Struct EgressGuard 

pub struct EgressGuard { /* private fields */ }

Egress guard over request-derived upstream URLs.

Implementations

impl EgressGuard

pub fn new(allowlist: Option<UpstreamAllowlist>) -> Self

pub fn check_without_dns(&self, target: &str) -> EgressDecision

Synchronous checks that need no network: literal IPs, metadata hostnames, and allowlist matching.

Exposed separately so callers (and tests) can exercise the pure logic without DNS.

pub async fn check_with_resolver<R, F>( &self, target: &str, resolver: R, ) -> EgressDecision

where R: FnOnce(String) -> F, F: Future<Output = Result<Vec<IpAddr>>>,

Full check with an injected resolver: synchronous rules first, then resolve non-literal hostnames and re-check every returned address.

Resolution closes the DNS-rebinding window between check and connect: whatever addresses the name currently points at must all be public. Residual risk: the OS resolver could answer differently when reqwest dials; pinning the checked address onto the connection is out of scope here.

pub async fn check(&self, target: &str) -> EgressDecision

Full check using blocking system DNS off the async runtime’s core threads.

Trait Implementations

impl Clone for EgressGuard

fn clone(&self) -> EgressGuard

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for EgressGuard

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for EgressGuard

fn default() -> EgressGuard

Returns the “default value” for a type.