Skip to content

net/upnp: Improve ACL validation, update changelog #5677

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Self-Hosting-Group wants to merge 1 commit into
base: master
Choose a base branch
from
Open

net/upnp: Improve ACL validation, update changelog #5677

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions net/upnp/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,5 @@
PLUGIN_NAME= upnp
PLUGIN_VERSION= 1.9
PLUGIN_REVISION= 1
PLUGIN_VERSION= 1.10
PLUGIN_DEPENDS= miniupnpd
PLUGIN_COMMENT= UPnP IGD & PCP/NAT-PMP Service
PLUGIN_MAINTAINER= franco@opnsense.org
Expand Down
20 changes: 12 additions & 8 deletions net/upnp/pkg-descr
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,24 +7,28 @@ WWW: https://miniupnp.tuxfamily.org/
Plugin Changelog
================

1.10

* Add UI option to specify default accepted minimum port for IPv6/IPv4, and implement daemon patch for it
* Improve ACL entry validation to remove unnecessary spaces
* Add daemon patches to improve logging and CGNAT use, and backport fix to display IPv4 addresses in Active Maps
* Update daemon to 2.3.11 plus backports to fix multiple issues, including security-related ones

(1.8-1.10 contributed by Self-Hosting-Group)

1.9

* Separate service log file and log level UI option
* More specific allow third-party mapping UI option
* Impove help/wording and update missed changelog
* Add daemon patch to improve logging

(all contributed by Self-Hosting-Group)
* Help/wording improvements

1.8

* New UI options: disable IPv6 mapping, allow third-party mapping, UPnP IGD compatibility, router/friendly name; remove option: report system uptime (bug)
* Add UI options: disable IPv6 mapping, allow third-party mapping, UPnP IGD compatibility, router/friendly name; remove option: report system uptime (bug)
* List IPv6 maps and keep active maps when reconfiguring/restarting service, clearer added via / description field
* New UI sections, rewording plugin, set allow-filtered with STUN to workaround CGNAT test limitation, clean up daemon config
* Add UI sections, rewording plugin, set allow-filtered with STUN to workaround CGNAT test limitation, clean up daemon config
* Update daemon to 2.3.9, add build options (e.g. IGDv2 support), add daemon patch to improve UPnP IGDv2 compatibility

(all contributed by Self-Hosting-Group)

1.7

* Add option to allow arbitrary number of UPnP/NAT-PMP rules (contributed by Kreeblah)
Expand Down
6 changes: 6 additions & 0 deletions net/upnp/src/etc/inc/plugins.inc.d/miniupnpd.inc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -295,6 +295,12 @@ function miniupnpd_configure_do($verbose = false)
$config_text .= "lease_file=/var/run/miniupnpd.leases\n";
$config_text .= "lease_file6=/var/run/miniupnpd.leases-ipv6\n";

if (!empty($upnp_config['default_min_port'])) {
$config_text .= "default_min_port=" . $upnp_config['default_min_port'] . "\n";
} else {
$config_text .= "default_min_port=1\n";
}

/* write out the configuration */
file_put_contents('/var/etc/miniupnpd.conf', $config_text);

Expand Down
40 changes: 29 additions & 11 deletions net/upnp/src/www/services_upnp.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,7 @@ function miniupnpd_validate_port($port)

$copy_fields = [
'allow_third_party_mapping',
'default_min_port',
'download',
'enable',
'enable_natpmp',
Expand Down Expand Up @@ -150,11 +151,15 @@ function miniupnpd_validate_port($port)
if (!empty($pconfig['num_permuser'] && (!is_numeric($pconfig['num_permuser']) || $pconfig['num_permuser'] < 1))) {
$input_errors[] = gettext('Number of permissions must be an integer greater than 0');
}
if (!empty($pconfig['default_min_port'] && !miniupnpd_validate_port($pconfig['default_min_port']))) {
$input_errors[] = gettext('Default minimum port must contain a valid port number');
}

/* user permissions validation */
foreach (miniupnpd_permuser_list() as $i => $permuser) {
if (!empty($pconfig[$permuser])) {
$perm = explode(' ', $pconfig[$permuser]);
Comment thread
Self-Hosting-Group marked this conversation as resolved.
$perm = preg_split('/\s+/', trim($pconfig[$permuser]));
$pconfig[$permuser] = implode(' ', $perm);
/* should explode to 4 args */
if (count($perm) != 4) {
$input_errors[] = sprintf(gettext("You must follow the specified format in the 'User specified permissions %s' field"), $i);
Expand Down Expand Up @@ -187,7 +192,7 @@ function miniupnpd_validate_port($port)
$upnp['num_permuser'] = $pconfig['num_permuser'];
}
// text field types
foreach (['allow_third_party_mapping', 'download', 'ext_iface', 'friendly_name', 'log_level', 'overridesubnet', 'overridewanip', 'stun_host', 'stun_port', 'upload', 'upnp_igd_compat'] as $fieldname) {
foreach (['allow_third_party_mapping', 'default_min_port', 'download', 'ext_iface', 'friendly_name', 'log_level', 'overridesubnet', 'overridewanip', 'stun_host', 'stun_port', 'upload', 'upnp_igd_compat'] as $fieldname) {
$upnp[$fieldname] = $pconfig[$fieldname];
}
foreach (miniupnpd_permuser_list() as $fieldname) {
Expand Down Expand Up @@ -252,7 +257,7 @@ function miniupnpd_validate_port($port)
</td>
</tr>
<tr>
<td><a id="help_for_enable_natpmp" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Enable PCP/NAT-PMP protocols");?></td>
<td><a id="help_for_enable_natpmp" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Enable PCP and NAT-PMP protocols");?></td>
<td>
<input name="enable_natpmp" type="checkbox" value="yes" <?=!empty($pconfig['enable_natpmp']) ? "checked=\"checked\"" : ""; ?> />
<div class="hidden" data-for="help_for_enable_natpmp">
Expand Down Expand Up @@ -361,12 +366,6 @@ function miniupnpd_validate_port($port)
</div>
</td>
</tr>
<tr>
<td><i class="fa fa-info-circle text-muted"></i> <?= gettext('Disable IPv6 mapping') ?></td>
<td>
<input name="ipv6_disable" type="checkbox" value="yes" <?= !empty($pconfig['ipv6_disable']) ? "checked=\"checked\"" : ""; ?> />
</td>
</tr>
<!-- <tr>
<td><a id="help_for_sysuptime" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Report system uptime");?></td>
<td>
Expand Down Expand Up @@ -467,10 +466,29 @@ function miniupnpd_validate_port($port)
<td>
<input name="permdefault" type="checkbox" value="yes" <?=!empty($pconfig['permdefault']) ? "checked=\"checked\"" : ""; ?> />
<div class="hidden" data-for="help_for_permdefault">
<?=gettext("Deny access to service by default.");?>
<?=gettext("Deny access to IPv4 service by default.");?>
</div>
</td>
</tr>
<tr>
<td><a id="help_for_default_min_port" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Default minimum port");?></td>
<td>
<input name="default_min_port" type="text" placeholder="1" value="<?= $pconfig['default_min_port'] ?? '' ?>" />
<div class="hidden" data-for="help_for_default_min_port">
<?=gettext("Specify the minimum accepted port with IPv6, with IPv4 only if default deny is unchecked and with no matching ACL entries.");?>
</div>
</td>
</tr>
<tr>
<td><a id="help_for_ipv6_disable" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?= gettext('Disable IPv6 mapping') ?></td>
<td>
<input name="ipv6_disable" type="checkbox" value="yes" <?= !empty($pconfig['ipv6_disable']) ? "checked=\"checked\"" : ""; ?> />
<div class="hidden" data-for="help_for_ipv6_disable">
<?=gettext("Disable IPv6 mapping entirely.");?>
</div>
</td>
</tr>

<tr>
<td><a id="help_for_num_permuser" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Number of entries");?></td>
<td>
Expand Down Expand Up @@ -498,7 +516,7 @@ function miniupnpd_validate_port($port)
</td>
</tr>
<?php endforeach ?>
<tr><td colspan="2"><?=gettext("The access control list (ACL) specifies which IP addresses and ports can be mapped. IPv6 is currently always accepted unless disabled.");?></td></tr>
<tr><td colspan="2"><?=gettext("The access control list (ACL) specifies which IPv4 addresses and ports can be mapped.");?></td></tr>
</tbody>
</table>
</div>
Expand Down