Module parse 

Pure parsers for OS proxy string formats.

List parsers drop malformed elements and keep the rest. Dropping a scheme endpoint without recording it would be fail-open; bypass drops are fail-closed → rejected.

Writing a bypass list

Every store has one, no two of them read it the same way, and the differences decide which hosts go direct. What an entry means to this crate depends on the list it is written in: it is the store’s own reading, except where a cell says the two differ:

Entry	no_proxy, KDE NoProxyFor	Windows ProxyOverride	macOS ExceptionsList	GNOME ignore-hosts
separator between entries	, alone: a ; leaves the two names one dead rule, and an entry still holding a space is rejected	;, , or whitespace	the array is the separator	the array is the separator
example.com	that host and everything under it	that host alone	that host alone	that host and everything under it
.example.com, *.example.com	the subdomains, not example.com itself	*.example.com is the subdomains; .example.com is rejected: Windows has no reading for a leading . (below)	the subdomains	the same rule as the bare name: the domain and its subdomains
a * anywhere else (192.168.*)	a glob here, which is Chromium’s reading; Go and libproxy take it as literal text no host carries	a glob	syntax only as a trailing .*, which misses the bare host a Mac’s own name.* still reaches; anything else is rejected	never syntax; rejected
a bare *	every destination direct	every destination direct	rejected: it matches no host on a Mac	rejected, same reason
10.0.0.0/8	the network	rejected: Windows has no / in this grammar, and one entry holding it turns the proxy off for every destination (below); write the range as 10.*	the network	the network
example.com:8080	holds the entry to that port	holds it	rejected: macOS compares the whole entry to the host name, so a port kills it	holds it, but a portless http:// URL is asked about with port 0 and will not meet it
<local>, <-loopback>	read	read	read	rejected: GLib reads neither and compares the token to a host so named
an entry ending in a dot (example.com.)	the dot is the DNS root and comes off; KDE: rejected; KIO compares the text	rejected	the dot comes off, as CFNetwork reads it	rejected
a trailing dot on the destination (example.com.)	shed, so example.com matches it; KDE: kept, so it does not	kept	shed	kept
no entry at all	localhost, 127.0.0.0/8, ::1, *.localhost and link-local go direct; KDE: nothing does	localhost, loopback, 127.0.0.1, ::1 and link-local go direct	localhost, 127.0.0.1 and ::1 go direct while the dictionary has a bypass key; with none, nothing does	nothing goes direct
a space at either end	trimmed	trimmed	kept, and no host carries it, so the entry is rejected	trailing trimmed, leading kept and rejected

A rejected entry lands in BypassRules::rejected with the reason, so a rule that does nothing is not mistaken for a live one.

Windows readers differ on entries starting with .: WinINet refuses the whole list, while WinHTTP and the registry keep it but proxy the subdomains. Write *.name. A / makes the registry reading send every destination direct. Both spellings are rejected here while neighboring entries stay live.

A bare name changes meaning between the first column and the next two, so contoso.com in no_proxy covers api.contoso.com and the same text in ProxyOverride does not. And <local> / <-loopback> are read out of every list but GNOME’s so the sources share one vocabulary, while WinINet is the only resolver that acts on both and KDE’s KIO acts on <local> alone: a macOS store spelling one gets a bypass from this crate and none from the machine. the_local_token_bypasses_nothing_here in tests/mac_exceptions_list.rs measures that. A GNOME entry spelling one is rejected, because GLib reads it as a host name.

The last row is BypassRules::implicit: the destinations each resolver sends direct when no entry names them. The Windows and macOS cells are measured against WinINet and CFNetwork; the GNOME and KDE cells are read off GLib’s and KIO’s matchers, which have no such set.

Constants

WINDOWS_DEFAULT_PORT

The port assumed when a Windows ProxyServer entry omits one.

Functions

no_proxy

Parse no_proxy into BypassRules: *, CIDR, domains, :port, and a localhost bypass that stays on unless an entry clears it. Entries are separated by , alone, not whitespace and not ;, which is what Go’s httpproxy does and what KDE’s readers do with NoProxyFor. Malformed → BypassRules::rejected. An entry that repeats one already in BypassRules::patterns is dropped, first spelling kept, so the list can be shorter than the string had entries.

proxy_override

Parse a Windows ProxyOverride registry value into BypassRules.

proxy_server

Parse Windows ProxyServer (WINHTTP_CURRENT_USER_IE_PROXY_CONFIG).

windows_manual

Assemble a ProxyMode::Manual from the two Windows registry strings.