@push.rocks/smartnftables 1.3.1 → 1.5.0

package/rust/src/egress_tests.rs

@@ -0,0 +1,332 @@
+use super::{Policy, Scope};
+use serde_json::{json, Value};
+
+fn link(index: u32, name: &str, kind: &str, address: &str) -> Value {
+    json!({"interfaceIndex":index,"interfaceName":name,"interfaceKind":kind,
+        "macAddress":if kind == "tun" { Value::Null } else { json!(format!("02:00:00:00:00:{index:02x}")) },
+        "interfaceLinkIndex":index+100,"requiredIpv4Addresses":[address]})
+}
+fn allocation() -> Value {
+    json!({"lease":{"id":"lease-a","generation":1,"digest":format!("sha256:{}","a".repeat(64))},
+        "transitSourceAddress":"10.240.0.2",
+        "sourcePortRanges":[{"protocol":"tcp","first":10000,"last":10999},{"protocol":"udp","first":10000,"last":10999}]})
+}
+fn protection() -> Value {
+    json!({"authorityDigest":format!("sha256:{}","b".repeat(64)),
+        "prefixes":["10.0.0.0/8","192.0.2.0/24","203.0.113.10/32"],
+        "platformEndpoints":[{"id":"dns","address":"192.0.2.1","protocol":"udp","port":53},
+            {"id":"relay","address":"203.0.113.10","protocol":"tcp","port":443}]})
+}
+pub(crate) fn router() -> Value {
+    let mut generation = allocation();
+    generation["conntrackZone"] = json!(1);
+    generation["conntrackLabel"] = json!("a".repeat(32));
+    generation["grants"] = json!([
+        {"sourceEndpoint":"work","sourcePrefix":"10.241.0.2/32","destination":{"kind":"public","prefix":"0.0.0.0/0"},
+            "protocol":"tcp","sourcePort":null,"destinationPort":443,"sourcePortRange":{"first":10000,"last":10999}},
+        {"sourceEndpoint":null,"sourcePrefix":"10.240.0.2/32","destination":{"kind":"platform","endpointId":"dns"},
+            "protocol":"udp","sourcePort":null,"destinationPort":53,"sourcePortRange":{"first":10000,"last":10999}},
+        {"sourceEndpoint":null,"sourcePrefix":"10.240.0.2/32","destination":{"kind":"platform","endpointId":"relay"},
+            "protocol":"tcp","sourcePort":null,"destinationPort":443,"sourcePortRange":{"first":10000,"last":10999}}
+    ]);
+    json!({"schemaVersion":2,"revision":1,"scope":{"kind":"routerEgress",
+        "endpoints":[
+            {"id":"work","interfaceIndex":2,"interfaceName":"work","interfaceKind":"veth","sourcePrefixes":["10.241.0.2/32"]},
+            {"id":"vpn","interfaceIndex":3,"interfaceName":"vpn","interfaceKind":"tun","sourcePrefixes":["10.242.0.0/24"]}],
+        "rules":[
+            {"sourceEndpoint":"work","destinationEndpoint":"vpn","sourcePrefix":"10.241.0.2/32","destinationPrefix":"10.242.0.2/32","protocol":"udp","sourcePort":null,"destinationPort":53},
+            {"sourceEndpoint":"work","destinationEndpoint":null,"sourcePrefix":"10.241.0.2/32","destinationPrefix":"10.241.0.1/32","protocol":"udp","sourcePort":null,"destinationPort":53},
+            {"sourceEndpoint":null,"destinationEndpoint":"work","sourcePrefix":"10.241.0.1/32","destinationPrefix":"10.241.0.2/32","protocol":"udp","sourcePort":53,"destinationPort":null}],
+        "links":[link(2,"work","veth","10.241.0.1"),link(3,"vpn","tun","10.242.0.1")],
+        "handoff":link(4,"handoff","veth","10.240.0.2"),"protection":protection(),"generations":[generation]}})
+}
+pub(crate) fn host() -> Value {
+    json!({"schemaVersion":2,"revision":1,"scope":{"kind":"hostTransit","protection":protection(),
+        "handoffs":[{"link":link(4,"handoff","veth","10.240.0.1"),"allocations":[allocation()]}],
+        "uplink":link(2,"ens18","ethernet","192.0.2.2"),"snatAddress":"192.0.2.2"}})
+}
+fn normalized(value: Value) -> super::Result<Policy> {
+    serde_json::from_value::<Policy>(value)
+        .map_err(|_| crate::Error::Invalid)?
+        .normalize()
+}
+fn changed(mut value: Value, path: &str, replacement: Value) -> Value {
+    *value.pointer_mut(path).unwrap() = replacement;
+    value
+}
+
+#[test]
+fn combined_router_preserves_private_tun_dns_and_explicit_local_egress() {
+    let expected = normalized(router()).unwrap();
+    let mut reordered = router();
+    for path in [
+        "/scope/endpoints",
+        "/scope/rules",
+        "/scope/links",
+        "/scope/protection/prefixes",
+        "/scope/protection/platformEndpoints",
+        "/scope/generations/0/sourcePortRanges",
+        "/scope/generations/0/grants",
+    ] {
+        reordered
+            .pointer_mut(path)
+            .unwrap()
+            .as_array_mut()
+            .unwrap()
+            .reverse();
+    }
+    assert_eq!(normalized(reordered).unwrap(), expected);
+    let denied = normalized(changed(router(), "/scope/generations", json!([]))).unwrap();
+    let Scope::RouterEgress(denied) = denied.scope else {
+        panic!()
+    };
+    assert_eq!(denied.endpoints.len(), 2);
+    assert_eq!(denied.rules.len(), 3);
+    assert!(denied.generations.is_empty());
+    assert!(normalized(host()).is_ok());
+}
+
+#[test]
+fn v2_rejects_unknown_fields_missing_nulls_and_wrong_scope_shapes() {
+    let mut unknown = router();
+    unknown["commands"] = json!([]);
+    let mut no_null = router();
+    no_null["scope"]["generations"][0]["grants"][0]
+        .as_object_mut()
+        .unwrap()
+        .remove("sourcePort");
+    let mut mixed = host();
+    mixed["scope"]["generations"] = json!([]);
+    for invalid in [
+        unknown,
+        no_null,
+        mixed,
+        changed(router(), "/schemaVersion", json!(1)),
+        changed(router(), "/revision", json!(0)),
+        changed(router(), "/revision", json!(9007199254740992_u64)),
+        changed(router(), "/scope/kind", json!("egress")),
+    ] {
+        assert!(normalized(invalid).is_err());
+    }
+    let duplicate = serde_json::to_string(&router()).unwrap().replace(
+        "\"schemaVersion\":2",
+        "\"schemaVersion\":2,\"schemaVersion\":2",
+    );
+    assert!(serde_json::from_str::<Policy>(&duplicate).is_err());
+}
+
+#[test]
+fn v2_binds_exact_local_links_addresses_and_complete_protection() {
+    for (path, replacement) in [
+        ("/scope/handoff/interfaceKind", json!("ethernet")),
+        ("/scope/handoff/interfaceIndex", json!(2)),
+        ("/scope/handoff/macAddress", json!("03:00:00:00:00:04")),
+        ("/scope/handoff/macAddress", json!("00:00:00:00:00:00")),
+        ("/scope/handoff/interfaceLinkIndex", json!(0)),
+        ("/scope/links/0/interfaceName", json!("foreign")),
+        ("/scope/links/1/macAddress", json!("02:00:00:00:00:03")),
+        (
+            "/scope/links/0/requiredIpv4Addresses",
+            json!(["10.241.0.1", "10.241.0.1"]),
+        ),
+        ("/scope/protection/prefixes", json!(["10.0.0.0/8"])),
+        (
+            "/scope/protection/prefixes",
+            json!([
+                "10.0.0.0/8",
+                "10.240.0.0/16",
+                "192.0.2.0/24",
+                "203.0.113.10/32"
+            ]),
+        ),
+        (
+            "/scope/protection/platformEndpoints/0/address",
+            json!("10.241.0.1"),
+        ),
+        (
+            "/scope/protection/platformEndpoints/0/address",
+            json!("10.241.0.2"),
+        ),
+        ("/scope/protection/authorityDigest", json!("sha256:bad")),
+    ] {
+        assert!(
+            normalized(changed(router(), path, replacement)).is_err(),
+            "{path}"
+        );
+    }
+    for (path, replacement) in [
+        ("/scope/snatAddress", json!("192.0.2.4")),
+        ("/scope/uplink/interfaceKind", json!("tun")),
+        (
+            "/scope/handoffs/0/allocations/0/transitSourceAddress",
+            json!("10.240.0.1"),
+        ),
+        (
+            "/scope/protection/platformEndpoints/0/address",
+            json!("192.0.2.2"),
+        ),
+    ] {
+        assert!(
+            normalized(changed(host(), path, replacement)).is_err(),
+            "{path}"
+        );
+    }
+}
+
+#[test]
+fn v2_rejects_unleased_ports_unbound_sources_and_ambiguous_platform_grants() {
+    for (path, replacement) in [
+        ("/scope/generations/0/lease/generation", json!(0)),
+        ("/scope/generations/0/conntrackZone", json!(0)),
+        ("/scope/generations/0/conntrackZone", json!(65536)),
+        ("/scope/generations/0/conntrackLabel", json!("0".repeat(32))),
+        (
+            "/scope/generations/0/transitSourceAddress",
+            json!("10.240.0.3"),
+        ),
+        ("/scope/generations/0/sourcePortRanges/0/first", json!(0)),
+        ("/scope/generations/0/sourcePortRanges/0/last", json!(9999)),
+        (
+            "/scope/generations/0/grants/0/sourcePortRange/last",
+            json!(11000),
+        ),
+        ("/scope/generations/0/grants/0/sourceEndpoint", json!("vpn")),
+        (
+            "/scope/generations/0/grants/0/sourcePrefix",
+            json!("10.241.0.0/24"),
+        ),
+        ("/scope/generations/0/grants/0/sourcePort", json!(0)),
+        (
+            "/scope/generations/0/grants/0/destination/prefix",
+            json!("10.242.0.0/24"),
+        ),
+        (
+            "/scope/generations/0/grants/1/sourcePrefix",
+            json!("10.240.0.0/24"),
+        ),
+        ("/scope/generations/0/grants/1/destinationPort", Value::Null),
+        ("/scope/generations/0/grants/1/protocol", json!("tcp")),
+    ] {
+        assert!(
+            normalized(changed(router(), path, replacement)).is_err(),
+            "{path}"
+        );
+    }
+}
+
+#[test]
+fn v2_classification_and_return_ranges_are_disjoint_between_active_generations() {
+    let mut value = router();
+    value["scope"]["generations"][0]["grants"]
+        .as_array_mut()
+        .unwrap()
+        .truncate(1);
+    let mut next = value["scope"]["generations"][0].clone();
+    next["lease"]["id"] = json!("lease-b");
+    next["conntrackZone"] = json!(2);
+    next["conntrackLabel"] = json!("b".repeat(32));
+    next["sourcePortRanges"] = json!([{"protocol":"tcp","first":11000,"last":11999}]);
+    next["grants"][0]["sourcePortRange"] = json!({"first":11000,"last":11999});
+    value["scope"]["generations"]
+        .as_array_mut()
+        .unwrap()
+        .push(next);
+    assert!(normalized(value.clone()).is_err());
+    value["scope"]["generations"][0]["grants"][0]["sourcePort"] = json!(1000);
+    value["scope"]["generations"][1]["grants"][0]["sourcePort"] = json!(2000);
+    assert!(normalized(value.clone()).is_ok());
+    for (path, replacement) in [
+        ("/scope/generations/1/conntrackZone", json!(1)),
+        ("/scope/generations/1/conntrackLabel", json!("a".repeat(32))),
+        ("/scope/generations/1/lease/id", json!("lease-a")),
+    ] {
+        assert!(normalized(changed(value.clone(), path, replacement)).is_err());
+    }
+    value["scope"]["generations"][1]["sourcePortRanges"][0] =
+        json!({"protocol":"tcp","first":10500,"last":11500});
+    value["scope"]["generations"][1]["grants"][0]["sourcePortRange"] =
+        json!({"first":10500,"last":11500});
+    assert!(normalized(value).is_err());
+}
+
+#[test]
+fn host_never_assigns_the_same_transit_source_to_different_active_handoff_links() {
+    let mut value = host();
+    let mut other = value["scope"]["handoffs"][0].clone();
+    other["link"] = link(5, "handoff-b", "veth", "10.240.0.5");
+    other["allocations"][0]["lease"]["id"] = json!("lease-b");
+    other["allocations"][0]["sourcePortRanges"] =
+        json!([{"protocol":"udp","first":12000,"last":12999}]);
+    value["scope"]["handoffs"]
+        .as_array_mut()
+        .unwrap()
+        .push(other);
+    assert!(normalized(value.clone()).is_err());
+    value["scope"]["handoffs"][1]["allocations"][0]["transitSourceAddress"] = json!("10.240.0.6");
+    assert!(normalized(value).is_ok());
+}
+
+#[test]
+fn prepared_v2_compiles_both_scopes_with_bounded_and_identifiable_graphs() {
+    for fixture in [router(), host()] {
+        let prepared = serde_json::from_value::<Policy>(fixture)
+            .unwrap()
+            .prepare()
+            .unwrap();
+        prepared.validate().unwrap();
+        let program = prepared.program("snft_v2_fixture").unwrap();
+        assert!(program.len() <= 768);
+        assert!(
+            program
+                .iter()
+                .map(|(_, attributes)| crate::wire::encode_attrs(attributes).len() + 20)
+                .sum::<usize>()
+                <= 100_000
+        );
+        assert!(program.iter().all(|(kind, _)| [3, 6].contains(kind)));
+        let mut changed = prepared.clone();
+        changed.policy.revision += 1;
+        assert!(changed.validate().is_err());
+        assert_ne!(changed.policy.prepare().unwrap().digest, prepared.digest);
+        println!("V2_GRAPH operations={}", program.len());
+    }
+}
+
+#[test]
+fn v2_compiled_graph_limit_rejects_bounded_but_excessive_cross_products() {
+    let mut value = router();
+    let mut grants = Vec::new();
+    for port in 1000..1032 {
+        let mut grant = value["scope"]["generations"][0]["grants"][0].clone();
+        grant["destinationPort"] = json!(port);
+        grants.push(grant);
+    }
+    value["scope"]["generations"][0]["grants"] = json!(grants);
+    let policy = normalized(value).unwrap();
+    assert!(policy.prepare().is_err());
+}
+
+#[test]
+fn managed_union_keeps_strict_duplicate_and_unknown_field_rejection() {
+    for value in [router(), host()] {
+        let text = serde_json::to_string(&value).unwrap();
+        assert!(serde_json::from_str::<crate::managed::Policy>(&text).is_ok());
+        for invalid in [
+            text.replace(
+                "\"schemaVersion\":2",
+                "\"schemaVersion\":2,\"schemaVersion\":2",
+            ),
+            text.replace("\"revision\":1", "\"revision\":1,\"revision\":2"),
+            text.replace(
+                "\"interfaceIndex\":2",
+                "\"interfaceIndex\":2,\"interfaceIndex\":2",
+            ),
+        ] {
+            assert!(serde_json::from_str::<crate::managed::Policy>(&invalid).is_err());
+        }
+    }
+    assert!(serde_json::from_str::<crate::managed::Policy>(
+        r#"{"schemaVersion":1,"schemaVersion":1,"revision":1,"endpoints":[],"rules":[]}"#
+    )
+    .is_err());
+}

package/rust/src/main.rs

@@ -1,3 +1,6 @@
+mod egress;
+mod managed;
+mod namespace;
 mod owner;
 mod policy;
 #[cfg(test)]
@@ -58,7 +61,7 @@ fn encode(value: impl serde::Serialize) -> Result<serde_json::Value> {
 }
 fn dispatch(owner: &mut Option<owner::Owner>, request: Request) -> Result<serde_json::Value> {
     match request.method.as_str() {
-        "preparePolicy" => encode(decode::<policy::Policy>(request.params)?.prepare()?),
+        "preparePolicy" => encode(decode::<managed::Policy>(request.params)?.prepare()?),
         "openOwner" => {
             if owner.is_some() {
                 return Err(Error::Conflict);
@@ -97,9 +100,26 @@ fn dispatch(owner: &mut Option<owner::Owner>, request: Request) -> Result<serde_
 }
 
 fn main() {
-    if std::env::args().skip(1).collect::<Vec<_>>() != ["--management"] {
-        std::process::exit(2);
+    let arguments = std::env::args().skip(1).collect::<Vec<_>>();
+    let descriptor = match arguments.as_slice() {
+        [management] if management == "--management" => None,
+        [management, option, fd]
+            if management == "--management" && option == "--network-namespace-fd" =>
+        {
+            match fd.parse::<i32>() {
+                Ok(value) => Some(value),
+                Err(_) => std::process::exit(2),
+            }
+        }
+        _ => std::process::exit(2),
+    };
+    if let Some(fd) = descriptor {
+        if let Err(error) = namespace::enter(fd) {
+            eprintln!("Network namespace startup failed: {error}");
+            std::process::exit(1);
+        }
     }
+    // The single native owner must enter before readiness, context capture or sockets.
     let mut output = std::io::stdout().lock();
     writeln!(output, "{{\"event\":\"ready\",\"data\":{{}}}}").unwrap();
     output.flush().unwrap();

package/rust/src/managed.rs

@@ -0,0 +1,105 @@
+use crate::{egress, policy, wire, Result};
+use serde::{Deserialize, Serialize};
+
+/// The v1 object remains byte-for-byte unchanged inside this input union.
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(untagged)]
+pub enum Policy {
+    Private(policy::Policy),
+    Egress(egress::Policy),
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct Prepared {
+    pub policy: Policy,
+    pub digest: String,
+}
+
+impl Policy {
+    pub fn revision(&self) -> u64 {
+        match self {
+            Self::Private(value) => value.revision,
+            Self::Egress(value) => value.revision,
+        }
+    }
+    pub fn kind(&self) -> &'static str {
+        match self {
+            Self::Private(_) => "privateV1",
+            Self::Egress(egress::Policy {
+                scope: egress::Scope::RouterEgress(_),
+                ..
+            }) => "routerEgressV2",
+            Self::Egress(egress::Policy {
+                scope: egress::Scope::HostTransit(_),
+                ..
+            }) => "hostTransitV2",
+        }
+    }
+    pub fn prepare(self) -> Result<Prepared> {
+        match self {
+            Self::Private(value) => Ok(value.prepare()?.into()),
+            Self::Egress(value) => Ok(value.prepare()?.into()),
+        }
+    }
+}
+impl From<policy::Prepared> for Prepared {
+    fn from(value: policy::Prepared) -> Self {
+        Self {
+            policy: Policy::Private(value.policy),
+            digest: value.digest,
+        }
+    }
+}
+impl From<egress::Prepared> for Prepared {
+    fn from(value: egress::Prepared) -> Self {
+        Self {
+            policy: Policy::Egress(value.policy),
+            digest: value.digest,
+        }
+    }
+}
+impl Prepared {
+    pub fn validate(&self) -> Result<()> {
+        match &self.policy {
+            Policy::Private(policy) => policy::Prepared {
+                policy: policy.clone(),
+                digest: self.digest.clone(),
+            }
+            .validate(),
+            Policy::Egress(policy) => egress::Prepared {
+                policy: policy.clone(),
+                digest: self.digest.clone(),
+            }
+            .validate(),
+        }
+    }
+    pub fn program(&self, table: &str) -> Result<Vec<(u16, Vec<wire::Attr>)>> {
+        match &self.policy {
+            Policy::Private(policy) => policy::Prepared {
+                policy: policy.clone(),
+                digest: self.digest.clone(),
+            }
+            .program(table),
+            Policy::Egress(policy) => egress::Prepared {
+                policy: policy.clone(),
+                digest: self.digest.clone(),
+            }
+            .program(table),
+        }
+    }
+    pub fn validate_interfaces(&self) -> Result<()> {
+        match &self.policy {
+            Policy::Private(policy) => policy::Prepared {
+                policy: policy.clone(),
+                digest: self.digest.clone(),
+            }
+            .validate_interfaces(),
+            Policy::Egress(policy) => egress::Prepared {
+                policy: policy.clone(),
+                digest: self.digest.clone(),
+            }
+            .validate_interfaces(),
+        }
+    }
+}

package/rust/src/namespace.rs

@@ -0,0 +1,51 @@
+//! Startup-only entry. No thread, runtime, socket or ready event may precede it.
+use std::io;
+
+#[cfg(target_os = "linux")]
+pub fn enter(fd: i32) -> io::Result<()> {
+    use std::os::fd::{AsRawFd, FromRawFd, OwnedFd};
+
+    // Only an explicitly inherited extra descriptor is accepted. Never consume IPC.
+    if fd < 3 {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidInput,
+            "network namespace descriptor must be at least 3",
+        ));
+    }
+    if unsafe { libc::fcntl(fd, libc::F_GETFD) } < 0 {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidInput,
+            "network namespace descriptor is not open",
+        ));
+    }
+    // Startup is single-threaded; this is the child's owned copy, not the parent's.
+    let descriptor = unsafe { OwnedFd::from_raw_fd(fd) };
+    let namespace_type = unsafe { libc::ioctl(descriptor.as_raw_fd(), libc::NS_GET_NSTYPE) };
+    if namespace_type != libc::CLONE_NEWNET {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidInput,
+            "descriptor is not a Linux network namespace",
+        ));
+    }
+    if unsafe { libc::setns(descriptor.as_raw_fd(), libc::CLONE_NEWNET) } != 0 {
+        return Err(io::Error::new(
+            io::ErrorKind::PermissionDenied,
+            format!(
+                "network namespace entry failed: {}",
+                io::Error::last_os_error()
+            ),
+        ));
+    }
+    // Close the inherited capability before creating threads. Namespace membership
+    // itself keeps the namespace alive until the complete process has exited.
+    drop(descriptor);
+    Ok(())
+}
+
+#[cfg(not(target_os = "linux"))]
+pub fn enter(_fd: i32) -> io::Result<()> {
+    Err(io::Error::new(
+        io::ErrorKind::Unsupported,
+        "network namespace entry requires Linux",
+    ))
+}

package/rust/src/owner.rs

@@ -1,4 +1,5 @@
-use crate::policy::{identifier, Prepared};
+use crate::managed::Prepared;
+use crate::policy::identifier;
 use crate::wire::{self, Attr, Socket};
 use crate::{Error, Result};
 use serde::{Deserialize, Serialize};
@@ -171,7 +172,15 @@ impl Owner {
                 Err(error) => return Err(error),
                 _ => return Err(Error::Protocol),
             };
-            let chains = socket.query(4, vec![Attr::string(1, &table_name)], true)?;
+            // Linux's NFT_MSG_GETCHAIN dump is family-wide: it ignores
+            // NFTA_CHAIN_TABLE. Select exact table identity before examining
+            // chain contents; another owner's chains are not our graph.
+            let mut chains = Vec::new();
+            for chain in socket.query(4, vec![Attr::string(1, &table_name)], true)? {
+                if wire::text(&chain, 1)? == table_name {
+                    chains.push(chain);
+                }
+            }
             let rules = socket.query(7, vec![Attr::string(1, &table_name)], true)?;
             // The managed compiler never creates any of these. Foreign objects reject.
             for operation in [10, 19, 23] {
@@ -222,7 +231,7 @@ impl Owner {
         if handle == 0
             || handle.to_string() != expected.receipt.table_handle
             || expected.receipt.identity != self.identity
-            || expected.receipt.revision != expected.prepared.policy.revision
+            || expected.receipt.revision != expected.prepared.policy.revision()
             || expected.receipt.digest != expected.prepared.digest
         {
             return Err(Error::Conflict);
@@ -316,7 +325,7 @@ impl Owner {
             receipt: Receipt {
                 identity: self.identity.clone(),
                 table_handle: wire::handle(&graph.table, 4)?.to_string(),
-                revision: prepared.policy.revision,
+                revision: prepared.policy.revision(),
                 digest: prepared.digest.clone(),
             },
             prepared,
@@ -334,7 +343,9 @@ impl Owner {
         }
         if let Some(previous) = &transition.previous {
             self.validate_receipt(previous)?;
-            if transition.target.policy.revision <= previous.prepared.policy.revision {
+            if transition.target.policy.kind() != previous.prepared.policy.kind()
+                || transition.target.policy.revision() <= previous.prepared.policy.revision()
+            {
                 return Err(Error::Conflict);
             }
         }
@@ -568,11 +579,13 @@ fn rule_identity(attributes: &[Attr]) -> Result<(String, Vec<u8>)> {
         }
         let name = wire::text(&fields, 1)?;
         let mut data = wire::attrs(&wire::one(&fields, 2)?.value)?;
+        validate_egress_expression(&name, &data)?;
         let nested: &[u16] = match name.as_str() {
             "immediate" => &[2],
             "cmp" => &[3],
             "bitwise" => &[4, 5],
-            "meta" | "payload" => &[],
+            "range" => &[3, 4],
+            "meta" | "payload" | "ct" | "nat" => &[],
             _ => return Err(Error::Conflict),
         };
         for attribute in &mut data {
@@ -599,6 +612,83 @@ fn rule_identity(attributes: &[Attr]) -> Result<(String, Vec<u8>)> {
     Ok((chain, encoded))
 }
 
+/// These expressions are compiler-owned. Preserve all operands in graph identity;
+/// neither unknown fields nor default repair may hide a changed kernel rule.
+fn validate_egress_expression(name: &str, data: &[Attr]) -> Result<()> {
+    let allowed: &[u16] = match name {
+        "ct" | "range" => &[1, 2, 3, 4],
+        "nat" => &[1, 2, 3, 4, 5, 6, 7],
+        _ => return Ok(()),
+    };
+    for attribute in data {
+        if !allowed.contains(&attribute.id()) {
+            return Err(Error::Conflict);
+        }
+        wire::one(data, attribute.id())?; // Duplicate fields are never canonical identity.
+    }
+    match name {
+        "ct" => {
+            let read = data.iter().any(|item| item.id() == 1);
+            let write = data.iter().any(|item| item.id() == 4);
+            if read == write {
+                return Err(Error::Conflict);
+            }
+            wire::number(data, if read { 1 } else { 4 })?;
+            wire::number(data, 2)?;
+            if data.iter().any(|item| item.id() == 3)
+                && ![vec![0], vec![1]].contains(&wire::one(data, 3)?.value)
+            {
+                return Err(Error::Conflict);
+            }
+        }
+        "nat" => {
+            // Emit min/max registers and derived flags explicitly, just as Linux
+            // dumps them. This surface only compiles address-bearing IPv4 NAT.
+            for id in [1, 2, 3, 4, 7] {
+                wire::number(data, id)?;
+            }
+            if wire::number(data, 1)? > 1 || wire::number(data, 2)? != 2 {
+                return Err(Error::Conflict);
+            }
+            let first_port = data.iter().any(|item| item.id() == 5);
+            let last_port = data.iter().any(|item| item.id() == 6);
+            if first_port != last_port {
+                return Err(Error::Conflict);
+            }
+            if first_port {
+                wire::number(data, 5)?;
+                wire::number(data, 6)?;
+            }
+        }
+        "range" => {
+            wire::number(data, 1)?;
+            if wire::number(data, 2)? > 1 || data.len() != 4 {
+                return Err(Error::Conflict);
+            }
+            let mut length = None;
+            for id in [3, 4] {
+                let value = wire::attrs(&wire::one(data, id)?.value)?;
+                if value.len() != 1 {
+                    return Err(Error::Conflict);
+                }
+                let bytes = &wire::one(&value, 1)?.value;
+                if !(1..=16).contains(&bytes.len())
+                    || length.is_some_and(|size| size != bytes.len())
+                {
+                    return Err(Error::Conflict);
+                }
+                length = Some(bytes.len());
+            }
+        }
+        _ => unreachable!(),
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+#[path = "owner_identity_tests.rs"]
+mod identity_tests;
+
 #[cfg(test)]
 #[path = "owner_tests.rs"]
 mod native_tests;