From da16233f64598b3dd57d4b8b9993292e829a3d30 Mon Sep 17 00:00:00 2001 From: Conrad Ludgate Date: Mon, 28 Oct 2024 18:41:07 +0000 Subject: [PATCH] fixup --- test_runner/fixtures/neon_fixtures.py | 1 + test_runner/regress/test_proxy_allowed_ips.py | 102 +++++++++--------- 2 files changed, 52 insertions(+), 51 deletions(-) diff --git a/test_runner/fixtures/neon_fixtures.py b/test_runner/fixtures/neon_fixtures.py index 2c9d41568b..b9562dd2b2 100644 --- a/test_runner/fixtures/neon_fixtures.py +++ b/test_runner/fixtures/neon_fixtures.py @@ -40,6 +40,7 @@ from _pytest.fixtures import FixtureRequest from psycopg2.extensions import connection as PgConnection from psycopg2.extensions import cursor as PgCursor from psycopg2.extensions import make_dsn, parse_dsn +from pytest_httpserver import HTTPServer from urllib3.util.retry import Retry from fixtures import overlayfs diff --git a/test_runner/regress/test_proxy_allowed_ips.py b/test_runner/regress/test_proxy_allowed_ips.py index f0dfcc2b24..1956c1ae5a 100644 --- a/test_runner/regress/test_proxy_allowed_ips.py +++ b/test_runner/regress/test_proxy_allowed_ips.py @@ -11,9 +11,7 @@ from pytest_httpserver import HTTPServer TABLE_NAME = "neon_control_plane.endpoints" -# Proxy uses the same logic for psql and websockets. -@pytest.mark.asyncio -async def test_proxy_psql_allowed_ips( +def test_proxy_psql_not_allowed_ips( static_proxy: NeonProxy, vanilla_pg: VanillaPostgres, httpserver: HTTPServer, @@ -23,9 +21,7 @@ async def test_proxy_psql_allowed_ips( ) # Shouldn't be able to connect to this project - httpserver.expect_request( - "/cplane/proxy_get_role_secret", query_string="project=private-project" - ).respond_with_json( + httpserver.expect_request("/cplane/proxy_get_role_secret").respond_with_json( { "role_secret": rolpassword, "allowed_ips": ["8.8.8.8"], @@ -33,24 +29,6 @@ async def test_proxy_psql_allowed_ips( } ) - # Should be able to connect to this project - httpserver.expect_request( - "/cplane/proxy_get_role_secret", query_string="project=generic-project" - ).respond_with_json( - { - "role_secret": rolpassword, - "allowed_ips": ["::1", "127.0.0.1"], - "project_id": "foo-bar", - } - ) - - # vanilla_pg.safe_psql( - # f"INSERT INTO {TABLE_NAME} (endpoint_id, allowed_ips) VALUES ('private-project', '8.8.8.8')" - # ) - # vanilla_pg.safe_psql( - # f"INSERT INTO {TABLE_NAME} (endpoint_id, allowed_ips) VALUES ('generic-project', '::1,127.0.0.1')" - # ) - def check_cannot_connect(**kwargs): with pytest.raises(psycopg2.Error) as exprinfo: static_proxy.safe_psql(**kwargs) @@ -66,6 +44,25 @@ async def test_proxy_psql_allowed_ips( # with SNI check_cannot_connect(query="select 1", host="private-project.localtest.me") + +def test_proxy_psql_allowed_ips( + static_proxy: NeonProxy, + vanilla_pg: VanillaPostgres, + httpserver: HTTPServer, +): + [(rolpassword,)] = vanilla_pg.safe_psql( + "select rolpassword from pg_catalog.pg_authid where rolname = 'proxy'" + ) + + # Should be able to connect to this project + httpserver.expect_request("/cplane/proxy_get_role_secret").respond_with_json( + { + "role_secret": rolpassword, + "allowed_ips": ["::1", "127.0.0.1"], + "project_id": "foo-bar", + } + ) + # no SNI, deprecated `options=project` syntax (before we had several endpoint in project) out = static_proxy.safe_psql(query="select 1", sslsni=0, options="project=generic-project") assert out[0][0] == 1 @@ -79,36 +76,18 @@ async def test_proxy_psql_allowed_ips( assert out[0][0] == 1 -@pytest.mark.asyncio -async def test_proxy_http_allowed_ips( +def test_proxy_http_not_allowed_ips( static_proxy: NeonProxy, vanilla_pg: VanillaPostgres, httpserver: HTTPServer, ): vanilla_pg.safe_psql("create user http_auth with password 'http' superuser") - # # Shouldn't be able to connect to this project - # vanilla_pg.safe_psql( - # f"INSERT INTO {TABLE_NAME} (endpoint_id, allowed_ips) VALUES ('proxy', '8.8.8.8')" - # ) - [(rolpassword,)] = vanilla_pg.safe_psql( - "select rolpassword from pg_catalog.pg_authid where rolname = 'proxy'" + "select rolpassword from pg_catalog.pg_authid where rolname = 'http_auth'" ) - def query(status: int, query: str, *args): - static_proxy.http_query( - query, - args, - user="http_auth", - password="http", - expected_code=status, - ) - - # Shouldn't be able to connect to this project - httpserver.expect_oneshot_request( - "/cplane/proxy_get_role_secret", query_string="project=proxy" - ).respond_with_json( + httpserver.expect_oneshot_request("/cplane/proxy_get_role_secret").respond_with_json( { "role_secret": rolpassword, "allowed_ips": ["8.8.8.8"], @@ -117,13 +96,28 @@ async def test_proxy_http_allowed_ips( ) with httpserver.wait() as waiting: - query(400, "select 1;") # ip address is not allowed + static_proxy.http_query( + "select 1;", + [], + user="http_auth", + password="http", + expected_code=400, + ) assert waiting.result - # Should be able to connect to this project - httpserver.expect_oneshot_request( - "/cplane/proxy_get_role_secret", query_string="project=proxy" - ).respond_with_json( + +def test_proxy_http_allowed_ips( + static_proxy: NeonProxy, + vanilla_pg: VanillaPostgres, + httpserver: HTTPServer, +): + vanilla_pg.safe_psql("create user http_auth with password 'http' superuser") + + [(rolpassword,)] = vanilla_pg.safe_psql( + "select rolpassword from pg_catalog.pg_authid where rolname = 'http_auth'" + ) + + httpserver.expect_oneshot_request("/cplane/proxy_get_role_secret").respond_with_json( { "role_secret": rolpassword, "allowed_ips": ["8.8.8.8", "127.0.0.1"], @@ -132,5 +126,11 @@ async def test_proxy_http_allowed_ips( ) with httpserver.wait() as waiting: - query(400, "select 1;") # ip address is not allowed + static_proxy.http_query( + "select 1;", + [], + user="http_auth", + password="http", + expected_code=200, + ) assert waiting.result