diff options
| author | Dmitry Tunin <hanipouspilot@gmail.com> | 2018-07-28 17:48:42 +0300 |
|---|---|---|
| committer | John Crispin <john@phrozen.org> | 2018-07-30 10:43:36 +0200 |
| commit | c128371124ce4d197a5fbc00e42b58e9d82c571e (patch) | |
| tree | b21ff50227d024f6a242358257e7978ef57c3bf0 /package/network/services/igmpproxy/files/igmpproxy.init | |
| parent | 53a45020135b504cb4bee0fa8d98c8eaf6391066 (diff) | |
| download | upstream-c128371124ce4d197a5fbc00e42b58e9d82c571e.tar.gz upstream-c128371124ce4d197a5fbc00e42b58e9d82c571e.tar.bz2 upstream-c128371124ce4d197a5fbc00e42b58e9d82c571e.zip | |
igmpproxy: drop SSDP packets
It is insecure to let this type of packets inside
They can e.g. open ports on some other routers with UPnP, etc
Signed-off-by: Dmitry Tunin <hanipouspilot@gmail.com>
Diffstat (limited to 'package/network/services/igmpproxy/files/igmpproxy.init')
| -rw-r--r-- | package/network/services/igmpproxy/files/igmpproxy.init | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/package/network/services/igmpproxy/files/igmpproxy.init b/package/network/services/igmpproxy/files/igmpproxy.init index 37fe62ad1b..c4af430681 100644 --- a/package/network/services/igmpproxy/files/igmpproxy.init +++ b/package/network/services/igmpproxy/files/igmpproxy.init @@ -68,6 +68,18 @@ igmp_add_firewall_routing() { [[ "$direction" = "downstream" && ! -z "$zone" ]] || return 0 +# First drop SSDP packets then accept all other multicast + + json_add_object "" + json_add_string type rule + json_add_string src "$upstream" + json_add_string dest "$zone" + json_add_string family ipv4 + json_add_string proto udp + json_add_string dest_ip "239.255.255.250" + json_add_string target DROP + json_close_object + json_add_object "" json_add_string type rule json_add_string src "$upstream" |