Add support for AllowNet capability in http.send

[tsandall]

OPA should support a mechanism for restricting http.send calls at runtime. The primary use case would be restricting what hosts http.send calls can make. To support this, we should look at what interfaces are required in the topdown package. On top of that, we could expose restriction settings via the OPA configuration.

Note, this is not about disabling the http.send call entirely or blocking it at compile-time. The goal here is to allow policy authors to make use of http.send but only for reaching out to specific hosts.

EDIT:

• We'll need to take into account other built-ins as well, e.g., the recent net.lookup_ip_addr function.

Related #3661

[tsandall]

With #3748 we now have an API for OPA admins to supply a list of hostnames/IPs that an OPA should be allowed to connect to. We should use make use of the capabilities within topdown.

[anderseknert]

It would be good to allow blocking specific protocols as well, like unix:// or http:// (i.e,. not https) .. might be one wants to request something from a local http service without allowing access to local unix domain sockets on the host filesystem.

[srenatus]

If we follow the semantics of the JSON Schema remote ref fetching, then as soon as there's any entry in allow_net , we'd only allow connections to those hosts from the list. I suppose we could deny http and unix if we supported globs, like https://* (or even https://*.internal.acme.corp etc).