net/ddns-scripts: add API-based registered IP verification for Cloudflare proxied records

[bdk38]

Description:
This patch introduces optional API-based verification of registered IPs for Cloudflare services, addressing inaccuracies in DNS lookups for proxied (orange cloud) records. It prevents unnecessary updates by fetching the origin IP directly via the Cloudflare API v4.

Problem Addressed:
The standard DDNS scripts rely on DNS lookups (e.g., via nslookup or host) to verify registered IPs. For providers like Cloudflare with proxied records (orange cloud enabled), this returns the provider's edge IP instead of the origin server's IP, leading to incorrect comparisons, unnecessary update attempts, and potential rate limiting. Workarounds like dummy subdomains or CNAMEs are cumbersome.

Solution Overview:
This PR adds optional API-based verification for Cloudflare, fetching the record's "content" (origin IP) directly. It is enabled via a new UCI option use_api_check '1' in /etc/config/ddns sections with service_name 'cloudflare.com-v4'. The implementation reuses existing authentication (username/password as API credentials) and handles IPv4/IPv6, retries, and errors consistently with the DNS fallback.

Detailed Changes:

1. dynamic_dns_functions.sh:

   • Added default for use_api_check=0 if unset.
   • Extended get_registered_ip() with Cloudflare API logic: Sets up curl with headers, fetches zone/record IDs (supporting optional param_opt for pre-defined IDs), retrieves the IP content, and integrates with existing retry loop.
   • Updated domain parsing to use $domain for accurate zone queries with subdomains.
   • Preserved backward compatibility via fallback to DNS tools when use_api_check=0 or for other providers.

2. dynamic_dns_updater.sh:

   • Added default value and in-script comment for use_api_check.

3. update_cloudflare_com_v4.sh:

   • Removed redundant IP fetch and comparison, as verification now occurs in get_registered_ip(). Assumes update is needed when called.

4. dynamic_dns_lucihelper.sh:

   • Updated usage comments and getopts loop to include support for the new option via parameter -a (enables use_api_check=1), ensuring compatibility with LUCI-based testing.

No changes to package dependencies (relies on existing curl and jsonfilter). The patch is modular and tested for no impact on non-Cloudflare services.

Testing Performed:

• Confirmed accurate origin IP detection, no unnecessary updates on matches, and successful updates on mismatches.
• Tested error cases: Invalid credentials (logs error, retries), API failures (falls back or exits gracefully).
• Regression: Disabled use_api_check; verified DNS fallback works for Cloudflare and other providers (e.g., No-IP).
• LUCI integration: Status displays correct registered IPs; reload/stop functions operate without issues.
• Build: make package/ddns-scripts/check V=s passes; no compilation errors. All added functionality operates correctly, with accurate IP detection and no unwarranted updates.

References:

• OpenWRT DDNS Guide: https://openwrt.org/docs/guide-user/services/ddns/client
• Cloudflare API Docs: https://developers.cloudflare.com/api/

This enhances usability for Cloudflare users without affecting existing setups. Feedback welcome.

📦 Package Details

Christian Schoenebeck @chris5560
Florian Eckert @feckert

---

🧪 Run Testing Details

• OpenWrt 24.10.4 r28959-29397011cc
• mediatek/filogic
• GL.iNet GL-MT6000

---

✅ Formalities

• I have reviewed the CONTRIBUTING.md file for detailed contributing guidelines.