openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-08-23 13:09:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

Ignore Unix socket proxy settings on Windows (#37889)

Browse Source 
## Why

Unix socket proxy permissions are macOS-only, but configuring them could still
clamp Windows proxy listeners to loopback and emit warnings about unsupported
settings.

## What changed

- Exclude Unix socket permissions from Windows runtime settings and bind-address
  clamping.
- Suppress the macOS-only Unix socket warning on Windows.
- Preserve the original configuration for state updates and remote launch
  configuration.

## Testing

Add coverage for proxy startup, live configuration replacement, remote launch
configuration, and warning behavior with Unix socket permissions configured.

GitOrigin-RevId: 5d72f5365486ab11ae3cf5edfd78da665e05344d
This commit is contained in:
viyatb-oai
2026-08-10 22:15:17 +00:00
committed by copyberry
parent cc2f262033
commit 9742cc8ed5
1 changed files with 111 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

118
codex-rs/network-proxy/src/proxy.rs
View File

@@ -201,9 +201,15 @@ impl NetworkProxyBuilder {
.await;
let current_cfg = state.current_cfg().await?;
#[cfg(target_os = "windows")]
let runtime_settings = NetworkProxyRuntimeSettings::from_config(&current_cfg)?;
#[cfg(target_os = "windows")]
let mut windows_ingress = None;
let (current_cfg, runtime_settings, mut windows_ingress) = {
let current_cfg = config::NetworkProxyConfig {
dangerously_allow_all_unix_sockets: false,
unix_sockets: None,
..current_cfg
};
let runtime_settings = NetworkProxyRuntimeSettings::from_config(&current_cfg)?;
(current_cfg, runtime_settings, None)
};
let (requested_http_addr, requested_socks_addr, reserved_listeners) = if self
.managed_by_codex
{
@@ -390,8 +396,13 @@ impl NetworkProxyRuntimeSettings {
};
Ok(Self {
allow_local_binding: config.allow_local_binding,
allow_unix_sockets: config.allow_unix_sockets().into(),
dangerously_allow_all_unix_sockets: config.dangerously_allow_all_unix_sockets,
allow_unix_sockets: if cfg!(target_os = "windows") {
Arc::default()
} else {
config.allow_unix_sockets().into()
},
dangerously_allow_all_unix_sockets: !cfg!(target_os = "windows")
&& config.dangerously_allow_all_unix_sockets,
mitm_ca_trust_bundle,
})
}
@@ -1268,7 +1279,7 @@ impl NetworkProxy {
return Ok(NetworkProxyHandle::noop());
}
if !unix_socket_permissions_supported() {
if !cfg!(target_os = "windows") && !unix_socket_permissions_supported() {
warn!(
"allowUnixSockets and dangerouslyAllowAllUnixSockets are macOS-only; requests will be rejected on this platform"
);
@@ -1546,6 +1557,91 @@ mod tests {
})
}
#[tokio::test]
async fn proxy_startup_ignores_macos_unix_socket_permissions_on_windows() -> Result<()> {
let unix_sockets = crate::config::NetworkUnixSocketPermissions {
entries: [
(
"/tmp/allowed.sock".to_string(),
crate::config::NetworkUnixSocketPermission::Allow,
),
(
"/tmp/denied.sock".to_string(),
crate::config::NetworkUnixSocketPermission::Deny,
),
]
.into_iter()
.collect(),
};
let config = NetworkProxyConfig {
enabled: true,
proxy_url: "http://0.0.0.0:3128".to_string(),
socks_url: "http://0.0.0.0:8081".to_string(),
dangerously_allow_non_loopback_proxy: true,
dangerously_allow_all_unix_sockets: true,
unix_sockets: Some(unix_sockets.clone()),
..NetworkProxyConfig::default()
};
let state = Arc::new(network_proxy_state_for_policy(config.clone()));
let (result, events) = crate::network_policy::test_support::capture_events(|| async {
NetworkProxy::builder()
.state(state)
.managed_by_codex(/*managed_by_codex*/ false)
.build()
.await
})
.await;
let proxy = result?;
let expected_bind_host = if cfg!(target_os = "windows") {
"0.0.0.0"
} else {
"127.0.0.1"
};
assert_eq!(
(proxy.http_addr, proxy.socks_addr),
(
format!("{expected_bind_host}:3128").parse::<SocketAddr>()?,
format!("{expected_bind_host}:8081").parse::<SocketAddr>()?,
)
);
let replacement = crate::state::build_config_state(config.clone(), Default::default())?;
proxy.replace_config_state(replacement).await?;
let expected_unix_sockets = if cfg!(target_os = "windows") {
Vec::new()
} else {
vec!["/tmp/allowed.sock".to_string()]
};
assert_eq!(
proxy.allow_unix_sockets().as_ref(),
expected_unix_sockets.as_slice()
);
assert_eq!(
proxy.dangerously_allow_all_unix_sockets(),
!cfg!(target_os = "windows")
);
assert_eq!(proxy.current_cfg().await?, config);
let remote = proxy.remote_launch_config().await?;
assert_eq!(
(
remote.proxy.unix_sockets,
remote.proxy.dangerously_allow_all_unix_sockets,
),
(Some(unix_sockets), true)
);
let emitted_unix_socket_warning = events.iter().any(|event| {
event.field("message").is_some_and(|message| {
message.contains("unix socket proxying is enabled")
|| message.contains("allowUnixSockets")
})
});
assert_eq!(emitted_unix_socket_warning, !cfg!(target_os = "windows"));
Ok(())
}
#[tokio::test]
async fn remote_policy_decider_rechecks_live_policy_and_restores_attribution() -> Result<()> {
let captured = Arc::new(Mutex::new(None));
@@ -1685,7 +1781,15 @@ mod tests {
assert_eq!(proxy.http_addr, http_addr);
assert_eq!(proxy.socks_addr, socks_addr);
assert_eq!(proxy.network_proxy_restricting_sid(None), None);
let handle = proxy.run().await.expect("start stable ingress route");
let (result, events) =
crate::network_policy::test_support::capture_events(|| async { proxy.run().await })
.await;
let handle = result.expect("start stable ingress route");
assert!(!events.iter().any(|event| {
event
.field("message")
.is_some_and(|message| message.contains("allowUnixSockets"))
}));
let second_state = Arc::new(network_proxy_state_for_policy(NetworkProxyConfig {
enabled: true,
proxy_url: format!("http://{http_addr}"),