agent: allow only public addresses as single-agent targets unless allowed_target_cidrs says otherwise

backend/shared/tests/MoShiro.Measurement.Tests/MeasurementTests.cs

@@ -46,24 +46,37 @@ public sealed class MeasurementTests
     }
 
     [Fact]
-    public void BudgetGuard_TargetTasks_AreDeniedUnlessTheAddressIsInAnAllowedRange()
+    public void BudgetGuard_TargetTasks_DefaultToPublicAddressesOnly_AndAnExplicitListIsExactly_WhatItSays()
     {
-        Assert.False(Guard().TargetAllowed("1.1.1.1"));
+        // 没配置白名单：公网地址允许，内网、回环、链路本地、运营商 NAT、组播一律拒绝；域名要解析后逐个地址检查
+        BudgetGuard open = Guard();
+        foreach (string allowed in new[] { "1.1.1.1", "1.1.1.1:443", "2606:4700::1111", "example.com:443", "https://example.com/health", "::ffff:8.8.8.8" })
+        {
+            Assert.True(open.TargetAllowed(allowed), allowed);
+        }
 
-        BudgetGuard some = Guard(new NodeLimits { AllowedTargetCidrs = ["192.0.2.0/24", "2001:db8::/32"] });
-        Assert.True(some.TargetAllowed("192.0.2.17"));
+        foreach (string denied in new[] { "10.1.2.3", "172.16.0.1", "172.31.255.255", "192.168.1.1:80", "127.0.0.1", "169.254.169.254", "100.64.0.1", "224.0.0.1", "0.0.0.0", "::1", "fe80::1", "fd00::1", "::ffff:10.0.0.1", "http://192.168.1.1/" })
+        {
+            Assert.False(open.TargetAllowed(denied), denied);
+        }
+
+        Assert.False(open.TargetAllowed(null));
+        Assert.True(open.AddressAllowed(IPAddress.Parse("172.32.0.1"))); // 172.16/12 的外面是公网
+
+        // 配置了白名单：只允许列出的网段，可以包含内网，其余（包括公网）都不允许
+        BudgetGuard some = Guard(new NodeLimits { AllowedTargetCidrs = ["192.0.2.0/24", "2001:db8::/32", "10.0.0.0/8"] });
         Assert.True(some.TargetAllowed("192.0.2.17:443"));
         Assert.True(some.TargetAllowed("2001:db8::1"));
+        Assert.True(some.TargetAllowed("10.9.9.9"));
+        Assert.False(some.TargetAllowed("1.1.1.1"));
         Assert.False(some.TargetAllowed("192.0.3.1"));
-        Assert.False(some.TargetAllowed(null));
-
-        // 域名要解析之后才知道地址：配置过白名单就先接受，每个解析出的地址再由 AddressAllowed 检查
-        Assert.True(some.TargetAllowed("example.com:443"));
-        Assert.True(some.TargetAllowed("https://example.com/health"));
-        Assert.False(Guard().TargetAllowed("example.com"));
+        Assert.True(some.TargetAllowed("example.com"));
         Assert.True(some.AddressAllowed(IPAddress.Parse("192.0.2.9")));
-        Assert.False(some.AddressAllowed(IPAddress.Parse("10.0.0.1")));
-        Assert.False(some.AddressAllowed(IPAddress.Parse("::ffff:10.0.0.1")));
+        Assert.False(some.AddressAllowed(IPAddress.Parse("8.8.8.8")));
+        Assert.False(some.AddressAllowed(IPAddress.Parse("::ffff:8.8.8.8")));
+
+        // 写了但一条也解析不出来：当成「什么都不允许」，不退回到默认
+        Assert.False(Guard(new NodeLimits { AllowedTargetCidrs = ["not-a-network"] }).AddressAllowed(IPAddress.Parse("1.1.1.1")));
     }
 
     // ---- RowStore ----