ReceiverAddressPolicy Class
Decides whether the transmitter may deliver to the address a receiver put in its stream configuration.
public sealed class ReceiverAddressPolicyInheritance System.Object → ReceiverAddressPolicy
Remarks
A receiver names its own delivery endpoint (SSF 1.0 Section 8.1.1.1), so that address is input from outside, and the transmitter POSTs security event tokens to it. Without this check a receiver could point a stream at a cloud metadata service and have the transmitter fetch it, which is server-side request forgery with the transmitter's own network position.
The rules about which addresses are internal are shared with every other outbound caller in this family, so they come from PrivateNetworks rather than being restated here.
Constructors
ReceiverAddressPolicy(SharedSignalsTransmitterOptions, HostResolver) Constructor
Decides whether the transmitter may deliver to the address a receiver put in its stream configuration.
public ReceiverAddressPolicy(Abblix.SharedSignals.Transmitter.SharedSignalsTransmitterOptions options, Abblix.SharedSignals.Transmitter.ReceiverAddressPolicy.HostResolver? resolveHost=null);Parameters
options SharedSignalsTransmitterOptions
The deployment's transmitter settings, including the operator's allow-list.
resolveHost HostResolver(string, CancellationToken)
Resolves a hostname to its addresses; defaults to System.Net.Dns.GetHostAddressesAsync(System.String,System.Threading.CancellationToken). A test supplies its own so the resolved-address branch, the only part of this policy that is not a string comparison, can be driven in both directions without a live DNS.
Remarks
A receiver names its own delivery endpoint (SSF 1.0 Section 8.1.1.1), so that address is input from outside, and the transmitter POSTs security event tokens to it. Without this check a receiver could point a stream at a cloud metadata service and have the transmitter fetch it, which is server-side request forgery with the transmitter's own network position.
The rules about which addresses are internal are shared with every other outbound caller in this family, so they come from PrivateNetworks rather than being restated here.
Methods
ReceiverAddressPolicy.RejectionOf(Uri, CancellationToken) Method
Judges the address of a delivery endpoint.
public System.Threading.Tasks.Task<string?> RejectionOf(System.Uri endpoint, System.Threading.CancellationToken cancellationToken=default(System.Threading.CancellationToken));Parameters
endpoint System.Uri
The endpoint a receiver configured for its stream.
cancellationToken System.Threading.CancellationToken
Cancels the name resolution.
Returns
System.Threading.Tasks.Task<System.String>
Null when delivery may proceed; otherwise why it may not, in a form fit for a log.
ReceiverAddressPolicy.RejectionOfName(Uri) Method
Why this transmitter will never deliver to the address AS WRITTEN, or null when its name alone gives no reason to refuse.
public string? RejectionOfName(System.Uri endpoint);Parameters
endpoint System.Uri
The endpoint a receiver proposed for its stream.
Returns
Remarks
This is the question a REGISTRATION may answer, and it is a strict prefix of RejectionOf(Uri, CancellationToken) rather than a second copy of it - so the two cannot come to disagree, which is the whole reason there is one policy and not a rule restated at each call site.
Everything judged here is fixed the moment the receiver names the address: an operator's permission, the scheme, a hostname spelling out this deployment's own network, an IP literal. None of it can change between registration and delivery, so accepting such an address and then refusing every push tells the receiver nothing the transmitter did not already know.
Resolution is deliberately NOT part of it. A name is resolved again for every pass, so an answer given now says nothing about the next one - and a resolver that is briefly down is a condition an operator recovers from, which delivery treats as one by holding the queue. Answered at registration the identical fact becomes a terminal refusal, and a receiver registering while its own DNS record is still propagating cannot tell that from a permanent misconfiguration.