openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-09-05 15:18:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'dev/winston/mitm-platform-ca-roots' into dev/winston/mitm-startup-ca-env

Browse Source 
# Conflicts:
#	codex-rs/network-proxy/src/certs.rs
This commit is contained in:
Winston Howes
2026-06-04 03:46:27 -07:00
parent 130450a9fa 750e73e047
commit caebf7980f
1 changed files with 28 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
codex-rs/network-proxy/src/certs.rs
View File

@@ -23,6 +23,7 @@ use rama_tls_rustls::server::TlsAcceptorData;
use sha2::Digest as _;
use sha2::Sha256;
use std::collections::HashMap;
use std::collections::HashSet;
use std::fs;
use std::fs::File;
use std::fs::OpenOptions;
@@ -160,7 +161,7 @@ fn managed_ca_trust_bundle_for_cert_path(
.map(|value| (key, value.clone()))
})
.collect();
let trust_bundle = build_managed_ca_trust_bundle(cert_path)?;
let trust_bundle = build_managed_ca_trust_bundle(cert_path, &startup_env_values)?;
let path = persist_managed_ca_trust_bundle(cert_path, &trust_bundle)?;
Ok(ManagedMitmCaTrustBundle {
@@ -170,7 +171,10 @@ fn managed_ca_trust_bundle_for_cert_path(
})
}
fn build_managed_ca_trust_bundle(managed_ca_cert_path: &Path) -> Result<String> {
fn build_managed_ca_trust_bundle(
managed_ca_cert_path: &Path,
startup_env_values: &HashMap<&'static str, String>,
) -> Result<String> {
let mut trust_bundle = String::new();
let rustls_native_certs::CertificateResult { certs, errors, .. } =
crate::native_certs::load_platform_native_certs();
@@ -183,6 +187,16 @@ fn build_managed_ca_trust_bundle(managed_ca_cert_path: &Path) -> Result<String>
for cert in certs {
push_certificate_pem(&mut trust_bundle, cert.as_ref());
}
let mut appended_startup_paths = HashSet::new();
for path in CUSTOM_CA_ENV_KEYS
.into_iter()
.filter_map(|key| startup_env_values.get(key))
.map(Path::new)
{
if path != managed_ca_cert_path && appended_startup_paths.insert(path) {
append_pem_file(&mut trust_bundle, path)?;
}
}
append_pem_file(&mut trust_bundle, managed_ca_cert_path)?;
Ok(trust_bundle)
}
@@ -518,24 +532,30 @@ mod tests {
fn managed_ca_trust_bundle_records_startup_ca_env_values() {
let dir = tempdir().unwrap();
let managed_ca_cert_path = dir.path().join("ca.pem");
let startup_ca_bundle_path = dir.path().join("startup-ca.pem");
let startup_cert_dir = dir.path().join("startup-certs");
fs::write(&managed_ca_cert_path, "managed ca\n").unwrap();
fs::write(&startup_ca_bundle_path, "startup ca\n").unwrap();
fs::create_dir(&startup_cert_dir).unwrap();
let startup_ca_bundle_path = startup_ca_bundle_path.display().to_string();
let startup_cert_dir = startup_cert_dir.display().to_string();
let env = HashMap::from([
("SSL_CERT_FILE", "/tmp/startup-ca.pem".to_string()),
(SSL_CERT_DIR_ENV_KEY, "/tmp/startup-certs".to_string()),
("SSL_CERT_FILE", startup_ca_bundle_path.clone()),
(SSL_CERT_DIR_ENV_KEY, startup_cert_dir.clone()),
]);
let trust_bundle =
managed_ca_trust_bundle_for_cert_path(&managed_ca_cert_path, &env).unwrap();
assert_eq!(
trust_bundle.startup_env_values,
HashMap::from([
("SSL_CERT_FILE", "/tmp/startup-ca.pem".to_string()),
(SSL_CERT_DIR_ENV_KEY, "/tmp/startup-certs".to_string()),
("SSL_CERT_FILE", startup_ca_bundle_path),
(SSL_CERT_DIR_ENV_KEY, startup_cert_dir),
])
);
}
#[test]
fn managed_ca_trust_bundle_does_not_append_startup_ca_override_to_baseline() {
fn managed_ca_trust_bundle_appends_startup_ca_override_to_baseline() {
let dir = tempdir().unwrap();
let managed_ca_cert_path = dir.path().join("ca.pem");
let startup_ca_bundle_path = dir.path().join("startup-ca.pem");
@@ -550,7 +570,7 @@ mod tests {
managed_ca_trust_bundle_for_cert_path(&managed_ca_cert_path, &env).unwrap();
let baseline_bundle = fs::read_to_string(trust_bundle.path).unwrap();
assert!(!baseline_bundle.contains("startup ca"));
assert!(baseline_bundle.contains("startup ca"));
assert!(baseline_bundle.contains("managed ca"));
}