test(policy): stabilize proxy e2e coverage

Author: johntmyers

e2e/python/test_sandbox_policy.py

@@ -1835,79 +1835,72 @@ def test_single_port_backwards_compat(
 # Host wildcard tests
 # =============================================================================
 #
-# HW-1: Wildcard *.anthropic.com matches subdomains
-# HW-2: Wildcard *.anthropic.com does NOT match anthropic.com (bare domain)
-# HW-3: Wildcard *.anthropic.com does NOT match deep.sub.anthropic.com
+# HW-1: Wildcard *.example.com matches subdomains
+# HW-2: Wildcard *.example.com does NOT match example.com (bare domain)
+# HW-3: Wildcard *.example.com does NOT match deep.sub.example.com
 # =============================================================================
 
 
 def test_host_wildcard_matches_subdomain(
     sandbox: Callable[..., Sandbox],
 ) -> None:
-    """HW-1: *.anthropic.com matches api.anthropic.com."""
+    """HW-1: *.example.com matches www.example.com."""
     policy = _base_policy(
         network_policies={
             "wildcard": sandbox_pb2.NetworkPolicyRule(
                 name="wildcard",
                 endpoints=[
-                    sandbox_pb2.NetworkEndpoint(host="*.anthropic.com", port=443),
+                    sandbox_pb2.NetworkEndpoint(host="*.example.com", port=443),
                 ],
                 binaries=[sandbox_pb2.NetworkBinary(path="/**")],
             ),
         },
     )
     spec = datamodel_pb2.SandboxSpec(policy=policy)
     with sandbox(spec=spec, delete_on_exit=True) as sb:
-        # api.anthropic.com -> matches *.anthropic.com
-        result = sb.exec_python(_proxy_connect(), args=("api.anthropic.com", 443))
+        # www.example.com -> matches *.example.com
+        result = sb.exec_python(_proxy_connect(), args=("www.example.com", 443))
         assert result.exit_code == 0, result.stderr
         assert "200" in result.stdout, (
-            f"*.anthropic.com should match api.anthropic.com: {result.stdout}"
+            f"*.example.com should match www.example.com: {result.stdout}"
         )
 
-        # statsig.anthropic.com -> also matches *.anthropic.com
-        result = sb.exec_python(_proxy_connect(), args=("statsig.anthropic.com", 443))
-        assert result.exit_code == 0, result.stderr
-        assert "200" in result.stdout, (
-            f"*.anthropic.com should match statsig.anthropic.com: {result.stdout}"
-        )
-
-        # example.com -> does NOT match *.anthropic.com
-        result = sb.exec_python(_proxy_connect(), args=("example.com", 443))
+        # example.org -> does NOT match *.example.com
+        result = sb.exec_python(_proxy_connect(), args=("example.org", 443))
         assert result.exit_code == 0, result.stderr
         assert "403" in result.stdout, (
-            f"*.anthropic.com should NOT match example.com: {result.stdout}"
+            f"*.example.com should NOT match example.org: {result.stdout}"
         )
 
 
 def test_host_wildcard_rejects_bare_domain(
     sandbox: Callable[..., Sandbox],
 ) -> None:
-    """HW-2: *.anthropic.com does NOT match anthropic.com (requires a subdomain)."""
+    """HW-2: *.example.com does NOT match example.com (requires a subdomain)."""
     policy = _base_policy(
         network_policies={
             "wildcard": sandbox_pb2.NetworkPolicyRule(
                 name="wildcard",
                 endpoints=[
-                    sandbox_pb2.NetworkEndpoint(host="*.anthropic.com", port=443),
+                    sandbox_pb2.NetworkEndpoint(host="*.example.com", port=443),
                 ],
                 binaries=[sandbox_pb2.NetworkBinary(path="/**")],
             ),
         },
     )
     spec = datamodel_pb2.SandboxSpec(policy=policy)
     with sandbox(spec=spec, delete_on_exit=True) as sb:
-        result = sb.exec_python(_proxy_connect(), args=("anthropic.com", 443))
+        result = sb.exec_python(_proxy_connect(), args=("example.com", 443))
         assert result.exit_code == 0, result.stderr
         assert "403" in result.stdout, (
-            f"*.anthropic.com should NOT match bare anthropic.com: {result.stdout}"
+            f"*.example.com should NOT match bare example.com: {result.stdout}"
         )
 
 
 def test_host_wildcard_rejects_deep_subdomain(
     sandbox: Callable[..., Sandbox],
 ) -> None:
-    """HW-3: *.anthropic.com does NOT match deep.sub.anthropic.com.
+    """HW-3: *.example.com does NOT match deep.sub.example.com.
 
     Single * matches one DNS label only (does not cross . boundaries).
     """
@@ -1916,18 +1909,18 @@ def test_host_wildcard_rejects_deep_subdomain(
             "wildcard": sandbox_pb2.NetworkPolicyRule(
                 name="wildcard",
                 endpoints=[
-                    sandbox_pb2.NetworkEndpoint(host="*.anthropic.com", port=443),
+                    sandbox_pb2.NetworkEndpoint(host="*.example.com", port=443),
                 ],
                 binaries=[sandbox_pb2.NetworkBinary(path="/**")],
             ),
         },
     )
     spec = datamodel_pb2.SandboxSpec(policy=policy)
     with sandbox(spec=spec, delete_on_exit=True) as sb:
-        result = sb.exec_python(_proxy_connect(), args=("deep.sub.anthropic.com", 443))
+        result = sb.exec_python(_proxy_connect(), args=("deep.sub.example.com", 443))
         assert result.exit_code == 0, result.stderr
         assert "403" in result.stdout, (
-            f"*.anthropic.com should NOT match deep.sub.anthropic.com: {result.stdout}"
+            f"*.example.com should NOT match deep.sub.example.com: {result.stdout}"
         )
 
 

e2e/rust/tests/forward_proxy_graphql_l7.rs

@@ -317,7 +317,6 @@ def forward_chunked_status(query):
             f"\r\n"
         ).encode() + chunk
         sock.sendall(request)
-        sock.shutdown(socket.SHUT_WR)
         response, body = read_response(sock)
         DETAILS["forward_chunked_query_allowed_detail"] = body.decode(errors="replace")
         return int(response.split()[1])