Skip to content

Prevent DNS resolver host aliases from moving to the wrong host#237

Open
djlongy wants to merge 1 commit intopfsensible:masterfrom
djlongy:fix/dns-resolver-alias-misassignment
Open

Prevent DNS resolver host aliases from moving to the wrong host#237
djlongy wants to merge 1 commit intopfsensible:masterfrom
djlongy:fix/dns-resolver-alias-misassignment

Conversation

@djlongy
Copy link

@djlongy djlongy commented Mar 1, 2026

What this fixes

This fixes a DNS resolver bug where host aliases can end up attached to the wrong host after a playbook reorders the hosts list.

In plain terms: if one host has aliases and another does not, changing the order of those hosts can cause the alias-less host to incorrectly inherit the other host's aliases in config.xml.

Why this is a problem

That means the saved pfSense DNS resolver configuration no longer matches the playbook input:

  • aliases can appear under the wrong host
  • DNS records can be applied to the wrong entry
  • subsequent runs can look inconsistent or confusing to operators
  • automation becomes unsafe because a harmless reorder can change resolver behavior

How it breaks

The module updates XML list entries by position. When a host that previously had aliases is replaced in that same XML position by a host with no aliases, the old nested alias entries are left behind instead of being cleared first.

So the host data changes, but the old alias children remain attached to that XML node.

Why this fix works

Before writing a plain scalar value into an XML element, this patch now removes any leftover child elements from the previous value.

That ensures a host with no aliases stays a host with no aliases, even if the host order changes.

Included in this PR

  • a focused fix in plugins/module_utils/pfsense.py
  • a regression test covering host reordering with aliases
  • a fixture that reproduces the bad before-fix XML shape

Validation

  • targeted unit test for pfsense_dns_resolver passes
  • regression test confirms aliases stay with the correct host after reorder
  • branch rebased cleanly onto current master

@djlongy djlongy marked this pull request as draft March 1, 2026 10:06
@djlongy djlongy marked this pull request as ready for review March 1, 2026 10:09
@djlongy djlongy force-pushed the fix/dns-resolver-alias-misassignment branch 2 times, most recently from 65af53e to 358a278 Compare March 11, 2026 09:24
@djlongy djlongy force-pushed the fix/dns-resolver-alias-misassignment branch from 358a278 to f8ccc49 Compare March 11, 2026 10:13
@djlongy djlongy changed the title Fix copy_dict_to_element() stale children causing alias misassignment Prevent DNS resolver host aliases from moving to the wrong host Mar 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant