{"id":21994774,"url":"https://github.com/allow2/c-icap-allow2","last_synced_at":"2025-07-27T18:02:51.683Z","repository":{"id":146494607,"uuid":"165166589","full_name":"Allow2/c-icap-allow2","owner":"Allow2","description":"Allow2 c-icap plugin. Parental Freedom for icap-enabled proxy servers.","archived":false,"fork":false,"pushed_at":"2019-02-26T21:42:52.000Z","size":151,"stargazers_count":2,"open_issues_count":0,"forks_count":2,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-03-23T04:16:12.462Z","etag":null,"topics":["c","c-icap","child","children","control","controls","family","freedom","gaming","icap","limit","limits","parent","parental","parental-control","quota","social","social-network","time","time-limit"],"latest_commit_sha":null,"homepage":"https://Allow2.github.io","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Allow2.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"COPYING","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-01-11T02:38:42.000Z","updated_at":"2024-07-07T14:36:24.000Z","dependencies_parsed_at":"2023-07-14T05:15:48.263Z","dependency_job_id":null,"html_url":"https://github.com/Allow2/c-icap-allow2","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/Allow2/c-icap-allow2","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Allow2%2Fc-icap-allow2","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Allow2%2Fc-icap-allow2/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Allow2%2Fc-icap-allow2/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Allow2%2Fc-icap-allow2/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Allow2","download_url":"https://codeload.github.com/Allow2/c-icap-allow2/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Allow2%2Fc-icap-allow2/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":265481735,"owners_count":23773944,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["c","c-icap","child","children","control","controls","family","freedom","gaming","icap","limit","limits","parent","parental","parental-control","quota","social","social-network","time","time-limit"],"created_at":"2024-11-29T21:10:26.625Z","updated_at":"2025-07-16T04:32:44.343Z","avatar_url":"https://github.com/Allow2.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"\n# Introduction\n\nc-icap-allow2 has been built to enable parents to control access to internet and certain websites for their children based on\n* the type of day (ie: a school day, a weekend, a sick day, a holiday, etc),\n* the time of day,\n* the amount of activity time a child has remaining (ie: no more than 2 hours of gaming, or 3 hours of internet, etc),\n* any existing restrictions (ie: a child is currently banned from using the internet such as when on timeout or grounded),\n* any particular extensions that have been granted\n* and lots more.\n\nFor more information on the capabilities of Allow2, create a free account at https://app.allow2.com and try it for yourself.\n\nIn order to control access for a child, c-icap-allow2 is supplied as a plugin service for the c-icap server.\nThis service acts as a proxy filter for any router that supports icap (and was designed to work with Squid, but could be any icap-enabled proxy).\n\n## Children\n\nA key requirement to using Allow2 is being able to identify the child using any particular resource (gaming console, PC, mobile device, tablet, web browser, etc) at a point in time in order\nto be able to apply the appropriate rules.\n\nTo achieve this on a network device, there are a couple of options:\n1. Use some authentication specific to the child (ie a user account on the proxy server), or\n2. associate a specific device to a specific user (allow2 provides a couple of options to achieve this).\n\nc-icap-allow2 can be configured to associate a proxy user id to a specific child, and it is advised to enable this to make things simpler and more robust.\nhowever, it has a fallback to allow you to configure a permanent device association with a child.\n\nIn lieu of either method being capable of identifying a child accessing the web, you can configure c-icap-allow2 to default to blocking or allowing the access.\n\nYou can also configure specific devices or proxy accounts as \"always allow\" or \"always block\" - this provides a way to bypass the rules for parents or other users.\n\n\n# Dependencies\n\n* unix build tools: automake, autoconf\n* OpenCV - Used for all image and video classification.\n* C-ICAP - This is a c-icap module. It requires c-icap development libraries to be compiled. It is run through C-ICAP.\n* An ICAP enabled proxy which can do ACLs based on HTTP reply headers (Squid is one such proxy.)\n\n# Installation\n\nThere are 3 parts required to make use of c-icap-allow2.\n* install c-icap and c-icap-allow2 on a suitable server (which could be your home server, an OpenWRT router, a raspberry pi, a virtual server, etc)\n* connect it to a suitable icap-enabled proxy (which could be built in to your particular router, or could be Squid on a server, or maybe all on OpenWRT)\n* correctly configure your network/firewalls/clients/etc according to your requirements (outside the scope of this document).\n\nThe installation steps below are written as if you were installing Squid, c-icap and c-icap-allow2 on an OpenWRT router.\nAn alternate configuration is to set up c-icap and c-icap-allow2 on a separate server and point any icap capable proxy on any router to this icap server.\n\n## Install Squid 3.1+ on your OpenWRT box\n\nEither use the OpenWRT gui to install:\n* squid\n* luci-app-squid (if you want to use luci to configure squid)\n* squid-mod-cachemgr (is this required?)\n\nOr install via commandline:\n```sh\nopkg install squid luci-app-squid squid-mod-cachemgr\n```\n\n## Install c-icap\n\nGeneral installation instructions: http://c-icap.sourceforge.net/install.html\n\nYou can install c-icap on OpenWRT using this guide: TBA\nAlternately install on another host or create VM and install there\n\n## Install c-icap-allow2\n\n?????\n\nAdd the Allow2 service to c-icap.conf:\n\n```text\nService allow2 srv_allow2.so\n```\n\n(Recommended) Set \"RemoteProxyUsers on\" in c-icap.conf to use the proxy user as the identifier for the child:\n\n```text\nRemoteProxyUsers on\n```\n\nYou then configure c-icap-allow2 using the mappings for users and IP addresses to either a child account\n\n\n##Configure Squid to use c-icap\n\nadd the following to the squid configuration (use 127.0.0.1 if c-icap is on the same router, or the correct IP if it's on a different host):\n\n```text\n# enable icap\nicap_enable on\nicap_send_client_ip on\nicap_send_client_username on\nicap_client_username_encode off\nicap_client_username_header X-Authenticated-User\nicap_preview_enable on\nicap_preview_size 1024\n\nicap_service service_req reqmod_precache bypass=1 icap://127.0.0.1:1344/request\nadaptation_access service_req allow all\n\nicap_service service_resp respmod_precache bypass=0 icap://127.0.0.1:1344/response\nadaptation_access service_resp allow all\n```\n\n## Configure Users for Squid (Recommended)\n\nAlthough you can also assign users by IP address, it is recommended you set up separate proxy users for each child. Then they can have the proxy set individually on each of their accounts/devices/systems\nand that will be much better for shared devices and also if devices change IP address (if they set it manually or something).\n\nIf proxy users are used, their creds will be sent to the icap service and take precedence. If not using that, or the user is not authenticated, then the mapping to children will fall back to IP addresses.\nYou can also set a default child to fallback to for ALL checks (allowing you to default to a child UNLESS they have a proxy account. And you can also map some proxy accounts as \"always allow\" for any parents or other users.\n\nTo set up basic username/password auth for squid:\n(see https://stackoverflow.com/questions/3297196/how-to-set-up-a-squid-proxy-with-basic-username-and-password-authentication)\n\n```text\nauth_param basic program /usr/lib/squid3/basic_ncsa_auth /etc/squid3/passwords\nauth_param basic realm proxy\nacl authenticated proxy_auth REQUIRED\nhttp_access allow authenticated\n```\n\nThen you can set up users like this:\n```sh\nsudo htpasswd -c /etc/squid3/passwords username_you_like\n```\n\nAnd don't forget to restart the squid service after adding/changing and removing credentials.\n```sh\nservice squid3 restart\n```\n\n## Testing the Installation\n\nView logs on Squid and run the c-icap using:\n\n```sh\nc-icap -N -D -d 10\n```","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fallow2%2Fc-icap-allow2","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fallow2%2Fc-icap-allow2","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fallow2%2Fc-icap-allow2/lists"}