@push.rocks/smartnftables 1.5.0 → 1.7.0

package/rust/src/docker.frontend.rs

@@ -0,0 +1,203 @@
+use super::policy::{Options, Rule};
+use crate::{Error, Result};
+use std::collections::{BTreeMap, BTreeSet};
+use std::io::{Read, Write};
+use std::os::fd::AsRawFd;
+use std::os::unix::{fs::MetadataExt, process::CommandExt};
+use std::process::{Command, Stdio};
+use std::time::{Duration, Instant};
+
+const IPTABLES: &str = "/usr/sbin/iptables-nft";
+const SAVE: &str = "/usr/sbin/iptables-nft-save";
+const RESTORE: &str = "/usr/sbin/iptables-nft-restore";
+const MAX_OUTPUT: usize = 2_097_152;
+#[cfg(test)]
+#[path="docker_process_tests.rs"]
+mod process_tests;
+
+fn nonblocking(fd: i32) -> Result<()> {
+    let flags = unsafe { libc::fcntl(fd, libc::F_GETFL) };
+    if flags < 0 || unsafe { libc::fcntl(fd,libc::F_SETFL,flags|libc::O_NONBLOCK) } < 0 {return Err(Error::Unavailable);}
+    Ok(())
+}
+pub fn deadline() -> Instant { Instant::now()+Duration::from_secs(8) }
+fn command(path: &str, args: &[&str], input: &[u8], deadline: Instant) -> Result<String> {
+    if Instant::now()>=deadline {return Err(Error::Unavailable);}
+    let metadata=std::fs::metadata(path).map_err(|_|Error::Unavailable)?;
+    if !metadata.is_file() || metadata.uid()!=0 || metadata.mode() & 0o022 != 0 { return Err(Error::Permission); }
+    let mut child=Command::new(path).args(args).env_clear().env("PATH","/usr/sbin:/usr/bin:/sbin:/bin")
+        .env("LC_ALL","C").stdin(Stdio::piped()).stdout(Stdio::piped()).stderr(Stdio::piped()).process_group(0)
+        .spawn().map_err(|_|Error::Unavailable)?;
+    let result=(|| {
+        let mut stdin=child.stdin.take();
+        let mut stdout=child.stdout.take().ok_or(Error::Unavailable)?;
+        let mut stderr=child.stderr.take().ok_or(Error::Unavailable)?;
+        for fd in [stdin.as_ref().ok_or(Error::Unavailable)?.as_raw_fd(),stdout.as_raw_fd(),stderr.as_raw_fd()] {nonblocking(fd)?;}
+        let mut written=0;let mut output=Vec::new();let mut errors=Vec::new();
+        let mut out_eof=false;let mut err_eof=false;let mut status=None;
+        loop {
+            if Instant::now()>=deadline {return Err(Error::Unavailable);}
+            if written==input.len() {stdin=None;}
+            if let Some(pipe)=stdin.as_mut() {
+                match pipe.write(&input[written..]) {
+                    Ok(0)=>return Err(Error::Unavailable),Ok(count)=>written+=count,
+                    Err(error) if error.kind()==std::io::ErrorKind::WouldBlock=>{},
+                    Err(_)=>return Err(Error::Unavailable),
+                }
+            }
+            for (pipe,bytes,eof) in [(&mut stdout as &mut dyn Read,&mut output,&mut out_eof),(&mut stderr as &mut dyn Read,&mut errors,&mut err_eof)] {
+                let mut buffer=[0;8192];
+                loop {
+                    match pipe.read(&mut buffer) {
+                        Ok(0)=>{*eof=true;break;},
+                        Ok(count)=>{if bytes.len()+count>MAX_OUTPUT{return Err(Error::Protocol);}bytes.extend_from_slice(&buffer[..count]);},
+                        Err(error) if error.kind()==std::io::ErrorKind::WouldBlock=>break,
+                        Err(_)=>return Err(Error::Unavailable),
+                    }
+                }
+            }
+            if status.is_none() {status=child.try_wait().map_err(|_|Error::Unavailable)?;}
+            if let Some(status)=status.filter(|_|out_eof&&err_eof) {
+                if !status.success() || written!=input.len() {
+                    if path==IPTABLES && args.get(2)==Some(&"-C") && status.code()==Some(1)
+                        && errors==b"iptables: Bad rule (does a matching rule exist in that chain?).\n" {
+                        return Err(Error::Conflict);
+                    }
+                    return Err(Error::Unavailable);
+                }
+                return String::from_utf8(output).map_err(|_|Error::Protocol);
+            }
+            std::thread::sleep(Duration::from_millis(2));
+        }
+    })();
+    if result.is_err() {
+        // Stop and join this exact mutator before reporting an inconclusive ACK.
+        if child.try_wait().ok().flatten().is_none() {
+            unsafe {libc::kill(-(child.id() as i32),libc::SIGKILL);}
+        }
+    }
+    child.wait().map_err(|_|Error::Unavailable)?;
+    result
+}
+pub fn version(deadline: Instant) -> Result<String> {
+    let mut version=None;
+    for path in [IPTABLES,SAVE,RESTORE] {
+        let output=command(path,&["--version"],&[],deadline)?;
+        let parts:Vec<_>=output.split_whitespace().collect();
+        if parts.len()!=3 {return Err(Error::UnsupportedBackend);}
+        let observed=format!("{} {}",parts[1],parts[2]);
+        super::policy::validate_backend(&observed)?;
+        if version.as_ref().is_some_and(|v|v!=&observed) {return Err(Error::Conflict);}
+        version=Some(observed);
+    }
+    version.ok_or(Error::Unavailable)
+}
+
+/// Tokenize save output only; no token is ever evaluated by a shell.
+fn tokens(line: &str) -> Result<Vec<String>> {
+    if line.len()>16_384 {return Err(Error::Protocol);}
+    let mut values=Vec::new();let mut word=String::new();let mut quoted=false;let mut escaped=false;let mut active=false;
+    for byte in line.bytes() {
+        if !(32..127).contains(&byte) {return Err(Error::Protocol);}
+        if escaped {word.push(byte as char);escaped=false;active=true;continue;}
+        if byte==b'\\' {escaped=true;continue;}
+        if byte==b'"' {quoted=!quoted;active=true;continue;}
+        if byte==b' ' && !quoted {if active {values.push(std::mem::take(&mut word));active=false;}} else {word.push(byte as char);active=true;}
+    }
+    if quoted||escaped {return Err(Error::Protocol);}
+    if active {values.push(word);}
+    if values.len()>512 {return Err(Error::Protocol);}
+    Ok(values)
+}
+fn normalized(args: &[String]) -> Result<Vec<(String, Vec<String>)>> {
+    let mut values=BTreeMap::new();let mut modules=BTreeSet::new();let mut index=0;
+    while index<args.len() {
+        let key=&args[index];let count=if key=="--tcp-flags" {2} else {1};
+        if !["-i","-o","-s","-d","-p","-m","--sport","--dport","--tcp-flags","--ctstate","--ctproto","--ctorigsrc","--ctorigsrcport","--ctdir","--comment","-j"].contains(&key.as_str()) {return Err(Error::Conflict);}
+        let mut value=args.get(index+1..index+1+count).ok_or(Error::Conflict)?.to_vec();index+=1+count;
+        if key=="-m" {if !modules.insert(value[0].clone()) {return Err(Error::Conflict);}continue;}
+        if key=="--ctorigsrc" && !value[0].contains('/') {value[0].push_str("/32");}
+        if key=="--ctproto" {value[0]=match value[0].as_str() {"tcp"=>"6".into(),"udp"=>"17".into(),_=>value[0].clone()};}
+        if values.insert(key.clone(),value).is_some() {return Err(Error::Conflict);}
+    }
+    values.insert("-m".into(),modules.into_iter().collect());
+    Ok(values.into_iter().collect())
+}
+pub struct Snapshot {
+    pub backend: String,
+    pub rows: Vec<Vec<String>>,
+    pub user: Vec<Vec<String>>,
+    raw: Option<super::graph::Snapshot>,
+}
+impl Snapshot {
+    pub fn read(deadline: Instant) -> Result<Self> {
+        let backend=version(deadline)?;
+        let (raw,text)=super::graph::Snapshot::read(||command(SAVE,&["-t","filter"],&[],deadline))?;
+        let mut snapshot=Self::parse(backend,&text)?;
+        snapshot.raw=Some(raw);
+        Ok(snapshot)
+    }
+    pub fn parse(backend: String, text: &str) -> Result<Self> {
+        if text.len()>MAX_OUTPUT {return Err(Error::Protocol);}
+        let mut table=false;let mut committed=false;let mut chains=BTreeMap::new();let mut rows=Vec::new();
+        for line in text.lines().filter(|line|!line.starts_with('#')&&!line.is_empty()) {
+            if line=="*filter" {if table||committed {return Err(Error::Conflict);}table=true;continue;}
+            if line=="COMMIT" {if !table||committed {return Err(Error::Conflict);}committed=true;continue;}
+            if !table||committed {return Err(Error::Conflict);}
+            let row=tokens(line)?;
+            if line.starts_with(':') {
+                if row.len()!=3 || chains.insert(row[0][1..].to_string(),row[1].clone()).is_some() {return Err(Error::Conflict);}
+            } else {
+                if row.len()<2 || row[0]!="-A" || rows.len()>=4096 {return Err(Error::Conflict);}
+                rows.push(row);
+            }
+        }
+        if !committed || chains.get("FORWARD").map(String::as_str)!=Some("DROP")
+            || chains.get("DOCKER-USER").map(String::as_str)!=Some("-")
+            || chains.get("DOCKER-FORWARD").map(String::as_str)!=Some("-") {return Err(Error::Conflict);}
+        let forward:Vec<_>=rows.iter().filter(|r|r[1]=="FORWARD").collect();
+        for (index,target) in ["DOCKER-USER","DOCKER-FORWARD"].iter().enumerate() {
+            if forward.get(index).map(|r|r.iter().map(String::as_str).collect::<Vec<_>>())!=Some(vec!["-A","FORWARD","-j",target]) {return Err(Error::Conflict);}
+        }
+        let user=rows.iter().filter(|r|r[1]=="DOCKER-USER").cloned().collect();
+        Ok(Self {backend,rows,user,raw:None})
+    }
+    /// Text proves placement/count and logical policy; -C additionally checks
+    /// match-extension bytes hidden by save output. Deletion uses the same spec.
+    pub fn verified_matches(&self, options: &Options, expected: &[Rule], deadline: Instant) -> Result<bool> {
+        if !self.matches(options,expected)? {return Ok(false);}
+        let raw=self.raw.as_ref().ok_or(Error::Conflict)?;
+        if !raw.matches(expected)? {return Ok(false);}
+        for rule in expected {
+            let mut args=vec!["-t","filter","-C","DOCKER-USER"];
+            args.extend(rule.args.iter().map(String::as_str));
+            match command(IPTABLES,&args,&[],deadline) {
+                Ok(_)=>{},Err(Error::Conflict)=>return Ok(false),Err(error)=>return Err(error),
+            }
+        }
+        raw.unchanged()
+    }
+    pub fn matches(&self, options: &Options, expected: &[Rule]) -> Result<bool> {
+        let prefix=format!("snftd1:{}:",options.owner_id);
+        // One node-level contribution owns the leading block. Do not prepend
+        // another managed owner and silently invalidate its placement proof.
+        if self.rows.iter().any(|r|r.iter().any(|t|t.starts_with("snftd1:")&&!t.starts_with(&prefix))) {return Err(Error::ForeignOwner);}
+        let owned:Vec<_>=self.rows.iter().filter(|r|r.iter().any(|t|t.starts_with(&prefix))).collect();
+        if owned.len()!=expected.len() || self.user.len()<expected.len() {return Ok(false);}
+        for (index,rule) in expected.iter().enumerate() {
+            let row=&self.user[index];
+            if row[1]!="DOCKER-USER" || !row.iter().any(|t|t==&rule.comment)
+                || normalized(&row[2..])?!=normalized(&rule.args)? {return Ok(false);}
+        }
+        Ok(true)
+    }
+}
+pub fn replace(previous: &[Rule], target: &[Rule], deadline: Instant) -> Result<()> {
+    let mut batch="*filter\n".to_string();
+    for rule in previous {batch.push_str(&format!("-D DOCKER-USER {}\n",rule.args.join(" ")));}
+    for rule in target.iter().rev() {batch.push_str(&format!("-I DOCKER-USER 1 {}\n",rule.args.join(" ")));}
+    batch.push_str("COMMIT\n");
+    if batch.len()>210_000 {return Err(Error::Invalid);}
+    command(RESTORE,&["--noflush","--wait","5"],batch.as_bytes(),deadline)?;
+    Ok(())
+}

package/rust/src/docker.graph.rs

@@ -0,0 +1,129 @@
+//! Ordered iptables-nft graph identity. Command-state reconstruction loses order.
+use super::policy::Rule;
+use crate::{policy::{compare, expr, meta, verdict}, wire::{self, Attr, Socket}, Error, Result};
+
+fn value<'a>(rule: &'a Rule, key: &str) -> Result<&'a str> {
+    rule.args.windows(2).find(|pair|pair[0]==key).map(|pair|pair[1].as_str()).ok_or(Error::Invalid)
+}
+fn payload(base: u32, offset: u32, length: u32) -> Attr {
+    expr("payload",vec![Attr::u32(1,1),Attr::u32(2,base),Attr::u32(3,offset),Attr::u32(4,length)])
+}
+
+/// Fixed Linux UAPI / xtables 1.8.10 and 1.8.11 constructors, not a raw rule API.
+pub(super) fn expected(rule: &Rule) -> Result<Vec<Attr>> {
+    let reply=value(rule,"--ctdir")?=="REPLY";
+    let new=value(rule,"--ctstate")?=="NEW";
+    let protocol=match value(rule,"-p")? {"tcp"=>6_u16,"udp"=>17,_=>return Err(Error::Invalid)};
+    let address=value(rule,"--ctorigsrc")?.parse::<std::net::Ipv4Addr>().map_err(|_|Error::Invalid)?.octets();
+    let ports=value(rule,"--ctorigsrcport")?;
+    let (first,last)=ports.split_once(':').unwrap_or((ports,ports));
+    let first=first.parse::<u16>().map_err(|_|Error::Invalid)?;
+    let last=last.parse::<u16>().map_err(|_|Error::Invalid)?;
+    let mut result=vec![payload(1,if reply {16} else {12},4),compare(address.to_vec())];
+    for (key,argument) in [(6,"-i"),(7,"-o")] {
+        result.extend(meta(key,[value(rule,argument)?.as_bytes(),&[0]].concat()));
+    }
+    result.extend([payload(1,9,1),compare(vec![protocol as u8])]);
+    if new && protocol==6 {
+        result.extend([payload(2,13,1),expr("bitwise",vec![
+            Attr::u32(1,1),Attr::u32(2,1),Attr::u32(3,1),Attr::u32(6,0),
+            Attr::nested(4,vec![Attr::bytes(1,vec![0x17])]),Attr::nested(5,vec![Attr::bytes(1,vec![0])]),
+        ]),compare(vec![2])]);
+    }
+    result.push(payload(2,if reply {2} else {0},2));
+    result.push(if first==last {compare(first.to_be_bytes().to_vec())} else {
+        expr("range",vec![Attr::u32(1,1),Attr::u32(2,0),
+            Attr::nested(3,vec![Attr::bytes(1,first.to_be_bytes().to_vec())]),
+            Attr::nested(4,vec![Attr::bytes(1,last.to_be_bytes().to_vec())])])
+    });
+    // xt_conntrack_mtinfo3 is 164 bytes, XT_ALIGN'ed to 168 on both shipped
+    // 64-bit Linux targets. All fields and padding are initialized explicitly.
+    let mut conntrack=vec![0;168];
+    conntrack[..4].copy_from_slice(&address);
+    conntrack[16..32].fill(0xff); // canonical bare-host nf_inet_addr mask
+    for (offset,number) in [(136,protocol),(138,first),(146,0x1107),
+        (148,if reply {0x1000} else {0}),(150,if new {8} else {2}),(154,last)] {
+        conntrack[offset..offset+2].copy_from_slice(&number.to_ne_bytes());
+    }
+    result.push(expr("match",vec![Attr::string(1,"conntrack"),Attr::u32(2,3),Attr::bytes(3,conntrack)]));
+    let mut comment=vec![0;256];
+    if rule.comment.len()>=comment.len() {return Err(Error::Invalid);}
+    comment[..rule.comment.len()].copy_from_slice(rule.comment.as_bytes());
+    result.push(expr("match",vec![Attr::string(1,"comment"),Attr::u32(2,0),Attr::bytes(3,comment)]));
+    result.push(expr("counter",vec![Attr::u64(1,0),Attr::u64(2,0)]));
+    result.push(verdict(1,None));
+    Ok(result)
+}
+
+/// Kernel dumps may omit nested flags and reorder fields; list order is exact.
+fn equivalent(actual: &[Attr], expected: &[Attr], ordered: bool) -> Result<bool> {
+    if actual.len()!=expected.len() {return Ok(false);}
+    let mut actual=actual.iter().collect::<Vec<_>>();let mut expected=expected.iter().collect::<Vec<_>>();
+    if !ordered {actual.sort_by_key(|a|a.id());expected.sort_by_key(|a|a.id());}
+    for (actual,expected) in actual.into_iter().zip(expected) {
+        if actual.id()!=expected.id() {return Ok(false);}
+        if expected.kind & 0x8000 != 0 {
+            let expected=wire::attrs(&expected.value)?;
+            if !equivalent(&wire::attrs(&actual.value)?,&expected,expected.iter().all(|a|a.id()==1))? {return Ok(false);}
+        } else if actual.value!=expected.value {return Ok(false);}
+    }
+    Ok(true)
+}
+pub(super) fn matches_rule(row: &[Attr], rule: &Rule) -> Result<bool> {
+    matches_graph(row,"DOCKER-USER",&expected(rule)?)
+}
+pub(super) fn matches_forward(row: &[Attr], target: &str) -> Result<bool> {
+    if !["DOCKER-USER","DOCKER-FORWARD"].contains(&target) {return Err(Error::Invalid);}
+    matches_graph(row,"FORWARD",&[expr("counter",vec![Attr::u64(1,0),Attr::u64(2,0)]),verdict(-3,Some(target))])
+}
+fn matches_graph(row: &[Attr], chain: &str, expected: &[Attr]) -> Result<bool> {
+    if row.iter().any(|a|![1,2,3,4,6,8].contains(&a.id()))
+        || wire::text(row,1)?!="filter" || wire::text(row,2)?!=chain
+        || wire::handle(row,3)?==0 {return Ok(false);}
+    for id in [6,8] {
+        if row.iter().any(|a|a.id()==id) {
+            let attr=wire::one(row,id)?;
+            if id==6 {wire::handle(row,id)?;} else if !attr.value.is_empty() {return Ok(false);}
+        }
+    }
+    let mut expressions=wire::attrs(&wire::one(row,4)?.value)?;
+    for expression in &mut expressions {
+        let mut fields=wire::attrs(&expression.value)?;
+        if wire::text(&fields,1)?=="counter" {
+            let mut data=wire::attrs(&wire::one(&fields,2)?.value)?;
+            // Counter values change without a ruleset generation change. No
+            // expression, including the counter itself, may move or disappear.
+            data.retain(|a|!(a.id()==3 && a.value.is_empty()));
+            if data.len()!=2 {return Ok(false);}
+            for id in [1,2] {wire::handle(&data,id)?;}
+            for attribute in &mut data {attribute.value=0_u64.to_be_bytes().to_vec();}
+            let field=fields.iter_mut().find(|a|a.id()==2).ok_or(Error::Protocol)?;
+            *field=Attr::nested(2,data);
+            expression.value=wire::encode_attrs(&fields);
+        }
+    }
+    equivalent(&expressions,expected,true)
+}
+
+pub struct Snapshot { generation: u32, rows: Vec<Vec<Attr>> }
+impl Snapshot {
+    pub fn read(save: impl FnOnce()->Result<String>) -> Result<(Self,String)> {
+        let mut socket=Socket::open()?;let generation=socket.generation()?;
+        let text=save()?;
+        let rows=socket.query_ipv4(7,vec![Attr::string(1,"filter"),Attr::string(2,"DOCKER-USER")],true)?;
+        let forward=socket.query_ipv4(7,vec![Attr::string(1,"filter"),Attr::string(2,"FORWARD")],true)?;
+        if socket.generation()!=Ok(generation) {return Err(Error::Conflict);}
+        for (index,target) in ["DOCKER-USER","DOCKER-FORWARD"].iter().enumerate() {
+            if !matches_forward(forward.get(index).ok_or(Error::Conflict)?,target)? {return Err(Error::Conflict);}
+        }
+        Ok((Self {generation,rows},text))
+    }
+    pub fn matches(&self, expected: &[Rule]) -> Result<bool> {
+        if self.rows.len()<expected.len() {return Ok(false);}
+        for (row,rule) in self.rows.iter().zip(expected) {
+            if !matches_rule(row,rule)? {return Ok(false);}
+        }
+        Ok(true)
+    }
+    pub fn unchanged(&self) -> Result<bool> {Ok(Socket::open()?.generation()?==self.generation)}
+}

package/rust/src/docker.policy.rs

@@ -0,0 +1,140 @@
+use crate::{egress, managed, owner, policy, Error, Result};
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct Policy {
+    pub schema_version: u8,
+    pub revision: u64,
+    pub barrier: owner::Applied,
+}
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct Prepared {
+    pub policy: Policy,
+    pub backend: String,
+    pub digest: String,
+}
+pub fn validate_backend(value: &str) -> Result<()> {
+    let patch=value.strip_prefix("v1.8.").and_then(|v|v.strip_suffix(" (nf_tables)")).ok_or(Error::UnsupportedBackend)?;
+    let number=patch.parse::<u16>().map_err(|_|Error::UnsupportedBackend)?;
+    if number < 10 || number.to_string()!=patch {return Err(Error::UnsupportedBackend);}
+    Ok(())
+}
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct Options {
+    pub owner_id: String,
+    pub instance_id: String,
+}
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct Identity {
+    pub owner_id: String,
+    pub instance_id: String,
+    pub boot_id: String,
+    pub namespace_device: String,
+    pub namespace_inode: String,
+}
+impl Options {
+    pub fn validate(&self) -> Result<()> {
+        if !policy::identifier(&self.owner_id) || !policy::identifier(&self.instance_id) || self.instance_id.len() < 16 {
+            return Err(Error::Invalid);
+        }
+        Ok(())
+    }
+    pub fn identity(&self) -> Result<Identity> {
+        self.validate()?;
+        let (boot_id, namespace_device, namespace_inode) = owner::context()?;
+        Ok(Identity { owner_id:self.owner_id.clone(), instance_id:self.instance_id.clone(), boot_id, namespace_device, namespace_inode })
+    }
+}
+impl Policy {
+    pub fn scope(&self) -> Result<&egress::HostScope> {
+        match &self.barrier.prepared.policy {
+            managed::Policy::Egress(egress::Policy { scope:egress::Scope::HostTransit(scope), .. }) => Ok(scope),
+            _ => Err(Error::Invalid),
+        }
+    }
+    pub fn prepare(self, backend: String) -> Result<Prepared> {
+        validate_backend(&backend)?;
+        if self.schema_version != 1 || self.revision == 0 || self.revision > 9_007_199_254_740_991 {
+            return Err(Error::Invalid);
+        }
+        self.barrier.prepared.validate()?;
+        self.scope()?;
+        let receipt = &self.barrier.receipt;
+        let handle = receipt.table_handle.parse::<u64>().map_err(|_| Error::Invalid)?;
+        if handle == 0 || handle.to_string() != receipt.table_handle
+            || receipt.revision != self.barrier.prepared.policy.revision()
+            || receipt.digest != self.barrier.prepared.digest
+            || !policy::identifier(&receipt.identity.owner_id)
+            || !policy::identifier(&receipt.identity.instance_id)
+            || receipt.identity.instance_id.len() < 16
+            || !policy::identifier(&receipt.identity.table_name)
+            || !receipt.identity.table_name.starts_with("snft_") {
+            return Err(Error::Invalid);
+        }
+        let mut hash = Sha256::new();
+        hash.update(b"smartnftables/docker-forwarding-v1\0");
+        hash.update(backend.as_bytes());
+        hash.update([0]);
+        hash.update(serde_json::to_vec(&self).map_err(|_| Error::Invalid)?);
+        let prepared = Prepared { policy:self, backend, digest:format!("sha256:{:x}",hash.finalize()) };
+        // Bound the fully expanded restore transaction before any subprocess.
+        prepared.rules(&Options { owner_id:"x".repeat(64), instance_id:"x".repeat(64) })?;
+        Ok(prepared)
+    }
+}
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Rule {
+    pub comment: String,
+    pub args: Vec<String>,
+}
+fn port_range(first: u16, last: u16) -> String {
+    if first == last { first.to_string() } else { format!("{first}:{last}") }
+}
+impl Prepared {
+    pub fn validate(&self) -> Result<()> {
+        if self.policy.clone().prepare(self.backend.clone())? != *self { return Err(Error::Invalid); }
+        Ok(())
+    }
+    pub fn rules(&self, options: &Options) -> Result<Vec<Rule>> {
+        options.validate()?;
+        let scope = self.policy.scope()?;
+        let mut result = Vec::new();
+        let mut bytes = 0;
+        for handoff in &scope.handoffs {
+            for allocation in &handoff.allocations {
+                for range in &allocation.source_port_ranges {
+                    for state in ["NEW", "ESTABLISHED", "REPLY"] {
+                        let reply = state == "REPLY";
+                        let mut args: Vec<String> = vec![
+                            "-i".into(), if reply { scope.uplink.interface_name.clone() } else { handoff.link.interface_name.clone() },
+                            "-o".into(), if reply { handoff.link.interface_name.clone() } else { scope.uplink.interface_name.clone() },
+                            if reply { "-d" } else { "-s" }.into(), format!("{}/32", allocation.transit_source_address),
+                            "-p".into(),range.protocol.clone(),"-m".into(),range.protocol.clone(),
+                            if reply { "--dport" } else { "--sport" }.into(),port_range(range.first,range.last),
+                        ];
+                        if state == "NEW" && range.protocol == "tcp" {
+                            args.extend(["--tcp-flags","FIN,SYN,RST,ACK","SYN"].map(String::from));
+                        }
+                        args.extend(["-m","conntrack","--ctstate",if reply {"ESTABLISHED"} else {state},"--ctproto",if range.protocol == "tcp" {"6"} else {"17"},"--ctorigsrc"].map(String::from));
+                        // Canonical xtables host form: explicit /32 has different unused
+                        // conntrack mask bytes and does not survive a save/restore round trip.
+                        args.push(allocation.transit_source_address.clone());
+                        args.push("--ctorigsrcport".into());args.push(port_range(range.first,range.last));
+                        args.extend(["--ctdir",if reply {"REPLY"} else {"ORIGINAL"},"-m","comment","--comment"].map(String::from));
+                        let comment = format!("snftd1:{}:{}:{}:{}",options.owner_id,options.instance_id,self.digest.strip_prefix("sha256:").ok_or(Error::Invalid)?,result.len());
+                        args.push(comment.clone());args.extend(["-j","ACCEPT"].map(String::from));
+                        bytes += args.iter().map(|arg|arg.len()+1).sum::<usize>()+32;
+                        if result.len() >= 192 || bytes > 100_000 { return Err(Error::Invalid); }
+                        result.push(Rule {comment,args});
+                    }
+                }
+            }
+        }
+        Ok(result)
+    }
+}

package/rust/src/docker.rs

@@ -0,0 +1,191 @@
+use crate::{decode, encode, owner, wire, Error, Request, Result};
+use serde::{Deserialize, Serialize};
+#[path = "docker.policy.rs"]
+mod policy;
+#[path = "docker.frontend.rs"]
+mod frontend;
+#[path = "docker.graph.rs"]
+mod graph;
+use policy::{Identity, Options, Prepared};
+#[cfg(test)]
+#[path="docker_tests.rs"]
+mod tests;
+
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(rename_all="camelCase",deny_unknown_fields)]
+pub struct Receipt {
+    pub identity: Identity,
+    pub backend: String,
+    pub revision: u64,
+    pub digest: String,
+}
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(rename_all="camelCase",deny_unknown_fields)]
+pub struct Applied { pub receipt: Receipt, pub prepared: Prepared }
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(rename_all="camelCase",deny_unknown_fields)]
+pub struct Transition {
+    #[serde(deserialize_with="crate::policy::required_nullable")]
+    pub previous: Option<Applied>,
+    pub target: Prepared,
+}
+#[derive(Clone, Debug, Serialize)]
+#[serde(rename_all="camelCase")]
+pub struct Status {
+    pub identity: Identity,
+    pub state: String,
+    pub present: bool,
+    pub applied: Option<Applied>,
+    pub pending: Option<Transition>,
+    pub error: Option<String>,
+}
+pub struct Owner {
+    options: Options,
+    identity: Identity,
+    applied: Option<Applied>,
+    pending: Option<Transition>,
+    error: Option<Error>,
+    released: bool,
+}
+impl Owner {
+    fn new(options: Options) -> Result<Self> {
+        let identity=options.identity()?;
+        Ok(Self {options,identity,applied:None,pending:None,error:None,released:false})
+    }
+    fn context(&self) -> Result<()> {
+        if self.options.identity()? != self.identity {return Err(Error::Conflict);}
+        Ok(())
+    }
+    fn validate_target(&self, target: &Prepared) -> Result<()> {
+        target.validate()?;
+        self.context()?;
+        let identity=&target.policy.barrier.receipt.identity;
+        if identity.boot_id!=self.identity.boot_id || identity.namespace_device!=self.identity.namespace_device
+            || identity.namespace_inode!=self.identity.namespace_inode {return Err(Error::Conflict);}
+        Ok(())
+    }
+    fn validate_receipt(&self, expected: &Applied) -> Result<()> {
+        self.validate_target(&expected.prepared)?;
+        if expected.receipt.identity!=self.identity || expected.receipt.digest!=expected.prepared.digest
+            || expected.receipt.revision!=expected.prepared.policy.revision
+            || expected.receipt.backend!=expected.prepared.backend {return Err(Error::Conflict);}
+        Ok(())
+    }
+    fn fence(target: &Prepared) -> Result<()> {
+        let scope=target.policy.scope()?;
+        wire::verify_bound_interfaces_down(scope.handoffs.iter().map(|handoff| {
+            let link=&handoff.link;
+            wire::BoundInterface {index:link.interface_index,name:&link.interface_name,kind:&link.interface_kind,
+                mac:link.mac_address.as_deref(),link_index:link.interface_link_index,addresses:&link.required_ipv4_addresses}
+        }))
+    }
+    fn applied(&self, prepared: Prepared, backend: String) -> Applied {
+        Applied {receipt:Receipt {identity:self.identity.clone(),backend,revision:prepared.policy.revision,digest:prepared.digest.clone()},prepared}
+    }
+    fn reconcile(&mut self, transition: Transition, deadline: std::time::Instant) -> Result<Applied> {
+        self.validate_target(&transition.target)?;
+        if let Some(previous)=&transition.previous {
+            self.validate_receipt(previous)?;
+            if previous.prepared.policy.revision>=transition.target.policy.revision {return Err(Error::Conflict);}
+        }
+        if self.released || self.pending.as_ref().is_some_and(|v|v!=&transition)
+            || self.applied.as_ref().is_some_and(|v|Some(v)!=transition.previous.as_ref() && v.prepared!=transition.target) {return Err(Error::Conflict);}
+        self.pending=Some(transition.clone());
+        let result=(|| {
+            let target_rules=transition.target.rules(&self.options)?;
+            let previous_rules=transition.previous.as_ref().map(|v|v.prepared.rules(&self.options)).transpose()?.unwrap_or_default();
+            let snapshot=frontend::Snapshot::read(deadline)?;
+            if snapshot.backend!=transition.target.backend {return Err(Error::Conflict);}
+            if transition.previous.as_ref().is_some_and(|v|v.receipt.backend!=snapshot.backend) {return Err(Error::Conflict);}
+            owner::Owner::verify_external(&transition.target.policy.barrier)?;
+            if snapshot.verified_matches(&self.options,&target_rules,deadline)? {
+                return Ok(self.applied(transition.target.clone(),snapshot.backend));
+            }
+            if !snapshot.verified_matches(&self.options,&previous_rules,deadline)? {return Err(Error::Conflict);}
+            if let Some(previous)=&transition.previous {Self::fence(&previous.prepared)?;}
+            Self::fence(&transition.target)?;
+            frontend::replace(&previous_rules,&target_rules,deadline)?;
+            self.context()?;
+            let current=frontend::Snapshot::read(deadline)?;
+            if current.backend!=snapshot.backend || !current.verified_matches(&self.options,&target_rules,deadline)? {return Err(Error::Conflict);}
+            owner::Owner::verify_external(&transition.target.policy.barrier)?;
+            if let Some(previous)=&transition.previous {Self::fence(&previous.prepared)?;}
+            Self::fence(&transition.target)?;
+            Ok(self.applied(transition.target.clone(),current.backend))
+        })();
+        match result {
+            Ok(applied)=>{self.applied=Some(applied.clone());self.pending=None;self.error=None;Ok(applied)},
+            Err(error)=>{self.error=Some(error);Err(error)},
+        }
+    }
+    fn inspect(&mut self, deadline: std::time::Instant) -> Status {
+        let mut present=false;
+        if let Some(applied)=self.applied.clone().filter(|_|!self.released) {
+            let result=(|| {
+                self.validate_receipt(&applied)?;
+                let current=frontend::Snapshot::read(deadline)?;
+                if current.backend!=applied.receipt.backend || !current.verified_matches(&self.options,&applied.prepared.rules(&self.options)?,deadline)? {return Err(Error::Conflict);}
+                owner::Owner::verify_external(&applied.prepared.policy.barrier)
+            })();
+            match result {Ok(())=>present=self.pending.is_none()&&self.error.is_none(),Err(error)=>self.error=Some(error)}
+        }
+        Status {identity:self.identity.clone(),state:if self.released {"released"} else if self.pending.is_some()||self.error.is_some() {"failed-owned"} else if present {"applied"} else {"idle"}.into(),
+            present,applied:self.applied.clone(),pending:self.pending.clone(),error:self.error.map(|v|v.code().into())}
+    }
+    fn release(&mut self, expected: Applied, deadline: std::time::Instant) -> Result<()> {
+        self.validate_receipt(&expected)?;
+        if self.pending.is_some() || self.applied.as_ref().is_some_and(|v|v!=&expected) {return Err(Error::Conflict);}
+        let result=(|| {
+            let current=frontend::Snapshot::read(deadline)?;
+            if current.backend!=expected.receipt.backend {return Err(Error::Conflict);}
+            if current.verified_matches(&self.options,&[],deadline)? {return Ok(());}
+            let rules=expected.prepared.rules(&self.options)?;
+            if !current.verified_matches(&self.options,&rules,deadline)? {return Err(Error::Conflict);}
+            Self::fence(&expected.prepared)?;
+            frontend::replace(&rules,&[],deadline)?;
+            self.context()?;
+            let after=frontend::Snapshot::read(deadline)?;
+            if after.backend!=current.backend || !after.verified_matches(&self.options,&[],deadline)? {return Err(Error::Conflict);}
+            Self::fence(&expected.prepared)
+        })();
+        match result {Ok(())=>{self.applied=Some(expected);self.error=None;self.released=true;Ok(())},Err(error)=>{self.error=Some(error);Err(error)}}
+    }
+    fn close(&mut self, deadline: std::time::Instant) -> Result<()> {
+        if let Some(pending)=self.pending.clone() {
+            self.context()?;
+            let current=frontend::Snapshot::read(deadline)?;
+            if current.backend!=pending.target.backend {return Err(Error::Conflict);}
+            let known=if current.verified_matches(&self.options,&pending.target.rules(&self.options)?,deadline)? {
+                Some(self.applied(pending.target,current.backend.clone()))
+            } else if let Some(previous)=pending.previous {
+                if current.backend!=previous.receipt.backend || !current.verified_matches(&self.options,&previous.prepared.rules(&self.options)?,deadline)? {return Err(Error::Conflict);}
+                Some(previous)
+            } else if current.verified_matches(&self.options,&[],deadline)? {None} else {return Err(Error::Conflict);};
+            self.applied=known;self.pending=None;
+        }
+        if let Some(applied)=self.applied.clone() {self.release(applied,deadline)?;} else {
+            self.context()?;
+            if !frontend::Snapshot::read(deadline)?.verified_matches(&self.options,&[],deadline)? {return Err(Error::Conflict);}
+            self.released=true;self.error=None;
+        }
+        Ok(())
+    }
+}
+pub fn dispatch(owner: &mut Option<Owner>, request: Request) -> Result<serde_json::Value> {
+    let deadline=frontend::deadline();
+    match request.method.as_str() {
+        "prepareDockerForwarding"=>encode(decode::<policy::Policy>(request.params)?.prepare(frontend::version(deadline)?)?),
+        "openDockerForwarding"=>{if owner.is_some(){return Err(Error::Conflict);}*owner=Some(Owner::new(decode(request.params)?)?);encode(owner.as_mut().unwrap().inspect(deadline))},
+        "reconcileDockerForwarding"=>encode(owner.as_mut().ok_or(Error::Conflict)?.reconcile(decode(request.params)?,deadline)?),
+        "inspectDockerForwarding"|"closeDockerForwarding"=>{
+            if decode::<serde_json::Value>(request.params)?!=serde_json::json!({}){return Err(Error::Invalid);}
+            let owner=owner.as_mut().ok_or(Error::Conflict)?;
+            if request.method=="inspectDockerForwarding" {encode(owner.inspect(deadline))} else {
+                if let Err(error)=owner.close(deadline) {owner.error=Some(error);return Err(error);}
+                Ok(serde_json::json!({"released":true}))
+            }
+        },
+        "releaseDockerForwarding"=>{owner.as_mut().ok_or(Error::Conflict)?.release(decode(request.params)?,deadline)?;Ok(serde_json::json!({"released":true}))},
+        _=>Err(Error::Invalid),
+    }
+}