mirror of
https://github.com/maziggy/bambuddy.git
synced 2026-09-30 03:01:21 +02:00
maziggy
fc746ae218
When running multiple virtual printers with different access codes on separate bind IPs, FTP connections were always routed to the wrong VP. Root cause: the iptables REDIRECT rule (990→9990) rewrites the destination IP to the incoming interface's primary address. With Linux's weak host model (arp_filter=0), packets for secondary IPs arrive on the primary interface, and REDIRECT sends them all to the first VP's FTP server. MQTT was unaffected because port 8883 had no redirect. Fix: FTP server now binds directly to port 990 (standard implicit FTPS), eliminating the iptables redirect entirely. Requires CAP_NET_BIND_SERVICE (already set in the systemd service file and Docker image). Also removed a global asyncio set_exception_handler() in the MQTT server that was overwritten by each VP instance, causing spurious "Unhandled exception in client_connected_cb" errors on startup. Changes: - FTP_PORT: 9990 → 990 (ftp_server.py) - Removed set_exception_handler() from MQTT server - Updated Dockerfile, docker-compose.yml port mappings - Deprecated --redirect-990 in install script - Updated wiki: removed iptables instructions for all platforms - Added migration guide (docs/migration-vp-ftp-port.md) - Added unit tests for port constant and no-global-state invariant
21 lines
756 B
Python
21 lines
756 B
Python
"""Tests for Virtual Printer FTP server port configuration."""
|
|
|
|
from backend.app.services.virtual_printer.ftp_server import FTP_PORT
|
|
|
|
|
|
class TestFTPPort:
|
|
"""Verify FTP server uses the standard FTPS port."""
|
|
|
|
def test_ftp_port_is_990(self):
|
|
"""FTP must bind to port 990 (standard implicit FTPS).
|
|
|
|
Port 9990 required an iptables REDIRECT rule which rewrites
|
|
the destination IP to the interface's primary address, breaking
|
|
multi-VP setups with different bind IPs and access codes.
|
|
"""
|
|
assert FTP_PORT == 990, (
|
|
f"FTP_PORT must be 990 (standard FTPS), not {FTP_PORT}. "
|
|
"Using a non-standard port requires iptables REDIRECT which "
|
|
"breaks multi-VP setups."
|
|
)
|