SHARMAN-4090 -- LAN SSH not working in 6.3 SDK

source/firewall/firewall.c

@@ -483,6 +483,7 @@ char cellular_ifname[32];
 #define SYSEVENT_MAPT_PSID_VALUE "mapt_psid_value"
 #define SYSEVENT_MAPT_PSID_LENGTH "mapt_psid_length"
 #define SYSEVENT_MAPT_TOTAL_PORTS "mapt_total_ports"
+#define SYSEVENT_LANSSHPORT_SUPPORT "LanSshNewPortSupport"
 
 BOOL isMAPTSet(void);
 static int do_wan_nat_lan_clients_mapt(FILE *fp);
@@ -10833,6 +10834,21 @@ static int do_wan2lan(FILE *fp)
    return(0);
 }
 
+int isLanSshPortSupportEnabled()
+{
+    char LanSshPortVal[7] = {'\0'};
+    if (sysevent_get(sysevent_fd, sysevent_token, SYSEVENT_LANSSHPORT_SUPPORT, LanSshPortVal, sizeof(LanSshPortVal)) != 0)
+    {
+        FIREWALL_DEBUG("ERROR: Failed to get LanSshPortSupport value from sysevent\n");
+        return RET_ERR;
+    }
+    if (strcmp(LanSshPortVal, "true") == 0)
+        return 1;
+    else
+        return 0;
+}
+
+
 /*
  *  Procedure     : do_block_lan_access_to_wan_ssh
  *  Purpose       : To block SSH using WAN IP from LAN client
@@ -10841,15 +10857,13 @@ static int do_wan2lan(FILE *fp)
  * Return Values  :
  *    0              : Success
  */
-#if defined(_SR213_PRODUCT_REQ_) || defined(_SCER11BEL_PRODUCT_REQ_) || defined(_HUB4_PRODUCT_REQ_)
 static int do_block_lan_access_to_wan_ssh(FILE *fp)
 {
    FIREWALL_DEBUG("Entering do_block_lan_access_to_wan_ssh\n");
    fprintf(fp, "-I INPUT 1 -i %s -d %s -p tcp --dport 10022 -j REJECT\n", lan_ifname, current_wan_ipaddr);
    FIREWALL_DEBUG("Exiting do_block_lan_access_to_wan_ssh\n");
    return(0);
 }
-#endif
 
 /*
  ==========================================================================
@@ -13954,10 +13968,12 @@ static int prepare_enabled_ipv4_firewall(FILE *raw_fp, FILE *mangle_fp, FILE *na
    do_lan2wan(mangle_fp, filter_fp, nat_fp); 
    do_wan2lan(filter_fp);
    do_filter_table_general_rules(filter_fp);
-#if defined(_SR213_PRODUCT_REQ_) || defined(_SCER11BEL_PRODUCT_REQ_) || defined(_HUB4_PRODUCT_REQ_)
-   if(isWanReady)
-        do_block_lan_access_to_wan_ssh(filter_fp);
-#endif
+   int LanSshPortSupport_ret = isLanSshPortSupportEnabled();
+   if( LanSshPortSupport_ret == 1)
+   { 
+      if(isWanReady)
+         do_block_lan_access_to_wan_ssh(filter_fp);
+   }
 #if defined(SPEED_BOOST_SUPPORTED)
 WAN_FAILOVER_SUPPORT_CHECK
    if(isWanServiceReady)

source/firewall/firewall.h

@@ -121,6 +121,9 @@ int prepare_ipv4_firewall(const char *fw_file);
 *
 */
 int prepare_ipv6_firewall(const char *fw_file);
+
+/* isLanSshPortSupportEnabled function is to check if the product can support LAN SSH through the port 10022 */
+int isLanSshPortSupportEnabled();
 #define CCSP_SUBSYS "eRT."
 
 #define IF_IPV6ADDR_MAX 16

source/firewall/firewall_ipv6.c

@@ -519,6 +519,12 @@ void do_ipv6_filter_table(FILE *fp){
    fprintf(fp, ":lan2wan_pc_service - [0:0]\n");
    fprintf(fp, ":wan2lan - [0:0]\n");
 
+   int LanSshPortSupport_ret = isLanSshPortSupportEnabled();
+   if( LanSshPortSupport_ret == 1)
+   {
+      fprintf(fp, "-I INPUT 1 -p tcp --dport 10022 -j DROP\n");
+   }
+
 #if defined (_HUB4_PRODUCT_REQ_) || defined (_RDKB_GLOBAL_PRODUCT_REQ_)
 #if defined (HUB4_BFD_FEATURE_ENABLED) || defined (IHC_FEATURE_ENABLED)
 #if defined(_RDKB_GLOBAL_PRODUCT_REQ_)

source/scripts/init/src/apply_system_defaults/apply_system_defaults.c

@@ -1376,6 +1376,10 @@ static int ApplyPartnersObjectItemsIntoSysevents( char *pcPartnerID )
                {
                   sysevent_set (global_fd, global_id, "HotSpotSupport", value, 0);
                }
+               else if ( 0 == strcmp ( key, "Device.X_RDK_Features.LanSshNewPortSupport.Enable") )
+               {
+                  sysevent_set (global_fd, global_id, "LanSshNewPortSupport", value, 0);
+               }
                else if ( 0 == strcmp ( key, "Device.X_RDK_Features.VlanDiscovery.Enable") )
                {
                   sysevent_set (global_fd, global_id, "VlanDiscoverySupport", value, 0);

source/scripts/init/src/apply_system_defaults_helper.c

@@ -1373,6 +1373,10 @@ static int ApplyPartnersObjectItemsIntoSysevents( char *pcPartnerID )
                {
                   sysevent_set (global_fd, global_id, "HotSpotSupport", value, 0);
                }
+               else if ( 0 == strcmp ( key, "Device.X_RDK_Features.LanSshNewPortSupport.Enable") )
+               {
+                  sysevent_set (global_fd, global_id, "LanSshNewPortSupport", value, 0);
+               }
 
 
                pCJsonChildParam = pCJsonChildParam->next;