mirror of
https://github.com/openai/codex.git
synced 2026-11-13 22:47:20 +00:00
Enable --deny-warnings for cargo shear (#21616)
## Summary In https://github.com/openai/codex/pull/21584, we disabled doctests for crates that lack any doctests. We can enforce that property via `cargo shear --deny-warnings`: crates that lack doctests will be flagged if doctests are enabled, and crates with doctests will be flagged if doctests are disabled. A few additional notes: - By adding `--deny-warnings`, `cargo shear` also flagged a number of modules that were not reachable at all. Some of those have been removed. - This PR removes a usage of `windows_modules!` (since `cargo shear` and `rustfmt` couldn't see through it) in favor of simple `#[cfg(target_os = "windows")]` macros. As a consequence, many of these files exhibit churn in this PR, since they weren't being formatted by `rustfmt` at all on main. - Again, to make the code more analyzable, this PR also removes some usages of `#[path = "cwd_junction.rs"]` in favor of a more standard module structure. The bin sidecar structure is still retained, but, e.g., `windows-sandbox-rs/src/bin/command_runner.rs` was moved to `windows-sandbox-rs/src/bin/command_runner/main.rs`, and so on. --------- Co-authored-by: Codex <noreply@openai.com>
This commit is contained in:
Charlie MarshandCodex authored and GitHub committed
1 parent
46e2250bcf
commit
7c9731c9af
47 files changed
+332
-1305
No files matched your search
@@ -0,0 +1,124 @@
|
||||
use windows_sys::Win32::NetworkManagement::WindowsFilteringPlatform::FWPM_LAYER_ALE_AUTH_CONNECT_V4;
|
||||
use windows_sys::Win32::NetworkManagement::WindowsFilteringPlatform::FWPM_LAYER_ALE_AUTH_CONNECT_V6;
|
||||
use windows_sys::Win32::NetworkManagement::WindowsFilteringPlatform::FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4;
|
||||
use windows_sys::Win32::NetworkManagement::WindowsFilteringPlatform::FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6;
|
||||
use windows_sys::Win32::Networking::WinSock::IPPROTO_ICMP;
|
||||
use windows_sys::Win32::Networking::WinSock::IPPROTO_ICMPV6;
|
||||
use windows_sys::core::GUID;
|
||||
|
||||
#[derive(Clone, Copy)]
|
||||
pub(super) enum ConditionSpec {
|
||||
User,
|
||||
Protocol(u8),
|
||||
RemotePort(u16),
|
||||
}
|
||||
|
||||
#[derive(Clone, Copy)]
|
||||
pub(super) struct FilterSpec {
|
||||
pub(super) key: GUID,
|
||||
pub(super) name: &'static str,
|
||||
pub(super) description: &'static str,
|
||||
pub(super) layer_key: GUID,
|
||||
pub(super) conditions: &'static [ConditionSpec],
|
||||
}
|
||||
|
||||
pub(super) const FILTER_SPECS: &[FilterSpec] = &[
|
||||
FilterSpec {
|
||||
key: GUID::from_u128(0x9f5f3812_79f0_4fe9_9615_4c2c92d2f0ff),
|
||||
name: "codex_wfp_icmp_connect_v4",
|
||||
description: "Block sandbox-account ICMP connect v4",
|
||||
layer_key: FWPM_LAYER_ALE_AUTH_CONNECT_V4,
|
||||
conditions: &[
|
||||
ConditionSpec::User,
|
||||
ConditionSpec::Protocol(IPPROTO_ICMP as u8),
|
||||
],
|
||||
},
|
||||
FilterSpec {
|
||||
key: GUID::from_u128(0x87498484_45ab_4510_845e_ece8b791b3bc),
|
||||
name: "codex_wfp_icmp_connect_v6",
|
||||
description: "Block sandbox-account ICMP connect v6",
|
||||
layer_key: FWPM_LAYER_ALE_AUTH_CONNECT_V6,
|
||||
conditions: &[
|
||||
ConditionSpec::User,
|
||||
ConditionSpec::Protocol(IPPROTO_ICMPV6 as u8),
|
||||
],
|
||||
},
|
||||
FilterSpec {
|
||||
key: GUID::from_u128(0xaf4751de_f874_4a7b_a34d_f0d0f22d1d9b),
|
||||
name: "codex_wfp_icmp_assign_v4",
|
||||
description: "Block sandbox-account ICMP resource assignment v4",
|
||||
layer_key: FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4,
|
||||
conditions: &[
|
||||
ConditionSpec::User,
|
||||
ConditionSpec::Protocol(IPPROTO_ICMP as u8),
|
||||
],
|
||||
},
|
||||
FilterSpec {
|
||||
key: GUID::from_u128(0xea10db66_a928_4b2e_a82e_a376a54f93ba),
|
||||
name: "codex_wfp_icmp_assign_v6",
|
||||
description: "Block sandbox-account ICMP resource assignment v6",
|
||||
layer_key: FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6,
|
||||
conditions: &[
|
||||
ConditionSpec::User,
|
||||
ConditionSpec::Protocol(IPPROTO_ICMPV6 as u8),
|
||||
],
|
||||
},
|
||||
// NAME_RESOLUTION_CACHE filters are intentionally omitted because ordinary
|
||||
// static filter shapes returned FWP_E_OUT_OF_BOUNDS during validation.
|
||||
FilterSpec {
|
||||
key: GUID::from_u128(0x83172805_f6be_4ae1_9dc6_6847aef04e7f),
|
||||
name: "codex_wfp_dns_53_v4",
|
||||
description: "Block sandbox-account DNS TCP or UDP port 53 v4",
|
||||
layer_key: FWPM_LAYER_ALE_AUTH_CONNECT_V4,
|
||||
conditions: &[ConditionSpec::User, ConditionSpec::RemotePort(53)],
|
||||
},
|
||||
FilterSpec {
|
||||
key: GUID::from_u128(0xd23b2efb_1efb_46b2_96f3_b0ccda5690c8),
|
||||
name: "codex_wfp_dns_53_v6",
|
||||
description: "Block sandbox-account DNS TCP or UDP port 53 v6",
|
||||
layer_key: FWPM_LAYER_ALE_AUTH_CONNECT_V6,
|
||||
conditions: &[ConditionSpec::User, ConditionSpec::RemotePort(53)],
|
||||
},
|
||||
FilterSpec {
|
||||
key: GUID::from_u128(0x420b026f_9dc9_4aea_88f4_0f2b9feab39a),
|
||||
name: "codex_wfp_dns_853_v4",
|
||||
description: "Block sandbox-account DNS-over-TLS port 853 v4",
|
||||
layer_key: FWPM_LAYER_ALE_AUTH_CONNECT_V4,
|
||||
conditions: &[ConditionSpec::User, ConditionSpec::RemotePort(853)],
|
||||
},
|
||||
FilterSpec {
|
||||
key: GUID::from_u128(0x8d917c81_99cc_45e7_84d6_824df860cfb8),
|
||||
name: "codex_wfp_dns_853_v6",
|
||||
description: "Block sandbox-account DNS-over-TLS port 853 v6",
|
||||
layer_key: FWPM_LAYER_ALE_AUTH_CONNECT_V6,
|
||||
conditions: &[ConditionSpec::User, ConditionSpec::RemotePort(853)],
|
||||
},
|
||||
FilterSpec {
|
||||
key: GUID::from_u128(0xe1d6e0af_ce5f_471b_b2d3_15ca00e966f3),
|
||||
name: "codex_wfp_smb_445_v4",
|
||||
description: "Block sandbox-account SMB port 445 v4",
|
||||
layer_key: FWPM_LAYER_ALE_AUTH_CONNECT_V4,
|
||||
conditions: &[ConditionSpec::User, ConditionSpec::RemotePort(445)],
|
||||
},
|
||||
FilterSpec {
|
||||
key: GUID::from_u128(0xc2bceca4_66ef_4a0f_ba80_f4f761b8c6f0),
|
||||
name: "codex_wfp_smb_445_v6",
|
||||
description: "Block sandbox-account SMB port 445 v6",
|
||||
layer_key: FWPM_LAYER_ALE_AUTH_CONNECT_V6,
|
||||
conditions: &[ConditionSpec::User, ConditionSpec::RemotePort(445)],
|
||||
},
|
||||
FilterSpec {
|
||||
key: GUID::from_u128(0xba10c618_84e7_4b83_8f74_36e22b2fa1ff),
|
||||
name: "codex_wfp_smb_139_v4",
|
||||
description: "Block sandbox-account SMB port 139 v4",
|
||||
layer_key: FWPM_LAYER_ALE_AUTH_CONNECT_V4,
|
||||
conditions: &[ConditionSpec::User, ConditionSpec::RemotePort(139)],
|
||||
},
|
||||
FilterSpec {
|
||||
key: GUID::from_u128(0xfe7f22b8_5cf5_4adb_b2aa_71fc0a8f5d44),
|
||||
name: "codex_wfp_smb_139_v6",
|
||||
description: "Block sandbox-account SMB port 139 v6",
|
||||
layer_key: FWPM_LAYER_ALE_AUTH_CONNECT_V6,
|
||||
conditions: &[ConditionSpec::User, ConditionSpec::RemotePort(139)],
|
||||
},
|
||||
];
|
||||
Reference in new issue
Block a user