Bug/guardian

[pavankumar464]

No description provided.

[github-actions]

📋 PR Format Reminder

• Title: Bug/guardian — expected TICKET-123 : description
  (Multiple tickets OK: RDKCOM-5492 RDKBDEV-3336 : ... | Include US ticket + subtask for user-stories)
• Description missing:
  • Reason for change
  • Test Procedure
  • Risks (Low / Medium / High)
  • Priority (P0 / P1 / P2)

Expected:

TICKET-123 : brief description

Reason for change: why
Test Procedure: how to verify
Risks: Low / Medium / High
Priority: P0 / P1 / P2

[Copilot]

Pull request overview

This PR introduces a new “Shield Home Guardian” web UI page for managing group policies, service rules, quarantine, and exceptions, plus a corresponding AJAX action handler to persist/apply the generated configuration.

Changes:

• Added guardian.jst UI for viewing/editing devices, policies, services, quarantine/exceptions, and generating config/flow previews.
• Added ajaxSet_guardian_config.jst endpoint to save the generated config to disk and trigger an “apply” action.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.

File	Description
source/Styles/xb3/jst/guardian.jst	New Guardian UI that loads existing config/log state, provides editing workflows, and generates config + flow preview output.
source/Styles/xb3/jst/actionHandler/ajaxSet_guardian_config.jst	New backend endpoint to write Guardian config and execute an apply script.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

Suppressed comments (7)

Previously missed (3) — in code that hasn't changed since the last review.

source/Styles/xb3/jst/guardian.jst:18

• The config parser stores device group membership, but drops the (optional) per-device IP from the [devices] section. Later, generated configs use the current host-table IPv4 (or "--"), which can silently overwrite the saved IPs (especially for offline devices).

This issue also appears on line 84 of the same file.

  $guardianSavedState['deviceGroups'] = {};
  $guardianSavedState['policy'] = {};

source/Styles/xb3/jst/guardian.jst:557

• The "Add Service Rule" protocol dropdown omits SCTP even though the backend/config parser supports it. Either add SCTP here or remove SCTP support server-side to avoid mismatched behavior.

      <select id="svc-proto"><option value="tcp">TCP</option><option value="udp">UDP</option></select>

source/Styles/xb3/jst/guardian.jst:240

• Configured devices may have an empty IPv4Address in the host table (offline, IPv6-only, etc). Falling back to the saved IP from the config avoids generating invalid "--" IP entries in the next config write.

        $deviceInfo['ip'] = ("" != $hostEntry['IPv4Address.1.IPAddress']) ? $hostEntry['IPv4Address.1.IPAddress'] : "--";

source/Styles/xb3/jst/guardian.jst:87

• When parsing [devices] lines, the third token (device IP) should be captured so the UI can preserve/restore IPs when a host is offline or missing an IPv4Address in the runtime host table.

        $deviceParts = preg_split('/\s+/', $guardianLine);
        if (count($deviceParts) >= 2) {
          $guardianSavedState['deviceGroups'][strtolower($deviceParts[0])] = strtoupper($deviceParts[1]);
        }

source/Styles/xb3/jst/guardian.jst:666

• SCTP is accepted when parsing config services/device-policy rules (server-side regex allows sctp), but the UI normalizes any non-tcp proto to udp. This will silently rewrite SCTP rules as UDP when saving.

function normalizeService(service) {
  const normalized = {...service};
  normalized.target = String(normalized.target || 'gateway');
  normalized.proto = normalized.proto === 'tcp' ? 'tcp' : 'udp';
  normalized.port = parseInt(normalized.port, 10);

source/Styles/xb3/jst/actionHandler/ajaxSet_guardian_config.jst:5

• This action handler performs security-sensitive writes to /var/tmp/guardian.cfg and can execute guardian.sh, but it does not include the standard actionHandler utilities (CSRF protection) nor enforce an authenticated session (session_start + loginuser check), unlike other handlers in this folder.

<?% include('includes/jwt.jst') ?>
<?%
$guardianConfigPath = "/var/tmp/guardian.cfg";
$action = isset($_POST['action']) ? strtolower(trim($_POST['action'])) : "";

source/Styles/xb3/jst/guardian.jst:49

• Flow log reads are unbounded (filesize + fread). If /var/tmp/guardian.log grows large, this can consume significant memory and slow the UI request. Consider capping the read size to a reasonable maximum and/or tailing only the last N bytes.

    $guardianLogSize = filesize($guardianLogPath);