Struct NetworkPolicy 

pub struct NetworkPolicy {
    pub default_egress: Action,
    pub default_ingress: Action,
    pub rules: Vec<Rule>,
}

Network policy: single ordered rule list plus per-direction default actions.

Rules carry a Direction field that determines which evaluator considers them. Egress evaluation iterates rules where direction ∈ {Egress, Both}; ingress evaluation iterates rules where direction ∈ {Ingress, Both}. First-match-wins within a direction.

Fields

default_egress: Action

Default action for egress traffic not matching any rule. Deny paired with an implicit allow-Public rule reproduces today’s “public internet only” reachability.

default_ingress: Action

Default action for ingress traffic not matching any rule. The per-field serde default is Deny so partially-specified JSON fails closed; permissive presets like NetworkPolicy::public_only flip this back to Allow explicitly.

rules: Vec<Rule>

Ordered list of rules, evaluated first-match-wins per direction.

Implementations

impl NetworkPolicy

pub fn builder() -> NetworkPolicyBuilder

Start building a NetworkPolicy via the fluent builder.

impl NetworkPolicy

pub fn none() -> Self

No network access — deny everything in both directions.

pub fn allow_all() -> Self

Unrestricted network access — allow everything in both directions.

pub fn public_only() -> Self

Public internet only — allow egress to public IPs, deny private, loopback, link-local, and metadata. Ingress defaults to allow (preserves today’s unfiltered published-port behavior).

pub fn non_local() -> Self

Non-local network access — allow public internet and private/LAN egress; deny loopback, link-local, and metadata. Ingress defaults to allow.

pub fn evaluate_egress( &self, dst: SocketAddr, protocol: Protocol, shared: &SharedState, ) -> Action

Evaluate an outbound connection against the rule list.

Iterates rules in order, considering only rules where direction ∈ {Egress, Any}. Returns the action from the first matching rule, or default_egress if no rule matches.

pub fn evaluate_egress_ip( &self, dst: IpAddr, protocol: Protocol, shared: &SharedState, ) -> Action

Evaluate an outbound ICMP packet against the rule list. Like Self::evaluate_egress but skips rules with a port filter (ICMP has no ports).

pub fn evaluate_egress_with_source( &self, dst: SocketAddr, protocol: Protocol, shared: &SharedState, source: HostnameSource<'_>, ) -> EgressEvaluation

Evaluate an outbound connection with an explicit HostnameSource for Domain / DomainSuffix matching. Walk order and protocol/port filtering are identical across sources — only the Domain match predicate varies.

pub fn evaluate_ingress( &self, peer: SocketAddr, guest_port: u16, protocol: Protocol, shared: &SharedState, ) -> Action

Evaluate an inbound connection against the rule list.

Iterates rules in order, considering only rules where direction ∈ {Ingress, Any}. peer is the source of the incoming connection (peer IP and source port — only the IP is matched). guest_port is the guest-side listening port; rules’ ports filter is matched against guest_port, not the peer’s port.

pub fn has_domain_rules(&self) -> bool

True if any rule references a Domain or DomainSuffix destination. The TCP proxy uses this to skip its SNI peek when no rule could possibly need a hostname for evaluation.

pub fn dns_query_denied(&self, name: &DomainName) -> bool

Should the DNS forwarder refuse a query for name?

Returns true iff the first matching Domain / DomainSuffix rule has action Deny. Port and protocol filters and default_egress are not consulted — only explicit deny rules refuse a query.

pub fn deny_domain<S: AsRef<str>>( self, name: S, ) -> Result<Self, DomainNameError>

Single-name sugar over Self::deny_domains.

pub fn allow_domain<S: AsRef<str>>( self, name: S, ) -> Result<Self, DomainNameError>

Single-name sugar over Self::allow_domains.

pub fn deny_domain_suffix<S: AsRef<str>>( self, suffix: S, ) -> Result<Self, DomainNameError>

Single-suffix sugar over Self::deny_domain_suffixes.

pub fn allow_domain_suffix<S: AsRef<str>>( self, suffix: S, ) -> Result<Self, DomainNameError>

Single-suffix sugar over Self::allow_domain_suffixes.

pub fn deny_domains<I, S>(self, names: I) -> Result<Self, DomainNameError>

where I: IntoIterator<Item = S>, S: AsRef<str>,

Prepend deny Domain(name) egress rules. Prepending lets the deny outrank catch-all allows like allow Public.

pub fn allow_domains<I, S>(self, names: I) -> Result<Self, DomainNameError>

where I: IntoIterator<Item = S>, S: AsRef<str>,

Prepend allow Domain(name) egress rules.

pub fn deny_domain_suffixes<I, S>( self, suffixes: I, ) -> Result<Self, DomainNameError>

where I: IntoIterator<Item = S>, S: AsRef<str>,

Prepend deny DomainSuffix(suffix) egress rules. Suffixes match the apex and any subdomain (label-aligned).

pub fn allow_domain_suffixes<I, S>( self, suffixes: I, ) -> Result<Self, DomainNameError>

where I: IntoIterator<Item = S>, S: AsRef<str>,

Prepend allow DomainSuffix(suffix) egress rules.

Trait Implementations

impl Clone for NetworkPolicy

fn clone(&self) -> NetworkPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for NetworkPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for NetworkPolicy

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for NetworkPolicy

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for NetworkPolicy

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.