Module http_policy 

Layer 1 phase C2: per-request HTTP policy hook.

Intercepts wasi:http/outgoing-handler via WasiHttpHooks::send_request (both p2 and p3). Checks each outgoing request against the resolved HttpConfig and either delegates to the default handler or returns ErrorCode::HttpRequestDenied. Deny-by-default for allowlist mode; open allows every request; deny blocks every request.

Enforcement scope:

• Host matching: literal host, exact match or *.suffix wildcard.
• Scheme / methods / ports matching.
• IP literals in URI: matched against cidr entries at HTTP-layer.
• DNS-resolved IPs against both allow and deny CIDRs: enforced in the PolicyDnsResolver (runtime::http_client). The resolver runs once per request, filters denied IPs, and in Allowlist mode additionally requires allow-CIDR coverage when the hostname doesn’t match any host-anchored allow rule. Named-host URIs with only allow-CIDR rules defer their verdict from the HTTP layer to the resolver. The single resolve pins the addresses for the subsequent connect, closing the DNS-rebinding window.
• Redirect re-decision: each hop re-evaluated via the redirect predicate hook (see http_client::build_redirect_policy).

Structs

PolicyHttpHooks

The capability gate for wasi:http, as one WasiHttpHooks covering both wasip2 and wasip3 — wasmtime 48 routes them through the same hook.