mirror of
https://github.com/openai/codex.git
synced 2026-11-06 20:20:34 +00:00
viyatb-oai
457441bca9
## What changed - Export `StaticNetworkProxyConfig` to parse and serialize network policy with constraints, and validate them before building proxy state. - Add `--strict` and `from_slice_strict` for managed callers, requiring explicit `constraints` and rejecting unknown fields at every typed level. Default parsing permits top-level `metadata` and omitted constraints while still rejecting unknown policy fields. - Match allowed Unix socket paths case-sensitively when validating constraints. - Bound configuration file reads to the size limit plus one byte. ## Testing Add coverage for constraint round trips, weakened policy rejection, exact socket path matching, parsing modes, and CLI flag selection. Exercise automatic MITM enablement through both parsers. GitOrigin-RevId: c45d094624240f23dd4659128e72a4208d5d5f1c
139 lines
5.0 KiB
Rust
139 lines
5.0 KiB
Rust
#![deny(clippy::print_stdout, clippy::print_stderr)]
|
|
|
|
mod attribution;
|
|
mod authorization_path;
|
|
mod aws_sigv4;
|
|
mod body_budget;
|
|
mod brokered_tunnel;
|
|
mod certs;
|
|
mod config;
|
|
mod connect_policy;
|
|
mod connection_lifecycle;
|
|
mod credential_broker;
|
|
mod domain_matcher;
|
|
mod environment_policy;
|
|
mod http_proxy;
|
|
mod mitm;
|
|
mod mitm_hook;
|
|
mod native_certs;
|
|
mod network_policy;
|
|
mod policy;
|
|
mod process_log_metadata;
|
|
mod proxy;
|
|
mod reasons;
|
|
mod remote_config;
|
|
mod request_cancellation;
|
|
mod request_disconnect;
|
|
mod responses;
|
|
mod runtime;
|
|
mod secret_substitution;
|
|
mod socket_path;
|
|
mod socks5;
|
|
mod state;
|
|
#[cfg(target_os = "macos")]
|
|
mod system_dns;
|
|
mod upstream;
|
|
#[cfg(target_os = "windows")]
|
|
mod windows_proxy_ingress;
|
|
#[cfg(target_os = "windows")]
|
|
mod windows_tcp_attribution;
|
|
|
|
pub use attribution::PROXY_ATTRIBUTION_TOKEN_ENV_KEY;
|
|
pub use attribution::write_attribution_frame;
|
|
pub use aws_sigv4::AwsSigV4Config;
|
|
pub use aws_sigv4::ProxySecretSource;
|
|
pub use certs::CUSTOM_CA_ENV_KEYS;
|
|
pub use certs::is_managed_mitm_ca_trust_bundle_path;
|
|
pub use codex_utils_path_uri::Platform;
|
|
pub use config::NetworkDomainPermission;
|
|
pub use config::NetworkDomainPermissionEntry;
|
|
pub use config::NetworkDomainPermissions;
|
|
pub use config::NetworkMitmCaConfig;
|
|
pub use config::NetworkMode;
|
|
pub use config::NetworkProxyConfig;
|
|
pub use config::NetworkUnixSocketPermission;
|
|
pub use config::NetworkUnixSocketPermissions;
|
|
pub use config::StaticNetworkProxyConfig;
|
|
pub use config::host_and_port_from_network_addr;
|
|
pub use config::managed_proxy_ports;
|
|
pub use credential_broker::CREDENTIAL_BROKER_ACTIVE_ENV_KEY;
|
|
pub use credential_broker::CredentialAuthMethod;
|
|
pub use credential_broker::CredentialBrokerContext;
|
|
pub use credential_broker::CredentialBrokerEnvironment;
|
|
pub use credential_broker::CredentialMaskingFailureMode;
|
|
pub use credential_broker::CredentialProviderConfig;
|
|
pub use credential_broker::brokered_credential_binding_env_keys;
|
|
pub use credential_broker::brokered_credential_dummy_env_keys;
|
|
pub use credential_broker::brokered_credential_env_keys;
|
|
pub use credential_broker::brokered_credential_marker_env_keys;
|
|
pub use credential_broker::brokered_credential_value_env_keys;
|
|
pub use credential_broker::credential_broker_provider_context_env_keys;
|
|
pub use credential_broker::credential_broker_provider_sources_allowed;
|
|
pub use credential_broker::is_credential_broker_provider_env_key;
|
|
pub use environment_policy::EnvironmentNetworkPolicy;
|
|
pub use mitm_hook::InjectedHeaderConfig;
|
|
pub use mitm_hook::MitmHookActionsConfig;
|
|
pub use mitm_hook::MitmHookBodyConfig;
|
|
pub use mitm_hook::MitmHookConfig;
|
|
pub use mitm_hook::MitmHookMatchConfig;
|
|
pub use network_policy::NetworkDecision;
|
|
pub use network_policy::NetworkDecisionSource;
|
|
pub use network_policy::NetworkPolicyAuditEvent;
|
|
pub use network_policy::NetworkPolicyAuditObserver;
|
|
pub use network_policy::NetworkPolicyDecider;
|
|
pub use network_policy::NetworkPolicyDeciderFuture;
|
|
pub use network_policy::NetworkPolicyDecision;
|
|
pub use network_policy::NetworkPolicyRequest;
|
|
pub use network_policy::NetworkPolicyRequestArgs;
|
|
pub use network_policy::NetworkProtocol;
|
|
pub use policy::is_non_public_ip;
|
|
pub use policy::normalize_host;
|
|
pub use process_log_metadata::ExecutorLogIdentity;
|
|
pub use process_log_metadata::NetworkProxyProcessLogMetadata;
|
|
pub use proxy::ALL_PROXY_ENV_KEYS;
|
|
pub use proxy::ALLOW_LOCAL_BINDING_ENV_KEY;
|
|
pub use proxy::Args;
|
|
#[cfg(target_os = "macos")]
|
|
pub use proxy::CODEX_PROXY_GIT_SSH_COMMAND_MARKER;
|
|
pub use proxy::DEFAULT_NO_PROXY_VALUE;
|
|
pub use proxy::ManagedNetworkSandboxContext;
|
|
pub use proxy::ManagedProxyRouting;
|
|
pub use proxy::NO_PROXY_ENV_KEYS;
|
|
pub use proxy::NetworkProxy;
|
|
pub use proxy::NetworkProxyBuilder;
|
|
pub use proxy::NetworkProxyHandle;
|
|
pub use proxy::PROXY_ACTIVE_ENV_KEY;
|
|
pub use proxy::PROXY_ENV_KEYS;
|
|
#[cfg(target_os = "macos")]
|
|
pub use proxy::PROXY_GIT_SSH_COMMAND_ENV_KEY;
|
|
pub use proxy::PROXY_URL_ENV_KEYS;
|
|
pub use proxy::PreparedManagedNetwork;
|
|
pub use proxy::has_proxy_url_env_vars;
|
|
pub use proxy::is_managed_proxy_env_var;
|
|
pub use proxy::proxy_url_env_value;
|
|
pub use proxy::strip_managed_proxy_env;
|
|
pub use remote_config::RemoteCredentialBrokerCache;
|
|
pub use remote_config::RemoteCredentialMasking;
|
|
pub use remote_config::RemoteNetworkProxyConfig;
|
|
pub use remote_config::RemoteNetworkProxyLaunchConfig;
|
|
pub use request_cancellation::NetworkRequestCancellation;
|
|
pub use request_cancellation::NetworkRequestCancellationReason;
|
|
pub use request_disconnect::NetworkRequestDisconnect;
|
|
pub use runtime::BlockedRequest;
|
|
pub use runtime::BlockedRequestArgs;
|
|
pub use runtime::BlockedRequestObserver;
|
|
pub use runtime::BlockedRequestObserverFuture;
|
|
pub use runtime::ConfigReloader;
|
|
pub use runtime::ConfigReloaderFuture;
|
|
pub use runtime::ConfigState;
|
|
pub use runtime::LocalBindingPolicy;
|
|
pub use runtime::NetworkProxyState;
|
|
pub use secret_substitution::BodySecretReplacement;
|
|
pub use secret_substitution::BodySecretSubstitutionConfig;
|
|
pub use state::NetworkProxyAuditMetadata;
|
|
pub use state::NetworkProxyConstraintError;
|
|
pub use state::NetworkProxyConstraints;
|
|
pub use state::PartialNetworkProxyConfig;
|
|
pub use state::build_config_state;
|
|
pub use state::validate_policy_against_constraints;
|