mirror of
https://github.com/dredx/prole.git
synced 2026-09-24 18:34:31 +00:00
63 lines
2.2 KiB
Python
63 lines
2.2 KiB
Python
"""
|
|
T1.4 — hostnossl reject precedence (static analysis, no cluster needed).
|
|
|
|
Regression detector for the externalTrafficPolicy: Cluster→Local bug from
|
|
Phase 1. See docs/plans/onboarding-tdd.md §3 T1.4 for the full spec.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
from tests.onboarding.conftest import (
|
|
GKE_KNOE_DB_YAML,
|
|
_is_external_range,
|
|
_parse_pg_hba_from_yaml,
|
|
)
|
|
|
|
import pytest
|
|
|
|
|
|
def test_hostnossl_reject_precedes_permissive_host_rules() -> None:
|
|
"""T1.4 — hostnossl reject must appear before any permissive host rule
|
|
that could match external IPs.
|
|
|
|
If a permissive `host` rule (non-SSL, non-reject) for an external CIDR
|
|
appears before the `hostnossl ... reject` line, an external plaintext
|
|
connection could match the permissive rule and bypass the TLS requirement.
|
|
|
|
Static analysis — no live cluster required. Runs on every commit.
|
|
"""
|
|
if not GKE_KNOE_DB_YAML.exists():
|
|
pytest.skip(f"pg_hba source not found: {GKE_KNOE_DB_YAML}")
|
|
|
|
rules = _parse_pg_hba_from_yaml(GKE_KNOE_DB_YAML)
|
|
assert rules, f"No pg_hba rules found in {GKE_KNOE_DB_YAML}"
|
|
|
|
hostnossl_reject_seen = False
|
|
violations: list[str] = []
|
|
|
|
for rule in rules:
|
|
tokens = rule.split()
|
|
if not tokens or tokens[0].startswith("#"):
|
|
continue
|
|
|
|
conn_type = tokens[0].lower()
|
|
|
|
if conn_type == "hostnossl" and tokens[-1].lower() == "reject":
|
|
hostnossl_reject_seen = True
|
|
continue
|
|
|
|
if conn_type == "host" and not hostnossl_reject_seen:
|
|
if len(tokens) >= 5:
|
|
address = tokens[3]
|
|
auth_method = tokens[-1].lower()
|
|
if auth_method != "reject" and _is_external_range(address):
|
|
violations.append(rule)
|
|
|
|
assert not violations, (
|
|
"pg_hba has permissive `host` rule(s) for external IPs appearing BEFORE "
|
|
"the `hostnossl ... reject` line. An external plaintext connection could "
|
|
"match these rules and bypass the TLS requirement.\n\n"
|
|
"Violating rules:\n" + "\n".join(f" {r}" for r in violations) + "\n\n"
|
|
"Fix: move `hostnossl all all 0.0.0.0/0 reject` above any permissive "
|
|
"`host` rule that covers non-RFC1918 addresses."
|
|
)
|