From e924308dab2172534c3fb230416293d03c6334d7 Mon Sep 17 00:00:00 2001 From: usi096 Date: Fri, 17 Jul 2026 15:58:25 +0100 Subject: [PATCH 1/3] SHARMAN-4090 -- LAN SSH not working in 6.3 SDK Reason for change: Creating a firewall rule to block SSH using WAN IP from LAN client Test Procedure: NA Risks: LOW Priority: P1 Signed-off-by: usi096 --- source/firewall/firewall.c | 28 +++++++++++++++---- source/firewall/firewall.h | 3 ++ .../apply_system_defaults.c | 4 +++ 3 files changed, 29 insertions(+), 6 deletions(-) diff --git a/source/firewall/firewall.c b/source/firewall/firewall.c index 0e24d5a2..ef6d8549 100644 --- a/source/firewall/firewall.c +++ b/source/firewall/firewall.c @@ -483,6 +483,7 @@ char cellular_ifname[32]; #define SYSEVENT_MAPT_PSID_VALUE "mapt_psid_value" #define SYSEVENT_MAPT_PSID_LENGTH "mapt_psid_length" #define SYSEVENT_MAPT_TOTAL_PORTS "mapt_total_ports" +#define SYSEVENT_LANSSHPORT_SUPPORT "LanSshNewPortSupport" BOOL isMAPTSet(void); static int do_wan_nat_lan_clients_mapt(FILE *fp); @@ -10833,6 +10834,21 @@ static int do_wan2lan(FILE *fp) return(0); } +int isLanSshPortSupportEnabled() +{ + char LanSshPortVal[7] = {'\0'}; + if (sysevent_get(sysevent_fd, sysevent_token, SYSEVENT_LANSSHPORT_SUPPORT, LanSshPortVal, sizeof(LanSshPortVal)) != 0) + { + FIREWALL_DEBUG("ERROR: Failed to get LanSshPortSupport value from sysevent\n"); + return RET_ERR; + } + if (strcmp(LanSshPortVal, "true") == 0) + return 1; + else + return 0; +} + + /* * Procedure : do_block_lan_access_to_wan_ssh * Purpose : To block SSH using WAN IP from LAN client @@ -10841,7 +10857,6 @@ static int do_wan2lan(FILE *fp) * Return Values : * 0 : Success */ -#if defined(_SR213_PRODUCT_REQ_) || defined(_SCER11BEL_PRODUCT_REQ_) || defined(_HUB4_PRODUCT_REQ_) static int do_block_lan_access_to_wan_ssh(FILE *fp) { FIREWALL_DEBUG("Entering do_block_lan_access_to_wan_ssh\n"); @@ -10849,7 +10864,6 @@ static int do_block_lan_access_to_wan_ssh(FILE *fp) FIREWALL_DEBUG("Exiting do_block_lan_access_to_wan_ssh\n"); return(0); } -#endif /* ========================================================================== @@ -13954,10 +13968,12 @@ static int prepare_enabled_ipv4_firewall(FILE *raw_fp, FILE *mangle_fp, FILE *na do_lan2wan(mangle_fp, filter_fp, nat_fp); do_wan2lan(filter_fp); do_filter_table_general_rules(filter_fp); -#if defined(_SR213_PRODUCT_REQ_) || defined(_SCER11BEL_PRODUCT_REQ_) || defined(_HUB4_PRODUCT_REQ_) - if(isWanReady) - do_block_lan_access_to_wan_ssh(filter_fp); -#endif + int LanSshPortSupport_ret = isLanSshPortSupportEnabled(); + if( LanSshPortSupport_ret == 1) + { + if(isWanReady) + do_block_lan_access_to_wan_ssh(filter_fp); + } #if defined(SPEED_BOOST_SUPPORTED) WAN_FAILOVER_SUPPORT_CHECK if(isWanServiceReady) diff --git a/source/firewall/firewall.h b/source/firewall/firewall.h index 70418829..df8ad4ad 100644 --- a/source/firewall/firewall.h +++ b/source/firewall/firewall.h @@ -121,6 +121,9 @@ int prepare_ipv4_firewall(const char *fw_file); * */ int prepare_ipv6_firewall(const char *fw_file); + +/* isLanSshPortSupportEnabled function is to check if the product can support LAN SSH through the port 10022 */ +int isLanSshPortSupportEnabled(); #define CCSP_SUBSYS "eRT." #define IF_IPV6ADDR_MAX 16 diff --git a/source/scripts/init/src/apply_system_defaults/apply_system_defaults.c b/source/scripts/init/src/apply_system_defaults/apply_system_defaults.c index 08571376..49fbd257 100644 --- a/source/scripts/init/src/apply_system_defaults/apply_system_defaults.c +++ b/source/scripts/init/src/apply_system_defaults/apply_system_defaults.c @@ -1376,6 +1376,10 @@ static int ApplyPartnersObjectItemsIntoSysevents( char *pcPartnerID ) { sysevent_set (global_fd, global_id, "HotSpotSupport", value, 0); } + else if ( 0 == strcmp ( key, "Device.X_RDK_Features.LanSshNewPortSupport.Enable") ) + { + sysevent_set (global_fd, global_id, "LanSshNewPortSupport", value, 0); + } else if ( 0 == strcmp ( key, "Device.X_RDK_Features.VlanDiscovery.Enable") ) { sysevent_set (global_fd, global_id, "VlanDiscoverySupport", value, 0); From 9322064d8f96b150150f951da6b04cac175b8fe1 Mon Sep 17 00:00:00 2001 From: usi096 Date: Fri, 17 Jul 2026 15:58:25 +0100 Subject: [PATCH 2/3] SHARMAN-4090 -- LAN SSH not working in 6.3 SDK Reason for change: Creating a firewall rule to block SSH using WAN IP from LAN client Test Procedure: NA Risks: LOW Priority: P1 Signed-off-by: usi096 --- source/firewall/firewall_ipv6.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/source/firewall/firewall_ipv6.c b/source/firewall/firewall_ipv6.c index 1a683b1f..043f26ca 100644 --- a/source/firewall/firewall_ipv6.c +++ b/source/firewall/firewall_ipv6.c @@ -519,6 +519,12 @@ void do_ipv6_filter_table(FILE *fp){ fprintf(fp, ":lan2wan_pc_service - [0:0]\n"); fprintf(fp, ":wan2lan - [0:0]\n"); + int LanSshPortSupport_ret = isLanSshPortSupportEnabled(); + if( LanSshPortSupport_ret == 1) + { + fprintf(fp, "-I INPUT 1 -p tcp --dport 10022 -j DROP\n"); + } + #if defined (_HUB4_PRODUCT_REQ_) || defined (_RDKB_GLOBAL_PRODUCT_REQ_) #if defined (HUB4_BFD_FEATURE_ENABLED) || defined (IHC_FEATURE_ENABLED) #if defined(_RDKB_GLOBAL_PRODUCT_REQ_) From c42bbe3db91083c3d56c33b2ac8aa5f37f1c9d00 Mon Sep 17 00:00:00 2001 From: usi096 Date: Fri, 17 Jul 2026 15:58:25 +0100 Subject: [PATCH 3/3] SHARMAN-4090 -- LAN SSH not working in 6.3 SDK Reason for change: Creating a firewall rule to block SSH using WAN IP from LAN client Test Procedure: NA Risks: LOW Priority: P1 Signed-off-by: usi096 --- source/scripts/init/src/apply_system_defaults_helper.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/source/scripts/init/src/apply_system_defaults_helper.c b/source/scripts/init/src/apply_system_defaults_helper.c index 3d11ae37..83b7b1a1 100644 --- a/source/scripts/init/src/apply_system_defaults_helper.c +++ b/source/scripts/init/src/apply_system_defaults_helper.c @@ -1373,6 +1373,10 @@ static int ApplyPartnersObjectItemsIntoSysevents( char *pcPartnerID ) { sysevent_set (global_fd, global_id, "HotSpotSupport", value, 0); } + else if ( 0 == strcmp ( key, "Device.X_RDK_Features.LanSshNewPortSupport.Enable") ) + { + sysevent_set (global_fd, global_id, "LanSshNewPortSupport", value, 0); + } pCJsonChildParam = pCJsonChildParam->next;