SHARMAN-4090 : LAN SSH not working in 6.3 SDK

[umasankar098]

Reason for change: Creating a firewall rule to block SSH using WAN IP from LAN client

Test Procedure: NA

Risks: LOW

Priority: P1

[Copilot]

Pull request overview

This PR addresses LAN clients being able to SSH to the device via its WAN IPv4 address by adding an explicit firewall reject rule when the WAN IP is known (and, for SR213, only for specific partner IDs).

Changes:

• Removed the local (static) helper that inserts an INPUT-chain reject rule for SSH to the WAN IP.
• Added conditional execution of do_block_lan_access_to_wan_ssh() for _SR213_PRODUCT_REQ_ when devicePartnerId is sky-uk or sky-italia.
• Exposed do_block_lan_access_to_wan_ssh() via firewall_custom.h.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
source/firewall/firewall.c	Updates when/if the LAN→WAN-IP SSH blocking rule is applied; removes the prior local helper implementation.
source/firewall/firewall_custom.h	Adds a prototype for the SSH-block helper and updates header documentation blocks.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (2)

source/firewall/firewall.c:13943

• do_block_lan_access_to_wan_ssh() is called for SR213_PRODUCT_REQ builds, but its implementation was removed from this file and there is no definition elsewhere in the repo (only a prototype in firewall_custom.h). This will fail to link. Either restore/relocate the function implementation, or inline the rule emission at the call site.

   if (strcmp ( devicePartnerId, "sky-uk") == 0 || strcmp ( devicePartnerId, "sky-italia") == 0)
   {
        if(isWanReady)
             do_block_lan_access_to_wan_ssh(filter_fp);

source/firewall/firewall_custom.h:322

• The Doxygen comment for "Apply HUB4 voice IPv4 filter rules" now documents do_block_lan_access_to_wan_ssh() instead of do_hub4_voice_rules_v4(), and the following duplicate comment block is also mismatched. If these new SSH-blocking helpers are not implemented/used, remove these declarations; otherwise, move them under their own correct doc blocks and keep the HUB4 voice doc attached to do_hub4_voice_rules_v4().

/**
* @brief Apply HUB4 voice IPv4 filter rules.
*
* @param[in] filter_fp - Pointer to the FILE stream for writing filter table rules.
*
* @return The status of the operation.
* @retval 0 on success.
*
*/
int do_block_lan_access_to_wan_ssh(FILE *filter_fp);

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

source/firewall/firewall.c:10841

• The implementation of do_block_lan_access_to_wan_ssh() was removed earlier in this file, but it is still called (and now has a public prototype in firewall_custom.h). In the current PR state there is no definition anywhere in the repo, which will cause an undefined reference at link time for _SR213_PRODUCT_REQ_ builds.

/*
 ==========================================================================
              Ephemeral filter rules
 ==========================================================================
 */

source/firewall/firewall_ipv6.c:526

• do_block_lan_access_to_wan_ssh_ipv6() is declared in firewall_custom.h and called here, but there is no implementation anywhere in the repo, which will fail linking for _SR213_PRODUCT_REQ_ builds. Either add the function definition or inline the rule emission here.

#if defined(_SR213_PRODUCT_REQ_)
   if (strcmp ( devicePartnerId, "sky-uk") == 0 || strcmp ( devicePartnerId, "sky-italia") == 0)
   {
        do_block_lan_access_to_wan_ssh_ipv6(fp);
   }

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

source/firewall/firewall.c:10836

• do_block_lan_access_to_wan_ssh() is still referenced later in this file, but its implementation was removed. For builds where _SR213_PRODUCT_REQ_/_HUB4_PRODUCT_REQ_ are set this will fail at link time (undefined reference). Re-add the helper implementation (or inline the rule generation at the call site).

/*

source/firewall/firewall_ipv6.c:526

• do_block_lan_access_to_wan_ssh_ipv6() is called here, but there is no definition for it in the repo (only a prototype). This will fail to link for _SR213_PRODUCT_REQ_/_HUB4_PRODUCT_REQ_ builds. Either add the missing function implementation in firewall_ipv6.c or inline the rule emission here.

#if defined(_SR213_PRODUCT_REQ_) || defined(_HUB4_PRODUCT_REQ_)
   if (strcmp ( devicePartnerId, "sky-uk") == 0 || strcmp ( devicePartnerId, "sky-italia") == 0)
   {
        do_block_lan_access_to_wan_ssh_ipv6(fp);
   }

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (2)

source/firewall/firewall.c:10836

• do_block_lan_access_to_wan_ssh() is still called later (prepare_enabled_ipv4_firewall), but its definition was removed from this file and no other definition exists in the repo, which will cause a link error for SR213_PRODUCT_REQ/HUB4_PRODUCT_REQ builds. Restore the helper (with the new signature) or provide an implementation in another compilation unit.

/*

source/firewall/firewall_ipv6.c:526

• do_block_lan_access_to_wan_ssh_ipv6() is declared in the headers and called here, but there is no definition in the repo, which will cause a link error. Either add the function implementation, or (if the rule is intended to mirror the IPv4 behavior) emit the ip6tables INPUT rule directly here.

   if (strcmp ( devicePartnerId, "sky-uk") == 0 || strcmp ( devicePartnerId, "sky-italia") == 0)
   {
        do_block_lan_access_to_wan_ssh_ipv6(fp);
   }

[LakshminarayananShenbagaraj]

Fine with me

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (3)

source/firewall/firewall.c:13952

• do_block_lan_access_to_wan_ssh(...) is called here but there is no implementation in the repository (only a prototype in firewall_custom.h). This will fail at link time once this code is compiled for the enabled products.

#if defined(_SR213_PRODUCT_REQ_) || defined(_HUB4_PRODUCT_REQ_)
   if (strcmp ( devicePartnerId, "sky-uk") == 0 || strcmp ( devicePartnerId, "sky-italia") == 0)
   {
        if(isWanReady)
             do_block_lan_access_to_wan_ssh(filter_fp, lan_ifname, current_wan_ipaddr);
   }

source/firewall/firewall.c:13952

• The PR description says it is creating a rule to block SSH to the WAN IP from LAN clients, but the new logic only applies the block when devicePartnerId is sky-uk or sky-italia. If the restriction is intended, the PR description should reflect this; otherwise the gating will leave other partners/products unaffected.

#if defined(_SR213_PRODUCT_REQ_) || defined(_HUB4_PRODUCT_REQ_)
   if (strcmp ( devicePartnerId, "sky-uk") == 0 || strcmp ( devicePartnerId, "sky-italia") == 0)
   {
        if(isWanReady)
             do_block_lan_access_to_wan_ssh(filter_fp, lan_ifname, current_wan_ipaddr);
   }

source/firewall/firewall_custom.h:315

• The @brief says this blocks SSH "through brlan0", but the function signature takes lan_ifname, implying it is not necessarily limited to brlan0. This can be misleading for future maintainers.

* @brief Blocks SSH connection from WAN IP through brlan0

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (3)

source/firewall/firewall.c:13991

• do_block_lan_access_to_wan_ssh() is now called as an external/custom function, but there is no definition for it in this repo; this change will rely on the product customization layer to provide the implementation, otherwise the intended SSH-block rule will not be emitted for SR213/HUB4 Sky partner builds.

#if defined(_SR213_PRODUCT_REQ_) || defined(_HUB4_PRODUCT_REQ_)
   if (strcmp ( devicePartnerId, "sky-uk") == 0 || strcmp ( devicePartnerId, "sky-italia") == 0)
   {
        if(isWanReady)
             do_block_lan_access_to_wan_ssh(filter_fp, lan_ifname, current_wan_ipaddr);
   }

source/firewall/firewall_ipv6.c:526

• do_block_lan_access_to_wan_ssh_ipv6() is invoked here but is only declared (in firewall_custom.h); there is no implementation in this repo, so the IPv6 SSH-block rule will depend on an out-of-tree/custom implementation being added and linked for SR213/HUB4 builds.

#if defined(_SR213_PRODUCT_REQ_) || defined(_HUB4_PRODUCT_REQ_)
   if (strcmp ( devicePartnerId, "sky-uk") == 0 || strcmp ( devicePartnerId, "sky-italia") == 0)
   {
        do_block_lan_access_to_wan_ssh_ipv6(fp);
   }

source/firewall/firewall_custom.h:336

• The doc comment for do_block_lan_access_to_wan_ssh() does not match the function signature (missing lan_ifname/current_wan_ipaddr params) and the @brief hard-codes brlan0 even though the interface is passed in.

/**
* @brief Blocks SSH connection from WAN IP through brlan0
*
* @param[in] filter_fp - Pointer to the FILE stream for writing filter table rules.
*