8121b8f438
`_get_proxy_for_base_url` lost its guard when it moved onto the shared matcher: `split_host_port` read `urlsplit(...).port`, which raises ValueError for `http://host:notaport/v1` or `:99999`, and `build_keepalive_http_client`'s outer except then returned None -- the client silently lost the shared pool instead of merely skipping the bypass check. The port parse now yields `(host, None)` on ValueError only; the host still matches NO_PROXY entries. Review follow-up on #109539.
60 lines
2.9 KiB
Python
60 lines
2.9 KiB
Python
"""Invariant: the LLM transport (``agent/process_bootstrap``) and the platform adapters
|
|
(``gateway/platforms/base``) answer "is this host in NO_PROXY" with the same matcher, so a
|
|
corporate ``NO_PROXY=10.0.0.0/8`` bypasses the proxy for a self-hosted ``10.x`` model endpoint
|
|
exactly as it does for Telegram/Discord/Slack.
|
|
"""
|
|
|
|
import pytest
|
|
|
|
from agent.process_bootstrap import _get_proxy_for_base_url
|
|
from agent.proxy_bypass import should_bypass_proxy
|
|
from gateway.platforms.base import is_host_excluded_by_no_proxy, resolve_proxy_url
|
|
|
|
_PROXY_KEYS = ("HTTPS_PROXY", "HTTP_PROXY", "ALL_PROXY", "https_proxy", "http_proxy", "all_proxy",
|
|
"NO_PROXY", "no_proxy")
|
|
|
|
|
|
@pytest.fixture
|
|
def proxy_env(monkeypatch):
|
|
for key in _PROXY_KEYS:
|
|
monkeypatch.delenv(key, raising=False)
|
|
monkeypatch.setenv("HTTPS_PROXY", "http://proxy.corp:3128")
|
|
monkeypatch.setattr("gateway.platforms.base.gateway_trust_env", lambda: True)
|
|
monkeypatch.setattr("gateway.platforms.base._detect_macos_system_proxy", lambda: None)
|
|
return monkeypatch
|
|
|
|
|
|
@pytest.mark.parametrize("no_proxy, host", [
|
|
("10.0.0.0/8", "10.1.2.3"),
|
|
("*.internal", "svc.internal"),
|
|
("*.slack.com", "slack.com"), # ``*.`` covers the apex, as the adapter docstring promised
|
|
(".slack.com", "slack.com"),
|
|
("localhost,.corp.example", "llm.corp.example"),
|
|
("api.example.com:8443", "api.example.com:8443"),
|
|
])
|
|
def test_llm_and_adapter_paths_bypass_the_same_entries(proxy_env, no_proxy, host):
|
|
proxy_env.setenv("NO_PROXY", no_proxy)
|
|
assert should_bypass_proxy(host)
|
|
assert _get_proxy_for_base_url(f"https://{host}/v1") is None
|
|
assert resolve_proxy_url(target_hosts=host) is None
|
|
assert is_host_excluded_by_no_proxy(host.split(":")[0]) or ":" in host # Slack passes bare hosts
|
|
|
|
|
|
def test_non_matching_host_keeps_the_proxy_on_both_paths(proxy_env):
|
|
proxy_env.setenv("NO_PROXY", "10.0.0.0/8,*.internal")
|
|
assert _get_proxy_for_base_url("https://api.openai.com/v1") == "http://proxy.corp:3128"
|
|
assert resolve_proxy_url(target_hosts="api.telegram.org") == "http://proxy.corp:3128"
|
|
assert not is_host_excluded_by_no_proxy("slack.com")
|
|
assert is_host_excluded_by_no_proxy("files.slack.com", "slack.com") # explicit value wins
|
|
assert not should_bypass_proxy("notslack.com", no_proxy_value="*.slack.com")
|
|
|
|
|
|
def test_malformed_port_in_base_url_keeps_the_proxy_instead_of_raising(proxy_env):
|
|
"""A ``host:notaport`` base_url must not raise out of the bypass check: the caller's
|
|
blanket ``except`` would otherwise drop the shared keepalive transport entirely."""
|
|
proxy_env.setenv("NO_PROXY", "other.example")
|
|
assert _get_proxy_for_base_url("http://host:notaport/v1") == "http://proxy.corp:3128"
|
|
assert _get_proxy_for_base_url("http://host:99999/v1") == "http://proxy.corp:3128"
|
|
proxy_env.setenv("NO_PROXY", "host")
|
|
assert _get_proxy_for_base_url("http://host:notaport/v1") is None # host still matched
|