Struct EgressPolicy 

pub struct EgressPolicy {
    pub allowed_cidrs: Vec<String>,
    pub allowed_domains: Vec<String>,
    pub allowed_tcp_ports: Vec<u16>,
    pub allowed_udp_ports: Vec<u16>,
    pub log_denied: bool,
    pub allow_dns: bool,
}

Egress policy for audited outbound network access.

When set, iptables OUTPUT chain rules restrict which destinations the container process can connect to. Use EgressPolicy::deny_all when no outbound connections, including DNS, should be permitted.

Fields

allowed_cidrs: Vec<String>

Allowed destination CIDRs (e.g., “10.0.0.0/8”, “192.168.1.0/24”).

allowed_domains: Vec<String>

Allowed exact DNS names. These are resolved to IPv4 /32 rules at startup.

allowed_tcp_ports: Vec<u16>

Allowed destination TCP ports. Empty means all ports on allowed CIDRs.

allowed_udp_ports: Vec<u16>

Allowed destination UDP ports.

log_denied: bool

Whether to log denied egress attempts (rate-limited).

allow_dns: bool

Whether to add implicit DNS (port 53 UDP/TCP) allow rules for configured resolvers. Defaults to true for explicit allowlist usability.

Implementations

impl EgressPolicy

pub fn deny_all() -> Self

Create a strict deny-all egress policy, including DNS.

pub fn with_allowed_cidrs(self, cidrs: Vec<String>) -> Self

Allow egress to the given CIDRs on any port.

pub fn with_allowed_domains(self, domains: Vec<String>) -> Self

Allow egress to the given exact DNS names.

pub fn with_allowed_tcp_ports(self, ports: Vec<u16>) -> Self

pub fn with_allowed_udp_ports(self, ports: Vec<u16>) -> Self

pub fn credential_broker_only(broker: &CredentialBrokerConfig) -> Self

Create a deny-by-default policy that only permits TCP egress to the configured host-side credential broker.

pub fn is_credential_broker_only(&self, broker: &CredentialBrokerConfig) -> bool

Return true when this policy permits no direct outbound route except the configured credential broker endpoint.

Trait Implementations

impl Clone for EgressPolicy

fn clone(&self) -> EgressPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for EgressPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for EgressPolicy

fn default() -> Self

Returns the “default value” for a type.