mirror of
https://git.openwrt.org/feed/packages.git
synced 2024-06-13 19:03:52 +02:00
adblock: update 1.2.8
* fw rule changes: force_dns now supports multiple lan devices disable needless force_dns- & forward/output-rules in 'ap mode' check return codes during adblock chain creation * simplified the test for a running firewall * documentation update Signed-off-by: Dirk Brenken <dev@brenken.org>
This commit is contained in:
Dirk Brenken
parent
01f86b1f30
commit
fbd4a7c746
|
|
@ -7,7 +7,7 @@
|
|||
include $(TOPDIR)/rules.mk
|
||||
|
||||
PKG_NAME:=adblock
|
||||
PKG_VERSION:=1.2.7
|
||||
PKG_VERSION:=1.2.8
|
||||
PKG_RELEASE:=1
|
||||
PKG_LICENSE:=GPL-3.0+
|
||||
PKG_MAINTAINER:=Dirk Brenken <dev@brenken.org>
|
||||
|
|
|
|||
|
|
@ -89,8 +89,8 @@ A lot of people already use adblocker plugins within their desktop browsers, but
|
|||
## Chaos Calmer installation notes
|
||||
* 'adblock' and 'luci-app-adblock' are _not_ available as .ipk packages in the Chaos Calmer download repository
|
||||
* download both packages from a development snapshot package directory:
|
||||
* for 'adblock' look [here](https://downloads.openwrt.org/snapshots/trunk/ar71xx/generic/packages/packages/)
|
||||
* for 'luci-app-adblock' look [here](https://downloads.openwrt.org/snapshots/trunk/ar71xx/generic/packages/luci/)
|
||||
* for 'adblock' look [here](https://downloads.lede-project.org/snapshots/packages/x86_64/packages/)
|
||||
* for 'luci-app-adblock' look [here](https://downloads.lede-project.org/snapshots/packages/x86_64/luci/)
|
||||
* manually transfer the packages to your routers temp directory (with tools like _sshfs_ or _winscp_)
|
||||
* install the packages with _opkg install <...>_ as described above
|
||||
|
||||
|
|
@ -100,9 +100,10 @@ A lot of people already use adblocker plugins within their desktop browsers, but
|
|||
* **backup/restore:** enable the backup/restore feature, to restore automatically the latest compressed backup of your adblock lists in case of any processing error (i.e. a single blocklist source is down). Please use an (external) solid partition and _not_ your volatile router temp directory for this
|
||||
* **list updates:** for a scheduled call of the adblock service add an appropriate crontab entry (see example below)
|
||||
* **new list sources:** you could add new blocklist sources on your own via uci config, all you need is a source url and an awk one-liner (see example below)
|
||||
* **AP mode:** in AP mode adblock uses automatically the local router ip as nullip address. To make sure that your LuCI interface will be still accessible, please change the local uhttpd instance to ports <> 80/443 (see example below)
|
||||
* **AP mode:** in 'AP mode' adblock uses automatically the local router ip as nullip address. To make sure that your LuCI interface will be still accessible, you have to change the local uhttpd instance to ports <> 80/443 (see example below)
|
||||
* **restricted mode:** to disable flash writes with adblock status information to the adblock config file (used by LuCI frontend), please set 'adb\_restricted' to '1'
|
||||
* **adblock toggle:** to quickly switch adblocking 'on' or 'off', simply use _/etc/init.d/adblock toggle_
|
||||
* **adblock statistics:** to update only the adblock statistics (without updating the block lists as well), please run _/etc/init.d/adblock stats_
|
||||
* **configuration update:** to update an outdated adblock config file with the current default version, please run _/etc/init.d/adblock cfgup_, make your individual changes and start the adblock service again
|
||||
* **debugging:** for script debugging please set the 'adb\_debug' variable in the header of _/etc/init.d/adblock_ to '1'
|
||||
* **disable active dns probing in windows:** to prevent a possible yellow exclamation mark on your internet connection icon (which wrongly means connected, but no internet), please change the following registry key/value from "1" to "0" _HKLM\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet\EnableActiveProbing_
|
||||
|
|
@ -116,7 +117,7 @@ A lot of people already use adblocker plugins within their desktop browsers, but
|
|||
* adb\_nullportssl => port of the adblock uhttpd instance used for ads delivered on port 443 (default: '65535')
|
||||
* adb\_nullipv4 => IPv4 blackhole ip address (default: '198.18.0.1', in AP mode: local router ip)
|
||||
* adb\_nullipv6 => IPv6 blackhole ip address (default: '::ffff:c612:0001', in AP mode: local router ip)
|
||||
* adb\_forcedns => redirect all local DNS queries to the local dnsmasq resolver (default: '1', enabled)
|
||||
* adb\_forcedns => redirect all local DNS queries to the local dnsmasq resolver (default: '1', enabled / always disabled in 'AP mode')
|
||||
* adb\_fetchttl => set the timeout for list downloads (default: '5' seconds)
|
||||
* adb\_restricted => disable updates of the adblock config file (no flash writes) during runtime (default: '0', disabled)
|
||||
|
||||
|
|
@ -223,7 +224,7 @@ If your awk one-liner works quite well, add a new source section in adblock conf
|
|||
|
||||
## Background
|
||||
This adblock package is a dns/dnsmasq based adblock solution.
|
||||
Queries to ad/abuse domains are never forwarded and always replied with a local IP address which may be IPv4 or IPv6. For that purpose adblock uses an ip address from the private 'Benchmark Test' subnet (198.18.0.1 / ::ffff:c612:0001) by default (in AP mode the local router ip address will be used). Furthermore all ad/abuse queries will be filtered by ip(6)tables and redirected to two uhttpd instances, separated for ads delivered on port 80 and on port 443 (in PREROUTING chain) or rejected (in FORWARD or OUTPUT chain).
|
||||
Queries to ad/abuse domains are never forwarded and always replied with a local IP address which may be IPv4 or IPv6. For that purpose adblock uses an ip address from the private 'Benchmark Test' subnet (198.18.0.1 / ::ffff:c612:0001) by default (in AP mode the local router ip address will be used). Furthermore all ad/abuse queries will be filtered by ip(6)tables and redirected to two uhttpd instances, separated for ads delivered on port 80 and on port 443 (in PREROUTING chain) or rejected (in FORWARD or OUTPUT chain). In 'AP mode' only the uhttpd related rules in PREROUTING chain are enabled.
|
||||
|
||||
All iptables and uhttpd related adblock additions are non-destructive, no hard-coded changes in 'firewall.user', 'uhttpd' config or any other system related config files. There is _no_ adblock background daemon running, the (scheduled) start of the adblock service keeps only the adblock lists up-to-date.
|
||||
|
||||
|
|
|
|||
|
|
@ -103,10 +103,11 @@ f_envload()
|
|||
config_foreach parse_config service
|
||||
config_foreach parse_config source
|
||||
|
||||
# get ip addresses & logical wan devices
|
||||
# get network basics
|
||||
#
|
||||
network_get_ipaddr adb_ipv4 "${adb_lanif}"
|
||||
network_get_ipaddr6 adb_ipv6 "${adb_lanif}"
|
||||
network_get_device adb_landev "${adb_lanif}"
|
||||
network_find_wan adb_wanif4
|
||||
network_find_wan6 adb_wanif6
|
||||
|
||||
|
|
@ -162,9 +163,6 @@ f_envcheck()
|
|||
rc=-1
|
||||
f_log "no valid IPv4/IPv6 configuration found (${adb_lanif}), please set 'adb_lanif' manually"
|
||||
f_exit
|
||||
else
|
||||
network_get_device adb_landev4 "${adb_lanif}"
|
||||
network_get_device adb_landev6 "${adb_lanif}"
|
||||
fi
|
||||
|
||||
# check logical update interfaces (with default route)
|
||||
|
|
@ -191,7 +189,7 @@ f_envcheck()
|
|||
rc=-1
|
||||
f_log "please enable the local dnsmasq instance to use adblock"
|
||||
f_exit
|
||||
elif [ -z "$(iptables -w -vnL | grep -Fo "DROP")" ]
|
||||
elif [ ! -f "/var/run/fw3.state" ]
|
||||
then
|
||||
rc=-1
|
||||
f_log "please enable the local firewall to use adblock"
|
||||
|
|
@ -356,45 +354,37 @@ f_envcheck()
|
|||
#
|
||||
if [ -n "${adb_wanif4}" ]
|
||||
then
|
||||
check="$(iptables -w -t nat -vnL | grep -Fo "adb-")"
|
||||
if [ -z "${check}" ]
|
||||
if [ "${apmode_ok}" = "false" ]
|
||||
then
|
||||
if [ "${adb_forcedns}" = "1" ] && [ -n "${adb_landev4}" ]
|
||||
if [ "${adb_forcedns}" = "1" ] && [ -n "${adb_landev}" ]
|
||||
then
|
||||
f_firewall "IPv4" "nat" "prerouting_rule" "prerouting_rule" "0" "dns" "-i ${adb_landev4} -p udp --dport 53 -j DNAT --to-destination ${adb_ipv4}:53"
|
||||
f_firewall "IPv4" "nat" "prerouting_rule" "prerouting_rule" "0" "dns" "-i ${adb_landev4} -p tcp --dport 53 -j DNAT --to-destination ${adb_ipv4}:53"
|
||||
fi
|
||||
f_firewall "IPv4" "nat" "prerouting_rule" "adb-nat" "1" "nat" "-p tcp --dport 80 -j DNAT --to-destination ${adb_ipv4}:${adb_nullport}"
|
||||
f_firewall "IPv4" "nat" "prerouting_rule" "adb-nat" "2" "nat" "-p tcp --dport 443 -j DNAT --to-destination ${adb_ipv4}:${adb_nullportssl}"
|
||||
if [ "${apmode_ok}" = "false" ]
|
||||
then
|
||||
f_firewall "IPv4" "filter" "forwarding_rule" "adb-fwd" "1" "fwd" "-p tcp -j REJECT --reject-with tcp-reset"
|
||||
f_firewall "IPv4" "filter" "forwarding_rule" "adb-fwd" "2" "fwd" "-j REJECT --reject-with icmp-host-unreachable"
|
||||
f_firewall "IPv4" "filter" "output_rule" "adb-out" "1" "out" "-p tcp -j REJECT --reject-with tcp-reset"
|
||||
f_firewall "IPv4" "filter" "output_rule" "adb-out" "2" "out" "-j REJECT --reject-with icmp-host-unreachable"
|
||||
f_firewall "IPv4" "nat" "prerouting_rule" "adb-dns" "1" "dns" "-p udp --dport 53 -j DNAT --to-destination ${adb_ipv4}:53"
|
||||
f_firewall "IPv4" "nat" "prerouting_rule" "adb-dns" "2" "dns" "-p tcp --dport 53 -j DNAT --to-destination ${adb_ipv4}:53"
|
||||
fi
|
||||
f_firewall "IPv4" "filter" "forwarding_rule" "adb-fwd" "1" "fwd" "-p tcp -j REJECT --reject-with tcp-reset"
|
||||
f_firewall "IPv4" "filter" "forwarding_rule" "adb-fwd" "2" "fwd" "-j REJECT --reject-with icmp-host-unreachable"
|
||||
f_firewall "IPv4" "filter" "output_rule" "adb-out" "1" "out" "-p tcp -j REJECT --reject-with tcp-reset"
|
||||
f_firewall "IPv4" "filter" "output_rule" "adb-out" "2" "out" "-j REJECT --reject-with icmp-host-unreachable"
|
||||
fi
|
||||
f_firewall "IPv4" "nat" "prerouting_rule" "adb-nat" "1" "nat" "-p tcp --dport 80 -j DNAT --to-destination ${adb_ipv4}:${adb_nullport}"
|
||||
f_firewall "IPv4" "nat" "prerouting_rule" "adb-nat" "2" "nat" "-p tcp --dport 443 -j DNAT --to-destination ${adb_ipv4}:${adb_nullportssl}"
|
||||
fi
|
||||
if [ -n "${adb_wanif6}" ]
|
||||
then
|
||||
check="$(ip6tables -w -t nat -vnL | grep -Fo "adb-")"
|
||||
if [ -z "${check}" ]
|
||||
if [ "${apmode_ok}" = "false" ]
|
||||
then
|
||||
if [ "${adb_forcedns}" = "1" ] && [ -n "${adb_landev6}" ]
|
||||
if [ "${adb_forcedns}" = "1" ] && [ -n "${adb_landev}" ]
|
||||
then
|
||||
f_firewall "IPv6" "nat" "PREROUTING" "PREROUTING" "0" "dns" "-i ${adb_landev6} -p udp --dport 53 -j DNAT --to-destination [${adb_ipv6}]:53"
|
||||
f_firewall "IPv6" "nat" "PREROUTING" "PREROUTING" "0" "dns" "-i ${adb_landev6} -p tcp --dport 53 -j DNAT --to-destination [${adb_ipv6}]:53"
|
||||
fi
|
||||
f_firewall "IPv6" "nat" "PREROUTING" "adb-nat" "1" "nat" "-p tcp --dport 80 -j DNAT --to-destination [${adb_ipv6}]:${adb_nullport}"
|
||||
f_firewall "IPv6" "nat" "PREROUTING" "adb-nat" "2" "nat" "-p tcp --dport 443 -j DNAT --to-destination [${adb_ipv6}]:${adb_nullportssl}"
|
||||
if [ "${apmode_ok}" = "false" ]
|
||||
then
|
||||
f_firewall "IPv6" "filter" "forwarding_rule" "adb-fwd" "1" "fwd" "-p tcp -j REJECT --reject-with tcp-reset"
|
||||
f_firewall "IPv6" "filter" "forwarding_rule" "adb-fwd" "2" "fwd" "-j REJECT --reject-with icmp6-addr-unreachable"
|
||||
f_firewall "IPv6" "filter" "output_rule" "adb-out" "1" "out" "-p tcp -j REJECT --reject-with tcp-reset"
|
||||
f_firewall "IPv6" "filter" "output_rule" "adb-out" "2" "out" "-j REJECT --reject-with icmp6-addr-unreachable"
|
||||
f_firewall "IPv6" "nat" "PREROUTING" "adb-dns" "1" "dns" "-p udp --dport 53 -j DNAT --to-destination [${adb_ipv6}]:53"
|
||||
f_firewall "IPv6" "nat" "PREROUTING" "adb-dns" "2" "dns" "-p tcp --dport 53 -j DNAT --to-destination [${adb_ipv6}]:53"
|
||||
fi
|
||||
f_firewall "IPv6" "filter" "forwarding_rule" "adb-fwd" "1" "fwd" "-p tcp -j REJECT --reject-with tcp-reset"
|
||||
f_firewall "IPv6" "filter" "forwarding_rule" "adb-fwd" "2" "fwd" "-j REJECT --reject-with icmp6-addr-unreachable"
|
||||
f_firewall "IPv6" "filter" "output_rule" "adb-out" "1" "out" "-p tcp -j REJECT --reject-with tcp-reset"
|
||||
f_firewall "IPv6" "filter" "output_rule" "adb-out" "2" "out" "-j REJECT --reject-with icmp6-addr-unreachable"
|
||||
fi
|
||||
f_firewall "IPv6" "nat" "PREROUTING" "adb-nat" "1" "nat" "-p tcp --dport 80 -j DNAT --to-destination [${adb_ipv6}]:${adb_nullport}"
|
||||
f_firewall "IPv6" "nat" "PREROUTING" "adb-nat" "2" "nat" "-p tcp --dport 443 -j DNAT --to-destination [${adb_ipv6}]:${adb_nullportssl}"
|
||||
fi
|
||||
if [ "${fw_done}" = "true" ]
|
||||
then
|
||||
|
|
@ -483,7 +473,18 @@ f_firewall()
|
|||
then
|
||||
"${ipt}" -w -t "${table}" -N "${chain}"
|
||||
"${ipt}" -w -t "${table}" -A "${chain}" -m comment --comment "${notes}" -j RETURN
|
||||
"${ipt}" -w -t "${table}" -A "${chsrc}" -d "${nullip}" -m comment --comment "${notes}" -j "${chain}"
|
||||
if [ "${chain}" = "adb-dns" ]
|
||||
then
|
||||
"${ipt}" -w -t "${table}" -A "${chsrc}" -i "${adb_landev}+" -m comment --comment "${notes}" -j "${chain}"
|
||||
else
|
||||
"${ipt}" -w -t "${table}" -A "${chsrc}" -d "${nullip}" -m comment --comment "${notes}" -j "${chain}"
|
||||
fi
|
||||
rc=${?}
|
||||
if [ $((rc)) -ne 0 ]
|
||||
then
|
||||
f_log "failed to initialize volatile ${proto} firewall chain '${chain}'"
|
||||
f_exit
|
||||
fi
|
||||
fi
|
||||
|
||||
# check whether iptables rule already exist
|
||||
|
|
@ -491,12 +492,7 @@ f_firewall()
|
|||
rc="$("${ipt}" -w -t "${table}" -C "${chain}" -m comment --comment "${notes}" ${rules} >/dev/null 2>&1; printf ${?})"
|
||||
if [ $((rc)) -ne 0 ]
|
||||
then
|
||||
if [ $((chpos)) -eq 0 ]
|
||||
then
|
||||
"${ipt}" -w -t "${table}" -A "${chain}" -m comment --comment "${notes}" ${rules}
|
||||
else
|
||||
"${ipt}" -w -t "${table}" -I "${chain}" "${chpos}" -m comment --comment "${notes}" ${rules}
|
||||
fi
|
||||
"${ipt}" -w -t "${table}" -I "${chain}" "${chpos}" -m comment --comment "${notes}" ${rules}
|
||||
rc=${?}
|
||||
if [ $((rc)) -eq 0 ]
|
||||
then
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@
|
|||
#
|
||||
adb_pid="${$}"
|
||||
adb_pidfile="/var/run/adblock.pid"
|
||||
adb_scriptver="1.2.7"
|
||||
adb_scriptver="1.2.8"
|
||||
adb_mincfgver="2.2"
|
||||
adb_scriptdir="${0%/*}"
|
||||
if [ -r "${adb_pidfile}" ]
|
||||
|
|
|
|||
Loading…
Reference in New Issue
Block a user