RDKCOM-5603: RDKBDEV-3455, RDKBACCL-1787 firewall, wan and service changes for generic arm

[mcbridematt]

This is a subset of the changes from #312 , rebased onto the current develop branch, containing only firewall and some service script changes to extend the same behavior other open source reference boards to this platform

Reason For Change: Upstreamed Generic ARM specific changes into common code to avoid maintaining platform patches.
Test Procedure: Remove firewall and service_wan patch from meta-rdk-bsp-arm. System should boot-up and should work as expected.
Risks: None
Priority: P0

A new platform GENERICARM is being introduced in RDK-B. Currently, to make the GENERICARM platform work similar to existing platforms like RPI and BPI, platform-specific changes are being maintained as patches in the meta-rdk-bsp-arm layer.

These patches add the required PLATFORM_FLAG handling (PLATFORM_GENERICARM_) and platform-specific behavior in utopia components, including firewall configuration, LAN handling, WAN handling, DHCP/DHCPv6 handling, IGD temporary path handling, and build fixes.

Actual Behavior

GENERICARM requires multiple downstream patches in meta-rdk-bsp-arm.
Without these patches:
Platform-specific code paths are not enabled.
Required firewall/LAN/WAN behavior is missing.
Build issues occur for some configurations.
Runtime behavior is inconsistent compared with other supported platforms.
Expected Behavior

GENERICARM should work similar to existing supported platforms (RPI/BPI).
Required platform-specific logic should be available in the common utopia code.
No additional utopia patches should be required from meta-rdk-bsp-arm.
build should complete successfully with GENERICARM configuration.

Original patch location: https://github.com/rdkcentral/meta-rdk-bsp-arm/tree/develop/meta-rdk-broadband/recipes-ccsp/util/utopia

[Copilot]

Pull request overview

This PR upstreams GENERICARM platform conditionals into the common utopia WAN service and firewall rule generation logic, aligning behavior with other embedded ARM-style platforms (e.g., RPi/BPi/Turris) and reducing reliance on downstream meta-rdk-bsp-arm patches.

Changes:

• Add _PLATFORM_GENERICARM_ to existing platform #if/#elif blocks in service_wan to gate interface-down and firewall/gw refresh execution paths.
• Extend IPv4 firewall rule-generation conditionals to treat GENERICARM similarly to other ARM platforms for logging/DoS protections/remote access and related behaviors.
• Apply the same GENERICARM gating to IPv6 NAT table behavior for WAN failover DNS redirection.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
source/service_wan/service_wan.c	Adds GENERICARM to platform-specific guards around WAN down and firewall/gw refresh flows.
source/firewall/firewall.c	Updates many iptables rule-generation platform conditionals to include/exclude GENERICARM where appropriate.
source/firewall/firewall_ipv6.c	Gates WAN failover IPv6 DNS redirection for GENERICARM consistently with other platforms.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.

Suppressed comments (6)

source/scripts/init/service.d/service_dhcp_server.sh:594

• Turris was removed from the transient dnsmasq-failure retry list while Generic ARM was added. This changes existing Turris behavior so a first startup failure is no longer retried; retain the old platform entry.

   	if [ "$BOX_TYPE" = "XB6" ] || [ "$BOX_TYPE" = "PUMA7_CGP" ] || [ "$BOX_TYPE" = "rpi" ] || [ "$BOX_TYPE" = "bpi" ] || [ "$BOX_TYPE" = "genericarm" ] ; then

source/scripts/init/service.d/service_dhcp_server/dhcp_server_functions.sh:1136

• This replacement drops the existing turris case. Turris still has dedicated DHCP configuration later in this file (line 1291), so it must continue transitioning lan-status from stopped; otherwise that platform's LAN readiness behavior regresses. Preserve turris while adding Generic ARM.

   if [ "$BOX_TYPE" = "rpi" ] || [ "$BOX_TYPE" = "bpi" ] || [ "$BOX_TYPE" = "genericarm" ]; then

source/scripts/init/service.d/service_dhcp_server.sh:454

• This removes Turris from the existing exemption. Turris will now enter this gate and can exit at line 464 whenever lan_status-dhcp is not started, preventing DHCP startup where it previously proceeded unconditionally. Add Generic ARM without dropping Turris.

This issue also appears on line 594 of the same file.

  if [ "$BOX_TYPE" != "rpi" ] && [ "$BOX_TYPE" != "bpi" ] && [ "$BOX_TYPE" != "genericarm" ]; then

source/scripts/init/service.d/service_dhcp_server.sh:594

• Generic ARM now enters this retry path, but its increment at line 604 assigns the literal string 0+1. On the next iteration /bin/sh cannot evaluate [ 0+1 -lt 5 ], so the intended five retries stop after one failed retry. Use shell arithmetic for the counter.

   	if [ "$BOX_TYPE" = "XB6" ] || [ "$BOX_TYPE" = "PUMA7_CGP" ] || [ "$BOX_TYPE" = "rpi" ] || [ "$BOX_TYPE" = "bpi" ] || [ "$BOX_TYPE" = "genericarm" ] ; then

source/firewall/firewall.c:9533

• Generic ARM is switched to the RPI/Turris/BPI destination-match implementation here, but the separate InternetAccessPolicy BlockUrl path at line 7888 was not updated and still emits an httphost rule for Generic ARM. As a result, the two URL-blocking APIs generate different platform-specific rule types, and the legacy InternetAccessPolicy path does not receive the Generic ARM compatibility behavior added here. Add _PLATFORM_GENERICARM_ to that analogous conditional as well.

#elif defined(_PLATFORM_RASPBERRYPI_) || defined(_PLATFORM_TURRIS_) || defined(_PLATFORM_BANANAPI_R4_) || defined(_PLATFORM_GENERICARM_) || defined(_COSA_QCA_ARM_)

source/scripts/init/system/utopia_init.sh:793

• The PR description says only the firewall and service_wan changes from #312 are included and that the other changes will be submitted separately, but this adds Generic ARM reboot-state handling; the PR also changes LAN, DHCP, IPv4, and SSH startup scripts. Split these non-firewall/WAN changes as described, or update the stated scope and test procedure so the additional boot/LAN/DHCP behavior is reviewed and validated.

if [ "$MODEL_NUM" = "DPC3939B" ] || [ "$MODEL_NUM" = "DPC3941B" ] || [ "${BOX_TYPE}" = "genericarm" ]; then