From f69ae0ecd96ce164a58bfc927992b99bdbd2c508 Mon Sep 17 00:00:00 2001 From: Self-Hosting-Group <155233284+Self-Hosting-Group@users.noreply.github.com> Date: Wed, 29 Oct 2025 10:05:50 +0100 Subject: [PATCH] net/upnp: Service improvements (#4629) --- net/upnp/Makefile | 5 +- .../src/etc/inc/plugins.inc.d/miniupnpd.inc | 23 +- .../mvc/app/models/OPNsense/UPnP/ACL/ACL.xml | 4 +- .../app/models/OPNsense/UPnP/Menu/Menu.xml | 6 +- net/upnp/src/www/services_upnp.php | 226 ++++++++++-------- net/upnp/src/www/status_upnp.php | 28 ++- 6 files changed, 160 insertions(+), 132 deletions(-) diff --git a/net/upnp/Makefile b/net/upnp/Makefile index 1f5e023a7..4c5c4109b 100644 --- a/net/upnp/Makefile +++ b/net/upnp/Makefile @@ -1,8 +1,7 @@ PLUGIN_NAME= upnp -PLUGIN_VERSION= 1.7 -PLUGIN_REVISION= 1 +PLUGIN_VERSION= 1.8 PLUGIN_DEPENDS= miniupnpd -PLUGIN_COMMENT= Universal Plug and Play (UPnP IGD & PCP/NAT-PMP) Service +PLUGIN_COMMENT= UPnP IGD & PCP/NAT-PMP Service PLUGIN_MAINTAINER= franco@opnsense.org .include "../../Mk/plugins.mk" diff --git a/net/upnp/src/etc/inc/plugins.inc.d/miniupnpd.inc b/net/upnp/src/etc/inc/plugins.inc.d/miniupnpd.inc index 5a283d096..d27bcd751 100644 --- a/net/upnp/src/etc/inc/plugins.inc.d/miniupnpd.inc +++ b/net/upnp/src/etc/inc/plugins.inc.d/miniupnpd.inc @@ -55,7 +55,7 @@ function miniupnpd_services() $pconfig = []; $pconfig['name'] = 'miniupnpd'; - $pconfig['description'] = gettext('Universal Plug and Play'); + $pconfig['description'] = gettext('UPnP IGD & PCP/NAT-PMP'); $pconfig['php']['restart'] = ['miniupnpd_stop', 'miniupnpd_start']; $pconfig['php']['start'] = ['miniupnpd_start']; $pconfig['php']['stop'] = ['miniupnpd_stop']; @@ -131,7 +131,7 @@ function miniupnpd_configure_do($verbose = false) return; } - service_log('Starting UPnP service...', $verbose); + service_log('Starting UPnP IGD & PCP/NAT-PMP service...', $verbose); $upnp_config = $config['installedpackages']['miniupnpd']['config'][0]; @@ -142,7 +142,7 @@ function miniupnpd_configure_do($verbose = false) } $config_text = "ext_ifname={$ext_ifname}\n"; - $config_text .= "port=2189\n"; + $config_text .= "http_port=2189\n"; $ifaces_active = ''; @@ -198,7 +198,13 @@ function miniupnpd_configure_do($verbose = false) $config_text .= "bitrate_up={$upload}\n"; } - $config_text .= "secure_mode=yes\n"; + if (!empty($upnp_config['allow_third_party_mapping'])) { + $config_text .= "secure_mode=no\n"; + $config_text .= "pcp_allow_thirdparty=yes\n"; + } else { + $config_text .= "secure_mode=yes\n"; + $config_text .= "pcp_allow_thirdparty=no\n"; + } /* enable logging of packets handled by miniupnpd rules */ if (!empty($upnp_config['logpackets'])) { @@ -234,17 +240,16 @@ function miniupnpd_configure_do($verbose = false) } if (!empty($upnp_config['permdefault'])) { - $config_text .= "deny 0-65535 0.0.0.0/0 0-65535\n"; + $config_text .= "deny 1-65535 0.0.0.0/0 1-65535\n"; } /* Allow UPnP IGD or PCP/NAT-PMP as requested */ $config_text .= "enable_upnp=" . ( $upnp_config['enable_upnp'] ? "yes\n" : "no\n" ); $config_text .= "enable_pcp_pmp=" . ( $upnp_config['enable_natpmp'] ? "yes\n" : "no\n" ); - /* configure lifetimes to force periodic expire */ - $config_text .= "clean_ruleset_interval=600\n"; - $config_text .= "min_lifetime=120\n"; - $config_text .= "max_lifetime=86400\n"; + # When building with IGDv2, infinite (IGDv1 only) lease time port maps are reduced to 7d + # following the IGDv2 standard. Disabling it at runtime allows IGDv2 incompatible clients + $config_text .= "force_igd_desc_v1=yes\n"; /* write out the configuration */ file_put_contents('/var/etc/miniupnpd.conf', $config_text); diff --git a/net/upnp/src/opnsense/mvc/app/models/OPNsense/UPnP/ACL/ACL.xml b/net/upnp/src/opnsense/mvc/app/models/OPNsense/UPnP/ACL/ACL.xml index cc93dde4a..6d4d75598 100644 --- a/net/upnp/src/opnsense/mvc/app/models/OPNsense/UPnP/ACL/ACL.xml +++ b/net/upnp/src/opnsense/mvc/app/models/OPNsense/UPnP/ACL/ACL.xml @@ -1,12 +1,12 @@ - Service: Universal Plug and Play + Services: UPnP IGD & PCP services_upnp.php* - Status: Universal Plug and Play + Services: UPnP IGD & PCP: Active Port Maps status_upnp.php* diff --git a/net/upnp/src/opnsense/mvc/app/models/OPNsense/UPnP/Menu/Menu.xml b/net/upnp/src/opnsense/mvc/app/models/OPNsense/UPnP/Menu/Menu.xml index 0dfae6b0f..27ffe1618 100644 --- a/net/upnp/src/opnsense/mvc/app/models/OPNsense/UPnP/Menu/Menu.xml +++ b/net/upnp/src/opnsense/mvc/app/models/OPNsense/UPnP/Menu/Menu.xml @@ -1,10 +1,10 @@ - - + + - + diff --git a/net/upnp/src/www/services_upnp.php b/net/upnp/src/www/services_upnp.php index d3a5897d8..adec81116 100644 --- a/net/upnp/src/www/services_upnp.php +++ b/net/upnp/src/www/services_upnp.php @@ -69,6 +69,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') { $pconfig = []; $copy_fields = [ + 'allow_third_party_mapping', 'download', 'enable', 'enable_natpmp', @@ -174,7 +175,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') { // save form data $upnp = []; // boolean types - foreach (['enable', 'enable_upnp', 'enable_natpmp', 'logpackets', 'sysuptime', 'permdefault'] as $fieldname) { + foreach (['enable', 'enable_upnp', 'enable_natpmp', 'logpackets', 'sysuptime', 'permdefault', 'allow_third_party_mapping'] as $fieldname) { $upnp[$fieldname] = !empty($pconfig[$fieldname]); } // numeric types @@ -193,7 +194,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') { // sync to config $config['installedpackages']['miniupnpd']['config'] = $upnp; - write_config('Modified Universal Plug and Play settings'); + write_config('Modified UPnP IGD & PCP settings'); miniupnpd_configure_do(); filter_configure(); header(url_safe('Location: /services_upnp.php')); @@ -219,9 +220,7 @@ include("head.inc"); - + - + @@ -253,7 +252,7 @@ include("head.inc"); @@ -270,12 +269,12 @@ include("head.inc"); endforeach;?> - + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - @@ -388,32 +304,138 @@ include("head.inc");
- - @@ -231,11 +230,11 @@ include("head.inc");
/>
/>
- -
- - -
- - -
- - -
- - -
- - -
- -
- /> - -
- /> - -
- /> -
- + + - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+ + +
+ +
+ +
+ + +
+ /> + +
+ /> + +
+ + +
+ + +
+ + + +
+
+
+ + + + + + + + + + + + + $permuser): ?> - + - + diff --git a/net/upnp/src/www/status_upnp.php b/net/upnp/src/www/status_upnp.php index 96ac60e80..d52bcd0b7 100644 --- a/net/upnp/src/www/status_upnp.php +++ b/net/upnp/src/www/status_upnp.php @@ -41,7 +41,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') { } $rdr_entries = array(); -exec("/sbin/pfctl -aminiupnpd -sn", $rdr_entries, $pf_ret); +exec("/sbin/pfctl -a miniupnpd -s nat -P", $rdr_entries, $pf_ret); $service_hook = 'miniupnpd'; include("head.inc"); @@ -57,21 +57,21 @@ include("head.inc");
-

+

-
+ /> + +
+
- - - - - - - + + + + + + + @@ -82,9 +82,9 @@ include("head.inc"); } ?> - + @@ -97,8 +97,10 @@ include("head.inc");
- - . +