@push.rocks/smartnftables 2.5.1 → 2.6.0

package/readme.md

@@ -264,9 +264,9 @@ allocation-pool guard policy kinds.
 
 | V2 scope | Required authority and behavior |
 | --- | --- |
-| `routerEgress` | Private `endpoints` and `rules`, one exact `links` binding per endpoint, a separate veth `handoff`, `protection`, and active `generations`. Private veth/TUN/local DNS and egress share one table so terminal private denial cannot override a separate egress table. Optional `publishedPorts` add the inbound second hop from the handoff to a workload endpoint; both directions are classified into the default conntrack zone ahead of every leased classifier, so a published endpoint port is dedicated to its publication and never becomes leased egress. Optional `hostGrants` forward exact host-origin flows from the handoff to a workload endpoint. |
-| `hostTransit` | Exact handoff `link`/`allocations` pairs, complete `protection`, an explicit veth or Ethernet `uplink`, and its current `snatAddress`. It checks each handoff's leased source address and protocol/port range, default conntrack zone, direction, uplink, and protected destinations before outer SNAT. Optional `publishedPorts` add inbound uplink destination NAT inside the same generation. Optional `hostGrants` let the host's own address on a handoff dial exact workload ports. |
-| `allocationPoolGuard` | An authenticated `authorityDigest` and complete current allocation-pool `prefixes`. Installs host-wide IPv4 destination denial before any handoff exists, without link, uplink or SNAT dependencies. Optional `hostGrants` are its only exceptions. |
+| `routerEgress` | Private `endpoints` and `rules`, one exact `links` binding per endpoint, a separate veth `handoff`, `protection`, and active `generations`. Private veth/TUN/local DNS and egress share one table so terminal private denial cannot override a separate egress table. Optional `publishedPorts` add the inbound second hop from the handoff to a workload endpoint; both directions are classified into the default conntrack zone ahead of every leased classifier, so a published endpoint port is dedicated to its publication and never becomes leased egress. Optional `hostGrants` forward exact host-origin flows from the handoff to a workload endpoint. Optional `workloadGrants` let one workload open one exact port of another, one way. |
+| `hostTransit` | Exact handoff `link`/`allocations` pairs, complete `protection`, an explicit veth or Ethernet `uplink`, and its current `snatAddress`. It checks each handoff's leased source address and protocol/port range, default conntrack zone, direction, uplink, and protected destinations before outer SNAT. Optional `publishedPorts` add inbound uplink destination NAT inside the same generation. Optional `hostGrants` let the host's own address on a handoff dial exact workload ports. Optional `localPlatformEndpoints` serve platform endpoints on the host's own addresses to leased flows. |
+| `allocationPoolGuard` | An authenticated `authorityDigest` and complete current allocation-pool `prefixes`. Installs host-wide IPv4 destination denial before any handoff exists, without link, uplink or SNAT dependencies. Optional `hostGrants` are its only exceptions. Optional `localTcpPortOwners` restrict loopback TCP ports to one local user each. |
 
 `allocationPoolGuard` accepts 1–64 canonical, disjoint RFC1918 prefixes. Supply
 the actual allocation pools, not the broader protected union containing management
@@ -474,6 +474,119 @@ hop by hop from the workload side (router, host transit, guard) and withdraw the
 in the reverse order; each table is atomic on its own, and a partially applied
 grant only stays dark.
 
+#### Host-local platform endpoints
+
+A platform endpoint normally lives elsewhere and host transit forwards leased
+flows to it. When the host serves an endpoint itself — a relay listener, a data
+port or a VPN hub on an address the host holds — the leased flow ends in the
+host's INPUT instead, where every handoff arrival is denied. The optional
+`hostTransit.localPlatformEndpoints` lists the ids of `protection.platformEndpoints`
+the host serves:
+
+```typescript
+protection: { authorityDigest, prefixes: ['10.0.0.0/8', '192.0.2.0/24'], platformEndpoints: [
+  { id: 'relay', address: '192.0.2.2', protocol: 'tcp', port: 8443 }] },
+localPlatformEndpoints: ['relay'],
+```
+
+Each id names an existing endpoint whose address is an exact `requiredIpv4Addresses`
+entry of the uplink or of a handoff link, so rtnetlink verifies that the host holds it
+at apply, recovery and inspection. The refusal of a platform endpoint on a host
+address is lifted only for declared ids; unknown, duplicate or unheld ids reject.
+The router scope grants its workloads the endpoint like any platform endpoint
+(`destination: { kind: 'platform', endpointId }`).
+
+INPUT admits the original direction only from the exact handoff that carries a lease,
+with the lease's transit source address and a source port in one of its ranges for
+the endpoint's protocol, in the default conntrack zone, to the exact endpoint address
+and port in both the live and the originally tracked tuple, NEW (a TCP opening only
+with SYN) or ESTABLISHED. OUTPUT admits only the ESTABLISHED reply back through that
+handoff. A flow translated in transit, another source address or port, another
+endpoint port or protocol and any host-origin opening toward the transit address keep
+meeting the handoff denials. The source port is checked against the leased range in
+both tuples, not for equality between them. Each leased range adds one INPUT and one
+OUTPUT jump when an endpoint of its protocol is declared, and each endpoint adds three
+rules. Absent and empty are the same canonical policy, digest and compiled bytes. The
+caller keeps a declared endpoint's address outside every guarded allocation pool and
+owns the listener.
+
+#### Workload grants
+
+`routerEgress.workloadGrants` is optional: a stateful one-way flow between two
+workloads behind the same router, such as an ingress workload reaching a target
+workload's service port across organizations. Each entry is `{ protocol,
+sourceAddress, destinationAddress, destinationPort }`: `tcp` or `udp`, the exact
+current addresses of two different veth workload endpoints of the scope and one port
+1–65535. Prefixes, wildcards, ranges, router-local and platform-endpoint addresses,
+TUN endpoints, both ends on one endpoint and duplicates reject. The source opens and
+the destination only answers; the reverse direction is a second grant.
+
+Four FORWARD admissions follow the private anti-spoof guards whatever the number of
+grants: ESTABLISHED original direction, a NEW UDP opening, a NEW TCP opening
+restricted to SYN with FIN/RST/ACK clear, and the ESTABLISHED reply, each in the
+default conntrack zone. Every admission looks up the incoming link with the source
+address and the outgoing link with the destination address (index and name) in the
+CONSTANT set `workload_link`, and the protocols with the live and originally tracked
+tuple in the CONSTANT set `workload_grant`, so a spoofed, renamed or translated flow
+never matches and the destination can never open toward the source. Endpoint prefixes
+are protected, so both directions stay in the default zone ahead of every leased
+classifier. Owner verification reads both sets back element by element. Up to 1024
+grants fit; the sets share the scope's 100,000-byte element budget with `hostGrants`,
+so 1024 of each do not fit together and preparation refuses that before any kernel
+work. Absent and empty are the same canonical policy, digest and compiled bytes, and
+withdrawal is an ordinary atomic replacement that also stops established flows.
+
+These flows need no private `rules`. A private rule is stateless: answering through
+private rules needs a reverse rule, which would also let the destination open toward
+the source.
+
+#### Loopback TCP port owners
+
+`allocationPoolGuard.localTcpPortOwners` is optional and restricts a loopback TCP
+service to one local user, such as a container runtime's CRI stream server on
+`127.0.0.1:10010` that only root may reach. Each entry is `{ address, port, uid }`:
+one exact IPv4 loopback host address in `127.0.0.0/8` (not the network or broadcast
+address), one port 1–65535 and one uid 0–4294967294. Prefixes, wildcards, IPv6,
+ranges, uid lists and a second entry for the same address and port reject; the
+limit is 8 entries. Absent and empty are the same canonical policy, so a guard
+without owners keeps its exact previous digest and compiled bytes.
+
+```typescript
+const guard: IManagedNftPolicyV2 = { schemaVersion: 2, revision: 1, scope: {
+  kind: 'allocationPoolGuard', authorityDigest, prefixes: ['10.240.0.0/16'],
+  localTcpPortOwners: [{ address: '127.0.0.1', port: 10010, uid: 0 }] } };
+```
+
+Each entry compiles two rules at the head of the guard's base chains, ahead of the
+host grant admissions and the pool guard, so nothing earlier in the table accepts
+past them:
+
+- OUTPUT (filter priority 0, after ordinary output destination NAT): IPv4 TCP to the
+  exact address and port with `meta skuid != uid` is rejected with a TCP reset, so
+  another user's `connect()` fails at once with `ECONNREFUSED`. This covers every
+  packet, not only the opening, and a flow a foreign output DNAT redirects to the
+  port. `meta skuid` is the socket file's file-system uid as the user namespace owning the
+  network namespace sees it, the initial one on a host: a process in a user namespace
+  that shares the host network namespace is matched by its host uid, and a user
+  namespace's root is not uid 0. A packet without a socket
+  file carries no uid and does not match: a kernel reply, the teardown of an orphaned
+  socket, or an in-kernel socket such as an NFS or CIFS client, which only a privileged
+  mount creates.
+- INPUT: the exact address and port arriving on any interface but loopback (ifindex
+  1 in every network namespace) are dropped, so `route_localnet` or a prerouting DNAT
+  cannot expose the service to another host.
+
+The rules match the exact destination address. The service must bind exactly that
+address; a wildcard listener stays reachable through the host's other addresses.
+IPv6 is not covered, so the service must not listen on `::1` or `::`. A socket keeps
+the uid it was created with, so a root process that hands its connected socket to
+another user delegates that connection. The reject expression needs the kernel's
+`nft_reject_inet` module (autoloaded on stock kernels). Owner verification reads
+back every rule, including the comparison operator, the uid and the reject type, so
+apply, inspection, adoption and recovery reject a changed rule. The entries are
+applied, retained, recovered and released with the rest of the guard's table; after
+a reboot the caller applies its retained intent again, like every other member.
+
 Input bounds are 1024 grants per scope, the maximum a network projection carries.
 Elements have their own 100,000-byte budget beside the 100,000-byte rule graph, and
 are sent 256 to a message. At 1024 grants the reference router needs about 94 KB
@@ -632,11 +745,42 @@ withdrawal in every scope stops new flows and the established one. A full guard
 set persists across owner loss, is re-verified element by element before adoption,
 survives lost-ACK replay and is replaced and released like the rest of the graph,
 and another socket cannot add or delete one of its elements.
+Host-local platform endpoints are qualified from a router namespace against
+pre-policy positive controls: without the member the handoff denials keep both a TCP
+endpoint on the uplink address and a UDP endpoint on the handoff address dark; with
+it the exact leased flows reach them with the transit source preserved, while a
+source port outside the lease or in the other protocol's range, an unleased source
+address, another endpoint port, a flow a foreign prerouting DNAT translated onto the
+endpoint and the host's own opening toward the transit address stay dark; withdrawal
+stops new flows and the established one, and release reopens the path. A graph with
+served endpoints persists across owner loss and survives lost-ACK replay.
+Workload grants are qualified between three workload namespaces behind the router,
+each with leased public egress on every port of both protocols: against pre-policy
+positive controls, the grant opens exactly the source workload's TCP and UDP flows to
+the granted ports with the source preserved; another port, another source workload,
+another destination workload, the destination's TCP and UDP openings toward the
+source stay dark; withdrawal stops new flows and the established one; release reopens
+the path. A set of 1024 grants persists across owner loss, is re-verified element by
+element and survives lost-ACK replay.
+Loopback TCP port owners are qualified against pre-policy positive controls on the
+same listeners: the owning uid (root, and uid 1000 for a second port) connects, every
+other uid is reset with `ECONNREFUSED`, an unowned port and another loopback address
+stay open to every user, a foreign output DNAT to the owned port stays closed to
+another user, and an uplink arrival translated to loopback with `route_localnet`
+enabled is dropped. The policy keeps enforcing after the owner detaches and its
+process is gone, a fresh owner verifies and adopts the exact graph, and release
+reopens every probe. The maximum of eight owners beside the guard persists across
+owner loss and survives lost-ACK replay.
 The arm64 binary is cross-built; native packet qualification is currently x86_64.
 Kernel 6.8 is unsupported. No production activation is implied by these tests.
 
-Native dependency and standard-library attribution is included in
-`native-notices/`. Distribution must retain these notices alongside the binaries.
+Native dependency, standard-library and C runtime attribution is included in
+`native-notices/`, generated by `tsrust notices` from `rust/Cargo.lock` and the Rust
+toolchain pinned in `rust-toolchain.toml`. Every build verifies the committed notices
+first and refuses when they no longer match. Distribution must retain these notices
+alongside the binaries. The statically linked musl 1.2.5 comes from the Rust 1.95.0
+toolchain pinned in `rust-toolchain.toml`, whose musl build includes the two
+CVE-2025-26519 patches.
 
 ## Quick Start
 

package/rust/src/egress.compile.rs

@@ -10,6 +10,8 @@ mod hostgrant;
 mod poolguard;
 #[path = "egress.router.rs"]
 mod router;
+#[path = "egress.workloadgrant.rs"]
+mod workloadgrant;
 
 /// Set elements of one target. Together with the 100,000-byte rule graph and the
 /// handle-only deletion of a previous maximum graph this bounds one replacement

package/rust/src/egress.host.rs

@@ -36,10 +36,25 @@ fn envelope(
     allocation: &Allocation,
     range: &PortRange,
     reply: bool,
+) -> Result<Vec<Attr>> {
+    leased(handoff, Some(&scope.uplink), allocation, range, reply)
+}
+/// One leased range of one allocation on its exact handoff: the default zone, the
+/// direction, the protocols, and the transit source address and port range in
+/// both the live and the originally tracked tuple. A forwarded envelope adds the
+/// uplink; a host-local one has none.
+fn leased(
+    handoff: &HostHandoff,
+    uplink: Option<&LocalLink>,
+    allocation: &Allocation,
+    range: &PortRange,
+    reply: bool,
 ) -> Result<Vec<Attr>> {
     let mut expressions = ipv4();
     expressions.extend(link(&handoff.link, !reply));
-    expressions.extend(link(&scope.uplink, reply));
+    if let Some(uplink) = uplink {
+        expressions.extend(link(uplink, reply));
+    }
     expressions.extend(meta(16, vec![protocol(&range.protocol)]));
     expressions.extend(ct(10, None, vec![protocol(&range.protocol)]));
     expressions.extend(ct(17, None, 0_u16.to_ne_bytes().to_vec()));
@@ -114,6 +129,70 @@ fn published(program: &mut Program<'_>, scope: &HostScope) -> Result<()> {
     }
     Ok(())
 }
+/// The exact platform endpoints served on host addresses. Every packet is
+/// checked against the live and the originally tracked destination tuple, so a
+/// flow rewritten in transit never matches.
+fn local_endpoints(scope: &HostScope) -> Vec<&PlatformEndpoint> {
+    scope
+        .protection
+        .platform_endpoints
+        .iter()
+        .filter(|endpoint| scope.local_platform_endpoints.contains(&endpoint.id))
+        .collect()
+}
+fn local_endpoint(endpoint: &PlatformEndpoint, reply: bool) -> Result<Vec<Attr>> {
+    let mut expressions = meta(16, vec![protocol(&endpoint.protocol)]);
+    expressions.extend(ct(10, None, vec![protocol(&endpoint.protocol)]));
+    let address = format!("{}/32", endpoint.address);
+    expressions.extend(current_address(&address, reply)?);
+    expressions.extend(current_port(endpoint.port, reply));
+    expressions.extend(original_address(&address, false)?);
+    expressions.extend(original_port(endpoint.port, false));
+    Ok(expressions)
+}
+/// Leased flows into host-local platform endpoints, the reverse of a host grant:
+/// INPUT admits the original direction only from an exact handoff with a leased
+/// source address and port range of that handoff, NEW (a TCP opening only with
+/// SYN) or ESTABLISHED; OUTPUT admits only the ESTABLISHED reply back to it. Each
+/// leased range jumps once per direction, and the endpoint chains hold one tuple
+/// check per endpoint, so the graph grows with ranges plus endpoints.
+fn local_platform(program: &mut Program<'_>, scope: &HostScope) -> Result<()> {
+    let endpoints = local_endpoints(scope);
+    for endpoint in &endpoints {
+        let original = local_endpoint(endpoint, false)?;
+        for connection_state in [2, 8] {
+            let mut expressions = original.clone();
+            expressions.extend(state(connection_state));
+            if connection_state == 8 && endpoint.protocol == "tcp" {
+                expressions.extend(opening_tcp());
+            }
+            program.end("local_platform_in", expressions, 1)?;
+        }
+        let mut reply = local_endpoint(endpoint, true)?;
+        reply.extend(state(2));
+        program.end("local_platform_back", reply, 1)?;
+    }
+    for handoff in &scope.handoffs {
+        for allocation in &handoff.allocations {
+            for range in &allocation.source_port_ranges {
+                if endpoints
+                    .iter()
+                    .all(|endpoint| endpoint.protocol != range.protocol)
+                {
+                    continue;
+                }
+                for (chain, target, reply) in [
+                    ("input", "local_platform_in", false),
+                    ("output", "local_platform_back", true),
+                ] {
+                    let expressions = leased(handoff, None, allocation, range, reply)?;
+                    program.jump(chain, expressions, target)?;
+                }
+            }
+        }
+    }
+    Ok(())
+}
 pub(super) fn compile(program: &mut Program<'_>, scope: &HostScope) -> Result<()> {
     // Filtering runs after destination NAT. Docker has independent filter hooks.
     // This table cannot override another owner's DROP; Docker contribution and
@@ -135,6 +214,11 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &HostScope) -> Result<()
     for name in ["protected_out", "protected_back"] {
         program.chain(name, None)?;
     }
+    if !scope.local_platform_endpoints.is_empty() {
+        for name in ["local_platform_in", "local_platform_back"] {
+            program.chain(name, None)?;
+        }
+    }
     if !scope.host_grants.is_empty() {
         // Validation admits only an address of exactly one handoff link.
         hostgrant::tuple_set(program, &scope.host_grants, |grant| {
@@ -163,6 +247,9 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &HostScope) -> Result<()
     if !scope.host_grants.is_empty() {
         hostgrant::admissions(program, ["output", "input"], true, |_| vec![])?;
     }
+    // Leased flows into host-local platform endpoints precede the same terminal
+    // handoff denials, which remain for everything else.
+    local_platform(program, scope)?;
     for handoff in &scope.handoffs {
         program.jump("forward", link(&handoff.link, true), "protected_out")?;
         program.jump("forward", link(&handoff.link, false), "protected_back")?;

package/rust/src/egress.hostgrant.rs

@@ -13,7 +13,7 @@ pub(super) const ARRIVAL_SET: &str = "host_grant_arrival";
 
 /// Register numbers as Linux dumps them: 16-byte aligned registers use the
 /// legacy NFT_REG_1..4 names, every other 4-byte register NFT_REG32_xx.
-fn register(index: u32) -> u32 {
+pub(super) fn register(index: u32) -> u32 {
     if index % 4 == 0 {
         index / 4
     } else {
@@ -24,10 +24,10 @@ fn store(name: &str, mut data: Vec<Attr>, index: u32) -> Attr {
     data.insert(0, Attr::u32(1, register(index)));
     expr(name, data)
 }
-fn meta_to(key: u32, index: u32) -> Attr {
+pub(super) fn meta_to(key: u32, index: u32) -> Attr {
     store("meta", vec![Attr::u32(2, key)], index)
 }
-fn payload_to(base: u32, offset: u32, length: u32, index: u32) -> Attr {
+pub(super) fn payload_to(base: u32, offset: u32, length: u32, index: u32) -> Attr {
     store(
         "payload",
         vec![
@@ -45,7 +45,7 @@ fn ct_to(key: u32, original: bool, index: u32) -> Attr {
     }
     store("ct", data, index)
 }
-fn lookup(set: &str) -> Attr {
+pub(super) fn lookup(set: &str) -> Attr {
     expr(
         "lookup",
         vec![
@@ -61,10 +61,10 @@ fn word(bytes: &[u8]) -> Vec<u8> {
     result
 }
 
-/// Key loads for one direction, then the lookup. `linked` adds the variable
-/// interface: the outgoing interface of the original direction, the incoming
-/// interface of the reply.
-fn tuple_lookup(linked: bool, reply: bool) -> Vec<Attr> {
+/// Key loads for one direction, then the lookup in `set`. `linked` adds the
+/// variable interface: the outgoing interface of the original direction, the
+/// incoming interface of the reply.
+pub(super) fn tuple_lookup(set: &str, linked: bool, reply: bool) -> Vec<Attr> {
     let mut result = Vec::new();
     let mut index = 4;
     if linked {
@@ -82,10 +82,10 @@ fn tuple_lookup(linked: bool, reply: bool) -> Vec<Attr> {
     result.push(ct_to(19, true, index + 5));
     result.push(ct_to(20, true, index + 6));
     result.push(ct_to(12, true, index + 7));
-    result.push(lookup(TUPLE_SET));
+    result.push(lookup(set));
     result
 }
-fn tuple_key(grant: &HostGrant, link: Option<&LocalLink>) -> Result<Vec<u8>> {
+pub(super) fn tuple_key(grant: &HostGrant, link: Option<&LocalLink>) -> Result<Vec<u8>> {
     let protocol = word(&[protocol(&grant.protocol)]);
     let source = address(&grant.source_address)?.to_be_bytes();
     let destination = address(&grant.destination_address)?.to_be_bytes();
@@ -170,7 +170,7 @@ pub(super) fn admissions(
         result
     };
     let mut established = envelope(false, 2);
-    established.extend(tuple_lookup(linked, false));
+    established.extend(tuple_lookup(TUPLE_SET, linked, false));
     program.end(chains[0], established, 1)?;
     for transport in ["udp", "tcp"] {
         let mut opening = envelope(false, 8);
@@ -178,10 +178,10 @@ pub(super) fn admissions(
         if transport == "tcp" {
             opening.extend(opening_tcp());
         }
-        opening.extend(tuple_lookup(linked, false));
+        opening.extend(tuple_lookup(TUPLE_SET, linked, false));
         program.end(chains[0], opening, 1)?;
     }
     let mut reply = envelope(true, 2);
-    reply.extend(tuple_lookup(linked, true));
+    reply.extend(tuple_lookup(TUPLE_SET, linked, true));
     program.end(chains[1], reply, 1)
 }

package/rust/src/egress.poolguard.rs

@@ -7,6 +7,10 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &AllocationPoolGuardScop
     for name in ["pool_guard", "pool_reply"] {
         program.chain(name, None)?;
     }
+    // First in the base chains, so nothing earlier in this table accepts past them.
+    for owner in &scope.local_tcp_port_owners {
+        local_tcp_port_owner(program, owner)?;
+    }
     // The only exceptions: an exact host-origin flow into a pool and its reply,
     // ahead of the guard. Everything else, including a translated flow that merely
     // arrives at a granted tuple, still meets the unconditional guard below.
@@ -35,3 +39,44 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &AllocationPoolGuardScop
     program.end("pool_guard", vec![], -5)?;
     program.end("pool_reply", vec![], -5)
 }
+
+/// The exact loopback TCP destination: IPv4, TCP, address and port.
+fn local_tcp_port(owner: &LocalTcpPortOwner) -> Result<Vec<Attr>> {
+    let mut result = ipv4();
+    result.extend(meta(16, vec![protocol("tcp")]));
+    result.push(load_payload(1, 16, 4));
+    result.push(compare(address(&owner.address)?.to_be_bytes().to_vec()));
+    result.extend(current_port(owner.port, false));
+    Ok(result)
+}
+/// `meta <key> != value`. A key the packet does not carry breaks the rule.
+fn meta_differs(key: u32, value: Vec<u8>) -> Vec<Attr> {
+    vec![
+        expr("meta", vec![Attr::u32(1, 1), Attr::u32(2, key)]),
+        expr(
+            "cmp",
+            vec![
+                Attr::u32(1, 1),
+                Attr::u32(2, 1),
+                Attr::nested(3, vec![Attr::bytes(1, value)]),
+            ],
+        ),
+    ]
+}
+/// OUTPUT at filter priority 0 sees the destination after ordinary destination
+/// NAT and rejects, with a TCP reset, every packet from a socket whose file
+/// system uid (as the user namespace owning the network namespace sees it) is
+/// not the owner. A packet without a user socket (a kernel reply, an orphaned
+/// socket's teardown) carries no uid and breaks the rule; it cannot open a
+/// connection. INPUT drops the destination arriving on any interface but
+/// loopback (ifindex 1 in every namespace), which `route_localnet` or
+/// prerouting DNAT could otherwise admit.
+fn local_tcp_port_owner(program: &mut Program<'_>, owner: &LocalTcpPortOwner) -> Result<()> {
+    let mut output = local_tcp_port(owner)?;
+    output.extend(meta_differs(10, owner.uid.to_ne_bytes().to_vec()));
+    output.push(expr("reject", vec![Attr::u32(1, 1)]));
+    program.rule("output", output)?;
+    let mut input = local_tcp_port(owner)?;
+    input.extend(meta_differs(4, 1_u32.to_ne_bytes().to_vec()));
+    program.end("input", input, 0)
+}

package/rust/src/egress.router.rs

@@ -50,7 +50,7 @@ fn raw_return(scope: &RouterScope, grant: &Grant, generation: &Generation) -> Re
 /// The exact veth link of the workload endpoint that holds an endpoint address.
 /// Validation admits only a current endpoint address, and endpoint prefixes are
 /// pairwise disjoint, so one publication or host grant never spans two links.
-fn endpoint_link<'a>(scope: &'a RouterScope, address: &str) -> Result<&'a LocalLink> {
+pub(super) fn endpoint_link<'a>(scope: &'a RouterScope, address: &str) -> Result<&'a LocalLink> {
     let target = format!("{address}/32");
     let endpoint = scope
         .endpoints
@@ -365,6 +365,7 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &RouterScope, revision:
         program.chain(name, None)?;
     }
     host_grant_sets(program, scope)?;
+    workloadgrant::sets(program, scope)?;
     let private = policy::Policy {
         schema_version: 1,
         revision,
@@ -397,6 +398,7 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &RouterScope, revision:
         if chain == "forward" {
             published_admissions(program, scope)?;
             host_grant_admissions(program, scope)?;
+            workloadgrant::admissions(program, scope)?;
         }
         for expressions in parts.grants {
             program.rule(chain, expressions)?;

package/rust/src/egress.rs

@@ -115,6 +115,10 @@ pub struct HostGrant {
     pub destination_address: String,
     pub destination_port: u16,
 }
+/// One stateful one-way flow between two workloads behind the same router: the
+/// source workload dials one exact port of the destination workload, which may
+/// only answer. It is the same exact tuple as a host grant.
+pub type WorkloadGrant = HostGrant;
 #[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct RouterScope {
@@ -131,6 +135,9 @@ pub struct RouterScope {
     /// Absent and empty are the same canonical policy, like publications.
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub host_grants: Vec<HostGrant>,
+    /// Absent and empty are the same canonical policy, like publications.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub workload_grants: Vec<WorkloadGrant>,
 }
 #[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
@@ -161,6 +168,20 @@ pub struct HostScope {
     /// Absent and empty are the same canonical policy, like publications.
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub host_grants: Vec<HostGrant>,
+    /// Ids of platform endpoints this host serves on an address of one of its
+    /// bound links. Absent and empty are the same canonical policy.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub local_platform_endpoints: Vec<String>,
+}
+/// One loopback TCP service that only one local user may dial: packets the host
+/// sends to the exact address and port from a socket of any other user reject,
+/// and packets arriving there on any interface but loopback drop.
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq, PartialOrd, Ord)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct LocalTcpPortOwner {
+    pub address: String,
+    pub port: u16,
+    pub uid: u32,
 }
 #[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
@@ -171,6 +192,10 @@ pub struct AllocationPoolGuardScope {
     /// Absent and empty are the same canonical policy.
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub host_grants: Vec<HostGrant>,
+    /// Host-wide loopback port ownership. Absent and empty are the same
+    /// canonical policy.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub local_tcp_port_owners: Vec<LocalTcpPortOwner>,
 }
 #[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
 #[serde(tag = "kind", rename_all = "camelCase", deny_unknown_fields)]
@@ -565,6 +590,46 @@ fn normalize_router_host_grants(value: &mut RouterScope) -> Result<()> {
     value.host_grants = grants;
     Ok(())
 }
+/// Both ends are exact current addresses of two different veth workload endpoints
+/// of this scope, neither router-local nor a platform endpoint. Endpoint prefixes
+/// are protected, so both directions stay in the default conntrack zone ahead of
+/// every leased classifier.
+fn normalize_router_workload_grants(value: &mut RouterScope) -> Result<()> {
+    let mut grants = std::mem::take(&mut value.workload_grants);
+    let scope = &*value;
+    let workload = |ip: &str| -> Result<&policy::Endpoint> {
+        let target = format!("{ip}/32");
+        let endpoint = scope
+            .endpoints
+            .iter()
+            .find(|endpoint| {
+                endpoint
+                    .source_prefixes
+                    .iter()
+                    .any(|source| covers(source, &target) == Ok(true))
+            })
+            .ok_or(Error::Invalid)?;
+        let local = scope
+            .links
+            .iter()
+            .chain(std::iter::once(&scope.handoff))
+            .any(|link| link.required_ipv4_addresses.iter().any(|item| item == ip));
+        let platform = scope
+            .protection
+            .platform_endpoints
+            .iter()
+            .any(|item| item.address == ip);
+        require(endpoint.interface_kind == "veth" && !local && !platform)?;
+        Ok(endpoint)
+    };
+    normalize_host_grants(&mut grants, |grant| {
+        let source = workload(&grant.source_address)?;
+        let destination = workload(&grant.destination_address)?;
+        require(source.id != destination.id)
+    })?;
+    value.workload_grants = grants;
+    Ok(())
+}
 fn normalize_router(value: &mut RouterScope, revision: u64) -> Result<()> {
     require(value.links.len() <= 32 && value.generations.len() <= 32)?;
     let private = policy::Policy {
@@ -737,7 +802,8 @@ fn normalize_router(value: &mut RouterScope, revision: u64) -> Result<()> {
         )
     }))?;
     normalize_router_published(value)?;
-    normalize_router_host_grants(value)
+    normalize_router_host_grants(value)?;
+    normalize_router_workload_grants(value)
 }
 fn normalize_pool_guard(value: &mut AllocationPoolGuardScope) -> Result<()> {
     require(
@@ -760,8 +826,32 @@ fn normalize_pool_guard(value: &mut AllocationPoolGuardScope) -> Result<()> {
         require(covers_address(&value.prefixes, &grant.destination_address)?)
     })?;
     value.host_grants = grants;
+    normalize_local_tcp_port_owners(&mut value.local_tcp_port_owners)
+}
+/// One exact IPv4 loopback host address and port per entry, never a prefix,
+/// wildcard or range, each with exactly one owning uid. `(uid_t)-1` is not a
+/// user; it is the kernel's "unchanged" sentinel.
+fn normalize_local_tcp_port_owners(owners: &mut [LocalTcpPortOwner]) -> Result<()> {
+    require(owners.len() <= LOCAL_TCP_PORT_OWNERS)?;
+    owners.sort();
+    for (index, owner) in owners.iter().enumerate() {
+        let ip = address(&owner.address)?;
+        require(
+            ip >> 24 == 127
+                && ip != 0x7f00_0000
+                && ip != 0x7fff_ffff
+                && owner.port > 0
+                && owner.uid != u32::MAX
+                && owners[..index]
+                    .iter()
+                    .all(|other| other.address != owner.address || other.port != owner.port),
+        )?;
+    }
     Ok(())
 }
+/// Two rules per entry; the maximum fits the atomic graph beside a guard with
+/// 64 pools and 1024 host grants.
+const LOCAL_TCP_PORT_OWNERS: usize = 8;
 /// The host dials from an exact current address of exactly one handoff link, into
 /// protected space that is neither host-local, a platform endpoint nor a leased
 /// router transit address: only a workload behind that handoff remains.
@@ -878,14 +968,31 @@ fn normalize_host(value: &mut HostScope) -> Result<()> {
         .flat_map(|item| item.link.required_ipv4_addresses.iter().cloned())
         .chain(value.uplink.required_ipv4_addresses.iter().cloned())
         .collect();
+    // A platform endpoint on a host address is served here, not forwarded, so
+    // only a declared local endpoint may hold one; it must hold a bound address,
+    // which rtnetlink verifies at apply, recovery and inspection.
+    value.local_platform_endpoints.sort();
+    require(
+        value
+            .local_platform_endpoints
+            .windows(2)
+            .all(|pair| pair[0] != pair[1]),
+    )?;
+    for id in &value.local_platform_endpoints {
+        let endpoint = value
+            .protection
+            .platform_endpoints
+            .iter()
+            .find(|endpoint| endpoint.id == *id)
+            .ok_or(Error::Invalid)?;
+        require(local_addresses.contains(&endpoint.address))?;
+    }
     for ip in &local_addresses {
         require(
             covers_address(&value.protection.prefixes, ip)?
-                && value
-                    .protection
-                    .platform_endpoints
-                    .iter()
-                    .all(|endpoint| endpoint.address != *ip),
+                && value.protection.platform_endpoints.iter().all(|endpoint| {
+                    endpoint.address != *ip || value.local_platform_endpoints.contains(&endpoint.id)
+                }),
         )?;
     }
     for handoff in &mut value.handoffs {
@@ -949,8 +1056,17 @@ fn normalize_host(value: &mut HostScope) -> Result<()> {
 #[path = "egress_hostgrant_tests.rs"]
 pub(crate) mod hostgrant_tests;
 #[cfg(test)]
+#[path = "egress_localplatform_tests.rs"]
+pub(crate) mod localplatform_tests;
+#[cfg(test)]
+#[path = "egress_localport_tests.rs"]
+pub(crate) mod localport_tests;
+#[cfg(test)]
 #[path = "egress_tests.rs"]
 pub(crate) mod tests;
+#[cfg(test)]
+#[path = "egress_workloadgrant_tests.rs"]
+pub(crate) mod workloadgrant_tests;
 impl Policy {
     pub fn prepare(self) -> Result<Prepared> {
         use sha2::{Digest, Sha256};