diff --git a/source/firewall/firewall.c b/source/firewall/firewall.c index 950a7d9d..780da262 100644 --- a/source/firewall/firewall.c +++ b/source/firewall/firewall.c @@ -10880,24 +10880,6 @@ static int do_wan2lan(FILE *fp) return(0); } -/* - * Procedure : do_block_lan_access_to_wan_ssh - * Purpose : To block SSH using WAN IP from LAN client - * Parameters : - * fp : An open file to write rules to block SSH using WAN IP in LAN client - * Return Values : - * 0 : Success - */ -#if defined(_SR213_PRODUCT_REQ_) || defined(_SCER11BEL_PRODUCT_REQ_) || defined(_HUB4_PRODUCT_REQ_) || defined(_XER2_PRODUCT_REQ_) -static int do_block_lan_access_to_wan_ssh(FILE *fp) -{ - FIREWALL_DEBUG("Entering do_block_lan_access_to_wan_ssh\n"); - fprintf(fp, "-I INPUT 1 -i %s -d %s -p tcp --dport 10022 -j REJECT\n", lan_ifname, current_wan_ipaddr); - FIREWALL_DEBUG("Exiting do_block_lan_access_to_wan_ssh\n"); - return(0); -} -#endif - /* ========================================================================== Ephemeral filter rules @@ -14001,9 +13983,12 @@ static int prepare_enabled_ipv4_firewall(FILE *raw_fp, FILE *mangle_fp, FILE *na do_lan2wan(mangle_fp, filter_fp, nat_fp); do_wan2lan(filter_fp); do_filter_table_general_rules(filter_fp); -#if defined(_SR213_PRODUCT_REQ_) || defined(_SCER11BEL_PRODUCT_REQ_) || defined(_HUB4_PRODUCT_REQ_) || defined(_XER2_PRODUCT_REQ_) - if(isWanReady) - do_block_lan_access_to_wan_ssh(filter_fp); +#if defined(_SR213_PRODUCT_REQ_) || defined(_HUB4_PRODUCT_REQ_) + if (strcmp ( devicePartnerId, "sky-uk") == 0 || strcmp ( devicePartnerId, "sky-italia") == 0) + { + if(isWanReady) + do_block_lan_access_to_wan_ssh(filter_fp, lan_ifname, current_wan_ipaddr); + } #endif #if defined(SPEED_BOOST_SUPPORTED) WAN_FAILOVER_SUPPORT_CHECK diff --git a/source/firewall/firewall_custom.h b/source/firewall/firewall_custom.h index 5a7fa670..4f23afb8 100644 --- a/source/firewall/firewall_custom.h +++ b/source/firewall/firewall_custom.h @@ -310,6 +310,30 @@ int do_hub4_mapt_rules_v4(FILE *nat_fp, FILE *filter_fp); */ int do_hub4_bfd_rules_v4(FILE *nat_fp, FILE *filter_fp, FILE *mangle_fp); +#if defined(_SR213_PRODUCT_REQ_) || defined(_HUB4_PRODUCT_REQ_) +/** +* @brief Blocks SSH connection from WAN IP through brlan0 +* +* @param[in] filter_fp - Pointer to the FILE stream for writing filter table rules. +* +* @return The status of the operation. +* @retval 0 on success. +* +*/ + +int do_block_lan_access_to_wan_ssh(FILE *filter_fp, char* lan_ifname, char* current_wan_ipaddr); +/** +* @brief Blocks SSH connection from WAN IPv6 and LANIPv6 address +* +* @param[in] filter_fp - Pointer to the FILE stream for writing filter table rules. +* +* @return The status of the operation. +* @retval 0 on success. +* +*/ + +int do_block_lan_access_to_wan_ssh_ipv6(FILE *filter_fp); +#endif /** * @brief Apply HUB4 voice IPv4 filter rules. * @@ -319,6 +343,7 @@ int do_hub4_bfd_rules_v4(FILE *nat_fp, FILE *filter_fp, FILE *mangle_fp); * @retval 0 on success. * */ + int do_hub4_voice_rules_v4(FILE *filter_fp); /** diff --git a/source/firewall/firewall_ipv6.c b/source/firewall/firewall_ipv6.c index 830e9f73..83bc5001 100644 --- a/source/firewall/firewall_ipv6.c +++ b/source/firewall/firewall_ipv6.c @@ -519,6 +519,12 @@ void do_ipv6_filter_table(FILE *fp){ fprintf(fp, ":lan2wan_pc_service - [0:0]\n"); fprintf(fp, ":wan2lan - [0:0]\n"); +#if defined(_SR213_PRODUCT_REQ_) || defined(_HUB4_PRODUCT_REQ_) + if (strcmp ( devicePartnerId, "sky-uk") == 0 || strcmp ( devicePartnerId, "sky-italia") == 0) + { + do_block_lan_access_to_wan_ssh_ipv6(fp); + } +#endif #if defined (_HUB4_PRODUCT_REQ_) || defined (_RDKB_GLOBAL_PRODUCT_REQ_) #if defined (HUB4_BFD_FEATURE_ENABLED) || defined (IHC_FEATURE_ENABLED) #if defined(_RDKB_GLOBAL_PRODUCT_REQ_)