Module guard 

Available on crate feature client only.

What an agent may dial on someone else’s say-so. A Person Server URL is often chosen by a tenant, and the agent calls it from its own network position, so it must never reach that network itself (SSRF).

Two halves, because reqwest dials an IP-literal URL without resolving it: admit_host refuses literals and localhost before a request is built, and PublicResolver is the client’s resolver, so the addresses it checked are the addresses the socket connects to.

Structs

DeniedNetworks

Ranges no tenant URL may resolve into, beyond the ones is_public knows: a plane whose pod or service CIDR is not RFC 1918 lists it here.

PublicResolver

Resolves through the system resolver and fails the lookup when any answer is not public, so a name cannot resolve one way when checked and another when dialled.

Functions

admit_host

Refuse a URL whose host is an IP literal or localhost: the resolver never sees those.

guarded_client

An HTTP client for URLs someone else chose: a 10-second timeout, no redirects, no proxy (which would resolve names past this resolver), and a resolver that refuses any name answering with a non-public address or one in denied.

is_public

Whether ip is a public unicast address.