RDKB-66917 : [MNGVULN] Remediation of managed vulnerabilities in firewall

[Selvaranjani971]

Reason for change: Added rules that are required for lan2self_isolatedBridges.
Test Procedure: To validate the testcases required for this rule created.
Risks: Medium
Priority: P1

[Copilot]

Copilot review overview

🟡 Changes recommended

Build guards, one-way nftables filtering, and hard-coded /24 prefixes leave security gaps.

Review effort: Balanced
Findings: 2 · 1

Open (3)

• Isolation rules are omitted for MULTILAN_FEATURE builds · New
• Non-MULTILAN builds lose replacement isolation rules · New
• One-way rules miss traffic between non-primary bridges · New

What changed in this PR

Adds dynamic isolation rules for LAN bridges across iptables and nftables backends.

Changes:

• Generates LAN-to-self isolation chains dynamically.
• Adds cross-bridge forwarding drops.
• Removes several hard-coded destination rules.

File	Description
source/​firewall/​firewall.c	Adds iptables bridge isolation rules.
source/​firewall_nft/​firewall_nft.c	Adds nftables LAN-to-self isolation rules.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

Hardcoded subnet assumptions and non-MultiLAN rule regressions leave security gaps.

Review effort: Balanced
Findings: 3

Open (3)

• Use each bridge's actual subnet mask for isolation rules · New
• Use each bridge's actual subnet mask for isolation rules · New
• Non-MULTILAN builds lose replacement isolation rules

Resolved since last review (2)

• Isolation rules are omitted for MULTILAN_FEATURE builds
• One-way rules miss traffic between non-primary bridges

[Copilot]

Copilot review overview

🟡 Changes recommended

Source spoofing and earlier ACCEPT rules can bypass the new isolation controls.

Review effort: Balanced
Findings: 4

Open (4)

• Use ingress bridge instead of source /24 for isolation · New
• Match isolation rules by ingress bridge, not source /24 · New
• Use each bridge's actual subnet mask for isolation rules
• Use each bridge's actual subnet mask for isolation rules

Resolved since last review (1)

• Non-MULTILAN builds lose replacement isolation rules

[Copilot]

Copilot review overview

🔵 Needs a closer look

Hard-coded /24 source matching leaves configurable non-/24 bridge networks incompletely isolated.

Review effort: Balanced
Findings: 4

Open (4)

• Match isolation rules by ingress bridge, not source /24
• Use ingress bridge instead of source /24 for isolation
• Use each bridge's actual subnet mask for isolation rules
• Use each bridge's actual subnet mask for isolation rules