OSS-Singularity/cinnamon-z-usage
OSS-Singularity/cinnamon-z-usage
Watch
5
0
Fork
You've already forked cinnamon-z-usage
 0
Code Issues Pull requests Projects Releases 6 Packages Wiki Activity Actions

Tests never reach the network (netguard) #30

Merged
claude merged 4 commits from oss-oo/test-netguard into main 2026-10-28 19:41:09 +00:00
Conversation 0 Commits 4 Files changed 5 +211 -3
claude agent commented 2026-10-28 18:28:45 +00:00
Member

Port of the test network guard from cinnamon-claude-usage (Claudiu: „dann sehr gerne auch in den andern beiden nachpflegen"), hardened in three review rounds; the guard and test files are identical in all three repos apart from the variable name.

  • make check runs the Python suites with Z_USAGE_TEST_NETGUARD=1 PYTHONPATH="$(CURDIR)/tests/netguard". Name lookups (getaddrinfo, gethostbyname*, gethostbyaddr, getnameinfo) and connect/connect_ex/sendto beyond loopback raise NetworkBlocked, a BaseException no except OSError can swallow; proxies are bypassed (NO_PROXY=*), since a loopback proxy carried requests past the checks; only localhost passes by name; Python children that inherit the environment are guarded too.
  • tests/test_netguard.py proves every lookup is the guard's wrapper before calling it, probes connect/sendto on closed sockets, checks the loopback decision first, lets its child prove the guard before its lookup of example.invalid, and fails (instead of skipping) when the guard is only half set up.
  • The repo release skill names the guard and the current count.
  • Measured before the change: the unchanged suite ran green under the guard, so no test reaches the network today and nothing needed a stub. (127 Python tests now.)

Reviews: a fresh read-only reviewer, three rounds (round 1: 2–3 should-fix + nits, round 2: one should-fix + 2 nits, round 3: one nit), every finding fixed; experiments in round 3 ran in an isolated network namespace. Test-only change: payload, installer and package unchanged, so no release or live sync.

🤖 Generated with Claude Code

Port of the test network guard from cinnamon-claude-usage (Claudiu: „dann sehr gerne auch in den andern beiden nachpflegen"), hardened in three review rounds; the guard and test files are identical in all three repos apart from the variable name. - `make check` runs the Python suites with `Z_USAGE_TEST_NETGUARD=1 PYTHONPATH="$(CURDIR)/tests/netguard"`. Name lookups (`getaddrinfo`, `gethostbyname*`, `gethostbyaddr`, `getnameinfo`) and `connect`/`connect_ex`/`sendto` beyond loopback raise `NetworkBlocked`, a `BaseException` no `except OSError` can swallow; proxies are bypassed (`NO_PROXY=*`), since a loopback proxy carried requests past the checks; only `localhost` passes by name; Python children that inherit the environment are guarded too. - `tests/test_netguard.py` proves every lookup is the guard's wrapper before calling it, probes connect/sendto on closed sockets, checks the loopback decision first, lets its child prove the guard before its lookup of `example.invalid`, and fails (instead of skipping) when the guard is only half set up. - The repo release skill names the guard and the current count. - Measured before the change: the unchanged suite ran green under the guard, so **no test reaches the network today** and nothing needed a stub. (127 Python tests now.) Reviews: a fresh read-only reviewer, three rounds (round 1: 2–3 should-fix + nits, round 2: one should-fix + 2 nits, round 3: one nit), every finding fixed; experiments in round 3 ran in an isolated network namespace. Test-only change: payload, installer and package unchanged, so no release or live sync. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
claude agent added 1 commit 2026-10-28 18:28:45 +00:00
Tests never reach the network (netguard)
All checks were successful
Checks / Functional checks (pull_request) Successful in 48s
Details Explain this check
a86254f50d 
make check runs the Python suites under tests/netguard/sitecustomize.py
(ported from cinnamon-claude-usage 1.1.0): any name lookup or connection
beyond loopback (decided by address, so 127.example.com is no loopback)
raises NetworkBlocked, a BaseException no except OSError can swallow, also
in subprocesses that inherit the environment. tests/test_netguard.py proves
the guard is active and never does a lookup itself. Documented in docs/README.md.

The unchanged suite ran green under the guard: no test reaches the network
today, so nothing needed a stub. Test-only change, payload unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Netguard review: proxies, all lookups and sends, a loud half setup
All checks were successful
Checks / Functional checks (pull_request) Successful in 44s
Details Explain this check
6a338d29c6 
- Proxies are bypassed (NO_PROXY=*): a loopback proxy carried a request
  to any host past the checks (urllib's CONNECT goes only to the proxy).
- gethostbyname, gethostbyname_ex, gethostbyaddr, getnameinfo and sendto
  are guarded as well as getaddrinfo, connect and connect_ex.
- test_netguard probes connect/connect_ex/sendto on closed sockets (the
  connect half was never exercised), the child proves the guard before its
  lookup of example.invalid (no real lookup when only half set up), and a
  half set-up guard fails instead of skipping.
- Docs say what the guard covers: Python processes that inherit the
  environment.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Netguard review round 2: the child proves INSTALLED; lookups proven guarded
All checks were successful
Checks / Functional checks (pull_request) Successful in 44s
Details Explain this check
3b1164f1c6 
- should-fix: test_netguard's child read sitecustomize.NetworkBlocked, and a
  child with the system sitecustomize died with an AttributeError naming
  NetworkBlocked, so the test passed unguarded. The child now checks
  sitecustomize.INSTALLED explicitly (python -O cannot drop it) and exits
  before its lookup otherwise (as in cinnamon-claude-usage 5276592).
- Each lookup is asserted to be the guard's wrapper (__wrapped__, via
  functools.wraps) before the call, so a guard that lost one never asks
  the real resolver, and a failing subtest names its lookup.
- Only "localhost" passes by name (localhost.localdomain may go to DNS).

Guard and test files are identical to cinnamon-claude-usage's apart from
the variable name.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Netguard round 3 nit: the child and setUp check before any lookup
All checks were successful
Checks / Functional checks (pull_request) Successful in 44s
Details Explain this check
b9ef77e8fa 
- The child exits unless the guard is installed and getaddrinfo is still
  its wrapper, so even a guard that lost that wrapper never asks the real
  resolver from the child.
- setUp checks the loopback decision before any lookup probe runs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
claude agent merged commit 7de1039285 into main 2026-10-28 19:41:09 +00:00
claude agent deleted branch oss-oo/test-netguard 2026-10-28 19:41:09 +00:00
claude agent referenced this pull request from a commit 2026-10-28 19:41:10 +00:00
Tests never reach the network (netguard) (#30)
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
OSS-Singularity/cinnamon-z-usage!30
No description provided.