From 413daf8ad58259f42cab4b34f189bd6e590a65c2 Mon Sep 17 00:00:00 2001 From: jochens Date: Fri, 2 Oct 2026 11:53:54 +0200 Subject: [PATCH 1/2] Issue 197: a physical link that is down is not filtered when it comes up --- .../00-report.md | 38 +++++++++++++++++++ .../01-diagnosis.md | 14 +++++++ 2 files changed, 52 insertions(+) create mode 100644 04-ISSUES/197-a-physical-link-that-is-down-is-not-filtered-when-it-comes-up/00-report.md create mode 100644 04-ISSUES/197-a-physical-link-that-is-down-is-not-filtered-when-it-comes-up/01-diagnosis.md diff --git a/04-ISSUES/197-a-physical-link-that-is-down-is-not-filtered-when-it-comes-up/00-report.md b/04-ISSUES/197-a-physical-link-that-is-down-is-not-filtered-when-it-comes-up/00-report.md new file mode 100644 index 0000000..1199623 --- /dev/null +++ b/04-ISSUES/197-a-physical-link-that-is-down-is-not-filtered-when-it-comes-up/00-report.md @@ -0,0 +1,38 @@ +--- +status: located +opened: 2026-10-02 +located-in: [mesh-host internal/outward (Links reported only the links carrying a default route)] +fixed-by: +amended-design: [] +--- + +# 197 — A physical link that is down is not filtered when it comes up + +## What was observed + +A sweep of every machine's filter on 2026-10-02. A laptop-class machine connected by its radio has a +wired port that was unplugged. Its filter guarded the radio and the tunnel, and accepted everything +arriving on any other link: + +``` +iifname != { "mesh0", "" } accept +``` + +The wired port was not in the list. Plugged in, everything arriving on it would have been accepted, +every port of the machine open to whatever network the cable reached. That would last until the +machine reported again and was pushed a new filter. + +## Why it matters + +**The filter's one rule about links fails open.** [ADR 0140](../../02-DECISIONS/0140-the-filter-constrains-what-arrives-from-outside.md) +has the filter constrain what arrives from outside, and has the machine say which links face outside. +Everything not named is treated as the machine's own, its containers and bridges. So a link the machine +fails to name is not filtered at all. The host named only the links carrying a default route at the +moment it reported. A cable plugged in later is the ordinary case for a laptop. A second wired network +that never carries the default route, such as a direct link to a storage box, is never named at all. + +## Open questions + +- A virtual link that faces outside (a VPN client's interface, a USB tether that appears as a virtual + device) has no physical device behind it. It is named only while it carries the default route. Is + that enough? diff --git a/04-ISSUES/197-a-physical-link-that-is-down-is-not-filtered-when-it-comes-up/01-diagnosis.md b/04-ISSUES/197-a-physical-link-that-is-down-is-not-filtered-when-it-comes-up/01-diagnosis.md new file mode 100644 index 0000000..bff05e8 --- /dev/null +++ b/04-ISSUES/197-a-physical-link-that-is-down-is-not-filtered-when-it-comes-up/01-diagnosis.md @@ -0,0 +1,14 @@ +# Diagnosis + +*2026-10-02.* + +**Located in `mesh-host` `internal/outward`.** `Links` read the kernel's routing tables and returned the +interfaces carrying a default route. An unplugged port carries none, so it was never reported, and the +controller rendered the filter around the links it was given. + +**The fix.** A link faces outside if it carries a default route **or** has a physical device behind it. +The kernel lists every interface under `/sys/class/net`, with a `device` entry for one backed by +hardware. A bridge, a veth, the tunnel and the loopback have none, so they stay the machine's own. The +wired port is now reported up or down, and the filter guards it before anything is plugged in. Tested +with a radio carrying the default route and an unplugged wired port beside a bridge, a veth, the docker +bridge, the tunnel and the loopback: the two physical links are reported, nothing else. -- 2.54.0 From 9bed54d3be93774211dc7f4b1ff43c0b2ecb8269 Mon Sep 17 00:00:00 2001 From: jochens Date: Fri, 2 Oct 2026 12:22:15 +0200 Subject: [PATCH 2/2] Issue 197 resolved: the wired port is guarded before it is plugged in --- .../00-report.md | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/04-ISSUES/197-a-physical-link-that-is-down-is-not-filtered-when-it-comes-up/00-report.md b/04-ISSUES/197-a-physical-link-that-is-down-is-not-filtered-when-it-comes-up/00-report.md index 1199623..c076999 100644 --- a/04-ISSUES/197-a-physical-link-that-is-down-is-not-filtered-when-it-comes-up/00-report.md +++ b/04-ISSUES/197-a-physical-link-that-is-down-is-not-filtered-when-it-comes-up/00-report.md @@ -1,8 +1,8 @@ --- -status: located +status: resolved opened: 2026-10-02 located-in: [mesh-host internal/outward (Links reported only the links carrying a default route)] -fixed-by: +fixed-by: mesh-host PR 66 (a link backed by a physical device is named outward, up or down), live 2026-10-02 amended-design: [] --- @@ -36,3 +36,8 @@ that never carries the default route, such as a direct link to a storage box, is - A virtual link that faces outside (a VPN client's interface, a USB tether that appears as a virtual device) has no physical device behind it. It is named only while it carries the default route. Is that enough? + +## Resolved (2026-10-02) + +Live on the affected machine after the host was delivered and one more push: its filter now guards the +radio, the tunnel and the unplugged wired port, before anything is plugged into it. -- 2.54.0