RDKB-63599:Private LAN traffic on/off handling

[Amaresh-Kotekal]

Reason for change: Private LAN traffic on/off based on wifi link status
Test Procedure: verify the logic and functionality
Risks: High
Priority: P1

[Copilot]

Pull request overview

This PR adds handling to disable LAN→WAN forwarding by reading a lan_wan_forwarding_enabled sysevent flag and injecting an iptables DROP rule into the lan2wan chain when forwarding is disabled.

Changes:

• Read lan_wan_forwarding_enabled from sysevent during firewall rule generation.
• When disabled, add a lan2wan chain rule to drop forwarded traffic from the LAN interface.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

atoi(cEnabled) treats any non-numeric non-empty value (e.g., "true"/"false") as 0, which would disable forwarding unexpectedly. This file usually treats sysevent/syscfg boolean flags as enabled unless the value is empty or exactly "0" (e.g., ciscoconnect_guest_enable, lanhost_tracking_enabled). Consider parsing this flag the same way (explicitly check for "0") or validate that the value is strictly "0"/"1" before using atoi.

[Amaresh-Kotekal]

NOT ADDRESSED.
we are only setting the lan_wan_forwarding_enabled as "0" or "1"

[Copilot]

The DROP rule is limited to -i lan_ifname, but there are other interfaces that also jump into lan2wan (e.g., ETH_MESH_BRIDGE, XHS_BRIDGE, LNF_BRIDGE in the MAPT/NAT46 block). With the current match, forwarding can remain possible for those paths even when lan_wan_forwarding_enabled is 0. If the intent is to disable all LAN→WAN forwarding handled by lan2wan, consider making the DROP unconditional within lan2wan (or covering all relevant ingress interfaces).

Suggested change

	fprintf(filter_fp, "-A lan2wan -i %s -j DROP\n", lan_ifname);
	/* Disable all LAN->WAN forwarding handled by the lan2wan chain,
	* regardless of ingress interface.
	*/
	fprintf(filter_fp, "-A lan2wan -j DROP\n");

[Amaresh-Kotekal]

NOT ADDRESSED. We wan't block only private LAN if the wifi link status is non serviceable.

[Copilot]

lan_ifname is defaulted to "brlan0" here, but the variable has already been used earlier in this function to emit multiple iptables rules (e.g., FORWARD/OUTPUT jumps). If a default is needed when syscfg_get("lan_ifname") returns empty, it should be applied at initialization time so all generated rules are consistent; otherwise this late fallback only affects the new DROP rule and subsequent rules.

Suggested change

	if('\0' == lan_ifname[0])
	snprintf(lan_ifname, sizeof(lan_ifname), "brlan0");
	int iEnabled = atoi(cEnabled);
	if (0 == iEnabled)
	{
	fprintf(filter_fp, "-A lan2wan -i %s -j DROP\n", lan_ifname);
	int iEnabled = atoi(cEnabled);
	if (0 == iEnabled)
	{
	if ('\0' != lan_ifname[0])
	{
	fprintf(filter_fp, "-A lan2wan -i %s -j DROP\n", lan_ifname);
	}

[Amaresh-Kotekal]

NOT ADDRESSED. We don't want to touch the previous implementation.

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

1 out of 2 committers have signed the CLA.
✅ Amaresh-Kotekal
❌ sshriv323
_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}