#!/bin/sh # adblock cgi remote script - dns based ad/abuse domain blocking # Copyright (c) 2026 Dirk Brenken # This is free software, licensed under the GNU General Public License v3. # (s)hellcheck exceptions # shellcheck disable=all # load relevant uci options # nft_remote="$(uci -q get adblock.global.adb_nftremote)" nft_macremote="$(uci -q get adblock.global.adb_nftmacremote)" nft_remotetimeout="$(uci -q get adblock.global.adb_nftremotetimeout)" nft_authorized="0" # parse query # query_str="${QUERY_STRING}" query_mac="$(printf "%s" "${query_str}" | sed -n 's/.*mac=$[^&]*$.*/\1/p' 2>/dev/null)" query_mode="$(printf "%s" "${query_str}" | sed -n 's/.*mode=$[^&]*$.*/\1/p' 2>/dev/null)" # determine MAC if not provided # if [ -z "${query_mac}" ]; then query_ip="${REMOTE_ADDR}" query_mac="$(ip neigh show 2>/dev/null | awk -v ip="${query_ip}" '$1==ip {print $5; exit}' 2>/dev/null)" fi # validate MAC address # printf '%s\n' "${query_mac}" | grep -Eq '^([0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2}$' 2>/dev/null \ && query_mac="$(printf '%s\n' "${query_mac}" | awk '{ print tolower($0) }' 2>/dev/null)" \ || query_mac="" # validate mode # [ "${query_mode}" = "renew" ] || query_mode="" # output header and start html # printf "%s\n\n" "Content-Type: text/html" printf "%s\n" " Adblock Remote Allow

Adblock Remote Allow

" # check if remote allow is enabled # if [ "${nft_remote}" != "1" ] || [ -z "${nft_macremote}" ]; then printf "%s\n" "

Remote allow is not enabled or no MAC addresses configured

" exit 0 fi if [ -z "${query_mac}" ]; then printf "%s\n" "

Could not determine MAC address

" exit 0 fi # check MAC authorization # for mac in ${nft_macremote}; do mac="$(printf '%s' "${mac}" | awk '{ print tolower($0) }')" if [ "${mac}" = "${query_mac}" ]; then nft_authorized="1" break fi done if [ "${nft_authorized}" = "0" ]; then printf "%s\n" "

MAC ${query_mac} is not authorized to use remote allow

" exit 0 fi # extract remaining timeout # # extract remaining timeout (strip ms part) remaining="$(nft list set inet adblock mac_remote 2>/dev/null | \ awk -v mac="${query_mac}" ' $0 ~ mac { for (i = 1; i <= NF; i++) { if ($i == "expires") { val = $(i+1) gsub(/[,}]/, "", val) sub(/s.*/, "s", val) print val exit } } } ')" # show renew option # if [ -z "${query_mode}" ] && [ -z "${remaining}" ]; then printf "%s\n" "

MAC ${query_mac} is currently not in the remote allow Set

Renew Set Entry

" exit 0 fi # add MAC # if [ -z "${remaining}" ]; then printf "%s\n" "

Renewing remote allow for MAC ${query_mac}

" nft add element inet adblock mac_remote "{ ${query_mac} }" >/dev/null 2>&1 printf "%s\n" "" fi # success message # printf "%s\n" "

MAC ${query_mac} is temporarily allowed
Remaining time: ${remaining:-${nft_remotetimeout}m}

" exit 0