netpolicy

type CommandRunner interface {
	Run(ctx context.Context, args ...string) ([]byte, error)
}

type Enforcer interface {
	// Apply installs the policy idempotently. A nil policy is a no-op.
	Apply(ctx context.Context, p *Policy) error
	// Remove tears down the policy for the given realm+space. It is safe
	// to call when no policy was installed.
	Remove(ctx context.Context, realmName, spaceName string) error
}

type HostResolver interface {
	LookupIP(ctx context.Context, host string) ([]net.IP, error)
}

type IptablesEnforcer struct {
	// contains filtered or unexported fields
}

type NetHostResolver struct{}

type NoopEnforcer struct{}

type Policy struct {
	// Bridge is the Linux bridge device name (as written in the CNI
	// conflist) that the policy guards.
	Bridge string
	// RealmName and SpaceName identify the space for chain naming and log
	// tagging.
	RealmName string
	SpaceName string
	// Default is the fallthrough action when no Allow rule matches.
	Default intmodel.EgressDefault
	// Allow is the list of validated allowlist entries.
	Allow []ResolvedRule
}

type ResolvedRule struct {
	// OriginalHost is the user-supplied host, kept so rule comments can
	// name the DNS origin. Empty when the rule came from a CIDR entry.
	OriginalHost string
	// CIDR is set when the rule was supplied as a literal CIDR.
	CIDR string
	// IPs is the list of IPs the rule targets. When CIDR is set, IPs is
	// empty and CIDR is used as the iptables -d target.
	IPs []net.IP
	// Ports is the list of TCP destination ports. Empty means "any port".
	Ports []int
}

type Rule struct {
	// Op is "-A" (append), "-I 1" (insert at head), etc.
	Op string
	// Chain is the target chain for Op.
	Chain string
	// Args is the remaining iptables argument list.
	Args []string
}