Struct NetRule 

pub struct NetRule {
    pub protocol: Protocol,
    pub target: NetTarget,
    pub ports: Vec<u16>,
    pub all_ports: bool,
}

A single --net-allow / --net-deny rule. Both flags share this representation and the same grammar; they differ only in whether hostnames are accepted (--net-deny rejects them) and in how the resolved rule is enforced (allowlist vs denylist).

Fields

protocol: Protocol

L4 protocol this rule applies to.

target: NetTarget

What the rule targets at the IP layer.

ports: Vec<u16>

Permitted/denied ports. Empty when all_ports is true and always empty for Protocol::Icmp.

all_ports: bool

“Any port” (bare target with no :port, or the * port token).

Implementations

impl NetRule

pub fn parse_allow(spec: &str) -> Result<NetRule, SandboxError>

Parse a --net-allow spec into a rule. Hostnames are accepted and resolved to IPs at sandbox start. Grammar (shared with --net-deny):

• host / <ip> / <cidr> / * – all ports (port optional; * targets any IP). TCP is the default scheme.
• host:<port[,port,...]> / <ip>:<port> / <cidr>:* / :port.
• [<ipv6|ipv6cidr>]:<port> – bracketed IPv6 with a port (a bare addr:port string is itself a valid IPv6 address, so the port form needs brackets).
• tcp://... / udp://... / icmp://... schemes (icmp: no port).

pub fn parse_deny(spec: &str) -> Result<NetDeny, SandboxError>

Parse a --net-deny spec into a rule. Identical grammar to parse_allow, except hostnames are rejected (the target must be a literal IP/CIDR or *); use --http-deny for domain blocking.

Trait Implementations

impl Clone for NetRule

fn clone(&self) -> NetRule

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for NetRule

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for NetRule

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for NetRule

fn eq(&self, other: &NetRule) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for NetRule

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for NetRule