Module domain_guard 

Shared domain/URL validation and allowlist helpers.

The primitives themselves live in zeroclaw_infra::net_guard so the tool implementations and zeroclaw-channels read one implementation. This module is the tool-layer facade: it keeps the crate::helpers::domain_guard::* paths the tools and zeroclaw-channels already use, and it is where a tool-specific or config-specific wrapper would go if one were ever needed. Unit coverage for the primitives lives beside them in zeroclaw-infra.

Structs

Nat64Prefix

Operator-declared, network-specific RFC 6052 NAT64 prefixes, and the parser that turns the configured strings into them.

Functions

host_matches_allowlist

True when host matches any entry in a normalized allowed list.

is_private_or_local_host

Check whether host is a private, loopback, link-local, or otherwise non-globally-routable address (SSRF guard). Handles both IPv4 and IPv6, as well as localhost and .local domains. True when host is loopback, private, link-local, a documentation/ benchmark range, or one of the localhost / *.local name forms. Accepts bracketed IPv6 ([::1]), ignores DNS root-label dots, and is case-insensitive.

normalize_allowed_domains

Normalize a whole allowlist, sorted and deduplicated.

normalize_domain

Normalize a single allowlist entry to a canonical bare host.

parse_nat64_prefixes

Operator-declared, network-specific RFC 6052 NAT64 prefixes, and the parser that turns the configured strings into them.