AdGuardHome on GL routers

luochongjun · July 1, 2020, 2:09am

Disable DNS Rebinding Attack Protection if you use private IP address

anon37060996 · July 23, 2020, 9:29pm

Possible to update to AdGuard Home v0.103.2 on ar750s

Johnex · July 23, 2020, 9:50pm

It was released 3 hours ago

luochongjun · July 24, 2020, 1:33am

Of course, I will update as soon as possible.
V0.103.2 has been fully compatible with the GL. INet router, soon GL will release the official version, and later AdGuardHome can be upgraded directly on the GL router if the updated version is released.

github.com/AdguardTeam/AdGuardHome

GL-Inet integration

opened 08:02PM - 30 Jun 20 UTC

closed 05:34PM - 03 Jul 20 UTC

ameshkov

enhancement P2: High

Currently, here's the patch that is used by GL-Inet so that it was using the sam…e authentication as the router itself: https://forum.gl-inet.com/t/adguardhome-on-gl-routers/10664 We can't merge it as is, though. At this point, I suppose we should add a special command-line argument that launches AdGuard Home in the "Gl-Inet integration mode." In the future, we should change this and add some generic configuration options that would allow achieving the same result without hardcording anything. But this needs to be done later as a part of a more massive refactoring. <details> <summary>glinet.patch</summary> ```patch From 95896b1df90001a66643c79afcc1e78101852641 Mon Sep 17 00:00:00 2001 From: Luochongjun <luochongjun@gl-inet.com> Date: Wed, 27 May 2020 09:52:59 +0800 Subject: [PATCH] apply gl patch --- home/auth.go | 77 ++++++++++++++++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 70 insertions(+), 7 deletions(-) mode change 100644 => 100755 home/auth.go diff --git a/home/auth.go b/home/auth.go old mode 100644 new mode 100755 index a2d6d5f..a0206f4 --- a/home/auth.go +++ b/home/auth.go @@ -11,6 +11,10 @@ import ( "strings" "sync" "time" + "os" + "io/ioutil" + "unsafe" + "bytes" "github.com/AdguardTeam/golibs/log" "go.etcd.io/bbolt" @@ -20,6 +24,9 @@ import ( const cookieTTL = 365 * 24 // in hours const sessionCookieName = "agh_session" +const GL_TokenTimeoutSeconds = 3600 +const GL_CookieName = "Admin-Token" + type session struct { userName string expire uint32 // expiration time (in seconds) @@ -219,13 +226,53 @@ func (a *Auth) removeSession(sess []byte) { log.Debug("Auth: removed session from DB") } +func check_gl_token(sess string) bool { + token_name := "/tmp/gl_token_" + sess + _, err := os.Stat(token_name) + if err != nil { + return false + } + token_date:=get_token_date(token_name) + now := uint32(time.Now().UTC().Unix()) + return now <= (token_date + GL_TokenTimeoutSeconds); +} + +func arch_is_littlendian() bool { + var i int32 = 0x01020304 + u := unsafe.Pointer(&i) + pb := (*byte)(u) + b := *pb + return (b == 0x04) +} + +func get_token_date(file string) uint32 { + f, err := os.Open(file) + if err != nil { + return 0 + } + var date_token uint32 + bs,err := ioutil.ReadAll(f) + buf := bytes.NewBuffer(bs) + if arch_is_littlendian() { + binary.Read(buf, binary.LittleEndian, &date_token) + }else{ + binary.Read(buf, binary.BigEndian, &date_token) + } + return date_token +} // CheckSession - check if session is valid // Return 0 if OK; -1 if session doesn't exist; 1 if session has expired func (a *Auth) CheckSession(sess string) int { now := uint32(time.Now().UTC().Unix()) update := false - + a.lock.Lock() + // Returns success if gl_token is valid + if check_gl_token(sess) { + a.lock.Unlock() + return 0 + } + s, ok := a.sessions[sess] if !ok { a.lock.Unlock() @@ -388,7 +435,17 @@ func optionalAuth(handler func(http.ResponseWriter, *http.Request)) func(http.Re // redirect to login page if not authenticated ok := false cookie, err := r.Cookie(sessionCookieName) - if err == nil { + gl_cookie, glerr := r.Cookie(GL_CookieName) + // use gl cookie first + if glerr == nil { + log.Debug("Auth: Gl cookie value: %s", gl_cookie.Value) + r := Context.auth.CheckSession(gl_cookie.Value) + if r == 0 { + ok = true + } else if r < 0 { + log.Info("Auth: invalid cookie value: %s", gl_cookie) + } + }else if err == nil { r := Context.auth.CheckSession(cookie.Value) if r == 0 { ok = true @@ -409,8 +466,14 @@ func optionalAuth(handler func(http.ResponseWriter, *http.Request)) func(http.Re } if !ok { if r.URL.Path == "/" || r.URL.Path == "/index.html" { - w.Header().Set("Location", "/login.html") - w.WriteHeader(http.StatusFound) + if(len(Context.auth.users) != 0){ + w.Header().Set("Location", "/login.html") + w.WriteHeader(http.StatusFound) + } else {// if no users setting,redirect to gl-inet login + url := "http://" + strings.Split(r.Host, ":")[0] + log.Info("No AGH users setting,redirect to %s",url) + http.Redirect(w, r, url, http.StatusFound) + } } else { w.WriteHeader(http.StatusForbidden) _, _ = w.Write([]byte("Forbidden")) @@ -507,8 +570,8 @@ func (a *Auth) GetUsers() []User { // AuthRequired - if authentication is required func (a *Auth) AuthRequired() bool { - a.lock.Lock() + /*a.lock.Lock() r := (len(a.users) != 0) - a.lock.Unlock() - return r + a.lock.Unlock()*/ + return true } -- 2.7.4 ``` </details>

anon37060996 · July 24, 2020, 4:00pm

cant wait fore good stuff

anon37060996 · July 24, 2020, 4:05pm

thanks luochongjun , sorry but am realy like glinet products

luochongjun · July 25, 2020, 7:46am

I updated the firmware of AR750S and MV1000

reflector · July 26, 2020, 4:18pm

Hi, possible to build adguardhome for B1300 based on stable firmware 3.027?
testing firmware 3.104 breaks ddns.

AnonyOne · July 26, 2020, 5:03pm

hi @luochongjun

it would have been REALLY helpful if updated releases (like the one you have just added) would either -
(a) have a meaningful file name (with a proper sequential ver/build number etc),
and/or -
(b) would at least have proper description in the ReleaseNote.txt file in that folder. it would be helpful to know which build it is based on and what was modified/rectified/added so we know what to test for

Johnex · July 26, 2020, 6:16pm

This has already been covered before. Since the Adguard firmware versions are snapshots/testing versions, there are no changelogs for them. When a new firmware is set to Release so it appears in the UI as a new update, then there will be a list of changes.

yochanan · July 29, 2020, 9:02pm

I’m not able to disable it on the openwrt-ar750s-AdGuardHome 07252020 snapshot via the GL interface. The status message at the top is -700. I cant find a corresponding log in /var/log/ and nothing was written to /tmp/system.log.

EDIT: I was able to disable it via the LUCI interface.

luochongjun · July 31, 2020, 1:31am

Please try to turn off your manual DNS settings first.

yochanan · July 31, 2020, 3:52pm

I don’t have any manual DNS settings, however I’m using Mullvad VPN via Wireguard and have AdGuard Home enabled. Since they both change DNS, I imagine I’d have to disable both first then?

Johnex · July 31, 2020, 10:28pm

Can you update the S1300 as well? Thanks

ongkang · August 1, 2020, 9:35am

Wow just tested today in AR300M. Most of things work including add regional DNS filters, change upstream DNS, etc. I am using it together with wireguard (warp+, cloudflare dns in wireguard setting) and as for me, using Cloudflare (DNS over TLS ) in the upstream DNS setting (AdGuardHome) fails DNS resolver for all client. Everything’s back to normal after reverting back to standard DNS over udp.
Thanks for this additional update.

luochongjun · August 5, 2020, 4:10am

I have updated the firmware of S1300

Johnex · August 5, 2020, 9:58am

@luochongjun

I updated to that new version, but the Adguard version is broken. It shows as:
“Version: -SNAPSHOT-7c836c2”

So Adguard keeps notifying of a new version at the top of the page.

" AdGuard Home v0.103.3-SNAPSHOT-5188da6 is now available! Click here for more info."

luochongjun · August 5, 2020, 10:20am

I noticed that I will try to communicate with AdGuardHome and get back to you.

Rubycon · August 13, 2020, 4:25pm

Dear developer,
I am very happy with your firmware for the B1300. Is an update possible in near future ?

Regards

Nick_T · August 17, 2020, 12:52am

Hi.

I’ve just ordered the AR750S but still waiting for it to arrive.
And since I’ve been running Adguard Home as a service on MAC for a few months without a major problem, I wonder router’s spec wise, can the router run Adgurd Home smoothly with VPN on?

Thank you.