Adds functionality to disable UPnP on package-by-package basis

packages/daemons/src/natRenewal/getPortsToOpen.ts

@@ -1,18 +1,44 @@
 import { PackageContainer, PortToOpen, PortMapping } from "@dappnode/types";
 import { logs } from "@dappnode/logger";
 import { ComposeFileEditor } from "@dappnode/dockercompose";
+import { readManifestIfExists } from "@dappnode/utils";
+import { listPackages } from "@dappnode/dockerapi";
 
-export function getPortsToOpen(containers: PackageContainer[]): PortToOpen[] {
+export async function shouldAddPort(port: PortMapping, container: PackageContainer): Promise<boolean> {
+  const packages = await listPackages();
+  const dnp = packages.find((dnp) => dnp.dnpName === container.dnpName);
+  if (!dnp) return false;
+
+  const manifest = readManifestIfExists(dnp);
+  if (manifest && manifest.upnpDisable) {
+    if (Array.isArray(manifest.upnpDisable)) {
+      if (port.host && manifest.upnpDisable.includes(port.host)) {
+        logs.debug(`UPnP disabled for port ${port.host} of ${manifest.name} package`);
+        return false; // Skip this port if it's in the disable list
+      }
+    } else if (manifest.upnpDisable === true) {
+      // It's a boolean true, skip all ports
+      logs.debug(`UPnP disabled for ${manifest.name} package`);
+      return false;
+    }
+  }
+  return true;
+}
+
+export async function getPortsToOpen(containers: PackageContainer[], _shouldAddPort?: boolean): Promise<PortToOpen[]> {
   // Aggreate ports with an object form to prevent duplicates
   const portsToOpen = new Map<string, PortToOpen>();
-  const addPortToOpen = (port: PortMapping, container: PackageContainer): void => {
-    if (port.host) {
-      portsToOpen.set(`${port.host}-${port.protocol}`, {
-        protocol: port.protocol,
-        portNumber: port.host,
-        serviceName: container.serviceName,
-        dnpName: container.dnpName
-      });
+
+  const addPortToOpen = async (port: PortMapping, container: PackageContainer): Promise<void> => {
+    if (_shouldAddPort || (await shouldAddPort(port, container))) {
+      if (port.host) {
+        portsToOpen.set(`${port.host}-${port.protocol}`, {
+          protocol: port.protocol,
+          portNumber: port.host,
+          serviceName: container.serviceName,
+          dnpName: container.dnpName
+        });
+      }
     }
   };
 

packages/daemons/src/natRenewal/index.ts

@@ -48,7 +48,7 @@ async function natRenewal(): Promise<void> {
 
     // Fetch portsToOpen and store them in the DB
     const containers = await listPackageContainers();
-    const portsToOpen = getPortsToOpen(containers);
+    const portsToOpen = await getPortsToOpen(containers);
     db.portsToOpen.set(portsToOpen);
     if (isFirstRun)
       logs.info("NAT renewal portsToOpen\n", portsToOpen.map((p) => `${p.portNumber}/${p.protocol}`).join(", "));

packages/daemons/test/unit/natRenewal.test.ts

@@ -71,7 +71,7 @@ describe("daemons > natRenewal > getPortsToOpen", () => {
     compose.writeTo(ComposeEditor.getComposePath(stoppedDnp, false));
 
     const containersListed = await listContainers();
-    const portsToOpen = getPortsToOpen(containersListed);
+    const portsToOpen = await getPortsToOpen(containersListed, true);
 
     expect(portsToOpen).to.deep.equal([
       // From "admin.dnp.dappnode.eth"
@@ -144,7 +144,7 @@ describe("daemons > natRenewal > getPortsToOpen", () => {
     // }
 
     const containers = await listContainers();
-    const portsToOpen = getPortsToOpen(containers);
+    const portsToOpen = await getPortsToOpen(containers, true);
     expect(portsToOpen).to.deep.equal([
       // Should return only the admin's ports and ignore the other DNP's
       // From "admin.dnp.dappnode.eth"

packages/types/src/manifest.ts

@@ -95,6 +95,7 @@ export interface Manifest {
 
   // Network metadata
   exposable?: ExposableServiceManifestInfo[];
+  upnpDisable?: boolean | number[];
 
   // setupWizard for compacted manifests in core packages
   setupWizard?: SetupWizard;