I am trying to set miniupnpd (UPnP server), but please point out if you understand miniupnpd.conf secure_mode.
When set to secure_mode = yes, miniupnpd will assign the IP address of the local network to the client.
that's ok?
secure_mode
There is a comment in miniupnpd.conf as follows:
https://github.com/miniupnp/miniupnp/blob/master/miniupnpd/miniupnpd.conf
# Secure Mode, UPnP clients can only add mappings to their own IP
#secure_mode=yes
secure_mode=no
I understood that secure_mode is the one that assigns the local IP address to the client.
background
Why did I ask a question like this, Google search for secure_mode hit information about vulnerability.
An issue was discovered on the D-Link DWR-932B router. A secure_mode=no line exists in /var/miniupnpd.conf.
Although it seems to be a D-Link limited router vulnerability, the setting secure_mode = no is the default setting in miniupnpd.conf.
I read the reproduction code. this vulnerability seems to be "access restriction by IP address is not done and secure_mode = no".
Access restrictions are as follows.
allow 1024-65535 192.168.0.0/24 1024-65535
deny 0-65535 0.0.0.0/0 0-65535
question
CVE-2016-10185 is written only as "Do not write secure_mode = no", but it is not so, as it is not restricting access.
That is, if secure_mode = yes, miniupnpd will assign the IP address of the local network to the client. Therefore, I understanding that you can restrict access even if secure_mode = no is set. that's ok?