@push.rocks/smartnftables 2.3.0 → 2.5.0

package/rust/src/egress_tests.rs

@@ -676,3 +676,417 @@ fn host_v2_published_ports_reject_unbound_targets_conflicts_and_out_of_range_por
     assert!(normalized(published_host(ports(13))).unwrap().prepare().is_err());
     println!("PUBLISHED_MAX ports=12 operations={} bytes={bytes}", program.len());
 }
+
+pub(crate) fn router_published_port(protocol: &str, transit_port: u16, endpoint_port: u16) -> Value {
+    json!({"protocol":protocol,"transitPort":transit_port,"endpointPort":endpoint_port,
+        "endpointAddress":"10.241.0.2","transitSourceAddress":"10.240.0.2"})
+}
+pub(crate) fn published_router(ports: Value) -> Value {
+    let mut value = router();
+    value["scope"]["publishedPorts"] = ports;
+    value
+}
+
+#[test]
+fn router_v2_without_published_ports_keeps_its_exact_digest_and_compiled_bytes() {
+    use sha2::{Digest, Sha256};
+    let baseline = prepared(router());
+    // Frozen before the optional publication field existed.
+    assert_eq!(
+        baseline.digest,
+        "sha256:762a556e0bf512b653acfcf86699ac7681f26e6cc9ea1d26671443e3d2ca0b61"
+    );
+    let bytes = program_bytes(&baseline, "snft_v2_router_golden");
+    assert_eq!(bytes.len(), 53272);
+    assert_eq!(
+        format!("{:x}", Sha256::digest(&bytes)),
+        "66850722fbd38a45a986cebeddcc75a541ebb1e2f003ea4375621decb2e08f99"
+    );
+    let serialized = serde_json::to_string(&baseline.policy).unwrap();
+    assert!(!serialized.contains("publishedPorts"));
+    // An explicit empty publication is the same canonical policy, digest and graph.
+    assert_eq!(prepared(published_router(json!([]))), baseline);
+    let (chains, rules) = graph(&baseline, "snft_v2_router_golden");
+    assert!(!chains.contains(&"pre".to_string()));
+    assert!(rules.iter().all(|(chain, _)| chain != "pre"));
+}
+
+#[test]
+fn router_v2_published_ports_compile_handoff_dnat_classification_and_admission() {
+    use sha2::{Digest, Sha256};
+    let baseline = graph(&prepared(router()), "snft_v2_router_golden");
+    let value = published_router(json!([
+        router_published_port("tcp", 443, 8443),
+        router_published_port("udp", 8125, 8125)
+    ]));
+    let published = prepared(value.clone());
+    assert_ne!(published.digest, prepared(router()).digest);
+    // Publication order is canonical, so a reordered list is the same policy.
+    let mut reordered = value;
+    reordered["scope"]["publishedPorts"]
+        .as_array_mut()
+        .unwrap()
+        .reverse();
+    assert_eq!(prepared(reordered), published);
+    let (chains, rules) = graph(&published, "snft_v2_router_golden");
+    assert_eq!(chains.len(), baseline.0.len() + 1);
+    assert_eq!(chains.iter().filter(|name| *name == "pre").count(), 1);
+    // Six rules per publication: one translation, one handoff ingress and one
+    // endpoint ingress classification, and the three forward admissions.
+    assert_eq!(rules.len(), baseline.1.len() + 12);
+    let translations: Vec<_> = rules.iter().filter(|(chain, _)| chain == "pre").collect();
+    assert_eq!(translations.len(), 2);
+    for (_, expressions) in &translations {
+        assert_eq!(expressions.last().unwrap(), "nat");
+        assert_eq!(
+            expressions.iter().filter(|name| *name == "immediate").count(),
+            2
+        );
+    }
+    let counted = |graph: &Vec<(String, Vec<String>)>, chain: &str| {
+        graph.iter().filter(|(name, _)| name == chain).count()
+    };
+    assert_eq!(
+        counted(&rules, "forward"),
+        counted(&baseline.1, "forward") + 6
+    );
+    // The classification leads the handoff ingress barrier, ahead of every denial
+    // in it, and never touches conntrack because raw runs before it.
+    let returns: Vec<_> = rules
+        .iter()
+        .filter(|(chain, _)| chain == "raw_return")
+        .map(|(_, expressions)| expressions)
+        .collect();
+    assert_eq!(returns.len(), counted(&baseline.1, "raw_return") + 2);
+    for expressions in &returns[..2] {
+        assert!(!expressions.contains(&"ct".to_string()));
+    }
+    assert!(returns[2..]
+        .iter()
+        .any(|expressions| expressions.contains(&"ct".to_string())));
+    assert_eq!(returns.last().unwrap().len(), 1);
+    // The endpoint side is classified in the workload ingress chain, behind the
+    // handoff barrier that opens it and ahead of every leased zone assignment.
+    let incoming: Vec<_> = rules
+        .iter()
+        .filter(|(chain, _)| chain == "raw_in")
+        .map(|(_, expressions)| expressions)
+        .collect();
+    assert_eq!(incoming.len(), counted(&baseline.1, "raw_in") + 2);
+    for expressions in &incoming[3..5] {
+        assert!(!expressions.contains(&"ct".to_string()));
+    }
+    assert!(incoming[5..]
+        .iter()
+        .any(|expressions| expressions.contains(&"ct".to_string())));
+    let bytes = program_bytes(&published, "snft_v2_router_golden");
+    assert_eq!(bytes.len(), 67818);
+    assert_eq!(
+        format!("{:x}", Sha256::digest(&bytes)),
+        "62bf0f5aace2a19fb8a92571d1c4d45d774aa003884c239e473c67a7e103bb12"
+    );
+}
+
+#[test]
+fn router_v2_published_ports_are_owned_by_their_generation_and_leave_with_it() {
+    let published = prepared(published_router(json!([router_published_port(
+        "tcp", 443, 8443
+    )])));
+    let rollback = prepared(router());
+    let (chains, rules) = graph(&published, "snft_v2_router_rollback");
+    assert!(chains.contains(&"pre".to_string()));
+    assert_eq!(rules.iter().filter(|(chain, _)| chain == "pre").count(), 1);
+    // Every operation names the owned table, and the rollback target compiles the
+    // same graph as before publication; reconcile deletes the complete previous
+    // graph and re-adds the target in one batch, so the publication cannot survive.
+    let (rollback_chains, rollback_rules) = graph(&rollback, "snft_v2_router_rollback");
+    assert!(!rollback_chains.contains(&"pre".to_string()));
+    assert!(rollback_rules.iter().all(|(chain, _)| chain != "pre"));
+    assert_eq!(rollback_chains.len() + 1, chains.len());
+    assert_eq!(rollback_rules.len() + 6, rules.len());
+    assert_ne!(published.digest, rollback.digest);
+    // A released generation takes its publication with it: the scope without
+    // generations rejects the publication it could no longer bind.
+    let mut revoked = published_router(json!([router_published_port("tcp", 443, 8443)]));
+    revoked["scope"]["generations"] = json!([]);
+    assert!(normalized(revoked).is_err());
+}
+
+#[test]
+fn router_v2_published_ports_reject_unbound_endpoints_conflicts_and_out_of_range_ports() {
+    assert!(normalized(published_router(json!([router_published_port("tcp", 443, 8443)]))).is_ok());
+    let mut unknown = router_published_port("tcp", 443, 8443);
+    unknown["endpointId"] = json!("work");
+    for invalid in [
+        published_router(json!([unknown])),
+        published_router(json!([router_published_port("sctp", 443, 8443)])),
+        published_router(json!([router_published_port("tcp", 0, 8443)])),
+        published_router(json!([router_published_port("tcp", 443, 0)])),
+        published_router(json!([changed(
+            router_published_port("tcp", 443, 8443),
+            "/transitPort",
+            json!(65536)
+        )])),
+        published_router(json!([changed(
+            router_published_port("tcp", 443, 8443),
+            "/endpointPort",
+            json!(65536)
+        )])),
+        published_router(json!([changed(
+            router_published_port("tcp", 443, 8443),
+            "/transitPort",
+            json!(-1)
+        )])),
+        // The destination must be a current workload endpoint address of this scope.
+        published_router(json!([changed(
+            router_published_port("tcp", 443, 8443),
+            "/endpointAddress",
+            json!("10.241.0.3")
+        )])),
+        // Not the endpoint's router-local gateway, and not the transit address.
+        published_router(json!([changed(
+            router_published_port("tcp", 443, 8443),
+            "/endpointAddress",
+            json!("10.241.0.1")
+        )])),
+        published_router(json!([changed(
+            router_published_port("tcp", 443, 8443),
+            "/endpointAddress",
+            json!("10.240.0.2")
+        )])),
+        // Not loopback, not a broadcast/multicast address, and IPv4 only.
+        published_router(json!([changed(
+            router_published_port("tcp", 443, 8443),
+            "/endpointAddress",
+            json!("127.0.0.1")
+        )])),
+        published_router(json!([changed(
+            router_published_port("tcp", 443, 8443),
+            "/endpointAddress",
+            json!("fd00::2")
+        )])),
+        // A TUN endpoint keeps private routing only; publication needs a veth.
+        published_router(json!([changed(
+            router_published_port("tcp", 443, 8443),
+            "/endpointAddress",
+            json!("10.242.0.2")
+        )])),
+        // The published address must be a current leased transit source address
+        // that is present on the handoff.
+        published_router(json!([changed(
+            router_published_port("tcp", 443, 8443),
+            "/transitSourceAddress",
+            json!("10.240.0.3")
+        )])),
+        published_router(json!([changed(
+            router_published_port("tcp", 443, 8443),
+            "/transitSourceAddress",
+            json!("10.241.0.1")
+        )])),
+        // A published port cannot collide with the leased outbound SNAT ranges
+        // translated to that same transit address.
+        published_router(json!([router_published_port("tcp", 10500, 8443)])),
+        published_router(json!([router_published_port("udp", 10000, 8443)])),
+        // One protocol/port is published exactly once across the scope.
+        published_router(json!([
+            router_published_port("tcp", 443, 8443),
+            router_published_port("tcp", 443, 9443)
+        ])),
+        published_router(json!((0..65)
+            .map(|index| router_published_port("tcp", 20000 + index, 8443))
+            .collect::<Vec<_>>())),
+    ] {
+        assert!(normalized(invalid).is_err());
+    }
+    // Bounded input still meets the atomic reserve first: every publication costs
+    // six operations, so prepare rejects before any kernel work.
+    let ports = |count: u16| -> Value {
+        json!((0..count)
+            .map(|index| router_published_port("tcp", 20000 + index, 8443))
+            .collect::<Vec<_>>())
+    };
+    let prepared = prepared(published_router(ports(5)));
+    let program = prepared
+        .program(&format!("snft_{}", "x".repeat(59)))
+        .unwrap();
+    let bytes: usize = program
+        .iter()
+        .map(|(_, attributes)| crate::wire::encode_attrs(attributes).len() + 20)
+        .sum();
+    assert!(program.len() <= 768 && bytes <= 100_000);
+    assert!(normalized(published_router(ports(6)))
+        .unwrap()
+        .prepare()
+        .is_err());
+    println!("ROUTER_PUBLISHED_MAX ports=5 operations={} bytes={bytes}", program.len());
+}
+
+/// One arriving IPv4 tuple for the ordered raw classifiers of a compiled chain.
+#[derive(Clone, Copy)]
+struct Arrival {
+    interface_index: u32,
+    interface_name: &'static str,
+    protocol: u8,
+    source: [u8; 4],
+    destination: [u8; 4],
+    source_port: u16,
+    destination_port: u16,
+}
+/// Walks one compiled chain in program order and reports the first rule that
+/// matches an arriving tuple as (position, verdict, conntrack zone it sets). Raw
+/// prerouting classification is the only hook this covers, so an unexpected
+/// expression panics instead of being silently ignored.
+fn classify(prepared: &Prepared, chain: &str, arrival: &Arrival) -> Option<(usize, i32, u16)> {
+    let table = "snft_v2_router_order";
+    let mut position = 0;
+    for (kind, attributes) in prepared.program(table).unwrap() {
+        if kind == 3 || crate::wire::text(&attributes, 2).unwrap() != chain {
+            continue;
+        }
+        let index = position;
+        position += 1;
+        let mut pending: Option<Vec<u8>> = None;
+        let mut immediate: Option<Vec<u8>> = None;
+        let mut verdict = 0;
+        let mut zone = 0;
+        let mut matched = true;
+        for expression in
+            crate::wire::attrs(&crate::wire::one(&attributes, 4).unwrap().value).unwrap()
+        {
+            let fields = crate::wire::attrs(&expression.value).unwrap();
+            let data = crate::wire::attrs(&crate::wire::one(&fields, 2).unwrap().value).unwrap();
+            match crate::wire::text(&fields, 1).unwrap().as_str() {
+                "meta" => {
+                    pending = Some(match crate::wire::number(&data, 2).unwrap() {
+                        4 => arrival.interface_index.to_ne_bytes().to_vec(),
+                        6 => [arrival.interface_name.as_bytes(), &[0]].concat(),
+                        15 => vec![libc::NFPROTO_IPV4 as u8],
+                        16 => vec![arrival.protocol],
+                        key => panic!("meta {key}"),
+                    })
+                }
+                "payload" => {
+                    pending = Some(
+                        match (
+                            crate::wire::number(&data, 2).unwrap(),
+                            crate::wire::number(&data, 3).unwrap(),
+                        ) {
+                            (1, 12) => arrival.source.to_vec(),
+                            (1, 16) => arrival.destination.to_vec(),
+                            (2, 0) => arrival.source_port.to_be_bytes().to_vec(),
+                            (2, 2) => arrival.destination_port.to_be_bytes().to_vec(),
+                            load => panic!("payload {load:?}"),
+                        },
+                    )
+                }
+                "bitwise" => {
+                    let mask = crate::wire::attrs(&crate::wire::one(&data, 4).unwrap().value)
+                        .unwrap()[0]
+                        .value
+                        .clone();
+                    let loaded = pending.take().unwrap();
+                    pending = Some(
+                        loaded
+                            .iter()
+                            .zip(&mask)
+                            .map(|(byte, mask)| byte & mask)
+                            .collect(),
+                    );
+                }
+                "cmp" => {
+                    assert_eq!(crate::wire::number(&data, 2).unwrap(), 0);
+                    let expected = crate::wire::attrs(&crate::wire::one(&data, 3).unwrap().value)
+                        .unwrap()[0]
+                        .value
+                        .clone();
+                    matched = pending.take().unwrap() == expected;
+                }
+                "ct" => {
+                    // Only the zone store reaches raw classification; a loaded
+                    // conntrack key would need a conntrack lookup that has not run.
+                    assert_eq!(crate::wire::number(&data, 2).unwrap(), 17);
+                    assert_eq!(crate::wire::number(&data, 4).unwrap(), 1);
+                    zone = u16::from_ne_bytes(immediate.take().unwrap().try_into().unwrap());
+                }
+                "immediate" => {
+                    let inner =
+                        crate::wire::attrs(&crate::wire::one(&data, 2).unwrap().value).unwrap();
+                    if crate::wire::number(&data, 1).unwrap() == 0 {
+                        let code = crate::wire::attrs(&crate::wire::one(&inner, 2).unwrap().value)
+                            .unwrap();
+                        verdict = crate::wire::number(&code, 1).unwrap() as i32;
+                    } else {
+                        immediate = Some(crate::wire::one(&inner, 1).unwrap().value.clone());
+                    }
+                }
+                other => panic!("{other}"),
+            }
+            if !matched {
+                break;
+            }
+        }
+        if matched {
+            return Some((index, verdict, zone));
+        }
+    }
+    None
+}
+
+#[test]
+fn router_v2_published_endpoint_traffic_is_classified_before_the_leased_grants() {
+    // A published reply to a client whose source port equals the leased grant's
+    // destination port on its public prefix. Raw runs before conntrack, so only
+    // the payload tuple separates it from ordinary leased egress.
+    let reply = Arrival {
+        interface_index: 2,
+        interface_name: "work",
+        protocol: 6,
+        source: [10, 241, 0, 2],
+        destination: [198, 51, 100, 7],
+        source_port: 9443,
+        destination_port: 443,
+    };
+    // Without the publication that exact tuple is leased into the generation zone,
+    // so the ordering below is what keeps the publication usable at all.
+    let leased = classify(&prepared(router()), "raw_in", &reply).unwrap();
+    assert_eq!((leased.1, leased.2), (1, 1));
+    let published = prepared(published_router(json!([router_published_port(
+        "tcp", 443, 9443
+    )])));
+    let (index, verdict, zone) = classify(&published, "raw_in", &reply).unwrap();
+    // Accepted with no zone set: the reply stays in the default zone, where the
+    // translated publication and its admission live.
+    assert_eq!((verdict, zone), (1, 0));
+    // Every other workload flow keeps its leased classification, and the leased
+    // classifier that claims the tuple above is reached only after this one.
+    let (leased_index, leased_verdict, leased_zone) = classify(
+        &published,
+        "raw_in",
+        &Arrival {
+            source_port: 50000,
+            ..reply
+        },
+    )
+    .unwrap();
+    assert_eq!((leased_verdict, leased_zone), (1, 1));
+    assert!(index < leased_index, "{index} {leased_index}");
+    // The classification is exact: another link, another workload address and
+    // another protocol are not published and are not classified here.
+    for foreign in [
+        Arrival {
+            interface_index: 3,
+            interface_name: "vpn",
+            ..reply
+        },
+        Arrival {
+            source: [10, 241, 0, 3],
+            ..reply
+        },
+        Arrival {
+            protocol: 17,
+            ..reply
+        },
+    ] {
+        assert!(classify(&published, "raw_in", &foreign).is_none());
+    }
+}

package/rust/src/main.rs

@@ -11,6 +11,10 @@ mod wire;
 use serde::Deserialize;
 use std::io::{BufRead, Read, Write};
 
+/// One request line from the facade; the facade's `managedIpcBytes` bounds the
+/// same lines. A transition carries two complete policies.
+pub(crate) const IPC_BYTES: usize = 1_048_576;
+
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum Error {
     Invalid,
@@ -141,12 +145,12 @@ fn main() {
     loop {
         let mut bytes = Vec::new();
         let read = std::io::Read::by_ref(&mut input)
-            .take(262_145)
+            .take(IPC_BYTES as u64 + 1)
             .read_until(b'\n', &mut bytes);
         if matches!(read, Ok(0)) {
             break;
         }
-        if read.is_err() || bytes.len() > 262_144 || bytes.last() != Some(&b'\n') {
+        if read.is_err() || bytes.len() > IPC_BYTES || bytes.last() != Some(&b'\n') {
             std::process::exit(2);
         }
         let request: Request = match serde_json::from_slice(&bytes) {

package/rust/src/owner.rs

@@ -66,6 +66,8 @@ struct Graph {
     table: Vec<Attr>,
     chains: Vec<Vec<Attr>>,
     rules: Vec<Vec<Attr>>,
+    /// Each named set with the key of every element it holds.
+    sets: Vec<(Vec<Attr>, Vec<Vec<u8>>)>,
 }
 pub struct Owner {
     identity: Identity,
@@ -220,8 +222,31 @@ impl Owner {
                 }
             }
             let rules = socket.query(7, vec![Attr::string(1, &table_name)], true)?;
+            // Set dumps select the table. Every element is read back, so a set
+            // whose content differs from the compiled target never verifies.
+            let mut sets = Vec::new();
+            for set in socket.query(10, vec![Attr::string(1, &table_name)], true)? {
+                if wire::text(&set, 1)? != table_name {
+                    return Err(Error::Conflict);
+                }
+                let name = wire::text(&set, 2)?;
+                let mut keys = Vec::new();
+                for message in socket.query(
+                    13,
+                    vec![Attr::string(1, &table_name), Attr::string(2, &name)],
+                    true,
+                )? {
+                    if wire::text(&message, 1)? != table_name || wire::text(&message, 2)? != name {
+                        return Err(Error::Conflict);
+                    }
+                    if let Ok(list) = wire::one(&message, 3) {
+                        keys.extend(element_keys(&wire::attrs(&list.value)?)?);
+                    }
+                }
+                sets.push((set, keys));
+            }
             // The managed compiler never creates any of these. Foreign objects reject.
-            for operation in [10, 19, 23] {
+            for operation in [19, 23] {
                 if !socket
                     .query(operation, vec![Attr::string(1, &table_name)], true)?
                     .is_empty()
@@ -235,6 +260,7 @@ impl Owner {
                     table,
                     chains,
                     rules,
+                    sets,
                 }));
             }
         }
@@ -310,7 +336,37 @@ impl Owner {
             }
             result
         };
-        Ok(expected_chains == actual_chains && regroup(expected_rules) == regroup(actual_rules))
+        // Element order is the set backend's; element keys are the identity.
+        let mut expected_sets = std::collections::BTreeMap::<String, (Vec<u8>, Vec<Vec<u8>>)>::new();
+        for (kind, attrs) in &program {
+            match kind {
+                9 => {
+                    expected_sets.insert(wire::text(attrs, 2)?, (set_identity(attrs)?, Vec::new()));
+                }
+                12 => {
+                    let entry = expected_sets
+                        .get_mut(&wire::text(attrs, 2)?)
+                        .ok_or(Error::Invalid)?;
+                    entry.1.extend(element_keys(&wire::attrs(&wire::one(attrs, 3)?.value)?)?);
+                }
+                _ => {}
+            }
+        }
+        let mut actual_sets = std::collections::BTreeMap::new();
+        for (attrs, keys) in &graph.sets {
+            if actual_sets
+                .insert(wire::text(attrs, 2)?, (set_identity(attrs)?, keys.clone()))
+                .is_some()
+            {
+                return Err(Error::Conflict);
+            }
+        }
+        for entry in expected_sets.values_mut().chain(actual_sets.values_mut()) {
+            entry.1.sort();
+        }
+        Ok(expected_chains == actual_chains
+            && regroup(expected_rules) == regroup(actual_rules)
+            && expected_sets == actual_sets)
     }
     fn adopt(&mut self, graph: Graph, transition: &Transition) -> Result<Graph> {
         self.binding(&graph, transition.previous.as_ref())?;
@@ -437,6 +493,17 @@ impl Owner {
                     ],
                 ));
             }
+            // After every rule that binds it; deleting a set deletes its elements.
+            for (set, _) in &graph.sets {
+                operations.push((
+                    11,
+                    0,
+                    vec![
+                        Attr::string(1, &table_name),
+                        Attr::u64(16, wire::handle(set, 16)?),
+                    ],
+                ));
+            }
             graph.generation
         } else {
             if transition.previous.is_some() || self.applied.is_some() {
@@ -454,9 +521,10 @@ impl Owner {
             self.socket()?.generation()?
         };
         for (operation, attributes) in transition.target.program(&table_name)? {
+            // Chains, sets and elements are created exclusively; rules append.
             operations.push((
                 operation,
-                if operation == 3 { 0x600 } else { 0xc00 },
+                if operation == 6 { 0xc00 } else { 0x600 },
                 attributes,
             ));
         }
@@ -612,6 +680,41 @@ fn chain_identity(attributes: &[Attr]) -> Result<Vec<u8>> {
     }
     serde_json::to_vec(&wire::canonical(&identity, false)?).map_err(|_| Error::Protocol)
 }
+/// A set is its table, name, flags, key type and key length. The handle, the
+/// informational backend type and count, the transaction ID and an empty
+/// description are not identity; anything else rejects.
+fn set_identity(attributes: &[Attr]) -> Result<Vec<u8>> {
+    let mut identity = Vec::new();
+    for attribute in attributes {
+        match attribute.id() {
+            10 | 16 | 19 | 20 => {}
+            9 if wire::attrs(&attribute.value)?.is_empty() => {}
+            1..=5 => identity.push(attribute.clone()),
+            _ => return Err(Error::Conflict),
+        }
+    }
+    for id in [1, 2, 3, 4, 5] {
+        wire::one(&identity, id)?;
+    }
+    serde_json::to_vec(&wire::canonical(&identity, false)?).map_err(|_| Error::Protocol)
+}
+/// Only plain keys: an element with data, flags, timeouts, expressions or any
+/// other extension is not one the compiler created.
+fn element_keys(list: &[Attr]) -> Result<Vec<Vec<u8>>> {
+    let mut keys = Vec::new();
+    for element in list {
+        let fields = wire::attrs(&element.value)?;
+        if element.id() != 1 || fields.len() != 1 {
+            return Err(Error::Conflict);
+        }
+        let key = wire::attrs(&wire::one(&fields, 1)?.value)?;
+        if key.len() != 1 {
+            return Err(Error::Conflict);
+        }
+        keys.push(wire::one(&key, 1)?.value.clone());
+    }
+    Ok(keys)
+}
 fn rule_identity(attributes: &[Attr]) -> Result<(String, Vec<u8>)> {
     let chain = wire::text(attributes, 2)?;
     if attributes
@@ -638,7 +741,7 @@ fn rule_identity(attributes: &[Attr]) -> Result<(String, Vec<u8>)> {
             "cmp" => &[3],
             "bitwise" => &[4, 5],
             "range" => &[3, 4],
-            "meta" | "payload" | "ct" | "nat" => &[],
+            "meta" | "payload" | "ct" | "nat" | "lookup" => &[],
             _ => return Err(Error::Conflict),
         };
         for attribute in &mut data {
@@ -669,6 +772,7 @@ fn rule_identity(attributes: &[Attr]) -> Result<(String, Vec<u8>)> {
 /// neither unknown fields nor default repair may hide a changed kernel rule.
 fn validate_egress_expression(name: &str, data: &[Attr]) -> Result<()> {
     let allowed: &[u16] = match name {
+        "lookup" => &[1, 2, 5],
         "ct" | "range" => &[1, 2, 3, 4],
         "nat" => &[1, 2, 3, 4, 5, 6, 7],
         _ => return Ok(()),
@@ -680,6 +784,14 @@ fn validate_egress_expression(name: &str, data: &[Attr]) -> Result<()> {
         wire::one(data, attribute.id())?; // Duplicate fields are never canonical identity.
     }
     match name {
+        "lookup" => {
+            // A plain membership test of a named set: no map, no inversion.
+            wire::text(data, 1)?;
+            wire::number(data, 2)?;
+            if data.len() != 3 || wire::number(data, 5)? != 0 {
+                return Err(Error::Conflict);
+            }
+        }
         "ct" => {
             let read = data.iter().any(|item| item.id() == 1);
             let write = data.iter().any(|item| item.id() == 4);

package/rust/src/owner_egress_tests.rs

@@ -85,7 +85,7 @@ pub(super) fn recover(name: &str, policy: egress::Policy) {
                         chain_identity(actual),
                         "chain {name}"
                     );
-                } else {
+                } else if kind == 6 {
                     let stamp = &wire::one(&expected, 7).unwrap().value;
                     let actual = graph
                         .rules

package/rust/src/owner_egress_traffic_tests.rs

@@ -25,7 +25,7 @@ pub(super) fn connect(a: &str, aname: &str, aip: &str, b: &str, bname: &str, bip
         ns_ip(ns, &["link", "set", name, "up"]);
     }
 }
-fn binding(name: &str, address: &str, kind: &str) -> Value {
+pub(super) fn binding(name: &str, address: &str, kind: &str) -> Value {
     let output = std::process::Command::new("/bin/ip")
         .args(["-j", "-d", "link", "show", "dev", name])
         .output()
@@ -37,12 +37,12 @@ fn binding(name: &str, address: &str, kind: &str) -> Value {
         "interfaceLinkIndex":if kind=="tun" {observed["ifindex"].clone()} else {observed["link_index"].clone()},
         "requiredIpv4Addresses":[address]})
 }
-fn protection() -> Value {
+pub(super) fn protection() -> Value {
     json!({"authorityDigest":format!("sha256:{}","b".repeat(64)),"prefixes":["10.0.0.0/8","192.0.2.0/24"],
         "platformEndpoints":[{"id":"dns","address":"192.0.2.3","protocol":"udp","port":5300},
             {"id":"mail","address":"192.0.2.3","protocol":"tcp","port":3000}]})
 }
-fn allocation() -> Value {
+pub(super) fn allocation() -> Value {
     json!({"lease":{"id":"lease-a","generation":1,"digest":format!("sha256:{}","a".repeat(64))},
         "transitSourceAddress":"10.240.0.2","sourcePortRanges":[{"protocol":"udp","first":10000,"last":10015},
             {"protocol":"tcp","first":10016,"last":10031}]})