How to Evaluate Mock NACL Rules in Python

import base64
import json
import hmac
import hashlib

def evaluate_mock_rule(rule_number, request_data, secret):
    """
    Simulates evaluating an NACL-like numbered rule by:
    1. Checking if the rule number exists in the mock policy.
    2. Computing an HMAC over the request payload for integrity.
    """
    # Mock NACL policy: rule number -> (action, source, destination)
    mock_policy = {
        100: ("ALLOW", "10.0.0.0/8", "any"),
        200: ("DENY", "192.168.1.0/24", "any"),
        300: ("ALLOW", "any", "0.0.0.0/0")
    }

    if rule_number not in mock_policy:
        return {"rule": rule_number, "status": "NOT_FOUND", "matched": False}

    action, source, destination = mock_policy[rule_number]
    # Encode payload and compute HMAC signature
    payload = json.dumps(request_data, sort_keys=True).encode()
    signature = hmac.new(secret.encode(), payload, hashlib.sha256).hexdigest()
    # Mock evaluation: always allow based on rule, but log the signature
    matches = action == "ALLOW" and destination != "0.0.0.0/0"
    return {
        "rule": rule_number,
        "action": action,
        "source": source,
        "destination": destination,
        "matches": matches,
        "signature": signature[:16]  # truncated for brevity
    }

if __name__ == "__main__":
    result = evaluate_mock_rule(100, {"host": "10.1.2.3", "port": 443}, "my-secret-key")
    print(json.dumps(result, indent=2))