52 lines
1.8 KiB
Python
52 lines
1.8 KiB
Python
|
"""docs/sources-egress.yaml stays valid for sand-boxer and in step with the prose allowlist."""
|
||
|
|
from pathlib import Path
|
||
|
|
import re
|
||
|
|
import unittest
|
||
|
|
|
||
|
|
import yaml
|
||
|
|
|
||
|
|
ROOT = Path(__file__).resolve().parent.parent
|
||
|
|
EGRESS = ROOT / 'docs' / 'sources-egress.yaml'
|
||
|
|
ALLOWLIST = ROOT / 'docs' / 'sources-allowlist.md'
|
||
|
|
# sand-boxer bwrap-egress: exact lowercase DNS name, port 443, no wildcard or IP literal.
|
||
|
|
HOST = re.compile(r'^(?=.{1,253}:443$)([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}:443$')
|
||
|
|
MAX_HOSTS = 24 # every host is a whole-host trust decision; raise only deliberately
|
||
|
|
|
||
|
|
|
||
|
|
class SourcesEgressTests(unittest.TestCase):
|
||
|
|
@classmethod
|
||
|
|
def setUpClass(cls):
|
||
|
|
cls.doc = yaml.safe_load(EGRESS.read_text(encoding='utf-8'))
|
||
|
|
cls.hosts = cls.doc['hosts']
|
||
|
|
cls.prose = ALLOWLIST.read_text(encoding='utf-8')
|
||
|
|
|
||
|
|
def test_version(self):
|
||
|
|
self.assertEqual(self.doc['version'], 1)
|
||
|
|
|
||
|
|
def test_host_format(self):
|
||
|
|
for entry in self.hosts:
|
||
|
|
self.assertRegex(entry['host'], HOST)
|
||
|
|
|
||
|
|
def test_no_duplicates_and_bounded(self):
|
||
|
|
names = [e['host'] for e in self.hosts]
|
||
|
|
self.assertEqual(len(names), len(set(names)))
|
||
|
|
self.assertLessEqual(len(names), MAX_HOSTS)
|
||
|
|
|
||
|
|
def test_entries_complete(self):
|
||
|
|
for entry in self.hosts:
|
||
|
|
self.assertEqual(set(entry), {'host', 'axes', 'channel', 'why'}, entry['host'])
|
||
|
|
self.assertTrue(entry['why'].strip(), entry['host'])
|
||
|
|
self.assertTrue(set(entry['axes']) <= set('ABCD'), entry['host'])
|
||
|
|
|
||
|
|
def test_every_axis_covered(self):
|
||
|
|
covered = {axis for e in self.hosts for axis in e['axes']}
|
||
|
|
self.assertEqual(covered, set('ABCD'))
|
||
|
|
|
||
|
|
def test_channel_named_in_prose_allowlist(self):
|
||
|
|
for entry in self.hosts:
|
||
|
|
self.assertIn(entry['channel'], self.prose, entry['host'])
|
||
|
|
|
||
|
|
|
||
|
|
if __name__ == '__main__':
|
||
|
|
unittest.main()
|