xarmian fc64d92ece fix(netpolicy): block Azure WireServer, and pin the cloud metadata census (BUG-3660) (#2155) ...

* fix(netpolicy): block Azure WireServer, and pin the cloud metadata census (BUG-3660)

168.63.129.16 is a public address, so no reserved range covered it and URL
import (and webhooks, and appfetch, which share netpolicy.Blocked) would
connect to it. It goes in a new platformAddresses list. A census test pins
every provider metadata endpoint we know of against the range that blocks
it; WireServer was the only one no range covered. The urlimport package
comment that listed an older policy now points at netpolicy.

Claude-Session: https://claude.ai/code/session_01Q9WssCjFuHjSfLABoW4tmS

* docs(netpolicy): WireServer is in public address space, not reachable from the internet (BUG-3660, codex r1 Low)

Claude-Session: https://claude.ai/code/session_01Q9WssCjFuHjSfLABoW4tmS

2026-10-14 07:48:02 -04:00

..

netpolicy_test.go

fix(netpolicy): block Azure WireServer, and pin the cloud metadata census (BUG-3660) (#2155)

2026-10-14 07:48:02 -04:00

netpolicy.go

fix(netpolicy): block Azure WireServer, and pin the cloud metadata census (BUG-3660) (#2155)

2026-10-14 07:48:02 -04:00