Fix unbound_dot: allow requests without domain parameter set #77
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
When creating a DNS over TLS rule in Opnsense, specifying a
target
attribute is required. One may also define one of the following optional parameters:domain
,port
orvalidate
(andreload
).Expected Behavior
According to the docs
domain
is not a required parameter.An Ansible task without the
domain
parameter set should therefore execute correctly.Actual Behavior
The
validate_domain
function called inunbound_dot.py
will throw anAttributeError: 'NoneType' object has no attribute 'find'
Changes
validate_domain
is only called ifdomain
is set.domain
set allows usage ofverify
instead.domain
norverify
is set, onlytarget
parameter is used.Discussion
Changing
match_fields
to allow matching only againsttarget
if neitherdomain
norverify
is set may lead to ansible operating on the wrong rule, if multiple rules with the sametarget
attribute are set.An alternative approach could be to always require either
verify
ordomain
parameter being set.However, since both are marked as optional, this will probably not solve the underlying issue.