Skip to content

TCXB8-3707: Parental Controls blocks false positives #106

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nvenka781 wants to merge 5 commits into
base: develop
Choose a base branch
from
Open

TCXB8-3707: Parental Controls blocks false positives #106

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
a4881de
TCXB8-3707: Parental Controls blocks false positives
nvenka781 Oct 20, 2025
dcbb174
Corrected debug print syntax
nvenka781 Oct 20, 2025
ca58327
Added multiple ranged rules to filter based on host and keyword
nvenka781 Oct 22, 2025
bdcc7b1
Removed unused function
nvenka781 Oct 22, 2025
b01f000
Adding rule for handling https keyword filtering
nvenka781 Oct 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
67 changes: 47 additions & 20 deletions source/firewall/firewall.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9309,32 +9309,59 @@ static int do_parcon_mgmt_site_keywd(FILE *fp, FILE *nat_fp, int iptype, FILE *c

block_url_by_ipaddr(fp, query + host_name_offset, drop_log, iptype, ins_num, nstdPort);
}
else if (strncasecmp(method, "KEYWD", 5)==0)
else if (strncasecmp(method, "KEYWD", 5) == 0)
{
// consider the case that user input whole url.
if(strstr(query, "://") != 0) {
fprintf(fp, "-A lan2wan_pc_site -m string --string \"%s\" --algo kmp --icase -j %s\n", strstr(query, "://") + 3, drop_log);
#if defined(_HUB4_PRODUCT_REQ_) || defined (_RDKB_GLOBAL_PRODUCT_REQ_)
#if defined (_RDKB_GLOBAL_PRODUCT_REQ_)
if( 0 == strncmp( devicePartnerId, "sky-", 4 ) )
#endif
{
//In Hub4 keyword blocking feature is not working with FORWARD chain rules as CPE (dnsmasq) acts as DNS Proxy.
//Add rules in INPUT chain to resolve this issue.
fprintf(fp, "-I INPUT -i %s -j lan2wan_pc_site \n", lan_ifname);
}
#endif
const char *keyword = NULL;
char hostStr[] = "Host:";
int range_max = 1024; //max payload bytes to filter
int range_incr = 64; //byte ranges to filter

// Extract keyword if user input is a full URL
if (strstr(query, "://") != NULL) {
keyword = strstr(query, "://") + 3;
} else {
fprintf(fp, "-A lan2wan_pc_site -m string --string \"%s\" --algo kmp --icase -j %s\n", query, drop_log);
keyword = query;
}

if (keyword == NULL || strlen(keyword) == 0) {
fprintf(stderr, "Warning: Empty keyword, skipping rule generation.\n");
return(0);
}

// Create rules for various ranges of payload to filter
int from;
for (from = 0; from < range_max; from += range_incr) {
int to = from + range_incr;
char chainName[64];

// Create new chain LOG_SiteBlocked_check_kw_<from>_<to>
snprintf(chainName, sizeof(chainName), "LOG_SiteBlocked_check_kw_%d_%d", from, to);
fprintf(fp, "-N %s\n", chainName);

// Add rule to jump to private chain if "Host:" is found in this offset range
fprintf(fp, "-A lan2wan_pc_site -p tcp --dport 80 -m string --string \"%s\" --algo kmp --from %d --to %d --icase -j %s\n",
hostStr, from, to, chainName);

// Add rule to match keyword in private chain within same offset range
fprintf(fp, "-A %s -m string --string \"%s\" --algo kmp --from %d --to %d --icase -j %s\n",
chainName, keyword, from, to, drop_log);

// Default rule to return if not matched
fprintf(fp, "-A %s -j RETURN\n", chainName);
}

// Add rule for https filter
fprintf(fp, "-A lan2wan_pc_site -p tcp --dport 443 -m string --string \"%s\" --algo kmp --icase -j %s\n",
keyword, drop_log);

#if defined(_HUB4_PRODUCT_REQ_) || defined (_RDKB_GLOBAL_PRODUCT_REQ_)
#if defined (_RDKB_GLOBAL_PRODUCT_REQ_)
if( 0 == strncmp( devicePartnerId, "sky-", 4 ) )
#endif
{
fprintf(fp, "-I INPUT -i %s -j lan2wan_pc_site \n", lan_ifname);
}
if (strncmp(devicePartnerId, "sky-", 4) == 0)
#endif
{
fprintf(fp, "-I INPUT -i %s -j lan2wan_pc_site\n", lan_ifname);
}
#endif
}
}
}
Expand Down
Loading