Implement canonical network readiness derivation

crates/lazaret-core/src/lib.rs

@@ -3,6 +3,7 @@
 pub mod codec;
 pub mod configuration;
 pub mod identity;
+pub mod network;
 pub mod protocol;
 pub mod records;
 

crates/lazaret-core/src/network.rs

@@ -0,0 +1,642 @@
+use std::collections::{BTreeMap, BTreeSet};
+use std::fmt;
+
+use sha2::{Digest, Sha256};
+
+use crate::codec::{CodecError, encode};
+use crate::configuration::ResolvedDomainConfiguration;
+use crate::identity::{
+    ConfigurationFingerprint, DerivedPolicyDigest, DomainId, GenerationId, NamespaceIdentity,
+    NetworkSidecarId, PidfsProcessIdentityV1, ReadinessFingerprint,
+};
+use crate::records::{
+    AddressFamily, AddressFamilyDisposition, AddressFamilyDispositionValue,
+    DERIVED_NETWORK_POLICY_SCHEMA_ID, DefaultAction, DerivedNetworkPolicy,
+    DerivedNetworkPolicyFields, IpAddress, IpNetwork, NETWORK_READINESS_IDENTITY_SCHEMA_ID,
+    NetworkObservation, NetworkReachabilityProbe, NetworkReadinessAttestation,
+    NetworkReadinessEvidence, NetworkReadinessIdentity, NetworkReadinessIdentityFields,
+    PolicyAction, PolicyDelivery, PrefixRule, Resolver,
+};
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct CanonicalDerivedNetworkPolicy {
+    policy: DerivedNetworkPolicy,
+    canonical_bytes: Vec<u8>,
+    digest: DerivedPolicyDigest,
+}
+
+impl CanonicalDerivedNetworkPolicy {
+    #[must_use]
+    pub const fn policy(&self) -> &DerivedNetworkPolicy {
+        &self.policy
+    }
+
+    #[must_use]
+    pub fn canonical_bytes(&self) -> &[u8] {
+        &self.canonical_bytes
+    }
+
+    #[must_use]
+    pub const fn digest(&self) -> DerivedPolicyDigest {
+        self.digest
+    }
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct ReachabilityExpectation {
+    pub denied_destinations: Vec<IpAddress>,
+    pub permitted_destinations: Vec<IpAddress>,
+    pub dns_queries: Vec<DnsQueryExpectation>,
+}
+
+#[derive(Clone, Debug, Eq, Ord, PartialEq, PartialOrd)]
+pub struct DnsQueryExpectation {
+    pub resolver: IpAddress,
+    pub query_name: String,
+}
+
+#[derive(Clone, Debug)]
+pub struct ReadinessExpectation<'a> {
+    pub domain_id: DomainId,
+    pub generation_id: GenerationId,
+    pub configuration_fingerprint: ConfigurationFingerprint,
+    pub network_sidecar_id: NetworkSidecarId,
+    pub enforcement_namespace: NamespaceIdentity,
+    pub runtime_supervisor: &'a PidfsProcessIdentityV1,
+    pub connectivity_helper: &'a PidfsProcessIdentityV1,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum NetworkValidationErrorKind {
+    AddressFamilies,
+    DefaultActions,
+    Prefix,
+    PrefixConflict,
+    Resolver,
+    CanonicalEncoding,
+    Attestation,
+    Reachability,
+    Evidence,
+}
+
+#[derive(Debug)]
+pub struct NetworkValidationError {
+    kind: NetworkValidationErrorKind,
+    detail: &'static str,
+}
+
+impl NetworkValidationError {
+    const fn new(kind: NetworkValidationErrorKind, detail: &'static str) -> Self {
+        Self { kind, detail }
+    }
+
+    #[must_use]
+    pub const fn kind(&self) -> NetworkValidationErrorKind {
+        self.kind
+    }
+}
+
+impl fmt::Display for NetworkValidationError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(formatter, "{}", self.detail)
+    }
+}
+
+impl std::error::Error for NetworkValidationError {}
+
+impl From<CodecError> for NetworkValidationError {
+    fn from(_: CodecError) -> Self {
+        Self::new(
+            NetworkValidationErrorKind::CanonicalEncoding,
+            "network document cannot be canonically encoded",
+        )
+    }
+}
+
+/// Derives the v1 policy from one resolved trusted-host configuration.
+///
+/// # Errors
+///
+/// Returns an error when resolver or canonical policy validation fails.
+pub fn derive_ipv4_policy(
+    configuration: &ResolvedDomainConfiguration,
+    resolvers: impl IntoIterator<Item = IpAddress>,
+) -> Result<CanonicalDerivedNetworkPolicy, NetworkValidationError> {
+    let prefix_rules = configuration
+        .effective_allow_prefixes()
+        .iter()
+        .map(|prefix| PrefixRule {
+            family: AddressFamily::Ipv4,
+            network: IpNetwork {
+                address: IpAddress::V4(prefix.address()),
+                prefix_length: prefix.prefix_length(),
+            },
+            action: PolicyAction::Allow,
+        })
+        .chain(
+            configuration
+                .effective_deny_prefixes()
+                .iter()
+                .map(|prefix| PrefixRule {
+                    family: AddressFamily::Ipv4,
+                    network: IpNetwork {
+                        address: IpAddress::V4(prefix.address()),
+                        prefix_length: prefix.prefix_length(),
+                    },
+                    action: PolicyAction::Deny,
+                }),
+        )
+        .collect();
+    derive_policy(DerivedNetworkPolicyFields {
+        address_families: vec![
+            AddressFamilyDisposition {
+                family: AddressFamily::Ipv4,
+                disposition: AddressFamilyDispositionValue::Enabled,
+            },
+            AddressFamilyDisposition {
+                family: AddressFamily::Ipv6,
+                disposition: AddressFamilyDispositionValue::Disabled,
+            },
+        ],
+        default_actions: vec![DefaultAction {
+            family: AddressFamily::Ipv4,
+            action: PolicyAction::Allow,
+        }],
+        prefix_rules,
+        resolvers: resolvers
+            .into_iter()
+            .map(|address| Resolver {
+                family: AddressFamily::Ipv4,
+                address,
+            })
+            .collect(),
+    })
+}
+
+/// Validates, normalizes, and fingerprints a derived policy document.
+///
+/// # Errors
+///
+/// Returns an error for an invalid family, prefix, resolver, conflict, or encoding.
+pub fn derive_policy(
+    mut fields: DerivedNetworkPolicyFields,
+) -> Result<CanonicalDerivedNetworkPolicy, NetworkValidationError> {
+    validate_address_families(&fields.address_families)?;
+    validate_default_actions(&fields.default_actions)?;
+    validate_prefix_rules(&fields.prefix_rules)?;
+    validate_resolvers(&fields.resolvers)?;
+
+    fields
+        .address_families
+        .sort_unstable_by_key(|item| item.family);
+    fields
+        .default_actions
+        .sort_unstable_by_key(|item| item.family);
+    fields.prefix_rules.sort_unstable();
+    fields.resolvers.sort_unstable();
+
+    let policy = DerivedNetworkPolicy::v1(fields);
+    let canonical_bytes = encode(&policy)?;
+    let digest = domain_digest(DERIVED_NETWORK_POLICY_SCHEMA_ID, &canonical_bytes);
+    Ok(CanonicalDerivedNetworkPolicy {
+        policy,
+        canonical_bytes,
+        digest: DerivedPolicyDigest::new(digest),
+    })
+}
+
+#[must_use]
+pub fn readiness_identity(attestation: &NetworkReadinessAttestation) -> NetworkReadinessIdentity {
+    NetworkReadinessIdentity::v1(NetworkReadinessIdentityFields {
+        domain_id: attestation.domain_id,
+        generation_id: attestation.generation_id,
+        configuration_fingerprint: attestation.configuration_fingerprint,
+        network_sidecar_id: attestation.network_sidecar_id,
+        derived_policy_digest: attestation.derived_policy_digest,
+        enforcement_namespace: attestation.enforcement_namespace,
+    })
+}
+
+/// Encodes the v1 readiness identity in its canonical form.
+///
+/// # Errors
+///
+/// Returns an error when canonical encoding fails.
+pub fn canonical_readiness_identity_bytes(
+    identity: &NetworkReadinessIdentity,
+) -> Result<Vec<u8>, NetworkValidationError> {
+    Ok(encode(identity)?)
+}
+
+/// Computes the domain-separated readiness fingerprint.
+///
+/// # Errors
+///
+/// Returns an error when canonical identity encoding fails.
+pub fn readiness_fingerprint(
+    identity: &NetworkReadinessIdentity,
+) -> Result<ReadinessFingerprint, NetworkValidationError> {
+    let canonical_bytes = canonical_readiness_identity_bytes(identity)?;
+    Ok(ReadinessFingerprint::new(domain_digest(
+        NETWORK_READINESS_IDENTITY_SCHEMA_ID,
+        &canonical_bytes,
+    )))
+}
+
+/// Binds validated attestation and reachability results into readiness evidence.
+///
+/// # Errors
+///
+/// Returns an error for any identity, observation, policy, or probe mismatch.
+pub fn accept_network_readiness(
+    policy: &CanonicalDerivedNetworkPolicy,
+    expectation: &ReadinessExpectation<'_>,
+    attestation: NetworkReadinessAttestation,
+    reachability: NetworkReachabilityProbe,
+    expected_reachability: &ReachabilityExpectation,
+) -> Result<NetworkReadinessEvidence, NetworkValidationError> {
+    validate_attestation(policy, expectation, &attestation)?;
+    validate_reachability(
+        policy.policy(),
+        expectation,
+        &reachability,
+        expected_reachability,
+    )?;
+    let identity = readiness_identity(&attestation);
+    let fingerprint = readiness_fingerprint(&identity)?;
+    Ok(NetworkReadinessEvidence {
+        domain_id: expectation.domain_id,
+        generation_id: expectation.generation_id,
+        network_sidecar_id: expectation.network_sidecar_id,
+        readiness_fingerprint: fingerprint,
+        attestation,
+        readiness_identity: identity,
+        reachability_probe: reachability,
+    })
+}
+
+/// Revalidates persisted readiness evidence against current generation authority.
+///
+/// # Errors
+///
+/// Returns an error for any identity, projection, fingerprint, or probe mismatch.
+pub fn validate_network_readiness_evidence(
+    policy: &CanonicalDerivedNetworkPolicy,
+    expectation: &ReadinessExpectation<'_>,
+    evidence: &NetworkReadinessEvidence,
+    expected_reachability: &ReachabilityExpectation,
+) -> Result<(), NetworkValidationError> {
+    if evidence.domain_id != expectation.domain_id
+        || evidence.generation_id != expectation.generation_id
+        || evidence.network_sidecar_id != expectation.network_sidecar_id
+    {
+        return Err(NetworkValidationError::new(
+            NetworkValidationErrorKind::Evidence,
+            "network readiness evidence identity mismatch",
+        ));
+    }
+    validate_attestation(policy, expectation, &evidence.attestation)?;
+    let projected = readiness_identity(&evidence.attestation);
+    let fingerprint = readiness_fingerprint(&projected)?;
+    if evidence.readiness_identity != projected || evidence.readiness_fingerprint != fingerprint {
+        return Err(NetworkValidationError::new(
+            NetworkValidationErrorKind::Evidence,
+            "network readiness projection or fingerprint mismatch",
+        ));
+    }
+    validate_reachability(
+        policy.policy(),
+        expectation,
+        &evidence.reachability_probe,
+        expected_reachability,
+    )
+}
+
+fn validate_address_families(
+    dispositions: &[AddressFamilyDisposition],
+) -> Result<(), NetworkValidationError> {
+    let expected = BTreeMap::from([
+        (AddressFamily::Ipv4, AddressFamilyDispositionValue::Enabled),
+        (AddressFamily::Ipv6, AddressFamilyDispositionValue::Disabled),
+    ]);
+    let actual: BTreeMap<_, _> = dispositions
+        .iter()
+        .map(|item| (item.family, item.disposition))
+        .collect();
+    if dispositions.len() != expected.len() || actual != expected {
+        return Err(NetworkValidationError::new(
+            NetworkValidationErrorKind::AddressFamilies,
+            "v1 requires IPv4 enabled and IPv6 disabled exactly once",
+        ));
+    }
+    Ok(())
+}
+
+fn validate_default_actions(actions: &[DefaultAction]) -> Result<(), NetworkValidationError> {
+    if actions
+        != [DefaultAction {
+            family: AddressFamily::Ipv4,
+            action: PolicyAction::Allow,
+        }]
+    {
+        return Err(NetworkValidationError::new(
+            NetworkValidationErrorKind::DefaultActions,
+            "v1 requires one IPv4 default-allow action",
+        ));
+    }
+    Ok(())
+}
+
+fn validate_prefix_rules(rules: &[PrefixRule]) -> Result<(), NetworkValidationError> {
+    let mut actions = BTreeMap::new();
+    for rule in rules {
+        validate_network(rule.family, rule.network)?;
+        if rule.family != AddressFamily::Ipv4 {
+            return Err(NetworkValidationError::new(
+                NetworkValidationErrorKind::AddressFamilies,
+                "disabled address family has a prefix rule",
+            ));
+        }
+        match actions.insert((rule.family, rule.network), rule.action) {
+            Some(previous) if previous != rule.action => {
+                return Err(NetworkValidationError::new(
+                    NetworkValidationErrorKind::PrefixConflict,
+                    "equal prefix has conflicting actions",
+                ));
+            }
+            Some(_) => {
+                return Err(NetworkValidationError::new(
+                    NetworkValidationErrorKind::Prefix,
+                    "duplicate prefix rule",
+                ));
+            }
+            None => {}
+        }
+    }
+    for network in [
+        ([10, 0, 0, 0], 8),
+        ([172, 16, 0, 0], 12),
+        ([192, 168, 0, 0], 16),
+    ] {
+        let required = IpNetwork {
+            address: IpAddress::V4(network.0),
+            prefix_length: network.1,
+        };
+        if actions.get(&(AddressFamily::Ipv4, required)) != Some(&PolicyAction::Deny) {
+            return Err(NetworkValidationError::new(
+                NetworkValidationErrorKind::Prefix,
+                "v1 policy is missing a default private-network deny",
+            ));
+        }
+    }
+    Ok(())
+}
+
+fn validate_resolvers(resolvers: &[Resolver]) -> Result<(), NetworkValidationError> {
+    if resolvers.is_empty() {
+        return Err(NetworkValidationError::new(
+            NetworkValidationErrorKind::Resolver,
+            "derived policy requires a resolver",
+        ));
+    }
+    let mut seen = BTreeSet::new();
+    for resolver in resolvers {
+        if resolver.family != AddressFamily::Ipv4
+            || address_family(resolver.address) != resolver.family
+        {
+            return Err(NetworkValidationError::new(
+                NetworkValidationErrorKind::Resolver,
+                "resolver address family is disabled or mismatched",
+            ));
+        }
+        if !seen.insert(*resolver) {
+            return Err(NetworkValidationError::new(
+                NetworkValidationErrorKind::Resolver,
+                "duplicate resolver",
+            ));
+        }
+    }
+    Ok(())
+}
+
+fn validate_network(
+    family: AddressFamily,
+    network: IpNetwork,
+) -> Result<(), NetworkValidationError> {
+    if address_family(network.address) != family {
+        return Err(NetworkValidationError::new(
+            NetworkValidationErrorKind::Prefix,
+            "prefix address family mismatch",
+        ));
+    }
+    let (bytes, maximum) = match network.address {
+        IpAddress::V4(bytes) => (bytes.to_vec(), 32),
+        IpAddress::V6(bytes) => (bytes.to_vec(), 128),
+    };
+    if network.prefix_length > maximum || !is_network_address(&bytes, network.prefix_length) {
+        return Err(NetworkValidationError::new(
+            NetworkValidationErrorKind::Prefix,
+            "prefix is not a canonical network",
+        ));
+    }
+    Ok(())
+}
+
+fn is_network_address(bytes: &[u8], prefix_length: u8) -> bool {
+    let complete = usize::from(prefix_length / 8);
+    let remainder = prefix_length % 8;
+    if remainder != 0 && bytes[complete] & (u8::MAX >> remainder) != 0 {
+        return false;
+    }
+    let start = complete + usize::from(remainder != 0);
+    bytes[start..].iter().all(|byte| *byte == 0)
+}
+
+fn validate_attestation(
+    policy: &CanonicalDerivedNetworkPolicy,
+    expected: &ReadinessExpectation<'_>,
+    attestation: &NetworkReadinessAttestation,
+) -> Result<(), NetworkValidationError> {
+    if attestation.domain_id != expected.domain_id
+        || attestation.generation_id != expected.generation_id
+        || attestation.configuration_fingerprint != expected.configuration_fingerprint
+        || attestation.network_sidecar_id != expected.network_sidecar_id
+        || attestation.derived_policy_digest != policy.digest()
+        || attestation.enforcement_namespace != expected.enforcement_namespace
+        || attestation.runtime_supervisor != *expected.runtime_supervisor
+        || attestation.connectivity_helper != *expected.connectivity_helper
+        || !valid_observation(&attestation.observation)
+    {
+        return Err(NetworkValidationError::new(
+            NetworkValidationErrorKind::Attestation,
+            "network readiness attestation mismatch",
+        ));
+    }
+    for route in &attestation.observation.observed_routes {
+        validate_network(address_family(route.address), *route)?;
+    }
+    Ok(())
+}
+
+fn valid_observation(observation: &NetworkObservation) -> bool {
+    observation.policy_delivery == PolicyDelivery::SealedMemfd
+        && observation.helper_ready
+        && observation.routes_attested
+}
+
+fn validate_reachability(
+    policy: &DerivedNetworkPolicy,
+    expected: &ReadinessExpectation<'_>,
+    probe: &NetworkReachabilityProbe,
+    expected_results: &ReachabilityExpectation,
+) -> Result<(), NetworkValidationError> {
+    if probe.domain_id != expected.domain_id
+        || probe.generation_id != expected.generation_id
+        || probe.enforcement_namespace != expected.enforcement_namespace
+        || expected_results.denied_destinations.is_empty()
+        || expected_results.permitted_destinations.is_empty()
+        || expected_results.dns_queries.is_empty()
+    {
+        return reachability_error();
+    }
+
+    let denied = exact_observations(
+        &expected_results.denied_destinations,
+        &probe.denied_destinations,
+        |item| (item.destination, item.unreachable),
+    )?;
+    let permitted = exact_observations(
+        &expected_results.permitted_destinations,
+        &probe.permitted_destinations,
+        |item| (item.destination, item.reachable),
+    )?;
+    if denied.iter().any(|(_, passed)| !passed)
+        || permitted.iter().any(|(_, passed)| !passed)
+        || expected_results
+            .denied_destinations
+            .iter()
+            .any(|address| effective_action(policy, *address) != Some(PolicyAction::Deny))
+        || expected_results
+            .permitted_destinations
+            .iter()
+            .any(|address| effective_action(policy, *address) != Some(PolicyAction::Allow))
+    {
+        return reachability_error();
+    }
+
+    let expected_dns: BTreeSet<_> = expected_results.dns_queries.iter().cloned().collect();
+    let actual_dns: BTreeSet<_> = probe
+        .dns_observations
+        .iter()
+        .map(|item| DnsQueryExpectation {
+            resolver: item.resolver,
+            query_name: item.query_name.clone(),
+        })
+        .collect();
+    let resolvers: BTreeSet<_> = policy
+        .resolvers
+        .iter()
+        .map(|resolver| resolver.address)
+        .collect();
+    if expected_dns.len() != expected_results.dns_queries.len()
+        || actual_dns.len() != probe.dns_observations.len()
+        || actual_dns != expected_dns
+        || probe.dns_observations.iter().any(|item| {
+            item.query_name.is_empty()
+                || !resolvers.contains(&item.resolver)
+                || item.resolved_addresses.is_empty()
+                || item
+                    .resolved_addresses
+                    .iter()
+                    .any(|address| address_family(*address) != AddressFamily::Ipv4)
+        })
+    {
+        return reachability_error();
+    }
+    Ok(())
+}
+
+fn exact_observations<T, F>(
+    expected: &[IpAddress],
+    actual: &[T],
+    project: F,
+) -> Result<BTreeSet<(IpAddress, bool)>, NetworkValidationError>
+where
+    F: Fn(&T) -> (IpAddress, bool),
+{
+    let expected_items: BTreeSet<_> = expected.iter().copied().collect();
+    let actual_items: BTreeSet<_> = actual.iter().map(project).collect();
+    let actual_addresses: BTreeSet<_> = actual_items.iter().map(|(address, _)| *address).collect();
+    if expected_items.len() != expected.len()
+        || actual_items.len() != actual.len()
+        || expected_items.len() != actual_items.len()
+        || expected_items.len() != actual_addresses.len()
+        || actual_addresses != expected_items
+    {
+        return reachability_error();
+    }
+    Ok(actual_items)
+}
+
+fn effective_action(policy: &DerivedNetworkPolicy, address: IpAddress) -> Option<PolicyAction> {
+    let family = address_family(address);
+    let disposition = policy
+        .address_families
+        .iter()
+        .find(|item| item.family == family)?;
+    if disposition.disposition != AddressFamilyDispositionValue::Enabled {
+        return None;
+    }
+    policy
+        .prefix_rules
+        .iter()
+        .filter(|rule| rule.family == family && network_contains(rule.network, address))
+        .max_by_key(|rule| rule.network.prefix_length)
+        .map(|rule| rule.action)
+        .or_else(|| {
+            policy
+                .default_actions
+                .iter()
+                .find(|item| item.family == family)
+                .map(|item| item.action)
+        })
+}
+
+fn network_contains(network: IpNetwork, address: IpAddress) -> bool {
+    let prefix_length = network.prefix_length;
+    let (network, address) = match (network.address, address) {
+        (IpAddress::V4(network), IpAddress::V4(address)) => (network.to_vec(), address.to_vec()),
+        (IpAddress::V6(network), IpAddress::V6(address)) => (network.to_vec(), address.to_vec()),
+        _ => return false,
+    };
+    let complete = usize::from(prefix_length / 8);
+    let remainder = prefix_length % 8;
+    if network[..complete] != address[..complete] {
+        return false;
+    }
+    remainder == 0
+        || network[complete] & (u8::MAX << (8 - remainder))
+            == address[complete] & (u8::MAX << (8 - remainder))
+}
+
+const fn address_family(address: IpAddress) -> AddressFamily {
+    match address {
+        IpAddress::V4(_) => AddressFamily::Ipv4,
+        IpAddress::V6(_) => AddressFamily::Ipv6,
+    }
+}
+
+fn domain_digest(schema_id: &str, canonical_bytes: &[u8]) -> [u8; 32] {
+    let mut hasher = Sha256::new();
+    hasher.update(schema_id.as_bytes());
+    hasher.update([0]);
+    hasher.update(canonical_bytes);
+    hasher.finalize().into()
+}
+
+fn reachability_error<T>() -> Result<T, NetworkValidationError> {
+    Err(NetworkValidationError::new(
+        NetworkValidationErrorKind::Reachability,
+        "network reachability evidence mismatch",
+    ))
+}

crates/lazaret-core/src/records/network.rs

@@ -3,56 +3,56 @@ use super::{
     NamespaceIdentity, NetworkSidecarId, PidfsProcessIdentityV1, ReadinessFingerprint, Serialize,
 };
 
-#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)]
 pub enum AddressFamily {
     Ipv4,
     Ipv6,
 }
 
-#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)]
 pub enum AddressFamilyDispositionValue {
     Enabled,
     Disabled,
 }
 
-#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)]
 pub struct AddressFamilyDisposition {
     pub family: AddressFamily,
     pub disposition: AddressFamilyDispositionValue,
 }
 
-#[derive(Clone, Copy, Debug, Deserialize, Eq, Hash, PartialEq, Serialize)]
+#[derive(Clone, Copy, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
 pub enum IpAddress {
     V4([u8; 4]),
     V6([u8; 16]),
 }
 
-#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)]
 pub struct IpNetwork {
     pub address: IpAddress,
     pub prefix_length: u8,
 }
 
-#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)]
 pub enum PolicyAction {
     Allow,
     Deny,
 }
 
-#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)]
 pub struct DefaultAction {
     pub family: AddressFamily,
     pub action: PolicyAction,
 }
 
-#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)]
 pub struct PrefixRule {
     pub family: AddressFamily,
     pub network: IpNetwork,
     pub action: PolicyAction,
 }
 
-#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)]
 pub struct Resolver {
     pub family: AddressFamily,
     pub address: IpAddress,