Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

NDS pre-auth allowlist ineffective: nds_enforce_forward (nft prio −1) rejects before the allow chain can mark/accept

Abierto
  • ¿Algo no está bien?
#754 4 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

  • #782 de @Amperstrand — cerrado sin fusionar

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
42/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
go
Área
networking

Línea de trabajo

Start by reviewing the nftables chain generation for nds_enforce_forward and the preauthenticated-users allowlist; the issue does not name the relevant files or tests. Use the cited benchmark report and session record for runtime evidence, then verify that pre-auth connections to the listed mint ports are accepted before the reject rule.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

release:v0.6.0

Migrated from Amperstrand/tollgate-module-basic-go#97 as part of the fork retirement — OpenTollGate/tollgate-module-basic-go is the single source of truth; the fork issue carries the original discussion and any lab evidence. Retirement plan: see the tracking issue linked in the migration comment there.]

Found live 2026-09-27 during the ESP32-wallet take against the NR7101 (gonuts-tollgate deployed, NDS 5.0.2):

Symptom: pre-auth clients cannot reach the accepted mints even though nodogsplash uci carries the intended preauthenticated_users entries (allow tcp port 3080/8190/8383 to 192.168.13.221). SYNs hit the compiled accept rule (counter increments) yet every connection dies — the device sees ICMP port-unreachable → lwIP EHOSTUNREACH.

Mechanism: nds_enforce_forward is a base chain at priority filter−1; its unmarked-br-lan-egress REJECT executes BEFORE the priority-0 fw4 chains (ndsTRU/ndsALW/…) can set the trusted mark or accept. The allowlist entries compile into a chain that runs too late. The 0x20000/0x30000 mark-accept rules only help already-marked traffic.

Runtime workaround used (removed post-take): nft insert rule inet fw4 nds_enforce_forward ip daddr <mint-host> tcp dport {…} counter accept ahead of the reject.

Evidence: conwrt-bench data/bench/s3-take-20260926-230924/REPORT.md + the nft dumps in the session record (sessions/2026-09-27-esp32-wallet-tollgate-take.md).

Product impact: pre-auth mint access (top-up-before-pay, the natural client flow) is broken on deployed builds — every client must be provisioned off-portal (pre-mined tokens or a PSK side-net, as our take did).

Fix direction: emit the preauth-allowlist accepts (or the trusted-mark sets) INTO the priority−1 enforce chain, ahead of its reject — or move the reject to a later priority.

Lenguaje dominante
Go
Estrellas
12
Forks
14
Merge medio
3 d 21 h
PR fusionados (30 d)
269

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de OpenTollGate/tollgate-module-basic-go

Todos los issues de OpenTollGate/tollgate-module-basic-go

Issues similares

Más issues de Go

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.