From 51707e8a7b1c656e83d950e3809f3f5ac7a12711 Mon Sep 17 00:00:00 2001 From: satish-kotapati Date: Thu, 25 Jun 2026 21:01:45 +0530 Subject: [PATCH 1/3] RDKCOM-5422: RDKBDEV-3258 Remove UTOPIA mcast services from the build (#80) Reason for change: Utopia should have an option to not build mcast sources if it is not required on the platform Test Procedure: binary presence based on the flag enablement Risks: None Signed-off-by: sai satish kotapati Co-authored-by: Santosh Nayak <70348540+snayak002c@users.noreply.github.com> --- configure.ac | 12 ++++++++++++ source/scripts/init/c_registration/Makefile.am | 14 +++++++++----- source/scripts/init/service.d/service_misc.sh | 4 ++-- 3 files changed, 23 insertions(+), 7 deletions(-) diff --git a/configure.ac b/configure.ac index 045bd2ae..ba916c5b 100644 --- a/configure.ac +++ b/configure.ac @@ -241,6 +241,18 @@ AC_ARG_ENABLE([hotspot], [enable_hotspot=true]) AM_CONDITIONAL([ENABLE_HOTSPOT_SERVICE], [test x$enable_hotspot = xtrue]) +AC_ARG_ENABLE([igmpmld], + AS_HELP_STRING([--enable-igmpmld],[Enable igmpmld]), + [ + case "${enableval}" in + yes) enable_igmpmld=true ;; + no) enable_igmpmld=false ;; + *) AC_MSG_ERROR([bad value ${enableval} for --enable-igmpmld]) ;; + esac + ], + [enable_igmpmld=true]) +AM_CONDITIONAL([ENABLE_MCAST_SERVICE], [test x$enable_igmpmld = xtrue]) + AC_CONFIG_FILES( Makefile source/Makefile diff --git a/source/scripts/init/c_registration/Makefile.am b/source/scripts/init/c_registration/Makefile.am index a39bee3a..d432e4b0 100644 --- a/source/scripts/init/c_registration/Makefile.am +++ b/source/scripts/init/c_registration/Makefile.am @@ -49,8 +49,6 @@ bin_PROGRAMS = \ 03_connectcheck \ 09_xdns \ 10_firewall \ - 10_mcastproxy \ - 10_mldproxy \ 10_ntpd \ 15_ccsphs \ 15_ddnsclient \ @@ -69,6 +67,10 @@ if FEATURE_RDKB_EXTENDER bin_PROGRAMS += 02_devicemode endif +if ENABLE_MCAST_SERVICE +bin_PROGRAMS += 10_mcastproxy 10_mldproxy +endif + if ENABLE_POTD_SERVICE bin_PROGRAMS += 26_potd endif @@ -98,9 +100,6 @@ endif 10_bootstrap_dns_SOURCES = 10_bootstrap_dns.c 10_firewall_SOURCES = 10_firewall.c 10_fpm_SOURCES = 10_fpm.c -10_mcastproxy_SOURCES = 10_mcastproxy.c -10_mcastsnooper_SOURCES = 10_mcastsnooper.c -10_mldproxy_SOURCES = 10_mldproxy.c 10_ntpclient_SOURCES = 10_ntpclient.c 10_ntpd_SOURCES = 10_ntpd.c 10_sysevent_proxy_SOURCES = 10_sysevent_proxy.c @@ -130,6 +129,11 @@ endif if FEATURE_RDKB_EXTENDER 02_devicemode_SOURCES = 02_devicemode.c endif +if ENABLE_MCAST_SERVICE +10_mcastproxy_SOURCES = 10_mcastproxy.c +10_mcastsnooper_SOURCES = 10_mcastsnooper.c +10_mldproxy_SOURCES = 10_mldproxy.c +endif if ENABLE_POTD_SERVICE 26_potd_SOURCES = 26_potd.c endif diff --git a/source/scripts/init/service.d/service_misc.sh b/source/scripts/init/service.d/service_misc.sh index 70383c71..bea1fd0d 100755 --- a/source/scripts/init/service.d/service_misc.sh +++ b/source/scripts/init/service.d/service_misc.sh @@ -75,11 +75,11 @@ if [ "$RG_MD" = "1" -o "$RG_MD" = "3" ]; then /etc/utopia/service.d/service_igd.sh lan-status& fi -if [ "$RG_MD" = "1" -o "$RG_MD" = "3" ]; then +if [[ "$RG_MD" = "1" -o "$RG_MD" = "3" ]] && [ -f /etc/utopia/service.d/service_mcastproxy.sh ]; then /etc/utopia/service.d/service_mcastproxy.sh lan-status& fi -if [ "$RG_MD" = "2" -o "$RG_MD" = "3" ]; then +if [[ "$RG_MD" = "2" -o "$RG_MD" = "3" ]] && [ -f /etc/utopia/service.d/service_mldproxy.sh ]; then /etc/utopia/service.d/service_mldproxy.sh lan-status& fi From c68b14507595815b93769a45cfcf8c302f96df5e Mon Sep 17 00:00:00 2001 From: Sivaraj Sivalingam Date: Mon, 29 Jun 2026 14:08:56 -0400 Subject: [PATCH 2/3] RDKB-64200, RDKB-64413: MAPT KP fix - hashlimit approach / split MAP-T postrouting chains by protocol (#327) Reason for change: Reduced the rate of new connections by adjusting existing SNAT rules to mitigate an internal kernel race condition. Additionally, MAP-T NAT postrouting rules were separated into distinct TCP, UDP, and ICMP chains, enabling protocol-specific SNAT and hashlimit application. This enhances NAT46/MAP-T processing and ensures accurate, per-protocol rate limiting. Test Procedure: 1. Verify creation of postrouting_towan_tcp, postrouting_towan_udp, and postrouting_towan_icmp chains in iptables. 2. Confirm SNAT rules are applied correctly for TCP, UDP, and ICMP with expected port ranges and hashlimit behavior. 3. Validate connectivity for IPv4 clients behind MAPT/NAT46 setup. Risks: Low Priority: P1 Gerrit change-Id's: If42a964aa73e89e95928c0193e032c26f265dc4d, I621e8fdf51c00ff24315a52452d4ea8f50b62075 --------- Signed-off-by: Santosh Nayak SantoshRamesh_Nayak@cable.comcast.com Co-authored-by: Harnish Patel Co-authored-by: Santosh Co-authored-by: Santosh Nayak <70348540+snayak002c@users.noreply.github.com> Co-authored-by: Harnish Patel <163233851+hpatel006c@users.noreply.github.com> --- source/firewall/firewall.c | 79 ++++++++++++++++++++++++++++++++++++-- 1 file changed, 75 insertions(+), 4 deletions(-) diff --git a/source/firewall/firewall.c b/source/firewall/firewall.c index 50538050..cd7c6175 100644 --- a/source/firewall/firewall.c +++ b/source/firewall/firewall.c @@ -473,6 +473,10 @@ char cellular_ifname[32]; #define SYSEVENT_MAPT_CONFIG_FLAG "mapt_config_flag" #define SYSEVENT_MAPT_IP_ADDRESS "mapt_ip_address" #define MAPT_NAT_IPV4_POST_ROUTING_TABLE "postrouting_towan" +#define MAPT_NAT_IPV4_POST_ROUTING_TABLE_TCP "postrouting_towan_tcp" +#define MAPT_NAT_IPV4_POST_ROUTING_TABLE_UDP "postrouting_towan_udp" +#define MAPT_NAT_IPV4_POST_ROUTING_TABLE_ICMP "postrouting_towan_icmp" + #define SYSEVENT_MAPT_RATIO "mapt_ratio" #define SYSEVENT_MAPT_IPV6_ADDRESS "mapt_ipv6_address" #define SYSEVENT_MAPT_PSID_OFFSET "mapt_psid_offset" @@ -1187,7 +1191,11 @@ int do_mapt_rules_v4(FILE *nat_fp, FILE *filter_fp, FILE *mangle_fp) #if defined(IVI_KERNEL_SUPPORT) fprintf(nat_fp, "-A POSTROUTING -o %s -j %s\n",get_current_wan_ifname(),MAPT_NAT_IPV4_POST_ROUTING_TABLE); #elif defined(NAT46_KERNEL_SUPPORT) || defined (FEATURE_SUPPORT_MAPT_NAT46) - fprintf(nat_fp, "-A POSTROUTING -o %s -j %s\n", NAT46_INTERFACE, MAPT_NAT_IPV4_POST_ROUTING_TABLE); + fprintf(nat_fp, "-A POSTROUTING -p tcp -m conntrack --ctstate NEW -o %s -j %s\n", NAT46_INTERFACE, MAPT_NAT_IPV4_POST_ROUTING_TABLE_TCP); + fprintf(nat_fp, "-A POSTROUTING -p udp -m conntrack --ctstate NEW -o %s -j %s\n", NAT46_INTERFACE, MAPT_NAT_IPV4_POST_ROUTING_TABLE_UDP); + + fprintf(nat_fp, "-A POSTROUTING -p icmp -o %s -j %s\n", NAT46_INTERFACE, MAPT_NAT_IPV4_POST_ROUTING_TABLE_ICMP); + #endif #if defined(NAT46_KERNEL_SUPPORT) @@ -1292,6 +1300,42 @@ int do_mapt_rules_v4(FILE *nat_fp, FILE *filter_fp, FILE *mangle_fp) /* Start of port range parameters. */ /* create rules */ +#if defined (_XB6_PRODUCT_REQ_) + if (offset != 0) + { + for(i = start_i; i < a; i++) + { + for(j = 0; j < contiguous_port; j++) + { + port = (i << block_shift) + (psid << m) + j; + + if (j == 0) + initialPortValue = port; + if (j == contiguous_port - 1 ) + finalPortValue = port; + } + + if (i == a-1) + { + fprintf(nat_fp, "-A %s -p tcp -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_TCP, ipaddress_str, initialPortValue,finalPortValue); + fprintf(nat_fp, "-A %s -p udp -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_UDP, ipaddress_str, initialPortValue,finalPortValue); + } + else if (i > a-4) + { + fprintf(nat_fp, "-A %s -p tcp -m hashlimit --hashlimit-name mapt_tcp_%d --hashlimit-mode srcip,dstip,dstport --hashlimit-upto 45/second --hashlimit-burst 60 -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_TCP, i%5, ipaddress_str, initialPortValue,finalPortValue); + fprintf(nat_fp, "-A %s -p udp -m hashlimit --hashlimit-name mapt_udp_%d --hashlimit-mode srcip,dstip,dstport --hashlimit-upto 100/second --hashlimit-burst 100 -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_UDP, i%5, ipaddress_str, initialPortValue,finalPortValue); + } + else + { + fprintf(nat_fp, "-A %s -p tcp -m hashlimit --hashlimit-name mapt_tcp_%d --hashlimit-mode srcip,dstip,dstport --hashlimit-upto 30/second --hashlimit-burst 60 -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_TCP, i%5, ipaddress_str, initialPortValue,finalPortValue); + fprintf(nat_fp, "-A %s -p udp -m hashlimit --hashlimit-name mapt_udp_%d --hashlimit-mode srcip,dstip,dstport --hashlimit-upto 60/second --hashlimit-burst 100 -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_UDP, i%5, ipaddress_str, initialPortValue,finalPortValue); + } + + fprintf(nat_fp, "-A %s -p icmp -m connlimit --connlimit-upto %d --connlimit-daddr -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_ICMP, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue); + FIREWALL_DEBUG("MAPT Rule: Port range is initialPortValue=%d, finalPortValue=%d \n" COMMA initialPortValue COMMA finalPortValue); + } + } +#endif for(i = start_i; i < a; i++) { for(j=0; j<(contiguous_port); j++) @@ -1314,9 +1358,32 @@ int do_mapt_rules_v4(FILE *nat_fp, FILE *filter_fp, FILE *mangle_fp) fprintf(nat_fp, "-A %s -p udp -m connlimit --connlimit-upto %d --connlimit-daddr -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue); fprintf(nat_fp, "-A %s -p icmp -m connlimit --connlimit-upto %d --connlimit-daddr -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue); #else - fprintf(nat_fp, "-A %s -p tcp -m connlimit --connlimit-upto %d --connlimit-daddr-dport -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue); - fprintf(nat_fp, "-A %s -p udp -m connlimit --connlimit-upto %d --connlimit-daddr-dport -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue); - fprintf(nat_fp, "-A %s -p icmp -m connlimit --connlimit-upto %d --connlimit-daddr-dport -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue); + if (offset == 0) + { + fprintf(nat_fp, "-A %s -p tcp -m connlimit --connlimit-upto %d --connlimit-daddr-dport -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_TCP, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue); + fprintf(nat_fp, "-A %s -p udp -m connlimit --connlimit-upto %d --connlimit-daddr-dport -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_UDP, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue); + fprintf(nat_fp, "-A %s -p icmp -m connlimit --connlimit-upto %d --connlimit-daddr-dport -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_ICMP, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue); + } + else + { + if (i == a-1) + { + fprintf(nat_fp, "-A %s -p tcp -m connlimit --connlimit-upto %d --connlimit-daddr-dport -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_TCP, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue); + fprintf(nat_fp, "-A %s -p udp -m connlimit --connlimit-upto %d --connlimit-daddr-dport -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_UDP, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue); + } + else if(i > a-4) + { + fprintf(nat_fp, "-A %s -p tcp -m hashlimit --hashlimit-name mapt_tcp_%d --hashlimit-mode srcip,dstip,dstport --hashlimit-upto 45/second --hashlimit-burst 60 -m connlimit --connlimit-upto %d --connlimit-daddr-dport -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_TCP, i%5, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue); + fprintf(nat_fp, "-A %s -p udp -m hashlimit --hashlimit-name mapt_udp_%d --hashlimit-mode srcip,dstip,dstport --hashlimit-upto 100/second --hashlimit-burst 100 -m connlimit --connlimit-upto %d --connlimit-daddr-dport -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_UDP, i%5, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue); + } + else + { + fprintf(nat_fp, "-A %s -p tcp -m hashlimit --hashlimit-name mapt_tcp_%d --hashlimit-mode srcip,dstip,dstport --hashlimit-upto 30/second --hashlimit-burst 60 -m connlimit --connlimit-upto %d --connlimit-daddr-dport -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_TCP, i%5, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue); + fprintf(nat_fp, "-A %s -p udp -m hashlimit --hashlimit-name mapt_udp_%d --hashlimit-mode srcip,dstip,dstport --hashlimit-upto 60/second --hashlimit-burst 100 -m connlimit --connlimit-upto %d --connlimit-daddr-dport -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_UDP, i%5, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue); + } + + fprintf(nat_fp, "-A %s -p icmp -m connlimit --connlimit-upto %d --connlimit-daddr-dport -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_ICMP, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue); + } #endif //_HUB4_PRODUCT_REQ_NO_DPORT_ #endif //IVI_KERNEL_SUPPORT FIREWALL_DEBUG("MAPT Rule: Port range is initialPortValue=%u, finalPortValue=%u \n" COMMA initialPortValue COMMA finalPortValue); @@ -12133,6 +12200,10 @@ static int prepare_subtables(FILE *raw_fp, FILE *mangle_fp, FILE *nat_fp, FILE * #endif fprintf(nat_fp, ":%s - [0:0]\n", "postrouting_towan"); + fprintf(nat_fp, ":%s - [0:0]\n", "postrouting_towan_tcp"); + fprintf(nat_fp, ":%s - [0:0]\n", "postrouting_towan_udp"); + fprintf(nat_fp, ":%s - [0:0]\n", "postrouting_towan_icmp"); + fprintf(nat_fp, ":%s - [0:0]\n", "postrouting_tolan"); fprintf(nat_fp, ":%s - [0:0]\n", "postrouting_plugins"); fprintf(nat_fp, ":%s - [0:0]\n", "postrouting_ephemeral"); From 7de1e5f720d3885383b2415ac9289a8ffefdba87 Mon Sep 17 00:00:00 2001 From: Pavan Kumar Reddy B <57708013+pavankumar464@users.noreply.github.com> Date: Tue, 30 Jun 2026 22:39:01 +0530 Subject: [PATCH 3/3] RDKB-64133: Allow restoreConfig in business devices (#355) Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Santosh Nayak <70348540+snayak002c@users.noreply.github.com> --- source/firewall/firewall.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/source/firewall/firewall.c b/source/firewall/firewall.c index cd7c6175..7172eaa0 100644 --- a/source/firewall/firewall.c +++ b/source/firewall/firewall.c @@ -1567,6 +1567,14 @@ void do_webui_attack_filter(FILE *filter_fp) fprintf(filter_fp, "-A UPLOAD_ATTACK_FILTER -m string --algo bm --string \"%s\" -j DROP \n", ".pi"); fprintf(filter_fp, "-A UPLOAD_ATTACK_FILTER -m string --algo bm --string \"%s\" -j DROP \n", ".sh"); fprintf(filter_fp, "-A UPLOAD_ATTACK_FILTER -m string --algo bm --string \"%s\" -j DROP \n", ".py"); +#if defined(_CBR2_PRODUCT_REQ_) || defined(_ONESTACK_PRODUCT_REQ_) + #ifdef _ONESTACK_PRODUCT_REQ_ + if(isFeatureSupportedInCurrentMode(FEATURE_SAVE_RESTORE)) + #endif + { + fprintf(filter_fp, "-A UPLOAD_ATTACK_FILTER -p tcp -m string --algo bm --from 0 --to 64 --string \"%s\" -j RETURN \n", "POST /restoreConfig.jst HTTP"); + } +#endif fprintf(filter_fp, "-A UPLOAD_ATTACK_FILTER -m string --algo bm --string \"%s\" -j DROP \n", "multipart/form-data"); FIREWALL_DEBUG("Exiting do_webui_attack_filter\n"); }