29 lines
1.2 KiB
Python
29 lines
1.2 KiB
Python
"""Run after root installs firewall. No keys or patient data are accessed."""
|
|
import subprocess
|
|
|
|
blocked_probe = """
|
|
import requests,sys
|
|
try:
|
|
response=requests.get('http://10.240.70.70:6003/mcp',timeout=4)
|
|
print('FAIL: direct 1C access returned HTTP',response.status_code)
|
|
sys.exit(1)
|
|
except requests.exceptions.Timeout:
|
|
print('PASS: direct 1C access timed out')
|
|
except requests.exceptions.RequestException as error:
|
|
print('INCONCLUSIVE: upstream unreachable:',type(error).__name__)
|
|
sys.exit(2)
|
|
"""
|
|
failures = 0
|
|
for name in ("dana-medical-api-1", "bright-app"):
|
|
print("Checking container network:", name, flush=True)
|
|
result = subprocess.run([
|
|
"docker", "run", "--rm", "--network", "container:" + name,
|
|
"--read-only", "--cap-drop", "ALL", "--security-opt", "no-new-privileges:true",
|
|
"--entrypoint", "python", "dana-1c-bridge:security-20261020", "-c", blocked_probe,
|
|
])
|
|
failures += result.returncode != 0
|
|
allowed_probe = "import requests,os; r=requests.get(os.environ['ONEC_MCP_URL'],timeout=4); print('Bridge reaches 1C, HTTP:',r.status_code)"
|
|
result = subprocess.run(["docker", "exec", "dana-1c-bridge", "python", "-c", allowed_probe])
|
|
failures += result.returncode != 0
|
|
raise SystemExit(1 if failures else 0)
|