@push.rocks/smartnftables 2.4.0 → 2.5.0

package/rust/src/main.rs

@@ -11,6 +11,10 @@ mod wire;
 use serde::Deserialize;
 use std::io::{BufRead, Read, Write};
 
+/// One request line from the facade; the facade's `managedIpcBytes` bounds the
+/// same lines. A transition carries two complete policies.
+pub(crate) const IPC_BYTES: usize = 1_048_576;
+
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum Error {
     Invalid,
@@ -141,12 +145,12 @@ fn main() {
     loop {
         let mut bytes = Vec::new();
         let read = std::io::Read::by_ref(&mut input)
-            .take(262_145)
+            .take(IPC_BYTES as u64 + 1)
             .read_until(b'\n', &mut bytes);
         if matches!(read, Ok(0)) {
             break;
         }
-        if read.is_err() || bytes.len() > 262_144 || bytes.last() != Some(&b'\n') {
+        if read.is_err() || bytes.len() > IPC_BYTES || bytes.last() != Some(&b'\n') {
             std::process::exit(2);
         }
         let request: Request = match serde_json::from_slice(&bytes) {

package/rust/src/owner.rs

@@ -66,6 +66,8 @@ struct Graph {
     table: Vec<Attr>,
     chains: Vec<Vec<Attr>>,
     rules: Vec<Vec<Attr>>,
+    /// Each named set with the key of every element it holds.
+    sets: Vec<(Vec<Attr>, Vec<Vec<u8>>)>,
 }
 pub struct Owner {
     identity: Identity,
@@ -220,8 +222,31 @@ impl Owner {
                 }
             }
             let rules = socket.query(7, vec![Attr::string(1, &table_name)], true)?;
+            // Set dumps select the table. Every element is read back, so a set
+            // whose content differs from the compiled target never verifies.
+            let mut sets = Vec::new();
+            for set in socket.query(10, vec![Attr::string(1, &table_name)], true)? {
+                if wire::text(&set, 1)? != table_name {
+                    return Err(Error::Conflict);
+                }
+                let name = wire::text(&set, 2)?;
+                let mut keys = Vec::new();
+                for message in socket.query(
+                    13,
+                    vec![Attr::string(1, &table_name), Attr::string(2, &name)],
+                    true,
+                )? {
+                    if wire::text(&message, 1)? != table_name || wire::text(&message, 2)? != name {
+                        return Err(Error::Conflict);
+                    }
+                    if let Ok(list) = wire::one(&message, 3) {
+                        keys.extend(element_keys(&wire::attrs(&list.value)?)?);
+                    }
+                }
+                sets.push((set, keys));
+            }
             // The managed compiler never creates any of these. Foreign objects reject.
-            for operation in [10, 19, 23] {
+            for operation in [19, 23] {
                 if !socket
                     .query(operation, vec![Attr::string(1, &table_name)], true)?
                     .is_empty()
@@ -235,6 +260,7 @@ impl Owner {
                     table,
                     chains,
                     rules,
+                    sets,
                 }));
             }
         }
@@ -310,7 +336,37 @@ impl Owner {
             }
             result
         };
-        Ok(expected_chains == actual_chains && regroup(expected_rules) == regroup(actual_rules))
+        // Element order is the set backend's; element keys are the identity.
+        let mut expected_sets = std::collections::BTreeMap::<String, (Vec<u8>, Vec<Vec<u8>>)>::new();
+        for (kind, attrs) in &program {
+            match kind {
+                9 => {
+                    expected_sets.insert(wire::text(attrs, 2)?, (set_identity(attrs)?, Vec::new()));
+                }
+                12 => {
+                    let entry = expected_sets
+                        .get_mut(&wire::text(attrs, 2)?)
+                        .ok_or(Error::Invalid)?;
+                    entry.1.extend(element_keys(&wire::attrs(&wire::one(attrs, 3)?.value)?)?);
+                }
+                _ => {}
+            }
+        }
+        let mut actual_sets = std::collections::BTreeMap::new();
+        for (attrs, keys) in &graph.sets {
+            if actual_sets
+                .insert(wire::text(attrs, 2)?, (set_identity(attrs)?, keys.clone()))
+                .is_some()
+            {
+                return Err(Error::Conflict);
+            }
+        }
+        for entry in expected_sets.values_mut().chain(actual_sets.values_mut()) {
+            entry.1.sort();
+        }
+        Ok(expected_chains == actual_chains
+            && regroup(expected_rules) == regroup(actual_rules)
+            && expected_sets == actual_sets)
     }
     fn adopt(&mut self, graph: Graph, transition: &Transition) -> Result<Graph> {
         self.binding(&graph, transition.previous.as_ref())?;
@@ -437,6 +493,17 @@ impl Owner {
                     ],
                 ));
             }
+            // After every rule that binds it; deleting a set deletes its elements.
+            for (set, _) in &graph.sets {
+                operations.push((
+                    11,
+                    0,
+                    vec![
+                        Attr::string(1, &table_name),
+                        Attr::u64(16, wire::handle(set, 16)?),
+                    ],
+                ));
+            }
             graph.generation
         } else {
             if transition.previous.is_some() || self.applied.is_some() {
@@ -454,9 +521,10 @@ impl Owner {
             self.socket()?.generation()?
         };
         for (operation, attributes) in transition.target.program(&table_name)? {
+            // Chains, sets and elements are created exclusively; rules append.
             operations.push((
                 operation,
-                if operation == 3 { 0x600 } else { 0xc00 },
+                if operation == 6 { 0xc00 } else { 0x600 },
                 attributes,
             ));
         }
@@ -612,6 +680,41 @@ fn chain_identity(attributes: &[Attr]) -> Result<Vec<u8>> {
     }
     serde_json::to_vec(&wire::canonical(&identity, false)?).map_err(|_| Error::Protocol)
 }
+/// A set is its table, name, flags, key type and key length. The handle, the
+/// informational backend type and count, the transaction ID and an empty
+/// description are not identity; anything else rejects.
+fn set_identity(attributes: &[Attr]) -> Result<Vec<u8>> {
+    let mut identity = Vec::new();
+    for attribute in attributes {
+        match attribute.id() {
+            10 | 16 | 19 | 20 => {}
+            9 if wire::attrs(&attribute.value)?.is_empty() => {}
+            1..=5 => identity.push(attribute.clone()),
+            _ => return Err(Error::Conflict),
+        }
+    }
+    for id in [1, 2, 3, 4, 5] {
+        wire::one(&identity, id)?;
+    }
+    serde_json::to_vec(&wire::canonical(&identity, false)?).map_err(|_| Error::Protocol)
+}
+/// Only plain keys: an element with data, flags, timeouts, expressions or any
+/// other extension is not one the compiler created.
+fn element_keys(list: &[Attr]) -> Result<Vec<Vec<u8>>> {
+    let mut keys = Vec::new();
+    for element in list {
+        let fields = wire::attrs(&element.value)?;
+        if element.id() != 1 || fields.len() != 1 {
+            return Err(Error::Conflict);
+        }
+        let key = wire::attrs(&wire::one(&fields, 1)?.value)?;
+        if key.len() != 1 {
+            return Err(Error::Conflict);
+        }
+        keys.push(wire::one(&key, 1)?.value.clone());
+    }
+    Ok(keys)
+}
 fn rule_identity(attributes: &[Attr]) -> Result<(String, Vec<u8>)> {
     let chain = wire::text(attributes, 2)?;
     if attributes
@@ -638,7 +741,7 @@ fn rule_identity(attributes: &[Attr]) -> Result<(String, Vec<u8>)> {
             "cmp" => &[3],
             "bitwise" => &[4, 5],
             "range" => &[3, 4],
-            "meta" | "payload" | "ct" | "nat" => &[],
+            "meta" | "payload" | "ct" | "nat" | "lookup" => &[],
             _ => return Err(Error::Conflict),
         };
         for attribute in &mut data {
@@ -669,6 +772,7 @@ fn rule_identity(attributes: &[Attr]) -> Result<(String, Vec<u8>)> {
 /// neither unknown fields nor default repair may hide a changed kernel rule.
 fn validate_egress_expression(name: &str, data: &[Attr]) -> Result<()> {
     let allowed: &[u16] = match name {
+        "lookup" => &[1, 2, 5],
         "ct" | "range" => &[1, 2, 3, 4],
         "nat" => &[1, 2, 3, 4, 5, 6, 7],
         _ => return Ok(()),
@@ -680,6 +784,14 @@ fn validate_egress_expression(name: &str, data: &[Attr]) -> Result<()> {
         wire::one(data, attribute.id())?; // Duplicate fields are never canonical identity.
     }
     match name {
+        "lookup" => {
+            // A plain membership test of a named set: no map, no inversion.
+            wire::text(data, 1)?;
+            wire::number(data, 2)?;
+            if data.len() != 3 || wire::number(data, 5)? != 0 {
+                return Err(Error::Conflict);
+            }
+        }
         "ct" => {
             let read = data.iter().any(|item| item.id() == 1);
             let write = data.iter().any(|item| item.id() == 4);

package/rust/src/owner_egress_tests.rs

@@ -85,7 +85,7 @@ pub(super) fn recover(name: &str, policy: egress::Policy) {
                         chain_identity(actual),
                         "chain {name}"
                     );
-                } else {
+                } else if kind == 6 {
                     let stamp = &wire::one(&expected, 7).unwrap().value;
                     let actual = graph
                         .rules

package/rust/src/owner_hostgrant_traffic_tests.rs

@@ -0,0 +1,280 @@
+use super::egress_traffic_tests::{
+    allocation, binding, connect, denied, host_policy, ns_ip, protection,
+};
+use super::egress_traffic_tests::{roundtrip, socket};
+use super::router_traffic_tests::connect_from;
+use super::*;
+use crate::egress;
+use serde_json::json;
+use std::io::{Read, Write};
+use std::net::{TcpListener, TcpStream};
+use std::time::Duration;
+
+const WORK: &str = "hg_work";
+const ROUTER: &str = "hg_router";
+const HOST: &str = "hg_host";
+const PEER: &str = "hg_peer";
+
+/// The contract maximum: the two probed grants among 1022 others, so every
+/// admission is a lookup in a full set. TCP and UDP 30000–30510 are members.
+fn grants() -> Vec<egress::HostGrant> {
+    let grant = |protocol: &str, port: u16| egress::HostGrant {
+        protocol: protocol.into(),
+        source_address: "10.240.0.1".into(),
+        destination_address: "10.241.0.2".into(),
+        destination_port: port,
+    };
+    let mut result = vec![grant("tcp", 8080), grant("udp", 5353)];
+    for port in 30000..=30510 {
+        result.push(grant("tcp", port));
+        result.push(grant("udp", port));
+    }
+    assert_eq!(result.len(), 1024);
+    result
+}
+/// One workload behind the router with leased public egress on every port of
+/// both protocols, exactly as a node composes it, so a leased classifier would
+/// claim the workload's replies if host grants were not default-zone flows.
+fn router_policy(revision: u64, granted: bool) -> egress::Policy {
+    let link = binding("work", "10.241.0.1", "veth");
+    let mut generation = allocation();
+    generation["conntrackZone"] = json!(17);
+    generation["conntrackLabel"] = json!("a".repeat(32));
+    generation["grants"] = json!([
+        {"sourceEndpoint":"work","sourcePrefix":"10.241.0.2/32","destination":{"kind":"public","prefix":"0.0.0.0/0"},
+            "protocol":"udp","sourcePort":null,"destinationPort":null,"sourcePortRange":{"first":10000,"last":10015}},
+        {"sourceEndpoint":"work","sourcePrefix":"10.241.0.2/32","destination":{"kind":"public","prefix":"0.0.0.0/0"},
+            "protocol":"tcp","sourcePort":null,"destinationPort":null,"sourcePortRange":{"first":10016,"last":10031}}
+    ]);
+    let mut policy: egress::Policy =
+        serde_json::from_value(json!({"schemaVersion":2,"revision":revision,
+        "scope":{"kind":"routerEgress",
+        "endpoints":[{"id":"work","interfaceIndex":link["interfaceIndex"],"interfaceName":"work",
+            "interfaceKind":"veth","sourcePrefixes":["10.241.0.2/32"]}],
+        "rules":[],"links":[link],"handoff":binding("handoff","10.240.0.2","veth"),
+        "protection":protection(),"generations":[generation]}}))
+        .unwrap();
+    let egress::Scope::RouterEgress(scope) = &mut policy.scope else {
+        panic!()
+    };
+    scope.host_grants = if granted { grants() } else { vec![] };
+    policy
+}
+fn transit_policy(revision: u64, granted: bool) -> egress::Policy {
+    let mut policy = host_policy();
+    policy.revision = revision;
+    let egress::Scope::HostTransit(scope) = &mut policy.scope else {
+        panic!()
+    };
+    scope.host_grants = if granted { grants() } else { vec![] };
+    policy
+}
+fn guard_policy(revision: u64, granted: bool) -> egress::Policy {
+    let mut policy: egress::Policy = serde_json::from_value(egress::tests::pool_guard()).unwrap();
+    policy.revision = revision;
+    let egress::Scope::AllocationPoolGuard(scope) = &mut policy.scope else {
+        panic!()
+    };
+    scope.host_grants = if granted { grants() } else { vec![] };
+    policy
+}
+/// One policy owner in its own namespace; every transition runs there.
+struct Hop {
+    namespace: &'static str,
+    owner: Option<Owner>,
+    applied: Option<Applied>,
+}
+impl Hop {
+    fn new(namespace: &'static str, table: &'static str) -> Self {
+        let owner = in_namespace(namespace, move || Owner::new(options(table)).unwrap());
+        Self {
+            namespace,
+            owner: Some(owner),
+            applied: None,
+        }
+    }
+    fn apply(&mut self, build: fn(u64, bool) -> egress::Policy, revision: u64, granted: bool) {
+        let mut owner = self.owner.take().unwrap();
+        let previous = self.applied.take();
+        let (owner, applied) = in_namespace(self.namespace, move || {
+            let target: Prepared = build(revision, granted).prepare().unwrap().into();
+            target
+                .validate_interfaces()
+                .expect("host grant fixture binding");
+            let applied = owner.reconcile(Transition { previous, target }).unwrap();
+            assert!(owner.inspect().enforced);
+            (owner, applied)
+        });
+        self.owner = Some(owner);
+        self.applied = Some(applied);
+    }
+    fn release(mut self) {
+        let mut owner = self.owner.take().unwrap();
+        let applied = self.applied.take().unwrap();
+        in_namespace(self.namespace, move || {
+            assert!(owner.inspect().enforced);
+            owner.release(applied).unwrap();
+        });
+    }
+}
+/// A host-origin TCP flow from an exact source address. On success the workload
+/// must observe that exact source and exchange data both ways.
+fn dial(
+    source: &'static str,
+    destination: &'static str,
+    listener: &TcpListener,
+) -> Option<(TcpStream, TcpStream)> {
+    let client = in_namespace(HOST, move || connect_from(source, destination)).ok()?;
+    let (server, peer) = listener.accept().unwrap();
+    assert_eq!(peer.ip().to_string(), source.split(':').next().unwrap());
+    let (mut client, mut server) = (client, server);
+    for stream in [&client, &server] {
+        stream
+            .set_read_timeout(Some(Duration::from_secs(1)))
+            .unwrap();
+    }
+    client.write_all(b"ping").unwrap();
+    server.read_exact(&mut [0; 4]).unwrap();
+    server.write_all(b"pong").unwrap();
+    client.read_exact(&mut [0; 4]).unwrap();
+    Some((client, server))
+}
+fn dark(source: &'static str, destination: &'static str, listener: &TcpListener) {
+    assert!(
+        dial(source, destination, listener).is_none(),
+        "{source} -> {destination}"
+    );
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn v2_host_grant_opens_exactly_the_host_to_workload_port_through_guard_transit_and_router() {
+    isolated();
+    for name in [WORK, ROUTER, HOST, PEER] {
+        ip(&["netns", "add", name]);
+        ns_ip(name, &["link", "set", "lo", "up"]);
+        in_namespace(name, || {
+            std::fs::write("/proc/sys/net/ipv4/ip_forward", "1").unwrap()
+        });
+    }
+    connect(
+        WORK,
+        "client",
+        "10.241.0.2/24",
+        ROUTER,
+        "work",
+        "10.241.0.1/24",
+    );
+    connect(
+        ROUTER,
+        "handoff",
+        "10.240.0.2/30",
+        HOST,
+        "router",
+        "10.240.0.1/30",
+    );
+    connect(
+        HOST,
+        "uplink",
+        "192.0.2.2/24",
+        PEER,
+        "underlay",
+        "192.0.2.3/24",
+    );
+    ns_ip(WORK, &["route", "add", "default", "via", "10.241.0.1"]);
+    ns_ip(ROUTER, &["route", "add", "default", "via", "10.240.0.1"]);
+    // The workload route exists throughout, so every later denial is caused by
+    // policy and not by a missing route.
+    ns_ip(
+        HOST,
+        &["route", "add", "10.241.0.0/24", "via", "10.240.0.2"],
+    );
+    let granted_tcp = in_namespace(WORK, || TcpListener::bind("10.241.0.2:8080").unwrap());
+    let other_tcp = in_namespace(WORK, || TcpListener::bind("10.241.0.2:8081").unwrap());
+    let member_tcp = in_namespace(WORK, || TcpListener::bind("10.241.0.2:30300").unwrap());
+    let neighbour_tcp = in_namespace(WORK, || TcpListener::bind("10.241.0.2:30511").unwrap());
+    let host_tcp = in_namespace(HOST, || TcpListener::bind("10.240.0.1:9000").unwrap());
+    let granted_udp = socket(WORK, "10.241.0.2:5353");
+    let other_udp = socket(WORK, "10.241.0.2:5354");
+    let protocol_udp = socket(WORK, "10.241.0.2:8080");
+    // Every UDP probe uses its own socket: an unreplied conntrack entry would
+    // otherwise carry an earlier decision across a policy change.
+    let host_udp = || socket(HOST, "10.240.0.1:0");
+    // Positive controls without policy: every probe below can succeed, including
+    // the foreign source address and the workload-origin dial of the host.
+    assert!(dial("10.240.0.1:0", "10.241.0.2:8080", &granted_tcp).is_some());
+    assert!(dial("10.240.0.1:0", "10.241.0.2:8081", &other_tcp).is_some());
+    assert!(dial("192.0.2.2:0", "10.241.0.2:8080", &granted_tcp).is_some());
+    assert!(dial("10.240.0.1:0", "10.241.0.2:30511", &neighbour_tcp).is_some());
+    roundtrip(&host_udp(), &granted_udp);
+    roundtrip(&host_udp(), &other_udp);
+    roundtrip(&host_udp(), &protocol_udp);
+    let workload_dial = |expected: bool| {
+        let result = in_namespace(WORK, || {
+            TcpStream::connect_timeout(&"10.240.0.1:9000".parse().unwrap(), Duration::from_secs(1))
+        });
+        assert_eq!(result.is_ok(), expected);
+        if expected {
+            host_tcp.accept().unwrap();
+        }
+    };
+    workload_dial(true);
+
+    let mut guard = Hop::new(HOST, "host_grant_guard");
+    let mut transit = Hop::new(HOST, "host_grant_transit");
+    let mut router = Hop::new(ROUTER, "host_grant_router");
+    guard.apply(guard_policy, 1, false);
+    transit.apply(transit_policy, 1, false);
+    router.apply(router_policy, 1, false);
+    // Without grants the host never reaches the workload pool.
+    dark("10.240.0.1:0", "10.241.0.2:8080", &granted_tcp);
+    denied(&host_udp(), &granted_udp, true);
+
+    // Transit and router grants alone do not pass the host-wide guard.
+    transit.apply(transit_policy, 2, true);
+    router.apply(router_policy, 2, true);
+    dark("10.240.0.1:0", "10.241.0.2:8080", &granted_tcp);
+    denied(&host_udp(), &granted_udp, true);
+
+    // With the guard exception the exact tuples pass all three tables, and the
+    // workload's replies return in the default zone despite leased egress on
+    // every port of both protocols.
+    guard.apply(guard_policy, 2, true);
+    let (mut established, mut served) =
+        dial("10.240.0.1:0", "10.241.0.2:8080", &granted_tcp).expect("granted host tcp");
+    let observed = roundtrip(&host_udp(), &granted_udp);
+    assert_eq!(observed.ip().to_string(), "10.240.0.1");
+    // Any member of the full set passes; the tuple just outside it does not.
+    assert!(dial("10.240.0.1:0", "10.241.0.2:30300", &member_tcp).is_some());
+    dark("10.240.0.1:0", "10.241.0.2:30511", &neighbour_tcp);
+    // Another port, protocol, source address or direction stays blocked.
+    dark("10.240.0.1:0", "10.241.0.2:8081", &other_tcp);
+    denied(&host_udp(), &other_udp, true);
+    denied(&host_udp(), &protocol_udp, true);
+    dark("192.0.2.2:0", "10.241.0.2:8080", &granted_tcp);
+    workload_dial(false);
+
+    // The router hop is independently required: withdrawing only its grants
+    // closes the path behind the host's own tables, and re-granting reopens it.
+    router.apply(router_policy, 3, false);
+    dark("10.240.0.1:0", "10.241.0.2:8080", &granted_tcp);
+    denied(&host_udp(), &granted_udp, false);
+    router.apply(router_policy, 4, true);
+    assert!(dial("10.240.0.1:0", "10.241.0.2:8080", &granted_tcp).is_some());
+
+    // Withdrawal in every scope closes new flows and the established one.
+    guard.apply(guard_policy, 3, false);
+    transit.apply(transit_policy, 3, false);
+    router.apply(router_policy, 5, false);
+    dark("10.240.0.1:0", "10.241.0.2:8080", &granted_tcp);
+    denied(&host_udp(), &granted_udp, true);
+    established.write_all(b"late").unwrap();
+    assert!(served.read_exact(&mut [0; 4]).is_err());
+    drop(established);
+    drop(served);
+
+    router.release();
+    transit.release();
+    guard.release();
+    println!("V2_HOST_GRANT_PROOF grants_per_scope=1024 set_member=true set_neighbour_denied=true positive_controls=true ungranted_dark=true guard_required=true exact_tcp=true exact_udp=true source_preserved=true other_port_denied=true other_protocol_denied=true other_source_denied=true workload_origin_denied=true router_required=true regranted=true withdrawn_dark=true established_withdrawn=true");
+}

package/rust/src/owner_identity_tests.rs

@@ -1,4 +1,4 @@
-use super::rule_identity;
+use super::{element_keys, rule_identity, set_identity};
 use crate::wire::{self, Attr};
 
 fn expression(name: &str, data: Vec<Attr>) -> Attr {
@@ -249,3 +249,82 @@ fn published_router_graph_identity_preserves_destination_nat_and_admission_opera
             .count()
     );
 }
+
+/// A host-grant set as Linux dumps it: the compiled creation plus the kernel's
+/// handle, an empty description, the backend type and the element count.
+fn dumped_set(created: &[Attr]) -> Vec<Attr> {
+    let mut dump: Vec<Attr> = created.iter().filter(|attribute| attribute.id() != 10).cloned().collect();
+    dump.push(Attr::u64(16, 7));
+    dump.push(Attr::nested(9, vec![]));
+    dump.push(Attr::string(19, "nft_rhash_type"));
+    dump.push(Attr::u32(20, 1024));
+    dump
+}
+
+#[test]
+fn host_grant_sets_elements_and_lookups_have_exact_graph_identity() {
+    let prepared = serde_json::from_value::<crate::egress::Policy>(
+        crate::egress::hostgrant_tests::granted(
+            crate::egress::tests::router(),
+            serde_json::json!([crate::egress::hostgrant_tests::host_grant("tcp", "10.240.0.1", "10.241.0.2", 8080)]),
+        ),
+    )
+    .unwrap()
+    .prepare()
+    .unwrap();
+    let program = prepared.program("snft_identity").unwrap();
+    let sets: Vec<_> = program.iter().filter(|(kind, _)| *kind == 9).map(|(_, attributes)| attributes.clone()).collect();
+    assert_eq!(sets.len(), 2);
+    for created in &sets {
+        // The kernel's informational attributes are not identity.
+        assert_eq!(set_identity(created).unwrap(), set_identity(&dumped_set(created)).unwrap());
+        // A changed key length, flag or any unknown attribute is a different set.
+        for (id, value) in [(5, Attr::u32(5, 4)), (3, Attr::u32(3, 0))] {
+            let mut changed: Vec<_> = created.iter().filter(|attribute| attribute.id() != id).cloned().collect();
+            changed.push(value);
+            assert_ne!(set_identity(&changed).unwrap(), set_identity(created).unwrap());
+        }
+        for foreign in [
+            Attr::u64(11, 1000),
+            Attr::bytes(13, b"foreign".to_vec()),
+            Attr::nested(9, vec![Attr::u32(1, 64)]),
+        ] {
+            let mut changed = dumped_set(created);
+            changed.push(foreign);
+            assert!(set_identity(&changed).is_err());
+        }
+    }
+    // Elements are plain keys; any extension rejects.
+    let (_, elements) = program.iter().find(|(kind, _)| *kind == 12).unwrap();
+    let list = wire::attrs(&wire::one(elements, 3).unwrap().value).unwrap();
+    assert_eq!(element_keys(&list).unwrap().len(), 1);
+    let key = wire::attrs(&list[0].value).unwrap();
+    for extension in [Attr::u32(3, 1), Attr::nested(2, vec![Attr::bytes(1, vec![1; 4])])] {
+        let mut changed = key.clone();
+        changed.push(extension);
+        assert!(element_keys(&[Attr::nested(1, changed)]).is_err());
+    }
+    // Every lookup names its set with a plain, uninverted membership test, and
+    // the key registers are part of identity.
+    let lookups: Vec<_> = program
+        .iter()
+        .filter(|(kind, attributes)| *kind == 6 && rule_identity(attributes).unwrap().1.windows(6).any(|window| window == b"lookup"))
+        .collect();
+    assert_eq!(lookups.len(), 5);
+    let lookup = |data: Vec<Attr>| rule(vec![expression("lookup", data)]);
+    let exact = vec![Attr::string(1, "host_grant"), Attr::u32(2, 1), Attr::u32(5, 0)];
+    let identity = rule_identity(&lookup(exact.clone())).unwrap();
+    for changed in [
+        vec![Attr::string(1, "host_grant_arrival"), Attr::u32(2, 1), Attr::u32(5, 0)],
+        vec![Attr::string(1, "host_grant"), Attr::u32(2, 9), Attr::u32(5, 0)],
+    ] {
+        assert_ne!(rule_identity(&lookup(changed)).unwrap(), identity);
+    }
+    for invalid in [
+        vec![Attr::string(1, "host_grant"), Attr::u32(2, 1), Attr::u32(5, 1)],
+        vec![Attr::string(1, "host_grant"), Attr::u32(2, 1)],
+        vec![Attr::string(1, "host_grant"), Attr::u32(2, 1), Attr::u32(3, 2), Attr::u32(5, 0)],
+    ] {
+        assert!(rule_identity(&lookup(invalid)).is_err());
+    }
+}

package/rust/src/owner_poolguard_tests.rs

@@ -24,6 +24,75 @@ fn allocation_pool_guard_maximum_graph_persist_and_lost_ack_recovery() {
     super::egress_tests::recover("pools_v2", serde_json::from_value(policy).unwrap());
 }
 
+/// A full host-grant set persists, is re-verified element by element by a fresh
+/// owner, and is replaced and released exactly like the rest of the graph.
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn allocation_pool_guard_host_grant_set_persist_and_lost_ack_recovery() {
+    isolated();
+    let grants: Vec<_> = (0..1024_u16)
+        .map(|index| crate::egress::hostgrant_tests::host_grant(
+            if index % 2 == 0 { "tcp" } else { "udp" },
+            "10.240.0.1",
+            "10.241.0.2",
+            20000 + index / 2,
+        ))
+        .collect();
+    let policy = crate::egress::hostgrant_tests::granted(egress::tests::pool_guard(), json!(grants));
+    super::egress_tests::recover("grant_pools_v2", serde_json::from_value(policy).unwrap());
+}
+
+/// The set is CONSTANT and bound: even after the owning socket is gone, another
+/// privileged socket cannot add or remove a grant, and a fresh owner verifies
+/// the exact element set before adopting it.
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn allocation_pool_guard_host_grant_set_rejects_foreign_element_changes() {
+    isolated();
+    let grant = crate::egress::hostgrant_tests::host_grant("tcp", "10.240.0.1", "10.241.0.2", 8080);
+    let policy: egress::Policy = serde_json::from_value(crate::egress::hostgrant_tests::granted(
+        egress::tests::pool_guard(),
+        json!([grant]),
+    ))
+    .unwrap();
+    let prepared: Prepared = policy.prepare().unwrap().into();
+    let mut owner = Owner::new(options("grant_pool_foreign")).unwrap();
+    let applied = owner
+        .reconcile(Transition { previous: None, target: prepared.clone() })
+        .unwrap();
+    drop(owner);
+    let table = "snft_grant_pool_foreign";
+    let (_, elements) = prepared
+        .program(table)
+        .unwrap()
+        .into_iter()
+        .find(|(kind, _)| *kind == 12)
+        .unwrap();
+    let list = wire::attrs(&wire::one(&elements, 3).unwrap().value).unwrap();
+    let key = wire::attrs(&wire::attrs(&list[0].value).unwrap()[0].value).unwrap()[0].value.clone();
+    let mut foreign = key.clone();
+    foreign[16] ^= 1;
+    let element = |key: Vec<u8>| {
+        vec![
+            Attr::string(1, table),
+            Attr::string(2, "host_grant"),
+            Attr::nested(3, vec![Attr::nested(1, vec![Attr::nested(1, vec![Attr::bytes(1, key)])])]),
+        ]
+    };
+    let mut socket = wire::Socket::open().unwrap();
+    for (operation, key) in [(12, foreign), (14, key)] {
+        let generation = socket.generation().unwrap();
+        assert!(socket.batch(generation, vec![(operation, 0x600, element(key))]).is_err());
+    }
+    let mut owner = Owner::new(options("grant_pool_foreign")).unwrap();
+    let recovered = owner
+        .reconcile(Transition { previous: None, target: prepared })
+        .unwrap();
+    assert_eq!(recovered.receipt.table_handle, applied.receipt.table_handle);
+    assert!(owner.inspect().enforced);
+    owner.release(recovered).unwrap();
+}
+
 // Foreign capture controls exist only in this offline guest. They are never
 // composed into or removed with the managed policy under test.
 fn foreign_captures() {

package/rust/src/owner_router_traffic_tests.rs

@@ -58,7 +58,7 @@ fn sockaddr(value: &str) -> libc::sockaddr_in {
 /// A TCP client with an exact source address and port, which std cannot express.
 /// The collision this qualifies is the client's source port, so it must be chosen
 /// and not left to the ephemeral range.
-fn connect_from(source: &str, destination: &str) -> std::io::Result<TcpStream> {
+pub(super) fn connect_from(source: &str, destination: &str) -> std::io::Result<TcpStream> {
     let raw = unsafe { libc::socket(libc::AF_INET, libc::SOCK_STREAM | libc::SOCK_CLOEXEC, 0) };
     assert!(raw >= 0, "socket: {}", std::io::Error::last_os_error());
     let stream = unsafe { TcpStream::from_raw_fd(raw) };