From e9b0ff18c6d89578fa75b46b82e2212519e6ada3 Mon Sep 17 00:00:00 2001 From: Self-Hosting-Group <155233284+Self-Hosting-Group@users.noreply.github.com> Date: Tue, 29 Sep 2026 00:00:00 +0000 Subject: [PATCH] net/upnp: add option, improve ACL validation, update changelog --- net/upnp/Makefile | 3 +- net/upnp/pkg-descr | 20 ++++++---- .../src/etc/inc/plugins.inc.d/miniupnpd.inc | 6 +++ net/upnp/src/www/services_upnp.php | 40 ++++++++++++++----- 4 files changed, 48 insertions(+), 21 deletions(-) diff --git a/net/upnp/Makefile b/net/upnp/Makefile index 4da00ae84a..2d5ad0e881 100644 --- a/net/upnp/Makefile +++ b/net/upnp/Makefile @@ -1,6 +1,5 @@ PLUGIN_NAME= upnp -PLUGIN_VERSION= 1.9 -PLUGIN_REVISION= 1 +PLUGIN_VERSION= 1.10 PLUGIN_DEPENDS= miniupnpd PLUGIN_COMMENT= UPnP IGD & PCP/NAT-PMP Service PLUGIN_MAINTAINER= franco@opnsense.org diff --git a/net/upnp/pkg-descr b/net/upnp/pkg-descr index 5032d31d5c..77aa05d36e 100644 --- a/net/upnp/pkg-descr +++ b/net/upnp/pkg-descr @@ -7,24 +7,28 @@ WWW: https://miniupnp.tuxfamily.org/ Plugin Changelog ================ +1.10 + +* Add UI option to specify default accepted minimum port for IPv6/IPv4, and implement daemon patch for it +* Improve ACL entry validation to remove unnecessary spaces +* Add daemon patches to improve logging and CGNAT use, and backport fix to display IPv4 addresses in Active Maps +* Update daemon to 2.3.11 plus backports to fix multiple issues, including security-related ones + +(1.8-1.10 contributed by Self-Hosting-Group) + 1.9 * Separate service log file and log level UI option * More specific allow third-party mapping UI option -* Impove help/wording and update missed changelog -* Add daemon patch to improve logging - -(all contributed by Self-Hosting-Group) +* Help/wording improvements 1.8 -* New UI options: disable IPv6 mapping, allow third-party mapping, UPnP IGD compatibility, router/friendly name; remove option: report system uptime (bug) +* Add UI options: disable IPv6 mapping, allow third-party mapping, UPnP IGD compatibility, router/friendly name; remove option: report system uptime (bug) * List IPv6 maps and keep active maps when reconfiguring/restarting service, clearer added via / description field -* New UI sections, rewording plugin, set allow-filtered with STUN to workaround CGNAT test limitation, clean up daemon config +* Add UI sections, rewording plugin, set allow-filtered with STUN to workaround CGNAT test limitation, clean up daemon config * Update daemon to 2.3.9, add build options (e.g. IGDv2 support), add daemon patch to improve UPnP IGDv2 compatibility -(all contributed by Self-Hosting-Group) - 1.7 * Add option to allow arbitrary number of UPnP/NAT-PMP rules (contributed by Kreeblah) diff --git a/net/upnp/src/etc/inc/plugins.inc.d/miniupnpd.inc b/net/upnp/src/etc/inc/plugins.inc.d/miniupnpd.inc index 1c76948875..14cce72e3b 100644 --- a/net/upnp/src/etc/inc/plugins.inc.d/miniupnpd.inc +++ b/net/upnp/src/etc/inc/plugins.inc.d/miniupnpd.inc @@ -295,6 +295,12 @@ function miniupnpd_configure_do($verbose = false) $config_text .= "lease_file=/var/run/miniupnpd.leases\n"; $config_text .= "lease_file6=/var/run/miniupnpd.leases-ipv6\n"; + if (!empty($upnp_config['default_min_port'])) { + $config_text .= "default_min_port=" . $upnp_config['default_min_port'] . "\n"; + } else { + $config_text .= "default_min_port=1\n"; + } + /* write out the configuration */ file_put_contents('/var/etc/miniupnpd.conf', $config_text); diff --git a/net/upnp/src/www/services_upnp.php b/net/upnp/src/www/services_upnp.php index 1aad4b0130..10c6487983 100644 --- a/net/upnp/src/www/services_upnp.php +++ b/net/upnp/src/www/services_upnp.php @@ -70,6 +70,7 @@ function miniupnpd_validate_port($port) $copy_fields = [ 'allow_third_party_mapping', + 'default_min_port', 'download', 'enable', 'enable_natpmp', @@ -150,11 +151,15 @@ function miniupnpd_validate_port($port) if (!empty($pconfig['num_permuser'] && (!is_numeric($pconfig['num_permuser']) || $pconfig['num_permuser'] < 1))) { $input_errors[] = gettext('Number of permissions must be an integer greater than 0'); } + if (!empty($pconfig['default_min_port'] && !miniupnpd_validate_port($pconfig['default_min_port']))) { + $input_errors[] = gettext('Default minimum port must contain a valid port number'); + } /* user permissions validation */ foreach (miniupnpd_permuser_list() as $i => $permuser) { if (!empty($pconfig[$permuser])) { - $perm = explode(' ', $pconfig[$permuser]); + $perm = preg_split('/\s+/', trim($pconfig[$permuser])); + $pconfig[$permuser] = implode(' ', $perm); /* should explode to 4 args */ if (count($perm) != 4) { $input_errors[] = sprintf(gettext("You must follow the specified format in the 'User specified permissions %s' field"), $i); @@ -187,7 +192,7 @@ function miniupnpd_validate_port($port) $upnp['num_permuser'] = $pconfig['num_permuser']; } // text field types - foreach (['allow_third_party_mapping', 'download', 'ext_iface', 'friendly_name', 'log_level', 'overridesubnet', 'overridewanip', 'stun_host', 'stun_port', 'upload', 'upnp_igd_compat'] as $fieldname) { + foreach (['allow_third_party_mapping', 'default_min_port', 'download', 'ext_iface', 'friendly_name', 'log_level', 'overridesubnet', 'overridewanip', 'stun_host', 'stun_port', 'upload', 'upnp_igd_compat'] as $fieldname) { $upnp[$fieldname] = $pconfig[$fieldname]; } foreach (miniupnpd_permuser_list() as $fieldname) { @@ -252,7 +257,7 @@ function miniupnpd_validate_port($port) - + /> - - - - /> - -