@push.rocks/smartnftables 2.2.0 → 2.4.0

package/rust/src/egress_tests.rs

@@ -1,4 +1,4 @@
-use super::{Policy, Scope};
+use super::{Policy, Prepared, Scope};
 use serde_json::{json, Value};
 
 fn link(index: u32, name: &str, kind: &str, address: &str) -> Value {
@@ -483,3 +483,610 @@ fn allocation_pool_guard_maximum_fits_the_atomic_graph_without_link_bindings() {
     let excessive: Vec<_> = (0..65).map(|part| format!("10.{part}.0.0/16")).collect();
     assert!(normalized(changed(pool_guard(), "/scope/prefixes", json!(excessive))).is_err());
 }
+
+pub(crate) fn published_port(protocol: &str, host_port: u16, target_port: u16) -> Value {
+    json!({"protocol":protocol,"hostPort":host_port,"targetPort":target_port,
+        "targetAddress":"10.240.0.2","hostIp":"192.0.2.2"})
+}
+pub(crate) fn published_host(ports: Value) -> Value {
+    let mut value = host();
+    value["scope"]["publishedPorts"] = ports;
+    value
+}
+fn prepared(value: Value) -> Prepared {
+    normalized(value).unwrap().prepare().unwrap()
+}
+fn program_bytes(prepared: &Prepared, table: &str) -> Vec<u8> {
+    let mut bytes = Vec::new();
+    for (kind, attributes) in prepared.program(table).unwrap() {
+        let encoded = crate::wire::encode_attrs(&attributes);
+        bytes.extend(kind.to_be_bytes());
+        bytes.extend((encoded.len() as u32).to_be_bytes());
+        bytes.extend(encoded);
+    }
+    bytes
+}
+/// Chain names in creation order, then every rule as (chain, expression names).
+fn graph(prepared: &Prepared, table: &str) -> (Vec<String>, Vec<(String, Vec<String>)>) {
+    let mut chains = Vec::new();
+    let mut rules = Vec::new();
+    for (kind, attributes) in prepared.program(table).unwrap() {
+        assert_eq!(crate::wire::text(&attributes, 1).unwrap(), table);
+        if kind == 3 {
+            chains.push(crate::wire::text(&attributes, 3).unwrap());
+            continue;
+        }
+        let expressions = crate::wire::attrs(&crate::wire::one(&attributes, 4).unwrap().value).unwrap();
+        rules.push((
+            crate::wire::text(&attributes, 2).unwrap(),
+            expressions
+                .iter()
+                .map(|expression| {
+                    let fields = crate::wire::attrs(&expression.value).unwrap();
+                    crate::wire::text(&fields, 1).unwrap()
+                })
+                .collect(),
+        ));
+    }
+    (chains, rules)
+}
+
+#[test]
+fn host_v2_without_published_ports_keeps_its_exact_digest_and_compiled_bytes() {
+    use sha2::{Digest, Sha256};
+    let baseline = prepared(host());
+    // Frozen before the optional publication field existed.
+    assert_eq!(
+        baseline.digest,
+        "sha256:b24cd2bc4e812014cabd71a77f57a2fe085c4b83d4e7b7939ccfca28949c6848"
+    );
+    let bytes = program_bytes(&baseline, "snft_v2_host_golden");
+    assert_eq!(bytes.len(), 24932);
+    assert_eq!(
+        format!("{:x}", Sha256::digest(&bytes)),
+        "91735de50a831184648bf79cd7a840f7af5264f3c6ec461f5412b3fc1d1ef6ec"
+    );
+    let serialized = serde_json::to_string(&baseline.policy).unwrap();
+    assert!(!serialized.contains("publishedPorts"));
+    // An explicit empty publication is the same canonical policy, digest and graph.
+    assert_eq!(prepared(published_host(json!([]))), baseline);
+    let (chains, rules) = graph(&baseline, "snft_v2_host_golden");
+    assert!(!chains.contains(&"pre".to_string()));
+    assert!(rules.iter().all(|(chain, _)| chain != "pre"));
+}
+
+#[test]
+fn host_v2_published_ports_compile_uplink_dnat_and_exact_forward_admission() {
+    use sha2::{Digest, Sha256};
+    let baseline = graph(&prepared(host()), "snft_v2_host_golden");
+    let value = published_host(json!([
+        published_port("tcp", 443, 8443),
+        published_port("udp", 8125, 8125)
+    ]));
+    let published = prepared(value.clone());
+    assert_ne!(published.digest, prepared(host()).digest);
+    // Publication order is canonical, so a reordered list is the same policy.
+    let mut reordered = value;
+    reordered["scope"]["publishedPorts"]
+        .as_array_mut()
+        .unwrap()
+        .reverse();
+    assert_eq!(prepared(reordered), published);
+    let (chains, rules) = graph(&published, "snft_v2_host_golden");
+    assert_eq!(chains.len(), baseline.0.len() + 1);
+    assert_eq!(chains.iter().filter(|name| *name == "pre").count(), 1);
+    assert_eq!(rules.len(), baseline.1.len() + 8);
+    let translations: Vec<_> = rules.iter().filter(|(chain, _)| chain == "pre").collect();
+    assert_eq!(translations.len(), 2);
+    for (_, expressions) in &translations {
+        assert_eq!(expressions.last().unwrap(), "nat");
+        assert_eq!(expressions.iter().filter(|name| *name == "immediate").count(), 2);
+    }
+    // The three admissions precede the capture barrier jumps of their handoff.
+    let forward: Vec<_> = rules
+        .iter()
+        .filter(|(chain, _)| chain == "forward")
+        .map(|(_, expressions)| expressions.len())
+        .collect();
+    assert_eq!(forward.len(), baseline.1.iter().filter(|(chain, _)| chain == "forward").count() + 6);
+    let (_, first) = rules.iter().find(|(chain, _)| chain == "forward").unwrap();
+    assert!(first.contains(&"ct".to_string()) && first.len() > 4);
+    let bytes = program_bytes(&published, "snft_v2_host_golden");
+    assert_eq!(bytes.len(), 36322);
+    assert_eq!(
+        format!("{:x}", Sha256::digest(&bytes)),
+        "1d3485bb739ac3601642610eba465b80c9b5ac34df22a5374cfbc8773623710b"
+    );
+}
+
+#[test]
+fn host_v2_published_ports_are_owned_by_their_generation_and_leave_with_it() {
+    let published = prepared(published_host(json!([published_port("tcp", 443, 8443)])));
+    let rollback = prepared(host());
+    let (chains, rules) = graph(&published, "snft_v2_host_rollback");
+    assert!(chains.contains(&"pre".to_string()));
+    assert_eq!(rules.iter().filter(|(chain, _)| chain == "pre").count(), 1);
+    // Every operation names the owned table, and the rollback target compiles the
+    // same graph as before publication; reconcile deletes the complete previous
+    // graph and re-adds the target in one batch, so the publication cannot survive.
+    let (rollback_chains, rollback_rules) = graph(&rollback, "snft_v2_host_rollback");
+    assert!(!rollback_chains.contains(&"pre".to_string()));
+    assert!(rollback_rules.iter().all(|(chain, _)| chain != "pre"));
+    assert_eq!(rollback_chains.len() + 1, chains.len());
+    assert_eq!(rollback_rules.len() + 4, rules.len());
+    assert_ne!(published.digest, rollback.digest);
+}
+
+#[test]
+fn host_v2_published_ports_reject_unbound_targets_conflicts_and_out_of_range_ports() {
+    assert!(normalized(published_host(json!([published_port("tcp", 443, 8443)]))).is_ok());
+    let mut unknown = published_port("tcp", 443, 8443);
+    unknown["hostInterface"] = json!("ens18");
+    let mut second_address = published_host(json!([
+        changed(published_port("tcp", 443, 8443), "/hostIp", json!("192.0.2.5"))
+    ]));
+    second_address["scope"]["uplink"]["requiredIpv4Addresses"] = json!(["192.0.2.2", "192.0.2.5"]);
+    let mut duplicate_across_addresses = second_address.clone();
+    duplicate_across_addresses["scope"]["publishedPorts"]
+        .as_array_mut()
+        .unwrap()
+        .push(published_port("tcp", 443, 9443));
+    assert!(normalized(second_address).is_ok());
+    for invalid in [
+        published_host(json!([unknown])),
+        published_host(json!([published_port("sctp", 443, 8443)])),
+        published_host(json!([published_port("tcp", 0, 8443)])),
+        published_host(json!([published_port("tcp", 443, 0)])),
+        published_host(json!([changed(published_port("tcp", 443, 8443), "/hostPort", json!(65536))])),
+        published_host(json!([changed(published_port("tcp", 443, 8443), "/targetPort", json!(65536))])),
+        published_host(json!([changed(published_port("tcp", 443, 8443), "/hostPort", json!(-1))])),
+        // The published address must be an exact current uplink address.
+        published_host(json!([changed(published_port("tcp", 443, 8443), "/hostIp", json!("192.0.2.5"))])),
+        published_host(json!([changed(published_port("tcp", 443, 8443), "/hostIp", json!("10.240.0.1"))])),
+        // The target must be a current leased transit source address.
+        published_host(json!([changed(published_port("tcp", 443, 8443), "/targetAddress", json!("10.240.0.3"))])),
+        published_host(json!([changed(published_port("tcp", 443, 8443), "/targetAddress", json!("10.240.0.1"))])),
+        published_host(json!([changed(published_port("tcp", 443, 8443), "/targetAddress", json!("192.0.2.2"))])),
+        // A published port cannot collide with the leased outbound SNAT ranges.
+        published_host(json!([published_port("tcp", 10500, 8443)])),
+        published_host(json!([published_port("udp", 10000, 8443)])),
+        // One protocol/port is published exactly once, including across addresses.
+        published_host(json!([published_port("tcp", 443, 8443), published_port("tcp", 443, 9443)])),
+        duplicate_across_addresses,
+        published_host(json!((0..65).map(|index| published_port("tcp", 20000 + index, 8443)).collect::<Vec<_>>())),
+    ] {
+        assert!(normalized(invalid).is_err());
+    }
+    // Bounded input still meets the atomic reserve first: every publication costs
+    // one translation and three admissions, so prepare rejects before any kernel work.
+    let ports = |count: u16| -> Value {
+        json!((0..count)
+            .map(|index| published_port("tcp", 20000 + index, 8443))
+            .collect::<Vec<_>>())
+    };
+    let prepared = prepared(published_host(ports(12)));
+    let program = prepared
+        .program(&format!("snft_{}", "x".repeat(59)))
+        .unwrap();
+    let bytes: usize = program
+        .iter()
+        .map(|(_, attributes)| crate::wire::encode_attrs(attributes).len() + 20)
+        .sum();
+    assert!(program.len() <= 768 && bytes <= 100_000);
+    assert!(normalized(published_host(ports(13))).unwrap().prepare().is_err());
+    println!("PUBLISHED_MAX ports=12 operations={} bytes={bytes}", program.len());
+}
+
+pub(crate) fn router_published_port(protocol: &str, transit_port: u16, endpoint_port: u16) -> Value {
+    json!({"protocol":protocol,"transitPort":transit_port,"endpointPort":endpoint_port,
+        "endpointAddress":"10.241.0.2","transitSourceAddress":"10.240.0.2"})
+}
+pub(crate) fn published_router(ports: Value) -> Value {
+    let mut value = router();
+    value["scope"]["publishedPorts"] = ports;
+    value
+}
+
+#[test]
+fn router_v2_without_published_ports_keeps_its_exact_digest_and_compiled_bytes() {
+    use sha2::{Digest, Sha256};
+    let baseline = prepared(router());
+    // Frozen before the optional publication field existed.
+    assert_eq!(
+        baseline.digest,
+        "sha256:762a556e0bf512b653acfcf86699ac7681f26e6cc9ea1d26671443e3d2ca0b61"
+    );
+    let bytes = program_bytes(&baseline, "snft_v2_router_golden");
+    assert_eq!(bytes.len(), 53272);
+    assert_eq!(
+        format!("{:x}", Sha256::digest(&bytes)),
+        "66850722fbd38a45a986cebeddcc75a541ebb1e2f003ea4375621decb2e08f99"
+    );
+    let serialized = serde_json::to_string(&baseline.policy).unwrap();
+    assert!(!serialized.contains("publishedPorts"));
+    // An explicit empty publication is the same canonical policy, digest and graph.
+    assert_eq!(prepared(published_router(json!([]))), baseline);
+    let (chains, rules) = graph(&baseline, "snft_v2_router_golden");
+    assert!(!chains.contains(&"pre".to_string()));
+    assert!(rules.iter().all(|(chain, _)| chain != "pre"));
+}
+
+#[test]
+fn router_v2_published_ports_compile_handoff_dnat_classification_and_admission() {
+    use sha2::{Digest, Sha256};
+    let baseline = graph(&prepared(router()), "snft_v2_router_golden");
+    let value = published_router(json!([
+        router_published_port("tcp", 443, 8443),
+        router_published_port("udp", 8125, 8125)
+    ]));
+    let published = prepared(value.clone());
+    assert_ne!(published.digest, prepared(router()).digest);
+    // Publication order is canonical, so a reordered list is the same policy.
+    let mut reordered = value;
+    reordered["scope"]["publishedPorts"]
+        .as_array_mut()
+        .unwrap()
+        .reverse();
+    assert_eq!(prepared(reordered), published);
+    let (chains, rules) = graph(&published, "snft_v2_router_golden");
+    assert_eq!(chains.len(), baseline.0.len() + 1);
+    assert_eq!(chains.iter().filter(|name| *name == "pre").count(), 1);
+    // Six rules per publication: one translation, one handoff ingress and one
+    // endpoint ingress classification, and the three forward admissions.
+    assert_eq!(rules.len(), baseline.1.len() + 12);
+    let translations: Vec<_> = rules.iter().filter(|(chain, _)| chain == "pre").collect();
+    assert_eq!(translations.len(), 2);
+    for (_, expressions) in &translations {
+        assert_eq!(expressions.last().unwrap(), "nat");
+        assert_eq!(
+            expressions.iter().filter(|name| *name == "immediate").count(),
+            2
+        );
+    }
+    let counted = |graph: &Vec<(String, Vec<String>)>, chain: &str| {
+        graph.iter().filter(|(name, _)| name == chain).count()
+    };
+    assert_eq!(
+        counted(&rules, "forward"),
+        counted(&baseline.1, "forward") + 6
+    );
+    // The classification leads the handoff ingress barrier, ahead of every denial
+    // in it, and never touches conntrack because raw runs before it.
+    let returns: Vec<_> = rules
+        .iter()
+        .filter(|(chain, _)| chain == "raw_return")
+        .map(|(_, expressions)| expressions)
+        .collect();
+    assert_eq!(returns.len(), counted(&baseline.1, "raw_return") + 2);
+    for expressions in &returns[..2] {
+        assert!(!expressions.contains(&"ct".to_string()));
+    }
+    assert!(returns[2..]
+        .iter()
+        .any(|expressions| expressions.contains(&"ct".to_string())));
+    assert_eq!(returns.last().unwrap().len(), 1);
+    // The endpoint side is classified in the workload ingress chain, behind the
+    // handoff barrier that opens it and ahead of every leased zone assignment.
+    let incoming: Vec<_> = rules
+        .iter()
+        .filter(|(chain, _)| chain == "raw_in")
+        .map(|(_, expressions)| expressions)
+        .collect();
+    assert_eq!(incoming.len(), counted(&baseline.1, "raw_in") + 2);
+    for expressions in &incoming[3..5] {
+        assert!(!expressions.contains(&"ct".to_string()));
+    }
+    assert!(incoming[5..]
+        .iter()
+        .any(|expressions| expressions.contains(&"ct".to_string())));
+    let bytes = program_bytes(&published, "snft_v2_router_golden");
+    assert_eq!(bytes.len(), 67818);
+    assert_eq!(
+        format!("{:x}", Sha256::digest(&bytes)),
+        "62bf0f5aace2a19fb8a92571d1c4d45d774aa003884c239e473c67a7e103bb12"
+    );
+}
+
+#[test]
+fn router_v2_published_ports_are_owned_by_their_generation_and_leave_with_it() {
+    let published = prepared(published_router(json!([router_published_port(
+        "tcp", 443, 8443
+    )])));
+    let rollback = prepared(router());
+    let (chains, rules) = graph(&published, "snft_v2_router_rollback");
+    assert!(chains.contains(&"pre".to_string()));
+    assert_eq!(rules.iter().filter(|(chain, _)| chain == "pre").count(), 1);
+    // Every operation names the owned table, and the rollback target compiles the
+    // same graph as before publication; reconcile deletes the complete previous
+    // graph and re-adds the target in one batch, so the publication cannot survive.
+    let (rollback_chains, rollback_rules) = graph(&rollback, "snft_v2_router_rollback");
+    assert!(!rollback_chains.contains(&"pre".to_string()));
+    assert!(rollback_rules.iter().all(|(chain, _)| chain != "pre"));
+    assert_eq!(rollback_chains.len() + 1, chains.len());
+    assert_eq!(rollback_rules.len() + 6, rules.len());
+    assert_ne!(published.digest, rollback.digest);
+    // A released generation takes its publication with it: the scope without
+    // generations rejects the publication it could no longer bind.
+    let mut revoked = published_router(json!([router_published_port("tcp", 443, 8443)]));
+    revoked["scope"]["generations"] = json!([]);
+    assert!(normalized(revoked).is_err());
+}
+
+#[test]
+fn router_v2_published_ports_reject_unbound_endpoints_conflicts_and_out_of_range_ports() {
+    assert!(normalized(published_router(json!([router_published_port("tcp", 443, 8443)]))).is_ok());
+    let mut unknown = router_published_port("tcp", 443, 8443);
+    unknown["endpointId"] = json!("work");
+    for invalid in [
+        published_router(json!([unknown])),
+        published_router(json!([router_published_port("sctp", 443, 8443)])),
+        published_router(json!([router_published_port("tcp", 0, 8443)])),
+        published_router(json!([router_published_port("tcp", 443, 0)])),
+        published_router(json!([changed(
+            router_published_port("tcp", 443, 8443),
+            "/transitPort",
+            json!(65536)
+        )])),
+        published_router(json!([changed(
+            router_published_port("tcp", 443, 8443),
+            "/endpointPort",
+            json!(65536)
+        )])),
+        published_router(json!([changed(
+            router_published_port("tcp", 443, 8443),
+            "/transitPort",
+            json!(-1)
+        )])),
+        // The destination must be a current workload endpoint address of this scope.
+        published_router(json!([changed(
+            router_published_port("tcp", 443, 8443),
+            "/endpointAddress",
+            json!("10.241.0.3")
+        )])),
+        // Not the endpoint's router-local gateway, and not the transit address.
+        published_router(json!([changed(
+            router_published_port("tcp", 443, 8443),
+            "/endpointAddress",
+            json!("10.241.0.1")
+        )])),
+        published_router(json!([changed(
+            router_published_port("tcp", 443, 8443),
+            "/endpointAddress",
+            json!("10.240.0.2")
+        )])),
+        // Not loopback, not a broadcast/multicast address, and IPv4 only.
+        published_router(json!([changed(
+            router_published_port("tcp", 443, 8443),
+            "/endpointAddress",
+            json!("127.0.0.1")
+        )])),
+        published_router(json!([changed(
+            router_published_port("tcp", 443, 8443),
+            "/endpointAddress",
+            json!("fd00::2")
+        )])),
+        // A TUN endpoint keeps private routing only; publication needs a veth.
+        published_router(json!([changed(
+            router_published_port("tcp", 443, 8443),
+            "/endpointAddress",
+            json!("10.242.0.2")
+        )])),
+        // The published address must be a current leased transit source address
+        // that is present on the handoff.
+        published_router(json!([changed(
+            router_published_port("tcp", 443, 8443),
+            "/transitSourceAddress",
+            json!("10.240.0.3")
+        )])),
+        published_router(json!([changed(
+            router_published_port("tcp", 443, 8443),
+            "/transitSourceAddress",
+            json!("10.241.0.1")
+        )])),
+        // A published port cannot collide with the leased outbound SNAT ranges
+        // translated to that same transit address.
+        published_router(json!([router_published_port("tcp", 10500, 8443)])),
+        published_router(json!([router_published_port("udp", 10000, 8443)])),
+        // One protocol/port is published exactly once across the scope.
+        published_router(json!([
+            router_published_port("tcp", 443, 8443),
+            router_published_port("tcp", 443, 9443)
+        ])),
+        published_router(json!((0..65)
+            .map(|index| router_published_port("tcp", 20000 + index, 8443))
+            .collect::<Vec<_>>())),
+    ] {
+        assert!(normalized(invalid).is_err());
+    }
+    // Bounded input still meets the atomic reserve first: every publication costs
+    // six operations, so prepare rejects before any kernel work.
+    let ports = |count: u16| -> Value {
+        json!((0..count)
+            .map(|index| router_published_port("tcp", 20000 + index, 8443))
+            .collect::<Vec<_>>())
+    };
+    let prepared = prepared(published_router(ports(5)));
+    let program = prepared
+        .program(&format!("snft_{}", "x".repeat(59)))
+        .unwrap();
+    let bytes: usize = program
+        .iter()
+        .map(|(_, attributes)| crate::wire::encode_attrs(attributes).len() + 20)
+        .sum();
+    assert!(program.len() <= 768 && bytes <= 100_000);
+    assert!(normalized(published_router(ports(6)))
+        .unwrap()
+        .prepare()
+        .is_err());
+    println!("ROUTER_PUBLISHED_MAX ports=5 operations={} bytes={bytes}", program.len());
+}
+
+/// One arriving IPv4 tuple for the ordered raw classifiers of a compiled chain.
+#[derive(Clone, Copy)]
+struct Arrival {
+    interface_index: u32,
+    interface_name: &'static str,
+    protocol: u8,
+    source: [u8; 4],
+    destination: [u8; 4],
+    source_port: u16,
+    destination_port: u16,
+}
+/// Walks one compiled chain in program order and reports the first rule that
+/// matches an arriving tuple as (position, verdict, conntrack zone it sets). Raw
+/// prerouting classification is the only hook this covers, so an unexpected
+/// expression panics instead of being silently ignored.
+fn classify(prepared: &Prepared, chain: &str, arrival: &Arrival) -> Option<(usize, i32, u16)> {
+    let table = "snft_v2_router_order";
+    let mut position = 0;
+    for (kind, attributes) in prepared.program(table).unwrap() {
+        if kind == 3 || crate::wire::text(&attributes, 2).unwrap() != chain {
+            continue;
+        }
+        let index = position;
+        position += 1;
+        let mut pending: Option<Vec<u8>> = None;
+        let mut immediate: Option<Vec<u8>> = None;
+        let mut verdict = 0;
+        let mut zone = 0;
+        let mut matched = true;
+        for expression in
+            crate::wire::attrs(&crate::wire::one(&attributes, 4).unwrap().value).unwrap()
+        {
+            let fields = crate::wire::attrs(&expression.value).unwrap();
+            let data = crate::wire::attrs(&crate::wire::one(&fields, 2).unwrap().value).unwrap();
+            match crate::wire::text(&fields, 1).unwrap().as_str() {
+                "meta" => {
+                    pending = Some(match crate::wire::number(&data, 2).unwrap() {
+                        4 => arrival.interface_index.to_ne_bytes().to_vec(),
+                        6 => [arrival.interface_name.as_bytes(), &[0]].concat(),
+                        15 => vec![libc::NFPROTO_IPV4 as u8],
+                        16 => vec![arrival.protocol],
+                        key => panic!("meta {key}"),
+                    })
+                }
+                "payload" => {
+                    pending = Some(
+                        match (
+                            crate::wire::number(&data, 2).unwrap(),
+                            crate::wire::number(&data, 3).unwrap(),
+                        ) {
+                            (1, 12) => arrival.source.to_vec(),
+                            (1, 16) => arrival.destination.to_vec(),
+                            (2, 0) => arrival.source_port.to_be_bytes().to_vec(),
+                            (2, 2) => arrival.destination_port.to_be_bytes().to_vec(),
+                            load => panic!("payload {load:?}"),
+                        },
+                    )
+                }
+                "bitwise" => {
+                    let mask = crate::wire::attrs(&crate::wire::one(&data, 4).unwrap().value)
+                        .unwrap()[0]
+                        .value
+                        .clone();
+                    let loaded = pending.take().unwrap();
+                    pending = Some(
+                        loaded
+                            .iter()
+                            .zip(&mask)
+                            .map(|(byte, mask)| byte & mask)
+                            .collect(),
+                    );
+                }
+                "cmp" => {
+                    assert_eq!(crate::wire::number(&data, 2).unwrap(), 0);
+                    let expected = crate::wire::attrs(&crate::wire::one(&data, 3).unwrap().value)
+                        .unwrap()[0]
+                        .value
+                        .clone();
+                    matched = pending.take().unwrap() == expected;
+                }
+                "ct" => {
+                    // Only the zone store reaches raw classification; a loaded
+                    // conntrack key would need a conntrack lookup that has not run.
+                    assert_eq!(crate::wire::number(&data, 2).unwrap(), 17);
+                    assert_eq!(crate::wire::number(&data, 4).unwrap(), 1);
+                    zone = u16::from_ne_bytes(immediate.take().unwrap().try_into().unwrap());
+                }
+                "immediate" => {
+                    let inner =
+                        crate::wire::attrs(&crate::wire::one(&data, 2).unwrap().value).unwrap();
+                    if crate::wire::number(&data, 1).unwrap() == 0 {
+                        let code = crate::wire::attrs(&crate::wire::one(&inner, 2).unwrap().value)
+                            .unwrap();
+                        verdict = crate::wire::number(&code, 1).unwrap() as i32;
+                    } else {
+                        immediate = Some(crate::wire::one(&inner, 1).unwrap().value.clone());
+                    }
+                }
+                other => panic!("{other}"),
+            }
+            if !matched {
+                break;
+            }
+        }
+        if matched {
+            return Some((index, verdict, zone));
+        }
+    }
+    None
+}
+
+#[test]
+fn router_v2_published_endpoint_traffic_is_classified_before_the_leased_grants() {
+    // A published reply to a client whose source port equals the leased grant's
+    // destination port on its public prefix. Raw runs before conntrack, so only
+    // the payload tuple separates it from ordinary leased egress.
+    let reply = Arrival {
+        interface_index: 2,
+        interface_name: "work",
+        protocol: 6,
+        source: [10, 241, 0, 2],
+        destination: [198, 51, 100, 7],
+        source_port: 9443,
+        destination_port: 443,
+    };
+    // Without the publication that exact tuple is leased into the generation zone,
+    // so the ordering below is what keeps the publication usable at all.
+    let leased = classify(&prepared(router()), "raw_in", &reply).unwrap();
+    assert_eq!((leased.1, leased.2), (1, 1));
+    let published = prepared(published_router(json!([router_published_port(
+        "tcp", 443, 9443
+    )])));
+    let (index, verdict, zone) = classify(&published, "raw_in", &reply).unwrap();
+    // Accepted with no zone set: the reply stays in the default zone, where the
+    // translated publication and its admission live.
+    assert_eq!((verdict, zone), (1, 0));
+    // Every other workload flow keeps its leased classification, and the leased
+    // classifier that claims the tuple above is reached only after this one.
+    let (leased_index, leased_verdict, leased_zone) = classify(
+        &published,
+        "raw_in",
+        &Arrival {
+            source_port: 50000,
+            ..reply
+        },
+    )
+    .unwrap();
+    assert_eq!((leased_verdict, leased_zone), (1, 1));
+    assert!(index < leased_index, "{index} {leased_index}");
+    // The classification is exact: another link, another workload address and
+    // another protocol are not published and are not classified here.
+    for foreign in [
+        Arrival {
+            interface_index: 3,
+            interface_name: "vpn",
+            ..reply
+        },
+        Arrival {
+            source: [10, 241, 0, 3],
+            ..reply
+        },
+        Arrival {
+            protocol: 17,
+            ..reply
+        },
+    ] {
+        assert!(classify(&published, "raw_in", &foreign).is_none());
+    }
+}

package/rust/src/owner_egress_traffic_tests.rs

@@ -25,7 +25,7 @@ pub(super) fn connect(a: &str, aname: &str, aip: &str, b: &str, bname: &str, bip
         ns_ip(ns, &["link", "set", name, "up"]);
     }
 }
-fn binding(name: &str, address: &str, kind: &str) -> Value {
+pub(super) fn binding(name: &str, address: &str, kind: &str) -> Value {
     let output = std::process::Command::new("/bin/ip")
         .args(["-j", "-d", "link", "show", "dev", name])
         .output()
@@ -37,12 +37,12 @@ fn binding(name: &str, address: &str, kind: &str) -> Value {
         "interfaceLinkIndex":if kind=="tun" {observed["ifindex"].clone()} else {observed["link_index"].clone()},
         "requiredIpv4Addresses":[address]})
 }
-fn protection() -> Value {
+pub(super) fn protection() -> Value {
     json!({"authorityDigest":format!("sha256:{}","b".repeat(64)),"prefixes":["10.0.0.0/8","192.0.2.0/24"],
         "platformEndpoints":[{"id":"dns","address":"192.0.2.3","protocol":"udp","port":5300},
             {"id":"mail","address":"192.0.2.3","protocol":"tcp","port":3000}]})
 }
-fn allocation() -> Value {
+pub(super) fn allocation() -> Value {
     json!({"lease":{"id":"lease-a","generation":1,"digest":format!("sha256:{}","a".repeat(64))},
         "transitSourceAddress":"10.240.0.2","sourcePortRanges":[{"protocol":"udp","first":10000,"last":10015},
             {"protocol":"tcp","first":10016,"last":10031}]})