57 lines
2.9 KiB
Python
Executable File
57 lines
2.9 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
"""Verify the security-sensitive transport split without claiming a Rust execution."""
|
|
from pathlib import Path
|
|
import json
|
|
import re
|
|
root=Path(__file__).resolve().parents[2]
|
|
read=lambda file:(root/file).read_text(encoding='utf-8')
|
|
backend=read('src/config/backend.rs')
|
|
forward=read('src/proxy/forward/upstream.rs')
|
|
proxy=read('src/proxy/types.rs')
|
|
client=read('src/upstream/client.rs')
|
|
conn=read('src/upstream.rs')
|
|
assert not re.search(r'ensure!\([^;]*!backend\.preserve_host',backend)
|
|
assert 'preserve_host: backend.preserve_host' in backend
|
|
assert 'fn upstream_request_target(' in proxy
|
|
assert 'parts.authority = Some(authority)' in proxy
|
|
assert 'if strict_h2_request' in proxy and 'headers.remove(HOST)' in proxy
|
|
assert 'let Some(upstream_target) = upstream_request_target(' in forward
|
|
assert 'retry_headers = request.headers().clone()' in forward
|
|
assert 'upstream_request_target(&uri, request.headers_mut(), backend, false, false)' in proxy
|
|
assert 'let destination: http::Uri' in client
|
|
assert 'let uri = self.destination.clone()' in conn
|
|
assert 'fn call(&mut self, _request_uri: Uri)' in conn
|
|
assert 'connect_host' in client and 'connect_host' in conn
|
|
assert 'policy.check(ip)' in conn
|
|
assert '.retry_canceled_requests(false)' in client
|
|
assert 'preserve_host_is_valid_with_every_upstream_protocol' in read('src/config/tests.rs')
|
|
for test in (
|
|
'preserve_host_sets_http2_authority_without_changing_network_origin',
|
|
'retry_prepares_authority_for_the_selected_backend_not_the_previous_one',
|
|
'invalid_outgoing_host_is_rejected_instead_of_used_for_dialing',
|
|
):
|
|
assert test in read('src/proxy/tests/authority_tests.rs'),test
|
|
for test in (
|
|
'strict_h2_preserves_public_authority_while_tcp_and_sni_use_private_origin',
|
|
'auto_h1_fallback_preserves_public_host_without_resolving_it',
|
|
'auto_h2_alpn_retains_same_public_host_and_pinned_tls_origin',
|
|
'cleartext_h2c_preserves_public_authority_and_pins_socket',
|
|
):
|
|
assert test in read('src/upstream/protocol_tests.rs'),test
|
|
css=read('src/admin/web/style.css')
|
|
match=re.search(r'#panel-overview \.dashboard-overview-grid\.is-aligned\s*\{([^}]*)\}',css)
|
|
assert match
|
|
rules=match[1]
|
|
for marker in ['margin: 0;', '--overview-gap: max(3px, calc(var(--ui-gap) - 1px));',
|
|
'row-gap: var(--overview-gap);', 'column-gap: var(--overview-gap);',
|
|
'gap: var(--overview-gap);']:
|
|
assert marker in rules, marker
|
|
# Regression guard for E0382: the retry builder must not consume the URI
|
|
# before upstream_request_target() borrows it to prepare HTTP/2 authority.
|
|
retry = re.search(r'fn retry_request\([\s\S]*?\n}\n', proxy)
|
|
assert retry and '.uri(uri.clone())' in retry[0]
|
|
assert 'upstream_request_target(&uri, request.headers_mut()' in retry[0]
|
|
assert json.loads(read('src/admin/openapi.json'))['info']['version']=='0.32.6'
|
|
assert 'version = "0.32.6"' in read('Cargo.toml')
|
|
print('PASS: 0.32.6 origin pinning, authority, retry, CSS gutter source contracts (not Rust runtime)')
|