-the trigger calls start refresh, start_service() skips the run
while adblock_status in the runtime file is anything but error
- a missing or unreadable runtime file still starts a run,
which covers the boot case, and a failed run is retried on the next interface event
- manual start, boot, restart and reload are unaffected;
a suspended or stopped adblock is no longer restarted by an interface event
- wan6 in adb_trigger is supported now
- updatted the README and moved to the package root
- LuCI: reworked the feed editor, get rid of custom css
Signed-off-by: Dirk Brenken <dev@brenken.org>
CARTO now requires an API key for the raster basemaps at basemaps.cartocdn.com and watermarks every unauthenticated tile request, so the GeoIP map currently renders "API KEY REQUIRED" across the whole viewport.
Therefore in luci-app-banip the basemap is now drawn from country outlines that ship with the package: Natural Earth 1:110m, public domain, all attributes stripped, simplified to 36 kB (~10 kB in the apk).
readme changes in the base package only
Signed-off-by: Dirk Brenken <dev@brenken.org>
- only cap the cpu core count by available memory if it was auto-detected,
a manually set 'adb_cores' is now authoritative and no longer lowered
- readme update: clarify that the auto-cap does not apply to a manually
set core count
Signed-off-by: Dirk Brenken <dev@brenken.org>
The runtime status reported the last run as DD/MM/YYYY, which reads as a
different date entirely for anyone used to month first ordering.
Use YYYY-MM-DD instead. The DNS report already derives its timestamps from
tcpdump -tttt and is ISO 8601, so both views now agree, and the format is
unambiguous regardless of the reader's locale.
Signed-off-by: Dirk Brenken <dev@brenken.org>
* add new 'adb_repfilter' option to pass an additional, user
defined tcpdump filter expression which is logically ANDed
to the internal port filter. This allows to exclude redundant
traffic upfront, e.g. DNS requests originating from the router
itself which are routed via a VPN client interface and which
are picked up again when 'adb_repiface' is set to 'any';
see the readme for details/examples.
Signed-off-by: Dirk Brenken <dev@brenken.org>
The map array anchor and the f_fetch call were placed inside the uplink branch, so a WAN
interface without a resolvable address left adb_map.jsn empty. That skipped the blocked domain
lookup as well and dropped the entire map, not just the local marker.
Signed-off-by: Dirk Brenken <dev@brenken.org>
- add f_mem() helper to read MemAvailable from /proc/meminfo,
replacing three duplicated inline reads in f_load, f_dns and f_jsnup
- cap the auto-detected CPU core count by available memory in f_load:
adb_cores is limited to MemAvailable / 48 (MiB per job), floored to at least 1 core;
this bounds the number of feeds processed in parallel on constrained devices,
a user-set adb_cores is still honored as a ceiling (the cap only ever lowers it).
- derive the GNU sort buffer size from available memory
- readme update:
- added a "low memory systems" recommendation to use
the zram-swap package (compressed swap) with a swappiness hint,
plus a sizing rule of thumb — this works for all DNS backends OOTB
- significantly expanded the custom-feeds section (all JSON fields, rule parameters, etc.)
Signed-off-by: Dirk Brenken <dev@brenken.org>
- f_search: refactored backup and local block-/allowlist scan to run in parallel
- f_search: raise the search timeout in backups to max. 90 seconds
- f_load: skip f_fetch for search action, no remote download is needed for local lookups
- f_dns: skip destructive paths (file wipe, f_dnsup) for search and report actions
- LuCI: adapt search backend changes in the frontend
- LuCI: minor frontend fixes & improvements
Signed-off-by: Dirk Brenken <dev@brenken.org>
- gated f_load behind a ubus socket check at the end of adblock.sh
to harden against pre-ubus invocations
- added a 'adb_bver' fallback in f_log for invocation paths without prior f_load execution
- minor code improvements and fixes
Signed-off-by: Dirk Brenken <dev@brenken.org>
* added an separate adblock rundir (/var/run/adblock)
* refine the cpu/core detection
* behaviour change: allowlist domains now also removes subdomains from the blocklist
* flock/serialize the etag writing in the f_etag function
* code clean-up/linting
Signed-off-by: Dirk Brenken <dev@brenken.org>
* fixed a parsing issue in the DNS reporting,
see https://github.com/openwrt/packages/pull/29063 for details
* optimized the CGI/Adblock Remote Allow
* optimized the TLD function
* optimized the mail include
* removed needless forks
* various code-cleanups & small fixes
* updated the readme
* LuCI: small fixes & optimizations
Signed-off-by: Dirk Brenken <dev@brenken.org>
* renamed f_query to f_search (Query => Search)
* add better input validation to the f_search function,
to compensate for the very limited Wildcard ACL mechanisms in LuCI, see
https://github.com/openwrt/luci/issues/8435 for reference
* LuCI: add a proper poll mechanism to mitigate Reporting timeouts
on "Search" and "Refresh", even with big pcap files
* LuCI: Refine some ACLs
* LuCI: more fixes & optimizations
* readme update
Signed-off-by: Dirk Brenken <dev@brenken.org>
* refine the domain validator regarding prefix handling, esp.
relevant for ABP-syntax
* adapted the adguard feed to make use of the new prefix handling
* LuCI: various fixes & optimizations
Signed-off-by: Dirk Brenken <dev@brenken.org>
* optimized the awk for the Top10 statistics in the DNS Report,
removed the faulty caching (reported in the forum)
* minor improvement in the f_switch function
* readme update
Signed-off-by: Dirk Brenken <dev@brenken.org>
* the suspend/resume function now uses the external
DNS bridge when this function is used
* refine the f_nftadd function
* more file debug logging
* LuCI: add unfiltered DNS-Server to the DNS bridge selection
* LuCI: minor fixes
Signed-off-by: Dirk Brenken <dev@brenken.org>
* fixed the debug errorfile handling
* fixed a typo in the nftadd function
* minor cornercase improvements
* LuCI: minor cleanups & fixes
Signed-off-by: Dirk Brenken <dev@brenken.org>
* added a new firewall feature: the DNS‑Bridge.
This temporary DNS bridge ensures that an external fallback DNS server
is automatically used during local DNS restarts, providing Zero‑Downtime DNS resolution.
* The debug mode now captures internal error output in a dedicated log file,
located by default in the adblock base directory as /tmp/adb_error.log.
* LuCI: exposed the previously missing adb_cores option (auto‑detected by default).
* LuCI: added support for the new DNS‑Bridge options (Zero‑Downtime during DNS restarts).
Signed-off-by: Dirk Brenken <dev@brenken.org>
* Remote DNS Allow: this additional firewall feature lets selected client devices
temporarily bypass local DNS blocking and use an external, unfiltered DNS resolver.
* LuCI: new Firewall options for remote Access
* readme update
Signed-off-by: Dirk Brenken <dev@brenken.org>
* add interface information to the dns report
* support multiple tcpdump interfaces ('any') in the dns report properly
Signed-off-by: Dirk Brenken <dev@brenken.org>
* rework DNS reporting: more reliable, more information (request type), better performance
* fixed minor issues
* readme update
* LuCI: added new DNS page (incl. Allowed/Blocked canvas)
Signed-off-by: Dirk Brenken <dev@brenken.org>
* added firewall rules based on nftables in a separate isolated nftables table (inet adblock)
and chains (prerouting), with MAC addresses stored in an nftables set.
Implemented the following firewall‑integrated features:
* external DNS Routing (unfiltered): routes DNS queries from selected devices or interfaces
to an external unfiltered DNS resolver
* external DNS Routing (filtered): routes DNS queries from selected devices or interfaces
to an external filtered DNS resolver
* force DNS: blocks or redirects all external DNS traffic from selected interfaces
to ensure that clients use the local resolver
* removed the optional generation of an additional jail list (only supported bydnsmasq),
use the new, resolver independent ext. DNS routing instead
* removed the pz-client-ip feature (only supported by bind),
use the new, resolver independent ext. DNS routing instead
* removed the obsolete, hardcoded fw4 rules for DNS enforcement
existing rules will be removed via uci-defaults script after adblock update
* changed the Jail mode to a simple allowlist-only mode
* fixed minor issues in the mail template
* readme update
* LuCI: added a new config tab "Firewall Settings"
* LuCI: fixed minor usability issues
Signed-off-by: Dirk Brenken <dev@brenken.org>
* hardened the uci config parsing
* added a fast, flexible & secure domain validator function, it eliminates > 99 % of garbage inputs
- Please note: the "rule" in the feed file now only includes parameters for the domain validator,
see readme for details. Please nuke a custom feed file from former versions - they are no longer
compatible
* readme update
* LuCI: fixed a minor issue in the logread template
* LuCI: adapted the rule select options in the custom feed editor to use the new domain validator
Signed-off-by: Dirk Brenken <dev@brenken.org>
* fixed a typo in the allowlist/blocklist regex
* limit the f_switch function to only the suspend/resume actions
Signed-off-by: Dirk Brenken <dev@brenken.org>
* fix domain regex
* fix typo in f_query function
* remove backups during stop action or in disabled state
Signed-off-by: Dirk Brenken <dev@brenken.org>
* major feed cleanup, removed the following default feeds:
- adaway, unmaintained for more than 2 years
- easylist/easyprivacy, not effective for DNS-based ad blocking plus too many false positives
- energized_*, broken
- lightswitch05, abandoned
- notracking, abandoned
- openphish, not effective for DNS-based ad blocking plus too many false positives
- reg_*, not effective for DNS-based ad blocking plus too many false positives
- winhelp, unmaintained for more than 2 years
* update the utcapitole categories
* automatically migrate the hagezi categories via uci-defaults script to the new format
* the adblock status now includes the backend- and frontend version information
* small performance improvements
* LuCI: no longer call the logread binary, use rpc / the ubus log object instead
* LuCI: various code cleanups
* LuCI: various small usability improvements
* readme update
Signed-off-by: Dirk Brenken <dev@brenken.org>
* support TLDs in feeds and local block-/allowlist, e.g. to block all 'de' domains with a single entry
* add active feed domains (of the feed download URLs) automatically to the local allowlist, to prevent download erros
* update the feed categories of 1hosts
* update and change the feed categories of hagezi: new categories are 'abusetlds', 'social', 'urlshortener' and
'nrd' (newly registered domains). The latter one required download URL changes.
Please note: if you use hagezi than remove and re-add the categories in LuCI feed selection after the updae
* Add an external adblock test (https://adblock.turtlecute.org/) on the DNS reporting tab, itprovides a simple
way to check whether your current adblock setup is working as expected
* readme update
Signed-off-by: Dirk Brenken <dev@brenken.org>
* added a new "divested" feed, see https://divested.dev/pages/dnsbl
* added a new nsfw category of the hagezi feed
* added the missing custom feed file handling in the backend
* added a geoIP map with all blocked domains (plus the homeIP) in a
modal popup window on the Reporting tab in LuCI
* fixed the fetchcmd autodetection
* small code fixes and improvements
* update the readme, added a new "Best practise" section
* update different LuCI components (separate commit)
Signed-off-by: Dirk Brenken <dev@brenken.org>
* add an uci-defaults script for housekeeping and option migration from former versions
* update the readme
Signed-off-by: Dirk Brenken <dev@brenken.org>
Dirk Brenken