mirror of
https://github.com/openai/codex.git
synced 2026-09-20 12:47:38 +00:00
999a715089
## Why Elevated Windows sandboxes need stable managed-proxy ports while preserving the network policy and environment attribution of each sandboxed process. ## What changed - Keep shared HTTP and SOCKS5 loopback ingress listeners alive across managed-proxy instances. - Add a per-route restricting SID to elevated sandbox tokens and dispatch incoming connections to the matching proxy policy after attributing the client process. - Reject connections without exactly one registered route, remove routes when their proxy handle is dropped, and keep unsandboxed Windows launches off the managed ingress. - Provision the elevated sandbox with the configured proxy ports and local-binding setting, honoring the selected profile and CLI overrides. ## Testing - Add Windows unit tests for TCP ownership attribution, route selection, restricting-token propagation, and setup settings. - Add an end-to-end Windows test covering stable ports, isolated environment policies, HTTP and SOCKS5 routing, and route teardown. GitOrigin-RevId: 783fac6e0f904dc9bb1955b75d4a5895e8bb9690
44 lines
1.4 KiB
Rust
44 lines
1.4 KiB
Rust
use super::*;
|
|
use rama_core::service::service_fn;
|
|
|
|
#[test]
|
|
fn selects_exactly_one_registered_route() {
|
|
let route = route_services();
|
|
let routes = HashMap::from([("registered".to_string(), Arc::clone(&route))]);
|
|
|
|
let selected = registered_route_for_sids(
|
|
&routes,
|
|
&["unrelated".to_string(), "registered".to_string()],
|
|
)
|
|
.expect("one registered route should be selected");
|
|
|
|
assert!(Arc::ptr_eq(&selected, &route));
|
|
}
|
|
|
|
#[test]
|
|
fn rejects_missing_or_ambiguous_registered_routes() {
|
|
let first = route_services();
|
|
let second = route_services();
|
|
let routes = HashMap::from([("first".to_string(), first), ("second".to_string(), second)]);
|
|
|
|
let Err(missing) = registered_route_for_sids(&routes, &["missing".to_string()]) else {
|
|
panic!("an unknown SID should fail closed");
|
|
};
|
|
let Err(ambiguous) =
|
|
registered_route_for_sids(&routes, &["first".to_string(), "second".to_string()])
|
|
else {
|
|
panic!("multiple registered SIDs should fail closed");
|
|
};
|
|
|
|
assert_eq!(missing.kind(), io::ErrorKind::PermissionDenied);
|
|
assert_eq!(ambiguous.kind(), io::ErrorKind::PermissionDenied);
|
|
}
|
|
|
|
fn route_services() -> Arc<RouteServices> {
|
|
let service = service_fn(|_stream: TcpStream| async { Ok::<(), BoxError>(()) }).boxed();
|
|
Arc::new(RouteServices {
|
|
http: service,
|
|
socks: None,
|
|
})
|
|
}
|