netfilter

type Applier struct {
	// contains filtered or unexported fields
}

type Blocked struct {
	Prefix netip.Prefix
	Reason string
}

type IPBlock struct {
	CIDR   string   `json:"cidr"`
	Except []string `json:"except,omitempty"`
}

type Input struct {
	// AllowCIDRs are the address ranges the authorisation names. These are
	// the only thing that waives the block set, exactly as in the proxy.
	AllowCIDRs []netip.Prefix

	// AllowPorts bounds every destination allow. Empty means the caller
	// named no ports, and Compile refuses rather than guessing: an allow
	// rule with no port restriction is a hole, and "they probably meant
	// 80 and 443" is not a thing a firewall compiler should decide.
	AllowPorts []uint16

	// Brokers are egress proxy endpoints the sandbox must reach. Naming
	// any of them is what makes the policy brokered.
	Brokers []netip.AddrPort

	// Resolvers are DNS servers the sandbox may query directly. Each is
	// opened on both UDP and TCP — a truncated answer retries over TCP, and
	// a resolver reachable only over UDP fails on large responses in a way
	// that looks like a DNS outage rather than a firewall rule.
	//
	// A brokered policy needs none: the proxy resolves on the sandbox's
	// behalf, which is also what makes its resolve-once pinning meaningful.
	Resolvers []netip.AddrPort

	// AllowPublicInternet opens every address outside the block set on
	// AllowPorts. It exists because a hostname allowlist cannot be
	// expressed at layer 3, and it is a separate field rather than an
	// inference from HostPatterns so that widening the filter to the whole
	// Internet is something a caller states rather than something that
	// happens to it.
	AllowPublicInternet bool

	// HostPatterns is the L7 allowlist this policy could not enforce. It is
	// used only to write an accurate warning.
	HostPatterns []string
}

type LabelSelector struct {
	MatchLabels map[string]string `json:"matchLabels,omitempty"`
}

type Mode uint8

type NetworkPolicy struct {
	APIVersion string            `json:"apiVersion"`
	Kind       string            `json:"kind"`
	Metadata   NetworkPolicyMeta `json:"metadata"`
	Spec       NetworkPolicySpec `json:"spec"`
}

type NetworkPolicyMeta struct {
	Name        string            `json:"name,omitempty"`
	Namespace   string            `json:"namespace,omitempty"`
	Labels      map[string]string `json:"labels,omitempty"`
	Annotations map[string]string `json:"annotations,omitempty"`
}

type NetworkPolicyOptions struct {
	Name      string
	Namespace string
	// PodSelector must match exactly the Pods this policy should govern. An
	// empty selector in Kubernetes means *every* Pod in the namespace, so
	// an empty one here is refused rather than quietly firewalling the
	// namespace's other tenants.
	PodSelector map[string]string
	Labels      map[string]string
	Annotations map[string]string

	// AllowClusterDNS opens UDP and TCP 53 to the kube-dns Pods.
	//
	// It is a selector rather than an address because cluster DNS lives on
	// a Service ClusterIP in private space, and which side of the policy
	// the CNI applies its DNAT on varies by CNI. Selecting the kube-system
	// namespace is the form that works everywhere; an ipBlock for the
	// Service CIDR is the form that works until it doesn't.
	//
	// Without it, a default-deny egress policy breaks name resolution, and
	// the failure reads as "the network is broken" rather than "DNS is
	// denied" — which is why it defaults on in the driver.
	AllowClusterDNS bool
	// DNSNamespaceLabels selects the namespace running cluster DNS.
	// Defaults to kubernetes.io/metadata.name=kube-system, the label the
	// API server sets automatically on every namespace since 1.21.
	DNSNamespaceLabels map[string]string
}

type NetworkPolicyPeer struct {
	IPBlock           *IPBlock       `json:"ipBlock,omitempty"`
	NamespaceSelector *LabelSelector `json:"namespaceSelector,omitempty"`
	PodSelector       *LabelSelector `json:"podSelector,omitempty"`
}

type NetworkPolicyPort struct {
	Protocol string `json:"protocol,omitempty"`
	Port     *int   `json:"port,omitempty"`
}

type NetworkPolicyRule struct {
	To    []NetworkPolicyPeer `json:"to,omitempty"`
	From  []NetworkPolicyPeer `json:"from,omitempty"`
	Ports []NetworkPolicyPort `json:"ports,omitempty"`
}

type NetworkPolicySpec struct {
	PodSelector LabelSelector       `json:"podSelector"`
	PolicyTypes []string            `json:"policyTypes"`
	Egress      []NetworkPolicyRule `json:"egress,omitempty"`
	Ingress     []NetworkPolicyRule `json:"ingress,omitempty"`
}

type NftablesOptions struct {
	// Table is the inet table to install into. Deleting and recreating this
	// one table is what makes an apply atomic and idempotent, so it must
	// belong to this sandbox alone.
	Table string

	// Bridge, when set, renders the host-side form: a single forward chain
	// that filters only traffic arriving from that interface.
	//
	// This is how a control-plane host firewalls a container without ever
	// entering the container's network namespace. The bridge exists from
	// the moment the runtime creates the network, which is before any
	// workload can join it, so there is no window in which the sandbox is
	// running unfiltered — the ordering problem that makes the obvious
	// "start it, then firewall it" approach unsafe.
	//
	// Empty renders the in-namespace form instead: output, input and
	// forward chains that default to drop, for a filter installed inside
	// the sandbox's own namespace.
	Bridge string
}

type Policy struct {
	// Mode summarises the shape of the authorisation for display.
	Mode Mode
	// Rules are evaluated in order; the first match decides.
	Rules []Rule
	// Warnings record where the filter is necessarily wider than the
	// authorisation it was compiled from. They are rendered into the
	// output of every backend, because an operator reading a ruleset needs
	// to see that "*.github.com" became "the Internet".
	Warnings []string
}

type Proto uint8

type Rule struct {
	Verdict Verdict
	// Prefix is the destination address range.
	Prefix netip.Prefix
	// Ports is the destination port allowlist. Empty means every port,
	// which is what a drop rule wants and what an allow rule should almost
	// never have.
	Ports []uint16
	Proto Proto
	Scope Scope
	// Reason is the human sentence that lands in an nft comment, in the
	// NetworkPolicy annotation and in an operator's terminal. It is part of
	// the output, not a debugging aid.
	Reason string
}

type Scope uint8

type Verdict uint8