Implement network-001..008 source controls using mature reqwest/rustls/Hyper/proxy/PKCS12 libraries. Optional RequestNetwork extends old requests without changing their default HTTP1/no-proxy/TLS-verify behavior. Fields: HTTP1/automatic-H2/H2-prior-knowledge, explicit HTTP/HTTPS/SOCKS proxy with optional credentials/bypass, extra CA PEM/system-root choice, client identity PEM or PFX+password+alias, DNS host/IP overrides and connect timeout. Source uses variables and preserves inactive identity/proxy drafts. No hidden filesystem credentials or system proxy discovery.
Every direct hop still resolves/checks all destination addresses and pins the actual chosen addresses. DNS overrides preserve Host/SNI/signing URL and must pass the same private-IP policy. Proxies are explicitly trusted routing: restricted hosted policy cannot guarantee what a remote proxy resolves, so proxy use requires the administrator's existing allow_private_network permission; local/offline mode already permits it. Proxy credentials never become ordinary target headers or saved history/default exports. NTLM still needs a single HTTP1 socket; applicable TLS/identity/DNS controls share the same validated settings rather than bypassing its transport.
CA/certificate/key parsing, client-auth handshakes, CONNECT/SOCKS tunneling and PFX decryption are library operations. PFX imports require a matching named/single identity and checked key/cert correspondence. Reject unsupported forms, ambiguous multi-key stores, missing certificate files and secret budget overflow. Default source export clears private identity/PFX/password/proxy values and screens copied/decoded representations; explicit native source backup preserves exact source. External source mappings must be faithful or explicitly rejected.
Network settings affect HTTP/SOAP sends, SSE, WebSocket/GraphQL subscriptions, A2A SDK calls/card discovery and MCP HTTP initialization/calls. WebSocket upgrade modes explicitly require HTTP1; SSE/finite HTTP and HTTP SDKs can select H2. Dubbo adapters remain part of full scope. MQTT 3.1.1/5 TCP/TLS/WebSocket/WSS and Socket.IO WebSocket transports share the network settings. Raw TCP/TCPS uses the shared checked socket, CA/client identity configuration and original TLS name. gRPC uses HTTP2 with the same CA/PEM/PFX/DNS/proxy settings. Unsupported selected settings on transports must reject rather than silently ignore. Source-only drafts, configured server/client standalone behavior, bilingual Radix settings editor/file selection and owned-process cleanup follow existing conventions.
Necessary proof: actual custom CA/mTLS (PEM/PFX), HTTP and CONNECT/SOCKS proxy authentication/bypass/no credential forwarding, DNS override/private policy/Host-SNI preservation, real H2 modes, exact body replay/redirects, NTLM connection/identity compatibility, environment/privacy/interchange and UI stale file selection/locale. No local Docker; real platform installers/server/Docker release builds remain GitHub Actions gates after functional completion.
Implementation stage: supported finite/live HTTP transports, shared NTLM single-socket connection, bilingual settings editor, native/browser bounded file selection, scoped history privacy and exact native backup are implemented. Real fixtures cover PEM/encrypted PFX mTLS, wrong password/alias/no identity, custom CA, DNS/Host/SNI/private policy, H2 prior knowledge and TLS ALPN, HTTP proxy Basic/bypass, SOCKS5 password tunneling and NTLM CONNECT affinity. Unsupported protocol settings reject. External Postman/OpenAPI export currently rejects any selected network source, preserving explicit native export instead.
Current combinations requiring follow-up: ordinary HTTPS proxy plus destination client identity rejects because reqwest shares the TLS client configuration; ordinary remote-resolving proxy plus target DNS override rejects because a remote CONNECT/forward proxy cannot obey local resolver pins. Locally resolving SOCKS and direct DNS remain available. NTLM uses separate proxy TLS without destination identity and can tunnel to the selected DNS IP, then apply destination SNI/mTLS. Proxy routing requires trusted private-network permission even when bypass rules match. TLS verification opt-out also applies to proxy TLS.
Live HTTP extension proof: real SSE and WebSocket handshakes use a checked DNS override and retain the original Host; hosted policy blocks the private address. Official async-graphql subscription engine delivers next frames through the mapped endpoint and rejects H2 upgrade mode. Mature A2A client and Agent Card discovery both use the request mapping. Official rmcp server initializes and invokes tools through environment-resolved DNS settings; the fixture explicitly permits its test domain in the SDK Host allowlist. Shared prepared TLS/policy inputs serve reqwest 0.12 and the SDK’s reqwest 0.13 without duplicate TLS/PKCS12 parsing logic.
gRPC extension: Tonic still owns HTTP2 framing, TLS/client-auth and Reflection. The CONNECT/SOCKS socket adapter is shared with NTLM rather than duplicated; each reconnect rechecks destination policy. Original HTTPS endpoint/SNI remains in Tonic while the proxy receives the mapped target IP. Tests prove PEM/PFX mutual TLS, custom CA and DNS, authenticated CONNECT unary calls, Reflection DNS/private-policy handling and NTLM connection affinity. Native gRPC settings must select HTTP2; UI defaults and protocol switches choose a compatible mode. Restored the finite-only signing guard after CI caught unsupported AWS/SSE acceptance; adding network controls does not imply signing support for live protocol SDKs.
Raw TCP extension: network controls are located in TCP’s own settings pane; HTTP version choices are hidden and source edits preserve certificate drafts. tcps:// applies the shared rustls CA/client identity configuration; tcp:// and tcps:// share checked DNS and library-owned proxy tunneling. TCP_NODELAY is passed to the actual underlying socket, including proxy sockets. The selected connect timeout bounds the full connection/TLS setup. Real mutual-TLS fixture verifies original SNI, client certificate and exact binary payload; the existing EOF/continued-read/wire-accounting case still passes. Codec/half-close/idle and byte budgets remain owned by the existing TCP module.
MQTT and Socket.IO extension: rumqttc’s optional raw-socket factory and Engine.IO’s injected bounded WebSocket Stream/Sink reuse the shared checked CONNECT/SOCKS socket adapter. TLS, MQTT packet/QoS/TrafficBudget, Engine.IO heartbeat and Socket.IO routing/ACK remain owned by the existing mature SDKs. The legacy pinned/native-TLS paths remain when network source is absent. Source HTTP2 modes explicitly reject for MQTT/Socket.IO. Each actual MQTT reconnect calls the checked socket factory again; the source snapshot stays fixed for the session.
Independent fixtures: Mosquitto validates both protocol versions through authenticated CONNECT with a mapped DNS target and QoS2 echo; custom CA preserves TLS name; PEM/PFX mutual TLS is required by the broker; WSS receives real MQTT publishes after SDK upgrade; reconnect restores subscriptions through DNS mapping. Official Socket.IO 4/Node OpenSSL validates original SNI and PEM/PFX client identity, plus a CONNECT handshake preserving Host and excluding proxy credentials at the target. The legacy mixed JSON/binary/ACK/heartbeat test still passes after the generic IO extension. Fixture CA, server and client subjects are distinct for OpenSSL chain building. No local Docker was used.
Remote Data file extension: existing checked finite HTTP download and bounded CSV/JSON/Parquet worker are reused. Request network settings are accepted only for RemoteFile, and hidden for local-file/database modes that have their own connection controls. Actual routed CSV download preserves Host and executes SQL against the downloaded data through the real server worker.
Client identity origin fencing: finite HTTP/GraphQL, SSE, WebSocket and GraphQL subscription redirects disable destination client identity after any origin change, alongside the existing header/query credential cleanup. Same-origin redirects retain client identity; saved source is not mutated. A real TLS fixture reproduced the previous credential forwarding before the fix, then proves anonymous TLS at the new origin, client identity at the original origin and preserved source. Real SSE/WebSocket TLS redirects prove the same behavior for live transports. Roots, DNS and trusted proxy configuration remain available for every checked hop.