From f4a1938069f111f9b39f8d51ae80c2d807cf9bb3 Mon Sep 17 00:00:00 2001
From: David Wiesen <iceweasel@openai.com>
Date: Fri, 17 Apr 2026 02:03:16 -0700
Subject: [PATCH] Fix Windows sandbox firewall remote port setup

---
 codex-rs/windows-sandbox-rs/src/firewall.rs | 47 +++++++++++++++++----
 1 file changed, 39 insertions(+), 8 deletions(-)

diff --git a/codex-rs/windows-sandbox-rs/src/firewall.rs b/codex-rs/windows-sandbox-rs/src/firewall.rs
index c0caa165fc..c058c39163 100644
--- a/codex-rs/windows-sandbox-rs/src/firewall.rs
+++ b/codex-rs/windows-sandbox-rs/src/firewall.rs
@@ -317,14 +317,16 @@ fn configure_rule(rule: &INetFwRule3, spec: &BlockRuleSpec<'_>) -> Result<()> {
                     format!("SetRemoteAddresses failed: {err:?}"),
                 ))
             })?;
-        let remote_ports = spec.remote_ports.unwrap_or("*");
-        rule.SetRemotePorts(&BSTR::from(remote_ports))
-            .map_err(|err| {
-                anyhow::Error::new(SetupFailure::new(
-                    SetupErrorCode::HelperFirewallRuleCreateOrAddFailed,
-                    format!("SetRemotePorts failed: {err:?}"),
-                ))
-            })?;
+        if firewall_protocol_supports_remote_ports(spec.protocol) {
+            let remote_ports = spec.remote_ports.unwrap_or("*");
+            rule.SetRemotePorts(&BSTR::from(remote_ports))
+                .map_err(|err| {
+                    anyhow::Error::new(SetupFailure::new(
+                        SetupErrorCode::HelperFirewallRuleCreateOrAddFailed,
+                        format!("SetRemotePorts failed: {err:?}"),
+                    ))
+                })?;
+        }
         rule.SetLocalUserAuthorizedList(&BSTR::from(spec.local_user_spec))
             .map_err(|err| {
                 anyhow::Error::new(SetupFailure::new(
@@ -354,6 +356,10 @@ fn configure_rule(rule: &INetFwRule3, spec: &BlockRuleSpec<'_>) -> Result<()> {
     Ok(())
 }
 
+fn firewall_protocol_supports_remote_ports(protocol: i32) -> bool {
+    protocol == NET_FW_IP_PROTOCOL_TCP.0 || protocol == NET_FW_IP_PROTOCOL_UDP.0
+}
+
 fn blocked_loopback_tcp_remote_ports(proxy_ports: &[u16]) -> Option<String> {
     let mut allowed_ports = proxy_ports
         .iter()
@@ -400,3 +406,28 @@ fn log_line(log: &mut File, msg: &str) -> Result<()> {
     writeln!(log, "[{ts}] {msg}")?;
     Ok(())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::firewall_protocol_supports_remote_ports;
+    use windows::Win32::NetworkManagement::WindowsFirewall::NET_FW_IP_PROTOCOL_ANY;
+    use windows::Win32::NetworkManagement::WindowsFirewall::NET_FW_IP_PROTOCOL_TCP;
+    use windows::Win32::NetworkManagement::WindowsFirewall::NET_FW_IP_PROTOCOL_UDP;
+
+    #[test]
+    fn remote_ports_are_not_applied_to_any_protocol_rules() {
+        assert!(!firewall_protocol_supports_remote_ports(
+            NET_FW_IP_PROTOCOL_ANY.0
+        ));
+    }
+
+    #[test]
+    fn remote_ports_are_applied_to_tcp_and_udp_rules() {
+        assert!(firewall_protocol_supports_remote_ports(
+            NET_FW_IP_PROTOCOL_TCP.0
+        ));
+        assert!(firewall_protocol_supports_remote_ports(
+            NET_FW_IP_PROTOCOL_UDP.0
+        ));
+    }
+}