🐛 hetzner: remodel the HTTP-redirect check the API cannot satisfy as written by tas50 · Pull Request #2821 · mondoohq/cnspec

tas50 · 2026-06-12T14:44:15Z

Part of the series reviewing every remediation in content/ for correctness (#2775, #2780–#2820). This PR covers mondoo-hetzner-security.mql.yaml: all 12 checks were reviewed and all 12 needed fixes. Policy version bumped. Verified against the hetzner provider schema and implementation, the Hetzner OpenAPI spec, the hcloud CLI source, and the terraform provider docs.

A check modeled backwards from the API

lb-http-redirected-to-https treated the redirect as a property of the HTTP service. In Hetzner's API, redirect_http belongs to the HTTPS service ("Only available if protocol is https"), and when enabled the load balancer answers port 80 itself. Consequences: the console step pointed at a control that cannot exist, the CLI command was rejected by the API, the terraform example failed to apply — and independently, the runtime mql read http[\"redirect_http\"] while the provider emits the camelCase redirectHttp, an assertion that was never true. All four variants now assert the corrected model (no plain HTTP service, redirect enabled on the HTTPS service), and the remediation and audit follow it.

Firewall deletions that error or miss IPv6

hcloud firewall delete-rule matches the stored rule with deep equality. The four firewall checks' commands passed --source-ips 0.0.0.0/0 alone, which errors with "rule was not found" on the common rule listing both 0.0.0.0/0 and ::/0, and never cleared IPv6-only rules even though the checks flag them. All four now inspect the rule first, reuse its exact values, add scoped replacements before deleting, and the all-ports fix warns that deleting a firewall's only inbound rule default-denies everything to the attached servers.

Other fixes

server-image-not-deprecated claimed Hetzner cannot change a server's image in place; the Rebuild tab and hcloud server rebuild do exactly that (with the disk-erase warning now attached), and the migration path now deletes the old server, without which the check keeps failing.
cert-not-expired deleted the certificate before repointing load balancers, breaking TLS mid-rotation; now create, repoint, delete, with a note that an expired managed certificate means automatic renewal failed and needs investigating.
lb-https-service-has-certificate used add-service against an existing service, a port conflict; now update-service.
blocked-IP checks gain in-list comments explaining the blocked flag is controlled solely by Hetzner's abuse team, replacing comments that sat above the checks.
The two terraform remediation entries that pointed at attachment forms the checks don't recognize now steer to the recognized inline forms.

Left for maintainers

The terraform variants of the private-network and firewall checks don't recognize the provider's hcloud_server_network, hcloud_firewall_attachment, or apply_to attachment forms, so compliant configs using them false-fail.
The firewall checks compare ports as exact strings, so ranges containing the flagged port (and unquoted HCL numbers) evade them.
The runtime HTTPS-certificate check is effectively constant-pass since the API requires certificates at HTTPS-service creation; the terraform variant is the one catching real misconfigurations.

Validation

cnspec policy lint passes (compiles the remodeled runtime and terraform variant mql)
validate_remediation_commands.py hetzner: 46 passed, 0 failed
YAML parses clean

🤖 Generated with Claude Code

mondoo-code-review

Well-structured remediation improvements with one potential logic issue in the Terraform HCL query

github-actions · 2026-06-12T14:47:44Z

Test Results

1 files ±0 44 suites ±0 1m 25s ⏱️ -14s
854 tests ±0 853 ✅ ±0 1 💤 ±0 0 ❌ ±0
855 runs ±0 854 ✅ ±0 1 💤 ±0 0 ❌ ±0

Results for commit 73b4d30. ± Comparison against base commit 5c0d2f3.

♻️ This comment has been updated with latest results.

Superseded by new review

mondoo-code-review

Well-structured remediation improvements with one potential logic concern in the HTTP redirect MQL query

mondoo-code-review

Well-structured remediation improvements with one potential logic concern in the MQL query refactor

mondoo-code-review

Well-structured remediation improvements with one potential logic concern in the MQL query change

mondoo-code-review

Well-structured remediation improvements with one potential MQL query concern

mondoo-code-review

Well-structured remediation improvements with one potential MQL query correctness concern

mondoo-code-review

Well-structured remediation improvements with one potential logic concern in the MQL query change

mondoo-code-review

Well-written remediation improvements and a correct remodel of the HTTP-redirect MQL checks; one potential logic concern in the MQL queries.

…written - The redirect check was modeled backwards: Hetzner's redirect_http is a property of the HTTPS service, so the console step, CLI flag, and terraform example were all rejected by the API, and the runtime mql read redirect_http where the provider emits redirectHttp, an assertion that was never true. All four variants now assert no plain HTTP service plus redirect enabled on the HTTPS service, and the remediations follow that model - hcloud firewall delete-rule matches rules with deep equality, so the single-CIDR commands errored on rules listing both 0.0.0.0/0 and ::/0 and never cleared IPv6 rules; all four firewall fixes now describe first, add replacements before deleting, and warn that removing a firewall's only inbound rule blocks all traffic - Hetzner does support in-place rebuilds; the image check's claim otherwise is corrected with data-loss warnings, and the migration path now deletes the old server the check still counts - Certificate rotation reordered to create, repoint, then delete; the HTTPS-service fix uses update-service instead of a port-conflicting add-service; blocked-IP checks gain in-list comments for the CLI/terraform methods Hetzner's abuse team alone controls Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…iants Equivalent logic to the disjunctive form but reads as the intent: evaluate the redirect block only on https services. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

mondoo-code-review

Well-structured remediation improvements with one potential logic concern in the MQL query changes

mondoo-code-review · 2026-06-29T17:23:00Z

+      hetzner.loadBalancer.services.none(protocol == "http")
+      hetzner.loadBalancer.services.where(protocol == "https").all(http["redirectHttp"] == true)


🟡 warning — The MQL query now uses two separate statements: none(protocol == "http") and .where(protocol == "https").all(...). If a load balancer has zero HTTPS services (e.g., only TCP services), the .all() on an empty collection will vacuously pass, meaning the check succeeds even though there's no redirect configured. Consider whether you need a guard like services.where(protocol == "https").length > 0 or whether vacuous truth is the intended behavior for non-HTTP/HTTPS load balancers.

mondoo-code-review · 2026-06-29T17:23:00Z

+      terraform.resources("hcloud_load_balancer_service").all(arguments['protocol'] != "http")
+      terraform.resources("hcloud_load_balancer_service").where(arguments['protocol'] == "https").all(
        blocks.where(type == "http").all(arguments['redirect_http'] == true)
      )
  - uid: mondoo-hetzner-security-lb-http-redirected-to-https-terraform-plan


🟡 warning — Same vacuous-truth concern in the Terraform HCL variant: if no hcloud_load_balancer_service resources have protocol == "https", the .where(...).all(...) passes trivially. This is consistent with the other variants, but verify this is the desired behavior — a project with only non-HTTP services would pass this check silently.

mondoo-code-review · 2026-06-29T17:23:00Z

    filters: asset.platform == "hetzner-loadbalancer"
    mql: |
-      hetzner.loadBalancer.services.where(protocol == "http").all(http["redirect_http"] == true)
+      hetzner.loadBalancer.services.none(protocol == "http")


🔵 suggestion — The Hetzner loadbalancer query uses http["redirectHttp"] (camelCase) while the Terraform queries use http['redirect_http'] (snake_case). This is likely correct since they target different APIs (Hetzner API vs Terraform schema), but worth double-checking that the Hetzner API field is indeed redirectHttp and not redirect_http.

mondoo-code-review Bot previously requested changes Jun 12, 2026

View reviewed changes

Comment thread content/mondoo-hetzner-security.mql.yaml Outdated

Comment thread content/mondoo-hetzner-security.mql.yaml

Comment thread content/mondoo-hetzner-security.mql.yaml

mondoo-code-review Bot reviewed Jun 12, 2026

View reviewed changes

Comment thread content/mondoo-hetzner-security.mql.yaml Outdated

Comment thread content/mondoo-hetzner-security.mql.yaml Outdated

tas50 mentioned this pull request Jun 12, 2026

🐛 vllm: name the flags the checks inspect and fix the wrong-route audit #2822

Merged

tas50 force-pushed the tim/hetzner-remediation-review branch from 1ca8a8c to f8303ec Compare June 18, 2026 05:03

mondoo-code-review Bot reviewed Jun 18, 2026

View reviewed changes

Comment thread content/mondoo-hetzner-security.mql.yaml Outdated

Comment thread content/mondoo-hetzner-security.mql.yaml Outdated

Comment thread content/mondoo-hetzner-security.mql.yaml

tas50 force-pushed the tim/hetzner-remediation-review branch from f8303ec to a24ef82 Compare June 21, 2026 04:13

mondoo-code-review Bot reviewed Jun 21, 2026

View reviewed changes

Comment thread content/mondoo-hetzner-security.mql.yaml

Comment thread content/mondoo-hetzner-security.mql.yaml

tas50 force-pushed the tim/hetzner-remediation-review branch from a24ef82 to a025c80 Compare June 23, 2026 00:32

mondoo-code-review Bot reviewed Jun 23, 2026

View reviewed changes

Comment thread content/mondoo-hetzner-security.mql.yaml

Comment thread content/mondoo-hetzner-security.mql.yaml

Comment thread content/mondoo-hetzner-security.mql.yaml

tas50 force-pushed the tim/hetzner-remediation-review branch from a025c80 to c45a3e1 Compare June 24, 2026 16:05

mondoo-code-review Bot reviewed Jun 24, 2026

View reviewed changes

Comment thread content/mondoo-hetzner-security.mql.yaml

Comment thread content/mondoo-hetzner-security.mql.yaml

tas50 force-pushed the tim/hetzner-remediation-review branch from c45a3e1 to e072347 Compare June 26, 2026 20:45

mondoo-code-review Bot reviewed Jun 26, 2026

View reviewed changes

Comment thread content/mondoo-hetzner-security.mql.yaml

Comment thread content/mondoo-hetzner-security.mql.yaml

tas50 force-pushed the tim/hetzner-remediation-review branch from e072347 to 2513d74 Compare June 26, 2026 21:16

mondoo-code-review Bot reviewed Jun 26, 2026

View reviewed changes

Comment thread content/mondoo-hetzner-security.mql.yaml

Comment thread content/mondoo-hetzner-security.mql.yaml

tas50 and others added 2 commits June 29, 2026 10:22

🧹 hetzner: use where-filtered form for the https-service redirect var…

73b4d30

…iants Equivalent logic to the disjunctive form but reads as the intent: evaluate the redirect block only on https services. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tas50 force-pushed the tim/hetzner-remediation-review branch from 2513d74 to 73b4d30 Compare June 29, 2026 17:22

mondoo-code-review Bot reviewed Jun 29, 2026

View reviewed changes

		hetzner.loadBalancer.services.none(protocol == "http")
		hetzner.loadBalancer.services.where(protocol == "https").all(http["redirectHttp"] == true)

Uh oh!

Conversation

tas50 commented Jun 12, 2026

A check modeled backwards from the API

Firewall deletions that error or miss IPv6

Other fixes

Left for maintainers

Validation

Uh oh!

mondoo-code-review Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jun 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Results

Uh oh!

mondoo-code-review Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

mondoo-code-review Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mondoo-code-review Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

mondoo-code-review Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mondoo-code-review Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

mondoo-code-review Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

mondoo-code-review Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

mondoo-code-review Bot left a comment

Choose a reason for hiding this comment

Uh oh!

mondoo-code-review Bot Jun 29, 2026

Choose a reason for hiding this comment

Uh oh!

mondoo-code-review Bot Jun 29, 2026

Choose a reason for hiding this comment

Uh oh!

mondoo-code-review Bot Jun 29, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

github-actions Bot commented Jun 12, 2026 •

edited

Loading