GovOPlaN/govoplan-core
1
0
Fork 0
Code Issues 43 Pull Requests Actions Packages Projects Releases Wiki Activity

Block SDK-managed secondary connector peers

Browse Source
This commit is contained in:
Albrecht Degering
2026-07-21 15:43:04 +02:00
parent 28a0a596a6
commit 0845e99cf6
3 changed files with 35 additions and 134 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
tests/test_http_fetch.py
View File

@@ -14,8 +14,8 @@ from govoplan_core.security.outbound_http import (
bounded_response_bytes,
create_outbound_connection,
outbound_http_policy,
pinned_outbound_hostname,
validate_outbound_http_url,
validate_unpinned_sdk_host,
validate_unpinned_sdk_http_url,
)
@@ -155,34 +155,16 @@ class HttpFetchTests(unittest.TestCase):
policy=policy,
)
def test_unpinned_hostname_transport_fails_closed_when_private_networks_are_enabled(self) -> None:
def test_unpinned_host_sdk_fails_closed_for_dns_and_explicit_ip_targets(self) -> None:
policy = outbound_http_policy(
{"APP_ENV": "production", "GOVOPLAN_CONNECTOR_ALLOW_PRIVATE_NETWORKS": "true"}
)
with patch("govoplan_core.security.outbound_http.socket.getaddrinfo") as resolver, self.assertRaisesRegex(
OutboundHttpBlocked,
"cannot pin DNS resolution",
):
pinned_outbound_hostname(
"files.internal.example",
port=445,
label="SMB endpoint",
policy=policy,
)
resolver.assert_not_called()
def test_explicit_private_ip_remains_a_pinned_transport_target(self) -> None:
policy = outbound_http_policy(
{"APP_ENV": "production", "GOVOPLAN_CONNECTOR_ALLOW_PRIVATE_NETWORKS": "true"}
)
with patch(
"govoplan_core.security.outbound_http.socket.getaddrinfo",
return_value=[(2, 1, 6, "", ("10.0.0.5", 445))],
):
self.assertEqual(
"10.0.0.5",
pinned_outbound_hostname("10.0.0.5", port=445, label="SMB endpoint", policy=policy),
)
for host in ("files.internal.example", "10.0.0.5"):
with self.subTest(host=host), patch(
"govoplan_core.security.outbound_http.socket.getaddrinfo",
return_value=[(2, 1, 6, "", ("10.0.0.5", 445))],
), self.assertRaisesRegex(OutboundHttpBlocked, "redirects/referrals.*DNS/IP pinning"):
validate_unpinned_sdk_host(host, port=445, label="SMB endpoint", policy=policy)
def test_core_redirects_strip_credentials_cross_origin_and_reject_https_downgrades(self) -> None:
import urllib.request