3 Commits

Include renames

Author	SHA1	Message	Date
clawbot	38157d8936	Say how to allow a refused private target address (closes #398) ... Refusing an http or slack target whose address is private or reserved, on add or edit, now adds one sentence: such addresses are refused by default, and the server's ALLOWED_EGRESS_CIDRS setting allows named networks, with a pointer to the README section. It suggests no value, so it never points at allowing everything. Metadata refusals get no such sentence. To tell them apart, the default blocklist's public addresses now have their own list, blockedPublicNetworks, still checked after the allowlist; a test pins which addresses each list refuses and how listing opens them, unchanged from before. Model: opus-5-5	2026-10-02 07:52:50 +02:00
clawbot	f755c03110	Default-block Azure WireServer's public address (closes #245) ... Add 168.63.129.16 (Azure WireServer) to blockedNetworks, the default blocklist, not alwaysBlockedNetworks: it is public unicast, so an operator who lists it in ALLOWED_EGRESS_CIDRS can reach it again. The refusal message, the allowlist startup warning, the README and the comments no longer call every blocked address private/reserved, and no longer claim the allowlist cannot open any metadata endpoint. Sources: - https://learn.microsoft.com/en-us/azure/virtual-network/what-is-ip-address-168-63-129-16 - https://learn.microsoft.com/en-us/azure/virtual-machines/metadata-security-protocol/overview Deviation: 147.75.207.243 (Equinix Metal) is not added; Equinix documents only a hostname, and the service was sunset on 2026-06-30. Model: opus-5-5	2026-09-29 10:22:07 +02:00
clawbot	03cd1859d7	Add an egress CIDR allowlist to the SSRF guard (closes #204) (#217)	2026-08-20 10:34:42 +02:00