RDKBNETWOR-80 : Transform to Nftables from Iptables

configure.ac

@@ -50,6 +50,16 @@ AC_PREFIX_DEFAULT(`pwd`)
 AC_ENABLE_SHARED
 AC_DISABLE_STATIC
 
+#Enable NFT compile time flags if firewall-nft is set as yes
+AC_ARG_ENABLE([firewall-nft],
+[  --enable-firewall-nft=val Turn on nft Feature, val=true or false],
+[case "${enableval}" in
+  yes) firewall_nft=true ;;
+  no)  firewall_nft=false ;;
+  *) AC_MSG_ERROR([bad value ${enableval} for --enable-firewall-nft]) ;;
+esac],[firewall_nft=false])
+AM_CONDITIONAL(FIREWALL_NFT, test x"$firewall_nft" = x"true")
+
 AC_CONFIG_HEADERS([config.h])
 AC_CONFIG_MACRO_DIR([m4])
 
@@ -258,6 +268,7 @@ AC_CONFIG_FILES(
 	source/Makefile
 	source/dhcpproxy/Makefile
 	source/firewall/Makefile
+	source/firewall_nft/Makefile
 	source/firewall_log/Makefile
 	source/igd/Makefile
 	source/igd/src/Makefile

source/Makefile.am

@@ -16,7 +16,16 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 ##########################################################################
-SUBDIRS = ulog syscfg sysevent services utctx utapi util firewall firewall_log newhost macclone pal pmon services service_wan trigger igd service_routed service_ipv6 scripts service_multinet service_udhcpc
+SUBDIRS = ulog syscfg sysevent services utctx utapi util
+
+if FIREWALL_NFT
+SUBDIRS += firewall_nft
+SUBDIRS += firewall
+else
+SUBDIRS += firewall
+endif
+
+SUBDIRS += firewall_log newhost macclone pal pmon services service_wan trigger igd service_routed service_ipv6 scripts service_multinet service_udhcpc
 
 #SUBDIRS += dhcpproxy
 

source/firewall/Makefile.am

@@ -21,10 +21,10 @@ AM_CFLAGS += -pthread
 AM_CPPFLAGS = -I$(top_srcdir)/source/include -I$(top_srcdir)/source/util/utils $(DBUS_CFLAGS)
 AM_LDFLAGS = -lccsp_common -lsecure_wrapper -lnetfilter_queue -lnfnetlink $(DBUS_LIBS) -pthread -lrt
 
+if FIREWALL_NFT
+bin_PROGRAMS = firewall_ipt nfq_handler
+else
 bin_PROGRAMS = firewall nfq_handler
-
-if ONESTACK_PRODUCT_REQ
-AM_LDFLAGS += -lrdkb_feature_mode_gate
 endif
 
 firewall_SOURCES = firewall_ipv6.c firewall.c firewall_priv.c firewall_interface.c  firewall_ext.c firewall_utils.c
@@ -33,6 +33,11 @@ firewall_SOURCES += firewall_lib.c firewall_dsl.c rabid.c
 AM_LDFLAGS += -lrdkconfig
 endif
 
+if FIREWALL_NFT
+firewall_ipt_SOURCES = $(firewall_SOURCES)
+firewall_ipt_LDADD   = $(firewall_LDADD)
+endif
+
 nfq_handler_SOURCES = raw_socket_send.c nfq_handler.c
 
 firewall_LDADD = $(top_builddir)/source/syscfg/lib/libsyscfg.la \

source/firewall_nft/Makefile.am

@@ -0,0 +1,41 @@
+##########################################################################
+# If not stated otherwise in this file or this component's Licenses.txt
+# file the following copyright and licenses apply:
+#
+# Copyright 2025 RDK Management
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+##########################################################################
+AM_CFLAGS = -D_GNU_SOURCE
+AM_CFLAGS += -pthread
+AM_CPPFLAGS = -I$(top_srcdir)/source/include -I$(top_srcdir)/source/util/utils $(DBUS_CFLAGS)
+AM_LDFLAGS = -lccsp_common -lsecure_wrapper -lnetfilter_queue -lnfnetlink $(DBUS_LIBS) -pthread -lrt
+bin_PROGRAMS = firewall_nft nfq_handler
+
+firewall_nft_SOURCES = firewall_nft.c firewall_ipv6_nft.c firewall_priv_nft.c firewall_interface_nft.c  firewall_ext_nft.c
+if CPC_FIREWALL_ENABLE
+firewall_nft_SOURCES += firewall_lib.c firewall_dsl.c rabid.c
+AM_LDFLAGS += -lrdkconfig
+endif
+nfq_handler_SOURCES = raw_socket_send.c nfq_handler_nft.c
+firewall_nft_LDADD = $(top_builddir)/source/syscfg/lib/libsyscfg.la \
+                 $(top_builddir)/source/sysevent/lib/libsysevent.la \
+                 $(top_builddir)/source/ulog/libulog.la \
+                 $(top_builddir)/source/util/utils/libutopiautil.la
+nfq_handler_LDADD = $(top_builddir)/source/syscfg/lib/libsyscfg.la \
+                    $(top_builddir)/source/sysevent/lib/libsysevent.la \
+                    $(top_builddir)/source/ulog/libulog.la
+
+if CORE_NET_LIB_FEATURE_SUPPORT
+AM_LDFLAGS += -lnet
+endif

source/firewall_nft/firewall_custom.h

@@ -0,0 +1,135 @@
+/*
+ * If not stated otherwise in this file or this component's Licenses.txt file the
+ * following copyright and licenses apply:
+ *
+ * Copyright 2015 RDK Management
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+*/
+
+/**********************************************************************
+   Copyright [2014] [Cisco Systems, Inc.]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+**********************************************************************/
+
+#ifndef __FIREWALL_CUSTOM_H__
+#define __FIREWALL_CUSTOM_H__
+
+
+#include <stdio.h>
+#include<stdlib.h>
+#include <pthread.h>
+#include <time.h>
+#include <stdarg.h>
+#include "ccsp_custom.h"
+extern FILE *firewallfp;
+#define FW_DEBUG 1
+
+void do_device_based_pp_disabled_appendrule(FILE *fp, const char *ins_num, const char *lan_ifname, const char *query);
+void do_device_based_pp_disabled_ip_appendrule(FILE *fp, const char *ins_num, const char *ipAddr);
+int do_parcon_mgmt_lan2wan_pc_site_appendrule(FILE *fp);
+void do_parcon_mgmt_lan2wan_pc_site_insertrule(FILE *fp, int index, char *nstdPort);
+void firewall_log( char* fmt, ...);
+void update_rabid_features_status();
+void do_forwardPorts(FILE *filter_fp);
+void do_snmp_IpAccessTable(FILE *filt_fp, int family);
+void do_ssh_IpAccessTable(FILE *filt_fp, const char *port, int family, const char *interface);
+void do_tr69_whitelistTable(FILE *filt_fp, int family);
+void filterPortMap(FILE *filt_fp);
+void do_openPorts(FILE *filter_fp);
+int prepare_xconf_rules(FILE *mangle_fp);
+int do_self_heal_rules_v6(FILE *mangle_fp);
+int do_qos_output_marking_v6(FILE *mangle_fp);
+int do_hub4_mapt_rules_v6(FILE *filter_fp);
+int do_hub4_bfd_rules_v6(FILE *filter_fp, FILE *mangle_fp);
+int do_hub4_dns_rule_v6(FILE* mangle_fp);
+int do_hub4_voice_rules_v6(FILE *filter_fp, FILE *mangle_fp);
+int do_self_heal_rules_v4(FILE *mangle_fp);
+int do_qos_output_marking_v4(FILE *mangle_fp);
+int do_hub4_mapt_rules_v4(FILE *nat_fp, FILE *filter_fp);
+int do_hub4_bfd_rules_v4(FILE *nat_fp, FILE *filter_fp, FILE *mangle_fp);
+int do_hub4_voice_rules_v4(FILE *filter_fp);
+int isInSelfHealMode ();
+char *get_lan_ipaddr();
+char *get_current_wan_ifname();
+void ethwan_mso_gui_acess_rules(FILE *filter_fp,FILE *mangle_fp);
+void do_OpenVideoAnalyticsPort (FILE *filter_fp);
+void do_webui_rate_limit (FILE *filter_fp,const char *version);
+int prepare_dscp_rules_to_prioritized_clnt(FILE* mangle_fp);
+int prepare_lld_dscp_rules(FILE *mangle_fp);
+void prepare_dscp_rule_for_host_mngt_traffic(FILE *mangle_fp);
+
+#if defined(SPEED_BOOST_SUPPORTED)
+void do_speedboost_port_rules(FILE *mangle_fp, FILE *nat_fp , int iptype);
+int IsPortOverlapWithSpeedboostPortRange(int ExternalPort, int ExternalPortEndRange, int InternalPort , int InternalPortend);
+#endif
+
+#ifdef FW_DEBUG
+#define COMMA ,
+#define FIREWALL_DEBUG(x) firewall_log(x);
+#else 
+#define FIREWALL_DEBUG(x)
+#endif
+
+#define SHM_MUTEX "FirewallMutex"
+
+typedef enum {
+    IP_V4 = 0,
+    IP_V6,
+}ip_ver_t;
+
+typedef struct fw_shm_mutex {
+  pthread_mutex_t *ptr; 
+  int fw_shm_create;        
+  int fw_shm_fd;       
+  char fw_mutex[32];        
+
+} fw_shm_mutex;
+
+
+fw_shm_mutex fw_shm_mutex_init(char *name);
+
+int fw_shm_mutex_close(fw_shm_mutex mutex);
+
+/*
+ *  rdkb_arm is same as 3939/3941
+ *
+#define CONFIG_CCSP_LAN_HTTP_ACCESS
+#define CONFIG_CCSP_VPN_PASSTHROUGH
+ */
+#if defined (INTEL_PUMA7) || (defined (_COSA_BCM_ARM_) && !defined(_CBR_PRODUCT_REQ_)) || defined(_COSA_QCA_ARM_)
+#define CONFIG_CCSP_VPN_PASSTHROUGH
+#endif
+
+#if defined (INTEL_PUMA7)
+#define CONFIG_KERNEL_NETFILTER_XT_TARGET_CT
+#endif
+#define CONFIG_CCSP_WAN_MGMT
+#define CONFIG_CCSP_WAN_MGMT_PORT
+//#define CONFIG_CCSP_WAN_MGMT_ACCESS //defined in ccsp_custom.h
+#ifndef _HUB4_PRODUCT_REQ_
+#define CONFIG_CCSP_CM_IP_WEBACCESS
+#endif /* * !_HUB4_PRODUCT_REQ_ */
+
+#endif