ocaml-docker/test/server/ at main · gazagnaire.org/ocaml-docker · Tangled

gazagnaire.org / ocaml-docker

0

Docker Engine API types and codecs in pure OCaml

0

ocaml-docker / test / server /

at main 8 files

Thomas Gazagnaire docker-proxy: differential fuzz of the request parser, strict Content-Length 3w ago

eio-net: add in-memory network backend

1 month ago

docker: AuthZ-plugin mode for the proxy policies (Server.Authz) Add Server.Authz, the Docker authorization-plugin protocol decided by the same Proxy.policy as the standalone proxy. Registered with `dockerd --authorization-plugin`, it answers the plugin handshake (Plugin.Activate -> implements authz) and the AuthZPlugin.AuthZReq/AuthZRes RPCs: it base64- decodes the daemon's RequestBody, turns the call into a Proxy.request, and returns {Allow,Msg} from the policy (a Rewrite is treated as allow, since the AuthZ protocol cannot modify the request). So no_privileged, read_only, and the Rego adapter all run BOTH as a standalone gateway and in-daemon -- the opa-docker-authz integration model over our policy surface. Test (test_authz.ml): drive the plugin over a socket -- the handshake advertises authz, and the no_privileged policy denies a privileged create and allows a plain one.

1 month ago

eio-net: add in-memory network backend

1 month ago

docker: AuthZ-plugin mode for the proxy policies (Server.Authz) Add Server.Authz, the Docker authorization-plugin protocol decided by the same Proxy.policy as the standalone proxy. Registered with `dockerd --authorization-plugin`, it answers the plugin handshake (Plugin.Activate -> implements authz) and the AuthZPlugin.AuthZReq/AuthZRes RPCs: it base64- decodes the daemon's RequestBody, turns the call into a Proxy.request, and returns {Allow,Msg} from the policy (a Rewrite is treated as allow, since the AuthZ protocol cannot modify the request). So no_privileged, read_only, and the Rego adapter all run BOTH as a standalone gateway and in-daemon -- the opa-docker-authz integration model over our policy surface. Test (test_authz.ml): drive the plugin over a socket -- the handshake advertises authz, and the no_privileged policy denies a privileged create and allows a plain one.

1 month ago

docker-proxy: differential fuzz of the request parser, strict Content-Length Cross-check the proxy's hand-rolled request-head parser against the strict RFC 9112 parser in nox-http: for every generated request the proxy must never trust an n-byte body a strict parser frames differently (the smuggling root), and must refuse the ambiguous framings that parser rejects. Exposed via Proxy.classify. The fuzz immediately found the gap it was built for: content_length used int_of_string, which accepts 0x10, 5_0 and +5 -- none valid HTTP -- so the proxy trusted a length the daemon would reject. Content-Length is now parsed as a single run of ASCII digits, and a malformed or comma-list value is refused as invalid framing alongside the TE+CL and conflicting-length checks.

3 weeks ago

docker: in-flight proxy server work (snapshot to clean the tree) Concurrent proxy/server changes committed as-is; not authored in this session.

1 month ago

eio-net: add in-memory network backend

1 month ago

test_server.mli

docker: GET /networks; e2e/runner tests follow the test.ml convention Add the networks resource: Docker.Network with the three networks every daemon has (bridge/host/none), served at GET /networks and exposed as Client.Network.list. Real network management is a follow-up; the defaults are honest. The real docker CLI's `docker network ls` lists them. Also restructure the standalone e2e/runner tests to the merlint test convention (E600/E617): test_*.ml export a `suite` named after the file, Alcotest.run moves into a sibling test.ml, and each e2e case drives its own Eio main. test/runner, test/client, test/server each gain a test.ml + test_*.mli.

1 month ago