Networking

use microsandbox::NetworkPolicy;

let policy = NetworkPolicy::builder()
    .default_deny()
    .egress(|e| e.tcp().port(443).allow_public().allow_private())
    .rule(|r| r.any().deny().ip("198.51.100.5"))
    .build()?;

NetworkPolicy::builder()
    .default_deny()
    .egress(|e| e
        .allow().cidr("10.0.0.0/8")     // matches everything in 10.x
        .deny().ip("10.0.0.5"))          // never reached
    .build()?;

WARN rule #1 (Egress Cidr(10.0.0.5/32) Deny) is shadowed by rule #0 (Egress Cidr(10.0.0.0/8) Allow); to narrow, place the more specific rule first

.rule(|r| r.egress()
    .tcp().port(443).allow_public()    // rule 1: egress, TCP, 443, allow Public
    .udp().allow_private())            // rule 2: egress, [TCP, UDP], 443, allow Private

fn any<F>(self, f: F) -> Self
where
    F: for<'a> FnOnce(&'a mut RuleBuilder) -> &'a mut RuleBuilder

fn build(self) -> Result<NetworkPolicy, BuildError>

fn default_allow(self) -> Self

fn default_deny(self) -> Self

fn default_egress(self, action: Action) -> Self

fn default_ingress(self, action: Action) -> Self

fn egress<F>(self, f: F) -> Self
where
    F: for<'a> FnOnce(&'a mut RuleBuilder) -> &'a mut RuleBuilder

fn ingress<F>(self, f: F) -> Self
where
    F: for<'a> FnOnce(&'a mut RuleBuilder) -> &'a mut RuleBuilder

fn rule<F>(self, f: F) -> Self
where
    F: for<'a> FnOnce(&'a mut RuleBuilder) -> &'a mut RuleBuilder

fn any(&mut self) -> &mut Self

fn egress(&mut self) -> &mut Self

fn ingress(&mut self) -> &mut Self

fn icmpv4(&mut self) -> &mut Self

fn icmpv6(&mut self) -> &mut Self

fn tcp(&mut self) -> &mut Self

fn udp(&mut self) -> &mut Self

fn port(&mut self, port: u16) -> &mut Self

fn port_range(&mut self, lo: u16, hi: u16) -> &mut Self

fn ports<I: IntoIterator<Item = u16>>(&mut self, ports: I) -> &mut Self

fn allow_host(&mut self) -> &mut Self

fn allow_link_local(&mut self) -> &mut Self

fn allow_loopback(&mut self) -> &mut Self

fn allow_meta(&mut self) -> &mut Self

fn allow_multicast(&mut self) -> &mut Self

fn allow_private(&mut self) -> &mut Self

fn allow_public(&mut self) -> &mut Self

fn deny_host(&mut self) -> &mut Self

fn deny_link_local(&mut self) -> &mut Self

fn deny_loopback(&mut self) -> &mut Self

fn deny_meta(&mut self) -> &mut Self

fn deny_multicast(&mut self) -> &mut Self

fn deny_private(&mut self) -> &mut Self

fn deny_public(&mut self) -> &mut Self

NetworkPolicy::builder()
    .default_allow()
    .egress(|e| e
        .deny_domains(["evil.com", "tracker.example"])
        .deny_domain_suffixes([".ads.example", ".doubleclick.net"]))
    .build()?

fn allow_domain_suffixes<I, S>(&mut self, suffixes: I) -> &mut Self
where I: IntoIterator<Item = S>, S: Into<String>

fn allow_domains<I, S>(&mut self, names: I) -> &mut Self
where I: IntoIterator<Item = S>, S: Into<String>

fn deny_domain_suffixes<I, S>(&mut self, suffixes: I) -> &mut Self
where I: IntoIterator<Item = S>, S: Into<String>

fn deny_domains<I, S>(&mut self, names: I) -> &mut Self
where I: IntoIterator<Item = S>, S: Into<String>

fn allow_local(&mut self) -> &mut Self

fn deny_local(&mut self) -> &mut Self

.rule(|r| r.egress().tcp().port(443).allow().domain("api.example.com"))
.rule(|r| r.any().deny().cidr("198.51.100.0/24"))

fn allow(&mut self) -> ExplicitRuleBuilder<'_>

fn deny(&mut self) -> ExplicitRuleBuilder<'_>

fn dns(self, f: impl FnOnce(DnsBuilder) -> DnsBuilder) -> Self

.network(|n| n
    .dns(|d| d
        .nameservers(["1.1.1.1".parse::<Nameserver>()?])
        .query_timeout_ms(3000)
    )
)

fn max_connections(self, max: usize) -> Self

fn ipv4_pool(self, pool: Ipv4Network) -> Self

fn ipv6_pool(self, pool: Ipv6Network) -> Self

fn on_secret_violation(
    self,
    f: impl FnOnce(ViolationActionBuilder) -> ViolationActionBuilder,
) -> Self

.network(|n| n.on_secret_violation(|v| {
    v.block_and_log()
     .passthrough_host("api.anthropic.com")
     .passthrough_host_pattern("*.example.com")
}))

fn policy(self, policy: NetworkPolicy) -> Self

.network(|n| n.policy(NetworkPolicy::builder().default_deny().build()?))

fn tls(self, f: impl FnOnce(TlsBuilder) -> TlsBuilder) -> Self

fn trust_host_cas(self, enabled: bool) -> Self

fn nameservers<I>(self, nameservers: I) -> Self
where
    I: IntoIterator,
    I::Item: Into<Nameserver>

fn query_timeout_ms(self, ms: u64) -> Self

fn rebind_protection(self, enabled: bool) -> Self

fn block_quic(self, block: bool) -> Self

fn bypass(self, pattern: impl Into<String>) -> Self

fn intercept_ca_cert(self, path: impl Into<PathBuf>) -> Self

fn intercept_ca_key(self, path: impl Into<PathBuf>) -> Self

fn intercepted_ports(self, ports: Vec<u16>) -> Self

fn upstream_ca_cert(self, path: impl Into<PathBuf>) -> Self

fn verify_upstream(self, verify: bool) -> Self

use microsandbox_network::policy::{Destination, DomainName};

let exact: DomainName = "PyPI.Org.".parse()?;     // -> "pypi.org"
let suffix: DomainName = ".example.com".parse()?;  // -> "example.com"

struct PortRange {
    start: u16,  // inclusive
    end: u16,    // inclusive
}