4 Commits

Include renames

Author	SHA1	Message	Date
sneak	3699f37b76	Refuse [::], 0.0.0.0, IPv6 multicast and documentation space (closes #341) ... On Linux a connection to the unspecified address [::] or 0.0.0.0 reaches the host's own loopback, and the SSRF guard let [::] through. Both unspecified addresses now sit in alwaysBlockedNetworks, so an allowlist reaches loopback only through an entry that covers a loopback address, never through one that covers only 0.0.0.0 or ::; ::/128 joins the default blocklist beside 0.0.0.0/8. IPv6 multicast (ff00::/8) and documentation space (2001:db8::/32) are refused by default. Every default blocklist entry gets a one-line comment, and the README, the rules above each list, the two pinning tests and the allowlist refusal test follow. Model: opus-5-5	2026-10-02 08:15:55 +00:00
clawbot	38157d8936	Say how to allow a refused private target address (closes #398) ... Refusing an http or slack target whose address is private or reserved, on add or edit, now adds one sentence: such addresses are refused by default, and the server's ALLOWED_EGRESS_CIDRS setting allows named networks, with a pointer to the README section. It suggests no value, so it never points at allowing everything. Metadata refusals get no such sentence. To tell them apart, the default blocklist's public addresses now have their own list, blockedPublicNetworks, still checked after the allowlist; a test pins which addresses each list refuses and how listing opens them, unchanged from before. Model: opus-5-5	2026-10-02 07:52:50 +02:00
clawbot	f755c03110	Default-block Azure WireServer's public address (closes #245) ... Add 168.63.129.16 (Azure WireServer) to blockedNetworks, the default blocklist, not alwaysBlockedNetworks: it is public unicast, so an operator who lists it in ALLOWED_EGRESS_CIDRS can reach it again. The refusal message, the allowlist startup warning, the README and the comments no longer call every blocked address private/reserved, and no longer claim the allowlist cannot open any metadata endpoint. Sources: - https://learn.microsoft.com/en-us/azure/virtual-network/what-is-ip-address-168-63-129-16 - https://learn.microsoft.com/en-us/azure/virtual-machines/metadata-security-protocol/overview Deviation: 147.75.207.243 (Equinix Metal) is not added; Equinix documents only a hostname, and the service was sunset on 2026-06-30. Model: opus-5-5	2026-09-29 10:22:07 +02:00
clawbot	03cd1859d7	Add an egress CIDR allowlist to the SSRF guard (closes #204) (#217)	2026-08-20 10:34:42 +02:00