Fix/613 default network policy

[ionfwsrijan]

Description

settings.network_allowlist defaults to [] (empty list). When the allowlist is empty, _init_default_policies() automatically adds 0.0.0.0/0 and ::/0 as "Default allow all" rules. This means every network connection from any scanner to any public internet host is permitted unless the operator explicitly sets SECUSCAN_NETWORK_ALLOWLIST. The deny-by-default security model is illusory.

Fix: remove the default allow-all rules. An empty allowlist now means deny-all egress. Operators must explicitly configure SECUSCAN_NETWORK_ALLOWLIST to permit outbound traffic.

Related Issues

• [BUG] Default Network Policy Allows All Public Traffic — Deny-by-Default is Illusory #613

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update

How Has This Been Tested?

Verified that _init_default_policies no longer adds 0.0.0.0/0 or ::/0 when network_allowlist is empty. The denylist (RFC 1918, cloud metadata) continues to be applied as before.

Checklist

• My code follows the code style of this project.
• I have performed a self-review of my own code.
• I have commented my code, particularly in hard-to-understand areas.
• I have made corresponding changes to the documentation.
• My changes generate no new warnings.

[ionfwsrijan]

@utksh1 You may review and merge

[utksh1]

Focused default network policy fix with green checks. Approving for merge.

[utksh1]

After #629 merged, this branch now conflicts with main because it carries the same CI baseline files. The default-network-policy fix is useful, but this PR is not mergeable now. Please rebase on latest main and keep the branch scoped to config.py/network_policy.py plus directly related tests.

[ionfwsrijan]

@utksh1 You may merge this now

[utksh1]

Re-reviewed the latest update. The core default-deny network policy change is useful, but the PR still includes unrelated CI-baseline/frontend test changes. Please rebase on latest main and keep this scoped to backend/secuscan/config.py and backend/secuscan/network_policy.py plus direct network-policy tests only.

[ionfwsrijan]

@utksh1 I've dropped unrelated CI-baseline and frontend test changes. You may review and merge now

[utksh1]

Re-reviewed the latest update. The PR is now focused on default-deny network policy behavior with direct unit coverage and green visible checks. Approving.