From 25db0fb0509022b001a477b1cdc172e8dbdeb632 Mon Sep 17 00:00:00 2001
From: Tonis Tiigi <tonistiigi@gmail.com>
Date: Tue, 9 Jun 2026 23:50:46 -0700
Subject: [PATCH] tests: verify exec traffic is policy-checked in caps proxy
 test

Extend testBuildPolicyCapsProxy so that instead of only checking that
the network proxy was enabled, the build runs a command that makes an
HTTP request to a local test server. The policy denies that URL as an
HTTP source, so the test now verifies that exec traffic actually flows
through the proxy and is subject to source policy, including the deny
message and DENY decision in the build output.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
---
 tests/policy_build.go | 31 ++++++++++++++++++++++---------
 1 file changed, 22 insertions(+), 9 deletions(-)

diff --git a/tests/policy_build.go b/tests/policy_build.go
index cbf9c8ac8..3c1fabf35 100644
--- a/tests/policy_build.go
+++ b/tests/policy_build.go
@@ -44,27 +44,37 @@ var policyBuildTests = []func(t *testing.T, sb integration.Sandbox){
 	testBuildPolicyCapsProxyUnsupported,
 }
 
-var policyCapsProxyFile = []byte(`
+func policyCapsProxyFile(serverURL string) []byte {
+	return fmt.Appendf(nil, `
 package docker
 default allow = true
+default deny_msg := []
 default caps := {}
 caps := {"exec.proxy": true} if input.env.capsRequest
-decision := {"allow": allow, "caps": caps}
-`)
+allow := false if input.http.url == "%s/file"
+deny_msg := ["exec proxy http source denied by policy"] if input.http.url == "%s/file"
+decision := {"allow": allow, "deny_msg": deny_msg, "caps": caps}
+`, serverURL, serverURL)
+}
 
 func testBuildPolicyCapsProxy(t *testing.T, sb integration.Sandbox) {
 	if buildkitTag() != "master" {
 		skipNoCompatBuildKit(t, sb, ">= 0.31.0-0", "network proxy requires BuildKit v0.31.0+")
 	}
+	resp := &httpserver.Response{Content: []byte("policy-caps-proxy")}
+	server := httpserver.NewTestServer(map[string]*httpserver.Response{
+		"/file": resp,
+	})
+	defer server.Close()
+
 	dockerfile := []byte(`
-FROM scratch
-COPY foo /foo
+FROM busybox:latest
+RUN wget -O- ` + server.URL + `/file
 `)
 	dir := tmpdir(
 		t,
 		fstest.CreateFile("Dockerfile", dockerfile, 0600),
-		fstest.CreateFile("Dockerfile.rego", policyCapsProxyFile, 0600),
-		fstest.CreateFile("foo", []byte("foo"), 0600),
+		fstest.CreateFile("Dockerfile.rego", policyCapsProxyFile(server.URL), 0600),
 	)
 
 	cmd := buildxCmd(sb, withDir(dir), withArgs(
@@ -74,8 +84,11 @@ COPY foo /foo
 		dir,
 	))
 	out, err := cmd.CombinedOutput()
-	require.NoError(t, err, string(out))
+	require.Error(t, err, string(out))
 	require.Contains(t, string(out), "policy enabled network proxy")
+	require.Contains(t, string(out), "exec proxy http source denied by policy")
+	require.Contains(t, string(out), "policy decision for source "+server.URL+"/file")
+	require.Contains(t, string(out), "DENY")
 }
 
 func testBuildPolicyCapsProxyUnsupported(t *testing.T, sb integration.Sandbox) {
@@ -90,7 +103,7 @@ COPY foo /foo
 	dir := tmpdir(
 		t,
 		fstest.CreateFile("Dockerfile", dockerfile, 0600),
-		fstest.CreateFile("Dockerfile.rego", policyCapsProxyFile, 0600),
+		fstest.CreateFile("Dockerfile.rego", policyCapsProxyFile(""), 0600),
 		fstest.CreateFile("foo", []byte("foo"), 0600),
 	)