* prevents the creation of an invalid json structure
* add more space to the domain column on cli
* removed test.sh script from package
Signed-off-by: Dirk Brenken <dev@brenken.org>
* switch all safesearch providers to dynamic ips (derived from cname)
* made the new safesearch approach compatible with bind-nslookup
* removed 3.x config compatibility code
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 4b0d029bb5)
* remove 'dshield' and 'sysctl' (discontinued)
* switch 'malwaredomains', 'shallalist' and 'winhelp' to https
* add a second regional list for poland (provided by matx1002)
* update readme
Signed-off-by: Dirk Brenken <dev@brenken.org>
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 5ba498f7c8)
* add anti_ad blocklist source
* made SafeSearch provider configurable, you can limit
SafeSearch to certain providers
* update readme
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit e5ab2de1ff)
* add regional list source for czech/slovak
* add regional list source for korea
* adapt oisd_nl changes, switch to adb-syntax domains
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 0a5e61ecb6)
* remove dumb list cache
* start adblock processing after adding/removing
list sources via CLI
* add regional list source for france
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit ab44d8146a)
* limit domain name length to max. 63 chars
to fix issues with energized sources
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 0b6ea12560)
* add 'status_service' as workaround to init for 19.07
* fix 'wifionice' auto-login script
* fix autologin script matching
* change wifi scanning to logical interface name,
no longer use the radio device
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 59cca01a23)
* prevent processing of spurious line endings
that confuses (g)awk
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit e291d68055)
* add a final sort step, this fixes dns reporting with
multiple pcap files as input
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 1d8d456a55)
* add 'ca-bundle' dependency
* fix a sort bug in report engine
* fix potential bugs in the f_extconf function
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit d6634b611a)
* new package dependencies: coreultis-sort and
a download util with SSL support
* focus on speed (multicore-support) to handle quite big lists
* include more than 40 pre-configured blocklist sources in a compressed
json file (/etc/adblock/adblock.sources.gz)
* dynamic SafeSearch support for google, bing, duckduckgo,
yandex, youtube and pixabay (CNAME (bind) & IP (dnsmaq, unbound))
* DNS backend autodetection
* Download Utility autodetection
* Report Interface autodetection
* Easy cron wrapper to set an adblock related auto-timer for
automatic blocklist updates
* raw domain/blocklist support (e.g. for dnscrypt support)
* re-add restrictive Jaillist support
* rework online doc
* Complete LuCI rewrite (migrated to client side JS)
Signed-off-by: Dirk Brenken <dev@brenken.org>
* remove 'reg_cz' list (abandoned)
* add 'notracking' list (provided by @rcarmo)
* 19.07-only: fix/bring back status message
Signed-off-by: Dirk Brenken <dev@brenken.org>
* remove 'ransomware' blocklist by abbuse.ch (discontinued)
from default adblock config
* fix/switch 'someonewhocares' config to https only
* fix curl download parameters to follow redirects and
suppress needless output
* made the tmp directory of sort operations configurable,
set 'adb_sorttmp' accordingly (only supported by 'coreutils-sort')
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 21a85fef22)
* fix possible dns restart issue with DNS File Reset (race condition)
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 219abdc5a1)
* some init tweaks
* use the usual wifi wrapper for reloads
* compatibility fix for latest wifi-related changes
in master (dynamic wireless radio reconfiguration)
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 05c3153bb7)
* add missing logd dependency
* check if logd is enabled during runtime
* some more init tweaks
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit de149441a4)
* limit firewall hotplug trigger to certain wan 'INTERFACE' as well,
to prevent possible race conditions during boot
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 0dee2a92de)
* fix a logical glitch in the hotplug event handler
* properly handle fatal iptables errors - even in subshells
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 49b43b81e8)
* more startup tweaks
* re-use f_log function in helper scripts
* small fixes / polish up for forthcoming 19.07 release
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 72fba3a17b)
* fix race condition in download utility detection during boot
* fix multiple possible bugs in ipset creation
* prevent parallel service starts
* refine service trigger handling
* add ssh daemon auto detection
* print to stdout if 'logger' is not available
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit fcea2f75c3)
* print to stdout if 'logger' is not available
* add support to set the service nice level (default is 0)
* small fixes / polish up for forthcoming 19.07 release
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 0d406b2a42)
* more startup tweaks
* re-use f_log function in helper scripts
* small fixes / polish up for forthcoming 19.07 release
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 2c3cb6f1d1)
* the WAN auto detection now supports multiple interfaces, too
* no longer filter out possible LAN devices
* add a new DoH (DNS over HTTPS) blocklist source with public
DoH DNS server addresses, to effectively block client side DoH
communication, e.g. via Firefox or Chrome
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 70ab67649b)
* new 'ca-bundle' dependency as all https connections
are now validated by default
* automatically select the download utility: 'aria2', 'curl',
'uclient-fetch' with libustream-* or wget are supported
* track & ban failed LuCI login attempts as well
* add a small log/banIP background monitor to block
SSH/LuCI brute force attacks in realtime (disabled by default)
* add a config version check (please update your default config!)
* made the automatic wan detection more stable
* fix the IPv6 logfile parser
* fix the service status message
* update readme
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit ff8b853a6d)
* remove 'http-only' mode, all sources are now fetched from https sites
* the backup mode is now mandatory ('/tmp' is the default backup
directory), always create and re-use backups if available.
To force a re-download take the 'reload' action.
* support 'sshd' in addition to 'dropbear' for logfile parsing
to detect break-in events
* always update the black-/whitelist with logfile parsing results
in 'refresh' mode (no new downloads)
* rework the return code handling
* tweak procd trigger
* various small fixes
* (s)hellsheck cosmetics
* Change .*GPL.*+ licenses to SPDX compatible identifier
Signed-off-by: Dirk Brenken <dev@brenken.org>
* use raw procd interface trigger as last resort, if the
adblock config is not available during startup
* fix selective subdomain whitelisting for dnsmasq
* fix a kresd restart issue with 'DNS File Reset'
* fix a suspend/resume cornercase
* disable the tld compression, if the number of blocked domains
is greater than 'adb_maxtld' (default: 100000)
* made the fw portlist configurable (default '53 853 5353')
* preliminary support for inotify-like autoload features
of dns backends like kresd in future Turris OS. If 'adb_dnsinotify'
is set to 'true', all adblock related restarts and the
'DNS File Reset' will be disabled
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 45cb0e1023)
* automatically add open uplinks to your wireless config,
e.g. hotel captive portals (disabled by default)
* shift net status check in a separate function
* (s)hellcheck cosmetics
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 1d90509b03)
* fix the 'adb_sysver' output
* pass the adblock version information to the helper scripts correctly
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 161597f2fa)
* fix a dns restart issue if 'flush dns cache' is set
* fix a suspend/resume issue, the status wasn't properly updated
* fix a long standing query issue
* rework return code handling, mostly for debugging
* various cleanups & cosmetics
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 95189994e7)
* background service: no longer miss "signal" events for the
dns backend (to trigger adblock)
* fix a dns backend reload issue during switch between
different blocking modes
* domain query: report found domains only once in
"null" blocking mode with IPv4 & IPv6 list entries
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 806f5ca9d8)
* fix a possible race condition during DNS file reset on slow hardware
* optimize DNS restart behaviour in 'null' blocking mode
* mute useless warnings
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 866878aa78)
* add support for 'DNS File Reset', where the final DNS blockfile
will be purged after DNS backend loading (save storage space).
A small background service will be started to trace/handle
dns backend reloads/restarts
* add support for the 'null' blocking variant in dnsmasq
(via addn-hosts), which may provide better response times
in dnsmasq
* enhance the report & search engine to support
the new blocking variants. Search now includes
backups & black-/whitelist as well
* compressed source list backups are now mandatory (default to '/tmp')
* speed up TLD compression
* E-Mail notification setup is now integrated in UCI/LuCI
* update the LuCI frontend to reflect all changes (separate PR)
* drop preliminary dnscrypt-proxy-support (use dnsmasq instead)
* drop additional 'dnsjail' blocklist support (not used by anyone)
* procd cleanups in init
* various shellcheck cleanups
* update readme
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 504412ccdb)
* add missing dnsmasq dependency
* add a captive portal auto-login hook (configurable via uci/LuCI),
you could reference an external auto-login script - see readme
* provide an auto-login script for german ICE hotspots
(/etc/travelmate/wifionice.login), requires 'curl'
* small fixes
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 5a2a4fa20a)
* use '$ddns_rundir' in 'get_service_data' for pipe creation, fix#8971
* add missing local variables in 'get_service_data'
* change DNS server verification with drill in 'verify_host_port',
fix/supersed #8935
* remove needless cat calls in 'verify_host_port'
* set cloudfare TTL to min. 120 seconds, fix#7745
* bump/align package version number
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 2e06c4ec93)
* fix a corner case issue with auto expiry of the
'Faulty Station' list (the last run information was not updated)
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 59a69ee059)
* optimize the main scan/iwinfo call (performance & system load):
- remove a needless f_trim function call
- remove a redundant awk call
- reduce the scan buffer size and
make it configurable (trm_scanbuffer, default 1024 bytes)
* cosmetics
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 8335e6e76c)
* refine 'refresh' mode, add normal processing/download as fallback
* remove needless reload trigger
* fix various ipset warnings
* fix timer in 'refresh' mode
* adapt ssbl regex to new source list format
Signed-off-by: Dirk Brenken <dev@brenken.org>
* change iptables whitelist target from 'ACCEPT' to 'RETURN'
to stop traversing the banIP chain and resume at the next chain
* cosmetics
Signed-off-by: Dirk Brenken <dev@brenken.org>
* remove needless sort step to reduce system load
* change maxqueue default in backend and LuCI frontend
to '4' to reduce (default) system load
* cosmetics
Signed-off-by: Dirk Brenken <dev@brenken.org>
* add a 'Net Error Check' which treats a missing
internet availability as an error (disabled by default)
* add a 'List Auto Expiry' which automatically resets
the 'Faulty Stations' list after n minutes,
default is '0' which means no expiry (old behaviour).
* rework major parts of the check subroutine
* add both features to LuCI frontend (separate PR/commit)
Signed-off-by: Dirk Brenken <dev@brenken.org>
* fix a json related ressource leak
* add a reload trigger when the wireless config gets changed
* set an interface default 'trm_wwan' (like the LuCI frontend)
* reordered nested loops to optimize the connection handling
Signed-off-by: Dirk Brenken <dev@brenken.org>
* fix for #8357
* fix unexpectedy calling option_cb() during wireless config_load
* react immediately when the current active uplink connection
gets deleted
Signed-off-by: Dirk Brenken <dev@brenken.org>
* add captive portal domains automatically to the related
domain whitelist (dhcp option 'rebind_domain'),
if rebind protection/RFC1918 is enabled
Signed-off-by: Dirk Brenken <dev@brenken.org>
Dirk Brenken