mirror of
https://github.com/firestar5683/StarPilot.git
synced 2026-11-08 13:33:42 +08:00
firestar5683
53 lines
2.8 KiB
Python
53 lines
2.8 KiB
Python
"""Explicit reverse-proxy admission without trusting forwarded client identity."""
|
|
|
|
import unittest
|
|
from tempfile import TemporaryDirectory
|
|
|
|
from openpilot.starpilot.galaxy.http_server import ReverseProxy, allowed_authority
|
|
from openpilot.starpilot.galaxy.reverse_proxy import ReverseProxySettings
|
|
|
|
|
|
class ReverseProxyTest(unittest.TestCase):
|
|
def test_opt_in_and_invalid_configuration(self):
|
|
for peer, origin in (('', 'https://galaxy.example'), ('proxy.example', 'https://galaxy.example'),
|
|
('192.168.1.2', ''), ('192.168.1.2', 'http://galaxy.example'),
|
|
('192.168.1.2', 'https://galaxy.example/'),
|
|
('192.168.1.2', 'https://user@galaxy.example'),
|
|
('192.168.1.2', 'https://galaxy.example?query=1')):
|
|
with self.subTest(peer=peer, origin=origin), self.assertRaises(ValueError):
|
|
ReverseProxy.validated(peer, origin)
|
|
|
|
def test_persistence_disable_stale_revision_and_authority(self):
|
|
with TemporaryDirectory() as root:
|
|
owner = ReverseProxySettings(root)
|
|
self.assertIsNone(owner.current)
|
|
payload = {**owner.snapshot(), 'enabled': True, 'address': '192.168.1.2',
|
|
'origin': 'https://galaxy.example', 'confirmed': True}
|
|
with self.assertRaises(PermissionError):
|
|
owner.save(payload, lambda: False)
|
|
saved = owner.save(payload, lambda: True)
|
|
self.assertEqual(ReverseProxySettings(root).current.origin, payload['origin'])
|
|
with self.assertRaises(ValueError):
|
|
owner.save(payload, lambda: True)
|
|
calls = iter((True, False))
|
|
with self.assertRaises(PermissionError):
|
|
owner.save({**saved, 'enabled': False, 'confirmed': True}, lambda: next(calls))
|
|
self.assertIsNotNone(owner.current)
|
|
owner.save({**saved, 'enabled': False, 'confirmed': True}, lambda: True)
|
|
self.assertIsNone(ReverseProxySettings(root).current)
|
|
|
|
def test_exact_peer_host_and_origin(self):
|
|
proxy = ReverseProxy('192.168.1.2', 'https://galaxy.example:8443')
|
|
self.assertTrue(proxy.allows('192.168.1.2', 'galaxy.example:8443', None))
|
|
self.assertTrue(proxy.allows('192.168.1.2', 'galaxy.example:8443', proxy.origin, mutation=True))
|
|
for peer, host, origin in (
|
|
('192.168.1.3', 'galaxy.example:8443', proxy.origin),
|
|
(proxy.peer, 'evil.example', proxy.origin),
|
|
(proxy.peer, 'galaxy.example:8443', 'https://evil.example'),
|
|
(proxy.peer, 'galaxy.example:8443', 'http://galaxy.example:8443'),
|
|
):
|
|
self.assertFalse(proxy.allows(peer, host, origin))
|
|
self.assertFalse(proxy.allows(proxy.peer, 'galaxy.example:8443', None, mutation=True))
|
|
self.assertTrue(allowed_authority('192.168.1.10:8082', '192.168.1.10', 8082))
|
|
self.assertFalse(allowed_authority('evil.example:8082', '192.168.1.10', 8082))
|