RDKB-67001: Resolve Firewall Configuration Failures

[rirfha948]

Reason for change:

Implement general code improvements to enhance reliability, maintainability, and overall software quality.
Address identified issues and optimize existing implementation.
Test Procedure:

Verify the updated logic and functionality.
Validate that existing features continue to work as expected.
Perform regression testing to ensure no unintended impact on related functionality.
Review logs and system behavior for any anomalies after the update.
Risks: Low
Priority: P1
RDKB67001-logs.txt

[rdkcmf-jenkins]

b'## Blackduck scan failure details

Summary: 0 violations, 0 files pending approval, 1 file pending identification.

• Protex Server Path: /home/blackduck/github/utopia/440/rdkb/components/opensource/ccsp/Utopia

• Commit: 5dde06c

Report detail: gist'

[Copilot]

🟡 Changes recommended

Invalid CmDiag values can still enter generated rulesets, and custom-port parental-control enforcement is regressed.

5 open findings

• Retain custom-port packet-processor disabling for managed-site rules · New
• Reject parser-unsafe characters in interface-name validation · New
• Validate cmdiag_ifname before every CmDiag-dependent rule emission · New
• Validate cmdiag_ifname before disabled-firewall rule generation · New
• Validate cmdiag_ifname before bridge-mode access rule generation · New

What changed in this PR

Adds firewall-rule validation and telemetry to prevent corrupt CmDiag interface data from invalidating generated rulesets.

Changes:

• Validates CmDiag interface names for selected IPv4/IPv6 rules.
• Adds telemetry reporting and linkage.
• Removes parental-control custom-port rule insertion and initializes Wi-Fi buffers.

File	Description
source/​firewall/​Makefile.am	Links telemetry support.
source/​firewall/​firewall.h	Declares the validation API.
source/​firewall/​firewall.c	Adds validation, telemetry, and rule-generation changes.
source/​firewall/​firewall_priv.c	Removes custom-port insertion helper.
source/​firewall/​firewall_ipv6.c	Adds CmDiag validation to an IPv6 rule.
source/​firewall/​firewall_custom.h	Removes the helper declaration.

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[rdkcmf-jenkins]

b'## Blackduck scan failure details

Summary: 0 violations, 0 files pending approval, 1 file pending identification.

• Protex Server Path: /home/blackduck/github/utopia/440/rdkb/components/opensource/ccsp/Utopia

• Commit: cfd383c

Report detail: gist'

[Copilot]

🟡 Changes recommended

Some configurations fail to compile, and corrupt interface data can still reach multiple generated rules.

5 open findings

• Include net/if.h unconditionally for IFNAMSIZ · New
• Gate all cmdiag_ifname rules after validation · New
• Retain custom-port packet-processor disabling for managed-site rules
• Validate cmdiag_ifname before bridge-mode access rule generation
• Reject parser-unsafe characters in interface-name validation

2 resolved since last review

• Validate cmdiag_ifname before disabled-firewall rule generation
• Validate cmdiag_ifname before every CmDiag-dependent rule emission

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[Copilot]

🔵 Needs a closer look

P1 multi-platform firewall behavior changes require targeted device and regression validation.

0 open findings

5 resolved since last review

• Gate all cmdiag_ifname rules after validation
• Include net/if.h unconditionally for IFNAMSIZ
• Retain custom-port packet-processor disabling for managed-site rules
• Validate cmdiag_ifname before bridge-mode access rule generation
• Reject parser-unsafe characters in interface-name validation

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[Copilot]

🟡 Changes recommended

The BCM-MIPS path can generate an invalid rule insertion index and cause iptables-restore to reject the ruleset.

1 open finding

• Fix BCM-MIPS iptables insertion index for custom-port rules · New

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

The new platform condition can emit an unsupported GWMETA rule on Raspberry Pi builds and cause firewall restoration to fail.

1 open finding

• Preserve Raspberry Pi exclusion for GWMETA --dis-pp rule · New

1 resolved since last review

• Fix BCM-MIPS iptables insertion index for custom-port rules

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

Invalid or wildcard CmDiag values can leave management services exposed.

5 open findings

• Reject '+' to prevent iptables interface wildcard bypass · New
• Add IPv6 remote-management drop when CmDiag is rejected · New
• Apply wan2self_mgmt fallback when CmDiag interface is invalid · New
• Fix NFT rule index overwrite for custom-port filters
• Validate cmdiag_ifname in the NFT backend

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

Invalid bridge-mode configuration can still expose management ports, and the validator accepts invalid Linux interface names.

2 open findings

• Add bridge-mode fallback to prevent SSH restriction bypass · New
• Fix NFT rule index overwrite for custom-port filters

4 resolved since last review

• Apply wan2self_mgmt fallback when CmDiag interface is invalid
• Add IPv6 remote-management drop when CmDiag is rejected
• Reject '+' to prevent iptables interface wildcard bypass
• Validate cmdiag_ifname in the NFT backend

Previously missed (1)

In code that hasn't changed since last review

Reject colons and special names in interface validation

source/​firewall/​firewall.c:2357

This validator still accepts : and the special names ./.., although Linux rejects them as network-interface names. A corrupt value such as lan0:bad therefore survives validation and is emitted into the restore file, so this change does not reliably prevent malformed cmdiag_ifname rules. Reject those cases here.

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

Rejected interface data can leave remote management ports exposed over IPv6 in bridge mode.

1 open finding

• Drop bridge IPv6 traffic when cmdiag interface is unavailable · New

2 resolved since last review

• Add bridge-mode fallback to prevent SSH restriction bypass
• Fix NFT rule index overwrite for custom-port filters

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

The bridge-mode fallback can apply LAN access policy to WAN traffic, and empty configuration incorrectly generates corruption telemetry.

3 open findings

• Prevent bridge fallback from applying LAN policy to WAN traffic · New
• Drop bridge IPv6 traffic when cmdiag interface is unavailable
• Avoid reporting empty interface names as corrupt · New

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

Missing fail-closed fallbacks can expose management services when the CMDIAG interface is rejected.

0 open findings

3 resolved since last review

• Prevent bridge fallback from applying LAN policy to WAN traffic
• Drop bridge IPv6 traffic when cmdiag interface is unavailable
• Avoid reporting empty interface names as corrupt

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

A duplicate function prevents compilation, and empty CMDIAG fallbacks can omit security restrictions.

1 open finding

• Add fail-closed DROP for rejected bridge CMDIAG names · New

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

Invalid interface handling can fail open and expose remote-management services.

0 open findings

1 resolved since last review

• Add fail-closed DROP for rejected bridge CMDIAG names

🧠 Review effort: Balanced