FIREWALL: Allow to block hosts by IP address #90
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
tox failures existed before this PR. |
|
Hi, please rebase to get CI green. |
Perfect. Thank you. |
pbrezina
reviewed
Oct 25, 2024
pytest_mh/utils/firewall.py
Outdated
Comment on lines
610
to
630
| ipv4 = IPv4Address(hostname) | ||
| if type == "A": | ||
| return [hostname] | ||
| except ValueError: | ||
| ipv4 = None | ||
|
|
||
| try: | ||
| ipv6 = IPv6Address(hostname) | ||
| if type == "AAAA": | ||
| return [hostname] | ||
| except ValueError: | ||
| ipv6 = None | ||
|
|
||
| if ipv4 is not None or ipv6 is not None: | ||
| # In this case we were given an IP address but of the wrong family. We must not consider it a hostname. | ||
| return [] | ||
| else: | ||
| result = self.firewall.host.conn.exec( | ||
| ["dig", "+short", "-t", type, hostname], log_level=ProcessLogLevel.Error | ||
| ) | ||
| return result.stdout_lines |
There was a problem hiding this comment.
How about simplifying it to:
addrs = []
try:
ip = ipaddress.ip_address(hostname)
ip_type = ipaddress.IPv4Address if type == "A" else ipaddress.IPv6Address
if isinstance(ip, ip_type):
addrs = [hostname]
except ValueError:
result = self.firewall.host.conn.exec(
["dig", "+short", "-t", type, hostname], log_level=ProcessLogLevel.Error
)
addrs = result.stdout_lines
return addrsThere was a problem hiding this comment.
Nice! I will use it.
When blocking a host, its hostname is resolved using the `dig` command. If an IP address is provided, `dig` returns nothing. Check whether it is an IP address before launching `dig`. No matter whether the correct family is requested, do not call `dig` when an IP address is provided, in case the caller has already blocked the DNS host.
pbrezina
approved these changes
Oct 29, 2024
justin-stephenson
approved these changes
Oct 29, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
When blocking a host, its hostname is resolved using the
digcommand. If an IP address is provided,digreturns nothing and it is not blocked.We need to check whether it is an IP address before launching
dig. No matter whether the correct family is requested, do not calldigwhen an IP address is provided, in case the caller has already blocked the DNS host.