nftables.d guards hardcode br-lan — backend unreachable from portal side on renamed bridges (30-backend-firewall, 31-admin-board)

Cerrado
  • ¿Algo no está bien?
#757 2 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

@Amperstrand ya está trabajando en esto.

Desde el 8/10/2026.

  • #784 de @Amperstrand — abierto

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
35/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
go, linux
Área
infrastructure, networking

Línea de trabajo

Start with the two nftables files named in the issue: /etc/nftables.d/30-backend-firewall.nft and 31-admin-board, where each rule hardcodes iifname "br-lan". The issue also asks for a startup check in the Go service that logs an error naming the expected bridge when the interface is missing. Done means the portal interface is derived from the NDS gatewayinterface or installed topology rather than a literal, and a missing interface produces a clear log message. The issue's design questions remain open, so confirm the approach with maintainers first.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

release:v0.6.0

Migrated from Amperstrand/tollgate-module-basic-go#101 as part of the fork retirement — OpenTollGate/tollgate-module-basic-go is the single source of truth; the fork issue carries the original discussion and any lab evidence. Retirement plan: see the tracking issue linked in the migration comment there.]

Class: silent backend loss on non-stock bridge names

/etc/nftables.d/30-backend-firewall.nft and 31-admin-board hardcode
iifname "br-lan". The 30- file's own comment acknowledges it ("operators
who rename their bridge will lose API access"), but the failure is
silent: the portal SPA cannot reach :2121, payments never arrive, and the
operator sees client-side symptoms only.

On our split-plane bench DUTs this combined with the setup-rebind issue
(#100) to blackhole the whole payment leg; it took a wire-level
reproduction to localize.

Ask

  • Derive the portal interface from the NDS gatewayinterface (or the
    installed topology) at package install/upgrade time instead of a
    compile-time literal.
  • Fail loudly: if the referenced interface does not exist at service
    start, log an error naming the expected bridge (a WARN in klog would
    have saved a full debug session).

Companion bench-side context: the same naming assumption exists in the
shipped NDS users_to_router generation ordering (bench issue: pre-auth
allowlist shadowed by catch-all drop — the "payments never reach the
backend" signature).

Lenguaje dominante
Go
Estrellas
12
Forks
14
Merge medio
3 d 20 h
PR fusionados (30 d)
261

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de OpenTollGate/tollgate-module-basic-go

Todos los issues de OpenTollGate/tollgate-module-basic-go

Issues similares

Más issues de Go

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.