overlay: point the locked-out visitor at an address, not a hostname

[widgetii]

Problem

Post-merge review on #2346: a non-interactive SSH attempt against an unclaimed camera is
refused with a pointer at http://<hostname>/ — a name only the camera itself resolves, so
pasting it into a browser on the user's machine goes nowhere:

zig@futurae:~$ ssh root@172.17.32.100 'I agree'
This camera has not been set up yet, so it has no shell to offer.
Log in interactively (ssh root@gk7205v200-imx307, or the serial console),
or open http://gk7205v200-imx307/ in a browser, to set a root password.

What this does

Whoever hit this refusal reached the camera over SSH, and dropbear records the address they
used in SSH_CONNECTION ("client-ip port server-ip port") — the one address their network
provably routes. The refusal now names that address for both the ssh root@… hint and the
URL. The hostname stays only as the fallback for a local exec with no connection to read,
and an IPv6 literal gets brackets in the URL alone (a browser wants them, ssh refuses them).

Hardware tested on

hi3516ev300, imx335 lab bench camera (dlab), running the merged #2346 bits with this
script installed and root's shadow/passwd reset to the unclaimed state.

Evidence

Before — the review paste above (and identical on this camera).

After, reaching the camera by IP and by DNS name — both print the address the client used:

$ ssh root@10.216.128.68 'id'
This camera has not been set up yet, so it has no shell to offer.
Log in interactively (ssh root@10.216.128.68, or the serial console),
or open http://10.216.128.68/ in a browser, to set a root password.

$ ssh root@hi3516ev300-imx335.dlab.torturelabs.com 'I agree'
This camera has not been set up yet, so it has no shell to offer.
Log in interactively (ssh root@10.216.128.68, or the serial console),
or open http://10.216.128.68/ in a browser, to set a root password.

The same session then also exercised, on the merged majestic, the browser door end to end:
POST /setup without eula → 400 with the enforcement sentence; with
eula=accepted&eula_lang=ru → 200, /etc/eula-accepted = 1.0 ru web 2026-09-01T20:11:23Z,
and the next SSH login walked the (updated) claim shell transparently and repaired
/etc/passwd — the claimed-camera path of the edited script.

test_shell_parse.sh (134 scripts) and STRICT=1 test_strip_shell_comments.sh pass.

Scope

• No kernel patches under general/package/all-patches/linux/ (those go to OpenIPC/linux)
• No files specific to a single retail camera model (those go to OpenIPC/builder)
• No probing or bring-up tooling (that goes to OpenIPC/ipctool)
• Nothing under general/overlay/ or in a shared load_<vendor> script hardcodes a value specific to my board
• Package sources come from an OpenIPC repository, and any version bump keeps at least the specificity of the pin it replaces (a new package should pin a full 40-character SHA)
• No LD_PRELOAD, and no binaries that cannot be rebuilt from source
• New code is selected by a defconfig, so CI actually builds it

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Use reachable SSH address in unclaimed-camera guidance

🐞 Bug fix 🕐 10-20 Minutes

AI Description

• Use SSH_CONNECTION’s server address in unclaimed-camera login and browser guidance.
• Bracket IPv6 literals only in URLs while retaining the hostname fallback.

Diagram

graph TD
  A["SSH client"] --> B["Dropbear environment"] --> C["Claim shell"] --> H{"Address available?"}
  H -- "SSH address" --> D{"IPv6 address?"} --> E["Bracket URL"] --> G["Refusal guidance"]
  H -- "Hostname fallback" --> F["Plain URL"] --> G
  D -- "IPv4 or name" --> F

Loading

High-Level Assessment

Using SSH_CONNECTION’s server-address field is the best source of truth because it identifies the destination the client demonstrably reached. Continuing to use the hostname, performing reverse DNS, or probing local interfaces would be less reliable and could advertise an unroutable address; the hostname fallback appropriately covers local execution without connection metadata.

Files changed (1) +14 / -2

Bug fix (1) +14 / -2

openipc-claimShow the reachable server address in lockout guidance +14/-2

Show the reachable server address in lockout guidance

• Extracts the server address from SSH_CONNECTION for interactive-login and browser setup hints, with the local hostname retained as a fallback. It also brackets IPv6 literals for URLs without adding invalid brackets to SSH destinations.

general/overlay/usr/sbin/openipc-claim

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can describe a rule in plain language on the Rules page and Qodo drafts it for you

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗