* fix(netpolicy): block Azure WireServer, and pin the cloud metadata census (BUG-3660)
168.63.129.16 is a public address, so no reserved range covered it and URL
import (and webhooks, and appfetch, which share netpolicy.Blocked) would
connect to it. It goes in a new platformAddresses list. A census test pins
every provider metadata endpoint we know of against the range that blocks
it; WireServer was the only one no range covered. The urlimport package
comment that listed an older policy now points at netpolicy.
Claude-Session: https://claude.ai/code/session_01Q9WssCjFuHjSfLABoW4tmS
* docs(netpolicy): WireServer is in public address space, not reachable from the internet (BUG-3660, codex r1 Low)
Claude-Session: https://claude.ai/code/session_01Q9WssCjFuHjSfLABoW4tmS
* fix(urlimport): one address policy for URL import and webhooks (BUG-3358)
URL import refused only loopback, RFC 1918, link-local and CGNAT, so it
reached 198.18.0.0/15, 0.0.0.0/8, 240.0.0.0/4 and the other reserved ranges
webhooks already refused, and the import door returns the fetched body. Both
now call internal/netpolicy.Blocked, checked at dial time against the
address being connected to, which also adds IPv6 forms that embed IPv4
(NAT64, 6to4, IPv4-compatible) and the remaining special-purpose IPv6
blocks. Regression legs cover a literal address, a DNS answer and a
redirect.
* fix(netpolicy): registry gaps, public exceptions, NAT64 by embedded address, malformed input (BUG-3358)
Codex r1: add 192.88.99.0/24, 100:0:0:1::/64, 3fff::/20 and 5f00::/16;
allow the globally reachable exceptions inside 192.0.0.0/24 and 2001::/23;
judge the NAT64 well-known prefix by the IPv4 address it embeds instead of
refusing the prefix; refuse any slice that is not 4 or 16 bytes. The
redirect test now requires the policy refusal, and the dialer's literal
screen has its own leg.
xarmian