From 36c2338fc3f05f46dc84d95015656e270f0dd77f Mon Sep 17 00:00:00 2001 From: Mohd Husaam Mehdi Date: Wed, 5 Feb 2025 13:43:36 +0530 Subject: [PATCH] parental-control: add procd one shot script --- parental-control/Makefile | 4 +- .../files/etc/config/parentalcontrol | 94 ++++++- .../files/etc/init.d/parentalcontrol | 18 ++ .../files/lib/parentalcontrol/sync_bundles.sh | 246 ++++++++++++++++++ 4 files changed, 358 insertions(+), 4 deletions(-) create mode 100644 parental-control/files/lib/parentalcontrol/sync_bundles.sh diff --git a/parental-control/Makefile b/parental-control/Makefile index 9fb394347..543b6eca2 100644 --- a/parental-control/Makefile +++ b/parental-control/Makefile @@ -5,13 +5,13 @@ include $(TOPDIR)/rules.mk PKG_NAME:=parental-control -PKG_VERSION:=1.0.4 +PKG_VERSION:=1.1.0 LOCAL_DEV:=0 ifneq ($(LOCAL_DEV),1) PKG_SOURCE_PROTO:=git PKG_SOURCE_URL:=https://dev.iopsys.eu/network/parental-control.git -PKG_SOURCE_VERSION:=eea7793e26b52f45f4e47e849894ac3f8cdc3747 +PKG_SOURCE_VERSION:=92006ee45e164b5b1dd75a8047988a277b47bf19 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz PKG_MIRROR_HASH:=skip endif diff --git a/parental-control/files/etc/config/parentalcontrol b/parental-control/files/etc/config/parentalcontrol index fd30de201..250ca7533 100644 --- a/parental-control/files/etc/config/parentalcontrol +++ b/parental-control/files/etc/config/parentalcontrol @@ -1,3 +1,93 @@ config globals 'globals' - option enable '0' - option loglevel '3' + option enable '0' + option loglevel '3' + +config urlbundle 'urlbundle_1' + option enable '0' + option name 'Abuse' + option download_url 'https://blocklistproject.github.io/Lists/alt-version/abuse-nl.txt' + +config urlbundle 'urlbundle_2' + option enable '0' + option name 'Ads' + option download_url 'https://blocklistproject.github.io/Lists/alt-version/ads-nl.txt' + +config urlbundle 'urlbundle_3' + option enable '0' + option name 'Crypto' + option download_url 'https://blocklistproject.github.io/Lists/alt-version/crypto-nl.txt' + +config urlbundle 'urlbundle_4' + option enable '1' + option name 'Drugs' + option download_url 'https://blocklistproject.github.io/Lists/alt-version/drugs-nl.txt' + +config urlbundle 'urlbundle_5' + option enable '0' + option name 'Everything else' + option download_url 'https://blocklistproject.github.io/Lists/alt-version/everything-nl.txt' + +config urlbundle 'urlbundle_6' + option enable '1' + option name 'Facebook/Instagram' + option download_url 'https://blocklistproject.github.io/Lists/alt-version/facebook-nl.txt' + +config urlbundle 'urlbundle_7' + option enable '1' + option name 'Fraud' + option download_url 'https://blocklistproject.github.io/Lists/alt-version/fraud-nl.txt' + +config urlbundle 'urlbundle_8' + option enable '1' + option name 'Gambling' + option download_url 'https://blocklistproject.github.io/Lists/alt-version/gambling-nl.txt' + +config urlbundle 'urlbundle_9' + option enable '0' + option name 'Malware' + option download_url 'https://blocklistproject.github.io/Lists/alt-version/malware-nl.txt' + +config urlbundle 'urlbundle_10' + option enable '1' + option name 'Phishing' + option download_url 'https://blocklistproject.github.io/Lists/alt-version/phishing-nl.txt' + +config urlbundle 'urlbundle_11' + option enable '1' + option name 'Piracy' + option download_url 'https://blocklistproject.github.io/Lists/alt-version/piracy-nl.txt' + +config urlbundle 'urlbundle_12' + option enable '0' + option name 'Porn' + option download_url 'https://blocklistproject.github.io/Lists/alt-version/porn-nl.txt' + +config urlbundle 'urlbundle_13' + option enable '1' + option name 'Ransomware' + option download_url 'https://blocklistproject.github.io/Lists/alt-version/ransomware-nl.txt' + +config urlbundle 'urlbundle_14' + option enable '0' + option name 'Redirect' + option download_url 'https://blocklistproject.github.io/Lists/alt-version/redirect-nl.txt' + +config urlbundle 'urlbundle_15' + option enable '1' + option name 'Scam' + option download_url 'https://blocklistproject.github.io/Lists/alt-version/scam-nl.txt' + +config urlbundle 'urlbundle_16' + option enable '0' + option name 'TikTok' + option download_url 'https://blocklistproject.github.io/Lists/alt-version/tiktok-nl.txt' + +config urlbundle 'urlbundle_17' + option enable '0' + option name 'Torrent' + option download_url 'https://blocklistproject.github.io/Lists/alt-version/torrent-nl.txt' + +config urlbundle 'urlbundle_18' + option enable '0' + option name 'Tracking' + option download_url 'https://blocklistproject.github.io/Lists/alt-version/tracking-nl.txt' diff --git a/parental-control/files/etc/init.d/parentalcontrol b/parental-control/files/etc/init.d/parentalcontrol index 9d0713083..ab42041e9 100755 --- a/parental-control/files/etc/init.d/parentalcontrol +++ b/parental-control/files/etc/init.d/parentalcontrol @@ -5,6 +5,7 @@ STOP=10 USE_PROCD=1 PROG=/usr/sbin/urlfilter +PROG_SCRIPT=/lib/parentalcontrol/sync_bundles.sh . /lib/parentalcontrol/parentalcontrol.sh @@ -58,8 +59,25 @@ start_service() { # add firewall rules configure_fw_rules +<<<<<<< Updated upstream procd_open_instance parentalcontrol_dm procd_set_param command ${PROG} +======= + # if the router is, for example, upgraded and then it boots up + # then /tmp/dhcp.leases will be empty until clients try to get a lease, + # in that case, hostnames will not be processed by the daemon, + # for this we copy /tmp/dhcp.leases to /etc/parentalcontrol/dhcp.leases + # which will be persistent acrros reboots and upgrade where settings are kept + # and will be used as a backup in case /tmp/dhcp.leases is empty + copy_dhcp_leases + + procd_open_instance "parentalcontrol_bundle_script" + procd_set_param command nice -n 10 "${PROG_SCRIPT}" # Lower priority + procd_close_instance + + procd_open_instance "parentalcontrol_dm" + procd_set_param command nice -n 10 "${PROG}" # Lower priority +>>>>>>> Stashed changes procd_append_param command -l ${loglevel} procd_set_param respawn procd_close_instance diff --git a/parental-control/files/lib/parentalcontrol/sync_bundles.sh b/parental-control/files/lib/parentalcontrol/sync_bundles.sh new file mode 100644 index 000000000..bed29ad61 --- /dev/null +++ b/parental-control/files/lib/parentalcontrol/sync_bundles.sh @@ -0,0 +1,246 @@ +#!/bin/sh + +. /lib/functions.sh + +# this script handles syncing bundles +# if its a remote file, then it would be downloaded and placed in bundle_dir +bundle_dir="/tmp/parentalcontrol/urlbundles" +stringstore_dir="/etc/parentalcontrol/stringstore" +bundle_sizes="/tmp/parentalcontrol/bundle_sizes" + +# Ensure required directories and files exist +initialize_environment() { + mkdir -p "$bundle_dir" + [ ! -f "$bundle_sizes" ] && touch "$bundle_sizes" +} + +# Function to sanitize URLs to avoid code injection and ensure safety +sanitize_url() { + local raw_url="$1" + echo "$raw_url" | sed 's/[^a-zA-Z0-9_.:/?-]//g' +} + +update_bundle_file_from_url() { + local download_url="$1" + local bundle_file_name="$2" + local bundle_file_size="$3" + local bundle_name="$4" + local file_name="$5" + local available_memory + + available_memory=$(df "$bundle_dir" | tail -n 1 | awk '{print $(NF-2)}') # Available memory in 1K blocks + local needed_blocks=$((bundle_file_size / 1024)) # Convert bundle_file_size to 1K blocks + local max_size=$((10 * 1024 * 1024)) # 10MB in bytes + + if [ "$available_memory" -le "$needed_blocks" ]; then + logger -p info "Error: Not enough disk space for bundle: ${bundle_name}" + return 1 + fi + + if [ "$bundle_file_size" -gt "$max_size" ]; then + logger -p info "update_bundle_file_from_url: Error: File size for ${bundle_name} exceeds 10MB" + return 1 + fi + + # Determine file path + local file_path + if echo "$download_url" | grep -q "^file://"; then + file_path=${download_url#file://} + else + # Random delay (0-5s) before starting the download + local delay=$((RANDOM % 6)) + logger -p info "update_bundle_file_from_url: Waiting ${delay}s before downloading..." + sleep "$delay" + + # Retry logic with exponential backoff + local temp_file="${bundle_dir}/tmp_${file_name}" + local attempt=1 + local success=0 + while [ $attempt -le 3 ]; do + wget -q -O "$temp_file" "$download_url" + if [ $? -eq 0 ]; then + success=1 + break + else + logger -p info "update_bundle_file_from_url: Download failed. Retrying..." + local backoff=$(( (2 ** attempt) + (RANDOM % 3) )) # Exponential backoff + 0-2s jitter + sleep "$backoff" + fi + ((attempt++)) + done + + if [ $success -ne 1 ]; then + logger -p info "update_bundle_file_from_url: Failed to download bundle: ${bundle_name}" + rm -f "$temp_file" + return 1 + fi + file_path="$temp_file" + fi + + # Handle compressed files + local final_path="${bundle_dir}/${bundle_file_name}" + if [[ "$file_path" =~ \.xz$ ]]; then + if ! xz -dc "$file_path" > "$final_path"; then + logger -p info "update_bundle_file_from_url: Decompression failed." + rm -f "$final_path" + return 1 + fi + elif [[ "$file_path" =~ \.gz$ ]]; then + if ! gzip -dc "$file_path" > "$final_path"; then + logger -p info "update_bundle_file_from_url: Decompression failed." + rm -f "$final_path" + return 1 + fi + else + mv "$file_path" "$final_path" + fi + + # file would have lines of the format: 0.0.0.0 www.facebook.com + # so we keep only the url part and remove duplicates + awk '{print $NF}' "$final_path" | sort -u > "${final_path}_urls" + + # delete unprocessed file + logger -p info "deleting $final_path" + rm -rf "$final_path" + + # save the processed file path + final_path="${final_path}_urls" + logger -p info "final_path is $final_path" + + # Update the bundle size and send ubus event + logger -p info "sending event for $bundle_file_path" + echo "$bundle_file_name $bundle_file_size" >> "$bundle_sizes" + ubus send "parentalcontrol.bundle.update" "{\"bundle_file_path\":\"${final_path}\",\"bundle_name\":\"${bundle_name}\"}" + + return 0 +} + +handle_download_url() { + local raw_download_url="$1" + local bundle_name="$2" + + local sanitized_url + sanitized_url=$(sanitize_url "$raw_download_url") + + local file_name="${sanitized_url##*/}" # Get everything after the last '/' + #file_name="${file_name%.gz}" # Remove .gz if present + #file_name="${file_name%.xz}" # Remove .xz if present + + local bundle_file_name="${file_name}.urlbundle" + local unprocessed_file=0 + local file_path="${sanitized_url#file://}" + + if echo "$sanitized_url" | grep -q "^http://\|^file://"; then + local previous_bundle_size + previous_bundle_size=$(grep "^${bundle_file_name} " "$bundle_sizes" | awk '{print $2}') + + # If the URL is HTTP, fetch the file size + local bundle_file_size + if echo "$sanitized_url" | grep -q "^http://"; then + bundle_file_size=$(curl -I "$sanitized_url" 2>&1 | awk '/Content-Length:/ {print $2}' | tail -n 1) + [ -z "$bundle_file_size" ] && bundle_file_size=0 + else + # If it's a file:// URL, get the file size from the filesystem + bundle_file_size=$(ls -l "$file_path" 2>/dev/null | awk '{print $5}') + [ -z "$bundle_file_size" ] && bundle_file_size=0 + fi + + if [ -n "$previous_bundle_size" ] && [ "$bundle_file_size" -eq "$previous_bundle_size" ]; then + return + fi + + if echo "$sanitized_url" | grep -q "^file://" && ! echo "$sanitized_url" | grep -Eq "\.(xz|gz)$"; then + # the file is not processed and hence not moved if it is a local uncompressed file + sed -i "/^${bundle_file_name} /d" "$bundle_sizes" + echo "$bundle_file_name $bundle_file_size" >> "$bundle_sizes" + ubus send "parentalcontrol.bundle.update" "{\"bundle_file_path\":\"${file_path}\",\"bundle_name\":\"${bundle_name}\"}" + return + fi + + # Remove existing entries + if [ -n "$previous_bundle_size" ]; then + sed -i "/^${bundle_file_name} /d" "$bundle_sizes" + rm -f "${bundle_dir}/${bundle_file_name}" + fi + + update_bundle_file_from_url "$sanitized_url" "$bundle_file_name" "$bundle_file_size" "$bundle_name" "$file_name" + else + logger -p info "Error: Unsupported URL format for ${bundle_file_name}" + fi +} + +cleanup_bundle_files() { + dir="$1" + [ -d "$dir" ] || return 1 + + # Loop through all files in the directory + for file in "$dir"/*; do + [ -f "$file" ] || continue # Skip non-files + + # Remove the suffix after the last dot + base_name=$(basename "$file") + name="${base_name%.*}" # Removes the last dot and suffix + + # Check if the name is present in any urlbundle section + if ! uci show parentalcontrol | grep '.download_url=' | grep -q "$name'"; then + echo "Removing stale stringstore: $file" + rm -f "$file" + if [ "$dir" = "$bundle_dir" ]; then + sed -i "/^${file_name} /d" "$bundle_sizes" + fi + fi + done +} + +# Main handler for all profile URL bundles +handle_filter_for_bundles() { + ubus -t 20 wait_for bbfdm.parentalcontrol + + if [ "$?" -ne 0 ]; then + logger -p error "bbfdm.parentalcontrol object not found" + return + fi + + mkdir -p "$stringstore_dir" + + cleanup_bundle_files "$bundle_dir" + cleanup_bundle_files "$stringstore_dir" + + config_load parentalcontrol + + config_get_bool enable globals enable 0 + if [ "${enable}" -eq 0 ]; then + # Parental control is disabled + return 0 + fi + + initialize_environment + + local profile enable bundles bundle_name download_url + + check_bundle_exists() { + config_get name "$1" name + config_get download_url "$1" download_url + + if [ "$name" = "$2" ]; then + handle_download_url "$download_url" "$name" + fi + } + + handle_bundle_from_profile() { + local bundle_name="$1" + + config_foreach check_bundle_exists urlbundle "$bundle_name" + } + + handle_profile() { + config_get_bool enable "$1" enable 0 + [ "$enable" -ne 1 ] && return + + config_list_foreach "$1" profile_urlbundle handle_bundle_from_profile + } + + config_foreach handle_profile profile_urlfilter +} + +handle_filter_for_bundles