@push.rocks/smartnftables 2.5.2 → 2.6.0

package/rust/src/egress_localport_tests.rs

@@ -0,0 +1,264 @@
+//! Loopback TCP port ownership in the allocation-pool guard: canonical input,
+//! strict validation, the exact compiled decision per hook and the atomic budget.
+use super::hostgrant_tests::{
+    bytes, chains, decide, granted, many, normalized, opening, prepared, Flow, ACK, ESTABLISHED,
+    REJECT,
+};
+use super::tests::pool_guard;
+use crate::wire;
+use serde_json::{json, Value};
+
+pub(crate) fn owner(address: &str, port: u16, uid: u32) -> Value {
+    json!({"address":address,"port":port,"uid":uid})
+}
+pub(crate) fn owned(mut value: Value, owners: Value) -> Value {
+    value["scope"]["localTcpPortOwners"] = owners;
+    value
+}
+/// The fixture: a root-only CRI stream port and a port owned by uid 1000.
+fn exact() -> Value {
+    json!([
+        owner("127.0.0.1", 10010, 0),
+        owner("127.0.0.1", 10011, 1000)
+    ])
+}
+const LOOPBACK: [u8; 4] = [127, 0, 0, 1];
+const LO: Option<(u32, &str)> = Some((1, "lo"));
+/// A local TCP opening from `uid` to the loopback `port`, as OUTPUT sees it.
+fn dial(port: u16, uid: Option<u32>) -> Flow {
+    Flow {
+        input: None,
+        output: LO,
+        source: LOOPBACK,
+        destination: LOOPBACK,
+        source_port: 40000,
+        destination_port: port,
+        original: (LOOPBACK, LOOPBACK, 40000, port),
+        uid,
+        ..opening(None, LO)
+    }
+}
+
+#[test]
+fn local_tcp_port_owners_absent_and_empty_keep_the_guard_digest_and_compiled_bytes() {
+    let baseline = prepared(pool_guard());
+    let empty = prepared(owned(pool_guard(), json!([])));
+    assert_eq!(empty, baseline);
+    assert_eq!(bytes(&empty), bytes(&baseline));
+    let with = prepared(owned(pool_guard(), exact()));
+    assert_ne!(with.digest, baseline.digest);
+    // Canonical order: the same set of owners is the same policy.
+    let mut reversed = exact();
+    reversed.as_array_mut().unwrap().reverse();
+    assert_eq!(prepared(owned(pool_guard(), reversed)), with);
+    // The owning uid is part of the policy identity.
+    let changed = json!([
+        owner("127.0.0.1", 10010, 1),
+        owner("127.0.0.1", 10011, 1000)
+    ]);
+    assert_ne!(prepared(owned(pool_guard(), changed)).digest, with.digest);
+}
+
+#[test]
+fn local_tcp_port_owner_rejects_every_other_uid_at_its_exact_loopback_destination() {
+    let baseline = prepared(pool_guard());
+    let with = prepared(owned(pool_guard(), exact()));
+    // Every flow the baseline accepts; the owners change only their exact tuples.
+    for flow in [
+        dial(10010, Some(0)),
+        dial(10010, Some(1000)),
+        dial(10012, Some(1000)),
+    ] {
+        assert_eq!(decide(&baseline, "output", &flow).verdict, 1);
+    }
+    // The owner dials its port; every other user's socket is reset.
+    assert_eq!(decide(&with, "output", &dial(10010, Some(0))).verdict, 1);
+    for uid in [1, 1000, 65534, u32::MAX - 1] {
+        assert_eq!(
+            decide(&with, "output", &dial(10010, Some(uid))).verdict,
+            REJECT,
+            "{uid}"
+        );
+    }
+    assert_eq!(decide(&with, "output", &dial(10011, Some(1000))).verdict, 1);
+    assert_eq!(
+        decide(&with, "output", &dial(10011, Some(0))).verdict,
+        REJECT
+    );
+    // Not only openings: an established packet of another user is reset too.
+    let established = Flow {
+        state: ESTABLISHED,
+        tcp_flags: ACK,
+        ..dial(10010, Some(1000))
+    };
+    assert_eq!(decide(&with, "output", &established).verdict, REJECT);
+    // Without a user socket `meta skuid` breaks the rule: a kernel reply or an
+    // orphaned socket's teardown cannot open a connection.
+    assert_eq!(decide(&with, "output", &dial(10010, None)).verdict, 1);
+    // Another port, another loopback address and UDP keep the baseline decision.
+    for flow in [
+        dial(10012, Some(1000)),
+        Flow {
+            destination: [127, 0, 0, 2],
+            ..dial(10010, Some(1000))
+        },
+        Flow {
+            protocol: 17,
+            ..dial(10010, Some(1000))
+        },
+    ] {
+        assert_eq!(
+            decide(&with, "output", &flow),
+            decide(&baseline, "output", &flow)
+        );
+    }
+    // INPUT admits the destination only from loopback; any other interface, as
+    // route_localnet or prerouting DNAT could deliver it, drops.
+    let arriving = |input| Flow {
+        input,
+        output: None,
+        uid: None,
+        ..dial(10010, None)
+    };
+    assert_eq!(decide(&with, "input", &arriving(LO)).verdict, 1);
+    for input in [Some((2, "ens18")), Some((1, "ens18")), Some((2, "lo"))] {
+        let flow = arriving(input);
+        assert_eq!(decide(&baseline, "input", &flow).verdict, 1);
+        // Index 1 is the loopback device in every namespace; a device named "lo"
+        // with another index is not loopback.
+        let expected = if input.unwrap().0 == 1 { 1 } else { 0 };
+        assert_eq!(decide(&with, "input", &flow).verdict, expected, "{input:?}");
+    }
+    // Guarded pool traffic from any user keeps the guard's decision.
+    let pool = Flow {
+        uid: Some(1000),
+        ..opening(None, Some((4, "handoff")))
+    };
+    assert_eq!(
+        decide(&with, "output", &pool),
+        decide(&baseline, "output", &pool)
+    );
+    assert_eq!(decide(&with, "output", &pool).verdict, 0);
+}
+
+#[test]
+fn local_tcp_port_owners_lead_the_base_chains_and_leave_the_guard_unchanged() {
+    let reference = chains(&prepared(granted(pool_guard(), many(4))));
+    let graph = chains(&prepared(owned(granted(pool_guard(), many(4)), exact())));
+    for name in ["pool_guard", "pool_reply", "forward"] {
+        assert_eq!(graph[name], reference[name], "{name}");
+    }
+    // Two owners, one OUTPUT and one INPUT rule each, ahead of everything the
+    // guard and its host grants compile, so nothing earlier accepts past them.
+    for name in ["output", "input"] {
+        assert_eq!(graph[name].len(), reference[name].len() + 2, "{name}");
+        assert_eq!(graph[name][2..], reference[name][..], "{name}");
+    }
+    let names = |expressions: &Vec<wire::Attr>| -> Vec<String> {
+        expressions
+            .iter()
+            .map(|expression| wire::text(&wire::attrs(&expression.value).unwrap(), 1).unwrap())
+            .collect()
+    };
+    for rule in &graph["output"][..2] {
+        assert_eq!(names(rule).last().unwrap(), "reject");
+    }
+    for rule in &graph["input"][..2] {
+        assert_eq!(names(rule).last().unwrap(), "immediate");
+    }
+}
+
+#[test]
+fn local_tcp_port_owners_reject_non_loopback_wildcard_duplicate_and_unknown_input() {
+    for owners in [
+        json!([owner("10.0.0.1", 10010, 0)]),
+        json!([owner("0.0.0.0", 10010, 0)]),
+        json!([owner("128.0.0.1", 10010, 0)]),
+        json!([owner("127.0.0.0", 10010, 0)]),
+        json!([owner("127.255.255.255", 10010, 0)]),
+        json!([owner("127.0.0.01", 10010, 0)]),
+        json!([owner("127.0.0.1/32", 10010, 0)]),
+        json!([owner("127.0.0.0/8", 10010, 0)]),
+        json!([owner("::1", 10010, 0)]),
+        json!([owner("localhost", 10010, 0)]),
+        json!([owner("127.0.0.1", 0, 0)]),
+        json!([{"address":"127.0.0.1","port":65536,"uid":0}]),
+        json!([{"address":"127.0.0.1","port":10010,"uid":-1}]),
+        json!([owner("127.0.0.1", 10010, u32::MAX)]),
+        json!([{"address":"127.0.0.1","port":10010,"uid":4294967296_u64}]),
+        json!([{"address":"127.0.0.1","port":10010,"uid":0.5}]),
+        json!([{"address":"127.0.0.1","port":10010,"uid":"0"}]),
+        json!([{"address":"127.0.0.1","port":10010}]),
+        json!([{"address":"127.0.0.1","port":10010,"uid":0,"uids":[0]}]),
+        json!([{"address":"127.0.0.1","port":10010,"uid":0,"protocol":"tcp"}]),
+        // One owner per exact address and port.
+        json!([owner("127.0.0.1", 10010, 0), owner("127.0.0.1", 10010, 0)]),
+        json!([
+            owner("127.0.0.1", 10010, 0),
+            owner("127.0.0.1", 10010, 1000)
+        ]),
+        json!({}),
+        Value::Null,
+    ] {
+        assert!(
+            normalized(owned(pool_guard(), owners.clone())).is_err(),
+            "{owners}"
+        );
+    }
+    // Other loopback host addresses and the full port and uid ranges are valid.
+    assert!(normalized(owned(
+        pool_guard(),
+        json!([
+            owner("127.0.0.1", 1, 0),
+            owner("127.0.0.1", 65535, u32::MAX - 1),
+            owner("127.0.0.2", 1, 0),
+            owner("127.255.255.254", 10010, 1000)
+        ])
+    ))
+    .is_ok());
+    // Only the allocation-pool guard carries loopback ownership.
+    for fixture in [super::tests::host(), super::tests::router()] {
+        assert!(normalized(owned(fixture, exact())).is_err());
+    }
+}
+
+#[test]
+fn local_tcp_port_owners_meet_the_atomic_reserve_at_the_contract_maximum() {
+    let deletion = 768 * (20 + 72 + 36 + 12);
+    let maximum: Vec<_> = (0..8)
+        .map(|index| owner("127.0.0.1", 10000 + index, 0))
+        .collect();
+    // The guard's own maximum beside the owners: 64 pools and 1024 host grants.
+    let mut grants = many(1024);
+    for grant in grants.as_array_mut().unwrap() {
+        grant["destinationAddress"] = json!("10.1.0.2");
+    }
+    let mut value = owned(granted(pool_guard(), grants), json!(maximum));
+    value["scope"]["prefixes"] = json!((0..64)
+        .map(|part| format!("10.{part}.0.0/16"))
+        .collect::<Vec<_>>());
+    let prepared = prepared(value.clone());
+    prepared.validate().unwrap();
+    let program = prepared
+        .program(&format!("snft_{}", "x".repeat(59)))
+        .unwrap();
+    let size = |kinds: &[u16]| -> usize {
+        program
+            .iter()
+            .filter(|(kind, _)| kinds.contains(kind))
+            .map(|(_, attributes)| wire::encode_attrs(attributes).len() + 20)
+            .sum()
+    };
+    let (graph, elements) = (size(&[3, 6, 9]), size(&[12]));
+    assert!(program.len() < 768 && graph <= 100_000 && elements <= super::compile::ELEMENT_BYTES);
+    assert!(deletion + graph + elements + 64 <= wire::BATCH_BYTES);
+    println!(
+        "LOCAL_TCP_PORT_OWNER_MAX owners=8 prefixes=64 grants=1024 operations={} rule_bytes={graph}",
+        program.len()
+    );
+    value["scope"]["localTcpPortOwners"]
+        .as_array_mut()
+        .unwrap()
+        .push(owner("127.0.0.1", 10008, 0));
+    assert!(normalized(value).is_err());
+}

package/rust/src/egress_workloadgrant_tests.rs

@@ -0,0 +1,314 @@
+//! Workload grants: stateful one-way flows between two workload endpoints of
+//! one router scope, with no reverse opening.
+use super::hostgrant_tests::{
+    bytes, chains, decide, host_grant, many, normalized, opening, prepared, Flow, ACK, ESTABLISHED,
+};
+use super::tests::{host, pool_guard, router};
+use crate::wire;
+use serde_json::{json, Value};
+
+const SOURCE: [u8; 4] = [10, 241, 0, 2];
+const TARGET: [u8; 4] = [10, 241, 1, 2];
+const SOURCE_LINK: Option<(u32, &str)> = Some((2, "work"));
+const TARGET_LINK: Option<(u32, &str)> = Some((5, "target"));
+
+/// The router fixture with a second veth workload endpoint, `target`.
+pub(crate) fn two_workloads() -> Value {
+    let mut value = router();
+    value["scope"]["endpoints"]
+        .as_array_mut()
+        .unwrap()
+        .push(json!(
+        {"id":"target","interfaceIndex":5,"interfaceName":"target","interfaceKind":"veth",
+            "sourcePrefixes":["10.241.1.2/32"]}));
+    value["scope"]["links"].as_array_mut().unwrap().push(json!(
+        {"interfaceIndex":5,"interfaceName":"target","interfaceKind":"veth",
+            "macAddress":"02:00:00:00:00:05","interfaceLinkIndex":105,
+            "requiredIpv4Addresses":["10.241.1.1"]}));
+    value
+}
+pub(crate) fn workload_grant(protocol: &str, source: &str, destination: &str, port: u16) -> Value {
+    host_grant(protocol, source, destination, port)
+}
+pub(crate) fn granted(mut value: Value, grants: Value) -> Value {
+    value["scope"]["workloadGrants"] = grants;
+    value
+}
+fn exact() -> Value {
+    json!([
+        workload_grant("tcp", "10.241.0.2", "10.241.1.2", 8080),
+        workload_grant("udp", "10.241.0.2", "10.241.1.2", 5353)
+    ])
+}
+/// The source workload's opening toward the target, as FORWARD sees it.
+fn dial(protocol: u8, port: u16) -> Flow {
+    Flow {
+        input: SOURCE_LINK,
+        output: TARGET_LINK,
+        protocol,
+        source: SOURCE,
+        destination: TARGET,
+        source_port: 40000,
+        destination_port: port,
+        original: (SOURCE, TARGET, 40000, port),
+        ..opening(SOURCE_LINK, TARGET_LINK)
+    }
+}
+fn answer(flow: Flow) -> Flow {
+    Flow {
+        input: flow.output,
+        output: flow.input,
+        source: flow.destination,
+        destination: flow.source,
+        source_port: flow.destination_port,
+        destination_port: flow.source_port,
+        tcp_flags: ACK,
+        state: ESTABLISHED,
+        reply: true,
+        ..flow
+    }
+}
+
+#[test]
+fn workload_grants_absent_and_empty_keep_the_router_digest_and_compiled_bytes() {
+    let baseline = prepared(two_workloads());
+    let empty = prepared(granted(two_workloads(), json!([])));
+    assert_eq!(empty, baseline);
+    assert_eq!(bytes(&empty), bytes(&baseline));
+    let with = prepared(granted(two_workloads(), exact()));
+    assert_ne!(with.digest, baseline.digest);
+    let mut reversed = exact();
+    reversed.as_array_mut().unwrap().reverse();
+    assert_eq!(prepared(granted(two_workloads(), reversed)), with);
+    // Only the router scope carries workload grants.
+    for fixture in [host(), pool_guard()] {
+        assert!(normalized(granted(fixture, exact())).is_err());
+    }
+}
+
+#[test]
+fn workload_grant_opens_one_way_and_admits_only_the_exact_answer() {
+    let baseline = prepared(two_workloads());
+    let with = prepared(granted(two_workloads(), exact()));
+    let decided = |flow: &Flow| {
+        (
+            decide(&baseline, "forward", flow).verdict,
+            decide(&with, "forward", flow).verdict,
+        )
+    };
+    let tcp = dial(6, 8080);
+    let udp = dial(17, 5353);
+    // The openings, the established original direction and both answers pass;
+    // the baseline denies each at the private endpoint denials.
+    for flow in [
+        tcp,
+        Flow {
+            state: ESTABLISHED,
+            tcp_flags: ACK,
+            ..tcp
+        },
+        udp,
+        answer(tcp),
+        answer(udp),
+    ] {
+        assert_eq!(decided(&flow), (0, 1), "{:?}", flow.original);
+    }
+    // No reverse opening: the target cannot open toward the source, not even
+    // from the granted port to the source's port, and an answer that is not
+    // ESTABLISHED is refused.
+    let reverse = |port: u16, source_port: u16| Flow {
+        reply: false,
+        state: 8,
+        tcp_flags: 0x02,
+        original: (TARGET, SOURCE, source_port, port),
+        ..answer(Flow {
+            source_port: port,
+            destination_port: source_port,
+            ..tcp
+        })
+    };
+    for flow in [
+        reverse(40000, 8080),
+        reverse(8080, 40000),
+        reverse(5353, 40000),
+        Flow {
+            state: 8,
+            ..answer(tcp)
+        },
+        Flow {
+            state: 8,
+            ..answer(udp)
+        },
+    ] {
+        assert_eq!(decided(&flow), (0, 0), "{:?}", flow.original);
+    }
+    // Everything the grant does not name keeps the baseline decision: another
+    // port or protocol, a spoofed or renamed link, another address, a flow
+    // translated in transit, another zone and a TCP opening without SYN.
+    for flow in [
+        dial(6, 8081),
+        dial(17, 8080),
+        dial(6, 5353),
+        Flow {
+            input: Some((3, "vpn")),
+            ..tcp
+        },
+        Flow {
+            input: Some((2, "renamed")),
+            ..tcp
+        },
+        Flow {
+            input: Some((9, "work")),
+            ..tcp
+        },
+        Flow {
+            output: Some((5, "renamed")),
+            ..tcp
+        },
+        Flow {
+            destination: [10, 241, 1, 3],
+            original: (SOURCE, [10, 241, 1, 3], 40000, 8080),
+            ..tcp
+        },
+        Flow {
+            original: (SOURCE, TARGET, 40000, 9090),
+            ..tcp
+        },
+        Flow {
+            original: ([10, 241, 0, 9], TARGET, 40000, 8080),
+            ..tcp
+        },
+        Flow { zone: 17, ..tcp },
+        Flow {
+            tcp_flags: ACK,
+            ..tcp
+        },
+    ] {
+        let (before, after) = decided(&flow);
+        assert_eq!(after, before, "{:?} {:?}", flow.input, flow.original);
+    }
+    // Everything else in the graph is unchanged.
+    let graph = chains(&with);
+    let reference = chains(&baseline);
+    for (name, rules) in &reference {
+        if name != "forward" {
+            assert_eq!(&graph[name], rules, "{name}");
+        }
+    }
+    assert_eq!(graph["forward"].len(), reference["forward"].len() + 4);
+}
+
+#[test]
+fn workload_grants_reject_unbound_same_link_local_platform_and_tun_ends() {
+    assert!(normalized(granted(two_workloads(), exact())).is_ok());
+    let grant = |source: &str, destination: &str| {
+        granted(
+            two_workloads(),
+            json!([workload_grant("tcp", source, destination, 8080)]),
+        )
+    };
+    let mut tun = two_workloads();
+    tun["scope"]["endpoints"][1]["sourcePrefixes"] = json!(["10.242.0.0/24"]);
+    for invalid in [
+        // An end outside every workload endpoint, or the same endpoint twice.
+        grant("10.241.0.2", "10.241.9.2"),
+        grant("10.241.9.2", "10.241.1.2"),
+        grant("10.241.0.2", "10.241.0.2"),
+        // A router-local address or a TUN endpoint is not a veth workload.
+        grant("10.241.0.2", "10.241.1.1"),
+        grant("10.242.0.2", "10.241.1.2"),
+        grant("10.241.0.2", "10.242.0.2"),
+        // Prefixes, wildcards, ports and duplicates, as for host grants.
+        grant("10.241.0.2", "10.241.1.0/24"),
+        grant("0.0.0.0", "10.241.1.2"),
+        granted(
+            two_workloads(),
+            json!([workload_grant("tcp", "10.241.0.2", "10.241.1.2", 0)]),
+        ),
+        granted(
+            two_workloads(),
+            json!([workload_grant("sctp", "10.241.0.2", "10.241.1.2", 80)]),
+        ),
+        granted(
+            two_workloads(),
+            json!([
+                workload_grant("tcp", "10.241.0.2", "10.241.1.2", 80),
+                workload_grant("tcp", "10.241.0.2", "10.241.1.2", 80)
+            ]),
+        ),
+        granted(
+            two_workloads(),
+            json!([{"protocol":"tcp","sourceAddress":"10.241.0.2","destinationAddress":"10.241.1.2",
+                "destinationPort":80,"bidirectional":true}]),
+        ),
+        granted(
+            two_workloads(),
+            json!((0..1025_u16)
+                .map(|port| workload_grant("tcp", "10.241.0.2", "10.241.1.2", 1 + port))
+                .collect::<Vec<_>>()),
+        ),
+    ] {
+        assert!(
+            normalized(invalid.clone()).is_err(),
+            "{}",
+            invalid["scope"]["workloadGrants"]
+        );
+    }
+    // Both directions between two workloads are two separate grants.
+    assert!(normalized(granted(
+        two_workloads(),
+        json!([
+            workload_grant("tcp", "10.241.0.2", "10.241.1.2", 8080),
+            workload_grant("tcp", "10.241.1.2", "10.241.0.2", 8080)
+        ])
+    ))
+    .is_ok());
+}
+
+/// 1024 grants fit the atomic reserve with a constant rule graph; the element
+/// budget is shared with the scope's host grants.
+#[test]
+fn workload_grants_meet_the_atomic_reserve_at_the_contract_maximum() {
+    let deletion = 768 * (20 + 72 + 36 + 12);
+    let maximum: Vec<_> = (0..1024_u16)
+        .map(|index| {
+            workload_grant(
+                if index % 2 == 0 { "tcp" } else { "udp" },
+                "10.241.0.2",
+                "10.241.1.2",
+                20000 + index / 2,
+            )
+        })
+        .collect();
+    let small = prepared(granted(two_workloads(), exact()));
+    let prepared = prepared(granted(two_workloads(), json!(maximum)));
+    assert_eq!(
+        chains(&prepared)["forward"].len(),
+        chains(&small)["forward"].len()
+    );
+    let program = prepared
+        .program(&format!("snft_{}", "x".repeat(59)))
+        .unwrap();
+    let size = |kinds: &[u16]| -> usize {
+        program
+            .iter()
+            .filter(|(kind, _)| kinds.contains(kind))
+            .map(|(_, attributes)| wire::encode_attrs(attributes).len() + 20)
+            .sum()
+    };
+    let (graph, elements) = (size(&[3, 6, 9]), size(&[12]));
+    assert!(program.len() < 768 && graph <= 100_000 && elements <= super::compile::ELEMENT_BYTES);
+    assert!(deletion + graph + elements + 64 <= wire::BATCH_BYTES);
+    println!(
+        "WORKLOAD_GRANT_MAX grants=1024 operations={} rule_bytes={graph} element_bytes={elements}",
+        program.len()
+    );
+    // Host grants and workload grants share one element budget per target:
+    // half the host grant maximum fits beside the workload maximum, both maxima
+    // together are refused before any kernel work.
+    let mut both = granted(two_workloads(), json!(maximum));
+    both["scope"]["hostGrants"] = many(512);
+    normalized(both.clone()).unwrap().prepare().unwrap();
+    both["scope"]["hostGrants"] = many(1024);
+    assert!(normalized(both).unwrap().prepare().is_err());
+}

package/rust/src/owner.rs

@@ -741,7 +741,7 @@ fn rule_identity(attributes: &[Attr]) -> Result<(String, Vec<u8>)> {
             "cmp" => &[3],
             "bitwise" => &[4, 5],
             "range" => &[3, 4],
-            "meta" | "payload" | "ct" | "nat" | "lookup" => &[],
+            "meta" | "payload" | "ct" | "nat" | "lookup" | "reject" => &[],
             _ => return Err(Error::Conflict),
         };
         for attribute in &mut data {
@@ -775,6 +775,7 @@ fn validate_egress_expression(name: &str, data: &[Attr]) -> Result<()> {
         "lookup" => &[1, 2, 5],
         "ct" | "range" => &[1, 2, 3, 4],
         "nat" => &[1, 2, 3, 4, 5, 6, 7],
+        "reject" => &[1],
         _ => return Ok(()),
     };
     for attribute in data {
@@ -825,6 +826,12 @@ fn validate_egress_expression(name: &str, data: &[Attr]) -> Result<()> {
                 wire::number(data, 6)?;
             }
         }
+        "reject" => {
+            // Only a TCP reset, which carries no ICMP code.
+            if data.len() != 1 || wire::number(data, 1)? != 1 {
+                return Err(Error::Conflict);
+            }
+        }
         "range" => {
             wire::number(data, 1)?;
             if wire::number(data, 2)? > 1 || data.len() != 4 {

package/rust/src/owner_hostgrant_traffic_tests.rs

@@ -79,13 +79,13 @@ fn guard_policy(revision: u64, granted: bool) -> egress::Policy {
     policy
 }
 /// One policy owner in its own namespace; every transition runs there.
-struct Hop {
+pub(super) struct Hop {
     namespace: &'static str,
     owner: Option<Owner>,
     applied: Option<Applied>,
 }
 impl Hop {
-    fn new(namespace: &'static str, table: &'static str) -> Self {
+    pub(super) fn new(namespace: &'static str, table: &'static str) -> Self {
         let owner = in_namespace(namespace, move || Owner::new(options(table)).unwrap());
         Self {
             namespace,
@@ -93,7 +93,12 @@ impl Hop {
             applied: None,
         }
     }
-    fn apply(&mut self, build: fn(u64, bool) -> egress::Policy, revision: u64, granted: bool) {
+    pub(super) fn apply(
+        &mut self,
+        build: fn(u64, bool) -> egress::Policy,
+        revision: u64,
+        granted: bool,
+    ) {
         let mut owner = self.owner.take().unwrap();
         let previous = self.applied.take();
         let (owner, applied) = in_namespace(self.namespace, move || {
@@ -108,7 +113,7 @@ impl Hop {
         self.owner = Some(owner);
         self.applied = Some(applied);
     }
-    fn release(mut self) {
+    pub(super) fn release(mut self) {
         let mut owner = self.owner.take().unwrap();
         let applied = self.applied.take().unwrap();
         in_namespace(self.namespace, move || {