Function judge_nft 

pub fn judge_nft(ruleset: &str, plan: &FirewallPlan) -> FirewallObservation

Judge nft list ruleset output against the plan: a rule is admitted when a line accepts its dport (to its group, when it has one; from each source, when it has any).

use std::net::Ipv4Addr;
use majordomus_cli::mesh::firewall::{judge_nft, plan, FirewallObservationState};
use majordomus_cli::mesh::MeshConfig;

let config: MeshConfig = serde_json::from_value(serde_json::json!({
    "schema": "mesh/v1", "kind": "mesh-declaration", "id": "doc", "enabled": true,
})).unwrap();
let p = plan(Some(&config), &[Ipv4Addr::new(10, 0, 0, 5)], None);
assert_eq!(judge_nft("table inet filter {\n chain input {\n  ip daddr 239.255.77.77 udp dport 7741 accept\n }\n}\n", &p).state, FirewallObservationState::Present);
assert_eq!(judge_nft("table inet filter {\n}\n", &p).state, FirewallObservationState::Missing);
assert_eq!(judge_nft("", &p).state, FirewallObservationState::Inactive);
assert_eq!(judge_nft("Operation not permitted", &p).state, FirewallObservationState::Unobservable);