policy

type Action string

type Config struct {
	Runner        Runner
	WeaverNftPath string
	RegistryDir   string
	LockPath      string
	EnsureService func(ctx context.Context) error
}

type Direction string

type Manager struct {
	// contains filtered or unexported fields
}

type Policy struct {
	Name            string    `json:"name"`
	Action          Action    `json:"action"`
	Stamp           string    `json:"stamp"`             // HTB class (from --stamp); "" for deny
	ReplyStamp      string    `json:"reply_stamp"`       // reply class (from --reply-stamp); "" if unset
	Direction       Direction `json:"direction"`         // derived from Stamp's class by Validate; "" for deny
	Ports           []string  `json:"ports"`             // workload listener ports (from --ports); nil if none
	FromEntityWorld bool      `json:"from_entity_world"` // true if --from-entity world (no IP-set clause)
	CreatedAt       time.Time `json:"created_at"`        // tiebreaker within a tier, preserved across a --force replace
}

type Runner interface {
	// Apply loads a full nft document into the kernel (`nft -f -`). The
	// rendered document carries the idempotent `add table / delete table / add
	// table` prefix, so a re-apply atomically replaces the inet weaver table.
	Apply(ctx context.Context, doc string) error
	// AddElements adds initial membership to a policy's set
	// (`nft add element inet weaver <set> { … }`). Applied to the live kernel
	// only — set membership is never persisted.
	AddElements(ctx context.Context, set string, elements []string) error
	// DeleteElements removes specific elements from a policy's set
	// (`nft delete element inet weaver <set> { … }`). Applied to the live
	// kernel only.
	DeleteElements(ctx context.Context, set string, elements []string) error
	// SetElements atomically replaces a policy's set membership
	// (`flush set inet weaver <set>` followed by `add element … { … }` in a
	// single nft document — one kernel transaction). An empty elements slice
	// clears the set without adding any new entries.
	SetElements(ctx context.Context, set string, elements []string) error
	// ListElements returns one set's live elements
	// (`nft list set inet weaver <set>`), or nil if the set has no elements
	// or does not exist. Used by Manager.Create to snapshot every policy's
	// membership before the destructive delete/recreate Apply() performs, so
	// it can be restored afterward (see Manager.Create for why).
	ListElements(ctx context.Context, set string) ([]string, error)
	// List returns the rendered inet weaver table (`nft list table inet weaver`).
	List(ctx context.Context) (string, error)
	// Delete removes the inet weaver table (`nft delete table inet weaver`).
	Delete(ctx context.Context) error
	// Exists reports whether the inet weaver table is present in the kernel.
	Exists(ctx context.Context) (bool, error)
}