TCXB8-3707: Parental Controls blocks false positives

[nvenka781]

TCXB8-3707: Parental Controls blocks false positives

Reason for change: Parental control block on access with certain keywords cause false positives. User intended to block websites like matchweed.com, catchherb.co with keyword "thc", "bc". Along with these, any url with substring "thc" also gets blocked. If the keyword matches anywhere in the request payload - url, referrer, cookie, user-agent; the site is blocked.

Change: Keyword search is done on the full string with kmp algorithm. Since no limit is mentioned, the default of 65535 is considered as upper limit of packet payload size for kmp algorithm search. The following changes are made:

• Multiple iptable rules are added for http

• Each rule sets the kmp algorithm search range. Example: --algo kmp --from 0 --to 64

• The kmp string filter range rule jumps to a private chain corresponding to that range on matching "Host:" keyword

• The private chain looks for the configured keyword in the corresponding range

• For https, simple string match is done in the entire payload as only SNI part is unencrypted and would be visible to iptables

Recommendation to user: Avoid very short generic query keywords for blocking

Test Procedure: Validate IPTV playback

Priority: P1

Risks: None

Signed-off-by: nagalakshmi_venkataraman@comcast.com

IP table rules before and after fix:
-A lan2wan_pc_site -m string --string "xml" --algo kmp --to 65535 --icase -j LOG_SiteBlocked_1_DROP

-A LOG_SiteBlk_KW_0_64 -m string --string "xml" --algo kmp --to 64 --icase -j LOG_SiteBlocked_2_DROP -A LOG_SiteBlk_KW_0_64 -j RETURN -A LOG_SiteBlk_KW_128_256 -m string --string "xml" --algo kmp --from 128 --to 256 --icase -j LOG_SiteBlocked_2_DROP -A LOG_SiteBlk_KW_128_256 -j RETURN -A LOG_SiteBlk_KW_256_512 -m string --string "xml" --algo kmp --from 256 --to 512 --icase -j LOG_SiteBlocked_2_DROP -A LOG_SiteBlk_KW_256_512 -j RETURN -A LOG_SiteBlk_KW_512_1024 -m string --string "xml" --algo kmp --from 512 --to 1024 --icase -j LOG_SiteBlocked_2_DROP -A LOG_SiteBlk_KW_512_1024 -j RETURN -A LOG_SiteBlk_KW_64_128 -m string --string "xml" --algo kmp --from 64 --to 128 --icase -j LOG_SiteBlocked_2_DROP -A LOG_SiteBlk_KW_64_128 -j RETURN -A lan2wan_pc_site -p tcp -m tcp --dport 80 -m string --string "Host:" --algo kmp --to 64 --icase -j LOG_SiteBlk_KW_0_64 -A lan2wan_pc_site -p tcp -m tcp --dport 80 -m string --string "Host:" --algo kmp --from 64 --to 128 --icase -j LOG_SiteBlk_KW_64_128 -A lan2wan_pc_site -p tcp -m tcp --dport 80 -m string --string "Host:" --algo kmp --from 128 --to 256 --icase -j LOG_SiteBlk_KW_128_256 -A lan2wan_pc_site -p tcp -m tcp --dport 80 -m string --string "Host:" --algo kmp --from 256 --to 512 --icase -j LOG_SiteBlk_KW_256_512 -A lan2wan_pc_site -p tcp -m tcp --dport 80 -m string --string "Host:" --algo kmp --from 512 --to 1024 --icase -j LOG_SiteBlk_KW_512_1024 -A lan2wan_pc_site -p tcp -m tcp --dport 443 -m string --string "xml" --algo kmp --to 65535 --icase -j LOG_SiteBlocked_2_DROP