security/maltrail: don't override the Check Hostheaders setting - #5679
Open
Lux-WorldPC wants to merge 1 commit into
Open
security/maltrail: don't override the Check Hostheaders setting#5679Lux-WorldPC wants to merge 1 commit into
Lux-WorldPC wants to merge 1 commit into
Conversation
The template emitted CHECK_HOST_DOMAINS twice: once from the checkhostheader conditional and again below as a hardcoded false. maltrail's read_config() assigns config[name] = value unguarded while walking the file top to bottom, so the last occurrence won and the GUI toggle never took effect. The hardcoded line predates the option; cdf3620 added the conditional right above it without removing it. Closes opnsense#5489 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Important notices
Before you submit a pull request, we ask you kindly to acknowledge the following:
If AI was used, please disclose:
(
core/settings.py) for the duplicate-key behaviour, and to trace the template history.The fix is the one-line deletion proposed by the reporter in os-maltrail: CHECK_HOST_DOMAINS appears twice #5489. I reviewed and verified
each of those points before opening this PR.
Describe the problem
CHECK_HOST_DOMAINSis emitted twice in the generatedmaltrail.conf: once from thecheckhostheaderconditional, and again a few lines below as a hardcodedfalse.maltrail's
read_config()walks the file top to bottom and ends each iteration with a plainconfig[name] = value, with no guard, so the last occurrence wins. The trailing hardcoded linetherefore always overrides the GUI setting and pins
CHECK_HOST_DOMAINStofalse.The hardcoded line dates back to the initial template. The conditional block was later inserted
directly above it in cdf3620 ("security/maltrail: add hostheader checking", #3144) without removing
it, so Services -> Maltrail -> General -> Check Hostheaders has had no effect since the option was
introduced.
Describe the proposed solution
Drop the leftover hardcoded
CHECK_HOST_DOMAINS falseso the emitted value is the one selected inthe GUI. This is the fix suggested by @thwien in the issue.
Users who had the toggle off are unaffected (the conditional still emits
false); users who had iton now get the
truethey asked for.I left
PLUGIN_REVISIONalone, assuming the bump is done on your side as usual - happy to add it ifyou prefer.
Related issue
Closes #5489