mirror of
https://github.com/openai/codex.git
synced 2026-10-23 18:08:45 +00:00
viyatb-oai
129220bf05
## Why The network proxy previously required AWS signing requests to have an empty body or use `UNSIGNED-PAYLOAD`, preventing signing of nonempty payloads. ## What changed - Buffer and hash request bodies before signing, then forward the original bytes. - Add `max_body_bytes` with an 8 MiB default and a 16 MiB maximum, plus a 30-second body read timeout. - Limit concurrent buffering to eight requests with a five-second capacity wait. Retain reservations while forwarded body data remains alive. - Reject trailers and mismatched content lengths for buffered payloads while preserving streaming for explicitly unsigned payloads. ## Testing Add coverage for payload hashing and forwarding, body limits and timeouts, fragmented body collection, and buffer reservation lifetimes. Extend signing tests for S3 path and query canonicalization, header replacement, and secret exclusion from trace logs. GitOrigin-RevId: 48c18442fa90ae3efb1a4a99a168d07e1be2c496
83 lines
2.5 KiB
TOML
83 lines
2.5 KiB
TOML
[package]
|
|
name = "codex-network-proxy"
|
|
edition.workspace = true
|
|
version.workspace = true
|
|
license.workspace = true
|
|
|
|
[lib]
|
|
name = "codex_network_proxy"
|
|
path = "src/lib.rs"
|
|
doctest = false
|
|
|
|
[[bin]]
|
|
name = "codex-network-proxy"
|
|
path = "src/main.rs"
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
anyhow = { workspace = true }
|
|
aws-credential-types = { workspace = true }
|
|
aws-sigv4 = { workspace = true }
|
|
base64 = { workspace = true }
|
|
clap = { workspace = true, features = ["derive"] }
|
|
chrono = { workspace = true }
|
|
codex-utils-absolute-path = { workspace = true }
|
|
codex-utils-home-dir = { workspace = true }
|
|
codex-utils-path-uri = { workspace = true }
|
|
codex-utils-rustls-provider = { workspace = true }
|
|
globset = { workspace = true }
|
|
opentelemetry = { workspace = true }
|
|
rand = { workspace = true }
|
|
rand_regex = { workspace = true }
|
|
regex = { workspace = true }
|
|
regex-automata = { workspace = true }
|
|
regex-syntax = { workspace = true }
|
|
schemars = { workspace = true }
|
|
serde = { workspace = true, features = ["derive"] }
|
|
serde_ignored = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
time = { workspace = true }
|
|
tokio = { workspace = true, features = ["full"] }
|
|
tracing = { workspace = true }
|
|
tracing-subscriber = { workspace = true, features = ["env-filter"] }
|
|
url = { workspace = true }
|
|
rama-core = { version = "=0.3.0-alpha.4" }
|
|
rama-http = { version = "=0.3.0-alpha.4" }
|
|
rama-http-backend = { version = "=0.3.0-alpha.4", features = ["tls"] }
|
|
rama-net = { version = "=0.3.0-alpha.4", features = ["http", "tls"] }
|
|
rama-socks5 = { version = "=0.3.0-alpha.4" }
|
|
rama-tcp = { version = "=0.3.0-alpha.4", features = ["http"] }
|
|
rama-tls-rustls = { version = "=0.3.0-alpha.4", features = ["http"] }
|
|
rustls-native-certs = { workspace = true }
|
|
sha2 = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
pretty_assertions = { workspace = true }
|
|
tempfile = { workspace = true }
|
|
tokio = { workspace = true, features = ["test-util"] }
|
|
|
|
[target.'cfg(target_family = "unix")'.dependencies]
|
|
libc = { workspace = true }
|
|
rama-unix = { version = "=0.3.0-alpha.4" }
|
|
|
|
[target.'cfg(target_os = "macos")'.dependencies]
|
|
rama-dns = { version = "=0.3.0-alpha.4" }
|
|
security-framework = "3"
|
|
|
|
[target.'cfg(windows)'.dependencies]
|
|
schannel = "0.1"
|
|
windows-sys = { workspace = true, features = [
|
|
"Win32_Foundation",
|
|
"Win32_NetworkManagement_IpHelper",
|
|
"Win32_Networking_WinSock",
|
|
"Win32_Security",
|
|
"Win32_Security_Authorization",
|
|
"Win32_System_Threading",
|
|
] }
|
|
|
|
[target.'cfg(windows)'.dev-dependencies]
|
|
codex-windows-sandbox = { path = "../windows-sandbox-rs" }
|