From eb7ab27336d86b53b3ddf4515852ac502c4f61eb Mon Sep 17 00:00:00 2001 From: Dmitry Tunin Date: Sat, 28 Jul 2018 17:48:42 +0300 Subject: [PATCH] igmpproxy: drop SSDP packets It is insecure to let this type of packets inside They can e.g. open ports on some other routers with UPnP, etc Signed-off-by: Dmitry Tunin (backported from c128371124ce4d197a5fbc00e42b58e9d82c571e) --- package/network/services/igmpproxy/Makefile | 2 +- .../network/services/igmpproxy/files/igmpproxy.init | 12 ++++++++++++ 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/package/network/services/igmpproxy/Makefile b/package/network/services/igmpproxy/Makefile index d06402a267..488de6630d 100644 --- a/package/network/services/igmpproxy/Makefile +++ b/package/network/services/igmpproxy/Makefile @@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=igmpproxy PKG_VERSION:=0.2.1 -PKG_RELEASE:=3 +PKG_RELEASE:=4 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz PKG_SOURCE_URL:=https://github.com/pali/igmpproxy/releases/download/${PKG_VERSION}/ diff --git a/package/network/services/igmpproxy/files/igmpproxy.init b/package/network/services/igmpproxy/files/igmpproxy.init index 37fe62ad1b..c4af430681 100644 --- a/package/network/services/igmpproxy/files/igmpproxy.init +++ b/package/network/services/igmpproxy/files/igmpproxy.init @@ -68,6 +68,18 @@ igmp_add_firewall_routing() { [[ "$direction" = "downstream" && ! -z "$zone" ]] || return 0 +# First drop SSDP packets then accept all other multicast + + json_add_object "" + json_add_string type rule + json_add_string src "$upstream" + json_add_string dest "$zone" + json_add_string family ipv4 + json_add_string proto udp + json_add_string dest_ip "239.255.255.250" + json_add_string target DROP + json_close_object + json_add_object "" json_add_string type rule json_add_string src "$upstream" -- 2.25.1