Struct NetworkPolicy 

pub struct NetworkPolicy {
    pub default_egress: Action,
    pub default_ingress: Action,
    pub rules: Vec<Rule>,
}

Network policy: single ordered rule list plus per-direction default actions.

Rules carry a Direction field that determines which evaluator considers them. Egress evaluation iterates rules where direction ∈ {Egress, Both}; ingress evaluation iterates rules where direction ∈ {Ingress, Both}. First-match-wins within a direction.

Fields

default_egress: Action

Default action for egress traffic not matching any rule. Deny paired with an implicit allow-Public rule reproduces today’s “public internet only” reachability.

default_ingress: Action

Default action for ingress traffic not matching any rule. The per-field serde default is Deny so partially-specified JSON fails closed; permissive presets like NetworkPolicy::public_only flip this back to Allow explicitly.

rules: Vec<Rule>

Ordered list of rules, evaluated first-match-wins per direction.

Implementations

impl NetworkPolicy

pub fn builder() -> NetworkPolicyBuilder

Start building a NetworkPolicy via the fluent builder.

impl NetworkPolicy

pub fn none() -> Self

No network access — deny everything in both directions.

pub fn allow_all() -> Self

Unrestricted network access — allow everything in both directions.

pub fn public_only() -> Self

Public internet only — allow egress to public IPs, deny private, loopback, link-local, and metadata. Ingress defaults to allow (preserves today’s unfiltered published-port behavior).

pub fn non_local() -> Self

Non-local network access — allow public internet and private/LAN egress; deny loopback, link-local, and metadata. Ingress defaults to allow.

pub fn evaluate_egress( &self, dst: SocketAddr, protocol: Protocol, shared: &SharedState, ) -> Action

Evaluate an outbound connection against the rule list.

Iterates rules in order, considering only rules where direction ∈ {Egress, Any}. Returns the action from the first matching rule, or default_egress if no rule matches.

pub fn evaluate_egress_ip( &self, dst: IpAddr, protocol: Protocol, shared: &SharedState, ) -> Action

Evaluate an outbound ICMP packet against the rule list. Like Self::evaluate_egress but skips rules with a port filter (ICMP has no ports).

pub fn evaluate_egress_with_source( &self, dst: SocketAddr, protocol: Protocol, shared: &SharedState, source: HostnameSource<'_>, ) -> EgressEvaluation

Evaluate an outbound connection with an explicit HostnameSource for Domain / DomainSuffix matching. Walk order and protocol/port filtering are identical across sources — only the Domain match predicate varies.

pub fn evaluate_ingress( &self, peer: SocketAddr, guest_port: u16, protocol: Protocol, shared: &SharedState, ) -> Action

Evaluate an inbound connection against the rule list.

Iterates rules in order, considering only rules where direction ∈ {Ingress, Any}. peer is the source of the incoming connection (peer IP and source port — only the IP is matched). guest_port is the guest-side listening port; rules’ ports filter is matched against guest_port, not the peer’s port.

pub fn has_domain_rules(&self) -> bool

True if any rule references a Domain or DomainSuffix destination. The TCP proxy uses this to skip its SNI peek when no rule could possibly need a hostname for evaluation.

pub fn evaluate_dns_query( &self, name: &DomainName, protocol: Protocol, port: u16, ) -> Action

Evaluate a DNS query name against egress policy.

DNS queries do not have a resolved destination IP yet, so IP-based destinations (Cidr, most Group variants) cannot match here. Group::Host is the one exception: it names the gateway forwarder the query is actually delivered to, so a Group::Host rule is honored for DNS subject to its protocol/port filter. Name-based destinations (Domain / DomainSuffix) match the query name directly, ignoring protocol and port filters that apply to the later connection. Any rules still match the DNS transport’s protocol and port. If no rule matches, default_egress applies.

pub fn evaluate_dns_query_without_name( &self, protocol: Protocol, port: u16, ) -> Action

Evaluate a DNS query whose name cannot be represented as a DomainName. Only Any rules can match; otherwise the egress default applies.

pub fn deny_domain<S: AsRef<str>>( self, name: S, ) -> Result<Self, DomainNameError>

Single-name sugar over Self::deny_domains.

pub fn allow_domain<S: AsRef<str>>( self, name: S, ) -> Result<Self, DomainNameError>

Single-name sugar over Self::allow_domains.

pub fn deny_domain_suffix<S: AsRef<str>>( self, suffix: S, ) -> Result<Self, DomainNameError>

Single-suffix sugar over Self::deny_domain_suffixes.

pub fn allow_domain_suffix<S: AsRef<str>>( self, suffix: S, ) -> Result<Self, DomainNameError>

Single-suffix sugar over Self::allow_domain_suffixes.

pub fn deny_domains<I, S>(self, names: I) -> Result<Self, DomainNameError>

where I: IntoIterator<Item = S>, S: AsRef<str>,

Prepend deny Domain(name) egress rules. Prepending lets the deny outrank catch-all allows like allow Public.

pub fn allow_domains<I, S>(self, names: I) -> Result<Self, DomainNameError>

where I: IntoIterator<Item = S>, S: AsRef<str>,

Prepend allow Domain(name) egress rules.

pub fn deny_domain_suffixes<I, S>( self, suffixes: I, ) -> Result<Self, DomainNameError>

where I: IntoIterator<Item = S>, S: AsRef<str>,

Prepend deny DomainSuffix(suffix) egress rules. Suffixes match the apex and any subdomain (label-aligned).

pub fn allow_domain_suffixes<I, S>( self, suffixes: I, ) -> Result<Self, DomainNameError>

where I: IntoIterator<Item = S>, S: AsRef<str>,

Prepend allow DomainSuffix(suffix) egress rules.

Trait Implementations

impl Clone for NetworkPolicy

fn clone(&self) -> NetworkPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for NetworkPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for NetworkPolicy

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for NetworkPolicy

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for NetworkPolicy

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.