@push.rocks/smartnftables 2.5.2 → 3.0.0

package/rust/src/owner_identity_tests.rs

@@ -168,94 +168,162 @@ fn egress_identity_rejects_unknown_duplicate_or_incomplete_operands() {
     }
 }
 
+/// The compiled chains, rules, and sets with their element identities of one
+/// prepared policy, as the owner's graph comparison sees them.
+type Compiled = (
+    Vec<Vec<u8>>,
+    Vec<(String, Vec<u8>)>,
+    std::collections::BTreeMap<String, (Vec<u8>, Vec<Vec<u8>>)>,
+);
+fn compiled(value: serde_json::Value) -> Compiled {
+    let prepared = serde_json::from_value::<crate::egress::Policy>(value)
+        .unwrap()
+        .prepare()
+        .unwrap();
+    let (mut chains, mut rules) = (Vec::new(), Vec::new());
+    let mut sets = std::collections::BTreeMap::new();
+    for (kind, attributes) in prepared.program("snft_identity").unwrap() {
+        match kind {
+            3 => chains.push(super::chain_identity(&attributes).unwrap()),
+            6 => {
+                // The stamp carries the policy digest; compare the rule itself.
+                let unstamped: Vec<Attr> = attributes
+                    .iter()
+                    .map(|attribute| match attribute.id() {
+                        7 => Attr::bytes(7, b"stamp".to_vec()),
+                        _ => attribute.clone(),
+                    })
+                    .collect();
+                rules.push(rule_identity(&unstamped).unwrap());
+            }
+            9 => {
+                // The kernel's dump of the same set has the same identity.
+                let identity = set_identity(&attributes).unwrap();
+                assert_eq!(set_identity(&dumped_set(&attributes)).unwrap(), identity);
+                sets.insert(wire::text(&attributes, 2).unwrap(), (identity, Vec::new()));
+            }
+            12 => {
+                let list = wire::attrs(&wire::one(&attributes, 3).unwrap().value).unwrap();
+                sets.get_mut(&wire::text(&attributes, 2).unwrap())
+                    .unwrap()
+                    .1
+                    .extend(element_keys(&list).unwrap());
+            }
+            other => panic!("operation {other}"),
+        }
+    }
+    (chains, rules, sets)
+}
+
 /// A published host-transit generation must survive the same apply-time graph
-/// identity as the rest of the table: the kernel dump is compared operand by
-/// operand, so destination NAT and its admissions cannot be silently rewritten.
+/// identity as the rest of the table: its rules and every set element are
+/// compared operand by operand, so destination NAT and its admissions cannot be
+/// silently rewritten, while the rules stay the same for any publication.
 #[test]
 fn published_host_graph_identity_preserves_destination_nat_and_admission_operands() {
-    let compiled = |target_port: u16| {
-        let value = crate::egress::tests::published_host(serde_json::json!([
+    let host = |target_port: u16| {
+        compiled(crate::egress::tests::published_host(serde_json::json!([
             crate::egress::tests::published_port("tcp", 443, target_port)
-        ]));
-        let prepared = serde_json::from_value::<crate::egress::Policy>(value)
-            .unwrap()
-            .prepare()
-            .unwrap();
-        let mut chains = Vec::new();
-        let mut rules = Vec::new();
-        for (kind, attributes) in prepared.program("snft_identity").unwrap() {
-            if kind == 3 {
-                chains.push(super::chain_identity(&attributes).unwrap());
-            } else {
-                rules.push(rule_identity(&attributes).unwrap());
-            }
-        }
-        (chains, rules)
+        ])))
     };
-    let (chains, rules) = compiled(8443);
+    let (chains, rules, sets) = host(8443);
     assert_eq!(rules.iter().filter(|(chain, _)| chain == "pre").count(), 1);
     assert_eq!(chains.len(), 7);
-    let translation = rules.iter().find(|(chain, _)| chain == "pre").unwrap();
-    let (_, changed) = compiled(9443);
-    let other = changed.iter().find(|(chain, _)| chain == "pre").unwrap();
-    assert_ne!(translation.1, other.1);
-    assert_eq!(
-        rules.iter().filter(|(chain, _)| chain == "forward").count(),
-        changed.iter().filter(|(chain, _)| chain == "forward").count()
-    );
+    let (_, changed_rules, changed_sets) = host(9443);
+    assert_eq!(rules, changed_rules);
+    // The translation's port is map data and the admission's port is a key.
+    for name in ["published_port", "published_forward"] {
+        assert_eq!(sets[name].0, changed_sets[name].0);
+        assert_ne!(sets[name].1, changed_sets[name].1, "{name}");
+    }
 }
 
 /// A published router generation must survive the same apply-time graph identity
-/// as the rest of the table: the kernel dump is compared operand by operand, so
-/// the workload translation and its admissions cannot be silently rewritten.
+/// as the rest of the table: its rules and every set element are compared operand
+/// by operand, so the workload translation, both classifications and the
+/// admissions cannot be silently rewritten.
 #[test]
 fn published_router_graph_identity_preserves_destination_nat_and_admission_operands() {
-    let compiled = |endpoint_port: u16| {
-        let value = crate::egress::tests::published_router(serde_json::json!([
+    let router = |endpoint_port: u16| {
+        compiled(crate::egress::tests::published_router(serde_json::json!([
             crate::egress::tests::router_published_port("tcp", 443, endpoint_port)
-        ]));
-        let prepared = serde_json::from_value::<crate::egress::Policy>(value)
-            .unwrap()
-            .prepare()
-            .unwrap();
-        let mut chains = Vec::new();
-        let mut rules = Vec::new();
-        for (kind, attributes) in prepared.program("snft_identity").unwrap() {
-            if kind == 3 {
-                chains.push(super::chain_identity(&attributes).unwrap());
-            } else {
-                rules.push(rule_identity(&attributes).unwrap());
-            }
-        }
-        (chains, rules)
+        ])))
     };
-    let (chains, rules) = compiled(8443);
+    let (chains, rules, sets) = router(8443);
     assert_eq!(rules.iter().filter(|(chain, _)| chain == "pre").count(), 1);
-    assert_eq!(chains.len(), 16);
-    let translation = rules.iter().find(|(chain, _)| chain == "pre").unwrap();
-    let (_, changed) = compiled(9443);
-    let other = changed.iter().find(|(chain, _)| chain == "pre").unwrap();
-    assert_ne!(translation.1, other.1);
-    assert_eq!(
-        rules.iter().filter(|(chain, _)| chain == "forward").count(),
-        changed.iter().filter(|(chain, _)| chain == "forward").count()
-    );
-    // The handoff ingress classification is part of the same identity.
+    // The router's base chains, the pre chain and its three regular chains.
+    assert_eq!(chains.len(), 10);
+    let (_, changed_rules, changed_sets) = router(9443);
+    assert_eq!(rules, changed_rules);
+    for name in ["published_port", "published_forward", "published_endpoint"] {
+        assert_ne!(sets[name].1, changed_sets[name].1, "{name}");
+    }
+    assert_eq!(sets["published_arrival"], changed_sets["published_arrival"]);
+}
+
+/// Interval elements carry their last key and a map's data in their identity;
+/// a changed bound or datum is a changed element, and a set description is only
+/// ever a concatenation.
+#[test]
+fn interval_sets_and_elements_have_exact_graph_identity() {
+    let (_, _, sets) = compiled(crate::egress::tests::published_router(serde_json::json!([
+        crate::egress::tests::router_published_port("tcp", 443, 8443)
+    ])));
     assert_eq!(
-        rules.iter().filter(|(chain, _)| chain == "raw_return").count(),
-        changed
-            .iter()
-            .filter(|(chain, _)| chain == "raw_return")
-            .count()
+        sets.keys().filter(|name| name.starts_with("published_")).count(),
+        4
     );
+    let element = |last: u8, data: Option<u8>| {
+        let value = |kind: u16, byte: u8| Attr::nested(kind, vec![Attr::bytes(1, vec![byte; 8])]);
+        let mut fields = vec![value(1, 1), value(10, last)];
+        if let Some(data) = data {
+            fields.push(value(2, data));
+        }
+        Attr::nested(1, fields)
+    };
+    let identity = |attribute: Attr| element_keys(&[attribute]).unwrap();
+    let exact = identity(element(1, Some(4)));
+    assert_ne!(identity(element(2, Some(4))), exact);
+    assert_ne!(identity(element(1, Some(5))), exact);
+    assert_ne!(identity(element(1, None)), exact);
+    for extension in [
+        Attr::u32(3, 1),
+        Attr::nested(10, vec![Attr::bytes(1, vec![1; 8])]),
+    ] {
+        let Attr { value, .. } = element(1, Some(4));
+        let mut fields = wire::attrs(&value).unwrap();
+        fields.push(extension);
+        assert!(element_keys(&[Attr::nested(1, fields)]).is_err());
+    }
 }
 
-/// A host-grant set as Linux dumps it: the compiled creation plus the kernel's
-/// handle, an empty description, the backend type and the element count.
+/// A set as Linux dumps it: the compiled creation plus the kernel's handle, its
+/// description (empty for a plain key, the concatenation's field lengths without
+/// nesting flags otherwise), the backend type and the element count.
 fn dumped_set(created: &[Attr]) -> Vec<Attr> {
-    let mut dump: Vec<Attr> = created.iter().filter(|attribute| attribute.id() != 10).cloned().collect();
+    let mut dump: Vec<Attr> = created
+        .iter()
+        .filter(|attribute| ![9, 10].contains(&attribute.id()))
+        .cloned()
+        .collect();
     dump.push(Attr::u64(16, 7));
-    dump.push(Attr::nested(9, vec![]));
+    let fields = created
+        .iter()
+        .find(|attribute| attribute.id() == 9)
+        .map(|description| {
+            let concatenation = wire::attrs(&description.value).unwrap();
+            wire::attrs(&wire::one(&concatenation, 2).unwrap().value)
+                .unwrap()
+                .iter()
+                .map(|field| {
+                    Attr::bytes(1, wire::encode_attrs(&[Attr::u32(1, wire::number(&wire::attrs(&field.value).unwrap(), 1).unwrap())]))
+                })
+                .collect::<Vec<_>>()
+        });
+    dump.push(match fields {
+        Some(fields) => Attr::bytes(9, wire::encode_attrs(&[Attr::bytes(2, wire::encode_attrs(&fields))])),
+        None => Attr::nested(9, vec![]),
+    });
     dump.push(Attr::string(19, "nft_rhash_type"));
     dump.push(Attr::u32(20, 1024));
     dump
@@ -273,7 +341,11 @@ fn host_grant_sets_elements_and_lookups_have_exact_graph_identity() {
     .prepare()
     .unwrap();
     let program = prepared.program("snft_identity").unwrap();
-    let sets: Vec<_> = program.iter().filter(|(kind, _)| *kind == 9).map(|(_, attributes)| attributes.clone()).collect();
+    let sets: Vec<_> = program
+        .iter()
+        .filter(|(kind, attributes)| *kind == 9 && wire::text(attributes, 2).unwrap().starts_with("host_grant"))
+        .map(|(_, attributes)| attributes.clone())
+        .collect();
     assert_eq!(sets.len(), 2);
     for created in &sets {
         // The kernel's informational attributes are not identity.
@@ -294,21 +366,30 @@ fn host_grant_sets_elements_and_lookups_have_exact_graph_identity() {
             assert!(set_identity(&changed).is_err());
         }
     }
-    // Elements are plain keys; any extension rejects.
-    let (_, elements) = program.iter().find(|(kind, _)| *kind == 12).unwrap();
+    // Elements are plain keys; flags reject, and data is a different element.
+    let (_, elements) = program
+        .iter()
+        .find(|(kind, attributes)| *kind == 12 && wire::text(attributes, 2).unwrap() == "host_grant")
+        .unwrap();
     let list = wire::attrs(&wire::one(elements, 3).unwrap().value).unwrap();
     assert_eq!(element_keys(&list).unwrap().len(), 1);
     let key = wire::attrs(&list[0].value).unwrap();
-    for extension in [Attr::u32(3, 1), Attr::nested(2, vec![Attr::bytes(1, vec![1; 4])])] {
-        let mut changed = key.clone();
-        changed.push(extension);
-        assert!(element_keys(&[Attr::nested(1, changed)]).is_err());
-    }
-    // Every lookup names its set with a plain, uninverted membership test, and
-    // the key registers are part of identity.
+    let mut flagged = key.clone();
+    flagged.push(Attr::u32(3, 1));
+    assert!(element_keys(&[Attr::nested(1, flagged)]).is_err());
+    let mut mapped = key.clone();
+    mapped.push(Attr::nested(2, vec![Attr::bytes(1, vec![1; 4])]));
+    assert_ne!(
+        element_keys(&[Attr::nested(1, mapped)]).unwrap(),
+        element_keys(&list[..1]).unwrap()
+    );
+    // Five rules look up the host grant sets (the router's private and leased
+    // sets have their own lookups); the set name and key registers are identity.
     let lookups: Vec<_> = program
         .iter()
-        .filter(|(kind, attributes)| *kind == 6 && rule_identity(attributes).unwrap().1.windows(6).any(|window| window == b"lookup"))
+        .filter(|(kind, attributes)| {
+            *kind == 6 && wire::encode_attrs(attributes).windows(10).any(|window| window == b"host_grant")
+        })
         .collect();
     assert_eq!(lookups.len(), 5);
     let lookup = |data: Vec<Attr>| rule(vec![expression("lookup", data)]);
@@ -317,14 +398,81 @@ fn host_grant_sets_elements_and_lookups_have_exact_graph_identity() {
     for changed in [
         vec![Attr::string(1, "host_grant_arrival"), Attr::u32(2, 1), Attr::u32(5, 0)],
         vec![Attr::string(1, "host_grant"), Attr::u32(2, 9), Attr::u32(5, 0)],
+        // A map lookup's data register and an absence test are identity.
+        vec![Attr::string(1, "host_grant"), Attr::u32(2, 1), Attr::u32(3, 2), Attr::u32(5, 0)],
+        vec![Attr::string(1, "host_grant"), Attr::u32(2, 1), Attr::u32(5, 1)],
     ] {
         assert_ne!(rule_identity(&lookup(changed)).unwrap(), identity);
     }
     for invalid in [
-        vec![Attr::string(1, "host_grant"), Attr::u32(2, 1), Attr::u32(5, 1)],
+        vec![Attr::string(1, "host_grant"), Attr::u32(2, 1), Attr::u32(5, 2)],
         vec![Attr::string(1, "host_grant"), Attr::u32(2, 1)],
-        vec![Attr::string(1, "host_grant"), Attr::u32(2, 1), Attr::u32(3, 2), Attr::u32(5, 0)],
+        vec![Attr::string(1, "host_grant"), Attr::u32(2, 1), Attr::u32(3, 2)],
+        // A map lookup is never inverted.
+        vec![Attr::string(1, "host_grant"), Attr::u32(2, 1), Attr::u32(3, 2), Attr::u32(5, 1)],
     ] {
         assert!(rule_identity(&lookup(invalid)).is_err());
     }
 }
+
+/// A loopback port owner compiles `meta skuid != uid` and a TCP reset. The graph
+/// identity keeps the comparison operator, the uid and the reject type, and the
+/// only reject Linux may dump back is a plain TCP reset.
+#[test]
+fn local_tcp_port_owner_graph_identity_preserves_uid_operator_and_tcp_reset() {
+    let policy = |uid: u32| {
+        crate::egress::localport_tests::owned(
+            crate::egress::tests::pool_guard(),
+            serde_json::json!([crate::egress::localport_tests::owner(
+                "127.0.0.1",
+                10010,
+                uid
+            )]),
+        )
+    };
+    let output = |uid: u32| {
+        let prepared = serde_json::from_value::<crate::egress::Policy>(policy(uid))
+            .unwrap()
+            .prepare()
+            .unwrap();
+        let program = prepared.program("snft_identity").unwrap();
+        let (_, rule) = program
+            .into_iter()
+            .find(|(kind, attributes)| *kind == 6 && wire::text(attributes, 2).unwrap() == "output")
+            .unwrap();
+        rule
+    };
+    let root = rule_identity(&output(0)).unwrap();
+    assert_ne!(rule_identity(&output(1000)).unwrap().1, root.1);
+    // The same rule with `==` instead of `!=` is a different graph.
+    let mut equal = output(0);
+    let expressions = wire::attrs(&wire::one(&equal, 4).unwrap().value).unwrap();
+    let flipped: Vec<_> = expressions
+        .iter()
+        .enumerate()
+        .map(|(index, item)| {
+            if index + 2 != expressions.len() {
+                return item.clone();
+            }
+            let parts = wire::attrs(&item.value).unwrap();
+            let mut fields = wire::attrs(&wire::one(&parts, 2).unwrap().value).unwrap();
+            assert_eq!(wire::number(&fields, 2).unwrap(), 1);
+            fields[1] = Attr::u32(2, 0);
+            expression("cmp", fields)
+        })
+        .collect();
+    equal[2] = Attr::nested(4, flipped);
+    assert_ne!(rule_identity(&equal).unwrap(), root);
+    let reject = |data: Vec<Attr>| rule(vec![expression("reject", data)]);
+    assert!(rule_identity(&reject(vec![Attr::u32(1, 1)])).is_ok());
+    for invalid in [
+        vec![],
+        vec![Attr::u32(1, 0)],
+        vec![Attr::u32(1, 2)],
+        vec![Attr::u32(1, 1), Attr::bytes(2, vec![3])],
+        vec![Attr::u32(1, 1), Attr::u32(1, 1)],
+        vec![Attr::bytes(1, vec![1])],
+    ] {
+        assert!(rule_identity(&reject(invalid)).is_err());
+    }
+}

package/rust/src/owner_localplatform_tests.rs

@@ -0,0 +1,274 @@
+use super::egress_traffic_tests::{connect, denied, host_policy, ns_ip, roundtrip};
+use super::host_traffic_tests::{immediate, payload};
+use super::hostgrant_traffic_tests::Hop;
+use super::router_traffic_tests::connect_from;
+use super::*;
+use crate::{
+    egress,
+    policy::{expr, meta},
+};
+use std::io::{Read, Write};
+use std::net::{TcpListener, TcpStream, UdpSocket};
+use std::time::Duration;
+
+const ROUTER: &str = "lp_router";
+const HOST: &str = "lp_host";
+const PEER: &str = "lp_peer";
+
+/// Two platform endpoints the host serves itself: a TCP hub on the uplink
+/// address and a UDP store on the handoff address.
+fn served(policy: &mut egress::Policy, declared: bool) {
+    let egress::Scope::HostTransit(scope) = &mut policy.scope else {
+        panic!()
+    };
+    if declared {
+        scope.protection.platform_endpoints.extend([
+            egress::PlatformEndpoint {
+                id: "hub".into(),
+                address: "192.0.2.2".into(),
+                protocol: "tcp".into(),
+                port: 8443,
+            },
+            egress::PlatformEndpoint {
+                id: "store".into(),
+                address: "10.240.0.1".into(),
+                protocol: "udp".into(),
+                port: 7000,
+            },
+        ]);
+        scope.local_platform_endpoints = vec!["hub".into(), "store".into()];
+    }
+}
+fn transit_policy(revision: u64, declared: bool) -> egress::Policy {
+    let mut policy = host_policy();
+    policy.revision = revision;
+    served(&mut policy, declared);
+    policy
+}
+
+// A foreign prerouting DNAT, only in this guest: the handoff address port 9000
+// translates to the served hub, so a leased flow could otherwise reach the hub
+// under another destination.
+fn foreign_translation() {
+    let table = "snft_foreign_local_platform";
+    let mut expressions = meta(16, vec![6]);
+    expressions.extend(payload(16, vec![10, 240, 0, 1], false));
+    expressions.extend(payload(2, 9000_u16.to_be_bytes().to_vec(), true));
+    expressions.push(immediate(vec![192, 0, 2, 2]));
+    expressions.push(expr(
+        "immediate",
+        vec![
+            Attr::u32(1, 2),
+            Attr::nested(2, vec![Attr::bytes(1, 8443_u16.to_be_bytes().to_vec())]),
+        ],
+    ));
+    expressions.push(expr(
+        "nat",
+        vec![
+            Attr::u32(1, 1),
+            Attr::u32(2, 2),
+            Attr::u32(3, 1),
+            Attr::u32(4, 1),
+            Attr::u32(5, 2),
+            Attr::u32(6, 2),
+            Attr::u32(7, 3),
+        ],
+    ));
+    let operations = vec![
+        (0, 0x600, vec![Attr::string(1, table), Attr::u32(2, 6)]),
+        (
+            3,
+            0x600,
+            vec![
+                Attr::string(1, table),
+                Attr::string(3, "pre"),
+                Attr::nested(4, vec![Attr::u32(1, 0), Attr::u32(2, -100_i32 as u32)]),
+                Attr::u32(5, 1),
+                Attr::string(7, "nat"),
+                Attr::u32(10, 1),
+            ],
+        ),
+        (
+            6,
+            0xc00,
+            vec![
+                Attr::string(1, table),
+                Attr::string(2, "pre"),
+                Attr::nested(4, expressions),
+            ],
+        ),
+    ];
+    let mut socket = wire::Socket::open().unwrap();
+    let generation = socket.generation().unwrap();
+    socket.batch(generation, operations).unwrap();
+}
+
+/// A UDP socket in `namespace` bound to an exact address and port.
+fn udp(namespace: &str, address: String) -> UdpSocket {
+    let socket = in_namespace(namespace, move || UdpSocket::bind(address).unwrap());
+    socket
+        .set_read_timeout(Some(Duration::from_millis(250)))
+        .unwrap();
+    socket
+}
+/// A TCP flow from an exact leased source address and port in the router
+/// namespace. On success the host's listener observes that exact source and
+/// data crosses both ways.
+fn dial(source: &str, destination: &str, listener: &TcpListener) -> Option<(TcpStream, TcpStream)> {
+    let (from, to) = (source.to_owned(), destination.to_owned());
+    let client = in_namespace(ROUTER, move || connect_from(&from, &to)).ok()?;
+    let (server, peer) = listener.accept().unwrap();
+    assert_eq!(peer.to_string(), source);
+    let (mut client, mut server) = (client, server);
+    for stream in [&client, &server] {
+        stream
+            .set_read_timeout(Some(Duration::from_secs(1)))
+            .unwrap();
+    }
+    client.write_all(b"ping").unwrap();
+    server.read_exact(&mut [0; 4]).unwrap();
+    server.write_all(b"pong").unwrap();
+    client.read_exact(&mut [0; 4]).unwrap();
+    Some((client, server))
+}
+fn dark(source: &str, destination: &str, listener: &TcpListener) {
+    assert!(
+        dial(source, destination, listener).is_none(),
+        "{source} -> {destination}"
+    );
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn v2_host_serves_local_platform_endpoints_only_to_exact_leased_untranslated_flows() {
+    isolated();
+    for name in [ROUTER, HOST, PEER] {
+        ip(&["netns", "add", name]);
+        ns_ip(name, &["link", "set", "lo", "up"]);
+    }
+    connect(
+        ROUTER,
+        "handoff",
+        "10.240.0.2/29",
+        HOST,
+        "router",
+        "10.240.0.1/29",
+    );
+    connect(
+        HOST,
+        "uplink",
+        "192.0.2.2/24",
+        PEER,
+        "underlay",
+        "192.0.2.3/24",
+    );
+    // A second, unleased source address on the router side of the handoff.
+    ns_ip(
+        ROUTER,
+        &["address", "add", "10.240.0.3/29", "dev", "handoff"],
+    );
+    ns_ip(
+        ROUTER,
+        &["route", "add", "192.0.2.0/24", "via", "10.240.0.1"],
+    );
+    in_namespace(HOST, foreign_translation);
+    let hub = in_namespace(HOST, || TcpListener::bind("192.0.2.2:8443").unwrap());
+    let other = in_namespace(HOST, || TcpListener::bind("192.0.2.2:8444").unwrap());
+    let store = udp(HOST, "10.240.0.1:7000".into());
+    let other_store = udp(HOST, "10.240.0.1:7001".into());
+    let transit = in_namespace(ROUTER, || TcpListener::bind("10.240.0.2:10031").unwrap());
+    // The host's own opening toward the transit address.
+    let host_dial = |expected: bool| {
+        let result = in_namespace(HOST, || {
+            TcpStream::connect_timeout(&"10.240.0.2:10031".parse().unwrap(), Duration::from_secs(1))
+        });
+        assert_eq!(result.is_ok(), expected);
+        if expected {
+            transit.accept().unwrap();
+        }
+    };
+    // Every probe of one phase uses its own source ports: TCP ports that closed
+    // stay in TIME_WAIT and an unreplied UDP entry would carry a decision over.
+    // The leased ranges are UDP 10000–10015 and TCP 10016–10031.
+    let leased = |port: u16| format!("10.240.0.2:{port}");
+    let probes = |phase: u16, served: bool| {
+        let exact = dial(&leased(10016 + phase), "192.0.2.2:8443", &hub);
+        assert_eq!(exact.is_some(), served, "phase {phase}");
+        let client = udp(ROUTER, leased(10000 + phase));
+        if served {
+            let observed = roundtrip(&client, &store);
+            assert_eq!(observed.to_string(), leased(10000 + phase));
+        } else {
+            denied(&client, &store, false);
+        }
+        exact
+    };
+    // The rest never passes the member: another port, another protocol range,
+    // outside the lease, another source address, another endpoint port, and a
+    // flow whose destination was rewritten in transit.
+    let refused = |phase: u16| {
+        dark(&leased(20000 + phase), "192.0.2.2:8443", &hub);
+        dark(&leased(10005 + phase), "192.0.2.2:8443", &hub);
+        dark(
+            &format!("10.240.0.3:{}", 10021 + phase),
+            "192.0.2.2:8443",
+            &hub,
+        );
+        dark(&leased(10021 + phase), "192.0.2.2:8444", &other);
+        dark(&leased(10026 + phase), "10.240.0.1:9000", &hub);
+        denied(&udp(ROUTER, leased(10006 + phase)), &other_store, false);
+        denied(&udp(ROUTER, leased(10026 + phase)), &store, false);
+        host_dial(false);
+    };
+    // Positive controls without policy: every probe can succeed, including the
+    // translated flow and the host's own opening.
+    probes(0, true);
+    assert!(dial("10.240.0.2:20000", "192.0.2.2:8443", &hub).is_some());
+    assert!(dial("10.240.0.2:10005", "192.0.2.2:8443", &hub).is_some());
+    assert!(dial("10.240.0.3:10021", "192.0.2.2:8443", &hub).is_some());
+    assert!(dial("10.240.0.2:10021", "192.0.2.2:8444", &other).is_some());
+    assert!(dial("10.240.0.2:10026", "10.240.0.1:9000", &hub).is_some());
+    roundtrip(&udp(ROUTER, leased(10006)), &other_store);
+    roundtrip(&udp(ROUTER, leased(10026)), &store);
+    host_dial(true);
+
+    let mut transit_hop = Hop::new(HOST, "local_platform_transit");
+    // Without the member the handoff denials refuse the host's own addresses.
+    transit_hop.apply(transit_policy, 1, false);
+    assert!(probes(1, false).is_none());
+    refused(1);
+    // With it, exactly the leased flows reach the served endpoints.
+    transit_hop.apply(transit_policy, 2, true);
+    let (mut established, mut accepted) = probes(2, true).unwrap();
+    refused(2);
+    // Withdrawal stops new flows and the established one.
+    transit_hop.apply(transit_policy, 3, false);
+    assert!(probes(3, false).is_none());
+    established.write_all(b"late").unwrap();
+    assert!(accepted.read_exact(&mut [0; 4]).is_err());
+    drop((established, accepted));
+    transit_hop.release();
+    // Release control: the path is open again, so each denial was this table.
+    assert!(probes(4, true).is_some());
+    println!("V2_LOCAL_PLATFORM_PROOF positive_controls=true undeclared_dark=true exact_tcp=true exact_udp=true source_preserved=true outside_lease_denied=true other_protocol_range_denied=true other_source_denied=true other_port_denied=true translated_denied=true host_origin_denied=true withdrawn_dark=true established_withdrawn=true release_control=true");
+}
+
+/// The complete graph with served endpoints persists across owner loss and
+/// verifies before adoption, like every other transit graph.
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn v2_host_local_platform_graph_persist_and_lost_ack_recovery() {
+    isolated();
+    // Peers live in another namespace, as the bound veth facts expect.
+    ip(&["netns", "add", PEER]);
+    for (name, address) in [("router", "10.240.0.1/30"), ("uplink", "192.0.2.2/24")] {
+        ip(&[
+            "link", "add", name, "type", "veth", "peer", "name", name, "netns", PEER,
+        ]);
+        ip(&["address", "add", address, "dev", name]);
+        ip(&["link", "set", name, "up"]);
+    }
+    let mut policy = host_policy();
+    served(&mut policy, true);
+    super::egress_tests::recover("local_platform_v2", policy);
+}