3 Commits

Include renames

Author	SHA1	Message	Date
clawbot	90b0773b25	Say how to allow a refused private target address (closes #398) ... Adding or editing an http or slack target whose address is private or reserved was refused with no hint that the refusal is deliberate or that it can be lifted. The refusal now adds that such addresses are refused by default and that the server's ALLOWED_EGRESS_CIDRS setting allows named networks, naming the README section "Allowing egress to your own network". Metadata refusals do not get it. The default blocklist's public addresses move to a list of their own, still checked after the allowlist, and are refused as cloud metadata addresses. The private-and-reserved error is exported as ErrBlockedPrivateOrReservedIP so the handler can tell them apart. Model: opus-5-5	2026-10-02 03:43:59 +00:00
clawbot	f755c03110	Default-block Azure WireServer's public address (closes #245) ... Add 168.63.129.16 (Azure WireServer) to blockedNetworks, the default blocklist, not alwaysBlockedNetworks: it is public unicast, so an operator who lists it in ALLOWED_EGRESS_CIDRS can reach it again. The refusal message, the allowlist startup warning, the README and the comments no longer call every blocked address private/reserved, and no longer claim the allowlist cannot open any metadata endpoint. Sources: - https://learn.microsoft.com/en-us/azure/virtual-network/what-is-ip-address-168-63-129-16 - https://learn.microsoft.com/en-us/azure/virtual-machines/metadata-security-protocol/overview Deviation: 147.75.207.243 (Equinix Metal) is not added; Equinix documents only a hostname, and the service was sunset on 2026-06-30. Model: opus-5-5	2026-09-29 10:22:07 +02:00
clawbot	03cd1859d7	Add an egress CIDR allowlist to the SSRF guard (closes #204) (#217)	2026-08-20 10:34:42 +02:00