aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDmitry Tunin <hanipouspilot@gmail.com>2018-07-28 17:48:42 +0300
committerJo-Philipp Wich <jo@mein.io>2018-12-18 10:16:16 +0100
commiteb7ab27336d86b53b3ddf4515852ac502c4f61eb (patch)
tree3aa0be609b234aef260a1ec8a9fe216d26208626
parentf1b086bf0fe429dad6a97ac08240e83450566720 (diff)
downloadupstream-eb7ab27336d86b53b3ddf4515852ac502c4f61eb.tar.gz
upstream-eb7ab27336d86b53b3ddf4515852ac502c4f61eb.tar.bz2
upstream-eb7ab27336d86b53b3ddf4515852ac502c4f61eb.zip
igmpproxy: drop SSDP packets
It is insecure to let this type of packets inside They can e.g. open ports on some other routers with UPnP, etc Signed-off-by: Dmitry Tunin <hanipouspilot@gmail.com> (backported from c128371124ce4d197a5fbc00e42b58e9d82c571e)
-rw-r--r--package/network/services/igmpproxy/Makefile2
-rw-r--r--package/network/services/igmpproxy/files/igmpproxy.init12
2 files changed, 13 insertions, 1 deletions
diff --git a/package/network/services/igmpproxy/Makefile b/package/network/services/igmpproxy/Makefile
index d06402a267..488de6630d 100644
--- a/package/network/services/igmpproxy/Makefile
+++ b/package/network/services/igmpproxy/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
PKG_NAME:=igmpproxy
PKG_VERSION:=0.2.1
-PKG_RELEASE:=3
+PKG_RELEASE:=4
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://github.com/pali/igmpproxy/releases/download/${PKG_VERSION}/
diff --git a/package/network/services/igmpproxy/files/igmpproxy.init b/package/network/services/igmpproxy/files/igmpproxy.init
index 37fe62ad1b..c4af430681 100644
--- a/package/network/services/igmpproxy/files/igmpproxy.init
+++ b/package/network/services/igmpproxy/files/igmpproxy.init
@@ -68,6 +68,18 @@ igmp_add_firewall_routing() {
[[ "$direction" = "downstream" && ! -z "$zone" ]] || return 0
+# First drop SSDP packets then accept all other multicast
+
+ json_add_object ""
+ json_add_string type rule
+ json_add_string src "$upstream"
+ json_add_string dest "$zone"
+ json_add_string family ipv4
+ json_add_string proto udp
+ json_add_string dest_ip "239.255.255.250"
+ json_add_string target DROP
+ json_close_object
+
json_add_object ""
json_add_string type rule
json_add_string src "$upstream"