Struct NetworkPolicy 

pub struct NetworkPolicy {
    pub default_egress: Action,
    pub default_ingress: Action,
    pub rules: Vec<Rule>,
}

Network policy: single ordered rule list plus per-direction default actions.

Rules carry a Direction field that determines which evaluator considers them. Egress evaluation iterates rules where direction ∈ {Egress, Both}; ingress evaluation iterates rules where direction ∈ {Ingress, Both}. First-match-wins within a direction.

Fields

default_egress: Action

Default action for egress traffic not matching any rule. Deny paired with an implicit allow-Public rule reproduces today’s “public internet only” reachability.

default_ingress: Action

Default action for ingress traffic not matching any rule. The per-field serde default is Deny so partially-specified JSON fails closed; permissive presets like NetworkPolicy::public_only flip this back to Allow explicitly.

rules: Vec<Rule>

Ordered list of rules, evaluated first-match-wins per direction.

Implementations

impl NetworkPolicy

pub fn builder() -> NetworkPolicyBuilder

Start building a NetworkPolicy via the fluent builder.

impl NetworkPolicy

pub fn none() -> Self

No network access — deny everything in both directions.

pub fn allow_all() -> Self

Unrestricted network access — allow everything in both directions.

pub fn public_only() -> Self

Public internet only — allow egress to public IPs, deny private, loopback, link-local, and metadata. Ingress defaults to allow (preserves today’s unfiltered published-port behavior).

pub fn non_local() -> Self

Non-local network access — allow public internet and private/LAN egress; deny loopback, link-local, and metadata. Ingress defaults to allow.

pub fn evaluate_egress( &self, dst: SocketAddr, protocol: Protocol, shared: &SharedState, ) -> Action

Evaluate an outbound connection against the rule list.

Iterates rules in order, considering only rules where direction ∈ {Egress, Any}. Returns the action from the first matching rule, or default_egress if no rule matches.

pub fn evaluate_egress_ip( &self, dst: IpAddr, protocol: Protocol, shared: &SharedState, ) -> Action

Evaluate an outbound ICMP packet against the rule list.

Same as Self::evaluate_egress but without port matching — ICMP has no ports. Rules with a non-empty ports filter are skipped since applying a port range to a portless protocol would be semantically incorrect.

pub fn evaluate_ingress( &self, peer: SocketAddr, guest_port: u16, protocol: Protocol, shared: &SharedState, ) -> Action

Evaluate an inbound connection against the rule list.

Iterates rules in order, considering only rules where direction ∈ {Ingress, Any}. peer is the source of the incoming connection (peer IP and source port — only the IP is matched). guest_port is the guest-side listening port; rules’ ports filter is matched against guest_port, not the peer’s port.

Trait Implementations

impl Clone for NetworkPolicy

fn clone(&self) -> NetworkPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for NetworkPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for NetworkPolicy

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for NetworkPolicy

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for NetworkPolicy

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.