tests: verify exec traffic is policy-checked in caps proxy test

Extend testBuildPolicyCapsProxy so that instead of only checking that
the network proxy was enabled, the build runs a command that makes an
HTTP request to a local test server. The policy denies that URL as an
HTTP source, so the test now verifies that exec traffic actually flows
through the proxy and is subject to source policy, including the deny
message and DENY decision in the build output.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>

Author: tonistiigi

tests/policy_build.go

@@ -44,27 +44,37 @@ var policyBuildTests = []func(t *testing.T, sb integration.Sandbox){
 	testBuildPolicyCapsProxyUnsupported,
 }
 
-var policyCapsProxyFile = []byte(`
+func policyCapsProxyFile(serverURL string) []byte {
+	return fmt.Appendf(nil, `
 package docker
 default allow = true
+default deny_msg := []
 default caps := {}
 caps := {"exec.proxy": true} if input.env.capsRequest
-decision := {"allow": allow, "caps": caps}
-`)
+allow := false if input.http.url == "%s/file"
+deny_msg := ["exec proxy http source denied by policy"] if input.http.url == "%s/file"
+decision := {"allow": allow, "deny_msg": deny_msg, "caps": caps}
+`, serverURL, serverURL)
+}
 
 func testBuildPolicyCapsProxy(t *testing.T, sb integration.Sandbox) {
 	if buildkitTag() != "master" {
 		skipNoCompatBuildKit(t, sb, ">= 0.31.0-0", "network proxy requires BuildKit v0.31.0+")
 	}
+	resp := &httpserver.Response{Content: []byte("policy-caps-proxy")}
+	server := httpserver.NewTestServer(map[string]*httpserver.Response{
+		"/file": resp,
+	})
+	defer server.Close()
+
 	dockerfile := []byte(`
-FROM scratch
-COPY foo /foo
+FROM busybox:latest
+RUN wget -O- ` + server.URL + `/file
 `)
 	dir := tmpdir(
 		t,
 		fstest.CreateFile("Dockerfile", dockerfile, 0600),
-		fstest.CreateFile("Dockerfile.rego", policyCapsProxyFile, 0600),
-		fstest.CreateFile("foo", []byte("foo"), 0600),
+		fstest.CreateFile("Dockerfile.rego", policyCapsProxyFile(server.URL), 0600),
 	)
 
 	cmd := buildxCmd(sb, withDir(dir), withArgs(
@@ -74,8 +84,11 @@ COPY foo /foo
 		dir,
 	))
 	out, err := cmd.CombinedOutput()
-	require.NoError(t, err, string(out))
+	require.Error(t, err, string(out))
 	require.Contains(t, string(out), "policy enabled network proxy")
+	require.Contains(t, string(out), "exec proxy http source denied by policy")
+	require.Contains(t, string(out), "policy decision for source "+server.URL+"/file")
+	require.Contains(t, string(out), "DENY")
 }
 
 func testBuildPolicyCapsProxyUnsupported(t *testing.T, sb integration.Sandbox) {
@@ -90,7 +103,7 @@ COPY foo /foo
 	dir := tmpdir(
 		t,
 		fstest.CreateFile("Dockerfile", dockerfile, 0600),
-		fstest.CreateFile("Dockerfile.rego", policyCapsProxyFile, 0600),
+		fstest.CreateFile("Dockerfile.rego", policyCapsProxyFile(""), 0600),
 		fstest.CreateFile("foo", []byte("foo"), 0600),
 	)