Hello everyone,
I don't know where to publish so I try here.
I found that with the default IGMPproxy package for OpenWrt, the "whitelist" option that I used in /etc/config/igmpproxy was not applied. For exemple, I specified a unique whitelist subnet in the config file, but IGMPproxy still sent queries for multicasts groups that was not in this whitelist subnet to the upstream interface (I can see this with Wireshark capture on the wan interface).
If I look at /var/etc/igmpproxy.conf, the whitelist option isn't specified.
So I made some changes to /etc/init.d/igmpproxy :
In the "igmp_add_phyint" function I added :
config_get whitelists $1 whitelist
and
if [ -n "$whitelists" ]; then
local whitelist
for whitelist in $whitelists; do
echo -e "\twhitelist $whitelist" >> /var/etc/igmpproxy.conf
done
fi
So here is the complete /etc/init.d/igmpproxy file :
#!/bin/sh /etc/rc.common
# Copyright (C) 2010-2014 OpenWrt.org
START=99
USE_PROCD=1
PROG=/usr/sbin/igmpproxy
CONFIGFILE=/var/etc/igmpproxy.conf
igmp_header() {
local quickleave verbose
config_get_bool quickleave "$1" quickleave 0
config_get verbose "$1" verbose 1
[ $verbose = "0" ] && logopts="-d"
[ $verbose = "2" ] && logopts="-v"
[ $verbose = "3" ] && logopts="-v -v"
mkdir -p /var/etc
rm -f /var/etc/igmpproxy.conf
[ $quickleave -gt 0 ] && echo "quickleave" >> /var/etc/igmpproxy.conf
[ -L /etc/igmpproxy.conf ] || ln -nsf /var/etc/igmpproxy.conf /etc/igmpproxy.conf
}
igmp_add_phyint() {
local network direction altnets device up
config_get network $1 network
config_get direction $1 direction
config_get altnets $1 altnet
config_get whitelists $1 whitelist
local status="$(ubus -S call "network.interface.$network" status)"
[ -n "$status" ] || return
json_load "$status"
json_get_var device l3_device
json_get_var up up
[ -n "$device" -a "$up" = "1" ] || {
procd_append_param error "$network is not up"
return;
}
append netdevs "$device"
[[ "$direction" = "upstream" ]] && has_upstream=1
echo -e "\nphyint $device $direction ratelimit 0 threshold 1" >> /var/etc/igmpproxy.conf
if [ -n "$altnets" ]; then
local altnet
for altnet in $altnets; do
echo -e "\taltnet $altnet" >> /var/etc/igmpproxy.conf
done
fi
if [ -n "$whitelists" ]; then
local whitelist
for whitelist in $whitelists; do
echo -e "\twhitelist $whitelist" >> /var/etc/igmpproxy.conf
done
fi
}
igmp_add_network() {
local network
config_get network $1 network
procd_add_interface_trigger "interface.*" $network /etc/init.d/igmpproxy reload
}
igmp_add_firewall_routing() {
config_get direction $1 direction
config_get zone $1 zone
[[ "$direction" = "downstream" && ! -z "$zone" ]] || return 0
# First drop SSDP packets then accept all other multicast
json_add_object ""
json_add_string type rule
json_add_string src "$upstream"
json_add_string dest "$zone"
json_add_string family ipv4
json_add_string proto udp
json_add_string dest_ip "239.255.255.250"
json_add_string target DROP
json_close_object
json_add_object ""
json_add_string type rule
json_add_string src "$upstream"
json_add_string dest "$zone"
json_add_string family ipv4
json_add_string proto udp
json_add_string dest_ip "224.0.0.0/4"
json_add_string target ACCEPT
json_close_object
}
igmp_add_firewall_network() {
config_get direction $1 direction
config_get zone $1 zone
[ ! -z "$zone" ] || return
json_add_object ""
json_add_string type rule
json_add_string src "$zone"
json_add_string family ipv4
json_add_string proto igmp
json_add_string target ACCEPT
json_close_object
[[ "$direction" = "upstream" ]] && {
upstream="$zone"
config_foreach igmp_add_firewall_routing phyint
}
}
service_triggers() {
procd_add_reload_trigger "igmpproxy"
config_foreach igmp_add_network phyint
}
start_service() {
has_upstream=
netdevs=
logopts=
config_load igmpproxy
config_foreach igmp_header igmpproxy
config_foreach igmp_add_phyint phyint
[ -n "$has_upstream" ] || return
procd_open_instance
procd_set_param command $PROG '-n'
[ -n "$logopts" ] && procd_append_param command $logopts
procd_append_param command $CONFIGFILE
procd_set_param file $CONFIGFILE
procd_set_param netdev $netdevs
procd_set_param respawn
procd_open_data
json_add_array firewall
config_foreach igmp_add_firewall_network phyint
json_close_array
procd_close_data
procd_close_instance
}
service_started() {
procd_set_config_changed firewall
}
stop_service() {
procd_set_config_changed firewall
}
And now, by adding a white list option in /etc/config/igmpproxy, it's also added to /var/etc/igmpproxy.conf and it's applied, and only the multicast queries I what are sent to the upstream interface.
Can someone look at the code to see if there are any errors, and submit this to devs to make a patch ?
Thanks