SIP ALG: on/off switch on the Administration page, on FLWRT 2.0's Device.Firewall.ConnectionTracking.SIP.Enable (ref FWDEV#217) #1694

Summary

Add a SIP ALG on/off switch to the 2.x Administration page. FLWRT 2.0 serves it on the standard leaf Device.Firewall.ConnectionTracking.SIP.Enable (linksys/FWDEV#217; firmware merged in linksys/feed_usp#41 and linksys/targets#251 on 2026-10-09). It is 1.x's one ALG switch (JNAP isSIPEnabled).

This is the ALG part of #875. Device.NAT.ALG.*, which #875 names, is not the path (FW's comment on #875, 2026-10-15).

Parity row: linksys/Architecture#210, Advanced Settings — Administration.

FW contract

From linksys/FWDEV#217, confirmed on the bench below.

• The setter adds or removes sip in the conntrack helper list of the lan and guest zones.
• It is the only leaf under Device.Firewall.ConnectionTracking. on this firmware. The other TR-181 helpers (FTP, H323, ...) are not served.

Measured on the bench (2026-10-15)

M60, FW 2.0.3.26101472, through obuspa, ubus call bbfdm schema, and the app's own WASM USP client through the bridge (the path the UI uses).

• Read: Enable => 0. Writable, xsd:boolean.
• Device.NAT.ALG. → Path is invalid.
• Enable=1: read back 1; both zones' helper lists gained sip and the nft ruleset carries the sip helper.
• Enable=0: read back 0; sip left both lists and the ruleset. The bench is back at 0.
• A Set takes 8.4–9.0 s to answer through the WASM client (2 writes), and about 9 s through obuspa, where a Get takes about 1 s. UPnP's Set answers in 0.3–1.9 s. Save has to stay in its busy state for that long without timing out.
• Not measured yet: survival across a reboot, and a SIP call through NAT (the latter is FW's end-to-end check in FWDEV#217).

Scope

1. Definitions. linksys/usp_framework#85 adds firewall/sip_alg.yaml (Enable, writable, required). Vendor it and regenerate. If it is not merged when work starts, generate contract-first from it and keep a post-merge recheck list in this issue.
2. Service. Add the SIP ALG read and write to UspAdministrationService, beside UPnP. USP errors map to ServiceError.
3. UI. A SIP ALG card on the Administration page, holding one AppSwitch. Save-based like the UPnP card (dirty guard + Save); nothing is written when the switch is flipped.
4. Copy. Reuse the 1.x administrationApplicationLayerGateway string ("Application Layer Gateway (SIP)"), which already exists in all 26 locales on main.

Implementation notes (checked against dev-2.7.3 @ d21530432, 2026-10-16)

• Generate only sip_alg.yaml. PrivacyGUI vendors usp-codegen 0.17.0; the 0.18.1 upgrade is [USP] Migrate to usp-codegen 0.18.0: multi-instance tables are lists, no fixed-instance reads #1654 and is still open. Take firewall/sip_alg.yaml from linksys/usp_framework#85 and run the vendored binary on that one file, as feat(advanced, wifi): UPnP switch and client/node steering switches (#1660, #1661) #1674 did for UPnP. Pass --client-class 'UspClient' as well as --client-import; without it the output takes UspService and does not compile. Checked on 2026-10-16: it generates SipAlg with fetch() and update(enable:), and no other generated file changes.
• Copy the string from main. administrationApplicationLayerGateway is in all 26 locales on main (1.x) and in none on dev-2.7.3, so copy all 26 entries across.
• Write only what changed. Today UspAdministrationNotifier.performSave always writes UPnP, because the page had one switch. With two, compare settings.current against settings.original and send only the changed switches. "One Save writes both" (below) means both Sets in one Save, not one combined Set: UPnP and SIP ALG are owned by different USP services.
• One lock, one window. uspMutationLockProvider.withLock has a 30 s default. UPnP answers in under 2 s and SIP ALG in about 9 s, so one lock around both fits; keep the existing TimeoutException → TimeoutError fold.
• The re-read after a failure (_rereadAfterFailure) re-reads the whole page, so it covers the new switch once fetch() returns it.
• Test fixtures. test/mocks/test_data/scenes/administration_scene_data.dart and test/mocks/provider_overrides/mock_administration.dart build AdministrationSettings; both need the new field. The page's layout-gate cells are the page.administration rows in test/fixtures/overflow_baselines/page.tsv.
• Same page as Administration: management over Wi-Fi switch, on FLWRT 2.0's RULE_MGMT_WIFI_ACCESS (ref FWDEV#216) #1696 (management over Wi-Fi). Build this one first; Administration: management over Wi-Fi switch, on FLWRT 2.0's RULE_MGMT_WIFI_ACCESS (ref FWDEV#216) #1696 adds a third switch on top of it.

Out of scope

• The other ConnectionTracking helpers (FTP, H323, PPTP, ...): the firmware does not serve them.
• Management access and Express Forwarding: stay in [Advanced] Administration Settings Not Supported — Management, UPnP, ALG, Express Forwarding #875.
• A capability gate. The shipping firmware has the leaf, and we do not design for older firmware in this phase.

Acceptance criteria

• The Administration page shows a SIP ALG switch that reads Device.Firewall.ConnectionTracking.SIP.Enable; on a factory-default router it reads off.
• Turning it on and saving sends one Set of Enable=1. Reading back gives 1, and sip is in the lan and guest helper lists on the bench.
• Turning it off and saving sends Enable=0, reads back 0, and removes sip from both lists.
• The value survives a reboot.
• A failed Set shows an error and leaves the switch at the device's value.
• With both the UPnP and the SIP ALG switch changed, one Save writes both.
• Save shows its busy state for the whole ~9 s Set and does not time out.
• Leaving the page with an unsaved change triggers the dirty guard.
• Unit tests for the service and the notifier; the Administration page's layout-gate cells pass with the new card.

Related

• [Advanced] Administration Settings Not Supported — Management, UPnP, ALG, Express Forwarding #875: parent gap ticket. The ALG section becomes done when this ships.
• UPnP: on/off switch on the Administration page, on FLWRT 2.0's Device.UPnP (ref FWDEV#190) #1660: the UPnP switch on the same page.
• [MASTER] Feature inventory re-baselined on FW 2.0.2 — UI implementation × firmware support #1612: master inventory.
• linksys/FWDEV#217: FW work (linksys/feed_usp#41, linksys/targets#251).
• linksys/usp_framework#85: the definition.
• linksys/Architecture#210: parity matrix.