parental-control: add script to sync urlbundles

parental-control/Makefile

@@ -39,6 +39,10 @@ define Package/$(PKG_NAME)/config
 	source "$(SOURCE)/Config.in"
 endef
 
+define Package/$(PKG_NAME)/conffiles
+/etc/parentalcontrol/dhcp.leases
+endef
+
 TARGET_CFLAGS += \
 	-D_GNU_SOURCE\
 	-DBBF_VENDOR_PREFIX=\\\"$(CONFIG_BBF_VENDOR_PREFIX)\\\"
@@ -53,8 +57,10 @@ endef
 endif
 
 define Package/parental-control/install
+	$(INSTALL_DIR) $(1)/etc/parentalcontrol
 	$(INSTALL_DIR) $(1)/lib/parentalcontrol
 	$(INSTALL_DATA) ./files/lib/parentalcontrol/parentalcontrol.sh $(1)/lib/parentalcontrol/
+	$(INSTALL_BIN) ./files/lib/parentalcontrol/sync_bundles.sh $(1)/lib/parentalcontrol/
 
 	$(INSTALL_DIR) $(1)/etc
 	$(INSTALL_DATA) ./files/etc/firewall.parentalcontrol $(1)/etc/
@@ -74,8 +80,7 @@ define Package/parental-control/install
 	$(BBFDM_REGISTER_SERVICES) ./bbfdm_service.json $(1) parentalcontrol
 
 ifeq ($(CONFIG_PARENTAL_CONTROL_INCLUDE_URLFILTER_BUNDLES),y)
-	$(INSTALL_DIR) $(1)/etc/parental-control
-	$(INSTALL_DATA) ./files/etc/parental-control/urlbundles.tar.xz $(1)/etc/parental-control/
+	$(INSTALL_DATA) ./files/etc/parentalcontrol/urlbundles.tar.xz $(1)/etc/parentalcontrol/
 endif
 endef
 

parental-control/files/etc/init.d/parentalcontrol

@@ -1,6 +1,6 @@
 #!/bin/sh /etc/rc.common
 
-START=95
+START=99
 STOP=10
 
 USE_PROCD=1
@@ -47,6 +47,25 @@ configure_fw_rules() {
 	add_internet_schedule_rules
 }
 
+copy_dhcp_leases() {
+	src="/tmp/dhcp.leases"
+	dest="/etc/parentalcontrol/dhcp.leases"
+	dest_dir="/etc/parentalcontrol/"
+
+	# Ensure the destination directory exists
+	mkdir -p "$dest_dir" || { logger -p err "Failed to create directory $dest_dir."; return 1; }
+
+	# Check if the source file exists and is not empty
+	if [ -s "$src" ]; then
+		# Compare the content of the source and destination
+		if ! cmp -s "$src" "$dest"; then
+			# Use atomic copy to prevent partial writes
+			tmp_dest="${dest}.tmp"
+			cp "$src" "$tmp_dest" && mv "$tmp_dest" "$dest"
+		fi
+	fi
+}
+
 start_service() {
 	local enable loglevel
 
@@ -58,8 +77,17 @@ start_service() {
 	# add firewall rules
 	configure_fw_rules
 
+	mkdir -p "/tmp/parentalcontrol/stringstore/"
+	# if the router is, for example, upgraded and then it boots up
+	# then /tmp/dhcp.leases will be empty until clients try to get a lease,
+	# in that case, hostnames will not be processed by the daemon,
+	# for this we copy /tmp/dhcp.leases to /etc/parentalcontrol/dhcp.leases
+	# which will be persistent acrros reboots and upgrade where settings are kept
+	# and will be used as a backup in case /tmp/dhcp.leases is empty
+	copy_dhcp_leases
+
 	procd_open_instance parentalcontrol_dm
-	procd_set_param command ${PROG}
+	procd_set_param command nice -n 10 ${PROG}  # Lower priority
 	procd_append_param command -l ${loglevel}
 	procd_set_param respawn
 	procd_close_instance
@@ -69,6 +97,7 @@ stop_service() {
 	# remove default bundles
 	remove_default_bundles
 	remove_fw_rules
+	copy_dhcp_leases
 }
 
 reload_service() {
@@ -78,6 +107,7 @@ reload_service() {
 		start
 	else
 		configure_fw_rules
+		copy_dhcp_leases
 		ubus send parentalcontrol.reload
 	fi
 }

parental-control/files/lib/parentalcontrol/parentalcontrol.sh

@@ -13,8 +13,8 @@ IP_RULE=""
 ACL_FILE=""
 parentalcontrol_ipv4_forward=""
 parentalcontrol_ipv6_forward=""
-default_bundle_dir="/tmp/urlfilter/default/"
-bundle_archive="/etc/parental-control/urlbundles.tar.xz"
+default_bundle_dir="/tmp/parentalcontrol/default/"
+bundle_archive="/etc/parentalcontrol/urlbundles.tar.xz"
 
 log() {
 	echo "$*" |logger -t urlfilter.init -p debug

parental-control/files/lib/parentalcontrol/sync_bundles.sh

@@ -0,0 +1,224 @@
+#!/bin/sh
+
+. /lib/functions.sh
+
+# this script handles syncing bundles
+# if its a remote file, then it would be downloaded and placed in bundle_dir
+# next t
+bundle_dir="/tmp/parentalcontrol/urlbundles"
+bundle_sizes="/tmp/parentalcontrol/bundle_sizes"
+
+# Ensure required directories and files exist
+initialize_environment() {
+	mkdir -p "$bundle_dir"
+	[ ! -f "$bundle_sizes" ] && touch "$bundle_sizes"
+}
+
+# Function to sanitize URLs to avoid code injection and ensure safety
+sanitize_url() {
+	local raw_url="$1"
+	echo "$raw_url" | sed 's/[^a-zA-Z0-9_.:/?-]//g'
+}
+
+update_bundle_file_from_url() {
+	local download_url="$1"
+	local bundle_file_name="$2"
+	local bundle_file_size="$3"
+	local bundle_name="$4"
+	local file_name="$5"
+	local available_memory
+
+	available_memory=$(df "$bundle_dir" | tail -n 1 | awk '{print $(NF-2)}') # Available memory in 1K blocks
+	local needed_blocks=$((bundle_file_size / 1024)) # Convert bundle_file_size to 1K blocks
+	local max_size=$((10 * 1024 * 1024)) # 10MB in bytes
+
+	if [ "$available_memory" -le "$needed_blocks" ]; then
+		logger -p info "Error: Not enough disk space for bundle: ${bundle_name}"
+		return 1
+	fi
+
+	if [ "$bundle_file_size" -gt "$max_size" ]; then
+		logger -p info "update_bundle_file_from_url: Error: File size for ${bundle_name} exceeds 10MB"
+		return 1
+	fi
+
+	# Determine file path
+	local file_path
+	if echo "$download_url" | grep -q "^file://"; then
+		file_path=${download_url#file://}
+	else
+		# Random delay (0-5s) before starting the download
+		local delay=$((RANDOM % 6))
+		logger -p info "update_bundle_file_from_url: Waiting ${delay}s before downloading..."
+		sleep "$delay"
+
+		# Retry logic with exponential backoff
+		local temp_file="${bundle_dir}/tmp_${file_name}"
+		local attempt=1
+		local success=0
+		while [ $attempt -le 3 ]; do
+			wget -q -O "$temp_file" "$download_url"
+			if [ $? -eq 0 ]; then
+				success=1
+				break
+			else
+				logger -p info "update_bundle_file_from_url: Download failed. Retrying..."
+				local backoff=$(( (2 ** attempt) + (RANDOM % 3) )) # Exponential backoff + 0-2s jitter
+				sleep "$backoff"
+			fi
+			((attempt++))
+		done
+
+		if [ $success -ne 1 ]; then
+			logger -p info "update_bundle_file_from_url: Failed to download bundle: ${bundle_name}"
+			rm -f "$temp_file"
+			return 1
+		fi
+		file_path="$temp_file"
+	fi
+
+	# Handle compressed files
+	local final_path="${bundle_dir}/${bundle_file_name}"
+	if [[ "$file_path" =~ \.xz$ ]]; then
+		if ! xz -dc "$file_path" > "$final_path"; then
+			logger -p info "update_bundle_file_from_url: Decompression failed."
+			rm -f "$final_path"
+			return 1
+		fi
+	elif [[ "$file_path" =~ \.gz$ ]]; then
+		if ! gzip -dc "$file_path" > "$final_path"; then
+			logger -p info "update_bundle_file_from_url: Decompression failed."
+			rm -f "$final_path"
+			return 1
+		fi
+	else
+		mv "$file_path" "$final_path"
+	fi
+
+	# Update the bundle size and send ubus event
+	echo "$bundle_file_name $bundle_file_size" >> "$bundle_sizes"
+	ubus send "parentalcontrol.bundle.update" "{\"bundle_file_path\":\"${final_path}\",\"bundle_name\":\"${bundle_name}\"}"
+
+	return 0
+}
+
+handle_download_url() {
+	local raw_download_url="$1"
+	local bundle_name="$2"
+
+	local sanitized_url
+	sanitized_url=$(sanitize_url "$raw_download_url")
+
+	local file_name="${sanitized_url##*/}" # Get everything after the last '/'
+	#file_name="${file_name%.gz}"           # Remove .gz if present
+	#file_name="${file_name%.xz}"           # Remove .xz if present
+
+	local bundle_file_name="${file_name}.urlbundle"
+	local unprocessed_file=0
+	local file_path="${sanitized_url#file://}"
+
+	if echo "$sanitized_url" | grep -q "^http://\|^file://"; then
+		local previous_bundle_size
+		previous_bundle_size=$(grep "^${bundle_file_name} " "$bundle_sizes" | awk '{print $2}')
+
+		# If the URL is HTTP, fetch the file size
+		local bundle_file_size
+		if echo "$sanitized_url" | grep -q "^http://"; then
+			bundle_file_size=$(curl -I "$sanitized_url" 2>&1 | awk '/Content-Length:/ {print $2}' | tail -n 1)
+			[ -z "$bundle_file_size" ] && bundle_file_size=0
+		else
+			# If it's a file:// URL, get the file size from the filesystem
+			bundle_file_size=$(ls -l "$file_path" 2>/dev/null | awk '{print $5}')
+			[ -z "$bundle_file_size" ] && bundle_file_size=0
+		fi
+
+		if [ -n "$previous_bundle_size" ] && [ "$bundle_file_size" -eq "$previous_bundle_size" ]; then
+			return
+		fi
+
+		if echo "$sanitized_url" | grep -q "^file://" && ! echo "$sanitized_url" | grep -Eq "\.(xz|gz)$"; then
+			# the file is not processed and hence not moved if it is a local uncompressed file
+			sed -i "/^${bundle_file_name} /d" "$bundle_sizes"
+			echo "$bundle_file_name $bundle_file_size" >> "$bundle_sizes"
+			ubus send "parentalcontrol.bundle.update" "{\"bundle_file_path\":\"${file_path}\",\"bundle_name\":\"${bundle_name}\"}"
+			return
+		fi
+
+		# Remove existing entries
+		if [ -n "$previous_bundle_size" ]; then
+			sed -i "/^${bundle_file_name} /d" "$bundle_sizes"
+			rm -f "${bundle_dir}/${bundle_file_name}"
+		fi
+
+		update_bundle_file_from_url "$sanitized_url" "$bundle_file_name" "$bundle_file_size" "$bundle_name" "$file_name"
+	else
+		logger -p info "Error: Unsupported URL format for ${bundle_file_name}"
+	fi
+}
+
+cleanup_bundle_files() {
+	dir="$1"
+	[ -d "$dir" ] || return 1
+
+	# Loop through all files in the directory
+	for file in "$dir"/*; do
+		[ -f "$file" ] || continue  # Skip non-files
+
+		# Remove the suffix after the last dot
+		base_name=$(basename "$file")
+		name="${base_name%.*}"  # Removes the last dot and suffix
+
+		# Check if the name is present in any urlbundle section
+		if ! uci show parentalcontrol | grep '.download_url=' | grep -q "$name'"; then
+			echo "Removing stale stringstore: $file"
+			rm -f "$file"
+			if [ "$dir" = "$bundle_dir" ]; then
+				sed -i "/^${file_name} /d" "$bundle_sizes"
+			fi
+		fi
+	done
+}
+
+# Main handler for all profile URL bundles
+handle_filter_for_bundles() {
+	cleanup_bundle_files "$bundle_dir"
+	cleanup_bundle_files "/tmp/parentalcontrol/stringstore"
+
+	config_load parentalcontrol
+
+	config_get_bool enable globals enable 0
+	if [ "${enable}" -eq 0 ]; then
+		# Parental control is disabled
+		return 0
+	fi
+
+	initialize_environment
+
+	local profile enable bundles bundle_name download_url
+
+	check_bundle_exists() {
+		config_get name "$1" name
+		config_get download_url "$1" download_url
+
+		if [ "$name" = "$2" ]; then
+			handle_download_url "$download_url" "$name"
+		fi
+	}
+
+	handle_bundle_from_profile() {
+		local bundle_name="$1"
+
+		config_foreach check_bundle_exists urlbundle "$bundle_name"
+	}
+
+	handle_profile() {
+		config_get_bool enable "$1" enable 0
+		[ "$enable" -ne 1 ] && return
+
+		config_list_foreach "$1" profile_urlbundle handle_bundle_from_profile
+	}
+
+	config_foreach handle_profile profile_urlfilter
+}
+
+handle_filter_for_bundles