rebase onto main (post-#836/#839/#842 merges + cross-family review base): fix(packaging): IPv6 disabled globally until captivity is v6-aware (#783 mitigation)

Author: Amperstrand

.github/workflows/test.yml

@@ -314,6 +314,18 @@ jobs:
           # decoration); each was a reader/writer disagreement this table
           # would have caught.
           bash tests/contract/check-ssid-naming.sh
+      - name: NDS pre-auth allowlist nft ordering check
+        run: bash tests/contract/check-nds-preauth-nft.sh
+      - name: nft guard interface defines check
+        run: bash tests/contract/check-nft-interface-defs.sh
+      - name: gatewayinterface adoption check
+        run: bash tests/contract/check-gatewayinterface-adoption.sh
+      - name: firewall zone-ref resolution check
+        run: bash tests/contract/check-firewall-zone-refs.sh
+      - name: wifi rebind guard check
+        run: bash tests/contract/check-wifi-rebind-guard.sh
+      - name: topology self-check contract
+        run: bash tests/contract/check-topology-selfcheck.sh
 
   deps-and-imports:
     runs-on: ubuntu-latest

.ngit/act/workflows/test.yml

@@ -196,6 +196,16 @@ jobs:
         run: bash tests/contract/check-ssid-format.sh
       - name: SSID naming contract (the matcher's acceptance table)
         run: bash tests/contract/check-ssid-naming.sh
+      - name: NDS pre-auth allowlist nft ordering check
+        run: bash tests/contract/check-nds-preauth-nft.sh
+      - name: nft guard interface defines check
+        run: bash tests/contract/check-nft-interface-defs.sh
+      - name: firewall zone-ref resolution check
+        run: bash tests/contract/check-firewall-zone-refs.sh
+      - name: wifi rebind guard check
+        run: bash tests/contract/check-wifi-rebind-guard.sh
+      - name: topology self-check contract
+        run: bash tests/contract/check-topology-selfcheck.sh
 
   deps-and-imports:
     runs-on: ubuntu-latest

changelog.d/756-ap-rebind-guarded.fixed.md

@@ -0,0 +1,20 @@
+- **Setup never binds an AP to a network that does not exist, never silently
+  renames an operator-chosen SSID, and never silently opens an operator's
+  AP.** On a split-plane DUT whose config has no `network.lan`, the
+  unconditional `network=lan` rebind bridged every AP to a ghost network —
+  clients associate, DHCP dies, the portal is unreachable — and the staged
+  operator SSID was silently renamed on top (bench-verified on rc1, exactly
+  the verdict's repro). The binding is now decided: stock routers keep the
+  byte-identical `lan`; a config without it adopts the network owning the NDS
+  gatewayinterface (the portal plane); a config with neither preserves the
+  section's binding or leaves it unbound — never a ghost, every non-stock
+  decision logged. The SSID follows the one-way discipline of the hostname
+  (#444): machine-shaped names (empty, the current derivation,
+  `<anything>-<device code>`) re-derive from the stored code; an operator's
+  name is preserved and said so — and an adopted operator section keeps its
+  encryption untouched (the one-way rewrite is about generated names, never
+  credentials), while the module's own public APs stay open by contract. The
+  postinst now runs a topology self-check: every enabled AP a member of an
+  existing bridge, exactly one connected route per portal subnet — the
+  silent-blackhole signatures — named loudly in syslog
+  ([#786](https://github.com/OpenTollGate/tollgate-module-basic-go/pull/786)).

changelog.d/782-nds-preauth-allowlist-executes.fixed.md

@@ -0,0 +1,16 @@
+- **The NDS pre-auth allowlist actually executes now — rendered into the
+  enforcement chain, ahead of its first rule.** nodogsplash compiles
+  `preauthenticated_users` into priority-0 chains, but the package's own
+  `nds_enforce_forward` chain drops/rejects at priority −1 — the compiled
+  accepts never ran, so every allowlisted pre-auth flow (the
+  top-up-before-pay mint access) died (bench-verified on rc1 with
+  packet-level attribution). `tollgate-nds-preauth-render` now emits
+  `20-nds-enforce.nft` with the allowlist's accepts as the chain's FIRST
+  rules — the position the kernel honours, because a base chain's `accept`
+  verdict ends evaluation in that chain only (a separate earlier-priority
+  allow chain, this fix's first shape, was refuted live on an nft 1.1.7 rig
+  and removed). Unparseable, non-tcp/udp, DNS-destination and out-of-range
+  entries are refused loudly rather than guessed at; the shipped default
+  file is byte-identical to the renderer's empty-allowlist output by
+  contract test; convergence runs at install/upgrade/boot and on
+  nodogsplash config commits (#754, #782).

changelog.d/783-ipv6-global-disable.fixed.md

@@ -0,0 +1,11 @@
+- **IPv6 is disabled globally on the router until captivity is v6-aware.** The rc1
+  bench caught a pre-auth client fetching the real internet over IPv6 (AAAA) while
+  the identical IPv4 state was correctly captive (#783): nodogsplash manages only
+  the IPv4 dimension, and the existing LAN-side disable from #148 (`ra`/`dhcpv6`
+  off, `ip6assign=0`) does not cover a v6-capable WAN. `setup_disable_ipv6` now
+  also clears `network.lan.ipv6`, sets `network.wan.ipv6='0'`, and disables the
+  stock `wan6` section when present (a missing section is adoption, not an
+  error), re-asserted on every setup pass so upgrades converge too. Proper
+  v6-aware captivity stays tracked in #783 (post-0.6.0); #794 pins the test axis
+  ([#783](https://github.com/OpenTollGate/tollgate-module-basic-go/issues/783))
+  ([#815](https://github.com/OpenTollGate/tollgate-module-basic-go/pull/815)).

changelog.d/784-nft-guards-interface-defines.fixed.md

@@ -0,0 +1,14 @@
+- **The nftables guards no longer hardcode the captive bridge's name — a
+  renamed bridge keeps its API access instead of silently blackholing.**
+  The shipped guards (20/30/31/32) matched `br-lan` by literal; an operator
+  renaming the bridge lost the portal→:2121 path with nothing in the log
+  naming the cause (bench-verified on rc1: the guard's own drop counter
+  doing the killing). The guards now resolve `$tg_portal_if` /
+  `$tg_private_if` from `00-tollgate-defs.nft`, rendered from nodogsplash's
+  `gatewayinterface` and the module-owned private bridge by
+  `tollgate-nft-interfaces-render` — with a shipped static default so the
+  defines resolve before the first render, a service-start WARN naming the
+  expected interface when it does not exist, and every fallback said aloud.
+  The rendered `20-nds-enforce.nft` (the #754 rescue) carries the same
+  defines: the renderer's template and the shipped file are byte-identical
+  by contract test (#757, #784).

changelog.d/785-firewall-zone-refs-resolved.fixed.md

@@ -0,0 +1,17 @@
+- **A renamed firewall zone no longer silently un-ships the module's firewall
+  rules — the zone refs follow the router's own config and a skipped rule
+  says so in logread.** The package's firewall sections referenced the stock
+  zone by name; fw4 skips a wrong-name section with exit 0 and nothing in
+  syslog, so a zone rename left a portal that appeared to work with no rules
+  (bench-verified on rc1: the rule vanished from the ruleset and a trusted
+  client lost forwarding with only the zone name differing). The zone that
+  owns the captive bridge is now resolved from the NDS gatewayinterface
+  through the network config at section creation and on every setup pass,
+  with a warned fallback to the stock name when unresolvable — and every
+  fallback warning reaches both the setup log and syslog; a referenced zone
+  that does not exist is named on both surfaces too, and the postinst
+  surfaces fw4's own skip diagnostics instead of discarding them. Only the
+  captive-side rule (`tollgate_in`) is resolved; the wan-side
+  `tollgate_protocol` ref is asserted-loud rather than resolved — there is
+  no authoritative wan-zone source equivalent to the gatewayinterface
+  (#755, #785).

packaging/Makefile

@@ -144,7 +144,14 @@ wait_for_iface br-private || echo "Note: br-private not found — this is expect
 
 echo "Reloading remaining services..."
 wifi reload 2>/dev/null || true
-/etc/init.d/firewall reload 2>/dev/null || true
+/etc/init.d/firewall reload >/tmp/tollgate-fw4-reload.log 2>&1 || true
+# fw4 skips a section whose zone/interface ref is wrong — exit 0, stderr
+# only, never logread: exactly the silent-skip #755 is about. Surfacing the
+# skip diagnostics into syslog is the difference between an operator seeing
+# one ERROR line and debugging "the portal works but nothing is enforced".
+if grep -q "specifies invalid value\|skipped" /tmp/tollgate-fw4-reload.log 2>/dev/null; then
+    logger -t tollgate-setup "fw4 reload skipped section(s): $$(grep -E 'specifies invalid value|skipped' /tmp/tollgate-fw4-reload.log | head -n 3 | tr '\n' ' ')"
+fi
 /etc/init.d/dnsmasq restart 2>/dev/null || true
 /etc/init.d/uhttpd restart 2>/dev/null || true
 /etc/init.d/nodogsplash restart 2>/dev/null || true
@@ -157,6 +164,13 @@ else
     echo "Warning: /etc/init.d/tollgate-wrt not found, skipping service start"
 fi
 
+# The #756 verdict's postinst self-check: every enabled AP a member of an
+# existing bridge, exactly one connected route per portal subnet. Runs AFTER
+# the network/firewall convergence above; assert-style and loud (syslog +
+# stdout) but never fails the install — it reports topology damage, not a
+# packaging error. Operators can re-run it by hand.
+/usr/local/bin/tollgate-topology-selfcheck || true
+
 echo "Post-installation script completed successfully"
 exit 0
 endef
@@ -214,6 +228,9 @@ define Package/$(PKG_NAME)/install
 
 	$(INSTALL_DIR) $(1)/usr/local/bin
 	$(INSTALL_BIN) $(PKG_MAKEFILE_DIR)files/usr/local/bin/first-login-setup $(1)/usr/local/bin/
+	$(INSTALL_BIN) $(PKG_MAKEFILE_DIR)files/usr/local/bin/tollgate-nds-preauth-render $(1)/usr/local/bin/
+	$(INSTALL_BIN) $(PKG_MAKEFILE_DIR)files/usr/local/bin/tollgate-nft-interfaces-render $(1)/usr/local/bin/
+	$(INSTALL_BIN) $(PKG_MAKEFILE_DIR)files/usr/local/bin/tollgate-topology-selfcheck $(1)/usr/local/bin/
 
 	$(INSTALL_DIR) $(1)/etc/tollgate
 	$(INSTALL_DIR) $(1)/etc/tollgate/ecash
@@ -279,6 +296,7 @@ FILES_$(PKG_NAME) += \
 	/etc/crontabs/root \
 	/lib/upgrade/keep.d/tollgate \
 	/etc/hotplug.d/iface/95-tollgate-restart \
+	/etc/nftables.d/00-tollgate-defs.nft \
 	/etc/nftables.d/20-nds-enforce.nft \
 	/etc/nftables.d/30-backend-firewall.nft \
 	/etc/nftables.d/31-admin-board-not-guest-reachable.nft \

packaging/files/etc/init.d/tollgate-wrt

@@ -36,11 +36,36 @@ start_service() {
     procd_set_param respawn 3 5 0
 
     procd_close_instance
-    
+
+    # Fail loudly when the guards' interfaces are missing (#757's ask): the
+    # nft guards silently dropping a renamed bridge's traffic is the exact
+    # blind spot this replaces — a WARN naming the expected interface turns
+    # a client-side mystery into one logread line.
+    _portal_if="$(uci -q get nodogsplash.@nodogsplash[0].gatewayinterface 2>/dev/null || echo br-lan)"
+    if ! ip link show "$_portal_if" >/dev/null 2>&1; then
+        logger -s -t tollgate-wrt -p user.warn "WARN: the captive-portal interface '$_portal_if' (nodogsplash gatewayinterface) does not exist on this router — the nft guards and nodogsplash itself cannot serve it; rename follow-up missing? (#757)"
+    fi
+
     # Log the start for debugging
     echo "TollGate basic started with nodogsplash" > /tmp/basic.log
 }
 
+# Operator edits to nodogsplash uci (pre-auth allowlist changes among them)
+# re-render the priority -2 allow fragment and reload the firewall — WITHOUT
+# bouncing the daemon (#754: the allowlist must track uci, and nodogsplash's
+# own restart reloads nothing in /etc/nftables.d, which fw4 owns).
+service_triggers() {
+    procd_add_reload_trigger nodogsplash
+}
+
+reload_service() {
+    # Both nft fragments derive from config nodogsplash feeds on: the -2
+    # pre-auth allowlist (#754) and the interface defines the guards
+    # resolve (#757). One commit, one converge, no daemon bounce.
+    /usr/local/bin/tollgate-nds-preauth-render --reload
+    /usr/local/bin/tollgate-nft-interfaces-render --reload
+}
+
 stop() {
     # Log the stop for debugging
     echo "TollGate basic stopped and nodogsplash disabled" >> /tmp/basic.log

packaging/files/etc/nftables.d/00-tollgate-defs.nft

@@ -0,0 +1,11 @@
+# The interface defines every /etc/nftables.d guard resolves. This shipped
+# file is the STATIC DEFAULT (the shipped bridge names); the renderer
+# (/usr/local/bin/tollgate-nft-interfaces-render, run by 99-tollgate-setup
+# and the tollgate-wrt reload trigger) overwrites it from the router's own
+# config — nodogsplash's gatewayinterface and the module-owned private
+# bridge — so a renamed captive bridge keeps the guards matching it (#757).
+# The define must always exist: an unresolved $tg_portal_if would fail the
+# whole fw4 ruleset load, which is why the default ships rather than being
+# generated from nothing. This file sorts first; the guards follow.
+define tg_portal_if = "br-lan"
+define tg_private_if = "br-private"