mirror of
https://github.com/openai/codex.git
synced 2026-11-15 21:50:46 +00:00
viyatb-oai
7194b21776
## Why Native TCP clients need to reach managed network destinations without implementing proxy support themselves. ## What changed - Add `--transparent-tcp` to the Linux sandbox command, using a bundled TCP stack, private TUN interface, and DNS stub to route native IPv4 and IPv6 connections through the attributed managed SOCKS proxy. - Preserve original hostnames for proxy policy checks and cancel pending approval connections when their native sockets close. - Expose `--linux-sandbox-transparent-tcp` and `--tcp-upstream-proxy` on `codex exec-server` for transparent routing and a mandatory HTTP CONNECT next hop without direct fallback. - Require private network and PID namespaces, private procfs, system `bwrap`, and access to `/dev/net/tun`; reject incompatible launcher options and untrusted proxy ports. ## Testing Add integration coverage for native hostname and IPv6 connections, SOCKS attribution, pending connection cancellation, policy denials, and filesystem and host-loopback isolation. Extend launcher and executor tests for option validation and managed-policy propagation. GitOrigin-RevId: 96bd7726e5369efceb65320face56aa85ae3deb8
14 lines
567 B
Python
14 lines
567 B
Python
"""Expose the Ubuntu 24.04 bubblewrap executable as a Bazel test fixture."""
|
|
|
|
def _extract(ctx):
|
|
ctx.download_and_extract(
|
|
url = "https://archive.ubuntu.com/ubuntu/pool/main/b/bubblewrap/bubblewrap_0.9.0-1ubuntu0.3_amd64.deb",
|
|
sha256 = "2461f1beee9cb04c8942739fe1a2b37e7b7c2a3d518f0779dc75f9245baa3094",
|
|
type = "deb",
|
|
)
|
|
ctx.extract("data.tar.zst")
|
|
ctx.file("BUILD.bazel", 'exports_files(["usr/bin/bwrap"])')
|
|
return ctx.repo_metadata(reproducible = True)
|
|
|
|
managed_tcp_test_bwrap = repository_rule(implementation = _extract)
|