Module netpolicy 

Outbound address policy: address classification and the SSRF guard behind every crate::Client and [crate::AsyncClient] request.

The classification mirrors rightkit-browser’s policy.rs (classify_ip, AddressClass) with the same semantics, so a browser page and an HTTP call reach the same verdict for the same address. A test cross-checks the two tables.

How the guard works:

1. The host of the request URL (and of every redirect hop) is resolved once, by this crate’s resolver. Each resolved address is classified. One denied address denies the whole host.
2. Only the vetted addresses are handed to the connector, so the socket opens to an address that was checked. There is no second lookup between check and connect.
3. Names that resolve to no address are denied.

Default (public-web) policy denies loopback, RFC 1918, link-local (including 169.254.169.254), CGNAT 100.64/10, multicast, reserved, unspecified and broadcast addresses, IPv6 ULA fc00::/7 and link-local fe80::/10, and IPv6 forms that embed an IPv4 address (mapped, compatible, NAT64 64:ff9b::/96, 6to4 2002::/16) by the class of the embedded IPv4 address. Link-local and cloud-metadata destinations cannot be allowed by any hook.

Structs

AddressDenial

Why an address or host was refused. Converts to crate::HttpError::AddressDenied.

AddressPolicy

Outbound address policy carried by crate::ClientConfig::address_policy.

CredentialScope

Where credential headers may be sent: one canonical origin plus a whole-segment path prefix, for example https://api.example.com/api. Configured per request with crate::Request::credential_scope; the clients strip credential-named and secret-valued headers on the first request and on every redirect hop whose URL is outside the scope, exactly as they already do for a cross-origin hop. The scope never admits a destination: the outbound address policy still runs on every hop, so a metadata or link-local target inside the path prefix stays denied.

IpNet

A CIDR range such as 10.0.0.0/8 or fd00::/8.

ParseIpNetError

IpNet text or prefix length was invalid.

ParsedHostIp

A host string that is an IP address, as parsed by parse_host_ip.

Enums

AddressClass

Address class of a destination. Everything except Public is denied by default.

HostIpKind

How a host string spelled an IP address.

ResolveError

Why [AddressPolicy::resolve_vetted_async] refused a host.

UrlPolicyError

Why validate_public_https_url refused a URL.

Functions

classify_ip

Classify one address. IPv6 forms that embed an IPv4 address take the embedded class.

embedded_v4

The IPv4 address embedded in an IPv6 address (see embedded_v4s): the first non-public one when several layouts are possible, otherwise the first.

embedded_v4s

Every IPv4 address an IPv6 address can embed: IPv4-mapped ::ffff:a.b.c.d, the deprecated IPv4-compatible ::a.b.c.d, NAT64 64:ff9b::/96, 6to4 2002::/16, and the local-use NAT64 space 64:ff9b:1::/48 (RFC 8215). The local-use prefix may be deployed at several lengths (RFC 6052 section 2.2), so each of the /48, /56, /64 and /96 layouts is returned. ::, ::1 and non-embedding addresses return nothing.

parse_host_ip

Parse a host string as an IP address the way inet_aton and system resolvers do, and say how it was spelled. The input is a host as it appears in a URL: ASCII case does not matter, IPv6 may be bracketed, and one trailing dot is allowed (and makes an IPv4 spelling non-canonical).

parse_legacy_ipv4

Parse an IPv4 address with the inet_aton rules described at parse_host_ip. This accepts every spelling, canonical or not, and does not accept a trailing dot, brackets or IPv6; use parse_host_ip when the spelling matters.

validate_public_https_url

Check that url is a plain public https URL: scheme https (any case), no userinfo, a host that is a public IP literal or a multi-label name, and no localhost, .localhost, .local or .internal name. The check reads the string only; it does not resolve the host. The SSRF guard of crate::Client still vets the resolved addresses on every request. Query strings and fragments are allowed and not inspected.