@push.rocks/smartnftables 2.3.0 → 2.5.0

package/rust/src/egress_hostgrant_tests.rs

@@ -0,0 +1,948 @@
+//! Host-origin exact-port grants: compile-level exactness across the three
+//! scopes a host-to-workload flow crosses (allocation-pool guard and host
+//! transit in the host namespace, router egress in the router namespace).
+use super::tests::{host, pool_guard, router};
+use super::{Policy, Prepared};
+use crate::wire::{self, Attr};
+use serde_json::{json, Value};
+use std::collections::BTreeMap;
+
+pub(crate) fn host_grant(protocol: &str, source: &str, destination: &str, port: u16) -> Value {
+    json!({"protocol":protocol,"sourceAddress":source,"destinationAddress":destination,
+        "destinationPort":port})
+}
+pub(crate) fn granted(mut value: Value, grants: Value) -> Value {
+    value["scope"]["hostGrants"] = grants;
+    value
+}
+fn normalized(value: Value) -> crate::Result<Policy> {
+    serde_json::from_value::<Policy>(value)
+        .map_err(|_| crate::Error::Invalid)?
+        .normalize()
+}
+fn prepared(value: Value) -> Prepared {
+    normalized(value).unwrap().prepare().unwrap()
+}
+fn bytes(prepared: &Prepared) -> Vec<u8> {
+    let mut result = Vec::new();
+    for (kind, attributes) in prepared.program("snft_host_grant").unwrap() {
+        result.extend(kind.to_be_bytes());
+        result.extend(wire::encode_attrs(&attributes));
+    }
+    result
+}
+/// The fixture flow: the host's transit address on the handoff dials the workload.
+fn exact() -> Value {
+    json!([host_grant("tcp", "10.240.0.1", "10.241.0.2", 8080)])
+}
+
+/// One packet with the conntrack facts a filter hook observes.
+#[derive(Clone, Copy)]
+struct Flow {
+    input: Option<(u32, &'static str)>,
+    output: Option<(u32, &'static str)>,
+    protocol: u8,
+    source: [u8; 4],
+    destination: [u8; 4],
+    source_port: u16,
+    destination_port: u16,
+    tcp_flags: u8,
+    state: u32,
+    reply: bool,
+    zone: u16,
+    /// Original-direction conntrack tuple: source, destination, ports.
+    original: ([u8; 4], [u8; 4], u16, u16),
+}
+const HOST: [u8; 4] = [10, 240, 0, 1];
+const WORK: [u8; 4] = [10, 241, 0, 2];
+const NEW: u32 = 8;
+const ESTABLISHED: u32 = 2;
+const SYN: u8 = 0x02;
+const ACK: u8 = 0x10;
+fn opening(input: Option<(u32, &'static str)>, output: Option<(u32, &'static str)>) -> Flow {
+    Flow {
+        input,
+        output,
+        protocol: 6,
+        source: HOST,
+        destination: WORK,
+        source_port: 443,
+        destination_port: 8080,
+        tcp_flags: SYN,
+        state: NEW,
+        reply: false,
+        zone: 0,
+        original: (HOST, WORK, 443, 8080),
+    }
+}
+/// The workload's answer to `flow`, arriving on the reverse links.
+fn answer(flow: Flow) -> Flow {
+    Flow {
+        input: flow.output,
+        output: flow.input,
+        source: flow.destination,
+        destination: flow.source,
+        source_port: flow.destination_port,
+        destination_port: flow.source_port,
+        tcp_flags: ACK,
+        state: ESTABLISHED,
+        reply: true,
+        ..flow
+    }
+}
+/// Every variant of an admitted flow that the grant does not name.
+fn foreign(flow: Flow) -> Vec<Flow> {
+    let (source, destination, source_port, _) = flow.original;
+    let original = |value: (_, _, _, _)| {
+        if flow.reply {
+            (value.1, value.0, value.3, value.2)
+        } else {
+            value
+        }
+    };
+    let tuple = |changed: Flow| Flow {
+        original: original((
+            changed.source,
+            changed.destination,
+            changed.source_port,
+            changed.destination_port,
+        )),
+        ..changed
+    };
+    let mut result = vec![
+        // Another port, protocol, workload address and host source address.
+        if flow.reply {
+            tuple(Flow {
+                source_port: 8081,
+                ..flow
+            })
+        } else {
+            tuple(Flow {
+                destination_port: 8081,
+                ..flow
+            })
+        },
+        Flow {
+            protocol: 17,
+            ..flow
+        },
+        if flow.reply {
+            tuple(Flow {
+                source: [10, 241, 0, 3],
+                ..flow
+            })
+        } else {
+            tuple(Flow {
+                destination: [10, 241, 0, 3],
+                ..flow
+            })
+        },
+        if flow.reply {
+            tuple(Flow {
+                destination: [192, 0, 2, 2],
+                ..flow
+            })
+        } else {
+            tuple(Flow {
+                source: [192, 0, 2, 2],
+                ..flow
+            })
+        },
+        // Foreign destination NAT onto the granted tuple.
+        Flow {
+            original: (source, [203, 0, 113, 9], source_port, 80),
+            ..flow
+        },
+        Flow {
+            original: (source, destination, source_port, 80),
+            ..flow
+        },
+        // Another conntrack zone, the wrong direction, a non-SYN opening and an
+        // unreplied flow on the reply path.
+        Flow { zone: 7, ..flow },
+        Flow {
+            reply: !flow.reply,
+            ..flow
+        },
+    ];
+    result.push(if flow.reply {
+        Flow { state: NEW, ..flow }
+    } else {
+        Flow {
+            state: NEW,
+            tcp_flags: ACK,
+            ..flow
+        }
+    });
+    result
+}
+
+/// What one hook decides for a flow, following jumps and returns exactly as the
+/// kernel does: the terminal verdict, the chain that reached it (`policy` for the
+/// base chain's accept policy) and the conntrack zone a raw rule stored.
+#[derive(Debug, PartialEq, Eq)]
+struct Decision {
+    verdict: i32,
+    chain: String,
+    zone: u16,
+}
+/// The compiled table: rules per chain and element keys per set.
+struct Table {
+    chains: BTreeMap<String, Vec<Vec<Attr>>>,
+    sets: BTreeMap<String, Vec<Vec<u8>>>,
+}
+fn chains(prepared: &Prepared) -> BTreeMap<String, Vec<Vec<Attr>>> {
+    table(prepared).chains
+}
+fn table(prepared: &Prepared) -> Table {
+    let mut chains: BTreeMap<String, Vec<Vec<Attr>>> = BTreeMap::new();
+    let mut sets: BTreeMap<String, Vec<Vec<u8>>> = BTreeMap::new();
+    for (kind, attributes) in prepared.program("snft_host_grant").unwrap() {
+        match kind {
+            3 => {
+                chains
+                    .entry(wire::text(&attributes, 3).unwrap())
+                    .or_default();
+            }
+            6 => chains
+                .entry(wire::text(&attributes, 2).unwrap())
+                .or_default()
+                .push(wire::attrs(&wire::one(&attributes, 4).unwrap().value).unwrap()),
+            9 => {
+                assert!(sets
+                    .insert(wire::text(&attributes, 2).unwrap(), Vec::new())
+                    .is_none());
+            }
+            12 => {
+                let keys = sets.get_mut(&wire::text(&attributes, 2).unwrap()).unwrap();
+                for element in wire::attrs(&wire::one(&attributes, 3).unwrap().value).unwrap() {
+                    let key = wire::attrs(&element.value).unwrap();
+                    keys.push(data(&key, 1));
+                }
+            }
+            other => panic!("operation {other}"),
+        }
+    }
+    Table { chains, sets }
+}
+fn data(attributes: &[Attr], id: u16) -> Vec<u8> {
+    wire::attrs(&wire::one(attributes, id).unwrap().value).unwrap()[0]
+        .value
+        .clone()
+}
+/// A missing device loads as index 0 and an empty name, exactly like Linux.
+fn interface(value: Option<(u32, &'static str)>, name: bool) -> Vec<u8> {
+    let (index, text) = value.unwrap_or((0, ""));
+    if name {
+        let mut padded = text.as_bytes().to_vec();
+        padded.resize(16, 0);
+        padded
+    } else {
+        index.to_ne_bytes().to_vec()
+    }
+}
+/// None when a load cannot produce a value, which breaks the rule like the kernel.
+fn load(flow: &Flow, name: &str, fields: &[Attr]) -> Option<Vec<u8>> {
+    Some(match name {
+        "meta" => match wire::number(fields, 2).unwrap() {
+            4 => interface(flow.input, false),
+            5 => interface(flow.output, false),
+            6 => interface(flow.input, true),
+            7 => interface(flow.output, true),
+            15 => vec![libc::NFPROTO_IPV4 as u8],
+            16 => vec![flow.protocol],
+            key => panic!("meta {key}"),
+        },
+        "payload" => {
+            let loaded = match (
+                wire::number(fields, 2).unwrap(),
+                wire::number(fields, 3).unwrap(),
+            ) {
+                (1, 12) => flow.source.to_vec(),
+                (1, 16) => flow.destination.to_vec(),
+                (2, 0) => flow.source_port.to_be_bytes().to_vec(),
+                (2, 2) => flow.destination_port.to_be_bytes().to_vec(),
+                (2, 13) if flow.protocol == 6 => vec![flow.tcp_flags],
+                (2, 13) => return None,
+                load => panic!("payload {load:?}"),
+            };
+            assert_eq!(loaded.len() as u32, wire::number(fields, 4).unwrap());
+            loaded
+        }
+        "ct" => {
+            if let Ok(direction) = wire::one(fields, 3) {
+                assert_eq!(direction.value, vec![0]);
+            }
+            let (source, destination, source_port, destination_port) = flow.original;
+            match wire::number(fields, 2).unwrap() {
+                0 => flow.state.to_ne_bytes().to_vec(),
+                1 => vec![u8::from(flow.reply)],
+                10 => vec![flow.protocol],
+                11 => source_port.to_be_bytes().to_vec(),
+                12 => destination_port.to_be_bytes().to_vec(),
+                13 => vec![0; 16],
+                17 => flow.zone.to_ne_bytes().to_vec(),
+                19 => source.to_vec(),
+                20 => destination.to_vec(),
+                key => panic!("ct {key}"),
+            }
+        }
+        other => panic!("{other}"),
+    })
+}
+/// Byte offset of a register operand, as the kernel parses it.
+fn offset(fields: &[Attr], id: u16) -> usize {
+    let register = wire::number(fields, id).unwrap() as usize;
+    4 * if register <= 4 {
+        register * 4
+    } else {
+        register - 4
+    }
+}
+enum Step {
+    Next,
+    Final(Decision),
+}
+/// A register machine over the compiled rules: loads store into their register
+/// and zero the rest of a partially written 32-bit word, exactly as the kernel's
+/// store helpers do, so concatenated set keys are checked byte for byte.
+fn run(table: &Table, chain: &str, flow: &Flow, zone: &mut u16) -> Step {
+    for expressions in &table.chains[chain] {
+        let mut registers = [0_u8; 80];
+        let mut matched = true;
+        let mut verdict: Option<(i32, Option<String>)> = None;
+        for expression in expressions {
+            let parts = wire::attrs(&expression.value).unwrap();
+            let name = wire::text(&parts, 1).unwrap();
+            let fields = wire::attrs(&wire::one(&parts, 2).unwrap().value).unwrap();
+            match name.as_str() {
+                "ct" if wire::one(&fields, 4).is_ok() => {
+                    if wire::number(&fields, 2).unwrap() == 17 {
+                        let at = offset(&fields, 4);
+                        *zone = u16::from_ne_bytes(registers[at..at + 2].try_into().unwrap());
+                    }
+                }
+                "meta" | "payload" | "ct" => match load(flow, &name, &fields) {
+                    Some(value) => {
+                        let at = offset(&fields, 1);
+                        let end = at + value.len().div_ceil(4) * 4;
+                        registers[at..end].fill(0);
+                        registers[at..at + value.len()].copy_from_slice(&value);
+                    }
+                    None => matched = false,
+                },
+                "bitwise" => {
+                    let (from, to) = (offset(&fields, 1), offset(&fields, 2));
+                    let length = wire::number(&fields, 3).unwrap() as usize;
+                    let (mask, xor) = (data(&fields, 4), data(&fields, 5));
+                    for index in 0..length {
+                        registers[to + index] = registers[from + index] & mask[index] ^ xor[index];
+                    }
+                }
+                "cmp" => {
+                    assert_eq!(wire::number(&fields, 2).unwrap(), 0);
+                    let expected = data(&fields, 3);
+                    let at = offset(&fields, 1);
+                    matched = registers[at..at + expected.len()] == expected[..];
+                }
+                "range" => {
+                    assert_eq!(wire::number(&fields, 2).unwrap(), 0);
+                    let (first, last) = (data(&fields, 3), data(&fields, 4));
+                    let at = offset(&fields, 1);
+                    let loaded = &registers[at..at + first.len()];
+                    matched = loaded >= &first[..] && loaded <= &last[..];
+                }
+                "lookup" => {
+                    assert_eq!(wire::number(&fields, 5).unwrap(), 0);
+                    let keys = &table.sets[&wire::text(&fields, 1).unwrap()];
+                    let at = offset(&fields, 2);
+                    matched = keys
+                        .iter()
+                        .any(|key| registers[at..at + key.len()] == key[..]);
+                }
+                "immediate" if wire::number(&fields, 1).unwrap() == 0 => {
+                    let code = wire::attrs(
+                        &wire::one(
+                            &wire::attrs(&wire::one(&fields, 2).unwrap().value).unwrap(),
+                            2,
+                        )
+                        .unwrap()
+                        .value,
+                    )
+                    .unwrap();
+                    verdict = Some((
+                        wire::number(&code, 1).unwrap() as i32,
+                        wire::text(&code, 2).ok(),
+                    ));
+                }
+                "immediate" => {
+                    let value = data(&fields, 2);
+                    let at = offset(&fields, 1);
+                    registers[at..at + value.len()].copy_from_slice(&value);
+                }
+                "nat" => {}
+                other => panic!("{other}"),
+            }
+            if !matched {
+                break;
+            }
+        }
+        if !matched {
+            continue;
+        }
+        match verdict {
+            Some((code @ (0 | 1), _)) => {
+                return Step::Final(Decision {
+                    verdict: code,
+                    chain: chain.into(),
+                    zone: *zone,
+                })
+            }
+            Some((-5, _)) => return Step::Next,
+            Some((-3, Some(target))) => {
+                if let Step::Final(decision) = run(table, &target, flow, zone) {
+                    return Step::Final(decision);
+                }
+            }
+            Some((-4, Some(target))) => return run(table, &target, flow, zone),
+            Some(other) => panic!("verdict {other:?}"),
+            None => {}
+        }
+    }
+    Step::Next
+}
+/// A base chain that ends without a terminal verdict accepts by policy.
+fn decide(prepared: &Prepared, chain: &str, flow: &Flow) -> Decision {
+    let mut zone = 0;
+    match run(&table(prepared), chain, flow, &mut zone) {
+        Step::Final(decision) => decision,
+        Step::Next => Decision {
+            verdict: 1,
+            chain: "policy".into(),
+            zone,
+        },
+    }
+}
+/// The grant admits exactly its flow in both directions of every hook, and every
+/// other tuple meets exactly the decision the scope without the grant makes.
+fn assert_exact(baseline: &Prepared, granted: &Prepared, hooks: &[(&str, Flow)]) {
+    for (chain, flow) in hooks {
+        assert_ne!(decide(baseline, chain, flow).verdict, 1, "{chain} baseline");
+        assert_eq!(decide(granted, chain, flow).verdict, 1, "{chain} granted");
+        for (index, other) in foreign(*flow).iter().enumerate() {
+            assert_eq!(
+                decide(granted, chain, other),
+                decide(baseline, chain, other),
+                "{chain} variant {index}"
+            );
+        }
+    }
+}
+
+#[test]
+fn host_grants_absent_and_empty_keep_every_scope_digest_and_compiled_bytes() {
+    for fixture in [router(), host(), pool_guard()] {
+        let baseline = prepared(fixture.clone());
+        assert!(!serde_json::to_string(&baseline.policy)
+            .unwrap()
+            .contains("hostGrants"));
+        let empty = prepared(granted(fixture.clone(), json!([])));
+        assert_eq!(empty, baseline);
+        assert_eq!(bytes(&empty), bytes(&baseline));
+        let with = prepared(granted(fixture, exact()));
+        assert_ne!(with.digest, baseline.digest);
+        assert!(serde_json::to_string(&with.policy)
+            .unwrap()
+            .contains("\"hostGrants\""));
+    }
+}
+
+#[test]
+fn router_host_grant_classifies_and_admits_only_the_exact_handoff_flow() {
+    let baseline = prepared(router());
+    let with = prepared(granted(router(), exact()));
+    let handoff = Some((4, "handoff"));
+    let work = Some((2, "work"));
+    let original = opening(handoff, work);
+    // Forward admission of the opening, of the established flow and of the reply.
+    assert_exact(
+        &baseline,
+        &with,
+        &[
+            ("forward", original),
+            (
+                "forward",
+                Flow {
+                    state: ESTABLISHED,
+                    tcp_flags: ACK,
+                    ..original
+                },
+            ),
+            ("forward", answer(original)),
+        ],
+    );
+    // Raw handoff ingress runs before conntrack: the exact arriving tuple is
+    // accepted in the default zone ahead of the protected-source denial that
+    // drops every host-origin packet without the grant.
+    let raw = |prepared: &Prepared, flow: &Flow| decide(prepared, "raw_in", flow);
+    assert_eq!(raw(&baseline, &original).verdict, 0);
+    let classified = raw(&with, &original);
+    assert_eq!(
+        (classified.verdict, classified.chain.as_str()),
+        (1, "raw_return")
+    );
+    for other in [
+        Flow {
+            destination_port: 8081,
+            ..original
+        },
+        Flow {
+            protocol: 17,
+            ..original
+        },
+        Flow {
+            destination: [10, 241, 0, 3],
+            ..original
+        },
+        Flow {
+            source: [10, 240, 0, 5],
+            ..original
+        },
+        Flow {
+            input: Some((3, "vpn")),
+            ..original
+        },
+    ] {
+        assert_eq!(raw(&with, &other), raw(&baseline, &other));
+    }
+    // The workload's answer stays in the default zone even when the host's source
+    // port equals the destination port of a leased public grant (tcp/443 here):
+    // protected destinations return before any leased classifier can zone it.
+    let reply = raw(&with, &answer(original));
+    assert_eq!(reply, raw(&baseline, &answer(original)));
+    assert_eq!((reply.verdict, reply.zone), (1, 0));
+    let leased = raw(
+        &with,
+        &Flow {
+            destination: [198, 51, 100, 7],
+            ..answer(original)
+        },
+    );
+    assert_eq!(
+        (leased.verdict, leased.chain.as_str(), leased.zone),
+        (1, "raw_in", 1)
+    );
+    // One raw classification and four forward admissions, whatever the number
+    // of grants.
+    let count = |prepared: &Prepared, chain: &str| chains(prepared)[chain].len();
+    assert_eq!(
+        count(&with, "raw_return"),
+        count(&baseline, "raw_return") + 1
+    );
+    assert_eq!(count(&with, "forward"), count(&baseline, "forward") + 4);
+    assert_eq!(chains(&with).len(), chains(&baseline).len());
+}
+
+#[test]
+fn host_transit_host_grant_opens_only_the_exact_output_and_reply_input() {
+    let baseline = prepared(host());
+    let with = prepared(granted(host(), exact()));
+    let original = opening(None, Some((4, "handoff")));
+    assert_exact(
+        &baseline,
+        &with,
+        &[
+            ("output", original),
+            (
+                "output",
+                Flow {
+                    state: ESTABLISHED,
+                    tcp_flags: ACK,
+                    ..original
+                },
+            ),
+            ("input", answer(original)),
+        ],
+    );
+    // No forwarding, no uplink path and no other handoff opens.
+    for (chain, flow) in [
+        (
+            "forward",
+            Flow {
+                input: Some((2, "ens18")),
+                ..original
+            },
+        ),
+        (
+            "output",
+            Flow {
+                output: Some((2, "ens18")),
+                ..original
+            },
+        ),
+        (
+            "input",
+            Flow {
+                input: Some((2, "ens18")),
+                ..answer(original)
+            },
+        ),
+    ] {
+        assert_eq!(decide(&with, chain, &flow), decide(&baseline, chain, &flow));
+    }
+    let count = |prepared: &Prepared, chain: &str| chains(prepared)[chain].len();
+    assert_eq!(count(&with, "output"), count(&baseline, "output") + 3);
+    assert_eq!(count(&with, "input"), count(&baseline, "input") + 1);
+    assert_eq!(count(&with, "forward"), count(&baseline, "forward"));
+    assert_eq!(chains(&with).len(), chains(&baseline).len());
+}
+
+#[test]
+fn pool_guard_host_grant_is_the_only_exception_and_the_guard_keeps_every_other_pool_denial() {
+    let baseline = prepared(pool_guard());
+    let with = prepared(granted(pool_guard(), exact()));
+    // The guard has no link binding; the exception is the exact host-local tuple.
+    let original = opening(None, Some((4, "handoff")));
+    assert_exact(
+        &baseline,
+        &with,
+        &[
+            ("output", original),
+            (
+                "output",
+                Flow {
+                    state: ESTABLISHED,
+                    tcp_flags: ACK,
+                    ..original
+                },
+            ),
+            ("input", answer(original)),
+        ],
+    );
+    // Forwarded pool traffic never matches a host grant.
+    let forwarded = Flow {
+        input: Some((2, "ens18")),
+        ..original
+    };
+    assert_eq!(
+        decide(&with, "forward", &forwarded),
+        decide(&baseline, "forward", &forwarded)
+    );
+    assert_eq!(decide(&with, "forward", &forwarded).verdict, 0);
+    let graph = chains(&with);
+    let reference = chains(&baseline);
+    for name in ["pool_guard", "pool_reply", "forward"] {
+        assert_eq!(graph[name], reference[name], "{name}");
+    }
+    assert_eq!(graph["output"].len(), reference["output"].len() + 3);
+    assert_eq!(graph["input"].len(), reference["input"].len() + 1);
+}
+
+#[test]
+fn host_grant_withdrawal_compiles_the_exact_previous_graph() {
+    for fixture in [router(), host(), pool_guard()] {
+        let baseline = prepared(fixture.clone());
+        let two = prepared(granted(
+            fixture.clone(),
+            json!([
+                host_grant("tcp", "10.240.0.1", "10.241.0.2", 8080),
+                host_grant("udp", "10.240.0.1", "10.241.0.2", 5353)
+            ]),
+        ));
+        // Order is canonical, so a reordered list is the same policy.
+        let reordered = prepared(granted(
+            fixture.clone(),
+            json!([
+                host_grant("udp", "10.240.0.1", "10.241.0.2", 5353),
+                host_grant("tcp", "10.240.0.1", "10.241.0.2", 8080)
+            ]),
+        ));
+        assert_eq!(reordered, two);
+        // Withdrawing one grant is the single-grant policy; withdrawing all of them
+        // is byte-identical to the scope that never had one.
+        let one = prepared(granted(fixture.clone(), exact()));
+        let tcp = opening(None, Some((4, "handoff")));
+        assert_ne!(one.digest, two.digest);
+        assert_eq!(prepared(granted(fixture, json!([]))), baseline);
+        let (chain, flow) = if matches!(baseline.policy.scope, super::Scope::RouterEgress(_)) {
+            (
+                "forward",
+                Flow {
+                    input: Some((4, "handoff")),
+                    output: Some((2, "work")),
+                    ..tcp
+                },
+            )
+        } else {
+            ("output", tcp)
+        };
+        let udp = Flow {
+            protocol: 17,
+            destination_port: 5353,
+            original: (HOST, WORK, 443, 5353),
+            ..flow
+        };
+        assert_eq!(decide(&two, chain, &udp).verdict, 1);
+        assert_eq!(decide(&one, chain, &udp), decide(&baseline, chain, &udp));
+        assert_eq!(decide(&one, chain, &flow).verdict, 1);
+        assert_ne!(decide(&baseline, chain, &flow).verdict, 1);
+    }
+}
+
+#[test]
+fn host_grants_reject_ranges_wildcards_and_unbound_addresses() {
+    let valid = |fixture: Value| granted(fixture, exact());
+    for fixture in [router(), host(), pool_guard()] {
+        assert!(normalized(valid(fixture.clone())).is_ok());
+        let grant = host_grant("tcp", "10.240.0.1", "10.241.0.2", 8080);
+        let changed = |path: &str, value: Value| {
+            let mut changed = grant.clone();
+            *changed.pointer_mut(path).unwrap() = value;
+            granted(fixture.clone(), json!([changed]))
+        };
+        let mut unknown = grant.clone();
+        unknown["destinationPortLast"] = json!(8090);
+        let mut missing = grant.clone();
+        missing.as_object_mut().unwrap().remove("sourceAddress");
+        for invalid in [
+            granted(fixture.clone(), json!([unknown])),
+            granted(fixture.clone(), json!([missing])),
+            changed("/protocol", json!("any")),
+            changed("/protocol", json!("sctp")),
+            // Exact ports only: no zero, range, list, wildcard or null.
+            changed("/destinationPort", json!(0)),
+            changed("/destinationPort", json!(65536)),
+            changed("/destinationPort", json!(-1)),
+            changed("/destinationPort", json!("8080-8090")),
+            changed("/destinationPort", json!([8080, 8090])),
+            changed("/destinationPort", Value::Null),
+            // Exact unicast addresses only: no prefix, wildcard, broadcast or loopback.
+            changed("/sourceAddress", json!("10.240.0.1/32")),
+            changed("/sourceAddress", json!("0.0.0.0")),
+            changed("/sourceAddress", json!("10.240.0.01")),
+            changed("/destinationAddress", json!("10.241.0.0/24")),
+            changed("/destinationAddress", json!("0.0.0.0")),
+            changed("/destinationAddress", json!("255.255.255.255")),
+            changed("/destinationAddress", json!("127.0.0.1")),
+            changed("/destinationAddress", json!("fd00::2")),
+            changed("/destinationAddress", json!("10.240.0.1")),
+            // One entry per exact tuple, and a bounded list.
+            granted(fixture.clone(), json!([grant.clone(), grant.clone()])),
+            granted(
+                fixture.clone(),
+                json!((0..1025)
+                    .map(|index| host_grant("tcp", "10.240.0.1", "10.241.0.2", 20000 + index))
+                    .collect::<Vec<_>>()),
+            ),
+        ] {
+            assert!(normalized(invalid).is_err());
+        }
+    }
+    let bound = |fixture: Value, source: &str, destination: &str| {
+        normalized(granted(
+            fixture,
+            json!([host_grant("tcp", source, destination, 8080)]),
+        ))
+    };
+    // Router: the destination is a current veth workload endpoint address, and the
+    // source is protected handoff-side space that is neither router-local, a
+    // platform endpoint nor a workload.
+    for (source, destination) in [
+        ("10.240.0.1", "10.241.0.3"),
+        ("10.240.0.1", "10.241.0.1"),
+        ("10.240.0.1", "10.240.0.2"),
+        ("10.240.0.1", "10.242.0.2"),
+        ("10.240.0.1", "192.0.2.1"),
+        ("10.240.0.2", "10.241.0.2"),
+        ("10.241.0.1", "10.241.0.2"),
+        ("10.242.0.2", "10.241.0.2"),
+        ("192.0.2.1", "10.241.0.2"),
+        ("203.0.113.9", "10.241.0.2"),
+    ] {
+        assert!(
+            bound(router(), source, destination).is_err(),
+            "{source} {destination}"
+        );
+    }
+    // Host transit: the source is an exact current handoff address, and the
+    // destination is protected, non-local space that is no leased router address.
+    for (source, destination) in [
+        ("10.240.0.5", "10.241.0.2"),
+        ("192.0.2.2", "10.241.0.2"),
+        ("10.240.0.1", "10.240.0.2"),
+        ("10.240.0.1", "192.0.2.2"),
+        ("10.240.0.1", "192.0.2.1"),
+        ("10.240.0.1", "198.51.100.7"),
+    ] {
+        assert!(
+            bound(host(), source, destination).is_err(),
+            "{source} {destination}"
+        );
+    }
+    // Guard: the exception names an address inside a guarded pool.
+    for (source, destination) in [
+        ("10.240.0.1", "10.242.0.2"),
+        ("10.240.0.1", "192.168.1.1"),
+        ("10.240.0.1", "198.51.100.7"),
+    ] {
+        assert!(
+            bound(pool_guard(), source, destination).is_err(),
+            "{source} {destination}"
+        );
+    }
+}
+
+/// `count` distinct exact grants to the fixture workload, both protocols.
+fn many(count: usize) -> Value {
+    json!((0..count)
+        .map(|index| host_grant(
+            if index % 2 == 0 { "tcp" } else { "udp" },
+            "10.240.0.1",
+            "10.241.0.2",
+            20000 + (index / 2) as u16
+        ))
+        .collect::<Vec<_>>())
+}
+
+#[test]
+fn host_grants_compile_a_constant_rule_graph_and_one_element_per_grant() {
+    for fixture in [router(), host(), pool_guard()] {
+        let one = table(&prepared(granted(fixture.clone(), many(1))));
+        let all = table(&prepared(granted(fixture.clone(), many(1024))));
+        // The rule graph is independent of the number of grants.
+        assert_eq!(one.chains, all.chains);
+        assert_eq!(all.sets["host_grant"].len(), 1024);
+        let keys: std::collections::BTreeSet<_> = all.sets["host_grant"].iter().collect();
+        assert_eq!(keys.len(), 1024);
+        if let Some(arrival) = all.sets.get("host_grant_arrival") {
+            assert_eq!(arrival.len(), 1024);
+        }
+        assert!(table(&prepared(fixture)).sets.is_empty());
+    }
+}
+
+#[test]
+fn host_grants_admit_every_member_of_a_large_set_and_no_other_tuple() {
+    let flows = |fixture: &Value| -> Vec<(&'static str, Flow, bool)> {
+        let (chain, original) = if fixture["scope"]["kind"] == "routerEgress" {
+            ("forward", opening(Some((4, "handoff")), Some((2, "work"))))
+        } else {
+            ("output", opening(None, Some((4, "handoff"))))
+        };
+        let reply_chain = if chain == "forward" {
+            "forward"
+        } else {
+            "input"
+        };
+        let at = |protocol: u8, port: u16| Flow {
+            protocol,
+            destination_port: port,
+            original: (HOST, WORK, 443, port),
+            ..original
+        };
+        vec![
+            // First, middle and last members of both protocols.
+            (chain, at(6, 20000), true),
+            (chain, at(17, 20000), true),
+            (chain, at(6, 20255), true),
+            (chain, at(17, 20511), true),
+            (reply_chain, answer(at(6, 20511)), true),
+            (reply_chain, answer(at(17, 20300)), true),
+            // Just outside the member range, and a translated member.
+            (chain, at(6, 20512), false),
+            (chain, at(17, 19999), false),
+            (reply_chain, answer(at(6, 20512)), false),
+            (
+                chain,
+                Flow {
+                    original: (HOST, WORK, 443, 20001),
+                    ..at(6, 20000)
+                },
+                false,
+            ),
+        ]
+    };
+    for fixture in [router(), host(), pool_guard()] {
+        let with = prepared(granted(fixture.clone(), many(1024)));
+        let baseline = prepared(fixture.clone());
+        for (chain, flow, admitted) in flows(&fixture) {
+            let decision = decide(&with, chain, &flow);
+            if admitted {
+                assert_eq!(decision.verdict, 1, "{chain}");
+            } else {
+                assert_eq!(decision, decide(&baseline, chain, &flow), "{chain}");
+            }
+        }
+    }
+}
+
+#[test]
+fn host_grants_meet_the_atomic_reserve_at_the_contract_maximum() {
+    // Worst-case handle-only deletion of a previous maximum graph: 768 messages
+    // naming the longest table, a chain name and a handle.
+    let deletion = 768 * (20 + 72 + 36 + 12);
+    for (name, fixture) in [
+        ("router", router()),
+        ("host", host()),
+        ("guard", pool_guard()),
+    ] {
+        let prepared = prepared(granted(fixture.clone(), many(1024)));
+        let program = prepared
+            .program(&format!("snft_{}", "x".repeat(59)))
+            .unwrap();
+        let size = |kinds: &[u16]| -> usize {
+            program
+                .iter()
+                .filter(|(kind, _)| kinds.contains(kind))
+                .map(|(_, attributes)| wire::encode_attrs(attributes).len() + 20)
+                .sum()
+        };
+        let (graph, elements) = (size(&[3, 6, 9]), size(&[12]));
+        assert!(
+            program.len() < 768 && graph <= 100_000 && elements <= super::compile::ELEMENT_BYTES
+        );
+        assert!(deletion + graph + elements + 64 <= crate::wire::BATCH_BYTES);
+        // The contract maximum is the validation bound.
+        assert!(normalized(granted(fixture, many(1025))).is_err());
+        println!(
+            "HOST_GRANT_MAX scope={name} grants=1024 operations={} rule_bytes={graph} element_bytes={elements} batch_bound={}",
+            program.len(),
+            deletion + graph + elements + 64
+        );
+    }
+    // The reserve itself: a maximum previous graph beside a maximum target.
+    assert!(deletion + 100_000 + super::compile::ELEMENT_BYTES + 64 <= crate::wire::BATCH_BYTES);
+}
+
+/// A status carries up to three complete policies: the applied one and the
+/// pending transition's previous and target. At the contract maximum in every
+/// scope, that status still fits the private IPC bounds (1,000,000 JSON bytes
+/// and 65,536 values in the facade, 1,048,576-byte lines).
+#[test]
+fn host_grant_policies_fit_the_ipc_bounds_three_at_a_time() {
+    fn values(value: &Value) -> usize {
+        1 + match value {
+            Value::Array(items) => items.iter().map(values).sum(),
+            Value::Object(map) => map.values().map(values).sum(),
+            _ => 0,
+        }
+    }
+    for fixture in [router(), host(), pool_guard()] {
+        let prepared = serde_json::to_value(prepared(granted(fixture, many(1024)))).unwrap();
+        let applied = json!({"receipt":{"identity":{"ownerId":"o".repeat(64),"instanceId":"i".repeat(64),
+            "tableName":format!("snft_{}", "x".repeat(59)),"bootId":"0".repeat(36),
+            "namespaceDevice":"18446744073709551615","namespaceInode":"18446744073709551615"},
+            "tableHandle":"18446744073709551615","revision":9007199254740991_u64,"digest":prepared["digest"]},
+            "prepared":prepared});
+        let status = json!({"id":"x".repeat(128),"success":true,"result":{"identity":applied["receipt"]["identity"],
+            "state":"failed-owned","enforced":false,"applied":applied,
+            "pending":{"previous":applied,"target":prepared},"error":"CONFLICT"}});
+        let bytes = serde_json::to_vec(&status).unwrap().len();
+        assert!(bytes <= 1_000_000 && bytes < crate::IPC_BYTES, "{bytes}");
+        assert!(values(&status) <= 65_536);
+        println!(
+            "HOST_GRANT_IPC status_bytes={bytes} values={}",
+            values(&status)
+        );
+    }
+}