Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

NDS pre-auth allowlist ineffective: nds_enforce_forward (nft prio −1) rejects before the allow chain can mark/accept

Aperta
  • Qualcosa non va?
#754 4 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@Amperstrand ci sta già lavorando.

Dal 8/10/2026.

  • #782 di @Amperstrand — aperta

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
42/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
go
Ambito
networking

Direzione di ricerca

Start by reviewing the nftables chain generation for nds_enforce_forward and the preauthenticated-users allowlist; the issue does not name the relevant files or tests. Use the cited benchmark report and session record for runtime evidence, then verify that pre-auth connections to the listed mint ports are accepted before the reject rule.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

release:v0.6.0

Migrated from Amperstrand/tollgate-module-basic-go#97 as part of the fork retirement — OpenTollGate/tollgate-module-basic-go is the single source of truth; the fork issue carries the original discussion and any lab evidence. Retirement plan: see the tracking issue linked in the migration comment there.]

Found live 2026-09-27 during the ESP32-wallet take against the NR7101 (gonuts-tollgate deployed, NDS 5.0.2):

Symptom: pre-auth clients cannot reach the accepted mints even though nodogsplash uci carries the intended preauthenticated_users entries (allow tcp port 3080/8190/8383 to 192.168.13.221). SYNs hit the compiled accept rule (counter increments) yet every connection dies — the device sees ICMP port-unreachable → lwIP EHOSTUNREACH.

Mechanism: nds_enforce_forward is a base chain at priority filter−1; its unmarked-br-lan-egress REJECT executes BEFORE the priority-0 fw4 chains (ndsTRU/ndsALW/…) can set the trusted mark or accept. The allowlist entries compile into a chain that runs too late. The 0x20000/0x30000 mark-accept rules only help already-marked traffic.

Runtime workaround used (removed post-take): nft insert rule inet fw4 nds_enforce_forward ip daddr <mint-host> tcp dport {…} counter accept ahead of the reject.

Evidence: conwrt-bench data/bench/s3-take-20260926-230924/REPORT.md + the nft dumps in the session record (sessions/2026-09-27-esp32-wallet-tollgate-take.md).

Product impact: pre-auth mint access (top-up-before-pay, the natural client flow) is broken on deployed builds — every client must be provisioned off-portal (pre-mined tokens or a PSK side-net, as our take did).

Fix direction: emit the preauth-allowlist accepts (or the trusted-mark sets) INTO the priority−1 enforce chain, ahead of its reject — or move the reject to a later priority.

Lingua principale
Go
Stelle
12
Fork
14
Merge medio
1g 8h
PR unite (30g)
205

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di OpenTollGate/tollgate-module-basic-go

Tutte le issue di OpenTollGate/tollgate-module-basic-go

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.