mirror of
https://github.com/openai/codex.git
synced 2026-11-14 21:40:39 +00:00
Anton Panasenko
c82708f858
## Why The existing loopback listener mode does not provide the stdin/stdout transport needed by OpenSSH's `ProxyCommand`. ## What changed - Relay one SSH session over HTTP/3 CONNECT with `--environment-id ENV --port PORT`, defaulting to the public Portals gateway and port 22. Also accept an explicit `--proxy-url` with `--target ENV:PORT`. - Require ChatGPT OAuth login, enforce cloud configuration and application network policy, and restrict OAuth credentials to the built-in gateway origin. Leave SSH authentication and host-key verification to OpenSSH. - Preserve binary stdio, propagate input half-close, exit on gateway EOF, and report rejected CONNECT requests by HTTP status without exposing arbitrary peer error text. - Require ERS-issued v2 tunnel JWTs for Portals listener mode unless OAuth mode is selected, and reject older ERS tunnel JWTs during credential updates. - Disable UDP segmentation offload for SSH tunnels on Linux to avoid stalled bulk transfers on affected paths. Document an OpenSSH configuration example. ## Testing Add coverage for argument validation, gateway routing, credential boundaries, JWT startup and renewal checks, binary relay and half-close behavior, gateway EOF and rejection, and cloud policy enforcement before gateway connection. GitOrigin-RevId: 0d9afbddef01748efcc1c4b88f7e19923deff7e1
32 lines
1.0 KiB
TOML
32 lines
1.0 KiB
TOML
[package]
|
|
name = "codex-tcp-tunnel"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
|
|
[lib]
|
|
doctest = false
|
|
|
|
[dependencies]
|
|
anyhow = { workspace = true }
|
|
base64 = { workspace = true }
|
|
bytes = { workspace = true }
|
|
clap = { workspace = true, features = ["derive"] }
|
|
h3 = { git = "https://github.com/hyperium/h3", rev = "e07e69412876f7e26f026bd75a48b2704d8c8283" }
|
|
h3-quinn = { git = "https://github.com/hyperium/h3", rev = "e07e69412876f7e26f026bd75a48b2704d8c8283" }
|
|
http = { workspace = true }
|
|
quinn = { version = "0.11", default-features = false, features = ["runtime-tokio", "rustls-ring"] }
|
|
rand = { workspace = true }
|
|
rustls = { workspace = true, features = ["ring", "std"] }
|
|
rustls-native-certs = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
tokio = { workspace = true, features = ["io-util", "macros", "net", "rt-multi-thread", "sync", "time"] }
|
|
url = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
pretty_assertions = { workspace = true }
|
|
rcgen = { workspace = true }
|
|
|
|
[lints]
|
|
workspace = true
|