From 376e39207af303b88f49cccee0e0fbf9911c38fb Mon Sep 17 00:00:00 2001 From: usi096 Date: Fri, 24 Jul 2026 17:32:18 +0100 Subject: [PATCH 1/5] SHARMAN-4090 -- LAN SSH not working in 6.3 SDK Reason for change: Creating a firewall rule to block SSH using WAN IP from LAN client Test Procedure: NA Risks: LOW Priority: P1 Signed-off-by: usi096 --- source/firewall/firewall.c | 27 ++++++--------------------- source/firewall/firewall_custom.h | 10 ++++++++++ 2 files changed, 16 insertions(+), 21 deletions(-) diff --git a/source/firewall/firewall.c b/source/firewall/firewall.c index c82fbd0d..0a2e79e9 100644 --- a/source/firewall/firewall.c +++ b/source/firewall/firewall.c @@ -10841,24 +10841,6 @@ static int do_wan2lan(FILE *fp) return(0); } -/* - * Procedure : do_block_lan_access_to_wan_ssh - * Purpose : To block SSH using WAN IP from LAN client - * Parameters : - * fp : An open file to write rules to block SSH using WAN IP in LAN client - * Return Values : - * 0 : Success - */ -#if defined(_SR213_PRODUCT_REQ_) || defined(_SCER11BEL_PRODUCT_REQ_) || defined(_HUB4_PRODUCT_REQ_) || defined(_XER2_PRODUCT_REQ_) -static int do_block_lan_access_to_wan_ssh(FILE *fp) -{ - FIREWALL_DEBUG("Entering do_block_lan_access_to_wan_ssh\n"); - fprintf(fp, "-I INPUT 1 -i %s -d %s -p tcp --dport 10022 -j REJECT\n", lan_ifname, current_wan_ipaddr); - FIREWALL_DEBUG("Exiting do_block_lan_access_to_wan_ssh\n"); - return(0); -} -#endif - /* ========================================================================== Ephemeral filter rules @@ -13962,9 +13944,12 @@ static int prepare_enabled_ipv4_firewall(FILE *raw_fp, FILE *mangle_fp, FILE *na do_lan2wan(mangle_fp, filter_fp, nat_fp); do_wan2lan(filter_fp); do_filter_table_general_rules(filter_fp); -#if defined(_SR213_PRODUCT_REQ_) || defined(_SCER11BEL_PRODUCT_REQ_) || defined(_HUB4_PRODUCT_REQ_) || defined(_XER2_PRODUCT_REQ_) - if(isWanReady) - do_block_lan_access_to_wan_ssh(filter_fp); +#if defined(_SR213_PRODUCT_REQ_) || defined(_HUB4_PRODUCT_REQ_) + if (strcmp ( devicePartnerId, "sky-uk") == 0 || strcmp ( devicePartnerId, "sky-italia") == 0) + { + if(isWanReady) + do_block_lan_access_to_wan_ssh(filter_fp); + } #endif #if defined(SPEED_BOOST_SUPPORTED) WAN_FAILOVER_SUPPORT_CHECK diff --git a/source/firewall/firewall_custom.h b/source/firewall/firewall_custom.h index 5a7fa670..6d0d73cf 100644 --- a/source/firewall/firewall_custom.h +++ b/source/firewall/firewall_custom.h @@ -319,6 +319,16 @@ int do_hub4_bfd_rules_v4(FILE *nat_fp, FILE *filter_fp, FILE *mangle_fp); * @retval 0 on success. * */ +int do_block_lan_access_to_wan_ssh(FILE *filter_fp); +/** +* @brief Blocks SSH connection from WAN IP through brlan0 +* +* @param[in] filter_fp - Pointer to the FILE stream for writing filter table rules. +* +* @return The status of the operation. +* @retval 0 on success. +* +*/ int do_hub4_voice_rules_v4(FILE *filter_fp); /** From 27f8908284203ba82207d3d484c654b04c4d4465 Mon Sep 17 00:00:00 2001 From: usi096 Date: Fri, 24 Jul 2026 17:32:18 +0100 Subject: [PATCH 2/5] SHARMAN-4090 -- LAN SSH not working in 6.3 SDK Reason for change: Creating a firewall rule to block SSH using WAN IP from LAN client Test Procedure: NA Risks: LOW Priority: P1 Signed-off-by: usi096 --- source/firewall/firewall_custom.h | 10 ++++++++++ source/firewall/firewall_ipv6.c | 6 ++++++ 2 files changed, 16 insertions(+) diff --git a/source/firewall/firewall_custom.h b/source/firewall/firewall_custom.h index 6d0d73cf..bd2f02dd 100644 --- a/source/firewall/firewall_custom.h +++ b/source/firewall/firewall_custom.h @@ -329,6 +329,16 @@ int do_block_lan_access_to_wan_ssh(FILE *filter_fp); * @retval 0 on success. * */ +int do_block_lan_access_to_wan_ssh_ipv6(FILE *filter_fp); +/** +* @brief Blocks SSH connection from WAN IP through brlan0 +* +* @param[in] filter_fp - Pointer to the FILE stream for writing filter table rules. +* +* @return The status of the operation. +* @retval 0 on success. +* +*/ int do_hub4_voice_rules_v4(FILE *filter_fp); /** diff --git a/source/firewall/firewall_ipv6.c b/source/firewall/firewall_ipv6.c index 830e9f73..755043de 100644 --- a/source/firewall/firewall_ipv6.c +++ b/source/firewall/firewall_ipv6.c @@ -519,6 +519,12 @@ void do_ipv6_filter_table(FILE *fp){ fprintf(fp, ":lan2wan_pc_service - [0:0]\n"); fprintf(fp, ":wan2lan - [0:0]\n"); +#if defined(_SR213_PRODUCT_REQ_) + if (strcmp ( devicePartnerId, "sky-uk") == 0 || strcmp ( devicePartnerId, "sky-italia") == 0) + { + do_block_lan_access_to_wan_ssh_ipv6(fp); + } +#endif #if defined (_HUB4_PRODUCT_REQ_) || defined (_RDKB_GLOBAL_PRODUCT_REQ_) #if defined (HUB4_BFD_FEATURE_ENABLED) || defined (IHC_FEATURE_ENABLED) #if defined(_RDKB_GLOBAL_PRODUCT_REQ_) From 845e96d6fa6d15099f8e61e1637cd7601356b0f9 Mon Sep 17 00:00:00 2001 From: usi096 Date: Fri, 24 Jul 2026 17:32:18 +0100 Subject: [PATCH 3/5] SHARMAN-4090 -- LAN SSH not working in 6.3 SDK Reason for change: Creating a firewall rule to block SSH using WAN IP from LAN client Test Procedure: NA Risks: LOW Priority: P1 Signed-off-by: usi096 --- source/firewall/firewall_custom.h | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/source/firewall/firewall_custom.h b/source/firewall/firewall_custom.h index bd2f02dd..9843cfd8 100644 --- a/source/firewall/firewall_custom.h +++ b/source/firewall/firewall_custom.h @@ -311,7 +311,7 @@ int do_hub4_mapt_rules_v4(FILE *nat_fp, FILE *filter_fp); int do_hub4_bfd_rules_v4(FILE *nat_fp, FILE *filter_fp, FILE *mangle_fp); /** -* @brief Apply HUB4 voice IPv4 filter rules. +* @brief Blocks SSH connection from WAN IP through brlan0 * * @param[in] filter_fp - Pointer to the FILE stream for writing filter table rules. * @@ -319,9 +319,10 @@ int do_hub4_bfd_rules_v4(FILE *nat_fp, FILE *filter_fp, FILE *mangle_fp); * @retval 0 on success. * */ + int do_block_lan_access_to_wan_ssh(FILE *filter_fp); /** -* @brief Blocks SSH connection from WAN IP through brlan0 +* @brief Blocks SSH connection from WAN IPv6 and LANIPv6 address * * @param[in] filter_fp - Pointer to the FILE stream for writing filter table rules. * @@ -329,9 +330,10 @@ int do_block_lan_access_to_wan_ssh(FILE *filter_fp); * @retval 0 on success. * */ + int do_block_lan_access_to_wan_ssh_ipv6(FILE *filter_fp); /** -* @brief Blocks SSH connection from WAN IP through brlan0 +* @brief Apply HUB4 voice IPv4 filter rules. * * @param[in] filter_fp - Pointer to the FILE stream for writing filter table rules. * @@ -339,6 +341,7 @@ int do_block_lan_access_to_wan_ssh_ipv6(FILE *filter_fp); * @retval 0 on success. * */ + int do_hub4_voice_rules_v4(FILE *filter_fp); /** From 444c8f70dd41e8ca3f145dd234dca408e8b36656 Mon Sep 17 00:00:00 2001 From: usi096 Date: Fri, 24 Jul 2026 17:32:18 +0100 Subject: [PATCH 4/5] SHARMAN-4090 -- LAN SSH not working in 6.3 SDK Reason for change: Creating a firewall rule to block SSH using WAN IP from LAN client Test Procedure: NA Risks: LOW Priority: P1 Signed-off-by: usi096 --- source/firewall/firewall_custom.h | 2 ++ source/firewall/firewall_ipv6.c | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/source/firewall/firewall_custom.h b/source/firewall/firewall_custom.h index 9843cfd8..cc54c93d 100644 --- a/source/firewall/firewall_custom.h +++ b/source/firewall/firewall_custom.h @@ -310,6 +310,7 @@ int do_hub4_mapt_rules_v4(FILE *nat_fp, FILE *filter_fp); */ int do_hub4_bfd_rules_v4(FILE *nat_fp, FILE *filter_fp, FILE *mangle_fp); +#if defined(_SR213_PRODUCT_REQ_) || defined(_HUB4_PRODUCT_REQ_) /** * @brief Blocks SSH connection from WAN IP through brlan0 * @@ -332,6 +333,7 @@ int do_block_lan_access_to_wan_ssh(FILE *filter_fp); */ int do_block_lan_access_to_wan_ssh_ipv6(FILE *filter_fp); +#endif /** * @brief Apply HUB4 voice IPv4 filter rules. * diff --git a/source/firewall/firewall_ipv6.c b/source/firewall/firewall_ipv6.c index 755043de..83bc5001 100644 --- a/source/firewall/firewall_ipv6.c +++ b/source/firewall/firewall_ipv6.c @@ -519,7 +519,7 @@ void do_ipv6_filter_table(FILE *fp){ fprintf(fp, ":lan2wan_pc_service - [0:0]\n"); fprintf(fp, ":wan2lan - [0:0]\n"); -#if defined(_SR213_PRODUCT_REQ_) +#if defined(_SR213_PRODUCT_REQ_) || defined(_HUB4_PRODUCT_REQ_) if (strcmp ( devicePartnerId, "sky-uk") == 0 || strcmp ( devicePartnerId, "sky-italia") == 0) { do_block_lan_access_to_wan_ssh_ipv6(fp); From deba9e42c1219f17498409cecc37fa663df92a19 Mon Sep 17 00:00:00 2001 From: usi096 Date: Fri, 24 Jul 2026 17:32:18 +0100 Subject: [PATCH 5/5] SHARMAN-4090 -- LAN SSH not working in 6.3 SDK Reason for change: Creating a firewall rule to block SSH using WAN IP from LAN client Test Procedure: NA Risks: LOW Priority: P1 Signed-off-by: usi096 --- source/firewall/firewall.c | 2 +- source/firewall/firewall_custom.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/source/firewall/firewall.c b/source/firewall/firewall.c index 0a2e79e9..84574dc8 100644 --- a/source/firewall/firewall.c +++ b/source/firewall/firewall.c @@ -13948,7 +13948,7 @@ static int prepare_enabled_ipv4_firewall(FILE *raw_fp, FILE *mangle_fp, FILE *na if (strcmp ( devicePartnerId, "sky-uk") == 0 || strcmp ( devicePartnerId, "sky-italia") == 0) { if(isWanReady) - do_block_lan_access_to_wan_ssh(filter_fp); + do_block_lan_access_to_wan_ssh(filter_fp, lan_ifname, current_wan_ipaddr); } #endif #if defined(SPEED_BOOST_SUPPORTED) diff --git a/source/firewall/firewall_custom.h b/source/firewall/firewall_custom.h index cc54c93d..4f23afb8 100644 --- a/source/firewall/firewall_custom.h +++ b/source/firewall/firewall_custom.h @@ -321,7 +321,7 @@ int do_hub4_bfd_rules_v4(FILE *nat_fp, FILE *filter_fp, FILE *mangle_fp); * */ -int do_block_lan_access_to_wan_ssh(FILE *filter_fp); +int do_block_lan_access_to_wan_ssh(FILE *filter_fp, char* lan_ifname, char* current_wan_ipaddr); /** * @brief Blocks SSH connection from WAN IPv6 and LANIPv6 address *