Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[M-1..M-5] MAC identity weaknesses — client-declared identity, shared fallback bucket, normalization gap, loopback XFF trust

Aperta
  • Qualcosa non va?
#808 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
12/100
Tipo di issue
Bug
Chiarezza
Da chiarire
Stato di attività
Attiva
Stack tecnologico
go
Ambito
backend, payments, security

Direzione di ricerca

Start by checking whether each finding still reproduces on upstream main: the quote-to-MAC binding in lightning.go (around lines 159-169), ValidateMACAddress in utils.go:26, net.ParseMAC in valve.go:48, and getIP in main.go (around lines 923-941). The fix needs a design decision on binding payments to the ARP-resolved MAC, so it is not a first-timer task. Done means each of M-1 to M-4 is confirmed or closed with evidence.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Migrated from Amperstrand/tollgate-module-basic-go#80 as part of the fork retirement — OpenTollGate/tollgate-module-basic-go is the single source of truth; the fork issue carries the original discussion and any lab evidence. Retirement plan: #758.]

CONSOLIDATED ISSUE covering multiple MAC tracking weaknesses:

M-1 (High, functional/security hybrid): The MAC is a fully client-declared identity. ?mac=/body mac is accepted unvalidated (beyond format) on every payment path; quote↔MAC binding is enforced (lightning.go:159-169) but the bound value is attacker-declared. Pay-for-anyone's-MAC is possible (gifting/session-extension).

M-2 (Medium): Fallback MAC bucket. Clients missing from dhcp.leases AND ARP (static IPs, expired entries) all share session key 00:00:00:00:00:00: allotments pool, usage attribution conflates payers, ndsctl auth 00:00:00:00:00:00 fails for a non-existent client → the payer's token is consumed with no grantable session.

M-3 (Low): MAC normalization gap. ValidateMACAddress (utils.go:26) accepts hyphen/dot/bare-hex formats that map to different session-map keys than the colon-lowercase form from getMacAddress; net.ParseMAC (valve.go:48) rejects bare-hex → grant fails at valve after session mutation. NDS passes uppercase colon-form while dhcp.leases is lowercase — mixed-case keys for the same device.

M-4 (Low): Loopback XFF trust. getIP (main.go:923-941) honors X-Real-Ip/X-Forwarded-For only from loopback peers — any on-router forwarder makes /balance, /usage attribution and rate-limit bucketing spoofable.

M-5 (negative note): No MAC→shell injection found. Every sink is argv-exec behind net.ParseMAC or hex-regex validation.

Fix: Bind payments to ARP-resolved MAC where possible; normalize MAC formats consistently; validate XFF headers more strictly.

Evidence: /home/ubuntu/src/tollgate_audit_report_2026-08-26.md §5, lines 78-82; §7, line 150

Migrated 2026-10-09. Applicability to current upstream main (4614ac2, post-rc1) was not re-verified during migration — confirming whether the finding still reproduces upstream is this issue's first task.

Lingua principale
Go
Stelle
12
Fork
14
Merge medio
1g 5h
PR unite (30g)
239

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di OpenTollGate/tollgate-module-basic-go

Tutte le issue di OpenTollGate/tollgate-module-basic-go

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.