Skip to content

Rebase #359

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
NareshM1702 wants to merge 3 commits into from
Closed

Rebase #359

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
51707e8
RDKCOM-5422: RDKBDEV-3258 Remove UTOPIA mcast services from the build…
satish-kotapati Jun 25, 2026
c68b145
RDKB-64200, RDKB-64413: MAPT KP fix - hashlimit approach / split MAP-…
sivaraj-comcast Jun 29, 2026
7de1e5f
RDKB-64133: Allow restoreConfig in business devices (#355)
pavankumar464 Jun 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions configure.ac
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -241,6 +241,18 @@ AC_ARG_ENABLE([hotspot],
[enable_hotspot=true])
AM_CONDITIONAL([ENABLE_HOTSPOT_SERVICE], [test x$enable_hotspot = xtrue])

AC_ARG_ENABLE([igmpmld],
AS_HELP_STRING([--enable-igmpmld],[Enable igmpmld]),
[
case "${enableval}" in
yes) enable_igmpmld=true ;;
no) enable_igmpmld=false ;;
*) AC_MSG_ERROR([bad value ${enableval} for --enable-igmpmld]) ;;
esac
],
[enable_igmpmld=true])
AM_CONDITIONAL([ENABLE_MCAST_SERVICE], [test x$enable_igmpmld = xtrue])

AC_CONFIG_FILES(
Makefile
source/Makefile
Expand Down
87 changes: 83 additions & 4 deletions source/firewall/firewall.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -473,6 +473,10 @@ char cellular_ifname[32];
#define SYSEVENT_MAPT_CONFIG_FLAG "mapt_config_flag"
#define SYSEVENT_MAPT_IP_ADDRESS "mapt_ip_address"
#define MAPT_NAT_IPV4_POST_ROUTING_TABLE "postrouting_towan"
#define MAPT_NAT_IPV4_POST_ROUTING_TABLE_TCP "postrouting_towan_tcp"
#define MAPT_NAT_IPV4_POST_ROUTING_TABLE_UDP "postrouting_towan_udp"
#define MAPT_NAT_IPV4_POST_ROUTING_TABLE_ICMP "postrouting_towan_icmp"

#define SYSEVENT_MAPT_RATIO "mapt_ratio"
#define SYSEVENT_MAPT_IPV6_ADDRESS "mapt_ipv6_address"
#define SYSEVENT_MAPT_PSID_OFFSET "mapt_psid_offset"
Expand Down Expand Up @@ -1187,7 +1191,11 @@ int do_mapt_rules_v4(FILE *nat_fp, FILE *filter_fp, FILE *mangle_fp)
#if defined(IVI_KERNEL_SUPPORT)
fprintf(nat_fp, "-A POSTROUTING -o %s -j %s\n",get_current_wan_ifname(),MAPT_NAT_IPV4_POST_ROUTING_TABLE);
#elif defined(NAT46_KERNEL_SUPPORT) || defined (FEATURE_SUPPORT_MAPT_NAT46)
fprintf(nat_fp, "-A POSTROUTING -o %s -j %s\n", NAT46_INTERFACE, MAPT_NAT_IPV4_POST_ROUTING_TABLE);
fprintf(nat_fp, "-A POSTROUTING -p tcp -m conntrack --ctstate NEW -o %s -j %s\n", NAT46_INTERFACE, MAPT_NAT_IPV4_POST_ROUTING_TABLE_TCP);
fprintf(nat_fp, "-A POSTROUTING -p udp -m conntrack --ctstate NEW -o %s -j %s\n", NAT46_INTERFACE, MAPT_NAT_IPV4_POST_ROUTING_TABLE_UDP);

fprintf(nat_fp, "-A POSTROUTING -p icmp -o %s -j %s\n", NAT46_INTERFACE, MAPT_NAT_IPV4_POST_ROUTING_TABLE_ICMP);

#endif

#if defined(NAT46_KERNEL_SUPPORT)
Expand Down Expand Up @@ -1292,6 +1300,42 @@ int do_mapt_rules_v4(FILE *nat_fp, FILE *filter_fp, FILE *mangle_fp)

/* Start of port range parameters. */
/* create rules */
#if defined (_XB6_PRODUCT_REQ_)
if (offset != 0)
{
for(i = start_i; i < a; i++)
{
for(j = 0; j < contiguous_port; j++)
{
port = (i << block_shift) + (psid << m) + j;

if (j == 0)
initialPortValue = port;
if (j == contiguous_port - 1 )
finalPortValue = port;
}

if (i == a-1)
{
fprintf(nat_fp, "-A %s -p tcp -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_TCP, ipaddress_str, initialPortValue,finalPortValue);
fprintf(nat_fp, "-A %s -p udp -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_UDP, ipaddress_str, initialPortValue,finalPortValue);
}
else if (i > a-4)
{
fprintf(nat_fp, "-A %s -p tcp -m hashlimit --hashlimit-name mapt_tcp_%d --hashlimit-mode srcip,dstip,dstport --hashlimit-upto 45/second --hashlimit-burst 60 -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_TCP, i%5, ipaddress_str, initialPortValue,finalPortValue);
fprintf(nat_fp, "-A %s -p udp -m hashlimit --hashlimit-name mapt_udp_%d --hashlimit-mode srcip,dstip,dstport --hashlimit-upto 100/second --hashlimit-burst 100 -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_UDP, i%5, ipaddress_str, initialPortValue,finalPortValue);
}
else
{
fprintf(nat_fp, "-A %s -p tcp -m hashlimit --hashlimit-name mapt_tcp_%d --hashlimit-mode srcip,dstip,dstport --hashlimit-upto 30/second --hashlimit-burst 60 -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_TCP, i%5, ipaddress_str, initialPortValue,finalPortValue);
fprintf(nat_fp, "-A %s -p udp -m hashlimit --hashlimit-name mapt_udp_%d --hashlimit-mode srcip,dstip,dstport --hashlimit-upto 60/second --hashlimit-burst 100 -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_UDP, i%5, ipaddress_str, initialPortValue,finalPortValue);
}

fprintf(nat_fp, "-A %s -p icmp -m connlimit --connlimit-upto %d --connlimit-daddr -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_ICMP, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue);
FIREWALL_DEBUG("MAPT Rule: Port range is initialPortValue=%d, finalPortValue=%d \n" COMMA initialPortValue COMMA finalPortValue);
}
}
#endif
for(i = start_i; i < a; i++)
{
for(j=0; j<(contiguous_port); j++)
Expand All @@ -1314,9 +1358,32 @@ int do_mapt_rules_v4(FILE *nat_fp, FILE *filter_fp, FILE *mangle_fp)
fprintf(nat_fp, "-A %s -p udp -m connlimit --connlimit-upto %d --connlimit-daddr -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue);
fprintf(nat_fp, "-A %s -p icmp -m connlimit --connlimit-upto %d --connlimit-daddr -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue);
#else
fprintf(nat_fp, "-A %s -p tcp -m connlimit --connlimit-upto %d --connlimit-daddr-dport -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue);
fprintf(nat_fp, "-A %s -p udp -m connlimit --connlimit-upto %d --connlimit-daddr-dport -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue);
fprintf(nat_fp, "-A %s -p icmp -m connlimit --connlimit-upto %d --connlimit-daddr-dport -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue);
if (offset == 0)
{
fprintf(nat_fp, "-A %s -p tcp -m connlimit --connlimit-upto %d --connlimit-daddr-dport -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_TCP, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue);
fprintf(nat_fp, "-A %s -p udp -m connlimit --connlimit-upto %d --connlimit-daddr-dport -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_UDP, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue);
fprintf(nat_fp, "-A %s -p icmp -m connlimit --connlimit-upto %d --connlimit-daddr-dport -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_ICMP, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue);
}
else
{
if (i == a-1)
{
fprintf(nat_fp, "-A %s -p tcp -m connlimit --connlimit-upto %d --connlimit-daddr-dport -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_TCP, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue);
fprintf(nat_fp, "-A %s -p udp -m connlimit --connlimit-upto %d --connlimit-daddr-dport -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_UDP, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue);
}
else if(i > a-4)
{
fprintf(nat_fp, "-A %s -p tcp -m hashlimit --hashlimit-name mapt_tcp_%d --hashlimit-mode srcip,dstip,dstport --hashlimit-upto 45/second --hashlimit-burst 60 -m connlimit --connlimit-upto %d --connlimit-daddr-dport -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_TCP, i%5, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue);
fprintf(nat_fp, "-A %s -p udp -m hashlimit --hashlimit-name mapt_udp_%d --hashlimit-mode srcip,dstip,dstport --hashlimit-upto 100/second --hashlimit-burst 100 -m connlimit --connlimit-upto %d --connlimit-daddr-dport -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_UDP, i%5, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue);
}
else
{
fprintf(nat_fp, "-A %s -p tcp -m hashlimit --hashlimit-name mapt_tcp_%d --hashlimit-mode srcip,dstip,dstport --hashlimit-upto 30/second --hashlimit-burst 60 -m connlimit --connlimit-upto %d --connlimit-daddr-dport -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_TCP, i%5, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue);
fprintf(nat_fp, "-A %s -p udp -m hashlimit --hashlimit-name mapt_udp_%d --hashlimit-mode srcip,dstip,dstport --hashlimit-upto 60/second --hashlimit-burst 100 -m connlimit --connlimit-upto %d --connlimit-daddr-dport -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_UDP, i%5, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue);
}

fprintf(nat_fp, "-A %s -p icmp -m connlimit --connlimit-upto %d --connlimit-daddr-dport -j SNAT --to-source %s:%d-%d\n", MAPT_NAT_IPV4_POST_ROUTING_TABLE_ICMP, finalPortValue - initialPortValue + 1, ipaddress_str, initialPortValue,finalPortValue);
}
#endif //_HUB4_PRODUCT_REQ_NO_DPORT_
#endif //IVI_KERNEL_SUPPORT
FIREWALL_DEBUG("MAPT Rule: Port range is initialPortValue=%u, finalPortValue=%u \n" COMMA initialPortValue COMMA finalPortValue);
Expand Down Expand Up @@ -1500,6 +1567,14 @@ void do_webui_attack_filter(FILE *filter_fp)
fprintf(filter_fp, "-A UPLOAD_ATTACK_FILTER -m string --algo bm --string \"%s\" -j DROP \n", ".pi");
fprintf(filter_fp, "-A UPLOAD_ATTACK_FILTER -m string --algo bm --string \"%s\" -j DROP \n", ".sh");
fprintf(filter_fp, "-A UPLOAD_ATTACK_FILTER -m string --algo bm --string \"%s\" -j DROP \n", ".py");
#if defined(_CBR2_PRODUCT_REQ_) || defined(_ONESTACK_PRODUCT_REQ_)
#ifdef _ONESTACK_PRODUCT_REQ_
if(isFeatureSupportedInCurrentMode(FEATURE_SAVE_RESTORE))
#endif
{
fprintf(filter_fp, "-A UPLOAD_ATTACK_FILTER -p tcp -m string --algo bm --from 0 --to 64 --string \"%s\" -j RETURN \n", "POST /restoreConfig.jst HTTP");
}
#endif
fprintf(filter_fp, "-A UPLOAD_ATTACK_FILTER -m string --algo bm --string \"%s\" -j DROP \n", "multipart/form-data");
FIREWALL_DEBUG("Exiting do_webui_attack_filter\n");
}
Expand Down Expand Up @@ -12133,6 +12208,10 @@ static int prepare_subtables(FILE *raw_fp, FILE *mangle_fp, FILE *nat_fp, FILE *
#endif

fprintf(nat_fp, ":%s - [0:0]\n", "postrouting_towan");
fprintf(nat_fp, ":%s - [0:0]\n", "postrouting_towan_tcp");
fprintf(nat_fp, ":%s - [0:0]\n", "postrouting_towan_udp");
fprintf(nat_fp, ":%s - [0:0]\n", "postrouting_towan_icmp");

fprintf(nat_fp, ":%s - [0:0]\n", "postrouting_tolan");
fprintf(nat_fp, ":%s - [0:0]\n", "postrouting_plugins");
fprintf(nat_fp, ":%s - [0:0]\n", "postrouting_ephemeral");
Expand Down
14 changes: 9 additions & 5 deletions source/scripts/init/c_registration/Makefile.am
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,8 +49,6 @@ bin_PROGRAMS = \
03_connectcheck \
09_xdns \
10_firewall \
10_mcastproxy \
10_mldproxy \
10_ntpd \
15_ccsphs \
15_ddnsclient \
Expand All @@ -69,6 +67,10 @@ if FEATURE_RDKB_EXTENDER
bin_PROGRAMS += 02_devicemode
endif

if ENABLE_MCAST_SERVICE
bin_PROGRAMS += 10_mcastproxy 10_mldproxy
endif

if ENABLE_POTD_SERVICE
bin_PROGRAMS += 26_potd
endif
Expand Down Expand Up @@ -98,9 +100,6 @@ endif
10_bootstrap_dns_SOURCES = 10_bootstrap_dns.c
10_firewall_SOURCES = 10_firewall.c
10_fpm_SOURCES = 10_fpm.c
10_mcastproxy_SOURCES = 10_mcastproxy.c
10_mcastsnooper_SOURCES = 10_mcastsnooper.c
10_mldproxy_SOURCES = 10_mldproxy.c
10_ntpclient_SOURCES = 10_ntpclient.c
10_ntpd_SOURCES = 10_ntpd.c
10_sysevent_proxy_SOURCES = 10_sysevent_proxy.c
Expand Down Expand Up @@ -130,6 +129,11 @@ endif
if FEATURE_RDKB_EXTENDER
02_devicemode_SOURCES = 02_devicemode.c
endif
if ENABLE_MCAST_SERVICE
10_mcastproxy_SOURCES = 10_mcastproxy.c
10_mcastsnooper_SOURCES = 10_mcastsnooper.c
10_mldproxy_SOURCES = 10_mldproxy.c
endif
if ENABLE_POTD_SERVICE
26_potd_SOURCES = 26_potd.c
endif
Expand Down
4 changes: 2 additions & 2 deletions source/scripts/init/service.d/service_misc.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,11 +75,11 @@ if [ "$RG_MD" = "1" -o "$RG_MD" = "3" ]; then
/etc/utopia/service.d/service_igd.sh lan-status&
fi

if [ "$RG_MD" = "1" -o "$RG_MD" = "3" ]; then
if [[ "$RG_MD" = "1" -o "$RG_MD" = "3" ]] && [ -f /etc/utopia/service.d/service_mcastproxy.sh ]; then
/etc/utopia/service.d/service_mcastproxy.sh lan-status&
fi

if [ "$RG_MD" = "2" -o "$RG_MD" = "3" ]; then
if [[ "$RG_MD" = "2" -o "$RG_MD" = "3" ]] && [ -f /etc/utopia/service.d/service_mldproxy.sh ]; then
/etc/utopia/service.d/service_mldproxy.sh lan-status&
fi

Expand Down
Loading