From 5a2ce8a6d8ec3052b9f1dc006f8da8a66b25a751 Mon Sep 17 00:00:00 2001 From: ss192 Date: Fri, 25 Sep 2026 11:44:34 +0000 Subject: [PATCH 01/10] RDKB-66917 [MNGVULN] Remediation of managed vulnerabilities in firewall --- source/firewall/firewall.c | 73 +++++++++++++++++++++++++----- source/firewall_nft/firewall_nft.c | 56 ++++++++++++++++++----- 2 files changed, 107 insertions(+), 22 deletions(-) diff --git a/source/firewall/firewall.c b/source/firewall/firewall.c index 5270bc07..c7a8bc14 100644 --- a/source/firewall/firewall.c +++ b/source/firewall/firewall.c @@ -359,16 +359,12 @@ Defines used to control conditional compilation #include "ccsp_memory.h" -#if defined (WAN_FAILOVER_SUPPORTED) || defined(RDKB_EXTENDER_ENABLED) - #include #include #include #include #include -#endif - #ifdef _ONESTACK_PRODUCT_REQ_ #include #endif @@ -887,8 +883,6 @@ unsigned int Get_Device_Mode() } #endif -#ifdef WAN_FAILOVER_SUPPORTED - int create_socket() { int sockfd = 0; @@ -925,6 +919,7 @@ char* get_iface_ipaddr(const char* iface_name) return (inet_ntoa(((struct sockaddr_in *)&ifr.ifr_addr)->sin_addr)); } + #ifdef WAN_FAILOVER_SUPPORTED bool isServiceNeeded() { if (Get_Device_Mode()==EXTENDER_MODE) @@ -5912,6 +5907,62 @@ static int do_multinet_lan2self_by_wanip (FILE *filter_fp) } #endif +static int do_lan2self_isolatedInterfaces(FILE *filter_fp) +{ + FIREWALL_DEBUG("Entering do_lan2self_isolatedInterfaces\n"); +#if defined(MULTILAN_FEATURE) + char *tok; + char net_query[MAX_QUERY]; + char net_resp[MAX_QUERY]; + char inst_resp[MAX_QUERY]; + char primary_inst[MAX_QUERY]; + char *interface_ipaddr; + + inst_resp[0] = 0; + sysevent_get(sysevent_fd, sysevent_token, "multinet-instances", inst_resp, sizeof(inst_resp)); + FIREWALL_DEBUG("lan2self_isolatedInterfaces: multinet-instances='%s'\n", inst_resp); + + primary_inst[0] = 0; + sysevent_get(sysevent_fd, sysevent_token, "primary_lan_l2net", primary_inst, sizeof(primary_inst)); + FIREWALL_DEBUG("lan2self_isolatedInterfaces: primary_lan_l2net='%s'\n", primary_inst); + + tok = strtok(inst_resp, " "); + if (tok) do { + FIREWALL_DEBUG("lan2self_isolatedInterfaces: checking instance '%s'\n", tok); + if (strcmp(primary_inst, tok) == 0) { + FIREWALL_DEBUG("lan2self_isolatedInterfaces: skipping primary instance '%s'\n", tok); + continue; + } + + snprintf(net_query, sizeof(net_query), "multinet_%s-localready", tok); + net_resp[0] = 0; + sysevent_get(sysevent_fd, sysevent_token, net_query, net_resp, sizeof(net_resp)); + FIREWALL_DEBUG("lan2self_isolatedInterfaces: %s='%s'\n", net_query, net_resp); + if (strcmp("1", net_resp) != 0) { + FIREWALL_DEBUG("lan2self_isolatedInterfaces: skipping instance '%s' because it is not ready\n", tok); + continue; + } + + snprintf(net_query, sizeof(net_query), "multinet_%s-name", tok); + net_resp[0] = 0; + sysevent_get(sysevent_fd, sysevent_token, net_query, net_resp, sizeof(net_resp)); + FIREWALL_DEBUG("lan2self_isolatedInterfaces: %s='%s'\n", net_query, net_resp); + interface_ipaddr = get_iface_ipaddr(net_resp); + if (interface_ipaddr != NULL) { + FIREWALL_DEBUG("lan2self_isolatedInterfaces: adding interface '%s' with IPv4 '%s'\n", net_resp, interface_ipaddr); + fprintf(filter_fp, "-A lan2self_isolatedInterfaces -s %s/24 -d %s/32 -j xlog_drop_lan2self\n", lan_ipaddr, interface_ipaddr); + } else { + FIREWALL_DEBUG("lan2self_isolatedInterfaces: no IPv4 address found for interface '%s'\n", net_resp); + } + } while ((tok = strtok(NULL, " ")) != NULL); +#else + FIREWALL_DEBUG("lan2self_isolatedInterfaces: MULTILAN_FEATURE is disabled\n"); +#endif + + FIREWALL_DEBUG("Exiting do_lan2self_isolatedInterfaces\n"); + return 0; +} + static int do_lan2self_by_wanip(FILE *filter_fp, int family) { //As requested, we don't allow SNMP/HTTP/HTTPs/Ping @@ -5955,12 +6006,7 @@ static int do_lan2self_by_wanip(FILE *filter_fp, int family) #if defined(_WNXL11BWL_PRODUCT_REQ_) fprintf(filter_fp, "-A lan2self_by_wanip -s %s/24 -d 169.254.70.254/32 -j xlog_drop_lan2self\n", lan_ipaddr); fprintf(filter_fp, "-A lan2self_by_wanip -s %s/24 -d 169.254.71.254/32 -j xlog_drop_lan2self\n", lan_ipaddr); -#else - fprintf(filter_fp, "-A lan2self_by_wanip -s %s/24 -d 169.254.0.254/32 -j xlog_drop_lan2self\n", lan_ipaddr); - fprintf(filter_fp, "-A lan2self_by_wanip -s %s/24 -d 169.254.1.254/32 -j xlog_drop_lan2self\n", lan_ipaddr); #endif - fprintf(filter_fp, "-A lan2self_by_wanip -s %s/24 -d 172.16.12.1/32 -j xlog_drop_lan2self\n", lan_ipaddr); - fprintf(filter_fp, "-A lan2self_by_wanip -s %s/24 -d 192.168.106.1/32 -j xlog_drop_lan2self\n", lan_ipaddr); fprintf(filter_fp, "-A lan2self_by_wanip -s %s/24 -d 192.168.251.1/32 -j xlog_drop_lan2self\n", lan_ipaddr); if (rc == 0 && httpport[0] != '\0' && atoi(httpport) != 80 && (atoi(httpport) >= 0 && atoi(httpport) <= 65535 )) @@ -6069,6 +6115,7 @@ static int do_lan2self_mgmt(FILE *fp) static int do_lan2self(FILE *fp) { // FIREWALL_DEBUG("Entering do_lan2self\n"); + do_lan2self_isolatedInterfaces(fp); #if (defined(FEATURE_MAPT) && defined(NAT46_KERNEL_SUPPORT)) || defined(FEATURE_SUPPORT_MAPT_NAT46) if((!isMAPTReady) & isWanReady) // Pass for Dual Stack Line #else @@ -12544,6 +12591,7 @@ static int prepare_subtables(FILE *raw_fp, FILE *mangle_fp, FILE *nat_fp, FILE * #endif fprintf(filter_fp, ":%s - [0:0]\n", "lan2self"); fprintf(filter_fp, ":%s - [0:0]\n", "lan2self_by_wanip"); + fprintf(filter_fp, ":%s - [0:0]\n", "lan2self_isolatedInterfaces"); fprintf(filter_fp, ":%s - [0:0]\n", "lan2self_mgmt"); fprintf(filter_fp, ":%s - [0:0]\n", "host_detect"); fprintf(filter_fp, ":%s - [0:0]\n", "lanattack"); @@ -13195,8 +13243,10 @@ static int prepare_subtables(FILE *raw_fp, FILE *mangle_fp, FILE *nat_fp, FILE * fprintf(filter_fp, "-A general_input -i %s -p udp -m udp --dport 161 -j xlog_drop_lan2self\n", XHS_IF_NAME); fprintf(filter_fp, "-A general_input -i %s -p udp -m udp --dport 161 -j xlog_drop_lan2self\n", LNF_IF_NAME); #if defined (MULTILAN_FEATURE) + fprintf(filter_fp, "-A lan2self -j lan2self_isolatedInterfaces\n"); fprintf(filter_fp, "-A lan2self -j lan2self_by_wanip\n"); #else + fprintf(filter_fp, "-A lan2self -j lan2self_isolatedInterfaces\n"); fprintf(filter_fp, "-A lan2self ! -d %s -j lan2self_by_wanip\n", lan_ipaddr); #endif fprintf(filter_fp, "-A lan2self -j lan2self_mgmt\n"); @@ -14298,6 +14348,7 @@ static int prepare_disabled_ipv4_firewall(FILE *raw_fp, FILE *mangle_fp, FILE *n { fprintf(filter_fp, ":%s - [0:0]\n", "lan2self"); fprintf(filter_fp, ":%s - [0:0]\n", "lan2self_by_wanip"); + fprintf(filter_fp, ":%s - [0:0]\n", "lan2self_isolatedInterfaces"); fprintf(filter_fp, ":%s - [0:0]\n", "lanattack"); fprintf(filter_fp, ":%s - [0:0]\n", "xlog_drop_lanattack"); do_lan2self(filter_fp); diff --git a/source/firewall_nft/firewall_nft.c b/source/firewall_nft/firewall_nft.c index 45db8335..d0652e1e 100644 --- a/source/firewall_nft/firewall_nft.c +++ b/source/firewall_nft/firewall_nft.c @@ -355,16 +355,12 @@ Defines used to control conditional compilation #include "util.h" -#if defined (WAN_FAILOVER_SUPPORTED) || defined(RDKB_EXTENDER_ENABLED) - #include #include #include #include #include -#endif - #ifdef FEATURE_464XLAT #define XLAT_IF "xlat" #define XLAT_IP "192.0.0.1" @@ -919,8 +915,6 @@ unsigned int Get_Device_Mode() } #endif -#ifdef WAN_FAILOVER_SUPPORTED - int create_socket() { int sockfd = 0; @@ -957,6 +951,7 @@ char* get_iface_ipaddr(const char* iface_name) return (inet_ntoa(((struct sockaddr_in *)&ifr.ifr_addr)->sin_addr)); } + #ifdef WAN_FAILOVER_SUPPORTED bool isServiceNeeded() { FIREWALL_DEBUG("Inside isServiceNeeded\n"); @@ -5675,6 +5670,45 @@ static int do_multinet_lan2self_by_wanip (FILE *filter_fp) } #endif +static int do_lan2self_isolatedInterfaces(FILE *filter_fp) +{ +#if defined(MULTILAN_FEATURE) + char *tok; + char net_query[MAX_QUERY]; + char net_resp[MAX_QUERY]; + char inst_resp[MAX_QUERY]; + char primary_inst[MAX_QUERY]; + char *interface_ipaddr; + + inst_resp[0] = 0; + sysevent_get(sysevent_fd, sysevent_token, "multinet-instances", inst_resp, sizeof(inst_resp)); + + primary_inst[0] = 0; + sysevent_get(sysevent_fd, sysevent_token, "primary_lan_l2net", primary_inst, sizeof(primary_inst)); + + tok = strtok(inst_resp, " "); + if (tok) do { + if (strcmp(primary_inst, tok) == 0) + continue; + + snprintf(net_query, sizeof(net_query), "multinet_%s-localready", tok); + net_resp[0] = 0; + sysevent_get(sysevent_fd, sysevent_token, net_query, net_resp, sizeof(net_resp)); + if (strcmp("1", net_resp) != 0) + continue; + + snprintf(net_query, sizeof(net_query), "multinet_%s-name", tok); + net_resp[0] = 0; + sysevent_get(sysevent_fd, sysevent_token, net_query, net_resp, sizeof(net_resp)); + interface_ipaddr = get_iface_ipaddr(net_resp); + if (interface_ipaddr != NULL) + fprintf(filter_fp, "add rule ip filter lan2self_isolatedInterfaces ip saddr %s/24 ip daddr %s/32 counter jump xlog_drop_lan2self\n", lan_ipaddr, interface_ipaddr); + } while ((tok = strtok(NULL, " ")) != NULL); +#endif + + return 0; +} + static int do_lan2self_by_wanip(FILE *filter_fp, int family) { //As requested, we don't allow SNMP/HTTP/HTTPs/Ping @@ -5717,12 +5751,7 @@ static int do_lan2self_by_wanip(FILE *filter_fp, int family) #if defined(_WNXL11BWL_PRODUCT_REQ_) fprintf(filter_fp, "add rule ip filter lan2self_by_wanip ip saddr %s/24 ip daddr 169.254.70.254/32 counter xlog_drop_lan2self\n", lan_ipaddr); fprintf(filter_fp, "add rule ip filter lan2self_by_wanip ip saddr %s/24 ip daddr 169.254.71.254/32 counter jump xlog_drop_lan2self\n", lan_ipaddr); -#else - fprintf(filter_fp, "add rule ip filter lan2self_by_wanip ip saddr %s/24 ip daddr 169.254.0.254/32 counter jump xlog_drop_lan2self\n", lan_ipaddr); - fprintf(filter_fp, "add rule ip filter lan2self_by_wanip ip saddr %s/24 ip daddr 169.254.1.254 /32 counter jump xlog_drop_lan2self\n", lan_ipaddr); #endif - fprintf(filter_fp, "add rule ip filter lan2self_by_wanip ip saddr %s/24 ip daddr 172.16.12.1/32 counter jump xlog_drop_lan2self\n", lan_ipaddr); - fprintf(filter_fp, "add rule ip filter lan2self_by_wanip ip saddr %s/24 ip daddr 192.168.106.1/32 counter jump xlog_drop_lan2self\n", lan_ipaddr); fprintf(filter_fp, "add rule ip filter lan2self_by_wanip ip saddr %s/24 ip daddr 192.168.251.1/32 counter jump xlog_drop_lan2self\n", lan_ipaddr); if (rc == 0 && httpport[0] != '\0' && atoi(httpport) != 80 && (atoi(httpport) >= 0 && atoi(httpport) <= 65535 )) @@ -5831,6 +5860,7 @@ static int do_lan2self_mgmt(FILE *fp) static int do_lan2self(FILE *fp) { // FIREWALL_DEBUG("Entering do_lan2self\n"); + do_lan2self_isolatedInterfaces(fp); #if (defined(FEATURE_MAPT) && defined(NAT46_KERNEL_SUPPORT)) || defined(FEATURE_SUPPORT_MAPT_NAT46) if((!isMAPTReady) & isWanReady) // Pass for Dual Stack Line #else @@ -11375,6 +11405,7 @@ static int prepare_subtables(FILE *raw_fp, FILE *mangle_fp, FILE *nat_fp, FILE * #endif fprintf(filter_fp, "add chain ip filter %s\n", "lan2self"); fprintf(filter_fp, "add chain ip filter %s\n", "lan2self_by_wanip"); + fprintf(filter_fp, "add chain ip filter %s\n", "lan2self_isolatedInterfaces"); fprintf(filter_fp, "add chain ip filter %s\n", "lan2self_mgmt"); fprintf(filter_fp, "add chain ip filter %s\n", "host_detect"); fprintf(filter_fp, "add chain ip filter %s\n", "lanattack"); @@ -11958,8 +11989,10 @@ fprintf(filter_fp, "add rule ip filter FORWARD iifname \"%s\" oifname \"brlan112 fprintf(filter_fp, "add rule ip filter general_input iifname \"%s\" udp dport 161 jump xlog_drop_lan2self\n", XHS_IF_NAME); fprintf(filter_fp, "add rule ip filter general_input iifname \"%s\" udp dport 161 jump xlog_drop_lan2self\n", LNF_IF_NAME); #if defined (MULTILAN_FEATURE) + fprintf(filter_fp, "add rule ip filter lan2self counter jump lan2self_isolatedInterfaces\n"); fprintf(filter_fp, " add rule ip filter lan2self counter jump lan2self_by_wanip\n"); #else + fprintf(filter_fp, "add rule ip filter lan2self counter jump lan2self_isolatedInterfaces\n"); fprintf(filter_fp, "add rule ip filter lan2self ip daddr != %s counter jump lan2self_by_wanip\n", lan_ipaddr); #endif fprintf(filter_fp, "add rule ip filter lan2self counter jump lan2self_mgmt\n"); @@ -12903,6 +12936,7 @@ static int prepare_disabled_ipv4_firewall(FILE *raw_fp, FILE *mangle_fp, FILE *n { fprintf(filter_fp, "add chain ip filter %s\n", "lan2self"); fprintf(filter_fp, "add chain ip filter %s\n", "lan2self_by_wanip"); + fprintf(filter_fp, "add chain ip filter %s\n", "lan2self_isolatedInterfaces"); fprintf(filter_fp, "add chain ip filter %s\n", "lanattack"); fprintf(filter_fp, "add chain ip filter %s\n", "xlog_drop_lanattack"); do_lan2self(filter_fp); From f47cc81baf5414ab84f0011cd0ef4caf9f6e4ad6 Mon Sep 17 00:00:00 2001 From: ss192 Date: Fri, 25 Sep 2026 11:44:34 +0000 Subject: [PATCH 02/10] RDKB-66917 [MNGVULN] Remediation of managed vulnerabilities in firewall --- source/firewall/firewall.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source/firewall/firewall.c b/source/firewall/firewall.c index c7a8bc14..96887f9f 100644 --- a/source/firewall/firewall.c +++ b/source/firewall/firewall.c @@ -5910,7 +5910,7 @@ static int do_multinet_lan2self_by_wanip (FILE *filter_fp) static int do_lan2self_isolatedInterfaces(FILE *filter_fp) { FIREWALL_DEBUG("Entering do_lan2self_isolatedInterfaces\n"); -#if defined(MULTILAN_FEATURE) +#if !defined(MULTILAN_FEATURE) char *tok; char net_query[MAX_QUERY]; char net_resp[MAX_QUERY]; From ee231ff06688ff99b8ff04c5ede66024d5046a87 Mon Sep 17 00:00:00 2001 From: ss192 Date: Fri, 25 Sep 2026 14:07:16 +0000 Subject: [PATCH 03/10] local commit 2 --- source/firewall/firewall.c | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/source/firewall/firewall.c b/source/firewall/firewall.c index 96887f9f..7d04dd10 100644 --- a/source/firewall/firewall.c +++ b/source/firewall/firewall.c @@ -5920,39 +5920,34 @@ static int do_lan2self_isolatedInterfaces(FILE *filter_fp) inst_resp[0] = 0; sysevent_get(sysevent_fd, sysevent_token, "multinet-instances", inst_resp, sizeof(inst_resp)); - FIREWALL_DEBUG("lan2self_isolatedInterfaces: multinet-instances='%s'\n", inst_resp); + FIREWALL_DEBUG("lan2self_isolatedInterfaces: multinet-instance\n"); primary_inst[0] = 0; sysevent_get(sysevent_fd, sysevent_token, "primary_lan_l2net", primary_inst, sizeof(primary_inst)); - FIREWALL_DEBUG("lan2self_isolatedInterfaces: primary_lan_l2net='%s'\n", primary_inst); tok = strtok(inst_resp, " "); if (tok) do { - FIREWALL_DEBUG("lan2self_isolatedInterfaces: checking instance '%s'\n", tok); if (strcmp(primary_inst, tok) == 0) { - FIREWALL_DEBUG("lan2self_isolatedInterfaces: skipping primary instance '%s'\n", tok); + FIREWALL_DEBUG("lan2self_isolatedInterfaces: skipping primary instance \n"); continue; } snprintf(net_query, sizeof(net_query), "multinet_%s-localready", tok); net_resp[0] = 0; sysevent_get(sysevent_fd, sysevent_token, net_query, net_resp, sizeof(net_resp)); - FIREWALL_DEBUG("lan2self_isolatedInterfaces: %s='%s'\n", net_query, net_resp); + FIREWALL_DEBUG("lan2self_isolatedInterfaces: netquery\n"); if (strcmp("1", net_resp) != 0) { - FIREWALL_DEBUG("lan2self_isolatedInterfaces: skipping instance '%s' because it is not ready\n", tok); continue; } snprintf(net_query, sizeof(net_query), "multinet_%s-name", tok); net_resp[0] = 0; sysevent_get(sysevent_fd, sysevent_token, net_query, net_resp, sizeof(net_resp)); - FIREWALL_DEBUG("lan2self_isolatedInterfaces: %s='%s'\n", net_query, net_resp); interface_ipaddr = get_iface_ipaddr(net_resp); if (interface_ipaddr != NULL) { - FIREWALL_DEBUG("lan2self_isolatedInterfaces: adding interface '%s' with IPv4 '%s'\n", net_resp, interface_ipaddr); fprintf(filter_fp, "-A lan2self_isolatedInterfaces -s %s/24 -d %s/32 -j xlog_drop_lan2self\n", lan_ipaddr, interface_ipaddr); } else { - FIREWALL_DEBUG("lan2self_isolatedInterfaces: no IPv4 address found for interface '%s'\n", net_resp); + FIREWALL_DEBUG("lan2self_isolatedInterfaces: no IPv4 address found for interface\n"); } } while ((tok = strtok(NULL, " ")) != NULL); #else From c23f767464a7c51b033e41b77bb9dd122cf9ad61 Mon Sep 17 00:00:00 2001 From: ss192 Date: Tue, 29 Sep 2026 15:02:36 +0000 Subject: [PATCH 04/10] local commit 4 --- source/firewall/firewall.c | 43 +++++++++++++++++++++++++++++++++----- 1 file changed, 38 insertions(+), 5 deletions(-) diff --git a/source/firewall/firewall.c b/source/firewall/firewall.c index 7d04dd10..ab2a0779 100644 --- a/source/firewall/firewall.c +++ b/source/firewall/firewall.c @@ -5917,6 +5917,11 @@ static int do_lan2self_isolatedInterfaces(FILE *filter_fp) char inst_resp[MAX_QUERY]; char primary_inst[MAX_QUERY]; char *interface_ipaddr; + char *src_ipaddr; + char *dst_ipaddr; + char iface_names[32][IFNAMSIZ]; + int iface_count = 0; + int i, j; inst_resp[0] = 0; sysevent_get(sysevent_fd, sysevent_token, "multinet-instances", inst_resp, sizeof(inst_resp)); @@ -5943,13 +5948,41 @@ static int do_lan2self_isolatedInterfaces(FILE *filter_fp) snprintf(net_query, sizeof(net_query), "multinet_%s-name", tok); net_resp[0] = 0; sysevent_get(sysevent_fd, sysevent_token, net_query, net_resp, sizeof(net_resp)); - interface_ipaddr = get_iface_ipaddr(net_resp); - if (interface_ipaddr != NULL) { - fprintf(filter_fp, "-A lan2self_isolatedInterfaces -s %s/24 -d %s/32 -j xlog_drop_lan2self\n", lan_ipaddr, interface_ipaddr); - } else { - FIREWALL_DEBUG("lan2self_isolatedInterfaces: no IPv4 address found for interface\n"); + if (net_resp[0] != '\0') { + snprintf(iface_names[iface_count], sizeof(iface_names[iface_count]), "%s", net_resp); + iface_count++; } } while ((tok = strtok(NULL, " ")) != NULL); + + for (i = 0; i < 16; i++) { + snprintf(net_resp, sizeof(net_resp), "brlan%d", i); + if (strcmp(net_resp, lan_ifname) == 0) { + continue; + } + if (get_iface_ipaddr(net_resp) == NULL) { + continue; + } + snprintf(iface_names[iface_count], sizeof(iface_names[iface_count]), "%s", net_resp); + iface_count++; + } + + for (i = 0; i < iface_count; i++) { + src_ipaddr = get_iface_ipaddr(iface_names[i]); + if (src_ipaddr == NULL) { + continue; + } + + for (j = 0; j < iface_count; j++) { + if (i == j) { + continue; + } + + dst_ipaddr = get_iface_ipaddr(iface_names[j]); + if (dst_ipaddr != NULL) { + fprintf(filter_fp, "-A lan2self_isolatedInterfaces -s %s/24 -d %s/32 -j xlog_drop_lan2self\n", src_ipaddr, dst_ipaddr); + } + } + } #else FIREWALL_DEBUG("lan2self_isolatedInterfaces: MULTILAN_FEATURE is disabled\n"); #endif From da32d30a81e5b31a120bd31b396dc73695108a03 Mon Sep 17 00:00:00 2001 From: ss192 Date: Tue, 29 Sep 2026 15:32:27 +0000 Subject: [PATCH 05/10] local commit 9 --- source/firewall/firewall.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/source/firewall/firewall.c b/source/firewall/firewall.c index ab2a0779..60052e6c 100644 --- a/source/firewall/firewall.c +++ b/source/firewall/firewall.c @@ -5916,7 +5916,6 @@ static int do_lan2self_isolatedInterfaces(FILE *filter_fp) char net_resp[MAX_QUERY]; char inst_resp[MAX_QUERY]; char primary_inst[MAX_QUERY]; - char *interface_ipaddr; char *src_ipaddr; char *dst_ipaddr; char iface_names[32][IFNAMSIZ]; @@ -5949,8 +5948,11 @@ static int do_lan2self_isolatedInterfaces(FILE *filter_fp) net_resp[0] = 0; sysevent_get(sysevent_fd, sysevent_token, net_query, net_resp, sizeof(net_resp)); if (net_resp[0] != '\0') { - snprintf(iface_names[iface_count], sizeof(iface_names[iface_count]), "%s", net_resp); - iface_count++; + if (iface_count < (int)(sizeof(iface_names) / sizeof(iface_names[0]))) { + strncpy(iface_names[iface_count], net_resp, sizeof(iface_names[iface_count]) - 1); + iface_names[iface_count][sizeof(iface_names[iface_count]) - 1] = '\0'; + iface_count++; + } } } while ((tok = strtok(NULL, " ")) != NULL); @@ -5962,8 +5964,11 @@ static int do_lan2self_isolatedInterfaces(FILE *filter_fp) if (get_iface_ipaddr(net_resp) == NULL) { continue; } - snprintf(iface_names[iface_count], sizeof(iface_names[iface_count]), "%s", net_resp); - iface_count++; + if (iface_count < (int)(sizeof(iface_names) / sizeof(iface_names[0]))) { + strncpy(iface_names[iface_count], net_resp, sizeof(iface_names[iface_count]) - 1); + iface_names[iface_count][sizeof(iface_names[iface_count]) - 1] = '\0'; + iface_count++; + } } for (i = 0; i < iface_count; i++) { From a2af8607f98ced9a079605301169d52645839125 Mon Sep 17 00:00:00 2001 From: ss192 Date: Tue, 29 Sep 2026 17:34:17 +0000 Subject: [PATCH 06/10] local commit 5 --- source/firewall/firewall.c | 34 ++++++++++++++++++++++++++-------- 1 file changed, 26 insertions(+), 8 deletions(-) diff --git a/source/firewall/firewall.c b/source/firewall/firewall.c index 60052e6c..d936d99e 100644 --- a/source/firewall/firewall.c +++ b/source/firewall/firewall.c @@ -5921,6 +5921,7 @@ static int do_lan2self_isolatedInterfaces(FILE *filter_fp) char iface_names[32][IFNAMSIZ]; int iface_count = 0; int i, j; + int already_exists; inst_resp[0] = 0; sysevent_get(sysevent_fd, sysevent_token, "multinet-instances", inst_resp, sizeof(inst_resp)); @@ -5948,7 +5949,14 @@ static int do_lan2self_isolatedInterfaces(FILE *filter_fp) net_resp[0] = 0; sysevent_get(sysevent_fd, sysevent_token, net_query, net_resp, sizeof(net_resp)); if (net_resp[0] != '\0') { - if (iface_count < (int)(sizeof(iface_names) / sizeof(iface_names[0]))) { + already_exists = 0; + for (i = 0; i < iface_count; i++) { + if (strcmp(iface_names[i], net_resp) == 0) { + already_exists = 1; + break; + } + } + if (!already_exists && iface_count < (int)(sizeof(iface_names) / sizeof(iface_names[0]))) { strncpy(iface_names[iface_count], net_resp, sizeof(iface_names[iface_count]) - 1); iface_names[iface_count][sizeof(iface_names[iface_count]) - 1] = '\0'; iface_count++; @@ -5964,7 +5972,15 @@ static int do_lan2self_isolatedInterfaces(FILE *filter_fp) if (get_iface_ipaddr(net_resp) == NULL) { continue; } - if (iface_count < (int)(sizeof(iface_names) / sizeof(iface_names[0]))) { + + already_exists = 0; + for (j = 0; j < iface_count; j++) { + if (strcmp(iface_names[j], net_resp) == 0) { + already_exists = 1; + break; + } + } + if (!already_exists && iface_count < (int)(sizeof(iface_names) / sizeof(iface_names[0]))) { strncpy(iface_names[iface_count], net_resp, sizeof(iface_names[iface_count]) - 1); iface_names[iface_count][sizeof(iface_names[iface_count]) - 1] = '\0'; iface_count++; @@ -5977,15 +5993,17 @@ static int do_lan2self_isolatedInterfaces(FILE *filter_fp) continue; } - for (j = 0; j < iface_count; j++) { - if (i == j) { + for (j = i + 1; j < iface_count; j++) { + dst_ipaddr = get_iface_ipaddr(iface_names[j]); + if (dst_ipaddr == NULL) { continue; } - - dst_ipaddr = get_iface_ipaddr(iface_names[j]); - if (dst_ipaddr != NULL) { - fprintf(filter_fp, "-A lan2self_isolatedInterfaces -s %s/24 -d %s/32 -j xlog_drop_lan2self\n", src_ipaddr, dst_ipaddr); + if (strcmp(src_ipaddr, dst_ipaddr) == 0) { + continue; } + + fprintf(filter_fp, "-A lan2self_isolatedInterfaces -s %s/24 -d %s/32 -j xlog_drop_lan2self\n", src_ipaddr, dst_ipaddr); + fprintf(filter_fp, "-A lan2self_isolatedInterfaces -s %s/24 -d %s/32 -j xlog_drop_lan2self\n", dst_ipaddr, src_ipaddr); } } #else From 07f256330b5084d0cea7dd540d8340edf08d1f85 Mon Sep 17 00:00:00 2001 From: ss192 Date: Tue, 29 Sep 2026 18:43:43 +0000 Subject: [PATCH 07/10] local commit 7 --- source/firewall/firewall.c | 89 ++++++++++++++++---------------------- 1 file changed, 37 insertions(+), 52 deletions(-) diff --git a/source/firewall/firewall.c b/source/firewall/firewall.c index d936d99e..d41c347f 100644 --- a/source/firewall/firewall.c +++ b/source/firewall/firewall.c @@ -5915,10 +5915,9 @@ static int do_lan2self_isolatedInterfaces(FILE *filter_fp) char net_query[MAX_QUERY]; char net_resp[MAX_QUERY]; char inst_resp[MAX_QUERY]; - char primary_inst[MAX_QUERY]; - char *src_ipaddr; - char *dst_ipaddr; char iface_names[32][IFNAMSIZ]; + char iface_ipaddrs[32][INET_ADDRSTRLEN]; + char *interface_ipaddr; int iface_count = 0; int i, j; int already_exists; @@ -5927,16 +5926,8 @@ static int do_lan2self_isolatedInterfaces(FILE *filter_fp) sysevent_get(sysevent_fd, sysevent_token, "multinet-instances", inst_resp, sizeof(inst_resp)); FIREWALL_DEBUG("lan2self_isolatedInterfaces: multinet-instance\n"); - primary_inst[0] = 0; - sysevent_get(sysevent_fd, sysevent_token, "primary_lan_l2net", primary_inst, sizeof(primary_inst)); - tok = strtok(inst_resp, " "); if (tok) do { - if (strcmp(primary_inst, tok) == 0) { - FIREWALL_DEBUG("lan2self_isolatedInterfaces: skipping primary instance \n"); - continue; - } - snprintf(net_query, sizeof(net_query), "multinet_%s-localready", tok); net_resp[0] = 0; sysevent_get(sysevent_fd, sysevent_token, net_query, net_resp, sizeof(net_resp)); @@ -5948,62 +5939,34 @@ static int do_lan2self_isolatedInterfaces(FILE *filter_fp) snprintf(net_query, sizeof(net_query), "multinet_%s-name", tok); net_resp[0] = 0; sysevent_get(sysevent_fd, sysevent_token, net_query, net_resp, sizeof(net_resp)); - if (net_resp[0] != '\0') { - already_exists = 0; - for (i = 0; i < iface_count; i++) { - if (strcmp(iface_names[i], net_resp) == 0) { - already_exists = 1; - break; - } - } - if (!already_exists && iface_count < (int)(sizeof(iface_names) / sizeof(iface_names[0]))) { - strncpy(iface_names[iface_count], net_resp, sizeof(iface_names[iface_count]) - 1); - iface_names[iface_count][sizeof(iface_names[iface_count]) - 1] = '\0'; - iface_count++; - } - } - } while ((tok = strtok(NULL, " ")) != NULL); - - for (i = 0; i < 16; i++) { - snprintf(net_resp, sizeof(net_resp), "brlan%d", i); - if (strcmp(net_resp, lan_ifname) == 0) { - continue; - } - if (get_iface_ipaddr(net_resp) == NULL) { + interface_ipaddr = get_iface_ipaddr(net_resp); + if (interface_ipaddr == NULL) { + FIREWALL_DEBUG("lan2self_isolatedInterfaces: no IPv4 address found for interface\n"); continue; } already_exists = 0; - for (j = 0; j < iface_count; j++) { - if (strcmp(iface_names[j], net_resp) == 0) { + for (i = 0; i < iface_count; i++) { + if (strcmp(iface_names[i], net_resp) == 0) { already_exists = 1; break; } } if (!already_exists && iface_count < (int)(sizeof(iface_names) / sizeof(iface_names[0]))) { - strncpy(iface_names[iface_count], net_resp, sizeof(iface_names[iface_count]) - 1); - iface_names[iface_count][sizeof(iface_names[iface_count]) - 1] = '\0'; + snprintf(iface_names[iface_count], sizeof(iface_names[iface_count]), "%.*s", IFNAMSIZ - 1, net_resp); + snprintf(iface_ipaddrs[iface_count], sizeof(iface_ipaddrs[iface_count]), "%.*s", INET_ADDRSTRLEN - 1, interface_ipaddr); iface_count++; } - } + } while ((tok = strtok(NULL, " ")) != NULL); for (i = 0; i < iface_count; i++) { - src_ipaddr = get_iface_ipaddr(iface_names[i]); - if (src_ipaddr == NULL) { - continue; - } - for (j = i + 1; j < iface_count; j++) { - dst_ipaddr = get_iface_ipaddr(iface_names[j]); - if (dst_ipaddr == NULL) { - continue; - } - if (strcmp(src_ipaddr, dst_ipaddr) == 0) { + if (strcmp(iface_ipaddrs[i], iface_ipaddrs[j]) == 0) { continue; } - fprintf(filter_fp, "-A lan2self_isolatedInterfaces -s %s/24 -d %s/32 -j xlog_drop_lan2self\n", src_ipaddr, dst_ipaddr); - fprintf(filter_fp, "-A lan2self_isolatedInterfaces -s %s/24 -d %s/32 -j xlog_drop_lan2self\n", dst_ipaddr, src_ipaddr); + fprintf(filter_fp, "-A lan2self_isolatedInterfaces -s %s/24 -d %s/32 -j xlog_drop_lan2self\n", iface_ipaddrs[i], iface_ipaddrs[j]); + fprintf(filter_fp, "-A lan2self_isolatedInterfaces -s %s/24 -d %s/32 -j xlog_drop_lan2self\n", iface_ipaddrs[j], iface_ipaddrs[i]); } } #else @@ -11385,6 +11348,10 @@ static int prepare_multinet_filter_forward (FILE *filter_fp) char inst_resp[MAX_QUERY]; char primary_inst[MAX_QUERY]; char ip[MAX_QUERY]; + char bridge_names[32][IFNAMSIZ]; + int bridge_count = 0; + int i, j; + int already_exists; FIREWALL_DEBUG("Entering prepare_multinet_filter_forward\n"); @@ -11602,11 +11569,29 @@ static int prepare_multinet_filter_forward (FILE *filter_fp) snprintf(net_query, sizeof(net_query), "multinet_%s-name", tok); net_resp[0] = 0; sysevent_get(sysevent_fd, sysevent_token, net_query, net_resp, sizeof(net_resp)); - - fprintf(filter_fp, "-A FORWARD -i %s -o %s -j ACCEPT\n", net_resp, net_resp); + + already_exists = 0; + for (i = 0; i < bridge_count; i++) { + if (strcmp(bridge_names[i], net_resp) == 0) { + already_exists = 1; + break; + } + } + if (!already_exists && bridge_count < (int)(sizeof(bridge_names) / sizeof(bridge_names[0]))) { + snprintf(bridge_names[bridge_count], sizeof(bridge_names[bridge_count]), "%.*s", IFNAMSIZ - 1, net_resp); + bridge_count++; + } } while ((tok = strtok(NULL, " ")) != NULL); + for (i = 0; i < bridge_count; i++) { + for (j = i + 1; j < bridge_count; j++) { + fprintf(filter_fp, "-A FORWARD -i %s -o %s -j DROP\n", bridge_names[i], bridge_names[j]); + fprintf(filter_fp, "-A FORWARD -i %s -o %s -j DROP\n", bridge_names[j], bridge_names[i]); + } + fprintf(filter_fp, "-A FORWARD -i %s -o %s -j ACCEPT\n", bridge_names[i], bridge_names[i]); + } + FIREWALL_DEBUG("Exiting prepare_multinet_filter_forward\n"); return 0; From 67394a7b590c3a18d191001f52ca0e966152f49e Mon Sep 17 00:00:00 2001 From: ss192 Date: Wed, 30 Sep 2026 10:45:54 +0000 Subject: [PATCH 08/10] local commit 8 --- source/firewall/firewall.c | 49 ++++++--------- source/firewall_nft/firewall_nft.c | 98 ++++++++++++++++++++---------- 2 files changed, 86 insertions(+), 61 deletions(-) diff --git a/source/firewall/firewall.c b/source/firewall/firewall.c index d41c347f..50047f05 100644 --- a/source/firewall/firewall.c +++ b/source/firewall/firewall.c @@ -5907,10 +5907,10 @@ static int do_multinet_lan2self_by_wanip (FILE *filter_fp) } #endif -static int do_lan2self_isolatedInterfaces(FILE *filter_fp) +#if defined(MULTILAN_FEATURE) +static int do_lan2self_isolatedBridges(FILE *filter_fp) { - FIREWALL_DEBUG("Entering do_lan2self_isolatedInterfaces\n"); -#if !defined(MULTILAN_FEATURE) + FIREWALL_DEBUG("Entering do_lan2self_isolatedBridges\n"); char *tok; char net_query[MAX_QUERY]; char net_resp[MAX_QUERY]; @@ -5924,24 +5924,16 @@ static int do_lan2self_isolatedInterfaces(FILE *filter_fp) inst_resp[0] = 0; sysevent_get(sysevent_fd, sysevent_token, "multinet-instances", inst_resp, sizeof(inst_resp)); - FIREWALL_DEBUG("lan2self_isolatedInterfaces: multinet-instance\n"); + FIREWALL_DEBUG("lan2self_isolatedBridges: multinet-instance\n"); tok = strtok(inst_resp, " "); if (tok) do { - snprintf(net_query, sizeof(net_query), "multinet_%s-localready", tok); - net_resp[0] = 0; - sysevent_get(sysevent_fd, sysevent_token, net_query, net_resp, sizeof(net_resp)); - FIREWALL_DEBUG("lan2self_isolatedInterfaces: netquery\n"); - if (strcmp("1", net_resp) != 0) { - continue; - } - snprintf(net_query, sizeof(net_query), "multinet_%s-name", tok); net_resp[0] = 0; sysevent_get(sysevent_fd, sysevent_token, net_query, net_resp, sizeof(net_resp)); interface_ipaddr = get_iface_ipaddr(net_resp); if (interface_ipaddr == NULL) { - FIREWALL_DEBUG("lan2self_isolatedInterfaces: no IPv4 address found for interface\n"); + FIREWALL_DEBUG("lan2self_isolatedBridges: no IPv4 address found for interface\n"); continue; } @@ -5965,17 +5957,15 @@ static int do_lan2self_isolatedInterfaces(FILE *filter_fp) continue; } - fprintf(filter_fp, "-A lan2self_isolatedInterfaces -s %s/24 -d %s/32 -j xlog_drop_lan2self\n", iface_ipaddrs[i], iface_ipaddrs[j]); - fprintf(filter_fp, "-A lan2self_isolatedInterfaces -s %s/24 -d %s/32 -j xlog_drop_lan2self\n", iface_ipaddrs[j], iface_ipaddrs[i]); + fprintf(filter_fp, "-A lan2self_isolatedBridges -s %s/24 -d %s/32 -j xlog_drop_lan2self\n", iface_ipaddrs[i], iface_ipaddrs[j]); + fprintf(filter_fp, "-A lan2self_isolatedBridges -s %s/24 -d %s/32 -j xlog_drop_lan2self\n", iface_ipaddrs[j], iface_ipaddrs[i]); } } -#else - FIREWALL_DEBUG("lan2self_isolatedInterfaces: MULTILAN_FEATURE is disabled\n"); -#endif - FIREWALL_DEBUG("Exiting do_lan2self_isolatedInterfaces\n"); + FIREWALL_DEBUG("Exiting do_lan2self_isolatedBridges\n"); return 0; } +#endif static int do_lan2self_by_wanip(FILE *filter_fp, int family) { @@ -6129,7 +6119,9 @@ static int do_lan2self_mgmt(FILE *fp) static int do_lan2self(FILE *fp) { // FIREWALL_DEBUG("Entering do_lan2self\n"); - do_lan2self_isolatedInterfaces(fp); +#if defined(MULTILAN_FEATURE) + do_lan2self_isolatedBridges(fp); +#endif #if (defined(FEATURE_MAPT) && defined(NAT46_KERNEL_SUPPORT)) || defined(FEATURE_SUPPORT_MAPT_NAT46) if((!isMAPTReady) & isWanReady) // Pass for Dual Stack Line #else @@ -11560,12 +11552,6 @@ static int prepare_multinet_filter_forward (FILE *filter_fp) tok = strtok(inst_resp, " "); if (tok) do { - snprintf(net_query, sizeof(net_query), "multinet_%s-localready", tok); - net_resp[0] = 0; - sysevent_get(sysevent_fd, sysevent_token, net_query, net_resp, sizeof(net_resp)); - if (strcmp("1", net_resp) != 0) - continue; - snprintf(net_query, sizeof(net_query), "multinet_%s-name", tok); net_resp[0] = 0; sysevent_get(sysevent_fd, sysevent_token, net_query, net_resp, sizeof(net_resp)); @@ -12627,7 +12613,9 @@ static int prepare_subtables(FILE *raw_fp, FILE *mangle_fp, FILE *nat_fp, FILE * #endif fprintf(filter_fp, ":%s - [0:0]\n", "lan2self"); fprintf(filter_fp, ":%s - [0:0]\n", "lan2self_by_wanip"); - fprintf(filter_fp, ":%s - [0:0]\n", "lan2self_isolatedInterfaces"); +#if defined(MULTILAN_FEATURE) + fprintf(filter_fp, ":%s - [0:0]\n", "lan2self_isolatedBridges"); +#endif fprintf(filter_fp, ":%s - [0:0]\n", "lan2self_mgmt"); fprintf(filter_fp, ":%s - [0:0]\n", "host_detect"); fprintf(filter_fp, ":%s - [0:0]\n", "lanattack"); @@ -13279,10 +13267,9 @@ static int prepare_subtables(FILE *raw_fp, FILE *mangle_fp, FILE *nat_fp, FILE * fprintf(filter_fp, "-A general_input -i %s -p udp -m udp --dport 161 -j xlog_drop_lan2self\n", XHS_IF_NAME); fprintf(filter_fp, "-A general_input -i %s -p udp -m udp --dport 161 -j xlog_drop_lan2self\n", LNF_IF_NAME); #if defined (MULTILAN_FEATURE) - fprintf(filter_fp, "-A lan2self -j lan2self_isolatedInterfaces\n"); + fprintf(filter_fp, "-A lan2self -j lan2self_isolatedBridges\n"); fprintf(filter_fp, "-A lan2self -j lan2self_by_wanip\n"); #else - fprintf(filter_fp, "-A lan2self -j lan2self_isolatedInterfaces\n"); fprintf(filter_fp, "-A lan2self ! -d %s -j lan2self_by_wanip\n", lan_ipaddr); #endif fprintf(filter_fp, "-A lan2self -j lan2self_mgmt\n"); @@ -14384,7 +14371,9 @@ static int prepare_disabled_ipv4_firewall(FILE *raw_fp, FILE *mangle_fp, FILE *n { fprintf(filter_fp, ":%s - [0:0]\n", "lan2self"); fprintf(filter_fp, ":%s - [0:0]\n", "lan2self_by_wanip"); - fprintf(filter_fp, ":%s - [0:0]\n", "lan2self_isolatedInterfaces"); +#if defined(MULTILAN_FEATURE) + fprintf(filter_fp, ":%s - [0:0]\n", "lan2self_isolatedBridges"); +#endif fprintf(filter_fp, ":%s - [0:0]\n", "lanattack"); fprintf(filter_fp, ":%s - [0:0]\n", "xlog_drop_lanattack"); do_lan2self(filter_fp); diff --git a/source/firewall_nft/firewall_nft.c b/source/firewall_nft/firewall_nft.c index d0652e1e..0badcbe5 100644 --- a/source/firewall_nft/firewall_nft.c +++ b/source/firewall_nft/firewall_nft.c @@ -5670,44 +5670,59 @@ static int do_multinet_lan2self_by_wanip (FILE *filter_fp) } #endif -static int do_lan2self_isolatedInterfaces(FILE *filter_fp) -{ #if defined(MULTILAN_FEATURE) +static int do_lan2self_isolatedBridges(FILE *filter_fp) +{ char *tok; char net_query[MAX_QUERY]; char net_resp[MAX_QUERY]; char inst_resp[MAX_QUERY]; - char primary_inst[MAX_QUERY]; + char iface_names[32][IFNAMSIZ]; + char iface_ipaddrs[32][INET_ADDRSTRLEN]; char *interface_ipaddr; + int iface_count = 0; + int i, j; + int already_exists; inst_resp[0] = 0; sysevent_get(sysevent_fd, sysevent_token, "multinet-instances", inst_resp, sizeof(inst_resp)); - primary_inst[0] = 0; - sysevent_get(sysevent_fd, sysevent_token, "primary_lan_l2net", primary_inst, sizeof(primary_inst)); - tok = strtok(inst_resp, " "); if (tok) do { - if (strcmp(primary_inst, tok) == 0) - continue; - - snprintf(net_query, sizeof(net_query), "multinet_%s-localready", tok); - net_resp[0] = 0; - sysevent_get(sysevent_fd, sysevent_token, net_query, net_resp, sizeof(net_resp)); - if (strcmp("1", net_resp) != 0) - continue; - snprintf(net_query, sizeof(net_query), "multinet_%s-name", tok); net_resp[0] = 0; sysevent_get(sysevent_fd, sysevent_token, net_query, net_resp, sizeof(net_resp)); interface_ipaddr = get_iface_ipaddr(net_resp); - if (interface_ipaddr != NULL) - fprintf(filter_fp, "add rule ip filter lan2self_isolatedInterfaces ip saddr %s/24 ip daddr %s/32 counter jump xlog_drop_lan2self\n", lan_ipaddr, interface_ipaddr); + if (interface_ipaddr == NULL) + continue; + + already_exists = 0; + for (i = 0; i < iface_count; i++) { + if (strcmp(iface_names[i], net_resp) == 0) { + already_exists = 1; + break; + } + } + if (!already_exists && iface_count < (int)(sizeof(iface_names) / sizeof(iface_names[0]))) { + snprintf(iface_names[iface_count], sizeof(iface_names[iface_count]), "%.*s", IFNAMSIZ - 1, net_resp); + snprintf(iface_ipaddrs[iface_count], sizeof(iface_ipaddrs[iface_count]), "%.*s", INET_ADDRSTRLEN - 1, interface_ipaddr); + iface_count++; + } } while ((tok = strtok(NULL, " ")) != NULL); -#endif + + for (i = 0; i < iface_count; i++) { + for (j = i + 1; j < iface_count; j++) { + if (strcmp(iface_ipaddrs[i], iface_ipaddrs[j]) == 0) + continue; + + fprintf(filter_fp, "add rule ip filter lan2self_isolatedBridges ip saddr %s/24 ip daddr %s/32 counter jump xlog_drop_lan2self\n", iface_ipaddrs[i], iface_ipaddrs[j]); + fprintf(filter_fp, "add rule ip filter lan2self_isolatedBridges ip saddr %s/24 ip daddr %s/32 counter jump xlog_drop_lan2self\n", iface_ipaddrs[j], iface_ipaddrs[i]); + } + } return 0; } +#endif static int do_lan2self_by_wanip(FILE *filter_fp, int family) { @@ -5860,7 +5875,9 @@ static int do_lan2self_mgmt(FILE *fp) static int do_lan2self(FILE *fp) { // FIREWALL_DEBUG("Entering do_lan2self\n"); - do_lan2self_isolatedInterfaces(fp); +#if defined(MULTILAN_FEATURE) + do_lan2self_isolatedBridges(fp); +#endif #if (defined(FEATURE_MAPT) && defined(NAT46_KERNEL_SUPPORT)) || defined(FEATURE_SUPPORT_MAPT_NAT46) if((!isMAPTReady) & isWanReady) // Pass for Dual Stack Line #else @@ -10211,6 +10228,10 @@ static int prepare_multinet_filter_forward (FILE *filter_fp) char inst_resp[MAX_QUERY]; char primary_inst[MAX_QUERY]; char ip[MAX_QUERY]; + char bridge_names[32][IFNAMSIZ]; + int bridge_count = 0; + int i, j; + int already_exists; FIREWALL_DEBUG("Entering prepare_multinet_filter_forward\n"); @@ -10422,20 +10443,32 @@ static int prepare_multinet_filter_forward (FILE *filter_fp) tok = strtok(inst_resp, " "); if (tok) do { - snprintf(net_query, sizeof(net_query), "multinet_%s-localready", tok); - net_resp[0] = 0; - sysevent_get(sysevent_fd, sysevent_token, net_query, net_resp, sizeof(net_resp)); - if (strcmp("1", net_resp) != 0) - continue; - snprintf(net_query, sizeof(net_query), "multinet_%s-name", tok); net_resp[0] = 0; sysevent_get(sysevent_fd, sysevent_token, net_query, net_resp, sizeof(net_resp)); - - fprintf(filter_fp, "add rule ip filter FORWARD iifname \"%s\" oifname \"%s\" counter accept\n", net_resp, net_resp); + + already_exists = 0; + for (i = 0; i < bridge_count; i++) { + if (strcmp(bridge_names[i], net_resp) == 0) { + already_exists = 1; + break; + } + } + if (!already_exists && bridge_count < (int)(sizeof(bridge_names) / sizeof(bridge_names[0]))) { + snprintf(bridge_names[bridge_count], sizeof(bridge_names[bridge_count]), "%.*s", IFNAMSIZ - 1, net_resp); + bridge_count++; + } } while ((tok = strtok(NULL, " ")) != NULL); + for (i = 0; i < bridge_count; i++) { + for (j = i + 1; j < bridge_count; j++) { + fprintf(filter_fp, "add rule ip filter FORWARD iifname \"%s\" oifname \"%s\" counter drop\n", bridge_names[i], bridge_names[j]); + fprintf(filter_fp, "add rule ip filter FORWARD iifname \"%s\" oifname \"%s\" counter drop\n", bridge_names[j], bridge_names[i]); + } + fprintf(filter_fp, "add rule ip filter FORWARD iifname \"%s\" oifname \"%s\" counter accept\n", bridge_names[i], bridge_names[i]); + } + FIREWALL_DEBUG("Exiting prepare_multinet_filter_forward\n"); return 0; @@ -11405,7 +11438,9 @@ static int prepare_subtables(FILE *raw_fp, FILE *mangle_fp, FILE *nat_fp, FILE * #endif fprintf(filter_fp, "add chain ip filter %s\n", "lan2self"); fprintf(filter_fp, "add chain ip filter %s\n", "lan2self_by_wanip"); - fprintf(filter_fp, "add chain ip filter %s\n", "lan2self_isolatedInterfaces"); +#if defined(MULTILAN_FEATURE) + fprintf(filter_fp, "add chain ip filter %s\n", "lan2self_isolatedBridges"); +#endif fprintf(filter_fp, "add chain ip filter %s\n", "lan2self_mgmt"); fprintf(filter_fp, "add chain ip filter %s\n", "host_detect"); fprintf(filter_fp, "add chain ip filter %s\n", "lanattack"); @@ -11989,10 +12024,9 @@ fprintf(filter_fp, "add rule ip filter FORWARD iifname \"%s\" oifname \"brlan112 fprintf(filter_fp, "add rule ip filter general_input iifname \"%s\" udp dport 161 jump xlog_drop_lan2self\n", XHS_IF_NAME); fprintf(filter_fp, "add rule ip filter general_input iifname \"%s\" udp dport 161 jump xlog_drop_lan2self\n", LNF_IF_NAME); #if defined (MULTILAN_FEATURE) - fprintf(filter_fp, "add rule ip filter lan2self counter jump lan2self_isolatedInterfaces\n"); + fprintf(filter_fp, "add rule ip filter lan2self counter jump lan2self_isolatedBridges\n"); fprintf(filter_fp, " add rule ip filter lan2self counter jump lan2self_by_wanip\n"); #else - fprintf(filter_fp, "add rule ip filter lan2self counter jump lan2self_isolatedInterfaces\n"); fprintf(filter_fp, "add rule ip filter lan2self ip daddr != %s counter jump lan2self_by_wanip\n", lan_ipaddr); #endif fprintf(filter_fp, "add rule ip filter lan2self counter jump lan2self_mgmt\n"); @@ -12936,7 +12970,9 @@ static int prepare_disabled_ipv4_firewall(FILE *raw_fp, FILE *mangle_fp, FILE *n { fprintf(filter_fp, "add chain ip filter %s\n", "lan2self"); fprintf(filter_fp, "add chain ip filter %s\n", "lan2self_by_wanip"); - fprintf(filter_fp, "add chain ip filter %s\n", "lan2self_isolatedInterfaces"); + #if defined(MULTILAN_FEATURE) + fprintf(filter_fp, "add chain ip filter %s\n", "lan2self_isolatedBridges"); + #endif fprintf(filter_fp, "add chain ip filter %s\n", "lanattack"); fprintf(filter_fp, "add chain ip filter %s\n", "xlog_drop_lanattack"); do_lan2self(filter_fp); From d39994b9ffd3d9e506b06577744994f093ea6ac6 Mon Sep 17 00:00:00 2001 From: ss192 Date: Wed, 30 Sep 2026 13:28:33 +0000 Subject: [PATCH 09/10] local commit 10 --- source/firewall/firewall.c | 10 +--------- source/firewall_nft/firewall_nft.c | 10 +--------- 2 files changed, 2 insertions(+), 18 deletions(-) diff --git a/source/firewall/firewall.c b/source/firewall/firewall.c index 50047f05..1916166c 100644 --- a/source/firewall/firewall.c +++ b/source/firewall/firewall.c @@ -5907,7 +5907,6 @@ static int do_multinet_lan2self_by_wanip (FILE *filter_fp) } #endif -#if defined(MULTILAN_FEATURE) static int do_lan2self_isolatedBridges(FILE *filter_fp) { FIREWALL_DEBUG("Entering do_lan2self_isolatedBridges\n"); @@ -5965,7 +5964,6 @@ static int do_lan2self_isolatedBridges(FILE *filter_fp) FIREWALL_DEBUG("Exiting do_lan2self_isolatedBridges\n"); return 0; } -#endif static int do_lan2self_by_wanip(FILE *filter_fp, int family) { @@ -6119,9 +6117,7 @@ static int do_lan2self_mgmt(FILE *fp) static int do_lan2self(FILE *fp) { // FIREWALL_DEBUG("Entering do_lan2self\n"); -#if defined(MULTILAN_FEATURE) do_lan2self_isolatedBridges(fp); -#endif #if (defined(FEATURE_MAPT) && defined(NAT46_KERNEL_SUPPORT)) || defined(FEATURE_SUPPORT_MAPT_NAT46) if((!isMAPTReady) & isWanReady) // Pass for Dual Stack Line #else @@ -12613,9 +12609,7 @@ static int prepare_subtables(FILE *raw_fp, FILE *mangle_fp, FILE *nat_fp, FILE * #endif fprintf(filter_fp, ":%s - [0:0]\n", "lan2self"); fprintf(filter_fp, ":%s - [0:0]\n", "lan2self_by_wanip"); -#if defined(MULTILAN_FEATURE) fprintf(filter_fp, ":%s - [0:0]\n", "lan2self_isolatedBridges"); -#endif fprintf(filter_fp, ":%s - [0:0]\n", "lan2self_mgmt"); fprintf(filter_fp, ":%s - [0:0]\n", "host_detect"); fprintf(filter_fp, ":%s - [0:0]\n", "lanattack"); @@ -13266,8 +13260,8 @@ static int prepare_subtables(FILE *raw_fp, FILE *mangle_fp, FILE *nat_fp, FILE * /* RDKB-57186 SNMP drop to XHS and LnF */ fprintf(filter_fp, "-A general_input -i %s -p udp -m udp --dport 161 -j xlog_drop_lan2self\n", XHS_IF_NAME); fprintf(filter_fp, "-A general_input -i %s -p udp -m udp --dport 161 -j xlog_drop_lan2self\n", LNF_IF_NAME); -#if defined (MULTILAN_FEATURE) fprintf(filter_fp, "-A lan2self -j lan2self_isolatedBridges\n"); +#if defined (MULTILAN_FEATURE) fprintf(filter_fp, "-A lan2self -j lan2self_by_wanip\n"); #else fprintf(filter_fp, "-A lan2self ! -d %s -j lan2self_by_wanip\n", lan_ipaddr); @@ -14371,9 +14365,7 @@ static int prepare_disabled_ipv4_firewall(FILE *raw_fp, FILE *mangle_fp, FILE *n { fprintf(filter_fp, ":%s - [0:0]\n", "lan2self"); fprintf(filter_fp, ":%s - [0:0]\n", "lan2self_by_wanip"); -#if defined(MULTILAN_FEATURE) fprintf(filter_fp, ":%s - [0:0]\n", "lan2self_isolatedBridges"); -#endif fprintf(filter_fp, ":%s - [0:0]\n", "lanattack"); fprintf(filter_fp, ":%s - [0:0]\n", "xlog_drop_lanattack"); do_lan2self(filter_fp); diff --git a/source/firewall_nft/firewall_nft.c b/source/firewall_nft/firewall_nft.c index 0badcbe5..72f883dc 100644 --- a/source/firewall_nft/firewall_nft.c +++ b/source/firewall_nft/firewall_nft.c @@ -5670,7 +5670,6 @@ static int do_multinet_lan2self_by_wanip (FILE *filter_fp) } #endif -#if defined(MULTILAN_FEATURE) static int do_lan2self_isolatedBridges(FILE *filter_fp) { char *tok; @@ -5722,7 +5721,6 @@ static int do_lan2self_isolatedBridges(FILE *filter_fp) return 0; } -#endif static int do_lan2self_by_wanip(FILE *filter_fp, int family) { @@ -5875,9 +5873,7 @@ static int do_lan2self_mgmt(FILE *fp) static int do_lan2self(FILE *fp) { // FIREWALL_DEBUG("Entering do_lan2self\n"); -#if defined(MULTILAN_FEATURE) do_lan2self_isolatedBridges(fp); -#endif #if (defined(FEATURE_MAPT) && defined(NAT46_KERNEL_SUPPORT)) || defined(FEATURE_SUPPORT_MAPT_NAT46) if((!isMAPTReady) & isWanReady) // Pass for Dual Stack Line #else @@ -11438,9 +11434,7 @@ static int prepare_subtables(FILE *raw_fp, FILE *mangle_fp, FILE *nat_fp, FILE * #endif fprintf(filter_fp, "add chain ip filter %s\n", "lan2self"); fprintf(filter_fp, "add chain ip filter %s\n", "lan2self_by_wanip"); -#if defined(MULTILAN_FEATURE) fprintf(filter_fp, "add chain ip filter %s\n", "lan2self_isolatedBridges"); -#endif fprintf(filter_fp, "add chain ip filter %s\n", "lan2self_mgmt"); fprintf(filter_fp, "add chain ip filter %s\n", "host_detect"); fprintf(filter_fp, "add chain ip filter %s\n", "lanattack"); @@ -12023,8 +12017,8 @@ fprintf(filter_fp, "add rule ip filter FORWARD iifname \"%s\" oifname \"brlan112 /* RDKB-57186 SNMP drop to XHS and LnF */ fprintf(filter_fp, "add rule ip filter general_input iifname \"%s\" udp dport 161 jump xlog_drop_lan2self\n", XHS_IF_NAME); fprintf(filter_fp, "add rule ip filter general_input iifname \"%s\" udp dport 161 jump xlog_drop_lan2self\n", LNF_IF_NAME); - #if defined (MULTILAN_FEATURE) fprintf(filter_fp, "add rule ip filter lan2self counter jump lan2self_isolatedBridges\n"); +#if defined (MULTILAN_FEATURE) fprintf(filter_fp, " add rule ip filter lan2self counter jump lan2self_by_wanip\n"); #else fprintf(filter_fp, "add rule ip filter lan2self ip daddr != %s counter jump lan2self_by_wanip\n", lan_ipaddr); @@ -12970,9 +12964,7 @@ static int prepare_disabled_ipv4_firewall(FILE *raw_fp, FILE *mangle_fp, FILE *n { fprintf(filter_fp, "add chain ip filter %s\n", "lan2self"); fprintf(filter_fp, "add chain ip filter %s\n", "lan2self_by_wanip"); - #if defined(MULTILAN_FEATURE) fprintf(filter_fp, "add chain ip filter %s\n", "lan2self_isolatedBridges"); - #endif fprintf(filter_fp, "add chain ip filter %s\n", "lanattack"); fprintf(filter_fp, "add chain ip filter %s\n", "xlog_drop_lanattack"); do_lan2self(filter_fp); From 7dd774962d9f10120668e3d1c78e393b94e09998 Mon Sep 17 00:00:00 2001 From: ss192 Date: Thu, 1 Oct 2026 18:38:20 +0000 Subject: [PATCH 10/10] local commit 11 --- source/firewall/firewall.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/source/firewall/firewall.c b/source/firewall/firewall.c index 1916166c..75704ca4 100644 --- a/source/firewall/firewall.c +++ b/source/firewall/firewall.c @@ -6005,10 +6005,6 @@ static int do_lan2self_by_wanip(FILE *filter_fp, int family) fprintf(filter_fp, "-A lan2self_by_wanip -s %s/24 -d 192.168.101.1/32 -j xlog_drop_lan2self\n", lan_ipaddr); fprintf(filter_fp, "-A lan2self_by_wanip -s %s/24 -d 169.254.101.1/32 -j xlog_drop_lan2self\n", lan_ipaddr); //<< -#if defined(_WNXL11BWL_PRODUCT_REQ_) - fprintf(filter_fp, "-A lan2self_by_wanip -s %s/24 -d 169.254.70.254/32 -j xlog_drop_lan2self\n", lan_ipaddr); - fprintf(filter_fp, "-A lan2self_by_wanip -s %s/24 -d 169.254.71.254/32 -j xlog_drop_lan2self\n", lan_ipaddr); -#endif fprintf(filter_fp, "-A lan2self_by_wanip -s %s/24 -d 192.168.251.1/32 -j xlog_drop_lan2self\n", lan_ipaddr); if (rc == 0 && httpport[0] != '\0' && atoi(httpport) != 80 && (atoi(httpport) >= 0 && atoi(httpport) <= 65535 ))