opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-12-15 11:42:28 +08:00
Code Issues Packages Projects Releases Wiki Activity

Ensure that we appropriately warn that TCP is insecure

Browse Source 
`podman system service` + TCP is not a configuration we should be
recommending. There was already language about this in the
manpages, but it was not sufficient in explaining how bad of an
idea this is. Expand the manpage warnings, add a dedicated
heading so people notice, and add a warning every time the
service starts with a TCP URL that directs people to the manpage
to see that explanation.

Signed-off-by: Matt Heon <mheon@redhat.com>
This commit is contained in:
Matt Heon
2023-07-20 11:42:27 -04:00
parent 4315611ad2
commit ce736413b4
3 changed files with 20 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
test/system/271-tcp-cors-server.bats
View File

@@ -16,13 +16,18 @@ SOCKET_FILE="$UNIT_DIR/$SERVICE_NAME.socket"
@test "podman system service - tcp CORS" {
skip_if_remote "system service tests are meaningless over remote"
PORT=$(random_free_port 63000-64999)
$PODMAN system service --cors="*" tcp:$SERVICE_TCP_HOST:$PORT -t 20 &
log=${PODMAN_TMPDIR}/system-service.log
$PODMAN system service --cors="*" tcp:$SERVICE_TCP_HOST:$PORT -t 20 2> $log &
podman_pid="$!"
sleep 5s
run curl -s --max-time 10 -vvv $SERVICE_TCP_HOST:$PORT/_ping 2>&1
is "$output" ".*< Access-Control-Allow-Origin: \*.*" "access-control-allow-origin verifies CORS is set"
kill $podman_pid
wait $podman_pid || true
# Running server over TCP is a bad idea. We should see a warning
assert "$(< $log)" =~ "Using the Podman API service with TCP sockets" \
"podman warns about server on TCP"
}
@test "podman system service - tcp without CORS" {