xarmian c52f64e263 fix(netpolicy): one outbound address policy for URL import and webhooks (#1738) ...

* fix(urlimport): one address policy for URL import and webhooks (BUG-3358)

URL import refused only loopback, RFC 1918, link-local and CGNAT, so it
reached 198.18.0.0/15, 0.0.0.0/8, 240.0.0.0/4 and the other reserved ranges
webhooks already refused, and the import door returns the fetched body. Both
now call internal/netpolicy.Blocked, checked at dial time against the
address being connected to, which also adds IPv6 forms that embed IPv4
(NAT64, 6to4, IPv4-compatible) and the remaining special-purpose IPv6
blocks. Regression legs cover a literal address, a DNS answer and a
redirect.

* fix(netpolicy): registry gaps, public exceptions, NAT64 by embedded address, malformed input (BUG-3358)

Codex r1: add 192.88.99.0/24, 100:0:0:1::/64, 3fff::/20 and 5f00::/16;
allow the globally reachable exceptions inside 192.0.0.0/24 and 2001::/23;
judge the NAT64 well-known prefix by the IPv4 address it embeds instead of
refusing the prefix; refuse any slice that is not 4 or 16 bytes. The
redirect test now requires the policy refusal, and the dialer's literal
screen has its own leg.

2026-10-02 17:09:12 -04:00

..

bug3340_midflight_test.go

fix(webhooks): whole-workspace access to manage; no delivery for a deleted workspace (#1727)

2026-10-02 13:20:09 -04:00

dispatcher_test.go

fix(webhooks): whole-workspace access to manage; no delivery for a deleted workspace (#1727)

2026-10-02 13:20:09 -04:00

dispatcher.go

fix(webhooks): whole-workspace access to manage; no delivery for a deleted workspace (#1727)

2026-10-02 13:20:09 -04:00

validate_test.go

fix(webhooks): enforce SSRF guard at dial time + widen deny-list (#836)

2026-07-07 15:23:25 -04:00

validate.go

fix(netpolicy): one outbound address policy for URL import and webhooks (#1738)

2026-10-02 17:09:12 -04:00