Module policy 

Network egress policy for outbound HTTP — SSRF protection.

A NetworkPolicy decides whether a resolved IP may be connected to. PolicyResolver enforces it as reqwest’s custom DNS resolver: it resolves the host and drops policy-forbidden addresses, so the connection only ever targets vetted IPs. Filtering at resolution rather than on the host string is what closes the DNS-rebinding window — a public name that resolves to an internal IP is caught, and reqwest connects to exactly the addresses we approved.

Structs

NetworkPolicy

Outbound-address policy. The default (enforce == false) permits every address — the interpreter library and submilli run stay unrestricted. The submilli-server binary opts into NetworkPolicy::deny_private.

PolicyResolver

reqwest DNS resolver that drops policy-forbidden addresses post-resolution.

Enums

ResolveFailure

Why a host name yielded no address to connect to.