@push.rocks/smartnftables 2.5.2 → 2.6.0

package/rust/src/egress.rs

@@ -115,6 +115,10 @@ pub struct HostGrant {
     pub destination_address: String,
     pub destination_port: u16,
 }
+/// One stateful one-way flow between two workloads behind the same router: the
+/// source workload dials one exact port of the destination workload, which may
+/// only answer. It is the same exact tuple as a host grant.
+pub type WorkloadGrant = HostGrant;
 #[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct RouterScope {
@@ -131,6 +135,9 @@ pub struct RouterScope {
     /// Absent and empty are the same canonical policy, like publications.
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub host_grants: Vec<HostGrant>,
+    /// Absent and empty are the same canonical policy, like publications.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub workload_grants: Vec<WorkloadGrant>,
 }
 #[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
@@ -161,6 +168,20 @@ pub struct HostScope {
     /// Absent and empty are the same canonical policy, like publications.
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub host_grants: Vec<HostGrant>,
+    /// Ids of platform endpoints this host serves on an address of one of its
+    /// bound links. Absent and empty are the same canonical policy.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub local_platform_endpoints: Vec<String>,
+}
+/// One loopback TCP service that only one local user may dial: packets the host
+/// sends to the exact address and port from a socket of any other user reject,
+/// and packets arriving there on any interface but loopback drop.
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq, PartialOrd, Ord)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct LocalTcpPortOwner {
+    pub address: String,
+    pub port: u16,
+    pub uid: u32,
 }
 #[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
@@ -171,6 +192,10 @@ pub struct AllocationPoolGuardScope {
     /// Absent and empty are the same canonical policy.
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub host_grants: Vec<HostGrant>,
+    /// Host-wide loopback port ownership. Absent and empty are the same
+    /// canonical policy.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub local_tcp_port_owners: Vec<LocalTcpPortOwner>,
 }
 #[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
 #[serde(tag = "kind", rename_all = "camelCase", deny_unknown_fields)]
@@ -565,6 +590,46 @@ fn normalize_router_host_grants(value: &mut RouterScope) -> Result<()> {
     value.host_grants = grants;
     Ok(())
 }
+/// Both ends are exact current addresses of two different veth workload endpoints
+/// of this scope, neither router-local nor a platform endpoint. Endpoint prefixes
+/// are protected, so both directions stay in the default conntrack zone ahead of
+/// every leased classifier.
+fn normalize_router_workload_grants(value: &mut RouterScope) -> Result<()> {
+    let mut grants = std::mem::take(&mut value.workload_grants);
+    let scope = &*value;
+    let workload = |ip: &str| -> Result<&policy::Endpoint> {
+        let target = format!("{ip}/32");
+        let endpoint = scope
+            .endpoints
+            .iter()
+            .find(|endpoint| {
+                endpoint
+                    .source_prefixes
+                    .iter()
+                    .any(|source| covers(source, &target) == Ok(true))
+            })
+            .ok_or(Error::Invalid)?;
+        let local = scope
+            .links
+            .iter()
+            .chain(std::iter::once(&scope.handoff))
+            .any(|link| link.required_ipv4_addresses.iter().any(|item| item == ip));
+        let platform = scope
+            .protection
+            .platform_endpoints
+            .iter()
+            .any(|item| item.address == ip);
+        require(endpoint.interface_kind == "veth" && !local && !platform)?;
+        Ok(endpoint)
+    };
+    normalize_host_grants(&mut grants, |grant| {
+        let source = workload(&grant.source_address)?;
+        let destination = workload(&grant.destination_address)?;
+        require(source.id != destination.id)
+    })?;
+    value.workload_grants = grants;
+    Ok(())
+}
 fn normalize_router(value: &mut RouterScope, revision: u64) -> Result<()> {
     require(value.links.len() <= 32 && value.generations.len() <= 32)?;
     let private = policy::Policy {
@@ -737,7 +802,8 @@ fn normalize_router(value: &mut RouterScope, revision: u64) -> Result<()> {
         )
     }))?;
     normalize_router_published(value)?;
-    normalize_router_host_grants(value)
+    normalize_router_host_grants(value)?;
+    normalize_router_workload_grants(value)
 }
 fn normalize_pool_guard(value: &mut AllocationPoolGuardScope) -> Result<()> {
     require(
@@ -760,8 +826,32 @@ fn normalize_pool_guard(value: &mut AllocationPoolGuardScope) -> Result<()> {
         require(covers_address(&value.prefixes, &grant.destination_address)?)
     })?;
     value.host_grants = grants;
+    normalize_local_tcp_port_owners(&mut value.local_tcp_port_owners)
+}
+/// One exact IPv4 loopback host address and port per entry, never a prefix,
+/// wildcard or range, each with exactly one owning uid. `(uid_t)-1` is not a
+/// user; it is the kernel's "unchanged" sentinel.
+fn normalize_local_tcp_port_owners(owners: &mut [LocalTcpPortOwner]) -> Result<()> {
+    require(owners.len() <= LOCAL_TCP_PORT_OWNERS)?;
+    owners.sort();
+    for (index, owner) in owners.iter().enumerate() {
+        let ip = address(&owner.address)?;
+        require(
+            ip >> 24 == 127
+                && ip != 0x7f00_0000
+                && ip != 0x7fff_ffff
+                && owner.port > 0
+                && owner.uid != u32::MAX
+                && owners[..index]
+                    .iter()
+                    .all(|other| other.address != owner.address || other.port != owner.port),
+        )?;
+    }
     Ok(())
 }
+/// Two rules per entry; the maximum fits the atomic graph beside a guard with
+/// 64 pools and 1024 host grants.
+const LOCAL_TCP_PORT_OWNERS: usize = 8;
 /// The host dials from an exact current address of exactly one handoff link, into
 /// protected space that is neither host-local, a platform endpoint nor a leased
 /// router transit address: only a workload behind that handoff remains.
@@ -878,14 +968,31 @@ fn normalize_host(value: &mut HostScope) -> Result<()> {
         .flat_map(|item| item.link.required_ipv4_addresses.iter().cloned())
         .chain(value.uplink.required_ipv4_addresses.iter().cloned())
         .collect();
+    // A platform endpoint on a host address is served here, not forwarded, so
+    // only a declared local endpoint may hold one; it must hold a bound address,
+    // which rtnetlink verifies at apply, recovery and inspection.
+    value.local_platform_endpoints.sort();
+    require(
+        value
+            .local_platform_endpoints
+            .windows(2)
+            .all(|pair| pair[0] != pair[1]),
+    )?;
+    for id in &value.local_platform_endpoints {
+        let endpoint = value
+            .protection
+            .platform_endpoints
+            .iter()
+            .find(|endpoint| endpoint.id == *id)
+            .ok_or(Error::Invalid)?;
+        require(local_addresses.contains(&endpoint.address))?;
+    }
     for ip in &local_addresses {
         require(
             covers_address(&value.protection.prefixes, ip)?
-                && value
-                    .protection
-                    .platform_endpoints
-                    .iter()
-                    .all(|endpoint| endpoint.address != *ip),
+                && value.protection.platform_endpoints.iter().all(|endpoint| {
+                    endpoint.address != *ip || value.local_platform_endpoints.contains(&endpoint.id)
+                }),
         )?;
     }
     for handoff in &mut value.handoffs {
@@ -949,8 +1056,17 @@ fn normalize_host(value: &mut HostScope) -> Result<()> {
 #[path = "egress_hostgrant_tests.rs"]
 pub(crate) mod hostgrant_tests;
 #[cfg(test)]
+#[path = "egress_localplatform_tests.rs"]
+pub(crate) mod localplatform_tests;
+#[cfg(test)]
+#[path = "egress_localport_tests.rs"]
+pub(crate) mod localport_tests;
+#[cfg(test)]
 #[path = "egress_tests.rs"]
 pub(crate) mod tests;
+#[cfg(test)]
+#[path = "egress_workloadgrant_tests.rs"]
+pub(crate) mod workloadgrant_tests;
 impl Policy {
     pub fn prepare(self) -> Result<Prepared> {
         use sha2::{Digest, Sha256};

package/rust/src/egress.workloadgrant.rs

@@ -0,0 +1,88 @@
+//! Workload grants: stateful one-way flows from one workload endpoint to one
+//! exact port of another, both behind the same router. Like host grants they
+//! compile to a constant number of rules around exact set lookups. The tuple key
+//! carries both protocols and the live and originally tracked tuple, so a
+//! translated flow never matches. A second set binds every grant address to the
+//! exact link that holds it (index and name), and both the incoming and the
+//! outgoing link are looked up on every packet. Only the grant's source opens;
+//! the destination only answers.
+use super::hostgrant::{lookup, meta_to, payload_to, tuple_key, tuple_lookup};
+use super::*;
+use std::collections::BTreeSet;
+
+/// Every exact workload-to-workload flow of the scope.
+pub(super) const TUPLE_SET: &str = "workload_grant";
+/// Every grant address with the exact link that holds it.
+pub(super) const LINK_SET: &str = "workload_link";
+
+/// The link a packet crosses and the address on its side of that link: the
+/// incoming link and the source, or the outgoing link and the destination.
+fn link_lookup(incoming: bool) -> Vec<Attr> {
+    vec![
+        meta_to(if incoming { 4 } else { 5 }, 4),
+        meta_to(if incoming { 6 } else { 7 }, 5),
+        payload_to(1, if incoming { 12 } else { 16 }, 4, 9),
+        lookup(LINK_SET),
+    ]
+}
+fn link_key(link: &LocalLink, address: &str) -> Result<Vec<u8>> {
+    let mut key = link.interface_index.to_ne_bytes().to_vec();
+    let mut name = link.interface_name.as_bytes().to_vec();
+    name.resize(16, 0);
+    key.extend(name);
+    key.extend(super::address(address)?.to_be_bytes());
+    Ok(key)
+}
+
+pub(super) fn sets(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
+    if scope.workload_grants.is_empty() {
+        return Ok(());
+    }
+    let mut keys = Vec::new();
+    let mut links = BTreeSet::new();
+    for grant in &scope.workload_grants {
+        keys.push(tuple_key(grant, None)?);
+        for address in [&grant.source_address, &grant.destination_address] {
+            links.insert(link_key(
+                super::router::endpoint_link(scope, address)?,
+                address,
+            )?);
+        }
+    }
+    program.set(TUPLE_SET, 3, 32)?;
+    program.elements(TUPLE_SET, keys)?;
+    program.set(LINK_SET, 4, 24)?;
+    program.elements(LINK_SET, links.into_iter().collect())
+}
+
+/// Four forward admissions whatever the number of grants: the ESTABLISHED
+/// original direction, a NEW UDP opening, a NEW TCP opening restricted to SYN
+/// with FIN/RST/ACK clear, and the ESTABLISHED reply, each in the default
+/// conntrack zone. A reply is only ever ESTABLISHED, so the destination
+/// workload can never open a flow toward the source through a grant.
+pub(super) fn admissions(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
+    if scope.workload_grants.is_empty() {
+        return Ok(());
+    }
+    let admission = |reply: bool, connection_state: u32, transport: Option<&str>| {
+        let mut result = ipv4();
+        result.extend(ct(17, None, 0_u16.to_ne_bytes().to_vec()));
+        result.extend(ct(1, None, vec![u8::from(reply)]));
+        result.extend(state(connection_state));
+        if let Some(transport) = transport {
+            result.extend(meta(16, vec![protocol(transport)]));
+            if transport == "tcp" {
+                result.extend(opening_tcp());
+            }
+        }
+        result.extend(link_lookup(true));
+        result.extend(link_lookup(false));
+        result.extend(tuple_lookup(TUPLE_SET, false, reply));
+        result
+    };
+    program.end("forward", admission(false, 2, None), 1)?;
+    for transport in ["udp", "tcp"] {
+        program.end("forward", admission(false, 8, Some(transport)), 1)?;
+    }
+    program.end("forward", admission(true, 2, None), 1)
+}

package/rust/src/egress_hostgrant_tests.rs

@@ -15,15 +15,15 @@ pub(crate) fn granted(mut value: Value, grants: Value) -> Value {
     value["scope"]["hostGrants"] = grants;
     value
 }
-fn normalized(value: Value) -> crate::Result<Policy> {
+pub(super) fn normalized(value: Value) -> crate::Result<Policy> {
     serde_json::from_value::<Policy>(value)
         .map_err(|_| crate::Error::Invalid)?
         .normalize()
 }
-fn prepared(value: Value) -> Prepared {
+pub(super) fn prepared(value: Value) -> Prepared {
     normalized(value).unwrap().prepare().unwrap()
 }
-fn bytes(prepared: &Prepared) -> Vec<u8> {
+pub(super) fn bytes(prepared: &Prepared) -> Vec<u8> {
     let mut result = Vec::new();
     for (kind, attributes) in prepared.program("snft_host_grant").unwrap() {
         result.extend(kind.to_be_bytes());
@@ -38,28 +38,36 @@ fn exact() -> Value {
 
 /// One packet with the conntrack facts a filter hook observes.
 #[derive(Clone, Copy)]
-struct Flow {
-    input: Option<(u32, &'static str)>,
-    output: Option<(u32, &'static str)>,
-    protocol: u8,
-    source: [u8; 4],
-    destination: [u8; 4],
-    source_port: u16,
-    destination_port: u16,
-    tcp_flags: u8,
-    state: u32,
-    reply: bool,
-    zone: u16,
+pub(super) struct Flow {
+    pub(super) input: Option<(u32, &'static str)>,
+    pub(super) output: Option<(u32, &'static str)>,
+    pub(super) protocol: u8,
+    pub(super) source: [u8; 4],
+    pub(super) destination: [u8; 4],
+    pub(super) source_port: u16,
+    pub(super) destination_port: u16,
+    pub(super) tcp_flags: u8,
+    pub(super) state: u32,
+    pub(super) reply: bool,
+    pub(super) zone: u16,
     /// Original-direction conntrack tuple: source, destination, ports.
-    original: ([u8; 4], [u8; 4], u16, u16),
+    pub(super) original: ([u8; 4], [u8; 4], u16, u16),
+    /// The file system uid of the packet's user socket; None without one, when
+    /// `meta skuid` breaks the rule like the kernel.
+    pub(super) uid: Option<u32>,
 }
 const HOST: [u8; 4] = [10, 240, 0, 1];
 const WORK: [u8; 4] = [10, 241, 0, 2];
 const NEW: u32 = 8;
-const ESTABLISHED: u32 = 2;
+pub(super) const ESTABLISHED: u32 = 2;
 const SYN: u8 = 0x02;
-const ACK: u8 = 0x10;
-fn opening(input: Option<(u32, &'static str)>, output: Option<(u32, &'static str)>) -> Flow {
+pub(super) const ACK: u8 = 0x10;
+/// The `reject with tcp reset` decision, distinct from a plain drop.
+pub(super) const REJECT: i32 = i32::MIN;
+pub(super) fn opening(
+    input: Option<(u32, &'static str)>,
+    output: Option<(u32, &'static str)>,
+) -> Flow {
     Flow {
         input,
         output,
@@ -73,6 +81,7 @@ fn opening(input: Option<(u32, &'static str)>, output: Option<(u32, &'static str
         reply: false,
         zone: 0,
         original: (HOST, WORK, 443, 8080),
+        uid: None,
     }
 }
 /// The workload's answer to `flow`, arriving on the reverse links.
@@ -181,17 +190,17 @@ fn foreign(flow: Flow) -> Vec<Flow> {
 /// kernel does: the terminal verdict, the chain that reached it (`policy` for the
 /// base chain's accept policy) and the conntrack zone a raw rule stored.
 #[derive(Debug, PartialEq, Eq)]
-struct Decision {
-    verdict: i32,
-    chain: String,
-    zone: u16,
+pub(super) struct Decision {
+    pub(super) verdict: i32,
+    pub(super) chain: String,
+    pub(super) zone: u16,
 }
 /// The compiled table: rules per chain and element keys per set.
 struct Table {
     chains: BTreeMap<String, Vec<Vec<Attr>>>,
     sets: BTreeMap<String, Vec<Vec<u8>>>,
 }
-fn chains(prepared: &Prepared) -> BTreeMap<String, Vec<Vec<Attr>>> {
+pub(super) fn chains(prepared: &Prepared) -> BTreeMap<String, Vec<Vec<Attr>>> {
     table(prepared).chains
 }
 fn table(prepared: &Prepared) -> Table {
@@ -246,6 +255,7 @@ fn load(flow: &Flow, name: &str, fields: &[Attr]) -> Option<Vec<u8>> {
     Some(match name {
         "meta" => match wire::number(fields, 2).unwrap() {
             4 => interface(flow.input, false),
+            10 => flow.uid?.to_ne_bytes().to_vec(),
             5 => interface(flow.output, false),
             6 => interface(flow.input, true),
             7 => interface(flow.output, true),
@@ -340,10 +350,14 @@ fn run(table: &Table, chain: &str, flow: &Flow, zone: &mut u16) -> Step {
                     }
                 }
                 "cmp" => {
-                    assert_eq!(wire::number(&fields, 2).unwrap(), 0);
                     let expected = data(&fields, 3);
                     let at = offset(&fields, 1);
-                    matched = registers[at..at + expected.len()] == expected[..];
+                    let equal = registers[at..at + expected.len()] == expected[..];
+                    matched = match wire::number(&fields, 2).unwrap() {
+                        0 => equal,
+                        1 => !equal,
+                        operation => panic!("cmp {operation}"),
+                    };
                 }
                 "range" => {
                     assert_eq!(wire::number(&fields, 2).unwrap(), 0);
@@ -381,6 +395,10 @@ fn run(table: &Table, chain: &str, flow: &Flow, zone: &mut u16) -> Step {
                     registers[at..at + value.len()].copy_from_slice(&value);
                 }
                 "nat" => {}
+                "reject" => {
+                    assert_eq!(fields, vec![Attr::u32(1, 1)]);
+                    verdict = Some((REJECT, None));
+                }
                 other => panic!("{other}"),
             }
             if !matched {
@@ -391,7 +409,7 @@ fn run(table: &Table, chain: &str, flow: &Flow, zone: &mut u16) -> Step {
             continue;
         }
         match verdict {
-            Some((code @ (0 | 1), _)) => {
+            Some((code @ (0 | 1 | REJECT), _)) => {
                 return Step::Final(Decision {
                     verdict: code,
                     chain: chain.into(),
@@ -412,7 +430,7 @@ fn run(table: &Table, chain: &str, flow: &Flow, zone: &mut u16) -> Step {
     Step::Next
 }
 /// A base chain that ends without a terminal verdict accepts by policy.
-fn decide(prepared: &Prepared, chain: &str, flow: &Flow) -> Decision {
+pub(super) fn decide(prepared: &Prepared, chain: &str, flow: &Flow) -> Decision {
     let mut zone = 0;
     match run(&table(prepared), chain, flow, &mut zone) {
         Step::Final(decision) => decision,
@@ -793,7 +811,7 @@ fn host_grants_reject_ranges_wildcards_and_unbound_addresses() {
 }
 
 /// `count` distinct exact grants to the fixture workload, both protocols.
-fn many(count: usize) -> Value {
+pub(super) fn many(count: usize) -> Value {
     json!((0..count)
         .map(|index| host_grant(
             if index % 2 == 0 { "tcp" } else { "udp" },

package/rust/src/egress_localplatform_tests.rs

@@ -0,0 +1,204 @@
+//! Host-local platform endpoints in host transit: leased flows from a handoff
+//! into a platform endpoint served on a host address, and nothing else.
+use super::hostgrant_tests::{
+    bytes, chains, decide, normalized, opening, prepared, Flow, ACK, ESTABLISHED,
+};
+use super::tests::host;
+use serde_json::{json, Value};
+
+const TRANSIT: [u8; 4] = [10, 240, 0, 2];
+const UPLINK: [u8; 4] = [192, 0, 2, 2];
+const HANDOFF: [u8; 4] = [10, 240, 0, 1];
+const LINK: Option<(u32, &str)> = Some((4, "handoff"));
+
+/// The host fixture with two platform endpoints on host addresses: a TCP hub
+/// on the uplink address and a UDP store on the handoff address.
+pub(crate) fn served(mut value: Value) -> Value {
+    value["scope"]["protection"]["platformEndpoints"]
+        .as_array_mut()
+        .unwrap()
+        .extend([
+            json!({"id":"hub","address":"192.0.2.2","protocol":"tcp","port":8443}),
+            json!({"id":"store","address":"10.240.0.1","protocol":"udp","port":7000}),
+        ]);
+    value
+}
+pub(crate) fn local(mut value: Value, ids: Value) -> Value {
+    value["scope"]["localPlatformEndpoints"] = ids;
+    value
+}
+fn exact() -> Value {
+    local(served(host()), json!(["store", "hub"]))
+}
+/// A leased opening from the transit source address arriving on the handoff.
+fn arrival(protocol: u8, source_port: u16, destination: [u8; 4], port: u16) -> Flow {
+    Flow {
+        input: LINK,
+        output: None,
+        protocol,
+        source: TRANSIT,
+        destination,
+        source_port,
+        destination_port: port,
+        original: (TRANSIT, destination, source_port, port),
+        ..opening(LINK, None)
+    }
+}
+/// The host's answer to `flow`, leaving on the handoff.
+fn answer(flow: Flow) -> Flow {
+    Flow {
+        input: None,
+        output: LINK,
+        source: flow.destination,
+        destination: flow.source,
+        source_port: flow.destination_port,
+        destination_port: flow.source_port,
+        tcp_flags: ACK,
+        state: ESTABLISHED,
+        reply: true,
+        ..flow
+    }
+}
+
+#[test]
+fn local_platform_endpoints_absent_and_empty_keep_the_host_digest_and_compiled_bytes() {
+    let baseline = prepared(host());
+    let empty = prepared(local(host(), json!([])));
+    assert_eq!(empty, baseline);
+    assert_eq!(bytes(&empty), bytes(&baseline));
+    let with = prepared(exact());
+    assert!(serde_json::to_string(&with.policy)
+        .unwrap()
+        .contains("\"localPlatformEndpoints\":[\"hub\",\"store\"]"));
+    // Canonical order.
+    assert_eq!(
+        prepared(local(served(host()), json!(["hub", "store"]))),
+        with
+    );
+    // The endpoints and the chains exist only when declared.
+    let graph = chains(&with);
+    assert!(
+        graph.contains_key("local_platform_in")
+            && !chains(&baseline).contains_key("local_platform_in")
+    );
+}
+
+#[test]
+fn local_platform_endpoint_on_a_host_address_is_refused_unless_declared() {
+    // The refusal stays for every undeclared endpoint on a host address.
+    assert!(normalized(served(host())).is_err());
+    assert!(normalized(local(served(host()), json!(["hub"]))).is_err());
+    assert!(normalized(local(served(host()), json!(["store"]))).is_err());
+    assert!(normalized(exact()).is_ok());
+    for invalid in [
+        // Unknown, duplicate, or an endpoint the host does not hold.
+        json!(["hub", "store", "missing"]),
+        json!(["hub", "store", "hub"]),
+        json!(["hub", "store", "dns"]),
+        json!(["hub", "store", "relay"]),
+        json!(["hub", "store", ""]),
+        json!(["hub", "store", 1]),
+        json!("hub"),
+        json!({"hub": true}),
+    ] {
+        assert!(
+            normalized(local(served(host()), invalid.clone())).is_err(),
+            "{invalid}"
+        );
+    }
+}
+
+#[test]
+fn local_platform_endpoint_admits_only_leased_exact_untranslated_flows_and_their_replies() {
+    let baseline = prepared(host());
+    let with = prepared(exact());
+    let tcp = arrival(6, 10500, UPLINK, 8443);
+    let udp = arrival(17, 10500, HANDOFF, 7000);
+    let decided = |flow: &Flow| {
+        let chain = if flow.input.is_some() {
+            "input"
+        } else {
+            "output"
+        };
+        (
+            decide(&baseline, chain, flow).verdict,
+            decide(&with, chain, flow).verdict,
+        )
+    };
+    // Every admitted packet: the TCP opening, established TCP, the UDP opening,
+    // and both replies. The baseline denies each at the handoff.
+    for flow in [
+        tcp,
+        Flow {
+            state: ESTABLISHED,
+            tcp_flags: ACK,
+            ..tcp
+        },
+        udp,
+        answer(tcp),
+        answer(udp),
+    ] {
+        assert_eq!(decided(&flow), (0, 1));
+    }
+    // Everything else keeps the baseline decision: a source port outside the
+    // leased range of the protocol, another source address, another port or
+    // protocol, a flow translated in transit, another zone, a TCP opening
+    // without SYN, and a host-origin opening toward the transit address.
+    for flow in [
+        arrival(6, 20000, UPLINK, 8443),
+        arrival(6, 9999, UPLINK, 8443),
+        arrival(6, 10500, UPLINK, 8444),
+        arrival(17, 10500, UPLINK, 8443),
+        arrival(6, 10500, HANDOFF, 7000),
+        arrival(17, 10500, HANDOFF, 7001),
+        Flow {
+            source: [10, 240, 0, 3],
+            original: ([10, 240, 0, 3], UPLINK, 10500, 8443),
+            ..tcp
+        },
+        Flow {
+            original: (TRANSIT, HANDOFF, 10500, 9000),
+            ..tcp
+        },
+        Flow { zone: 7, ..tcp },
+        Flow {
+            tcp_flags: ACK,
+            ..tcp
+        },
+        Flow {
+            reply: false,
+            state: 8,
+            tcp_flags: 0x02,
+            original: (UPLINK, TRANSIT, 8443, 10500),
+            ..answer(tcp)
+        },
+        Flow {
+            state: 8,
+            ..answer(tcp)
+        },
+    ] {
+        let (before, after) = decided(&flow);
+        assert_eq!(after, before, "{:?}", flow.original);
+    }
+    // A translated arrival that the source range admits is still refused: the
+    // original tuple is part of every check.
+    assert_eq!(
+        decided(&Flow {
+            original: (TRANSIT, HANDOFF, 10500, 9000),
+            ..tcp
+        }),
+        (0, 0)
+    );
+    // Forwarded traffic and the uplink keep their exact previous rules. (The
+    // protected chains list every platform endpoint, served here or not.)
+    let graph = chains(&with);
+    let reference = chains(&baseline);
+    for name in ["forward", "post"] {
+        assert_eq!(graph[name], reference[name], "{name}");
+    }
+    // One jump per leased range per direction, ahead of the handoff denials.
+    assert_eq!(graph["input"].len(), reference["input"].len() + 2);
+    assert_eq!(graph["output"].len(), reference["output"].len() + 2);
+    assert_eq!(graph["local_platform_in"].len(), 4);
+    assert_eq!(graph["local_platform_back"].len(), 2);
+}