@push.rocks/smartnftables 1.4.0 → 1.6.0

package/rust/src/docker.policy.rs

@@ -0,0 +1,140 @@
+use crate::{egress, managed, owner, policy, Error, Result};
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct Policy {
+    pub schema_version: u8,
+    pub revision: u64,
+    pub barrier: owner::Applied,
+}
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct Prepared {
+    pub policy: Policy,
+    pub backend: String,
+    pub digest: String,
+}
+pub fn validate_backend(value: &str) -> Result<()> {
+    let patch=value.strip_prefix("v1.8.").and_then(|v|v.strip_suffix(" (nf_tables)")).ok_or(Error::UnsupportedBackend)?;
+    let number=patch.parse::<u16>().map_err(|_|Error::UnsupportedBackend)?;
+    if number < 10 || number.to_string()!=patch {return Err(Error::UnsupportedBackend);}
+    Ok(())
+}
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct Options {
+    pub owner_id: String,
+    pub instance_id: String,
+}
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct Identity {
+    pub owner_id: String,
+    pub instance_id: String,
+    pub boot_id: String,
+    pub namespace_device: String,
+    pub namespace_inode: String,
+}
+impl Options {
+    pub fn validate(&self) -> Result<()> {
+        if !policy::identifier(&self.owner_id) || !policy::identifier(&self.instance_id) || self.instance_id.len() < 16 {
+            return Err(Error::Invalid);
+        }
+        Ok(())
+    }
+    pub fn identity(&self) -> Result<Identity> {
+        self.validate()?;
+        let (boot_id, namespace_device, namespace_inode) = owner::context()?;
+        Ok(Identity { owner_id:self.owner_id.clone(), instance_id:self.instance_id.clone(), boot_id, namespace_device, namespace_inode })
+    }
+}
+impl Policy {
+    pub fn scope(&self) -> Result<&egress::HostScope> {
+        match &self.barrier.prepared.policy {
+            managed::Policy::Egress(egress::Policy { scope:egress::Scope::HostTransit(scope), .. }) => Ok(scope),
+            _ => Err(Error::Invalid),
+        }
+    }
+    pub fn prepare(self, backend: String) -> Result<Prepared> {
+        validate_backend(&backend)?;
+        if self.schema_version != 1 || self.revision == 0 || self.revision > 9_007_199_254_740_991 {
+            return Err(Error::Invalid);
+        }
+        self.barrier.prepared.validate()?;
+        self.scope()?;
+        let receipt = &self.barrier.receipt;
+        let handle = receipt.table_handle.parse::<u64>().map_err(|_| Error::Invalid)?;
+        if handle == 0 || handle.to_string() != receipt.table_handle
+            || receipt.revision != self.barrier.prepared.policy.revision()
+            || receipt.digest != self.barrier.prepared.digest
+            || !policy::identifier(&receipt.identity.owner_id)
+            || !policy::identifier(&receipt.identity.instance_id)
+            || receipt.identity.instance_id.len() < 16
+            || !policy::identifier(&receipt.identity.table_name)
+            || !receipt.identity.table_name.starts_with("snft_") {
+            return Err(Error::Invalid);
+        }
+        let mut hash = Sha256::new();
+        hash.update(b"smartnftables/docker-forwarding-v1\0");
+        hash.update(backend.as_bytes());
+        hash.update([0]);
+        hash.update(serde_json::to_vec(&self).map_err(|_| Error::Invalid)?);
+        let prepared = Prepared { policy:self, backend, digest:format!("sha256:{:x}",hash.finalize()) };
+        // Bound the fully expanded restore transaction before any subprocess.
+        prepared.rules(&Options { owner_id:"x".repeat(64), instance_id:"x".repeat(64) })?;
+        Ok(prepared)
+    }
+}
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Rule {
+    pub comment: String,
+    pub args: Vec<String>,
+}
+fn port_range(first: u16, last: u16) -> String {
+    if first == last { first.to_string() } else { format!("{first}:{last}") }
+}
+impl Prepared {
+    pub fn validate(&self) -> Result<()> {
+        if self.policy.clone().prepare(self.backend.clone())? != *self { return Err(Error::Invalid); }
+        Ok(())
+    }
+    pub fn rules(&self, options: &Options) -> Result<Vec<Rule>> {
+        options.validate()?;
+        let scope = self.policy.scope()?;
+        let mut result = Vec::new();
+        let mut bytes = 0;
+        for handoff in &scope.handoffs {
+            for allocation in &handoff.allocations {
+                for range in &allocation.source_port_ranges {
+                    for state in ["NEW", "ESTABLISHED", "REPLY"] {
+                        let reply = state == "REPLY";
+                        let mut args: Vec<String> = vec![
+                            "-i".into(), if reply { scope.uplink.interface_name.clone() } else { handoff.link.interface_name.clone() },
+                            "-o".into(), if reply { handoff.link.interface_name.clone() } else { scope.uplink.interface_name.clone() },
+                            if reply { "-d" } else { "-s" }.into(), format!("{}/32", allocation.transit_source_address),
+                            "-p".into(),range.protocol.clone(),"-m".into(),range.protocol.clone(),
+                            if reply { "--dport" } else { "--sport" }.into(),port_range(range.first,range.last),
+                        ];
+                        if state == "NEW" && range.protocol == "tcp" {
+                            args.extend(["--tcp-flags","FIN,SYN,RST,ACK","SYN"].map(String::from));
+                        }
+                        args.extend(["-m","conntrack","--ctstate",if reply {"ESTABLISHED"} else {state},"--ctproto",if range.protocol == "tcp" {"6"} else {"17"},"--ctorigsrc"].map(String::from));
+                        // Canonical xtables host form: explicit /32 has different unused
+                        // conntrack mask bytes and does not survive a save/restore round trip.
+                        args.push(allocation.transit_source_address.clone());
+                        args.push("--ctorigsrcport".into());args.push(port_range(range.first,range.last));
+                        args.extend(["--ctdir",if reply {"REPLY"} else {"ORIGINAL"},"-m","comment","--comment"].map(String::from));
+                        let comment = format!("snftd1:{}:{}:{}:{}",options.owner_id,options.instance_id,self.digest.strip_prefix("sha256:").ok_or(Error::Invalid)?,result.len());
+                        args.push(comment.clone());args.extend(["-j","ACCEPT"].map(String::from));
+                        bytes += args.iter().map(|arg|arg.len()+1).sum::<usize>()+32;
+                        if result.len() >= 192 || bytes > 100_000 { return Err(Error::Invalid); }
+                        result.push(Rule {comment,args});
+                    }
+                }
+            }
+        }
+        Ok(result)
+    }
+}

package/rust/src/docker.rs

@@ -0,0 +1,191 @@
+use crate::{decode, encode, owner, wire, Error, Request, Result};
+use serde::{Deserialize, Serialize};
+#[path = "docker.policy.rs"]
+mod policy;
+#[path = "docker.frontend.rs"]
+mod frontend;
+#[path = "docker.graph.rs"]
+mod graph;
+use policy::{Identity, Options, Prepared};
+#[cfg(test)]
+#[path="docker_tests.rs"]
+mod tests;
+
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(rename_all="camelCase",deny_unknown_fields)]
+pub struct Receipt {
+    pub identity: Identity,
+    pub backend: String,
+    pub revision: u64,
+    pub digest: String,
+}
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(rename_all="camelCase",deny_unknown_fields)]
+pub struct Applied { pub receipt: Receipt, pub prepared: Prepared }
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(rename_all="camelCase",deny_unknown_fields)]
+pub struct Transition {
+    #[serde(deserialize_with="crate::policy::required_nullable")]
+    pub previous: Option<Applied>,
+    pub target: Prepared,
+}
+#[derive(Clone, Debug, Serialize)]
+#[serde(rename_all="camelCase")]
+pub struct Status {
+    pub identity: Identity,
+    pub state: String,
+    pub present: bool,
+    pub applied: Option<Applied>,
+    pub pending: Option<Transition>,
+    pub error: Option<String>,
+}
+pub struct Owner {
+    options: Options,
+    identity: Identity,
+    applied: Option<Applied>,
+    pending: Option<Transition>,
+    error: Option<Error>,
+    released: bool,
+}
+impl Owner {
+    fn new(options: Options) -> Result<Self> {
+        let identity=options.identity()?;
+        Ok(Self {options,identity,applied:None,pending:None,error:None,released:false})
+    }
+    fn context(&self) -> Result<()> {
+        if self.options.identity()? != self.identity {return Err(Error::Conflict);}
+        Ok(())
+    }
+    fn validate_target(&self, target: &Prepared) -> Result<()> {
+        target.validate()?;
+        self.context()?;
+        let identity=&target.policy.barrier.receipt.identity;
+        if identity.boot_id!=self.identity.boot_id || identity.namespace_device!=self.identity.namespace_device
+            || identity.namespace_inode!=self.identity.namespace_inode {return Err(Error::Conflict);}
+        Ok(())
+    }
+    fn validate_receipt(&self, expected: &Applied) -> Result<()> {
+        self.validate_target(&expected.prepared)?;
+        if expected.receipt.identity!=self.identity || expected.receipt.digest!=expected.prepared.digest
+            || expected.receipt.revision!=expected.prepared.policy.revision
+            || expected.receipt.backend!=expected.prepared.backend {return Err(Error::Conflict);}
+        Ok(())
+    }
+    fn fence(target: &Prepared) -> Result<()> {
+        let scope=target.policy.scope()?;
+        wire::verify_bound_interfaces_down(scope.handoffs.iter().map(|handoff| {
+            let link=&handoff.link;
+            wire::BoundInterface {index:link.interface_index,name:&link.interface_name,kind:&link.interface_kind,
+                mac:link.mac_address.as_deref(),link_index:link.interface_link_index,addresses:&link.required_ipv4_addresses}
+        }))
+    }
+    fn applied(&self, prepared: Prepared, backend: String) -> Applied {
+        Applied {receipt:Receipt {identity:self.identity.clone(),backend,revision:prepared.policy.revision,digest:prepared.digest.clone()},prepared}
+    }
+    fn reconcile(&mut self, transition: Transition, deadline: std::time::Instant) -> Result<Applied> {
+        self.validate_target(&transition.target)?;
+        if let Some(previous)=&transition.previous {
+            self.validate_receipt(previous)?;
+            if previous.prepared.policy.revision>=transition.target.policy.revision {return Err(Error::Conflict);}
+        }
+        if self.released || self.pending.as_ref().is_some_and(|v|v!=&transition)
+            || self.applied.as_ref().is_some_and(|v|Some(v)!=transition.previous.as_ref() && v.prepared!=transition.target) {return Err(Error::Conflict);}
+        self.pending=Some(transition.clone());
+        let result=(|| {
+            let target_rules=transition.target.rules(&self.options)?;
+            let previous_rules=transition.previous.as_ref().map(|v|v.prepared.rules(&self.options)).transpose()?.unwrap_or_default();
+            let snapshot=frontend::Snapshot::read(deadline)?;
+            if snapshot.backend!=transition.target.backend {return Err(Error::Conflict);}
+            if transition.previous.as_ref().is_some_and(|v|v.receipt.backend!=snapshot.backend) {return Err(Error::Conflict);}
+            owner::Owner::verify_external(&transition.target.policy.barrier)?;
+            if snapshot.verified_matches(&self.options,&target_rules,deadline)? {
+                return Ok(self.applied(transition.target.clone(),snapshot.backend));
+            }
+            if !snapshot.verified_matches(&self.options,&previous_rules,deadline)? {return Err(Error::Conflict);}
+            if let Some(previous)=&transition.previous {Self::fence(&previous.prepared)?;}
+            Self::fence(&transition.target)?;
+            frontend::replace(&previous_rules,&target_rules,deadline)?;
+            self.context()?;
+            let current=frontend::Snapshot::read(deadline)?;
+            if current.backend!=snapshot.backend || !current.verified_matches(&self.options,&target_rules,deadline)? {return Err(Error::Conflict);}
+            owner::Owner::verify_external(&transition.target.policy.barrier)?;
+            if let Some(previous)=&transition.previous {Self::fence(&previous.prepared)?;}
+            Self::fence(&transition.target)?;
+            Ok(self.applied(transition.target.clone(),current.backend))
+        })();
+        match result {
+            Ok(applied)=>{self.applied=Some(applied.clone());self.pending=None;self.error=None;Ok(applied)},
+            Err(error)=>{self.error=Some(error);Err(error)},
+        }
+    }
+    fn inspect(&mut self, deadline: std::time::Instant) -> Status {
+        let mut present=false;
+        if let Some(applied)=self.applied.clone().filter(|_|!self.released) {
+            let result=(|| {
+                self.validate_receipt(&applied)?;
+                let current=frontend::Snapshot::read(deadline)?;
+                if current.backend!=applied.receipt.backend || !current.verified_matches(&self.options,&applied.prepared.rules(&self.options)?,deadline)? {return Err(Error::Conflict);}
+                owner::Owner::verify_external(&applied.prepared.policy.barrier)
+            })();
+            match result {Ok(())=>present=self.pending.is_none()&&self.error.is_none(),Err(error)=>self.error=Some(error)}
+        }
+        Status {identity:self.identity.clone(),state:if self.released {"released"} else if self.pending.is_some()||self.error.is_some() {"failed-owned"} else if present {"applied"} else {"idle"}.into(),
+            present,applied:self.applied.clone(),pending:self.pending.clone(),error:self.error.map(|v|v.code().into())}
+    }
+    fn release(&mut self, expected: Applied, deadline: std::time::Instant) -> Result<()> {
+        self.validate_receipt(&expected)?;
+        if self.pending.is_some() || self.applied.as_ref().is_some_and(|v|v!=&expected) {return Err(Error::Conflict);}
+        let result=(|| {
+            let current=frontend::Snapshot::read(deadline)?;
+            if current.backend!=expected.receipt.backend {return Err(Error::Conflict);}
+            if current.verified_matches(&self.options,&[],deadline)? {return Ok(());}
+            let rules=expected.prepared.rules(&self.options)?;
+            if !current.verified_matches(&self.options,&rules,deadline)? {return Err(Error::Conflict);}
+            Self::fence(&expected.prepared)?;
+            frontend::replace(&rules,&[],deadline)?;
+            self.context()?;
+            let after=frontend::Snapshot::read(deadline)?;
+            if after.backend!=current.backend || !after.verified_matches(&self.options,&[],deadline)? {return Err(Error::Conflict);}
+            Self::fence(&expected.prepared)
+        })();
+        match result {Ok(())=>{self.applied=Some(expected);self.error=None;self.released=true;Ok(())},Err(error)=>{self.error=Some(error);Err(error)}}
+    }
+    fn close(&mut self, deadline: std::time::Instant) -> Result<()> {
+        if let Some(pending)=self.pending.clone() {
+            self.context()?;
+            let current=frontend::Snapshot::read(deadline)?;
+            if current.backend!=pending.target.backend {return Err(Error::Conflict);}
+            let known=if current.verified_matches(&self.options,&pending.target.rules(&self.options)?,deadline)? {
+                Some(self.applied(pending.target,current.backend.clone()))
+            } else if let Some(previous)=pending.previous {
+                if current.backend!=previous.receipt.backend || !current.verified_matches(&self.options,&previous.prepared.rules(&self.options)?,deadline)? {return Err(Error::Conflict);}
+                Some(previous)
+            } else if current.verified_matches(&self.options,&[],deadline)? {None} else {return Err(Error::Conflict);};
+            self.applied=known;self.pending=None;
+        }
+        if let Some(applied)=self.applied.clone() {self.release(applied,deadline)?;} else {
+            self.context()?;
+            if !frontend::Snapshot::read(deadline)?.verified_matches(&self.options,&[],deadline)? {return Err(Error::Conflict);}
+            self.released=true;self.error=None;
+        }
+        Ok(())
+    }
+}
+pub fn dispatch(owner: &mut Option<Owner>, request: Request) -> Result<serde_json::Value> {
+    let deadline=frontend::deadline();
+    match request.method.as_str() {
+        "prepareDockerForwarding"=>encode(decode::<policy::Policy>(request.params)?.prepare(frontend::version(deadline)?)?),
+        "openDockerForwarding"=>{if owner.is_some(){return Err(Error::Conflict);}*owner=Some(Owner::new(decode(request.params)?)?);encode(owner.as_mut().unwrap().inspect(deadline))},
+        "reconcileDockerForwarding"=>encode(owner.as_mut().ok_or(Error::Conflict)?.reconcile(decode(request.params)?,deadline)?),
+        "inspectDockerForwarding"|"closeDockerForwarding"=>{
+            if decode::<serde_json::Value>(request.params)?!=serde_json::json!({}){return Err(Error::Invalid);}
+            let owner=owner.as_mut().ok_or(Error::Conflict)?;
+            if request.method=="inspectDockerForwarding" {encode(owner.inspect(deadline))} else {
+                if let Err(error)=owner.close(deadline) {owner.error=Some(error);return Err(error);}
+                Ok(serde_json::json!({"released":true}))
+            }
+        },
+        "releaseDockerForwarding"=>{owner.as_mut().ok_or(Error::Conflict)?.release(decode(request.params)?,deadline)?;Ok(serde_json::json!({"released":true}))},
+        _=>Err(Error::Invalid),
+    }
+}

package/rust/src/docker_process_tests.rs

@@ -0,0 +1,29 @@
+use super::*;
+
+#[test]
+fn frontend_subprocess_drains_large_input_and_output_with_a_clean_environment() {
+    let input="bounded-input\n".repeat(12_000);
+    assert_eq!(command("/usr/bin/cat",&[],input.as_bytes(),deadline()).unwrap(),input);
+    let environment=command("/usr/bin/env",&[],&[],deadline()).unwrap();
+    let values:BTreeSet<_>=environment.lines().collect();
+    assert_eq!(values,BTreeSet::from(["PATH=/usr/sbin:/usr/bin:/sbin:/bin","LC_ALL=C"]));
+}
+fn child_failure(kind: &str, source: &str, expected: Error) {
+    let directory=std::env::temp_dir().join(format!("smartnftables-command-{}-{kind}",std::process::id()));
+    std::fs::create_dir(&directory).unwrap();
+    let pidfile=directory.join("pid");
+    let source=format!("import os,pathlib,time;pathlib.Path({:?}).write_text(str(os.getpid()));{source}",pidfile.to_str().unwrap());
+    assert_eq!(command("/usr/bin/python3",&["-c",&source],&[],deadline()),Err(expected));
+    let pid=std::fs::read_to_string(&pidfile).unwrap().parse::<i32>().unwrap();
+    assert_eq!(unsafe{libc::kill(pid,0)},-1);
+    assert_eq!(std::io::Error::last_os_error().raw_os_error(),Some(libc::ESRCH));
+    std::fs::remove_file(pidfile).unwrap();std::fs::remove_dir(directory).unwrap();
+}
+#[test]
+fn frontend_subprocess_output_overflow_stops_and_joins_the_exact_child() {
+    child_failure("output","os.write(1,b'x'*2097153);time.sleep(60)",Error::Protocol);
+}
+#[test]
+fn frontend_subprocess_timeout_stops_and_joins_the_exact_child() {
+    child_failure("timeout","time.sleep(60)",Error::Unavailable);
+}

package/rust/src/docker_tests.rs

@@ -0,0 +1,148 @@
+use super::*;
+use serde_json::json;
+
+fn options() -> Options {Options {owner_id:"dockerfixture".into(),instance_id:"qualification_20260913".into()}}
+fn policy() -> policy::Policy {
+    let prepared:crate::managed::Prepared=serde_json::from_value::<crate::egress::Policy>(crate::egress::tests::host()).unwrap().prepare().unwrap().into();
+    policy::Policy {schema_version:1,revision:1,barrier:owner::Applied {
+        receipt:owner::Receipt {identity:owner::Identity {owner_id:"barrier".into(),instance_id:"qualification_20260913".into(),table_name:"snft_fixture".into(),boot_id:"00000000-0000-4000-8000-000000000000".into(),namespace_device:"4".into(),namespace_inode:"1".into()},table_handle:"1".into(),revision:1,digest:prepared.digest.clone()},prepared}}
+}
+fn text(rules: &[policy::Rule]) -> String {
+    let mut text="*filter\n:INPUT ACCEPT [0:0]\n:FORWARD DROP [0:0]\n:OUTPUT ACCEPT [0:0]\n:DOCKER-USER - [0:0]\n:DOCKER-FORWARD - [0:0]\n-A FORWARD -j DOCKER-USER\n-A FORWARD -j DOCKER-FORWARD\n".to_owned();
+    for rule in rules {text.push_str(&format!("-A DOCKER-USER {}\n",rule.args.join(" ")));}
+    text.push_str("-A DOCKER-USER -m comment --comment \"foreign unrelated rule\" -j RETURN\nCOMMIT\n");text
+}
+fn snapshot(text: &str) -> frontend::Snapshot {frontend::Snapshot::parse("v1.8.11 (nf_tables)".into(),text).unwrap()}
+
+#[test]
+fn docker_compiler_derives_only_scoped_directed_ranges_from_host_barrier() {
+    let prepared=policy().prepare("v1.8.11 (nf_tables)".into()).unwrap();let rules=prepared.rules(&options()).unwrap();
+    assert_eq!(rules.len(),6);
+    assert!(rules.iter().all(|r|r.args.contains(&"--ctorigsrcport".into()) && r.args.contains(&"--ctdir".into()) && !r.args.iter().any(|s|s.contains("RELATED"))));
+    let new_tcp=&rules[0].args;
+    assert!(new_tcp.windows(3).any(|w|w==["--tcp-flags","FIN,SYN,RST,ACK","SYN"]));
+    assert!(rules.iter().all(|r|r.comment.len()<256));
+    assert!(rules.iter().all(|r|r.args.windows(2).any(|w|w[0]=="--ctorigsrc" && !w[1].contains('/'))));
+    assert!(snapshot(&text(&rules)).matches(&options(),&rules).unwrap());
+}
+#[test]
+fn docker_prepare_rejects_router_receipts_bad_hashes_and_unbounded_restore() {
+    let mut value=policy();value.schema_version=2;assert!(value.prepare("v1.8.11 (nf_tables)".into()).is_err());
+    let mut value=policy();value.barrier.receipt.digest="sha256:wrong".into();assert!(value.prepare("v1.8.11 (nf_tables)".into()).is_err());
+    let mut value=policy();value.barrier.prepared.policy=crate::managed::Policy::Egress(serde_json::from_value(crate::egress::tests::router()).unwrap());assert!(value.prepare("v1.8.11 (nf_tables)".into()).is_err());
+    let value=serde_json::to_value(policy()).unwrap();
+    let mut extra=value.clone();extra["rules"]=json!([]);assert!(serde_json::from_value::<policy::Policy>(extra).is_err());
+    let mut extra=value;extra["barrier"]["receipt"]["tableHandle"]=json!("01");assert!(serde_json::from_value::<policy::Policy>(extra).unwrap().prepare("v1.8.11 (nf_tables)".into()).is_err());
+}
+#[test]
+fn docker_policy_digest_binds_barrier_handle_and_revision() {
+    let expected=policy().prepare("v1.8.11 (nf_tables)".into()).unwrap();
+    assert_ne!(policy().prepare("v1.8.10 (nf_tables)".into()).unwrap().digest,expected.digest);
+    for backend in ["v1.8. (nf_tables)","v1.8.9 (nf_tables)","v1.8.11 (legacy)","v1.8.011 (nf_tables)"] {
+        assert!(policy().prepare(backend.into()).is_err());
+    }
+    let mut value=policy();value.barrier.receipt.table_handle="2".into();assert_ne!(value.prepare("v1.8.11 (nf_tables)".into()).unwrap().digest,expected.digest);
+    let mut value=policy();value.revision=2;assert_ne!(value.prepare("v1.8.11 (nf_tables)".into()).unwrap().digest,expected.digest);
+    let mut forged=expected;forged.policy.revision=2;assert!(forged.validate().is_err());
+}
+#[test]
+fn docker_snapshot_accepts_only_equivalent_frontend_rendering() {
+    let rules=policy().prepare("v1.8.11 (nf_tables)".into()).unwrap().rules(&options()).unwrap();
+    let original=text(&rules);
+    let rendered=original.replace("--ctorigsrc 10.240.0.2/32","--ctorigsrc 10.240.0.2");
+    assert!(snapshot(&rendered).matches(&options(),&rules).unwrap());
+    for (before,after) in [("--ctdir ORIGINAL","--ctdir REPLY"),("--ctstate NEW","--ctstate RELATED"),("--sport 10000:10999","--sport 1:65535"),("-o ens18","-o foreign"),("-j ACCEPT","-j RETURN"),("FIN,SYN,RST,ACK SYN","FIN,SYN,RST,ACK ACK")] {
+        assert!(!snapshot(&original.replacen(before,after,1)).matches(&options(),&rules).unwrap());
+    }
+    assert!(snapshot(&original.replacen("-j ACCEPT","-m mark --mark 1 -j ACCEPT",1)).matches(&options(),&rules).is_err());
+}
+#[test]
+fn docker_snapshot_rejects_duplicates_moved_owner_and_foreign_instance() {
+    let rules=policy().prepare("v1.8.11 (nf_tables)".into()).unwrap().rules(&options()).unwrap();
+    let original=text(&rules);
+    let duplicate=original.replace("COMMIT",&format!("-A DOCKER-USER {}\nCOMMIT",rules[0].args.join(" ")));
+    assert!(!snapshot(&duplicate).matches(&options(),&rules).unwrap());
+    let moved=original.replacen("-A DOCKER-USER", "-A INPUT",1);
+    assert!(!snapshot(&moved).matches(&options(),&rules).unwrap());
+    assert!(!snapshot(&original.replace("qualification_20260913","foreign_instance_2026")).matches(&options(),&rules).unwrap());
+    assert_eq!(snapshot(&original.replace("snftd1:dockerfixture:","snftd1:anotherowner:")).matches(&options(),&[]),Err(Error::ForeignOwner));
+    let prepended=original.replacen("-A DOCKER-USER","-A DOCKER-USER -j RETURN\n-A DOCKER-USER",1);
+    assert!(!snapshot(&prepended).matches(&options(),&rules).unwrap());
+    assert!(!snapshot(&original).matches(&options(),&[]).unwrap());
+}
+#[test]
+fn docker_snapshot_rejects_wrong_backend_path_policy_chain_order_and_table_framing() {
+    let original=text(&[]);
+    for changed in [original.replace(":FORWARD DROP",":FORWARD ACCEPT"),original.replace("-A FORWARD -j DOCKER-USER","-A FORWARD -j ACCEPT"),original.replace("*filter","*nat"),original.replace("COMMIT","COMMIT\n*filter"),original.replace(":DOCKER-USER - [0:0]\n","")] {
+        assert!(frontend::Snapshot::parse("v1.8.11 (nf_tables)".into(),&changed).is_err());
+    }
+}
+
+#[test]
+fn docker_raw_graph_rejects_early_verdicts_reordered_matches_and_hidden_bytes() {
+    let rule=policy().prepare("v1.8.11 (nf_tables)".into()).unwrap().rules(&options()).unwrap().remove(0);
+    let expressions=graph::expected(&rule).unwrap();
+    let row=|expressions|vec![crate::wire::Attr::string(1,"filter"),crate::wire::Attr::string(2,"DOCKER-USER"),
+        crate::wire::Attr::u64(3,42),crate::wire::Attr::nested(4,expressions)];
+    assert!(graph::matches_rule(&row(expressions.clone()),&rule).unwrap());
+    let mut early=expressions.clone();let verdict=early.pop().unwrap();early.insert(0,verdict);
+    assert!(!graph::matches_rule(&row(early),&rule).unwrap());
+    let mut reordered=expressions.clone();reordered.swap(0,1);
+    assert!(!graph::matches_rule(&row(reordered),&rule).unwrap());
+    let mut moved_counter=expressions.clone();let length=moved_counter.len();moved_counter.swap(length-1,length-2);
+    assert!(!graph::matches_rule(&row(moved_counter),&rule).unwrap());
+    let mut hidden=expressions.clone();
+    for expression in &mut hidden {
+        let mut fields=crate::wire::attrs(&expression.value).unwrap();
+        if crate::wire::text(&fields,1).unwrap()!="match" {continue;}
+        let mut data=crate::wire::attrs(&crate::wire::one(&fields,2).unwrap().value).unwrap();
+        if crate::wire::text(&data,1).unwrap()!="conntrack" {continue;}
+        data.iter_mut().find(|a|a.id()==3).unwrap().value[20..32].fill(0);
+        *fields.iter_mut().find(|a|a.id()==2).unwrap()=crate::wire::Attr::nested(2,data);
+        expression.value=crate::wire::encode_attrs(&fields);
+    }
+    assert!(!graph::matches_rule(&row(hidden),&rule).unwrap());
+}
+
+#[test]
+fn docker_raw_graph_accepts_kernel_field_order_flags_and_changing_counters_only() {
+    let rule=policy().prepare("v1.8.11 (nf_tables)".into()).unwrap().rules(&options()).unwrap().remove(0);
+    let mut expressions=graph::expected(&rule).unwrap();
+    for expression in &mut expressions {
+        let mut fields=crate::wire::attrs(&expression.value).unwrap();
+        if crate::wire::text(&fields,1).unwrap()=="counter" {
+            *fields.iter_mut().find(|a|a.id()==2).unwrap()=crate::wire::Attr::nested(2,
+                vec![crate::wire::Attr::u64(2,123),crate::wire::Attr::u64(1,456)]);
+        }
+        fields.reverse();expression.value=crate::wire::encode_attrs(&fields);
+    }
+    fn kernel(attributes: &mut [crate::wire::Attr]) {
+        for attribute in attributes {
+            if attribute.kind&0x8000!=0 {
+                let mut children=crate::wire::attrs(&attribute.value).unwrap();kernel(&mut children);
+                attribute.value=crate::wire::encode_attrs(&children);
+            }
+            attribute.kind &= 0x3fff;
+        }
+    }
+    kernel(&mut expressions);
+    let row=vec![crate::wire::Attr::string(1,"filter"),crate::wire::Attr::string(2,"DOCKER-USER"),
+        crate::wire::Attr::u64(3,42),crate::wire::Attr::nested(4,expressions)];
+    assert!(graph::matches_rule(&row,&rule).unwrap());
+}
+
+#[test]
+fn docker_forward_jumps_require_exact_unconditional_order() {
+    use crate::{policy::{expr,verdict},wire::Attr};
+    let row=|expressions|vec![Attr::string(1,"filter"),Attr::string(2,"FORWARD"),
+        Attr::u64(3,42),Attr::nested(4,expressions)];
+    for target in ["DOCKER-USER","DOCKER-FORWARD"] {
+        let expected=vec![expr("counter",vec![Attr::u64(1,7),Attr::u64(2,11)]),verdict(-3,Some(target))];
+        assert!(graph::matches_forward(&row(expected.clone()),target).unwrap());
+        let mut early=expected.clone();early.insert(0,verdict(1,None));
+        assert!(!graph::matches_forward(&row(early),target).unwrap());
+        let mut reordered=expected.clone();reordered.reverse();
+        assert!(!graph::matches_forward(&row(reordered),target).unwrap());
+        assert!(!graph::matches_forward(&row(expected),if target=="DOCKER-USER" {"DOCKER-FORWARD"} else {"DOCKER-USER"}).unwrap());
+    }
+}