@push.rocks/smartnftables 1.2.0 → 1.3.1

package/rust/src/owner_tests.rs

@@ -0,0 +1,795 @@
+use super::*;
+
+fn isolated() {
+    assert_eq!(
+        std::env::var("SMARTNFTABLES_ISOLATED_NATIVE").as_deref(),
+        Ok("qemu-6.18.35")
+    );
+    assert!(std::fs::read_to_string("/proc/cmdline")
+        .unwrap()
+        .contains("smartnftables_qualification=1"));
+    assert_eq!(unsafe { libc::geteuid() }, 0);
+    let initial = context().unwrap();
+    assert_eq!(
+        unsafe { libc::unshare(libc::CLONE_NEWNET | libc::CLONE_NEWNS) },
+        0
+    );
+    assert_eq!(
+        unsafe {
+            libc::mount(
+                std::ptr::null(),
+                c"/".as_ptr(),
+                std::ptr::null(),
+                libc::MS_PRIVATE | libc::MS_REC,
+                std::ptr::null(),
+            )
+        },
+        0
+    );
+    assert_ne!(initial.2, context().unwrap().2);
+    assert_eq!(
+        unsafe {
+            libc::mount(
+                c"tmpfs".as_ptr(),
+                c"/run".as_ptr(),
+                c"tmpfs".as_ptr(),
+                libc::MS_NOSUID | libc::MS_NODEV,
+                c"size=4m".as_ptr().cast(),
+            )
+        },
+        0
+    );
+}
+
+fn ip(arguments: &[&str]) {
+    let result = std::process::Command::new("/bin/ip")
+        .args(arguments)
+        .output()
+        .unwrap();
+    assert!(
+        result.status.success(),
+        "ip {arguments:?}: {}",
+        String::from_utf8_lossy(&result.stderr)
+    );
+}
+fn in_namespace<T: Send + 'static>(name: &str, work: impl FnOnce() -> T + Send + 'static) -> T {
+    let file = std::fs::File::open(format!("/run/netns/{name}")).unwrap();
+    std::thread::spawn(move || {
+        use std::os::fd::AsRawFd;
+        assert_eq!(
+            unsafe { libc::setns(file.as_raw_fd(), libc::CLONE_NEWNET) },
+            0
+        );
+        work()
+    })
+    .join()
+    .unwrap()
+}
+fn endpoint(id: &str, part: u8) -> crate::policy::Endpoint {
+    let host = format!("work{id}");
+    let peer = format!("peer{id}");
+    ip(&["netns", "add", id]);
+    ip(&["link", "add", &host, "type", "veth", "peer", "name", &peer]);
+    ip(&["link", "set", &peer, "netns", id]);
+    ip(&[
+        "address",
+        "add",
+        &format!("10.81.{part}.1/24"),
+        "dev",
+        &host,
+    ]);
+    ip(&[
+        "-6",
+        "address",
+        "add",
+        &format!("2001:db8:{part}::1/64"),
+        "dev",
+        &host,
+        "nodad",
+    ]);
+    ip(&["link", "set", &host, "up"]);
+    for args in [
+        vec!["link", "set", "lo", "up"],
+        vec!["link", "set", &peer, "up"],
+    ] {
+        let mut command = vec!["-n", id];
+        command.extend(args);
+        ip(&command);
+    }
+    ip(&[
+        "-n",
+        id,
+        "address",
+        "add",
+        &format!("10.81.{part}.2/24"),
+        "dev",
+        &peer,
+    ]);
+    ip(&[
+        "-n",
+        id,
+        "route",
+        "add",
+        "default",
+        "via",
+        &format!("10.81.{part}.1"),
+    ]);
+    ip(&[
+        "-n",
+        id,
+        "-6",
+        "address",
+        "add",
+        &format!("2001:db8:{part}::2/64"),
+        "dev",
+        &peer,
+        "nodad",
+    ]);
+    ip(&[
+        "-n",
+        id,
+        "-6",
+        "route",
+        "add",
+        "default",
+        "via",
+        &format!("2001:db8:{part}::1"),
+    ]);
+    // Fixed peer neighbors isolate packet policy from multicast discovery timing.
+    let mac = |args: &[&str]| -> String {
+        let data = std::process::Command::new("/bin/ip")
+            .args(args)
+            .output()
+            .unwrap();
+        assert!(data.status.success());
+        serde_json::from_slice::<serde_json::Value>(&data.stdout).unwrap()[0]["address"]
+            .as_str()
+            .unwrap()
+            .into()
+    };
+    let host_mac = mac(&["-j", "link", "show", "dev", &host]);
+    let peer_mac = mac(&["-n", id, "-j", "link", "show", "dev", &peer]);
+    ip(&[
+        "-6",
+        "neigh",
+        "replace",
+        &format!("2001:db8:{part}::2"),
+        "lladdr",
+        &peer_mac,
+        "nud",
+        "permanent",
+        "dev",
+        &host,
+    ]);
+    ip(&[
+        "-n",
+        id,
+        "-6",
+        "neigh",
+        "replace",
+        &format!("2001:db8:{part}::1"),
+        "lladdr",
+        &host_mac,
+        "nud",
+        "permanent",
+        "dev",
+        &peer,
+    ]);
+    let cname = std::ffi::CString::new(host.clone()).unwrap();
+    crate::policy::Endpoint {
+        id: id.into(),
+        interface_name: host,
+        interface_kind: "veth".into(),
+        interface_index: unsafe { libc::if_nametoindex(cname.as_ptr()) },
+        source_prefixes: vec![format!("10.81.{part}.2/32")],
+    }
+}
+fn udp(source: &std::net::UdpSocket, target: &std::net::UdpSocket, expected: bool) {
+    target
+        .set_read_timeout(Some(std::time::Duration::from_millis(if expected {
+            1500
+        } else {
+            200
+        })))
+        .unwrap();
+    source
+        .send_to(b"exact-grant", target.local_addr().unwrap())
+        .unwrap();
+    let received = target.recv(&mut [0; 64]);
+    assert_eq!(
+        received.is_ok(),
+        expected,
+        "UDP {:?} -> {:?}: {received:?}",
+        source.local_addr(),
+        target.local_addr()
+    );
+}
+
+#[test]
+#[ignore = "requires the explicitly isolated QEMU qualification guest"]
+fn native_interface_ipv4_directed_grants_and_spoof_denial() {
+    isolated();
+    ip(&["link", "set", "lo", "up"]);
+    std::fs::write("/proc/sys/net/ipv4/ip_forward", "1").unwrap();
+    std::fs::write("/proc/sys/net/ipv6/conf/all/forwarding", "1").unwrap();
+    std::fs::write("/proc/sys/net/ipv6/conf/default/forwarding", "1").unwrap();
+    let a = endpoint("a", 1);
+    let b = endpoint("b", 2);
+    let c = endpoint("c", 3);
+    let _unmanaged = endpoint("d", 4);
+    let client = in_namespace("a", || {
+        std::net::UdpSocket::bind("10.81.1.2:23456").unwrap()
+    });
+    let server = in_namespace("b", || std::net::UdpSocket::bind("10.81.2.2:53").unwrap());
+    let forbidden = in_namespace("c", || std::net::UdpSocket::bind("10.81.3.2:53").unwrap());
+    let v6client = in_namespace("a", || {
+        std::net::UdpSocket::bind("[2001:db8:1::2]:23456").unwrap()
+    });
+    let v6server = in_namespace("b", || {
+        std::net::UdpSocket::bind("[2001:db8:2::2]:53").unwrap()
+    });
+    let tcp = in_namespace("b", || std::net::TcpListener::bind("10.81.2.2:53").unwrap());
+    let host = std::net::UdpSocket::bind("10.81.1.1:53").unwrap();
+    let unmanaged = in_namespace("d", || {
+        std::net::UdpSocket::bind("10.81.4.2:34567").unwrap()
+    });
+    udp(&client, &server, true);
+    udp(&client, &forbidden, true);
+    udp(&v6client, &v6server, true);
+    let mut rules = Vec::new();
+    for protocol in ["udp", "tcp"] {
+        for remote in [Some("b"), None] {
+            let destination = if remote.is_some() {
+                "10.81.2.2/32"
+            } else {
+                "10.81.1.1/32"
+            };
+            rules.push(crate::policy::Rule {
+                source_endpoint: Some("a".into()),
+                destination_endpoint: remote.map(Into::into),
+                source_prefix: "10.81.1.2/32".into(),
+                destination_prefix: destination.into(),
+                protocol: protocol.into(),
+                source_port: None,
+                destination_port: Some(53),
+            });
+            rules.push(crate::policy::Rule {
+                source_endpoint: remote.map(Into::into),
+                destination_endpoint: Some("a".into()),
+                source_prefix: destination.into(),
+                destination_prefix: "10.81.1.2/32".into(),
+                protocol: protocol.into(),
+                source_port: Some(53),
+                destination_port: None,
+            });
+        }
+    }
+    let policy = crate::policy::Policy {
+        schema_version: 1,
+        revision: 1,
+        endpoints: vec![a, b, c],
+        rules,
+    };
+    let mut owner = Owner::new(options("packets")).unwrap();
+    let mut invalid_pair = policy.clone();
+    invalid_pair.endpoints[0].interface_index = 1;
+    assert_eq!(
+        owner.reconcile(Transition {
+            previous: None,
+            target: invalid_pair.prepare().unwrap()
+        }),
+        Err(Error::Conflict)
+    );
+    assert!(owner.graph().unwrap().is_none());
+    ip(&["link", "add", "brtest", "type", "bridge"]);
+    ip(&["link", "set", "workc", "master", "brtest"]);
+    assert_eq!(
+        owner.reconcile(Transition {
+            previous: None,
+            target: policy.clone().prepare().unwrap()
+        }),
+        Err(Error::Conflict)
+    );
+    assert!(owner.graph().unwrap().is_none());
+    ip(&["link", "set", "workc", "nomaster"]);
+    let current = owner
+        .reconcile(Transition {
+            previous: None,
+            target: policy.clone().prepare().unwrap(),
+        })
+        .expect("apply interface policy");
+    assert!(owner.inspect().enforced);
+    udp(&client, &server, true);
+    udp(&server, &client, true);
+    udp(&client, &host, true);
+    udp(&host, &client, true);
+    udp(&client, &forbidden, false);
+    udp(&v6client, &v6server, false);
+    // Input unrelated to managed workload interfaces retains its original behavior.
+    udp(&unmanaged, &host, true);
+    let stream = in_namespace("a", || {
+        std::net::TcpStream::connect_timeout(
+            &"10.81.2.2:53".parse().unwrap(),
+            std::time::Duration::from_millis(500),
+        )
+    });
+    assert!(stream.is_ok());
+    let _accepted = tcp.accept().unwrap();
+    drop(stream);
+    ip(&["-n", "a", "address", "add", "10.81.99.2/32", "dev", "peera"]);
+    let spoof = in_namespace("a", || {
+        std::net::UdpSocket::bind("10.81.99.2:34567").unwrap()
+    });
+    udp(&spoof, &server, false);
+    // Renaming a bound interface cannot inherit the allow branch: the retained
+    // index still reaches denial, while allows require both exact selectors.
+    ip(&["link", "set", "worka", "name", "renameda"]);
+    udp(&client, &server, false);
+    ip(&["link", "set", "renameda", "name", "worka"]);
+    udp(&client, &server, true);
+    let mut denied = policy;
+    denied.revision = 2;
+    denied.rules.clear();
+    let revoked = owner
+        .reconcile(Transition {
+            previous: Some(current),
+            target: denied.prepare().unwrap(),
+        })
+        .expect("atomic complete deny");
+    udp(&client, &server, false);
+    udp(&client, &host, false);
+    udp(&unmanaged, &host, true);
+    // Caller closes its workload links before releasing persistent enforcement.
+    for name in ["worka", "workb", "workc"] {
+        ip(&["link", "set", name, "down"]);
+    }
+    owner.release(revoked).unwrap();
+}
+fn options(name: &str) -> Options {
+    Options {
+        owner_id: "fixture".into(),
+        instance_id: "qualification_20260909".into(),
+        table_name: format!("snft_{name}"),
+    }
+}
+fn empty(revision: u64) -> Prepared {
+    crate::policy::Policy {
+        schema_version: 1,
+        revision,
+        endpoints: vec![],
+        rules: vec![],
+    }
+    .prepare()
+    .unwrap()
+}
+
+#[test]
+#[ignore = "requires the explicitly isolated QEMU qualification guest"]
+fn native_owner_atomic_recovery_and_foreign_rejection() {
+    isolated();
+    let mut first = Owner::new(options("owner")).unwrap();
+    let intent = Transition {
+        previous: None,
+        target: empty(1),
+    };
+    let applied = first
+        .reconcile(intent.clone())
+        .expect("create owned persistent table");
+    assert!(first.inspect().enforced);
+    assert_eq!(first.reconcile(intent.clone()).unwrap(), applied);
+    let mut contender = Owner::new(options("owner")).unwrap();
+    assert_eq!(
+        contender.reconcile(intent.clone()),
+        Err(Error::ForeignOwner)
+    );
+    assert!(first.inspect().enforced);
+    drop(contender);
+    // Socket loss must retain the graph while clearing only exclusive ownership.
+    drop(first);
+    let mut recovered = Owner::new(options("owner")).unwrap();
+    assert_eq!(recovered.reconcile(intent).unwrap(), applied);
+    let next = recovered
+        .reconcile(Transition {
+            previous: Some(applied),
+            target: empty(2),
+        })
+        .unwrap();
+    assert!(recovered.inspect().enforced);
+    recovered.release(next.clone()).unwrap();
+    recovered.release(next).unwrap();
+    assert_eq!(recovered.inspect().state, "released");
+    assert!(recovered.inspect().error.is_none());
+    assert!(recovered.socket.is_none());
+    recovered.close().unwrap();
+}
+
+#[test]
+#[ignore = "requires the explicitly isolated QEMU qualification guest"]
+fn native_batch_rollback_generation_fence_and_lost_ack_recovery() {
+    isolated();
+    let mut owner = Owner::new(options("transactions")).unwrap();
+    let intent = Transition {
+        previous: None,
+        target: empty(1),
+    };
+    // The real batch commits, but its return is not recorded by the owner/caller.
+    owner.pending = Some(intent.clone());
+    let committed = owner.reconcile_inner(&intent).unwrap();
+    owner.error = Some(Error::Unavailable);
+    assert_eq!(owner.inspect().state, "failed-owned");
+    assert!(owner.close().is_err());
+    assert_eq!(
+        owner.reconcile(Transition {
+            previous: None,
+            target: empty(2)
+        }),
+        Err(Error::Conflict)
+    );
+    let exact = owner.reconcile(intent).unwrap();
+    assert_eq!(exact, committed);
+    let before = owner.graph().unwrap().unwrap();
+    let mut other = Socket::open().unwrap();
+    let gen = other.generation().unwrap();
+    other
+        .batch(
+            gen,
+            vec![(0, 0x600, vec![Attr::string(1, "other"), Attr::u32(2, 6)])],
+        )
+        .unwrap();
+    assert_eq!(
+        owner.socket().unwrap().batch(
+            before.generation,
+            vec![(
+                3,
+                0x600,
+                vec![
+                    Attr::string(1, "snft_transactions"),
+                    Attr::string(3, "stale")
+                ]
+            )]
+        ),
+        Err(Error::Conflict)
+    );
+    // A failing last operation rolls back the earlier chain creation as well.
+    let gen = owner.socket().unwrap().generation().unwrap();
+    assert!(owner
+        .socket()
+        .unwrap()
+        .batch(
+            gen,
+            vec![
+                (
+                    3,
+                    0x600,
+                    vec![
+                        Attr::string(1, "snft_transactions"),
+                        Attr::string(3, "staged")
+                    ]
+                ),
+                (
+                    6,
+                    0xc00,
+                    vec![
+                        Attr::string(1, "snft_transactions"),
+                        Attr::string(2, "missing")
+                    ]
+                ),
+            ]
+        )
+        .is_err());
+    let after = owner.graph().unwrap().unwrap();
+    assert!(owner.matches(&after, &committed.prepared).unwrap());
+    assert_eq!(
+        wire::handle(&before.table, 4),
+        wire::handle(&after.table, 4)
+    );
+    let gen = other.generation().unwrap();
+    assert_eq!(
+        other.batch(
+            gen,
+            vec![(2, 0, vec![Attr::string(1, "snft_transactions")])]
+        ),
+        Err(Error::Permission)
+    );
+    // Commit exact deletion, lose the ACK, then fully restart the native owner.
+    let gen = owner.socket().unwrap().generation().unwrap();
+    owner
+        .socket()
+        .unwrap()
+        .batch(
+            gen,
+            vec![(
+                2,
+                0,
+                vec![Attr::u64(4, wire::handle(&after.table, 4).unwrap())],
+            )],
+        )
+        .unwrap();
+    drop(owner);
+    let mut restarted = Owner::new(options("transactions")).unwrap();
+    restarted.release(committed.clone()).unwrap();
+    restarted.release(committed).unwrap();
+    assert_eq!(restarted.inspect().state, "released");
+}
+
+#[test]
+#[ignore = "requires the explicitly isolated QEMU qualification guest"]
+fn native_postclaim_rejects_changed_graph_even_with_matching_generation() {
+    isolated();
+    let intent = Transition {
+        previous: None,
+        target: empty(1),
+    };
+    let mut owner = Owner::new(options("postclaim")).unwrap();
+    owner.reconcile(intent.clone()).unwrap();
+    drop(owner);
+    let mut recovery = Owner::new(options("postclaim")).unwrap();
+    let mut stale = recovery.graph().unwrap().unwrap();
+    let mut foreign = Socket::open().unwrap();
+    let gen = foreign.generation().unwrap();
+    foreign
+        .batch(
+            gen,
+            vec![
+                (
+                    0,
+                    0,
+                    vec![Attr::string(1, "snft_postclaim"), Attr::u32(2, 6)],
+                ),
+                (
+                    3,
+                    0x600,
+                    vec![
+                        Attr::string(1, "snft_postclaim"),
+                        Attr::string(3, "foreign"),
+                    ],
+                ),
+            ],
+        )
+        .unwrap();
+    drop(foreign);
+    // Model the same 32-bit generation value recurring after counter wrap.
+    // The stale graph now passes GENID; only postclaim graph proof can reject it.
+    stale.generation = recovery.socket().unwrap().generation().unwrap();
+    assert!(matches!(
+        recovery.adopt(stale, &intent),
+        Err(Error::Conflict)
+    ));
+    let unchanged = recovery.graph().unwrap().unwrap();
+    assert_eq!(wire::number(&unchanged.table, 2).unwrap(), 4);
+    assert!(unchanged
+        .chains
+        .iter()
+        .any(|chain| wire::text(chain, 3).unwrap() == "foreign"));
+    assert_eq!(recovery.reconcile(intent), Err(Error::Conflict));
+    assert!(recovery.close().is_err());
+}
+
+#[test]
+#[ignore = "requires the explicitly isolated QEMU qualification guest"]
+fn native_foreign_table_binding_is_never_removed() {
+    isolated();
+    let mut foreign = Socket::open().unwrap();
+    let gen = foreign.generation().unwrap();
+    foreign
+        .batch(
+            gen,
+            vec![(
+                0,
+                0x600,
+                vec![
+                    Attr::string(1, "snft_foreign"),
+                    Attr::u32(2, 6),
+                    Attr::bytes(6, b"foreign-binding".to_vec()),
+                ],
+            )],
+        )
+        .unwrap();
+    let mut owner = Owner::new(options("foreign")).unwrap();
+    assert_eq!(
+        owner.reconcile(Transition {
+            previous: None,
+            target: empty(1)
+        }),
+        Err(Error::Conflict)
+    );
+    assert!(owner.close().is_err());
+    let graph = owner.graph().unwrap().unwrap();
+    assert_eq!(
+        wire::one(&graph.table, 6).unwrap().value,
+        b"foreign-binding"
+    );
+    assert_eq!(wire::number(&graph.table, 7).unwrap(), foreign.port);
+}
+
+#[test]
+#[ignore = "requires the explicitly isolated QEMU qualification guest"]
+fn native_tun_forwarding_binds_remote_ingress_and_rejects_tap() {
+    use std::io::Write;
+    use std::os::fd::AsRawFd;
+    isolated();
+    ip(&["link", "set", "lo", "up"]);
+    std::fs::write("/proc/sys/net/ipv4/ip_forward", "1").unwrap();
+    let workload = endpoint("a", 1);
+    let _unmanaged = endpoint("d", 4);
+    ip(&["tuntap", "add", "dev", "relaya", "mode", "tun"]);
+    ip(&["address", "add", "10.90.0.1/24", "dev", "relaya"]);
+    ip(&["link", "set", "relaya", "up"]);
+    let tunnel = crate::policy::Endpoint {
+        id: "relay".into(),
+        interface_name: "relaya".into(),
+        interface_index: unsafe { libc::if_nametoindex(c"relaya".as_ptr()) },
+        interface_kind: "tun".into(),
+        source_prefixes: vec!["10.90.0.2/32".into()],
+    };
+    let receiver = in_namespace("a", || std::net::UdpSocket::bind("10.81.1.2:53").unwrap());
+    receiver
+        .set_read_timeout(Some(std::time::Duration::from_millis(500)))
+        .unwrap();
+    let mut device = std::fs::OpenOptions::new()
+        .read(true)
+        .write(true)
+        .open("/dev/net/tun")
+        .unwrap();
+    let mut request: libc::ifreq = unsafe { std::mem::zeroed() };
+    for (slot, byte) in request.ifr_name.iter_mut().zip(b"relaya") {
+        *slot = *byte as libc::c_char;
+    }
+    request.ifr_ifru.ifru_flags = (libc::IFF_TUN | libc::IFF_NO_PI) as libc::c_short;
+    assert_eq!(
+        unsafe { libc::ioctl(device.as_raw_fd(), libc::TUNSETIFF, &request) },
+        0
+    );
+    let mut bytes = vec![0_u8; 32];
+    bytes[0] = 0x45;
+    bytes[2..4].copy_from_slice(&32_u16.to_be_bytes());
+    bytes[8] = 64;
+    bytes[9] = 17;
+    bytes[12..16].copy_from_slice(&[10, 90, 0, 2]);
+    bytes[16..20].copy_from_slice(&[10, 81, 1, 2]);
+    let sum: u32 = bytes[..20]
+        .chunks_exact(2)
+        .map(|v| u16::from_be_bytes(v.try_into().unwrap()) as u32)
+        .sum();
+    let sum = (sum & 0xffff) + (sum >> 16);
+    bytes[10..12].copy_from_slice(&(!(sum as u16)).to_be_bytes());
+    bytes[20..22].copy_from_slice(&23456_u16.to_be_bytes());
+    bytes[22..24].copy_from_slice(&53_u16.to_be_bytes());
+    bytes[24..26].copy_from_slice(&12_u16.to_be_bytes());
+    bytes[28..].copy_from_slice(b"test");
+    let send_tunnel = |device: &mut std::fs::File, expected| {
+        device.write_all(&bytes).unwrap();
+        assert_eq!(receiver.recv(&mut [0; 64]).is_ok(), expected);
+    };
+    send_tunnel(&mut device, true);
+    let policy = crate::policy::Policy {
+        schema_version: 1,
+        revision: 1,
+        endpoints: vec![workload, tunnel],
+        rules: vec![
+            crate::policy::Rule {
+                source_endpoint: Some("relay".into()),
+                destination_endpoint: Some("a".into()),
+                source_prefix: "10.90.0.2/32".into(),
+                destination_prefix: "10.81.1.2/32".into(),
+                protocol: "udp".into(),
+                source_port: None,
+                destination_port: Some(53),
+            },
+            // This host-side rule must never authorize forwarded traffic from workd.
+            crate::policy::Rule {
+                source_endpoint: None,
+                destination_endpoint: Some("a".into()),
+                source_prefix: "10.90.0.3/32".into(),
+                destination_prefix: "10.81.1.2/32".into(),
+                protocol: "udp".into(),
+                source_port: None,
+                destination_port: Some(53),
+            },
+        ],
+    };
+    let mut owner = Owner::new(options("tun")).unwrap();
+    ip(&["tuntap", "add", "dev", "badlayer2", "mode", "tap"]);
+    let mut invalid = policy.clone();
+    invalid.endpoints[1].interface_name = "badlayer2".into();
+    invalid.endpoints[1].interface_index = unsafe { libc::if_nametoindex(c"badlayer2".as_ptr()) };
+    assert_eq!(
+        owner.reconcile(Transition {
+            previous: None,
+            target: invalid.prepare().unwrap()
+        }),
+        Err(Error::Conflict)
+    );
+    let applied = owner
+        .reconcile(Transition {
+            previous: None,
+            target: policy.prepare().unwrap(),
+        })
+        .unwrap();
+    send_tunnel(&mut device, true);
+    for source in ["10.90.0.2", "10.90.0.3"] {
+        ip(&[
+            "-n",
+            "d",
+            "address",
+            "add",
+            &format!("{source}/32"),
+            "dev",
+            "peerd",
+        ]);
+        let address = format!("{source}:34567");
+        let forged = in_namespace("d", move || std::net::UdpSocket::bind(address).unwrap());
+        udp(&forged, &receiver, false);
+    }
+    ip(&["link", "set", "worka", "down"]);
+    ip(&["link", "set", "relaya", "down"]);
+    owner.release(applied).unwrap();
+}
+
+#[test]
+#[ignore = "requires the explicitly isolated QEMU qualification guest"]
+fn native_unprivileged_process_never_claims_enforcement_and_joins() {
+    use std::io::{BufRead, Write};
+    use std::os::unix::process::CommandExt;
+    isolated();
+    struct Child(std::process::Child);
+    impl Drop for Child {
+        fn drop(&mut self) {
+            let _ = self.0.kill();
+            let _ = self.0.wait();
+        }
+    }
+    let mut child = Child(
+        std::process::Command::new("/bin/managed")
+            .arg("--management")
+            .uid(65534)
+            .gid(65534)
+            .stdin(std::process::Stdio::piped())
+            .stdout(std::process::Stdio::piped())
+            .stderr(std::process::Stdio::null())
+            .spawn()
+            .unwrap(),
+    );
+    let mut output = std::io::BufReader::new(child.0.stdout.take().unwrap());
+    let mut line = String::new();
+    output.read_line(&mut line).unwrap();
+    assert_eq!(
+        serde_json::from_str::<serde_json::Value>(&line).unwrap()["event"],
+        "ready"
+    );
+    let mut command = |method: &str, params: serde_json::Value| {
+        let request = serde_json::json!({"id":"fixture", "method":method, "params":params});
+        let input = child.0.stdin.as_mut().unwrap();
+        writeln!(input, "{request}").unwrap();
+        input.flush().unwrap();
+        line.clear();
+        output.read_line(&mut line).unwrap();
+        serde_json::from_str::<serde_json::Value>(&line).unwrap()
+    };
+    let opened = command(
+        "openOwner",
+        serde_json::to_value(options("unprivileged")).unwrap(),
+    );
+    assert_eq!(opened["success"], true);
+    assert_eq!(opened["result"]["enforced"], false);
+    let applied = command(
+        "reconcilePolicy",
+        serde_json::to_value(Transition {
+            previous: None,
+            target: empty(1),
+        })
+        .unwrap(),
+    );
+    assert_eq!(applied["success"], false);
+    assert_eq!(applied["errorCode"], "PERMISSION");
+    let status = command("inspectPolicy", serde_json::json!({}));
+    assert_eq!(status["result"]["enforced"], false);
+    assert_eq!(status["result"]["pending"], serde_json::Value::Null);
+    assert_eq!(
+        command("closeOwner", serde_json::json!({}))["result"]["released"],
+        true
+    );
+    drop(command);
+    child.0.stdin.take();
+    assert!(child.0.wait().unwrap().success());
+}