mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-04 00:23:53 +08:00
Piotr Mlocek
aca0575a50
BREAKING CHANGE: Policy YAML and public policy APIs now use the protobuf-shaped openshell.policy.v1.PolicyDocument contract. Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
55 lines
2.0 KiB
Python
55 lines
2.0 KiB
Python
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
from __future__ import annotations
|
|
|
|
import protovalidate
|
|
import pytest
|
|
|
|
from openshell.policy import PolicyDocument, validate_policy_document
|
|
|
|
|
|
def test_policy_document_validation_runs_portable_rules() -> None:
|
|
assert validate_policy_document(PolicyDocument(version=1)).version == 1
|
|
|
|
|
|
def test_policy_document_validation_reports_portable_rule_ids() -> None:
|
|
documents: list[tuple[str, PolicyDocument, str]] = []
|
|
|
|
documents.append(("version", PolicyDocument(), "uint32.const"))
|
|
|
|
missing_ports = PolicyDocument(version=1)
|
|
missing_ports.network_policies["api"].endpoints.add(host="api.example.com")
|
|
documents.append(("missing ports", missing_ports, "repeated.min_items"))
|
|
|
|
duplicate_ports = PolicyDocument(version=1)
|
|
duplicate_ports.network_policies["api"].endpoints.add(
|
|
host="api.example.com", ports=[443, 443]
|
|
)
|
|
documents.append(("duplicate ports", duplicate_ports, "repeated.unique"))
|
|
|
|
port_range = PolicyDocument(version=1)
|
|
port_range.network_policies["api"].endpoints.add(
|
|
host="api.example.com", ports=[65536]
|
|
)
|
|
documents.append(("port range", port_range, "uint32.gte_lte"))
|
|
|
|
binary_path = PolicyDocument(version=1)
|
|
binary_path.network_policies["api"].binaries.add(path="")
|
|
documents.append(("binary path", binary_path, "string.min_len"))
|
|
|
|
matcher_choice = PolicyDocument(version=1)
|
|
endpoint = matcher_choice.network_policies["api"].endpoints.add(
|
|
host="api.example.com", ports=[443]
|
|
)
|
|
endpoint.rules.add().allow.query["owner"].SetInParent()
|
|
documents.append(("matcher choice", matcher_choice, "required"))
|
|
|
|
for name, document, rule_id in documents:
|
|
with pytest.raises(protovalidate.ValidationError) as error:
|
|
validate_policy_document(document)
|
|
|
|
assert rule_id in {
|
|
violation.proto.rule_id for violation in error.value.violations
|
|
}, name
|