Function test_forward_proxy_log_fields

e2e/python/test_sandbox_policy.py:1563–1606

FWD-6: Forward proxy requests produce structured FORWARD log lines.

(
    sandbox: Callable[..., Sandbox],
)

def test_forward_proxy_log_fields(
    sandbox: Callable[..., Sandbox],
) -> None:
    """FWD-6: Forward proxy requests produce structured FORWARD log lines."""
    policy = _base_policy(
        network_policies={
            "internal_http": sandbox_pb2.NetworkPolicyRule(
                name="internal_http",
                endpoints=[
                    sandbox_pb2.NetworkEndpoint(
                        host=_SANDBOX_IP,
                        port=_FORWARD_PROXY_PORT,
                        allowed_ips=["10.200.0.0/24"],
                    ),
                ],
                binaries=[sandbox_pb2.NetworkBinary(path="/**")],
            ),
        },
    )
    spec = datamodel_pb2.SandboxSpec(policy=policy)
    with sandbox(spec=spec, delete_on_exit=True) as sb:
        # Trigger an allowed forward proxy request (with server)
        sb.exec_python(
            _forward_proxy_with_server(),
            args=(_PROXY_HOST, _PROXY_PORT, _SANDBOX_IP, _FORWARD_PROXY_PORT),
        )
        # Trigger a denied forward proxy request (no allowed_ips match)
        sb.exec_python(
            _forward_proxy_raw(),
            args=(
                _PROXY_HOST,
                _PROXY_PORT,
                "http://example.com/",
            ),
        )
        # Read the log
        result = sb.exec_python(_read_openshell_log())
        assert result.exit_code == 0, result.stderr
        log = result.stdout

        # OCSF shorthand: FORWARD requests show as HTTP:method events
        assert "HTTP:" in log, "Expected OCSF HTTP activity event for FORWARD request"
        assert "ALLOWED" in log, "Expected ALLOWED for forward proxy allow"
        assert f"{_SANDBOX_IP}" in log, "Expected destination IP in FORWARD log"


# =============================================================================