--allow-hosts does not account for dynamic DNS resolution at runtime
When using --allow-hosts to permit network connections to specific hostnames, pytest-socket resolves these hostnames to IP addresses at the start of the test session. However, libraries like boto3 (which utilizes urllib3) perform DNS resolution at runtime, potentially obtaining different IP addresses.
As a result, even if a hostname is specified in --allow-hosts, connections made to IP addresses resolved during test execution are blocked, leading to unexpected SocketConnectBlockedError exceptions.
Steps to Reproduce:
-
Install
boto3,pytest, andpytest-socket. -
Write a test that uses
boto3to interact with an AWS service (e.g., listing S3 buckets). -
Run pytest with the following options:
pytest --disable-socket --allow-hosts=amazonaws.com -
Observe that the test fails with a
SocketConnectBlockedError, despiteamazonaws.combeing allowed.
Expected Behavior:
Allowing a hostname via --allow-hosts should permit all connections to that hostname, regardless of when DNS resolution occurs.
Actual Behavior:
Connections to IP addresses resolved at runtime are blocked, even if their corresponding hostnames are specified in --allow-hosts.
Additional Context:
This issue arises because pytest-socket resolves allowed hostnames to IP addresses only once at the beginning of the test session. If a library performs DNS resolution during test execution and obtains different IP addresses, these are not recognized as allowed, leading to blocked connections.
A potential solution could involve resolving hostnames at the time of each connection attempt