L4-4: Correct host but wrong port -> denied.
(
sandbox: Callable[..., Sandbox],
)
| 497 | |
| 498 | |
| 499 | def test_l4_wrong_port_denied( |
| 500 | sandbox: Callable[..., Sandbox], |
| 501 | ) -> None: |
| 502 | """L4-4: Correct host but wrong port -> denied.""" |
| 503 | policy = _base_policy( |
| 504 | network_policies={ |
| 505 | "anthropic": sandbox_pb2.NetworkPolicyRule( |
| 506 | name="anthropic", |
| 507 | endpoints=[ |
| 508 | sandbox_pb2.NetworkEndpoint(host="api.anthropic.com", port=443), |
| 509 | ], |
| 510 | binaries=[sandbox_pb2.NetworkBinary(path="/**")], |
| 511 | ), |
| 512 | }, |
| 513 | ) |
| 514 | spec = datamodel_pb2.SandboxSpec(policy=policy) |
| 515 | with sandbox(spec=spec, delete_on_exit=True) as sb: |
| 516 | # Port 443 -> allowed |
| 517 | result = sb.exec_python(_proxy_connect(), args=("api.anthropic.com", 443)) |
| 518 | assert result.exit_code == 0, result.stderr |
| 519 | assert "200" in result.stdout |
| 520 | |
| 521 | # Port 80 -> denied |
| 522 | result = sb.exec_python(_proxy_connect(), args=("api.anthropic.com", 80)) |
| 523 | assert result.exit_code == 0, result.stderr |
| 524 | assert "403" in result.stdout |
| 525 | |
| 526 | |
| 527 | def test_l4_cross_policy_denied( |
nothing calls this directly
no test coverage detected