97 lines
3.4 KiB
Python
97 lines
3.4 KiB
Python
from pathlib import Path
|
|
|
|
from flask import Blueprint, Flask, jsonify
|
|
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
|
|
|
|
def _metrics_app() -> Flask:
|
|
from services.http_access_policy_service import enforce_http_access_policy
|
|
|
|
app = Flask(__name__)
|
|
system_public = Blueprint("system_public", __name__)
|
|
|
|
@system_public.route("/metrics")
|
|
def prometheus_metrics():
|
|
return jsonify({"status": "up"})
|
|
|
|
app.register_blueprint(system_public)
|
|
app.before_request(enforce_http_access_policy)
|
|
return app
|
|
|
|
|
|
def test_metrics_network_classifier_is_deny_by_default():
|
|
from services.http_access_policy_service import is_internal_metrics_request
|
|
|
|
assert is_internal_metrics_request("127.0.0.1") is True
|
|
assert is_internal_metrics_request("172.20.0.4") is True
|
|
assert is_internal_metrics_request("127.0.0.1", "172.20.0.4") is True
|
|
assert is_internal_metrics_request("127.0.0.1", "203.0.113.10") is False
|
|
assert is_internal_metrics_request("127.0.0.1", "192.168.0.110") is True
|
|
assert is_internal_metrics_request("127.0.0.1", "192.168.0.111") is False
|
|
assert is_internal_metrics_request("203.0.113.10", "172.20.0.4") is False
|
|
assert is_internal_metrics_request("127.0.0.1", "not-an-ip") is False
|
|
|
|
|
|
def test_metrics_route_denies_public_and_lan_but_allows_internal_transport():
|
|
client = _metrics_app().test_client()
|
|
|
|
public = client.get(
|
|
"/metrics",
|
|
environ_base={"REMOTE_ADDR": "127.0.0.1"},
|
|
headers={"X-Real-IP": "203.0.113.10"},
|
|
)
|
|
lan = client.get(
|
|
"/metrics",
|
|
environ_base={"REMOTE_ADDR": "127.0.0.1"},
|
|
headers={"X-Real-IP": "192.168.0.111"},
|
|
)
|
|
internal = client.get(
|
|
"/metrics",
|
|
environ_base={"REMOTE_ADDR": "127.0.0.1"},
|
|
headers={"X-Real-IP": "172.20.0.4"},
|
|
)
|
|
monitoring = client.get(
|
|
"/metrics",
|
|
environ_base={"REMOTE_ADDR": "127.0.0.1"},
|
|
headers={"X-Real-IP": "192.168.0.110"},
|
|
)
|
|
direct = client.get("/metrics", environ_base={"REMOTE_ADDR": "172.18.0.5"})
|
|
|
|
assert public.status_code == 404
|
|
assert public.get_json() == {"error": "not_found"}
|
|
assert lan.status_code == 404
|
|
assert internal.status_code == 200
|
|
assert monitoring.status_code == 200
|
|
assert direct.status_code == 200
|
|
|
|
|
|
def test_source_owned_edge_and_prometheus_templates_are_closed_by_default():
|
|
nginx = (ROOT / "monitoring/edge/ewoooc_metrics_nginx_bridge.conf").read_text(
|
|
encoding="utf-8"
|
|
)
|
|
prometheus = (ROOT / "monitoring/edge/ewoooc_prometheus_scrape.yml").read_text(
|
|
encoding="utf-8"
|
|
)
|
|
|
|
assert "listen 172.20.0.1:19191;" in nginx
|
|
assert "location = /metrics" in nginx
|
|
assert "allow 127.0.0.1;" in nginx
|
|
assert "allow 172.16.0.0/12;" in nginx
|
|
assert "allow 192.168.0.110/32;" in nginx
|
|
assert "deny all;" in nginx
|
|
assert "proxy_pass https://192.168.0.188/metrics;" in nginx
|
|
assert "proxy_ssl_verify on;" in nginx
|
|
assert "job_name: 'ewoooc-app'" in prometheus
|
|
assert "metrics_path: /metrics" in prometheus
|
|
assert "targets: ['172.20.0.1:19191']" in prometheus
|
|
|
|
|
|
def test_monitoring_compose_has_no_plaintext_admin_password_or_public_prometheus_port():
|
|
compose = (ROOT / "monitoring/docker-compose.yml").read_text(encoding="utf-8")
|
|
|
|
assert "GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:?" in compose
|
|
assert "127.0.0.1:9090:9090" in compose
|
|
assert "\n - \"9090:9090\"" not in compose
|