Skip to content

RDKB-66917 : [MNGVULN] Remediation of managed vulnerabilities in firewall #434

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
snayak002c merged 11 commits into from
Oct 1, 2026
Merged

RDKB-66917 : [MNGVULN] Remediation of managed vulnerabilities in firewall #434

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
5a2ce8a
RDKB-66917 [MNGVULN] Remediation of managed vulnerabilities in firewall
Selvaranjani971 Sep 25, 2026
f47cc81
RDKB-66917 [MNGVULN] Remediation of managed vulnerabilities in firewall
Selvaranjani971 Sep 25, 2026
ee231ff
local commit 2
Selvaranjani971 Sep 25, 2026
c23f767
local commit 4
Selvaranjani971 Sep 29, 2026
da32d30
local commit 9
Selvaranjani971 Sep 29, 2026
a2af860
local commit 5
Selvaranjani971 Sep 29, 2026
07f2563
local commit 7
Selvaranjani971 Sep 29, 2026
67394a7
local commit 8
Selvaranjani971 Sep 30, 2026
d39994b
local commit 10
Selvaranjani971 Sep 30, 2026
7dd7749
local commit 11
Selvaranjani971 Oct 1, 2026
8566494
Merge branch 'develop' into lan2self_isolated
snayak002c Oct 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
110 changes: 87 additions & 23 deletions source/firewall/firewall.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -359,16 +359,12 @@ Defines used to control conditional compilation
#include "ccsp_memory.h"


#if defined (WAN_FAILOVER_SUPPORTED) || defined(RDKB_EXTENDER_ENABLED)

#include <sys/types.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <netinet/in.h>
#include <net/if.h>

#endif

#ifdef _ONESTACK_PRODUCT_REQ_
#include <rdkb_feature_mode_gate.h>
#endif
Expand Down Expand Up @@ -887,8 +883,6 @@ unsigned int Get_Device_Mode()
}
#endif

#ifdef WAN_FAILOVER_SUPPORTED

int create_socket()
{
int sockfd = 0;
Expand Down Expand Up @@ -925,6 +919,7 @@ char* get_iface_ipaddr(const char* iface_name)
return (inet_ntoa(((struct sockaddr_in *)&ifr.ifr_addr)->sin_addr));
}

#ifdef WAN_FAILOVER_SUPPORTED
bool isServiceNeeded()
{
if (Get_Device_Mode()==EXTENDER_MODE)
Expand Down Expand Up @@ -5881,6 +5876,64 @@ static int do_multinet_lan2self_by_wanip (FILE *filter_fp)
}
#endif

static int do_lan2self_isolatedBridges(FILE *filter_fp)
{
FIREWALL_DEBUG("Entering do_lan2self_isolatedBridges\n");
char *tok;
char net_query[MAX_QUERY];
char net_resp[MAX_QUERY];
char inst_resp[MAX_QUERY];
char iface_names[32][IFNAMSIZ];
char iface_ipaddrs[32][INET_ADDRSTRLEN];
char *interface_ipaddr;
int iface_count = 0;
int i, j;
int already_exists;

inst_resp[0] = 0;
sysevent_get(sysevent_fd, sysevent_token, "multinet-instances", inst_resp, sizeof(inst_resp));
FIREWALL_DEBUG("lan2self_isolatedBridges: multinet-instance\n");

tok = strtok(inst_resp, " ");
if (tok) do {
snprintf(net_query, sizeof(net_query), "multinet_%s-name", tok);
net_resp[0] = 0;
sysevent_get(sysevent_fd, sysevent_token, net_query, net_resp, sizeof(net_resp));
interface_ipaddr = get_iface_ipaddr(net_resp);
if (interface_ipaddr == NULL) {
FIREWALL_DEBUG("lan2self_isolatedBridges: no IPv4 address found for interface\n");
continue;
}

already_exists = 0;
for (i = 0; i < iface_count; i++) {
if (strcmp(iface_names[i], net_resp) == 0) {
already_exists = 1;
break;
}
}
if (!already_exists && iface_count < (int)(sizeof(iface_names) / sizeof(iface_names[0]))) {
snprintf(iface_names[iface_count], sizeof(iface_names[iface_count]), "%.*s", IFNAMSIZ - 1, net_resp);
snprintf(iface_ipaddrs[iface_count], sizeof(iface_ipaddrs[iface_count]), "%.*s", INET_ADDRSTRLEN - 1, interface_ipaddr);
iface_count++;
}
} while ((tok = strtok(NULL, " ")) != NULL);

for (i = 0; i < iface_count; i++) {
for (j = i + 1; j < iface_count; j++) {
if (strcmp(iface_ipaddrs[i], iface_ipaddrs[j]) == 0) {
continue;
}

fprintf(filter_fp, "-A lan2self_isolatedBridges -s %s/24 -d %s/32 -j xlog_drop_lan2self\n", iface_ipaddrs[i], iface_ipaddrs[j]);
fprintf(filter_fp, "-A lan2self_isolatedBridges -s %s/24 -d %s/32 -j xlog_drop_lan2self\n", iface_ipaddrs[j], iface_ipaddrs[i]);
Comment thread
snayak002c marked this conversation as resolved.
Comment thread
snayak002c marked this conversation as resolved.
}
}

FIREWALL_DEBUG("Exiting do_lan2self_isolatedBridges\n");
return 0;
}

static int do_lan2self_by_wanip(FILE *filter_fp, int family)
{
//As requested, we don't allow SNMP/HTTP/HTTPs/Ping
Expand Down Expand Up @@ -5921,15 +5974,6 @@ static int do_lan2self_by_wanip(FILE *filter_fp, int family)
fprintf(filter_fp, "-A lan2self_by_wanip -s %s/24 -d 192.168.101.1/32 -j xlog_drop_lan2self\n", lan_ipaddr);
fprintf(filter_fp, "-A lan2self_by_wanip -s %s/24 -d 169.254.101.1/32 -j xlog_drop_lan2self\n", lan_ipaddr);
//<<
#if defined(_WNXL11BWL_PRODUCT_REQ_)
fprintf(filter_fp, "-A lan2self_by_wanip -s %s/24 -d 169.254.70.254/32 -j xlog_drop_lan2self\n", lan_ipaddr);
fprintf(filter_fp, "-A lan2self_by_wanip -s %s/24 -d 169.254.71.254/32 -j xlog_drop_lan2self\n", lan_ipaddr);
#else
fprintf(filter_fp, "-A lan2self_by_wanip -s %s/24 -d 169.254.0.254/32 -j xlog_drop_lan2self\n", lan_ipaddr);
fprintf(filter_fp, "-A lan2self_by_wanip -s %s/24 -d 169.254.1.254/32 -j xlog_drop_lan2self\n", lan_ipaddr);
#endif
fprintf(filter_fp, "-A lan2self_by_wanip -s %s/24 -d 172.16.12.1/32 -j xlog_drop_lan2self\n", lan_ipaddr);
fprintf(filter_fp, "-A lan2self_by_wanip -s %s/24 -d 192.168.106.1/32 -j xlog_drop_lan2self\n", lan_ipaddr);
fprintf(filter_fp, "-A lan2self_by_wanip -s %s/24 -d 192.168.251.1/32 -j xlog_drop_lan2self\n", lan_ipaddr);

if (rc == 0 && httpport[0] != '\0' && atoi(httpport) != 80 && (atoi(httpport) >= 0 && atoi(httpport) <= 65535 ))
Expand Down Expand Up @@ -6038,6 +6082,7 @@ static int do_lan2self_mgmt(FILE *fp)
static int do_lan2self(FILE *fp)
{
// FIREWALL_DEBUG("Entering do_lan2self\n");
do_lan2self_isolatedBridges(fp);
#if (defined(FEATURE_MAPT) && defined(NAT46_KERNEL_SUPPORT)) || defined(FEATURE_SUPPORT_MAPT_NAT46)
if((!isMAPTReady) & isWanReady) // Pass for Dual Stack Line
#else
Expand Down Expand Up @@ -11256,6 +11301,10 @@ static int prepare_multinet_filter_forward (FILE *filter_fp)
char inst_resp[MAX_QUERY];
char primary_inst[MAX_QUERY];
char ip[MAX_QUERY];
char bridge_names[32][IFNAMSIZ];
int bridge_count = 0;
int i, j;
int already_exists;

FIREWALL_DEBUG("Entering prepare_multinet_filter_forward\n");

Expand Down Expand Up @@ -11464,20 +11513,32 @@ static int prepare_multinet_filter_forward (FILE *filter_fp)
tok = strtok(inst_resp, " ");

if (tok) do {
snprintf(net_query, sizeof(net_query), "multinet_%s-localready", tok);
net_resp[0] = 0;
sysevent_get(sysevent_fd, sysevent_token, net_query, net_resp, sizeof(net_resp));
if (strcmp("1", net_resp) != 0)
continue;

snprintf(net_query, sizeof(net_query), "multinet_%s-name", tok);
net_resp[0] = 0;
sysevent_get(sysevent_fd, sysevent_token, net_query, net_resp, sizeof(net_resp));

fprintf(filter_fp, "-A FORWARD -i %s -o %s -j ACCEPT\n", net_resp, net_resp);

already_exists = 0;
for (i = 0; i < bridge_count; i++) {
if (strcmp(bridge_names[i], net_resp) == 0) {
already_exists = 1;
break;
}
}
if (!already_exists && bridge_count < (int)(sizeof(bridge_names) / sizeof(bridge_names[0]))) {
snprintf(bridge_names[bridge_count], sizeof(bridge_names[bridge_count]), "%.*s", IFNAMSIZ - 1, net_resp);
bridge_count++;
}

} while ((tok = strtok(NULL, " ")) != NULL);

for (i = 0; i < bridge_count; i++) {
for (j = i + 1; j < bridge_count; j++) {
fprintf(filter_fp, "-A FORWARD -i %s -o %s -j DROP\n", bridge_names[i], bridge_names[j]);
fprintf(filter_fp, "-A FORWARD -i %s -o %s -j DROP\n", bridge_names[j], bridge_names[i]);
}
fprintf(filter_fp, "-A FORWARD -i %s -o %s -j ACCEPT\n", bridge_names[i], bridge_names[i]);
}

FIREWALL_DEBUG("Exiting prepare_multinet_filter_forward\n");

return 0;
Expand Down Expand Up @@ -12513,6 +12574,7 @@ static int prepare_subtables(FILE *raw_fp, FILE *mangle_fp, FILE *nat_fp, FILE *
#endif
fprintf(filter_fp, ":%s - [0:0]\n", "lan2self");
fprintf(filter_fp, ":%s - [0:0]\n", "lan2self_by_wanip");
fprintf(filter_fp, ":%s - [0:0]\n", "lan2self_isolatedBridges");
fprintf(filter_fp, ":%s - [0:0]\n", "lan2self_mgmt");
fprintf(filter_fp, ":%s - [0:0]\n", "host_detect");
fprintf(filter_fp, ":%s - [0:0]\n", "lanattack");
Expand Down Expand Up @@ -13156,6 +13218,7 @@ static int prepare_subtables(FILE *raw_fp, FILE *mangle_fp, FILE *nat_fp, FILE *
/* RDKB-57186 SNMP drop to XHS and LnF */
fprintf(filter_fp, "-A general_input -i %s -p udp -m udp --dport 161 -j xlog_drop_lan2self\n", XHS_IF_NAME);
fprintf(filter_fp, "-A general_input -i %s -p udp -m udp --dport 161 -j xlog_drop_lan2self\n", LNF_IF_NAME);
fprintf(filter_fp, "-A lan2self -j lan2self_isolatedBridges\n");
#if defined (MULTILAN_FEATURE)
fprintf(filter_fp, "-A lan2self -j lan2self_by_wanip\n");
#else
Expand Down Expand Up @@ -14260,6 +14323,7 @@ static int prepare_disabled_ipv4_firewall(FILE *raw_fp, FILE *mangle_fp, FILE *n
{
fprintf(filter_fp, ":%s - [0:0]\n", "lan2self");
fprintf(filter_fp, ":%s - [0:0]\n", "lan2self_by_wanip");
fprintf(filter_fp, ":%s - [0:0]\n", "lan2self_isolatedBridges");
fprintf(filter_fp, ":%s - [0:0]\n", "lanattack");
fprintf(filter_fp, ":%s - [0:0]\n", "xlog_drop_lanattack");
do_lan2self(filter_fp);
Expand Down
102 changes: 82 additions & 20 deletions source/firewall_nft/firewall_nft.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -355,16 +355,12 @@ Defines used to control conditional compilation
#include "util.h"


#if defined (WAN_FAILOVER_SUPPORTED) || defined(RDKB_EXTENDER_ENABLED)

#include <sys/types.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <netinet/in.h>
#include <net/if.h>

#endif

#ifdef FEATURE_464XLAT
#define XLAT_IF "xlat"
#define XLAT_IP "192.0.0.1"
Expand Down Expand Up @@ -919,8 +915,6 @@ unsigned int Get_Device_Mode()
}
#endif

#ifdef WAN_FAILOVER_SUPPORTED

int create_socket()
{
int sockfd = 0;
Expand Down Expand Up @@ -957,6 +951,7 @@ char* get_iface_ipaddr(const char* iface_name)
return (inet_ntoa(((struct sockaddr_in *)&ifr.ifr_addr)->sin_addr));
}

#ifdef WAN_FAILOVER_SUPPORTED
bool isServiceNeeded()
{
FIREWALL_DEBUG("Inside isServiceNeeded\n");
Expand Down Expand Up @@ -5675,6 +5670,58 @@ static int do_multinet_lan2self_by_wanip (FILE *filter_fp)
}
#endif

static int do_lan2self_isolatedBridges(FILE *filter_fp)
{
char *tok;
char net_query[MAX_QUERY];
char net_resp[MAX_QUERY];
char inst_resp[MAX_QUERY];
char iface_names[32][IFNAMSIZ];
char iface_ipaddrs[32][INET_ADDRSTRLEN];
char *interface_ipaddr;
int iface_count = 0;
int i, j;
int already_exists;

inst_resp[0] = 0;
sysevent_get(sysevent_fd, sysevent_token, "multinet-instances", inst_resp, sizeof(inst_resp));

tok = strtok(inst_resp, " ");
if (tok) do {
snprintf(net_query, sizeof(net_query), "multinet_%s-name", tok);
net_resp[0] = 0;
sysevent_get(sysevent_fd, sysevent_token, net_query, net_resp, sizeof(net_resp));
interface_ipaddr = get_iface_ipaddr(net_resp);
if (interface_ipaddr == NULL)
continue;

already_exists = 0;
for (i = 0; i < iface_count; i++) {
if (strcmp(iface_names[i], net_resp) == 0) {
already_exists = 1;
break;
}
}
if (!already_exists && iface_count < (int)(sizeof(iface_names) / sizeof(iface_names[0]))) {
snprintf(iface_names[iface_count], sizeof(iface_names[iface_count]), "%.*s", IFNAMSIZ - 1, net_resp);
snprintf(iface_ipaddrs[iface_count], sizeof(iface_ipaddrs[iface_count]), "%.*s", INET_ADDRSTRLEN - 1, interface_ipaddr);
iface_count++;
}
} while ((tok = strtok(NULL, " ")) != NULL);

for (i = 0; i < iface_count; i++) {
for (j = i + 1; j < iface_count; j++) {
if (strcmp(iface_ipaddrs[i], iface_ipaddrs[j]) == 0)
continue;

fprintf(filter_fp, "add rule ip filter lan2self_isolatedBridges ip saddr %s/24 ip daddr %s/32 counter jump xlog_drop_lan2self\n", iface_ipaddrs[i], iface_ipaddrs[j]);
fprintf(filter_fp, "add rule ip filter lan2self_isolatedBridges ip saddr %s/24 ip daddr %s/32 counter jump xlog_drop_lan2self\n", iface_ipaddrs[j], iface_ipaddrs[i]);
Comment thread
snayak002c marked this conversation as resolved.
Comment thread
snayak002c marked this conversation as resolved.
}
}

return 0;
}

static int do_lan2self_by_wanip(FILE *filter_fp, int family)
{
//As requested, we don't allow SNMP/HTTP/HTTPs/Ping
Expand Down Expand Up @@ -5717,12 +5764,7 @@ static int do_lan2self_by_wanip(FILE *filter_fp, int family)
#if defined(_WNXL11BWL_PRODUCT_REQ_)
fprintf(filter_fp, "add rule ip filter lan2self_by_wanip ip saddr %s/24 ip daddr 169.254.70.254/32 counter xlog_drop_lan2self\n", lan_ipaddr);
fprintf(filter_fp, "add rule ip filter lan2self_by_wanip ip saddr %s/24 ip daddr 169.254.71.254/32 counter jump xlog_drop_lan2self\n", lan_ipaddr);
#else
fprintf(filter_fp, "add rule ip filter lan2self_by_wanip ip saddr %s/24 ip daddr 169.254.0.254/32 counter jump xlog_drop_lan2self\n", lan_ipaddr);
fprintf(filter_fp, "add rule ip filter lan2self_by_wanip ip saddr %s/24 ip daddr 169.254.1.254 /32 counter jump xlog_drop_lan2self\n", lan_ipaddr);
#endif
fprintf(filter_fp, "add rule ip filter lan2self_by_wanip ip saddr %s/24 ip daddr 172.16.12.1/32 counter jump xlog_drop_lan2self\n", lan_ipaddr);
fprintf(filter_fp, "add rule ip filter lan2self_by_wanip ip saddr %s/24 ip daddr 192.168.106.1/32 counter jump xlog_drop_lan2self\n", lan_ipaddr);
fprintf(filter_fp, "add rule ip filter lan2self_by_wanip ip saddr %s/24 ip daddr 192.168.251.1/32 counter jump xlog_drop_lan2self\n", lan_ipaddr);

if (rc == 0 && httpport[0] != '\0' && atoi(httpport) != 80 && (atoi(httpport) >= 0 && atoi(httpport) <= 65535 ))
Expand Down Expand Up @@ -5831,6 +5873,7 @@ static int do_lan2self_mgmt(FILE *fp)
static int do_lan2self(FILE *fp)
{
// FIREWALL_DEBUG("Entering do_lan2self\n");
do_lan2self_isolatedBridges(fp);
#if (defined(FEATURE_MAPT) && defined(NAT46_KERNEL_SUPPORT)) || defined(FEATURE_SUPPORT_MAPT_NAT46)
if((!isMAPTReady) & isWanReady) // Pass for Dual Stack Line
#else
Expand Down Expand Up @@ -10181,6 +10224,10 @@ static int prepare_multinet_filter_forward (FILE *filter_fp)
char inst_resp[MAX_QUERY];
char primary_inst[MAX_QUERY];
char ip[MAX_QUERY];
char bridge_names[32][IFNAMSIZ];
int bridge_count = 0;
int i, j;
int already_exists;

FIREWALL_DEBUG("Entering prepare_multinet_filter_forward\n");

Expand Down Expand Up @@ -10392,20 +10439,32 @@ static int prepare_multinet_filter_forward (FILE *filter_fp)
tok = strtok(inst_resp, " ");

if (tok) do {
snprintf(net_query, sizeof(net_query), "multinet_%s-localready", tok);
net_resp[0] = 0;
sysevent_get(sysevent_fd, sysevent_token, net_query, net_resp, sizeof(net_resp));
if (strcmp("1", net_resp) != 0)
continue;

snprintf(net_query, sizeof(net_query), "multinet_%s-name", tok);
net_resp[0] = 0;
sysevent_get(sysevent_fd, sysevent_token, net_query, net_resp, sizeof(net_resp));

fprintf(filter_fp, "add rule ip filter FORWARD iifname \"%s\" oifname \"%s\" counter accept\n", net_resp, net_resp);

already_exists = 0;
for (i = 0; i < bridge_count; i++) {
if (strcmp(bridge_names[i], net_resp) == 0) {
already_exists = 1;
break;
}
}
if (!already_exists && bridge_count < (int)(sizeof(bridge_names) / sizeof(bridge_names[0]))) {
snprintf(bridge_names[bridge_count], sizeof(bridge_names[bridge_count]), "%.*s", IFNAMSIZ - 1, net_resp);
bridge_count++;
}

} while ((tok = strtok(NULL, " ")) != NULL);

for (i = 0; i < bridge_count; i++) {
for (j = i + 1; j < bridge_count; j++) {
fprintf(filter_fp, "add rule ip filter FORWARD iifname \"%s\" oifname \"%s\" counter drop\n", bridge_names[i], bridge_names[j]);
fprintf(filter_fp, "add rule ip filter FORWARD iifname \"%s\" oifname \"%s\" counter drop\n", bridge_names[j], bridge_names[i]);
}
fprintf(filter_fp, "add rule ip filter FORWARD iifname \"%s\" oifname \"%s\" counter accept\n", bridge_names[i], bridge_names[i]);
}

FIREWALL_DEBUG("Exiting prepare_multinet_filter_forward\n");

return 0;
Expand Down Expand Up @@ -11375,6 +11434,7 @@ static int prepare_subtables(FILE *raw_fp, FILE *mangle_fp, FILE *nat_fp, FILE *
#endif
fprintf(filter_fp, "add chain ip filter %s\n", "lan2self");
fprintf(filter_fp, "add chain ip filter %s\n", "lan2self_by_wanip");
fprintf(filter_fp, "add chain ip filter %s\n", "lan2self_isolatedBridges");
fprintf(filter_fp, "add chain ip filter %s\n", "lan2self_mgmt");
fprintf(filter_fp, "add chain ip filter %s\n", "host_detect");
fprintf(filter_fp, "add chain ip filter %s\n", "lanattack");
Expand Down Expand Up @@ -11957,7 +12017,8 @@ fprintf(filter_fp, "add rule ip filter FORWARD iifname \"%s\" oifname \"brlan112
/* RDKB-57186 SNMP drop to XHS and LnF */
fprintf(filter_fp, "add rule ip filter general_input iifname \"%s\" udp dport 161 jump xlog_drop_lan2self\n", XHS_IF_NAME);
fprintf(filter_fp, "add rule ip filter general_input iifname \"%s\" udp dport 161 jump xlog_drop_lan2self\n", LNF_IF_NAME);
#if defined (MULTILAN_FEATURE)
fprintf(filter_fp, "add rule ip filter lan2self counter jump lan2self_isolatedBridges\n");
#if defined (MULTILAN_FEATURE)
fprintf(filter_fp, " add rule ip filter lan2self counter jump lan2self_by_wanip\n");
#else
fprintf(filter_fp, "add rule ip filter lan2self ip daddr != %s counter jump lan2self_by_wanip\n", lan_ipaddr);
Expand Down Expand Up @@ -12903,6 +12964,7 @@ static int prepare_disabled_ipv4_firewall(FILE *raw_fp, FILE *mangle_fp, FILE *n
{
fprintf(filter_fp, "add chain ip filter %s\n", "lan2self");
fprintf(filter_fp, "add chain ip filter %s\n", "lan2self_by_wanip");
fprintf(filter_fp, "add chain ip filter %s\n", "lan2self_isolatedBridges");
fprintf(filter_fp, "add chain ip filter %s\n", "lanattack");
fprintf(filter_fp, "add chain ip filter %s\n", "xlog_drop_lanattack");
do_lan2self(filter_fp);
Expand Down
Loading