Function plan 

pub fn plan(
    config: Option<&MeshConfig>,
    local: &[Ipv4Addr],
    server_port: Option<u16>,
) -> FirewallPlan

Derive the admissions from the declaration (or its absence), this machine’s addresses and, when its server listens beyond loopback, the server’s port.

No declaration, or a disabled one, needs nothing: the plan is empty and that is the answer. Otherwise: the multicast group’s port when multicast is on; the broadcast port when broadcast is a permitted fallback, from the networks it names; every declared hub port whose address is this machine’s; and the server’s port, from the fleet’s networks, when one is given — a server on loopback is dialed by nobody and needs no rule.

use std::net::Ipv4Addr;
use majordomus_cli::mesh::firewall::{plan, Role};
use majordomus_cli::mesh::MeshConfig;

let config: MeshConfig = serde_json::from_value(serde_json::json!({
    "schema": "mesh/v1", "kind": "mesh-declaration", "id": "doc", "enabled": true,
    "cooperation": { "seeds": ["http://10.9.8.7:8741"] },
})).unwrap();
// no hub here, a server beyond loopback on 8741: the group's port and the link port
let p = plan(Some(&config), &[Ipv4Addr::new(10, 9, 8, 1)], Some(8741));
let roles: Vec<Role> = p.rules.iter().map(|r| r.role).collect();
assert_eq!(roles, [Role::Multicast, Role::Link]);
assert_eq!(p.rules[1].sources, ["10.0.0.0/8"]);