Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[M-1..M-5] MAC identity weaknesses — client-declared identity, shared fallback bucket, normalization gap, loopback XFF trust

Abierto
  • ¿Algo no está bien?
#808 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
12/100
Tipo de issue
Error
Claridad
Necesita aclaración
Estado de actividad
Activo
Stack tecnológico
go
Área
backend, payments, security

Línea de trabajo

Start by checking whether each finding still reproduces on upstream main: the quote-to-MAC binding in lightning.go (around lines 159-169), ValidateMACAddress in utils.go:26, net.ParseMAC in valve.go:48, and getIP in main.go (around lines 923-941). The fix needs a design decision on binding payments to the ARP-resolved MAC, so it is not a first-timer task. Done means each of M-1 to M-4 is confirmed or closed with evidence.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Migrated from Amperstrand/tollgate-module-basic-go#80 as part of the fork retirement — OpenTollGate/tollgate-module-basic-go is the single source of truth; the fork issue carries the original discussion and any lab evidence. Retirement plan: #758.]

CONSOLIDATED ISSUE covering multiple MAC tracking weaknesses:

M-1 (High, functional/security hybrid): The MAC is a fully client-declared identity. ?mac=/body mac is accepted unvalidated (beyond format) on every payment path; quote↔MAC binding is enforced (lightning.go:159-169) but the bound value is attacker-declared. Pay-for-anyone's-MAC is possible (gifting/session-extension).

M-2 (Medium): Fallback MAC bucket. Clients missing from dhcp.leases AND ARP (static IPs, expired entries) all share session key 00:00:00:00:00:00: allotments pool, usage attribution conflates payers, ndsctl auth 00:00:00:00:00:00 fails for a non-existent client → the payer's token is consumed with no grantable session.

M-3 (Low): MAC normalization gap. ValidateMACAddress (utils.go:26) accepts hyphen/dot/bare-hex formats that map to different session-map keys than the colon-lowercase form from getMacAddress; net.ParseMAC (valve.go:48) rejects bare-hex → grant fails at valve after session mutation. NDS passes uppercase colon-form while dhcp.leases is lowercase — mixed-case keys for the same device.

M-4 (Low): Loopback XFF trust. getIP (main.go:923-941) honors X-Real-Ip/X-Forwarded-For only from loopback peers — any on-router forwarder makes /balance, /usage attribution and rate-limit bucketing spoofable.

M-5 (negative note): No MAC→shell injection found. Every sink is argv-exec behind net.ParseMAC or hex-regex validation.

Fix: Bind payments to ARP-resolved MAC where possible; normalize MAC formats consistently; validate XFF headers more strictly.

Evidence: /home/ubuntu/src/tollgate_audit_report_2026-08-26.md §5, lines 78-82; §7, line 150

Migrated 2026-10-09. Applicability to current upstream main (4614ac2, post-rc1) was not re-verified during migration — confirming whether the finding still reproduces upstream is this issue's first task.

Lenguaje dominante
Go
Estrellas
12
Forks
14
Merge medio
1 d 8 h
PR fusionados (30 d)
201

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de OpenTollGate/tollgate-module-basic-go

Todos los issues de OpenTollGate/tollgate-module-basic-go

Issues similares

Más issues de Go

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.