adb_enabled}" != "1" ]
then
rc=-1
f_log "adblock is currently disabled, please set adblock.global.adb_enabled=1' to use this service"
f_exit
fi
- # check running dnsmasq instance
- #
- check="$(ps | pgrep -f "dnsmasq")"
- if [ -z "${check}" ]
- then
- rc=-1
- f_log "please enable the local dnsmasq instance to use adblock"
- f_exit
- fi
-
- # check running firewall
+ # get list with all installed packages
#
- check="$(${adb_iptv4} -vnL | grep -F "DROP")"
- if [ -z "${check}" ]
+ pkg_list="$(opkg list-installed)"
+ if [ -z "${pkg_list}" ]
then
rc=-1
- f_log "please enable the local firewall to use adblock"
+ f_log "empty 'opkg' package list, please check your installation"
f_exit
fi
+ adb_sysver="$(printf "${pkg_list}" | grep "^base-files -")"
+ adb_sysver="${adb_sysver##*-}"
# get lan ip addresses
#
- network_get_ipaddr adb_ipv4 "${adb_lanif}"
- network_get_ipaddr6 adb_ipv6 "${adb_lanif}"
if [ -z "${adb_ipv4}" ] && [ -z "${adb_ipv6}" ]
then
rc=-1
# check logical update interfaces (with default route)
#
- network_find_wan adb_wanif4
- network_find_wan6 adb_wanif6
if [ -z "${adb_wanif4}" ] && [ -z "${adb_wanif6}" ]
then
adb_wanif4="${adb_lanif}"
then
adb_nullipv4="${adb_ipv4}"
adb_nullipv6="${adb_ipv6}"
- if [ "$(${adb_uci} get uhttpd.main.listen_http | grep -Fo "80")" = "80" ] ||
- [ "$(${adb_uci} get uhttpd.main.listen_https | grep -Fo "443")" = "443" ]
+ if [ "$(${adb_uci} -q get uhttpd.main.listen_http | grep -Fo "80")" = "80" ] ||
+ [ "$(${adb_uci} -q get uhttpd.main.listen_https | grep -Fo "443")" = "443" ]
+ then
+ rc=-1
+ f_log "AP mode detected, please set local LuCI instance to ports <> 80/443"
+ f_exit
+ elif [ -z "$(pgrep -f "dnsmasq")" ]
then
rc=-1
- f_log "AP mode detected, set local LuCI instance to ports <> 80/443"
+ f_log "please enable the local dnsmasq instance to use adblock"
+ f_exit
+ elif [ -z "$(iptables -w -vnL | grep -Fo "DROP")" ]
+ then
+ rc=-1
+ f_log "please enable the local firewall to use adblock"
f_exit
else
apmode_ok="true"
fi
+ else
+ apmode_ok="false"
+ check="$(${adb_uci} -q get bcp38.@bcp38[0].enabled)"
+ if [ "${check}" = "1" ]
+ then
+ check="$(${adb_uci} -q get bcp38.@bcp38[0].match | grep -Fo "${adb_nullipv4%.*}")"
+ if [ -n "${check}" ]
+ then
+ rc=-1
+ f_log "please whitelist '${adb_nullipv4}' in your bcp38 configuration to use adblock"
+ f_exit
+ fi
+ fi
fi
- # get system release level
+ # start normal processing/logging
#
- adb_sysver="$(printf "${pkg_list}" | grep "^base-files -")"
- adb_sysver="${adb_sysver##*-}"
-}
-
-# f_envcheck: check/set environment prerequisites
-#
-f_envcheck()
-{
- local check
+ f_log "domain adblock processing started (${adb_scriptver}, ${adb_sysver}, $(/bin/date "+%d.%m.%Y %H:%M:%S"))"
# log partially outdated config
#
f_log "AP mode enabled"
fi
- # set & log restricted mode
+ # log restricted mode
#
- if [ $((adb_restricted)) -eq 1 ]
+ if [ "${restricted_ok}" = "true" ]
then
- adb_uci="$(which true)"
f_log "Restricted mode enabled"
fi
# check adblock temp directory
#
+ adb_tmpfile="$(mktemp -tu)"
+ adb_tmpdir="$(mktemp -p /tmp -d)"
if [ -n "${adb_tmpdir}" ] && [ -d "${adb_tmpdir}" ]
then
f_space "${adb_tmpdir}"
if [ $((av_space)) -le 2000 ]
then
rc=105
- f_log "not enough free space in '${adb_tmpdir}' (avail. ${av_space} kb)" "${rc}"
+ f_log "not enough free space in '${adb_tmpdir}' (avail. ${av_space} kb)"
f_exit
else
- f_log "not enough free space to handle all adblock list sources at once in '${adb_tmpdir}' (avail. ${av_space} kb)"
+ f_log "not enough free space to handle all block list sources at once in '${adb_tmpdir}' (avail. ${av_space} kb)"
fi
fi
else
rc=110
- f_log "temp directory not found" "${rc}"
+ f_log "temp directory not found"
f_exit
fi
# check backup configuration
#
- if [ -n "${adb_dir_backup}" ] && [ -d "${adb_dir_backup}" ]
+ if [ "${enabled_backup}" = "1" ] && [ -d "${adb_dir_backup}" ]
then
f_space "${adb_dir_backup}"
if [ "${space_ok}" = "false" ]
adb_dnsformat="awk -v ipv6="${adb_nullipv6}" '{print \"address=/\"\$0\"/\"ipv6}'"
fi
- # check ipv4/iptables configuration
+ # check volatile iptables configuration
#
if [ -n "${adb_wanif4}" ]
then
- f_firewall "IPv4" "nat" "A" "prerouting_rule" "adb-nat" "-p tcp -d ${adb_nullipv4} -m multiport --dports 80,443 -j DNAT --to-destination ${adb_ipv4}:${adb_nullport}"
- f_firewall "IPv4" "filter" "A" "forwarding_rule" "adb-fwd" "-p tcp -d ${adb_nullipv4} -j REJECT --reject-with tcp-reset"
- f_firewall "IPv4" "filter" "A" "forwarding_rule" "adb-fwd" "-d ${adb_nullipv4} -j REJECT --reject-with icmp-host-unreachable"
- f_firewall "IPv4" "filter" "A" "output_rule" "adb-out" "-p tcp -d ${adb_nullipv4} -j REJECT --reject-with tcp-reset"
- f_firewall "IPv4" "filter" "A" "output_rule" "adb-out" "-d ${adb_nullipv4} -j REJECT --reject-with icmp-host-unreachable"
- if [ $((adb_forcedns)) -eq 1 ] && [ -n "${adb_landev4}" ]
- then
- f_firewall "IPv4" "nat" "A" "prerouting_rule" "adb-dns" "-i ${adb_landev4} -p udp --dport 53 -j DNAT --to-destination ${adb_ipv4}:53"
- f_firewall "IPv4" "nat" "A" "prerouting_rule" "adb-dns" "-i ${adb_landev4} -p tcp --dport 53 -j DNAT --to-destination ${adb_ipv4}:53"
- fi
- if [ "${fw_done}" = "true" ]
+ check="$(iptables -w -t nat -vnL | grep -Fo "adb-")"
+ if [ -z "${check}" ]
then
- f_log "created volatile IPv4 firewall ruleset"
- fw_done="false"
+ if [ "${adb_forcedns}" = "1" ] && [ -n "${adb_landev4}" ]
+ then
+ f_firewall "IPv4" "nat" "prerouting_rule" "prerouting_rule" "0" "dns" "-i ${adb_landev4} -p udp --dport 53 -j DNAT --to-destination ${adb_ipv4}:53"
+ f_firewall "IPv4" "nat" "prerouting_rule" "prerouting_rule" "0" "dns" "-i ${adb_landev4} -p tcp --dport 53 -j DNAT --to-destination ${adb_ipv4}:53"
+ fi
+ f_firewall "IPv4" "nat" "prerouting_rule" "adb-nat" "1" "nat" "-p tcp --dport 80 -j DNAT --to-destination ${adb_ipv4}:${adb_nullport}"
+ f_firewall "IPv4" "nat" "prerouting_rule" "adb-nat" "2" "nat" "-p tcp --dport 443 -j DNAT --to-destination ${adb_ipv4}:${adb_nullportssl}"
+ if [ "${apmode_ok}" = "false" ]
+ then
+ f_firewall "IPv4" "filter" "forwarding_rule" "adb-fwd" "1" "fwd" "-p tcp -j REJECT --reject-with tcp-reset"
+ f_firewall "IPv4" "filter" "forwarding_rule" "adb-fwd" "2" "fwd" "-j REJECT --reject-with icmp-host-unreachable"
+ f_firewall "IPv4" "filter" "output_rule" "adb-out" "1" "out" "-p tcp -j REJECT --reject-with tcp-reset"
+ f_firewall "IPv4" "filter" "output_rule" "adb-out" "2" "out" "-j REJECT --reject-with icmp-host-unreachable"
+ fi
fi
fi
-
- # check ipv6/ip6tables configuration
- #
if [ -n "${adb_wanif6}" ]
then
- f_firewall "IPv6" "nat" "A" "PREROUTING" "adb-nat" "-p tcp -d ${adb_nullipv6} -m multiport --dports 80,443 -j DNAT --to-destination [${adb_ipv6}]:${adb_nullport}"
- f_firewall "IPv6" "filter" "A" "forwarding_rule" "adb-fwd" "-p tcp -d ${adb_nullipv6} -j REJECT --reject-with tcp-reset"
- f_firewall "IPv6" "filter" "A" "forwarding_rule" "adb-fwd" "-d ${adb_nullipv6} -j REJECT --reject-with icmp6-addr-unreachable"
- f_firewall "IPv6" "filter" "A" "output_rule" "adb-out" "-p tcp -d ${adb_nullipv6} -j REJECT --reject-with tcp-reset"
- f_firewall "IPv6" "filter" "A" "output_rule" "adb-out" "-d ${adb_nullipv6} -j REJECT --reject-with icmp6-addr-unreachable"
- if [ $((adb_forcedns)) -eq 1 ] && [ -n "${adb_landev6}" ]
- then
- f_firewall "IPv6" "nat" "A" "PREROUTING" "adb-dns" "-i ${adb_landev6} -p udp --dport 53 -j DNAT --to-destination [${adb_ipv6}]:53"
- f_firewall "IPv6" "nat" "A" "PREROUTING" "adb-dns" "-i ${adb_landev6} -p tcp --dport 53 -j DNAT --to-destination [${adb_ipv6}]:53"
- fi
- if [ "${fw_done}" = "true" ]
+ check="$(ip6tables -w -t nat -vnL | grep -Fo "adb-")"
+ if [ -z "${check}" ]
then
- f_log "created volatile IPv6 firewall ruleset"
- fw_done="false"
+ if [ "${adb_forcedns}" = "1" ] && [ -n "${adb_landev6}" ]
+ then
+ f_firewall "IPv6" "nat" "PREROUTING" "PREROUTING" "0" "dns" "-i ${adb_landev6} -p udp --dport 53 -j DNAT --to-destination [${adb_ipv6}]:53"
+ f_firewall "IPv6" "nat" "PREROUTING" "PREROUTING" "0" "dns" "-i ${adb_landev6} -p tcp --dport 53 -j DNAT --to-destination [${adb_ipv6}]:53"
+ fi
+ f_firewall "IPv6" "nat" "PREROUTING" "adb-nat" "1" "nat" "-p tcp --dport 80 -j DNAT --to-destination [${adb_ipv6}]:${adb_nullport}"
+ f_firewall "IPv6" "nat" "PREROUTING" "adb-nat" "2" "nat" "-p tcp --dport 443 -j DNAT --to-destination [${adb_ipv6}]:${adb_nullportssl}"
+ if [ "${apmode_ok}" = "false" ]
+ then
+ f_firewall "IPv6" "filter" "forwarding_rule" "adb-fwd" "1" "fwd" "-p tcp -j REJECT --reject-with tcp-reset"
+ f_firewall "IPv6" "filter" "forwarding_rule" "adb-fwd" "2" "fwd" "-j REJECT --reject-with icmp6-addr-unreachable"
+ f_firewall "IPv6" "filter" "output_rule" "adb-out" "1" "out" "-p tcp -j REJECT --reject-with tcp-reset"
+ f_firewall "IPv6" "filter" "output_rule" "adb-out" "2" "out" "-j REJECT --reject-with icmp6-addr-unreachable"
+ fi
fi
fi
+ if [ "${fw_done}" = "true" ]
+ then
+ f_log "created volatile firewall rulesets"
+ fw_done="false"
+ fi
- # check volatile adblock uhttpd instance configuration
+ # check volatile uhttpd instance configuration
#
- check="$(ps | pgrep -f "uhttpd -h /www/adblock")"
+ check="$(pgrep -f "uhttpd -h /www/adblock")"
if [ -z "${check}" ]
then
if [ -n "${adb_wanif4}" ] && [ -n "${adb_wanif6}" ]
then
- uhttpd -h "/www/adblock" -k 0 -N 100 -t 0 -T 1 -D -S -E "/index.html" -p "${adb_ipv4}:${adb_nullport}" -p "[${adb_ipv6}]:${adb_nullport}"
- rc=${?}
+ f_uhttpd "adbIPv4+6_80" "1" "-p ${adb_ipv4}:${adb_nullport} -p [${adb_ipv6}]:${adb_nullport}"
+ f_uhttpd "adbIPv4+6_443" "0" "-p ${adb_ipv4}:${adb_nullportssl} -p [${adb_ipv6}]:${adb_nullportssl}"
elif [ -n "${adb_wanif4}" ]
then
- uhttpd -h "/www/adblock" -k 0 -N 100 -t 0 -T 1 -D -S -E "/index.html" -p "${adb_ipv4}:${adb_nullport}"
- rc=${?}
+ f_uhttpd "adbIPv4_80" "1" "-p ${adb_ipv4}:${adb_nullport}"
+ f_uhttpd "adbIPv4_443" "0" "-p ${adb_ipv4}:${adb_nullportssl}"
else
- uhttpd -h "/www/adblock" -k 0 -N 100 -t 0 -T 1 -D -S -E "/index.html" -p "[${adb_ipv6}]:${adb_nullport}"
- rc=${?}
+ f_uhttpd "adbIPv6_80" "1" "-p [${adb_ipv6}]:${adb_nullport}"
+ f_uhttpd "adbIPv6_443" "0" "-p [${adb_ipv6}]:${adb_nullportssl}"
fi
- if [ $((rc)) -eq 0 ]
+ if [ "${uhttpd_done}" = "true" ]
then
- f_log "created volatile uhttpd instance"
- else
- f_log "failed to initialize volatile uhttpd instance" "${rc}"
- f_restore
+ f_log "created volatile uhttpd instances"
+ uhttpd_done="false"
fi
fi
awk "${adb_whitelist_rset}" "${adb_whitelist}" > "${adb_tmpdir}/tmp.whitelist"
fi
- # remove no longer used opkg package list
+ # remove temporary package list
#
unset pkg_list
}
if [ -z "${check}" ]
then
rc=115
- f_log "package '${package}' not found" "${rc}"
+ f_log "package '${package}' not found"
f_exit
fi
}
#
f_firewall()
{
- local ipt="${adb_iptv4}"
+ local ipt="iptables"
+ local nullip="${adb_nullipv4}"
local proto="${1}"
local table="${2}"
- local ctype="${3}"
+ local chsrc="${3}"
local chain="${4}"
- local notes="${5}"
- local rules="${6}"
+ local chpos="${5}"
+ local notes="adb-${6}"
+ local rules="${7}"
# select appropriate iptables executable for IPv6
#
if [ "${proto}" = "IPv6" ]
then
- ipt="${adb_iptv6}"
+ ipt="ip6tables"
+ nullip="${adb_nullipv6}"
+ fi
+
+ # check whether iptables chain already exist
+ #
+ rc="$("${ipt}" -w -t "${table}" -nL "${chain}" >/dev/null 2>&1; printf ${?})"
+ if [ $((rc)) -ne 0 ]
+ then
+ "${ipt}" -w -t "${table}" -N "${chain}"
+ "${ipt}" -w -t "${table}" -A "${chain}" -m comment --comment "${notes}" -j RETURN
+ "${ipt}" -w -t "${table}" -A "${chsrc}" -d "${nullip}" -m comment --comment "${notes}" -j "${chain}"
fi
- # check whether iptables rule already applied and proceed accordingly
+ # check whether iptables rule already exist
#
- rc="$("${ipt}" -w -t "${table}" -C "${chain}" -m comment --comment "${notes}" ${rules}; printf ${?})"
+ rc="$("${ipt}" -w -t "${table}" -C "${chain}" -m comment --comment "${notes}" ${rules} >/dev/null 2>&1; printf ${?})"
if [ $((rc)) -ne 0 ]
then
- "${ipt}" -w -t "${table}" -"${ctype}" "${chain}" -m comment --comment "${notes}" ${rules}
+ if [ $((chpos)) -eq 0 ]
+ then
+ "${ipt}" -w -t "${table}" -A "${chain}" -m comment --comment "${notes}" ${rules}
+ else
+ "${ipt}" -w -t "${table}" -I "${chain}" "${chpos}" -m comment --comment "${notes}" ${rules}
+ fi
rc=${?}
if [ $((rc)) -eq 0 ]
then
fw_done="true"
else
- f_log "failed to initialize volatile ${proto} firewall rule '${notes}'" "${rc}"
+ f_log "failed to initialize volatile ${proto} firewall rule '${notes}'"
f_exit
fi
fi
}
-# f_log: log messages to stdout and syslog
+# f_uhttpd: start uhttpd instances
#
-f_log()
+f_uhttpd()
{
- local log_parm
- local log_msg="${1}"
- local log_rc="${2}"
- local class="info "
-
- # check for terminal session
- #
- if [ -t 1 ]
- then
- log_parm="-s"
- fi
-
- # log to different output devices and set log class accordingly
- #
- if [ -n "${log_msg}" ]
+ local realm="${1}"
+ local timeout="${2}"
+ local ports="${3}"
+ uhttpd -h "/www/adblock" -N 25 -T "${timeout}" -r "${realm}" -k 0 -t 0 -R -D -S -E "/index.html" ${ports}
+ rc=${?}
+ if [ $((rc)) -eq 0 ]
then
- if [ $((log_rc)) -gt 0 ]
- then
- class="error"
- log_rc=", rc: ${log_rc}"
- log_msg="${log_msg}${log_rc}"
- fi
- "${adb_log}" ${log_parm} -t "adblock[${adb_pid}] ${class}" "${log_msg}" 2>&1
+ uhttpd_done="true"
+ else
+ f_log "failed to initialize volatile uhttpd instance (${realm})"
+ f_exit
fi
}
-################################################
# f_space: check mount points/space requirements
#
f_space()
{
local src_name
local count=0
- local count_sum=0
for src_name in $(ls -ASr "${adb_dnsdir}/${adb_dnsprefix}"*)
do
count=$((count / 2))
fi
"${adb_uci}" -q set "adblock.${src_name}.adb_src_count=${count}"
- count_sum=$((count_sum + count))
+ adb_count=$((adb_count + count))
done
- "${adb_uci}" -q set "adblock.global.adb_overall_count=${count_sum}"
+ "${adb_uci}" -q set "adblock.global.adb_overall_count=${adb_count}"
}
-# f_rmconfig: remove counters & timestamps in given config sections
+# f_rmconfig: remove volatile config entries
#
f_rmconfig()
{
- local src_name
- local rm_done="${1}"
- local restore_done="${2:-false}"
+ local opt
+ local options="adb_src_timestamp adb_src_count"
+ local section="${1}"
+
+ rm_cfg="${adb_lastrun}"
+ if [ -n "${rm_cfg}" ]
+ then
+ "${adb_uci}" -q delete "adblock.global.adb_overall_count"
+ "${adb_uci}" -q delete "adblock.global.adb_dnstoggle"
+ "${adb_uci}" -q delete "adblock.global.adb_percentage"
+ "${adb_uci}" -q delete "adblock.global.adb_lastrun"
+ for opt in ${options}
+ do
+ "${adb_uci}" -q delete "adblock.${section}.${opt}"
+ done
+ fi
+}
- for src_name in ${rm_done}
- do
- src_name="${src_name#*.}"
- if [ "${restore_done}" = "true" ]
+# f_rmdns: remove dns block lists and backups
+#
+f_rmdns()
+{
+ rm_dns="$(find "${adb_dnsdir}" -maxdepth 1 -type f -name "${adb_dnsprefix}*" -print -exec rm -f "{}" \;)"
+ if [ -n "${rm_dns}" ]
+ then
+ rm -rf "${adb_dnshidedir}"
+ if [ "${enabled_backup}" = "1" ] && [ -d "${adb_dir_backup}" ]
then
- src_name="${src_name%.*}"
- "${adb_uci}" -q set "adblock.${src_name}.adb_src_timestamp=list restored"
- else
- "${adb_uci}" -q delete "adblock.${src_name}.adb_src_count"
- "${adb_uci}" -q delete "adblock.${src_name}.adb_src_timestamp"
+ rm -f "${adb_dir_backup}/${adb_dnsprefix}"*.gz
fi
- done
+ /etc/init.d/dnsmasq restart
+ fi
}
-# f_restore: restore last adblock list backups and restart dnsmasq
+# f_rmuhttpd: remove uhttpd instances
#
-f_restore()
+f_rmuhttpd()
{
- local rm_done
- local restore_done
+ rm_uhttpd="$(pgrep -f "uhttpd -h /www/adblock")"
+ if [ -n "${rm_uhttpd}" ]
+ then
+ for pid in ${rm_uhttpd}
+ do
+ kill -9 "${pid}"
+ done
+ fi
+}
- # remove bogus adblock lists
- #
- if [ -n "${adb_revsrclist}" ]
+# f_rmfirewall: remove firewall rulsets
+#
+f_rmfirewall()
+{
+ rm_fw="$(iptables -w -t nat -vnL | grep -Fo "adb-")"
+ if [ -n "${rm_fw}" ]
then
- rm_done="$(find "${adb_dnsdir}" -maxdepth 1 -type f \( ${adb_revsrclist} \) -print -exec rm -f "{}" \;)"
- rc=${?}
- if [ $((rc)) -eq 0 ] && [ -n "${rm_done}" ]
- then
- f_rmconfig "${rm_done}"
- f_log "all bogus adblock lists removed"
- elif [ $((rc)) -ne 0 ]
+ iptables-save -t nat | grep -Fv -- "adb-" | iptables-restore
+ iptables-save -t filter | grep -Fv -- "adb-" | iptables-restore
+ if [ -n "$(lsmod | grep -Fo "ip6table_nat")" ]
then
- f_log "error during removal of bogus adblock lists" "${rc}"
- f_exit
+ ip6tables-save -t nat | grep -Fv -- "adb-" | ip6tables-restore
+ ip6tables-save -t filter | grep -Fv -- "adb-" | ip6tables-restore
fi
fi
+}
- # restore backups
+# f_log: log messages to stdout and syslog
+#
+f_log()
+{
+ local log_parm
+ local log_msg="${1}"
+ local class="info "
+ local lastrun="$(date "+%d.%m.%Y %H:%M:%S")"
+
+ # check for terminal session
#
- if [ "${backup_ok}" = "true" ]
+ if [ -t 1 ]
then
- restore_done="$(find "${adb_dir_backup}" -maxdepth 1 -type f -name "${adb_dnsprefix}*.gz" -print -exec cp -pf "{}" "${adb_dnsdir}" \;)"
- rc=${?}
- if [ $((rc)) -eq 0 ] && [ -n "${restore_done}" ]
- then
- find "${adb_dnsdir}" -maxdepth 1 -type f -name "${adb_dnsprefix}*.gz" -exec gunzip -f "{}" \;
- f_log "all available backups restored"
- elif [ $((rc)) -ne 0 ] && [ -n "${restore_done}" ]
- then
- f_log "error during restore of adblock lists" "${rc}"
- f_exit
- fi
- else
- f_log "backup service disabled, nothing to restore"
+ log_parm="-s"
fi
- # (re-)try dnsmasq restart without bogus adblock lists / with backups
+ # log to different output devices and set log class accordingly
#
- if [ -n "${restore_done}" ] || [ -n "${rm_done}" ]
+ if [ -n "${log_msg}" ]
then
- /etc/init.d/dnsmasq restart
- sleep 1
- check="$(ps | pgrep -f "dnsmasq")"
- if [ -n "${check}" ]
+ if [ $((rc)) -gt 0 ]
then
- rc=0
- f_cntconfig
- f_log "adblock lists with overall ${adb_count} domains loaded"
- else
- rc=120
- f_log "dnsmasq restart failed, please check 'logread' output" "${rc}"
+ class="error"
+ fi
+ logger ${log_parm} -t "adblock[${adb_pid}] ${class}" "${log_msg}" 2>&1
+
+ # clean exit on error
+ #
+ if [ $((rc)) -eq -1 ] || [ $((rc)) -gt 0 ]
+ then
+ f_rmdns
+ f_rmuhttpd
+ f_rmfirewall
+ config_foreach f_rmconfig source
+ "${adb_uci}" -q set "adblock.global.adb_lastrun=${lastrun} => runtime error, please check the log!"
+ "${adb_uci}" -q commit "adblock"
fi
fi
- f_exit
}
-# f_exit: delete (temporary) files, generate statistics and exit
-#
-f_exit()
+# f_statistics: adblock runtime statistics
+f_statistics()
{
- local ipv4_adblock=0
- local ipv6_adblock=0
- local lastrun="$(${adb_date} "+%d.%m.%Y %H:%M:%S")"
+ local ipv4_blk=0 ipv4_all=0 ipv4_pct=0
+ local ipv6_blk=0 ipv6_all=0 ipv6_pct=0
- # delete temporary files & directories
- #
- if [ -f "${adb_tmpfile}" ]
+ if [ -n "${adb_wanif4}" ]
then
- rm -f "${adb_tmpfile}"
+ ipv4_blk="$(iptables -t nat -vnL adb-nat | awk '$3 ~ /^DNAT$/ {sum += $1} END {printf sum}')"
+ ipv4_all="$(iptables -t nat -vnL PREROUTING | awk '$3 ~ /^prerouting_rule$/ {sum += $1} END {printf sum}')"
+ if [ $((ipv4_all)) -gt 0 ] && [ $((ipv4_blk)) -gt 0 ] && [ $((ipv4_all)) -gt $((ipv4_blk)) ]
+ then
+ ipv4_pct="$(printf "${ipv4_blk}" | awk -v all="${ipv4_all}" '{printf( "%5.2f\n",$1/all*100)}')"
+ fi
fi
- if [ -d "${adb_tmpdir}" ]
+ if [ -n "${adb_wanif6}" ]
then
- rm -rf "${adb_tmpdir}"
+ ipv6_blk="$(ip6tables -t nat -vnL adb-nat | awk '$3 ~ /^DNAT$/ {sum += $1} END {printf sum}')"
+ ipv6_all="$(ip6tables -t nat -vnL PREROUTING | awk '$3 ~ /^(adb-nat|DNAT)$/ {sum += $1} END {printf sum}')"
+ if [ $((ipv6_all)) -gt 0 ] && [ $((ipv6_blk)) -gt 0 ] && [ $((ipv6_all)) -gt $((ipv6_blk)) ]
+ then
+ ipv6_pct="$(printf "${ipv6_blk}" | awk -v all="${ipv6_all}" '{printf( "%5.2f\n",$1/all*100)}')"
+ fi
fi
+ "${adb_uci}" -q set "adblock.global.adb_percentage=${ipv4_pct}%/${ipv6_pct}%"
+ f_log "firewall statistics (IPv4/IPv6): ${ipv4_pct}%/${ipv6_pct}% of all packets in prerouting chain are ad related & blocked"
+}
+
+# f_exit: delete temporary files, generate statistics and exit
+#
+f_exit()
+{
+ local lastrun="$(date "+%d.%m.%Y %H:%M:%S")"
+
+ rm -f "${adb_tmpfile}"
+ rm -rf "${adb_tmpdir}"
# final log message and iptables statistics
#
if [ $((rc)) -eq 0 ]
then
- if [ -n "${adb_wanif4}" ]
- then
- ipv4_adblock="$(${adb_iptv4} -t nat -vnL | awk '$11 ~ /^adb-nat$/ {sum += $1} END {printf sum}')"
- ipv4_adblock="$((${ipv4_adblock} + $(${adb_iptv4} -vnL | awk '$11 ~ /^adb-(fwd|out)$/ {sum += $1} END {printf sum}')))"
- fi
- if [ -n "${adb_wanif6}" ]
- then
- ipv6_adblock="$(${adb_iptv6} -t nat -vnL | awk '$10 ~ /^adb-nat$/ {sum += $1} END {printf sum}')"
- ipv6_adblock="$((${ipv6_adblock} + $(${adb_iptv6} -vnL | awk '$10 ~ /^adb-(fwd|out)$/ {sum += $1} END {printf sum}')))"
- fi
- if [ -n "$(${adb_uci} -q changes adblock)" ]
- then
- "${adb_uci}" -q commit "adblock"
- fi
- f_log "firewall statistics (IPv4/IPv6): ${ipv4_adblock}/${ipv6_adblock} ad related packets blocked"
+ f_statistics
+ "${adb_uci}" -q set "adblock.global.adb_lastrun=${lastrun}"
+ "${adb_uci}" -q commit "adblock"
f_log "domain adblock processing finished successfully (${adb_scriptver}, ${adb_sysver}, ${lastrun})"
elif [ $((rc)) -gt 0 ]
then
- if [ -n "$(${adb_uci} -q changes adblock)" ]
- then
- "${adb_uci}" -q revert "adblock"
- fi
f_log "domain adblock processing failed (${adb_scriptver}, ${adb_sysver}, ${lastrun})"
else
rc=0
projects / feed / packages.git / blobdiff