rafael-oai 529cd6b860 Use a dedicated matcher for network domain policies (#51897) ...

## Why

Network domain rules need explicit wildcard semantics independent of filesystem glob syntax, including matching Unicode hosts with `?`.

## What changed

Replace `globset` in network allowlist and denylist matching with a domain matcher. Make `?` consume one Unicode scalar value, retain ASCII case-insensitive matching and existing host normalization, and preserve the distinction between `*.example.com` and `**.example.com`.

Reject empty patterns, repeated wildcards outside the supported `**.` prefix, character classes, brace expansions, escapes, slashes, and embedded whitespace when loading policies. Continue allowing global wildcards only in allowlists.

## Testing

Add coverage for Unicode wildcard semantics, unsupported syntax, IPv6 normalization, invalid entries in either policy list, and adversarial matching inputs. Compare the matcher against an independent dynamic-programming implementation over exhaustive short inputs.

GitOrigin-RevId: 64f65fcda1a50998d70e046445d22cd2d2dcf27a

2026-10-08 01:12:42 +00:00

..

connection_lifecycle

Default local binding to true for MXC managed networking (#46523)

2026-09-19 00:00:01 +00:00

credential_broker

Default local binding to true for MXC managed networking (#46523)

2026-09-19 00:00:01 +00:00

proxy

Honor explicit Unix socket grants in the Linux managed sandbox (#45534)

2026-09-14 22:40:20 +00:00

attribution_tests.rs

Remove the network proxy config wrapper (#31767)

2026-07-09 17:33:37 +01:00

attribution.rs

Add configurable credential providers to the network proxy (#44056)

2026-09-09 04:59:01 +00:00

authorization_path_tests.rs

Harden network proxy MITM authorization (#37211)

2026-08-06 03:57:10 +00:00

authorization_path.rs

Harden network proxy MITM authorization (#37211)

2026-08-06 03:57:10 +00:00

brokered_tunnel_tests.rs

Default local binding to true for MXC managed networking (#46523)

2026-09-19 00:00:01 +00:00

brokered_tunnel.rs

Support credential brokering in plaintext HTTP tunnels (#44089)

2026-09-09 07:06:12 +00:00

certs.rs

Support caller-provided MITM CAs in the network proxy (#47132)

2026-09-21 23:43:52 +00:00

config.rs

Support caller-provided MITM CAs in the network proxy (#47132)

2026-09-21 23:43:52 +00:00

connect_policy.rs

Default local binding to true for MXC managed networking (#46523)

2026-09-19 00:00:01 +00:00

credential_broker_tests.rs

Refactor credential-broker tunnel protocol detection (#44077)

2026-09-09 06:26:36 +00:00

credential_broker.rs

Default local binding to true for MXC managed networking (#46523)

2026-09-19 00:00:01 +00:00

domain_matcher_tests.rs

Use a dedicated matcher for network domain policies (#51897)

2026-10-08 01:12:42 +00:00

domain_matcher.rs

Use a dedicated matcher for network domain policies (#51897)

2026-10-08 01:12:42 +00:00

environment_policy.rs

Honor execution environment proxy requirements (#48198)

2026-09-25 20:11:25 +00:00

host_policy_tests.rs

Require hostname authorization before proxy DNS lookups (#51650)

2026-10-07 11:10:20 +00:00

http_proxy.rs

Allow exec-server to proxy permitted private IPs upstream (#48568)

2026-09-26 23:17:41 +00:00

lib.rs

Use a dedicated matcher for network domain policies (#51897)

2026-10-08 01:12:42 +00:00

main_tests.rs

Support caller-provided MITM CAs in the network proxy (#47132)

2026-09-21 23:43:52 +00:00

main.rs

Fix standalone network proxy policy initialization (#46578)

2026-09-19 02:19:47 +00:00

mitm_hook.rs

Harden network proxy MITM authorization (#37211)

2026-08-06 03:57:10 +00:00

mitm_tests.rs

Require hostname authorization before proxy DNS lookups (#51650)

2026-10-07 11:10:20 +00:00

mitm.rs

Require hostname authorization before proxy DNS lookups (#51650)

2026-10-07 11:10:20 +00:00

native_certs.rs

Honor startup custom CA bundles with managed MITM (#29014)

2026-06-22 14:16:48 -07:00

network_policy.rs

Require hostname authorization before proxy DNS lookups (#51650)

2026-10-07 11:10:20 +00:00

policy.rs

Use a dedicated matcher for network domain policies (#51897)

2026-10-08 01:12:42 +00:00

process_log_metadata.rs

Add attributed exec process lifecycle telemetry (#42373)

2026-09-02 21:58:58 +00:00

proxy.rs

Require hostname authorization before proxy DNS lookups (#51650)

2026-10-07 11:10:20 +00:00

reasons.rs

Wire MITM hooks into runtime enforcement (#20659)

2026-05-20 14:08:14 -07:00

remote_config_tests.rs

Support caller-provided MITM CAs in the network proxy (#47132)

2026-09-21 23:43:52 +00:00

remote_config.rs

Support caller-provided MITM CAs in the network proxy (#47132)

2026-09-21 23:43:52 +00:00

request_cancellation.rs

Handle pending network reviews after process completion (#42746)

2026-09-04 12:08:02 +00:00

request_disconnect_tests.rs

Report network disconnects during approval (#39284)

2026-08-18 21:30:45 +00:00

request_disconnect.rs

Report network disconnects during approval (#39284)

2026-08-18 21:30:45 +00:00

responses.rs

Wire MITM hooks into runtime enforcement (#20659)

2026-05-20 14:08:14 -07:00

runtime.rs

Use a dedicated matcher for network domain policies (#51897)

2026-10-08 01:12:42 +00:00

socket_path.rs

Share platform identity across path, network, and sandbox configuration (#46334)

2026-09-18 00:51:34 +00:00

socks5.rs

Share platform identity across path, network, and sandbox configuration (#46334)

2026-09-18 00:51:34 +00:00

state.rs

Use a dedicated matcher for network domain policies (#51897)

2026-10-08 01:12:42 +00:00

system_dns_tests.rs

Default local binding to true for MXC managed networking (#46523)

2026-09-19 00:00:01 +00:00

system_dns.rs

Use native DNS resolution for the network proxy on macOS (#45982)

2026-09-16 16:47:35 +00:00

upstream_tests.rs

Allow exec-server to proxy permitted private IPs upstream (#48568)

2026-09-26 23:17:41 +00:00

upstream.rs

Allow exec-server to proxy permitted private IPs upstream (#48568)

2026-09-26 23:17:41 +00:00

windows_proxy_ingress_tests.rs

Route Windows sandbox proxy traffic by restricting SID (#34613)

2026-07-21 21:06:04 +00:00

windows_proxy_ingress.rs

Route Windows sandbox proxy traffic by restricting SID (#34613)

2026-07-21 21:06:04 +00:00

windows_tcp_attribution_tests.rs

Route Windows sandbox proxy traffic by restricting SID (#34613)

2026-07-21 21:06:04 +00:00

windows_tcp_attribution.rs

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00