Architecture: move port 2121 to loopback-only (defense-in-depth)
Maintainers usually reply within 1 day
Nobody has claimed this yet.
- #317 by @Amperstrand — closed without merging
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 25/100
Research direction
Read the full analysis in #213, then locate the backend listener configuration for port 2121 and review how WiFi clients currently reach it. The issue proposes binding the backend to loopback and fronting it with a minimal CGI or reverse proxy via uhttpd or nodogsplash. Done means WiFi clients no longer reach port 2121 directly while the payment flow remains reachable through the proxy.
Written by the indexing model from the issue text.
Description
Current state
The TollGate backend API binds to :2121 (all interfaces). Nodogsplash explicitly allows WiFi clients to reach it. This is by design (payment flow) but means every HTTP handler is remotely reachable.
Recommendation
Move backend to 127.0.0.1:2121. Front with a minimal CGI/reverse proxy via uhttpd or nodogsplash. WiFi clients never directly touch port 2121.
Priority
Low — no current exploitable handler bug in v0.5.0 (shell injection fixed in #104, SSRF fixed in #198, error sanitization in #202). This is defense-in-depth for future handler bugs.
See #213 for the full analysis.
- Dominant language
- Go
- Stars
- 12
- Forks
- 14
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 244
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from OpenTollGate/tollgate-module-basic-go
-
Session event emits the customer's MAC address in the p tag — spec-invalid value on every payment responsePossibly taken @Amperstrand claimed this 4 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
OpenTollGate/tollgate-module-basic-go#949 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
OpenTollGate/tollgate-module-basic-go#833 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
OpenTollGate/tollgate-module-basic-go#813 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
OpenTollGate/tollgate-module-basic-go#804 ·
Maintainers usually reply within 1 day
-
go-battery needs an ndsctl on PATH: TestPurchaseSessionGuardHoldsThroughTheOutcomeUnknownWindow fails on bare hosts (passes with stub)Possibly taken @Amperstrand claimed this 9 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
OpenTollGate/tollgate-module-basic-go#726 · 2 comments ·
Maintainers usually reply within 1 day
All issues in OpenTollGate/tollgate-module-basic-go
Similar issues
-
validateDeclaredPath lets control characters through into the Gradle init script's Groovy literalOpenagent-butler-finding agent-research bug ready-for-agent
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
jordansmall/spindrift#5821 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
apache/rocketmq-dashboard#7243 ·
Maintainers usually reply within 3 days
-
Missing example coverage: getClockPossibly taken @camunda-sdk-automation claimed this today. Opennew-operations
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
camunda/orchestration-cluster-api-go#75 · 2 comments ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 78/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
praetorianer777/Stator#465 ·
Maintainers usually reply within 1 day