nftables.d guards hardcode br-lan — backend unreachable from portal side on renamed bridges (30-backend-firewall, 31-admin-board)
维护者通常 2 天内回复
评估
- 难度
- 3/5
- 预计耗时
- 1-2 天
- 新手友好度
- 35/100
- Issue 类型
- 缺陷
- 描述清晰度
- 基本清楚
- 活跃度
- 活跃
- 技术栈
- go, linux
调研方向
Start with the two nftables files named in the issue: /etc/nftables.d/30-backend-firewall.nft and 31-admin-board, where each rule hardcodes iifname "br-lan". The issue also asks for a startup check in the Go service that logs an error naming the expected bridge when the interface is missing. Done means the portal interface is derived from the NDS gatewayinterface or installed topology rather than a literal, and a missing interface produces a clear log message. The issue's design questions remain open, so confirm the approach with maintainers first.
由索引模型根据 Issue 内容生成。
描述
Migrated from Amperstrand/tollgate-module-basic-go#101 as part of the fork retirement — OpenTollGate/tollgate-module-basic-go is the single source of truth; the fork issue carries the original discussion and any lab evidence. Retirement plan: see the tracking issue linked in the migration comment there.]
Class: silent backend loss on non-stock bridge names
/etc/nftables.d/30-backend-firewall.nft and 31-admin-board hardcode
iifname "br-lan". The 30- file's own comment acknowledges it ("operators
who rename their bridge will lose API access"), but the failure is
silent: the portal SPA cannot reach :2121, payments never arrive, and the
operator sees client-side symptoms only.
On our split-plane bench DUTs this combined with the setup-rebind issue
(#100) to blackhole the whole payment leg; it took a wire-level
reproduction to localize.
Ask
- Derive the portal interface from the NDS gatewayinterface (or the
installed topology) at package install/upgrade time instead of a
compile-time literal. - Fail loudly: if the referenced interface does not exist at service
start, log an error naming the expected bridge (a WARN in klog would
have saved a full debug session).
Companion bench-side context: the same naming assumption exists in the
shipped NDS users_to_router generation ordering (bench issue: pre-auth
allowlist shadowed by catch-all drop — the "payments never reach the
backend" signature).
- 主要语言
- Go
- 星标
- 12
- 派生
- 14
- 平均合并
- 4 天 19 小时
- 30 天内合并 PR
- 193
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
OpenTollGate/tollgate-module-basic-go 的其他 Issue
-
难度 1/5 1-3 小时 新手友好度 75/100
OpenTollGate/tollgate-module-basic-go#1208 ·
维护者通常 2 天内回复
-
难度 1/5 1 小时以内 新手友好度 85/100
OpenTollGate/tollgate-module-basic-go#1159 ·
维护者通常 2 天内回复
-
Degraded-mode hygiene follow-ups: dead walletNotInitializedError() + main.go's startup log still over-promises mint recovery可能已有人在做 @Amperstrand 于 10 天前认领。 未关闭
难度 2/5 1-3 小时 新手友好度 72/100
OpenTollGate/tollgate-module-basic-go#1135 · 1 条评论 ·
维护者通常 2 天内回复
-
setup_uhttpd_portal hardcodes the GUEST portal docroot to the TollGate path — the brand token cannot select a re-brand guest portal可能已有人在做 @Amperstrand 于 7 天前认领。 未关闭
难度 2/5 1-3 小时 新手友好度 72/100
OpenTollGate/tollgate-module-basic-go#1122 ·
维护者通常 2 天内回复
-
changelog: dependency-security sweep missing from [Unreleased] [Amperstrand fork #105 review debt]未关闭
难度 1/5 1 小时以内 新手友好度 72/100
OpenTollGate/tollgate-module-basic-go#1055 · 1 条评论 ·
维护者通常 2 天内回复
查看 OpenTollGate/tollgate-module-basic-go 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 67/100
-
Component: Backup and Restore Type: Bug
难度 2/5 1-3 小时 新手友好度 76/100
维护者通常 1 天内回复
-
needs-acceptance wg/router-models-inference-runtime
难度 2/5 1-3 小时 新手友好度 88/100
vllm-project/semantic-router#6018 ·
维护者通常 2 天内回复
-
难度 1/5 1 小时以内 新手友好度 88/100
eugenioenko/ttt#1461 ·
维护者通常 1 天内回复
-
tech-debt
难度 2/5 1-3 小时 新手友好度 88/100
维护者通常 1 天内回复