Struct InternalNetworkGuard 

pub struct InternalNetworkGuard { /* private fields */ }

Guard that blocks SSRF targeting internal/private network addresses.

Inspects network egress actions and denies requests to private, loopback, link-local, and cloud metadata addresses.

Implementations

impl InternalNetworkGuard

pub fn new() -> Self

Create a new guard with default settings.

pub fn with_config( extra_blocked_hosts: Vec<String>, dns_rebinding_detection: bool, ) -> Self

Create a new guard with additional blocked hostnames and DNS rebinding detection toggle.

pub fn check_host(&self, host: &str) -> Option<String>

Check whether a host string targets an internal/private address.

Returns Some(reason) if blocked, None if allowed.

Trait Implementations

impl Default for InternalNetworkGuard

fn default() -> Self

Returns the “default value” for a type.

impl Guard for InternalNetworkGuard

fn name(&self) -> &str

Human-readable guard name (e.g., “forbidden-path”).

fn evaluate(&self, ctx: &GuardContext<'_>) -> Result<Verdict, KernelError>

Evaluate the guard against a tool call request.