From 3deec32ac8f7c3a62530848928da9e72efb973dd Mon Sep 17 00:00:00 2001 From: usi096 Date: Wed, 24 Jun 2026 11:31:15 +0100 Subject: [PATCH 1/7] SHARMAN-4090 WAN SSH is successful without authentication Reason for change: Creating a firewall rule to block SSH using WAN IP from LAN client Test Procedure: NA Risks: LOW Priority: P1 Signed-off-by: usi096 --- source/firewall/firewall.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/source/firewall/firewall.c b/source/firewall/firewall.c index 50538050..7919fcb5 100644 --- a/source/firewall/firewall.c +++ b/source/firewall/firewall.c @@ -10771,6 +10771,8 @@ static int do_block_lan_access_to_wan_ssh(FILE *fp) { FIREWALL_DEBUG("Entering do_block_lan_access_to_wan_ssh\n"); fprintf(fp, "-I INPUT 1 -i %s -d %s -p tcp --dport 10022 -j REJECT\n", lan_ifname, current_wan_ipaddr); + fprintf(fp, "-I INPUT 2 -i %s -d %s -p tcp --dport 10022 -j ACCEPT\n", lan_ifname, current_lan_ipaddr); + v_secure_system("ip6tables -I INPUT 1 -p tcp --dport 10022 -j DROP"); FIREWALL_DEBUG("Exiting do_block_lan_access_to_wan_ssh\n"); return(0); } From 82fcb9a8f3627d6af5c10fcd5b7e81a3e9a85153 Mon Sep 17 00:00:00 2001 From: usi096 Date: Wed, 24 Jun 2026 11:31:15 +0100 Subject: [PATCH 2/7] SHARMAN-4090 WAN SSH is successful without authentication Reason for change: Creating a firewall rule to block SSH using WAN IP from LAN client Test Procedure: NA Risks: LOW Priority: P1 Signed-off-by: usi096 --- source/firewall/firewall.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source/firewall/firewall.c b/source/firewall/firewall.c index 7919fcb5..2f6c94c4 100644 --- a/source/firewall/firewall.c +++ b/source/firewall/firewall.c @@ -10771,7 +10771,7 @@ static int do_block_lan_access_to_wan_ssh(FILE *fp) { FIREWALL_DEBUG("Entering do_block_lan_access_to_wan_ssh\n"); fprintf(fp, "-I INPUT 1 -i %s -d %s -p tcp --dport 10022 -j REJECT\n", lan_ifname, current_wan_ipaddr); - fprintf(fp, "-I INPUT 2 -i %s -d %s -p tcp --dport 10022 -j ACCEPT\n", lan_ifname, current_lan_ipaddr); + fprintf(fp, "-I INPUT 2 -i %s -d %s -p tcp --dport 10022 -j ACCEPT\n", lan_ifname, lan_ipaddr); v_secure_system("ip6tables -I INPUT 1 -p tcp --dport 10022 -j DROP"); FIREWALL_DEBUG("Exiting do_block_lan_access_to_wan_ssh\n"); return(0); From c8862eaf4cb74c658b165a4bfdd5c735b2033386 Mon Sep 17 00:00:00 2001 From: usi096 Date: Wed, 24 Jun 2026 11:31:15 +0100 Subject: [PATCH 3/7] SHARMAN-4090 WAN SSH is successful without authentication Reason for change: Creating a firewall rule to block SSH using WAN IP from LAN client Test Procedure: NA Risks: LOW Priority: P1 Signed-off-by: usi096 --- source/firewall/firewall.c | 1 - source/firewall/firewall_ipv6.c | 3 +++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/source/firewall/firewall.c b/source/firewall/firewall.c index 2f6c94c4..4bcad882 100644 --- a/source/firewall/firewall.c +++ b/source/firewall/firewall.c @@ -10772,7 +10772,6 @@ static int do_block_lan_access_to_wan_ssh(FILE *fp) FIREWALL_DEBUG("Entering do_block_lan_access_to_wan_ssh\n"); fprintf(fp, "-I INPUT 1 -i %s -d %s -p tcp --dport 10022 -j REJECT\n", lan_ifname, current_wan_ipaddr); fprintf(fp, "-I INPUT 2 -i %s -d %s -p tcp --dport 10022 -j ACCEPT\n", lan_ifname, lan_ipaddr); - v_secure_system("ip6tables -I INPUT 1 -p tcp --dport 10022 -j DROP"); FIREWALL_DEBUG("Exiting do_block_lan_access_to_wan_ssh\n"); return(0); } diff --git a/source/firewall/firewall_ipv6.c b/source/firewall/firewall_ipv6.c index 755c1580..a885930b 100644 --- a/source/firewall/firewall_ipv6.c +++ b/source/firewall/firewall_ipv6.c @@ -518,6 +518,9 @@ void do_ipv6_filter_table(FILE *fp){ fprintf(fp, ":lan2wan_pc_site - [0:0]\n"); fprintf(fp, ":lan2wan_pc_service - [0:0]\n"); fprintf(fp, ":wan2lan - [0:0]\n"); +#if defined(_SR213_PRODUCT_REQ_) + fprintf(fp, "-I INPUT 1 -p tcp --dport 10022 -j DROP\n"); +#endif #if defined (_HUB4_PRODUCT_REQ_) || defined (_RDKB_GLOBAL_PRODUCT_REQ_) #if defined (HUB4_BFD_FEATURE_ENABLED) || defined (IHC_FEATURE_ENABLED) From cd7d2c3f0de53fcf792dc61b824f9a6c08e1ec82 Mon Sep 17 00:00:00 2001 From: usi096 Date: Wed, 24 Jun 2026 11:31:15 +0100 Subject: [PATCH 4/7] SHARMAN-4090 WAN SSH is successful without authentication Reason for change: Creating a firewall rule to block SSH using WAN IP from LAN client Test Procedure: NA Risks: LOW Priority: P1 Signed-off-by: usi096 --- source/firewall/firewall.c | 4 ++-- source/firewall/firewall_ipv6.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/source/firewall/firewall.c b/source/firewall/firewall.c index 4bcad882..babd6db0 100644 --- a/source/firewall/firewall.c +++ b/source/firewall/firewall.c @@ -10766,7 +10766,7 @@ static int do_wan2lan(FILE *fp) * Return Values : * 0 : Success */ -#if defined(_SR213_PRODUCT_REQ_) || defined(_SCER11BEL_PRODUCT_REQ_) || defined(_HUB4_PRODUCT_REQ_) +#ifdef SKY static int do_block_lan_access_to_wan_ssh(FILE *fp) { FIREWALL_DEBUG("Entering do_block_lan_access_to_wan_ssh\n"); @@ -13876,7 +13876,7 @@ static int prepare_enabled_ipv4_firewall(FILE *raw_fp, FILE *mangle_fp, FILE *na do_lan2wan(mangle_fp, filter_fp, nat_fp); do_wan2lan(filter_fp); do_filter_table_general_rules(filter_fp); -#if defined(_SR213_PRODUCT_REQ_) || defined(_SCER11BEL_PRODUCT_REQ_) || defined(_HUB4_PRODUCT_REQ_) +#ifdef SKY if(isWanReady) do_block_lan_access_to_wan_ssh(filter_fp); #endif diff --git a/source/firewall/firewall_ipv6.c b/source/firewall/firewall_ipv6.c index a885930b..e191de12 100644 --- a/source/firewall/firewall_ipv6.c +++ b/source/firewall/firewall_ipv6.c @@ -518,7 +518,7 @@ void do_ipv6_filter_table(FILE *fp){ fprintf(fp, ":lan2wan_pc_site - [0:0]\n"); fprintf(fp, ":lan2wan_pc_service - [0:0]\n"); fprintf(fp, ":wan2lan - [0:0]\n"); -#if defined(_SR213_PRODUCT_REQ_) +#ifdef SKY fprintf(fp, "-I INPUT 1 -p tcp --dport 10022 -j DROP\n"); #endif From 2bde1f328b46e2c3ed45450e7a70ced05fd625d8 Mon Sep 17 00:00:00 2001 From: usi096 Date: Wed, 24 Jun 2026 11:31:15 +0100 Subject: [PATCH 5/7] SHARMAN-4090 WAN SSH is successful without authentication Reason for change: Creating a firewall rule to block SSH using WAN IP from LAN client Test Procedure: NA Risks: LOW Priority: P1 Signed-off-by: usi096 --- source/firewall/firewall.c | 4 ---- source/firewall/firewall_ipv6.c | 2 -- 2 files changed, 6 deletions(-) diff --git a/source/firewall/firewall.c b/source/firewall/firewall.c index babd6db0..a9c1fa7a 100644 --- a/source/firewall/firewall.c +++ b/source/firewall/firewall.c @@ -10766,7 +10766,6 @@ static int do_wan2lan(FILE *fp) * Return Values : * 0 : Success */ -#ifdef SKY static int do_block_lan_access_to_wan_ssh(FILE *fp) { FIREWALL_DEBUG("Entering do_block_lan_access_to_wan_ssh\n"); @@ -10775,7 +10774,6 @@ static int do_block_lan_access_to_wan_ssh(FILE *fp) FIREWALL_DEBUG("Exiting do_block_lan_access_to_wan_ssh\n"); return(0); } -#endif /* ========================================================================== @@ -13876,10 +13874,8 @@ static int prepare_enabled_ipv4_firewall(FILE *raw_fp, FILE *mangle_fp, FILE *na do_lan2wan(mangle_fp, filter_fp, nat_fp); do_wan2lan(filter_fp); do_filter_table_general_rules(filter_fp); -#ifdef SKY if(isWanReady) do_block_lan_access_to_wan_ssh(filter_fp); -#endif #if defined(SPEED_BOOST_SUPPORTED) WAN_FAILOVER_SUPPORT_CHECK if(isWanServiceReady) diff --git a/source/firewall/firewall_ipv6.c b/source/firewall/firewall_ipv6.c index e191de12..4234b81f 100644 --- a/source/firewall/firewall_ipv6.c +++ b/source/firewall/firewall_ipv6.c @@ -518,9 +518,7 @@ void do_ipv6_filter_table(FILE *fp){ fprintf(fp, ":lan2wan_pc_site - [0:0]\n"); fprintf(fp, ":lan2wan_pc_service - [0:0]\n"); fprintf(fp, ":wan2lan - [0:0]\n"); -#ifdef SKY fprintf(fp, "-I INPUT 1 -p tcp --dport 10022 -j DROP\n"); -#endif #if defined (_HUB4_PRODUCT_REQ_) || defined (_RDKB_GLOBAL_PRODUCT_REQ_) #if defined (HUB4_BFD_FEATURE_ENABLED) || defined (IHC_FEATURE_ENABLED) From 661103a0fca04be1e5c5e5cf033a0232fc982702 Mon Sep 17 00:00:00 2001 From: usi096 Date: Wed, 24 Jun 2026 11:31:15 +0100 Subject: [PATCH 6/7] SHARMAN-4090 WAN SSH is successful without authentication Reason for change: Creating a firewall rule to block SSH using WAN IP from LAN client Test Procedure: NA Risks: LOW Priority: P1 Signed-off-by: usi096 --- source/firewall/firewall.c | 1 - 1 file changed, 1 deletion(-) diff --git a/source/firewall/firewall.c b/source/firewall/firewall.c index a9c1fa7a..59cbc416 100644 --- a/source/firewall/firewall.c +++ b/source/firewall/firewall.c @@ -10770,7 +10770,6 @@ static int do_block_lan_access_to_wan_ssh(FILE *fp) { FIREWALL_DEBUG("Entering do_block_lan_access_to_wan_ssh\n"); fprintf(fp, "-I INPUT 1 -i %s -d %s -p tcp --dport 10022 -j REJECT\n", lan_ifname, current_wan_ipaddr); - fprintf(fp, "-I INPUT 2 -i %s -d %s -p tcp --dport 10022 -j ACCEPT\n", lan_ifname, lan_ipaddr); FIREWALL_DEBUG("Exiting do_block_lan_access_to_wan_ssh\n"); return(0); } From 04a69178afd6f4d338d560512def9f24d5f0ff5d Mon Sep 17 00:00:00 2001 From: usi096 Date: Wed, 24 Jun 2026 11:31:15 +0100 Subject: [PATCH 7/7] SHARMAN-4090 WAN SSH is successful without authentication Reason for change: Creating a firewall rule to block SSH using WAN IP from LAN client Test Procedure: NA Risks: LOW Priority: P1 Signed-off-by: usi096 --- source/firewall/firewall.c | 4 ++++ source/firewall/firewall_ipv6.c | 2 ++ 2 files changed, 6 insertions(+) diff --git a/source/firewall/firewall.c b/source/firewall/firewall.c index 59cbc416..d9beed91 100644 --- a/source/firewall/firewall.c +++ b/source/firewall/firewall.c @@ -10766,6 +10766,7 @@ static int do_wan2lan(FILE *fp) * Return Values : * 0 : Success */ +#ifdef SKY static int do_block_lan_access_to_wan_ssh(FILE *fp) { FIREWALL_DEBUG("Entering do_block_lan_access_to_wan_ssh\n"); @@ -10773,6 +10774,7 @@ static int do_block_lan_access_to_wan_ssh(FILE *fp) FIREWALL_DEBUG("Exiting do_block_lan_access_to_wan_ssh\n"); return(0); } +#endif /* ========================================================================== @@ -13873,8 +13875,10 @@ static int prepare_enabled_ipv4_firewall(FILE *raw_fp, FILE *mangle_fp, FILE *na do_lan2wan(mangle_fp, filter_fp, nat_fp); do_wan2lan(filter_fp); do_filter_table_general_rules(filter_fp); +#ifdef SKY if(isWanReady) do_block_lan_access_to_wan_ssh(filter_fp); +#endif #if defined(SPEED_BOOST_SUPPORTED) WAN_FAILOVER_SUPPORT_CHECK if(isWanServiceReady) diff --git a/source/firewall/firewall_ipv6.c b/source/firewall/firewall_ipv6.c index 4234b81f..e191de12 100644 --- a/source/firewall/firewall_ipv6.c +++ b/source/firewall/firewall_ipv6.c @@ -518,7 +518,9 @@ void do_ipv6_filter_table(FILE *fp){ fprintf(fp, ":lan2wan_pc_site - [0:0]\n"); fprintf(fp, ":lan2wan_pc_service - [0:0]\n"); fprintf(fp, ":wan2lan - [0:0]\n"); +#ifdef SKY fprintf(fp, "-I INPUT 1 -p tcp --dport 10022 -j DROP\n"); +#endif #if defined (_HUB4_PRODUCT_REQ_) || defined (_RDKB_GLOBAL_PRODUCT_REQ_) #if defined (HUB4_BFD_FEATURE_ENABLED) || defined (IHC_FEATURE_ENABLED)