agent: allow only public addresses as single-agent targets unless allowed_target_cidrs says otherwise

backend/agent/src/MoShiro.Agent/AgentConfig.cs

@@ -98,7 +98,7 @@ public sealed class LimitsSection
     [JsonPropertyName("max_total_pps")]
     public long MaxTotalPps { get; set; } = 20_000;
 
-    /// <summary>默认为空：不允许执行任何目标任务。</summary>
+    /// <summary>单个 Agent 任务（外部目标）能探测的网段。默认为空：只允许公网地址，内网、回环、链路本地等一律拒绝；写了就只允许列出的网段（可以包含内网）。</summary>
     [JsonPropertyName("allowed_target_cidrs")]
     public List<string> AllowedTargetCidrs { get; set; } = [];
 

backend/shared/MoShiro.Measurement/Execution/BudgetGuard.cs

@@ -107,8 +107,8 @@ public sealed class BudgetGuard
     }
 
     /// <summary>
-    /// 目标在静态上可不可以接受：IP 字面量按 <c>allowed_target_cidrs</c> 检查；域名（包括 URL 里的）要解析之后才知道，
-    /// 这里只要求配置过白名单，运行时每次解析出的地址再用 <see cref="AddressAllowed"/> 检查。
+    /// 目标在静态上可不可以接受：IP 字面量直接用 <see cref="AddressAllowed"/> 判断；域名（包括 URL 里的）要解析之后才知道，
+    /// 这里先接受，运行时每次解析出的地址再逐个检查。
     /// </summary>
     public bool TargetAllowed(string? target)
     {
@@ -117,9 +117,13 @@ public sealed class BudgetGuard
             return false;
         }
 
-        return IPAddress.TryParse(host, out IPAddress? address) ? AddressAllowed(address) : _cidrs.Count > 0;
+        return !IPAddress.TryParse(host, out IPAddress? address) || AddressAllowed(address);
     }
 
+    /// <summary>
+    /// 这个地址能不能作为单个 Agent 任务的目标。<c>allowed_target_cidrs</c> 没配置时只允许公网地址（内网、回环、链路本地、组播等一律拒绝），
+    /// 防止被攻破的 Backend 借 Agent 探测它所在的内网；配置了就只允许列出的网段（包括内网段，由节点所有者显式决定）。
+    /// </summary>
     public bool AddressAllowed(IPAddress address)
     {
         if (address.IsIPv4MappedToIPv6)
@@ -127,6 +131,11 @@ public sealed class BudgetGuard
             address = address.MapToIPv4();
         }
 
+        if (_limits.AllowedTargetCidrs.Count == 0)
+        {
+            return IsPublic(address);
+        }
+
         foreach ((IPAddress network, int prefix) in _cidrs)
         {
             if (InCidr(address, network, prefix))
@@ -138,6 +147,28 @@ public sealed class BudgetGuard
         return false;
     }
 
+    private static readonly (IPAddress Network, int Prefix)[] s_nonPublic =
+    [
+        (IPAddress.Parse("0.0.0.0"), 8), (IPAddress.Parse("10.0.0.0"), 8), (IPAddress.Parse("100.64.0.0"), 10), (IPAddress.Parse("127.0.0.0"), 8),
+        (IPAddress.Parse("169.254.0.0"), 16), (IPAddress.Parse("172.16.0.0"), 12), (IPAddress.Parse("192.0.0.0"), 24), (IPAddress.Parse("192.168.0.0"), 16),
+        (IPAddress.Parse("198.18.0.0"), 15), (IPAddress.Parse("224.0.0.0"), 3),
+        (IPAddress.Parse("::"), 128), (IPAddress.Parse("::1"), 128), (IPAddress.Parse("fc00::"), 7), (IPAddress.Parse("fe80::"), 10), (IPAddress.Parse("ff00::"), 8),
+    ];
+
+    /// <summary>不是公网：私有、回环、链路本地、运营商级 NAT、组播、保留地址。</summary>
+    private static bool IsPublic(IPAddress address)
+    {
+        foreach ((IPAddress network, int prefix) in s_nonPublic)
+        {
+            if (InCidr(address, network, prefix))
+            {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
     private bool PortAllowed(KindSpec kind, ParamValues values)
     {
         if (!kind.Params.Any(p => p.Name == "port"))

backend/shared/tests/MoShiro.Measurement.Tests/MeasurementTests.cs

@@ -46,24 +46,37 @@ public sealed class MeasurementTests
     }
 
     [Fact]
-    public void BudgetGuard_TargetTasks_AreDeniedUnlessTheAddressIsInAnAllowedRange()
+    public void BudgetGuard_TargetTasks_DefaultToPublicAddressesOnly_AndAnExplicitListIsExactly_WhatItSays()
     {
-        Assert.False(Guard().TargetAllowed("1.1.1.1"));
+        // 没配置白名单：公网地址允许，内网、回环、链路本地、运营商 NAT、组播一律拒绝；域名要解析后逐个地址检查
+        BudgetGuard open = Guard();
+        foreach (string allowed in new[] { "1.1.1.1", "1.1.1.1:443", "2606:4700::1111", "example.com:443", "https://example.com/health", "::ffff:8.8.8.8" })
+        {
+            Assert.True(open.TargetAllowed(allowed), allowed);
+        }
 
-        BudgetGuard some = Guard(new NodeLimits { AllowedTargetCidrs = ["192.0.2.0/24", "2001:db8::/32"] });
-        Assert.True(some.TargetAllowed("192.0.2.17"));
+        foreach (string denied in new[] { "10.1.2.3", "172.16.0.1", "172.31.255.255", "192.168.1.1:80", "127.0.0.1", "169.254.169.254", "100.64.0.1", "224.0.0.1", "0.0.0.0", "::1", "fe80::1", "fd00::1", "::ffff:10.0.0.1", "http://192.168.1.1/" })
+        {
+            Assert.False(open.TargetAllowed(denied), denied);
+        }
+
+        Assert.False(open.TargetAllowed(null));
+        Assert.True(open.AddressAllowed(IPAddress.Parse("172.32.0.1"))); // 172.16/12 的外面是公网
+
+        // 配置了白名单：只允许列出的网段，可以包含内网，其余（包括公网）都不允许
+        BudgetGuard some = Guard(new NodeLimits { AllowedTargetCidrs = ["192.0.2.0/24", "2001:db8::/32", "10.0.0.0/8"] });
         Assert.True(some.TargetAllowed("192.0.2.17:443"));
         Assert.True(some.TargetAllowed("2001:db8::1"));
+        Assert.True(some.TargetAllowed("10.9.9.9"));
+        Assert.False(some.TargetAllowed("1.1.1.1"));
         Assert.False(some.TargetAllowed("192.0.3.1"));
-        Assert.False(some.TargetAllowed(null));
-
-        // 域名要解析之后才知道地址：配置过白名单就先接受，每个解析出的地址再由 AddressAllowed 检查
-        Assert.True(some.TargetAllowed("example.com:443"));
-        Assert.True(some.TargetAllowed("https://example.com/health"));
-        Assert.False(Guard().TargetAllowed("example.com"));
+        Assert.True(some.TargetAllowed("example.com"));
         Assert.True(some.AddressAllowed(IPAddress.Parse("192.0.2.9")));
-        Assert.False(some.AddressAllowed(IPAddress.Parse("10.0.0.1")));
-        Assert.False(some.AddressAllowed(IPAddress.Parse("::ffff:10.0.0.1")));
+        Assert.False(some.AddressAllowed(IPAddress.Parse("8.8.8.8")));
+        Assert.False(some.AddressAllowed(IPAddress.Parse("::ffff:8.8.8.8")));
+
+        // 写了但一条也解析不出来：当成「什么都不允许」，不退回到默认
+        Assert.False(Guard(new NodeLimits { AllowedTargetCidrs = ["not-a-network"] }).AddressAllowed(IPAddress.Parse("1.1.1.1")));
     }
 
     // ---- RowStore ----