@push.rocks/smartnftables 2.3.0 → 2.5.0

package/rust/src/owner_host_traffic_tests.rs

@@ -113,7 +113,7 @@ fn hostile_capture_fixture() {
     // This is a persistent *foreign fixture* table. Drop its process socket;
     // native managed-table ownership never adopts or removes this graph.
 }
-fn control(source: &UdpSocket, destination: &str, target: &UdpSocket, allowed: bool) {
+pub(super) fn control(source: &UdpSocket, destination: &str, target: &UdpSocket, allowed: bool) {
     assert_eq!(source.send_to(b"probe", destination).unwrap(), 5);
     if allowed {
         assert_eq!(target.recv(&mut [0; 64]).unwrap(), 5);
@@ -305,7 +305,7 @@ const PUBLISH_SOURCE: &str = "hp_source";
 const PUBLISH_HOST: &str = "hp_host";
 const PUBLISH_PEER: &str = "hp_peer";
 
-fn chain_names(owner: &mut Owner) -> Vec<String> {
+pub(super) fn chain_names(owner: &mut Owner) -> Vec<String> {
     owner
         .graph()
         .unwrap()
@@ -317,7 +317,7 @@ fn chain_names(owner: &mut Owner) -> Vec<String> {
 }
 /// Inbound publication through the uplink: the workload must observe the actual
 /// client address, and the client must observe the published address back.
-fn published_udp(client: &UdpSocket, workload: &UdpSocket, published: &str, client_address: &str) {
+pub(super) fn published_udp(client: &UdpSocket, workload: &UdpSocket, published: &str, client_address: &str) {
     let mut bytes = [0; 64];
     assert_eq!(client.send_to(b"query", published).unwrap(), 5);
     let (size, observed) = workload.recv_from(&mut bytes).expect("published delivery");
@@ -328,7 +328,7 @@ fn published_udp(client: &UdpSocket, workload: &UdpSocket, published: &str, clie
     assert_eq!(&bytes[..size], b"reply");
     assert_eq!(from.to_string(), published);
 }
-fn dark_udp(client: &UdpSocket, workload: &UdpSocket, published: &str) {
+pub(super) fn dark_udp(client: &UdpSocket, workload: &UdpSocket, published: &str) {
     assert_eq!(client.send_to(b"query", published).unwrap(), 5);
     assert!(workload.recv(&mut [0; 64]).is_err());
 }

package/rust/src/owner_hostgrant_traffic_tests.rs

@@ -0,0 +1,280 @@
+use super::egress_traffic_tests::{
+    allocation, binding, connect, denied, host_policy, ns_ip, protection,
+};
+use super::egress_traffic_tests::{roundtrip, socket};
+use super::router_traffic_tests::connect_from;
+use super::*;
+use crate::egress;
+use serde_json::json;
+use std::io::{Read, Write};
+use std::net::{TcpListener, TcpStream};
+use std::time::Duration;
+
+const WORK: &str = "hg_work";
+const ROUTER: &str = "hg_router";
+const HOST: &str = "hg_host";
+const PEER: &str = "hg_peer";
+
+/// The contract maximum: the two probed grants among 1022 others, so every
+/// admission is a lookup in a full set. TCP and UDP 30000–30510 are members.
+fn grants() -> Vec<egress::HostGrant> {
+    let grant = |protocol: &str, port: u16| egress::HostGrant {
+        protocol: protocol.into(),
+        source_address: "10.240.0.1".into(),
+        destination_address: "10.241.0.2".into(),
+        destination_port: port,
+    };
+    let mut result = vec![grant("tcp", 8080), grant("udp", 5353)];
+    for port in 30000..=30510 {
+        result.push(grant("tcp", port));
+        result.push(grant("udp", port));
+    }
+    assert_eq!(result.len(), 1024);
+    result
+}
+/// One workload behind the router with leased public egress on every port of
+/// both protocols, exactly as a node composes it, so a leased classifier would
+/// claim the workload's replies if host grants were not default-zone flows.
+fn router_policy(revision: u64, granted: bool) -> egress::Policy {
+    let link = binding("work", "10.241.0.1", "veth");
+    let mut generation = allocation();
+    generation["conntrackZone"] = json!(17);
+    generation["conntrackLabel"] = json!("a".repeat(32));
+    generation["grants"] = json!([
+        {"sourceEndpoint":"work","sourcePrefix":"10.241.0.2/32","destination":{"kind":"public","prefix":"0.0.0.0/0"},
+            "protocol":"udp","sourcePort":null,"destinationPort":null,"sourcePortRange":{"first":10000,"last":10015}},
+        {"sourceEndpoint":"work","sourcePrefix":"10.241.0.2/32","destination":{"kind":"public","prefix":"0.0.0.0/0"},
+            "protocol":"tcp","sourcePort":null,"destinationPort":null,"sourcePortRange":{"first":10016,"last":10031}}
+    ]);
+    let mut policy: egress::Policy =
+        serde_json::from_value(json!({"schemaVersion":2,"revision":revision,
+        "scope":{"kind":"routerEgress",
+        "endpoints":[{"id":"work","interfaceIndex":link["interfaceIndex"],"interfaceName":"work",
+            "interfaceKind":"veth","sourcePrefixes":["10.241.0.2/32"]}],
+        "rules":[],"links":[link],"handoff":binding("handoff","10.240.0.2","veth"),
+        "protection":protection(),"generations":[generation]}}))
+        .unwrap();
+    let egress::Scope::RouterEgress(scope) = &mut policy.scope else {
+        panic!()
+    };
+    scope.host_grants = if granted { grants() } else { vec![] };
+    policy
+}
+fn transit_policy(revision: u64, granted: bool) -> egress::Policy {
+    let mut policy = host_policy();
+    policy.revision = revision;
+    let egress::Scope::HostTransit(scope) = &mut policy.scope else {
+        panic!()
+    };
+    scope.host_grants = if granted { grants() } else { vec![] };
+    policy
+}
+fn guard_policy(revision: u64, granted: bool) -> egress::Policy {
+    let mut policy: egress::Policy = serde_json::from_value(egress::tests::pool_guard()).unwrap();
+    policy.revision = revision;
+    let egress::Scope::AllocationPoolGuard(scope) = &mut policy.scope else {
+        panic!()
+    };
+    scope.host_grants = if granted { grants() } else { vec![] };
+    policy
+}
+/// One policy owner in its own namespace; every transition runs there.
+struct Hop {
+    namespace: &'static str,
+    owner: Option<Owner>,
+    applied: Option<Applied>,
+}
+impl Hop {
+    fn new(namespace: &'static str, table: &'static str) -> Self {
+        let owner = in_namespace(namespace, move || Owner::new(options(table)).unwrap());
+        Self {
+            namespace,
+            owner: Some(owner),
+            applied: None,
+        }
+    }
+    fn apply(&mut self, build: fn(u64, bool) -> egress::Policy, revision: u64, granted: bool) {
+        let mut owner = self.owner.take().unwrap();
+        let previous = self.applied.take();
+        let (owner, applied) = in_namespace(self.namespace, move || {
+            let target: Prepared = build(revision, granted).prepare().unwrap().into();
+            target
+                .validate_interfaces()
+                .expect("host grant fixture binding");
+            let applied = owner.reconcile(Transition { previous, target }).unwrap();
+            assert!(owner.inspect().enforced);
+            (owner, applied)
+        });
+        self.owner = Some(owner);
+        self.applied = Some(applied);
+    }
+    fn release(mut self) {
+        let mut owner = self.owner.take().unwrap();
+        let applied = self.applied.take().unwrap();
+        in_namespace(self.namespace, move || {
+            assert!(owner.inspect().enforced);
+            owner.release(applied).unwrap();
+        });
+    }
+}
+/// A host-origin TCP flow from an exact source address. On success the workload
+/// must observe that exact source and exchange data both ways.
+fn dial(
+    source: &'static str,
+    destination: &'static str,
+    listener: &TcpListener,
+) -> Option<(TcpStream, TcpStream)> {
+    let client = in_namespace(HOST, move || connect_from(source, destination)).ok()?;
+    let (server, peer) = listener.accept().unwrap();
+    assert_eq!(peer.ip().to_string(), source.split(':').next().unwrap());
+    let (mut client, mut server) = (client, server);
+    for stream in [&client, &server] {
+        stream
+            .set_read_timeout(Some(Duration::from_secs(1)))
+            .unwrap();
+    }
+    client.write_all(b"ping").unwrap();
+    server.read_exact(&mut [0; 4]).unwrap();
+    server.write_all(b"pong").unwrap();
+    client.read_exact(&mut [0; 4]).unwrap();
+    Some((client, server))
+}
+fn dark(source: &'static str, destination: &'static str, listener: &TcpListener) {
+    assert!(
+        dial(source, destination, listener).is_none(),
+        "{source} -> {destination}"
+    );
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn v2_host_grant_opens_exactly_the_host_to_workload_port_through_guard_transit_and_router() {
+    isolated();
+    for name in [WORK, ROUTER, HOST, PEER] {
+        ip(&["netns", "add", name]);
+        ns_ip(name, &["link", "set", "lo", "up"]);
+        in_namespace(name, || {
+            std::fs::write("/proc/sys/net/ipv4/ip_forward", "1").unwrap()
+        });
+    }
+    connect(
+        WORK,
+        "client",
+        "10.241.0.2/24",
+        ROUTER,
+        "work",
+        "10.241.0.1/24",
+    );
+    connect(
+        ROUTER,
+        "handoff",
+        "10.240.0.2/30",
+        HOST,
+        "router",
+        "10.240.0.1/30",
+    );
+    connect(
+        HOST,
+        "uplink",
+        "192.0.2.2/24",
+        PEER,
+        "underlay",
+        "192.0.2.3/24",
+    );
+    ns_ip(WORK, &["route", "add", "default", "via", "10.241.0.1"]);
+    ns_ip(ROUTER, &["route", "add", "default", "via", "10.240.0.1"]);
+    // The workload route exists throughout, so every later denial is caused by
+    // policy and not by a missing route.
+    ns_ip(
+        HOST,
+        &["route", "add", "10.241.0.0/24", "via", "10.240.0.2"],
+    );
+    let granted_tcp = in_namespace(WORK, || TcpListener::bind("10.241.0.2:8080").unwrap());
+    let other_tcp = in_namespace(WORK, || TcpListener::bind("10.241.0.2:8081").unwrap());
+    let member_tcp = in_namespace(WORK, || TcpListener::bind("10.241.0.2:30300").unwrap());
+    let neighbour_tcp = in_namespace(WORK, || TcpListener::bind("10.241.0.2:30511").unwrap());
+    let host_tcp = in_namespace(HOST, || TcpListener::bind("10.240.0.1:9000").unwrap());
+    let granted_udp = socket(WORK, "10.241.0.2:5353");
+    let other_udp = socket(WORK, "10.241.0.2:5354");
+    let protocol_udp = socket(WORK, "10.241.0.2:8080");
+    // Every UDP probe uses its own socket: an unreplied conntrack entry would
+    // otherwise carry an earlier decision across a policy change.
+    let host_udp = || socket(HOST, "10.240.0.1:0");
+    // Positive controls without policy: every probe below can succeed, including
+    // the foreign source address and the workload-origin dial of the host.
+    assert!(dial("10.240.0.1:0", "10.241.0.2:8080", &granted_tcp).is_some());
+    assert!(dial("10.240.0.1:0", "10.241.0.2:8081", &other_tcp).is_some());
+    assert!(dial("192.0.2.2:0", "10.241.0.2:8080", &granted_tcp).is_some());
+    assert!(dial("10.240.0.1:0", "10.241.0.2:30511", &neighbour_tcp).is_some());
+    roundtrip(&host_udp(), &granted_udp);
+    roundtrip(&host_udp(), &other_udp);
+    roundtrip(&host_udp(), &protocol_udp);
+    let workload_dial = |expected: bool| {
+        let result = in_namespace(WORK, || {
+            TcpStream::connect_timeout(&"10.240.0.1:9000".parse().unwrap(), Duration::from_secs(1))
+        });
+        assert_eq!(result.is_ok(), expected);
+        if expected {
+            host_tcp.accept().unwrap();
+        }
+    };
+    workload_dial(true);
+
+    let mut guard = Hop::new(HOST, "host_grant_guard");
+    let mut transit = Hop::new(HOST, "host_grant_transit");
+    let mut router = Hop::new(ROUTER, "host_grant_router");
+    guard.apply(guard_policy, 1, false);
+    transit.apply(transit_policy, 1, false);
+    router.apply(router_policy, 1, false);
+    // Without grants the host never reaches the workload pool.
+    dark("10.240.0.1:0", "10.241.0.2:8080", &granted_tcp);
+    denied(&host_udp(), &granted_udp, true);
+
+    // Transit and router grants alone do not pass the host-wide guard.
+    transit.apply(transit_policy, 2, true);
+    router.apply(router_policy, 2, true);
+    dark("10.240.0.1:0", "10.241.0.2:8080", &granted_tcp);
+    denied(&host_udp(), &granted_udp, true);
+
+    // With the guard exception the exact tuples pass all three tables, and the
+    // workload's replies return in the default zone despite leased egress on
+    // every port of both protocols.
+    guard.apply(guard_policy, 2, true);
+    let (mut established, mut served) =
+        dial("10.240.0.1:0", "10.241.0.2:8080", &granted_tcp).expect("granted host tcp");
+    let observed = roundtrip(&host_udp(), &granted_udp);
+    assert_eq!(observed.ip().to_string(), "10.240.0.1");
+    // Any member of the full set passes; the tuple just outside it does not.
+    assert!(dial("10.240.0.1:0", "10.241.0.2:30300", &member_tcp).is_some());
+    dark("10.240.0.1:0", "10.241.0.2:30511", &neighbour_tcp);
+    // Another port, protocol, source address or direction stays blocked.
+    dark("10.240.0.1:0", "10.241.0.2:8081", &other_tcp);
+    denied(&host_udp(), &other_udp, true);
+    denied(&host_udp(), &protocol_udp, true);
+    dark("192.0.2.2:0", "10.241.0.2:8080", &granted_tcp);
+    workload_dial(false);
+
+    // The router hop is independently required: withdrawing only its grants
+    // closes the path behind the host's own tables, and re-granting reopens it.
+    router.apply(router_policy, 3, false);
+    dark("10.240.0.1:0", "10.241.0.2:8080", &granted_tcp);
+    denied(&host_udp(), &granted_udp, false);
+    router.apply(router_policy, 4, true);
+    assert!(dial("10.240.0.1:0", "10.241.0.2:8080", &granted_tcp).is_some());
+
+    // Withdrawal in every scope closes new flows and the established one.
+    guard.apply(guard_policy, 3, false);
+    transit.apply(transit_policy, 3, false);
+    router.apply(router_policy, 5, false);
+    dark("10.240.0.1:0", "10.241.0.2:8080", &granted_tcp);
+    denied(&host_udp(), &granted_udp, true);
+    established.write_all(b"late").unwrap();
+    assert!(served.read_exact(&mut [0; 4]).is_err());
+    drop(established);
+    drop(served);
+
+    router.release();
+    transit.release();
+    guard.release();
+    println!("V2_HOST_GRANT_PROOF grants_per_scope=1024 set_member=true set_neighbour_denied=true positive_controls=true ungranted_dark=true guard_required=true exact_tcp=true exact_udp=true source_preserved=true other_port_denied=true other_protocol_denied=true other_source_denied=true workload_origin_denied=true router_required=true regranted=true withdrawn_dark=true established_withdrawn=true");
+}

package/rust/src/owner_identity_tests.rs

@@ -1,4 +1,4 @@
-use super::rule_identity;
+use super::{element_keys, rule_identity, set_identity};
 use crate::wire::{self, Attr};
 
 fn expression(name: &str, data: Vec<Attr>) -> Attr {
@@ -204,3 +204,127 @@ fn published_host_graph_identity_preserves_destination_nat_and_admission_operand
         changed.iter().filter(|(chain, _)| chain == "forward").count()
     );
 }
+
+/// A published router generation must survive the same apply-time graph identity
+/// as the rest of the table: the kernel dump is compared operand by operand, so
+/// the workload translation and its admissions cannot be silently rewritten.
+#[test]
+fn published_router_graph_identity_preserves_destination_nat_and_admission_operands() {
+    let compiled = |endpoint_port: u16| {
+        let value = crate::egress::tests::published_router(serde_json::json!([
+            crate::egress::tests::router_published_port("tcp", 443, endpoint_port)
+        ]));
+        let prepared = serde_json::from_value::<crate::egress::Policy>(value)
+            .unwrap()
+            .prepare()
+            .unwrap();
+        let mut chains = Vec::new();
+        let mut rules = Vec::new();
+        for (kind, attributes) in prepared.program("snft_identity").unwrap() {
+            if kind == 3 {
+                chains.push(super::chain_identity(&attributes).unwrap());
+            } else {
+                rules.push(rule_identity(&attributes).unwrap());
+            }
+        }
+        (chains, rules)
+    };
+    let (chains, rules) = compiled(8443);
+    assert_eq!(rules.iter().filter(|(chain, _)| chain == "pre").count(), 1);
+    assert_eq!(chains.len(), 16);
+    let translation = rules.iter().find(|(chain, _)| chain == "pre").unwrap();
+    let (_, changed) = compiled(9443);
+    let other = changed.iter().find(|(chain, _)| chain == "pre").unwrap();
+    assert_ne!(translation.1, other.1);
+    assert_eq!(
+        rules.iter().filter(|(chain, _)| chain == "forward").count(),
+        changed.iter().filter(|(chain, _)| chain == "forward").count()
+    );
+    // The handoff ingress classification is part of the same identity.
+    assert_eq!(
+        rules.iter().filter(|(chain, _)| chain == "raw_return").count(),
+        changed
+            .iter()
+            .filter(|(chain, _)| chain == "raw_return")
+            .count()
+    );
+}
+
+/// A host-grant set as Linux dumps it: the compiled creation plus the kernel's
+/// handle, an empty description, the backend type and the element count.
+fn dumped_set(created: &[Attr]) -> Vec<Attr> {
+    let mut dump: Vec<Attr> = created.iter().filter(|attribute| attribute.id() != 10).cloned().collect();
+    dump.push(Attr::u64(16, 7));
+    dump.push(Attr::nested(9, vec![]));
+    dump.push(Attr::string(19, "nft_rhash_type"));
+    dump.push(Attr::u32(20, 1024));
+    dump
+}
+
+#[test]
+fn host_grant_sets_elements_and_lookups_have_exact_graph_identity() {
+    let prepared = serde_json::from_value::<crate::egress::Policy>(
+        crate::egress::hostgrant_tests::granted(
+            crate::egress::tests::router(),
+            serde_json::json!([crate::egress::hostgrant_tests::host_grant("tcp", "10.240.0.1", "10.241.0.2", 8080)]),
+        ),
+    )
+    .unwrap()
+    .prepare()
+    .unwrap();
+    let program = prepared.program("snft_identity").unwrap();
+    let sets: Vec<_> = program.iter().filter(|(kind, _)| *kind == 9).map(|(_, attributes)| attributes.clone()).collect();
+    assert_eq!(sets.len(), 2);
+    for created in &sets {
+        // The kernel's informational attributes are not identity.
+        assert_eq!(set_identity(created).unwrap(), set_identity(&dumped_set(created)).unwrap());
+        // A changed key length, flag or any unknown attribute is a different set.
+        for (id, value) in [(5, Attr::u32(5, 4)), (3, Attr::u32(3, 0))] {
+            let mut changed: Vec<_> = created.iter().filter(|attribute| attribute.id() != id).cloned().collect();
+            changed.push(value);
+            assert_ne!(set_identity(&changed).unwrap(), set_identity(created).unwrap());
+        }
+        for foreign in [
+            Attr::u64(11, 1000),
+            Attr::bytes(13, b"foreign".to_vec()),
+            Attr::nested(9, vec![Attr::u32(1, 64)]),
+        ] {
+            let mut changed = dumped_set(created);
+            changed.push(foreign);
+            assert!(set_identity(&changed).is_err());
+        }
+    }
+    // Elements are plain keys; any extension rejects.
+    let (_, elements) = program.iter().find(|(kind, _)| *kind == 12).unwrap();
+    let list = wire::attrs(&wire::one(elements, 3).unwrap().value).unwrap();
+    assert_eq!(element_keys(&list).unwrap().len(), 1);
+    let key = wire::attrs(&list[0].value).unwrap();
+    for extension in [Attr::u32(3, 1), Attr::nested(2, vec![Attr::bytes(1, vec![1; 4])])] {
+        let mut changed = key.clone();
+        changed.push(extension);
+        assert!(element_keys(&[Attr::nested(1, changed)]).is_err());
+    }
+    // Every lookup names its set with a plain, uninverted membership test, and
+    // the key registers are part of identity.
+    let lookups: Vec<_> = program
+        .iter()
+        .filter(|(kind, attributes)| *kind == 6 && rule_identity(attributes).unwrap().1.windows(6).any(|window| window == b"lookup"))
+        .collect();
+    assert_eq!(lookups.len(), 5);
+    let lookup = |data: Vec<Attr>| rule(vec![expression("lookup", data)]);
+    let exact = vec![Attr::string(1, "host_grant"), Attr::u32(2, 1), Attr::u32(5, 0)];
+    let identity = rule_identity(&lookup(exact.clone())).unwrap();
+    for changed in [
+        vec![Attr::string(1, "host_grant_arrival"), Attr::u32(2, 1), Attr::u32(5, 0)],
+        vec![Attr::string(1, "host_grant"), Attr::u32(2, 9), Attr::u32(5, 0)],
+    ] {
+        assert_ne!(rule_identity(&lookup(changed)).unwrap(), identity);
+    }
+    for invalid in [
+        vec![Attr::string(1, "host_grant"), Attr::u32(2, 1), Attr::u32(5, 1)],
+        vec![Attr::string(1, "host_grant"), Attr::u32(2, 1)],
+        vec![Attr::string(1, "host_grant"), Attr::u32(2, 1), Attr::u32(3, 2), Attr::u32(5, 0)],
+    ] {
+        assert!(rule_identity(&lookup(invalid)).is_err());
+    }
+}

package/rust/src/owner_poolguard_tests.rs

@@ -24,6 +24,75 @@ fn allocation_pool_guard_maximum_graph_persist_and_lost_ack_recovery() {
     super::egress_tests::recover("pools_v2", serde_json::from_value(policy).unwrap());
 }
 
+/// A full host-grant set persists, is re-verified element by element by a fresh
+/// owner, and is replaced and released exactly like the rest of the graph.
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn allocation_pool_guard_host_grant_set_persist_and_lost_ack_recovery() {
+    isolated();
+    let grants: Vec<_> = (0..1024_u16)
+        .map(|index| crate::egress::hostgrant_tests::host_grant(
+            if index % 2 == 0 { "tcp" } else { "udp" },
+            "10.240.0.1",
+            "10.241.0.2",
+            20000 + index / 2,
+        ))
+        .collect();
+    let policy = crate::egress::hostgrant_tests::granted(egress::tests::pool_guard(), json!(grants));
+    super::egress_tests::recover("grant_pools_v2", serde_json::from_value(policy).unwrap());
+}
+
+/// The set is CONSTANT and bound: even after the owning socket is gone, another
+/// privileged socket cannot add or remove a grant, and a fresh owner verifies
+/// the exact element set before adopting it.
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn allocation_pool_guard_host_grant_set_rejects_foreign_element_changes() {
+    isolated();
+    let grant = crate::egress::hostgrant_tests::host_grant("tcp", "10.240.0.1", "10.241.0.2", 8080);
+    let policy: egress::Policy = serde_json::from_value(crate::egress::hostgrant_tests::granted(
+        egress::tests::pool_guard(),
+        json!([grant]),
+    ))
+    .unwrap();
+    let prepared: Prepared = policy.prepare().unwrap().into();
+    let mut owner = Owner::new(options("grant_pool_foreign")).unwrap();
+    let applied = owner
+        .reconcile(Transition { previous: None, target: prepared.clone() })
+        .unwrap();
+    drop(owner);
+    let table = "snft_grant_pool_foreign";
+    let (_, elements) = prepared
+        .program(table)
+        .unwrap()
+        .into_iter()
+        .find(|(kind, _)| *kind == 12)
+        .unwrap();
+    let list = wire::attrs(&wire::one(&elements, 3).unwrap().value).unwrap();
+    let key = wire::attrs(&wire::attrs(&list[0].value).unwrap()[0].value).unwrap()[0].value.clone();
+    let mut foreign = key.clone();
+    foreign[16] ^= 1;
+    let element = |key: Vec<u8>| {
+        vec![
+            Attr::string(1, table),
+            Attr::string(2, "host_grant"),
+            Attr::nested(3, vec![Attr::nested(1, vec![Attr::nested(1, vec![Attr::bytes(1, key)])])]),
+        ]
+    };
+    let mut socket = wire::Socket::open().unwrap();
+    for (operation, key) in [(12, foreign), (14, key)] {
+        let generation = socket.generation().unwrap();
+        assert!(socket.batch(generation, vec![(operation, 0x600, element(key))]).is_err());
+    }
+    let mut owner = Owner::new(options("grant_pool_foreign")).unwrap();
+    let recovered = owner
+        .reconcile(Transition { previous: None, target: prepared })
+        .unwrap();
+    assert_eq!(recovered.receipt.table_handle, applied.receipt.table_handle);
+    assert!(owner.inspect().enforced);
+    owner.release(recovered).unwrap();
+}
+
 // Foreign capture controls exist only in this offline guest. They are never
 // composed into or removed with the managed policy under test.
 fn foreign_captures() {