@push.rocks/smartnftables 2.5.2 → 3.0.0

package/rust/src/owner_scale_traffic_tests.rs

@@ -0,0 +1,383 @@
+//! A 64-workload router: every workload with local DNS, public TCP and UDP
+//! egress, four platform endpoints and a publication, the first with the SIP
+//! shape, applied in one batch and proven on first, middle and last workloads.
+use super::egress_traffic_tests::{allocation, binding, connect, denied, ns_ip, roundtrip};
+use super::host_traffic_tests::{control, published_udp};
+use super::*;
+use crate::egress;
+use serde_json::{json, Value};
+use std::io::{Read, Write};
+use std::net::{TcpListener, TcpStream, UdpSocket};
+use std::time::Duration;
+
+const WORKLOADS: u32 = 64;
+const ROUTER: &str = "sc_router";
+const HOST: &str = "sc_host";
+const PEER: &str = "sc_peer";
+/// The proven workloads: first, middle and last.
+const PROBED: [u32; 3] = [0, 31, 63];
+
+fn workload(index: u32) -> String {
+    format!("sc_w{index}")
+}
+fn socket_at(namespace: &str, address: String) -> UdpSocket {
+    let socket = in_namespace(namespace, move || UdpSocket::bind(address).unwrap());
+    socket
+        .set_read_timeout(Some(Duration::from_millis(250)))
+        .unwrap();
+    socket
+}
+/// Four platform endpoints on the peer, beside the protected prefixes.
+fn protection() -> Value {
+    json!({"authorityDigest":format!("sha256:{}","b".repeat(64)),"prefixes":["10.0.0.0/8","192.0.2.0/24"],
+        "platformEndpoints":[{"id":"dns","address":"192.0.2.3","protocol":"udp","port":5300},
+            {"id":"mail","address":"192.0.2.3","protocol":"tcp","port":3000},
+            {"id":"metrics","address":"192.0.2.3","protocol":"tcp","port":9100},
+            {"id":"registry","address":"192.0.2.3","protocol":"udp","port":5301}]})
+}
+/// Publication `index`: one TCP port per workload, and the SIP shape on the
+/// first.
+fn publications(router: bool) -> Vec<Value> {
+    let entry = |protocol: &str,
+                 port: u16,
+                 end: Option<u16>,
+                 endpoint: u16,
+                 address: String,
+                 symmetric: bool| {
+        let mut value = if router {
+            json!({"protocol":protocol,"transitPort":port,"endpointPort":endpoint,
+                "endpointAddress":address,"transitSourceAddress":"10.240.0.2","symmetric":symmetric})
+        } else {
+            json!({"protocol":protocol,"hostPort":port,"targetPort":port,
+                "targetAddress":"10.240.0.2","hostIp":"192.0.2.2","symmetric":symmetric})
+        };
+        if let Some(end) = end {
+            value[if router {
+                "transitPortEnd"
+            } else {
+                "hostPortEnd"
+            }] = json!(end);
+        }
+        value
+    };
+    let mut result = vec![
+        entry("udp", 5070, None, 5070, "10.241.0.2".into(), true),
+        entry("tcp", 5070, None, 5070, "10.241.0.2".into(), true),
+        entry("udp", 20000, Some(20200), 20000, "10.241.0.2".into(), true),
+    ];
+    for index in 0..WORKLOADS {
+        let port = 30000 + index as u16;
+        result.push(entry(
+            "tcp",
+            port,
+            None,
+            if router { 8080 } else { port },
+            format!("10.241.{index}.2"),
+            false,
+        ));
+    }
+    result
+}
+fn router_policy() -> egress::Policy {
+    let mut endpoints = Vec::new();
+    let mut links = Vec::new();
+    let mut rules = Vec::new();
+    let mut grants = Vec::new();
+    for index in 0..WORKLOADS {
+        let name = format!("w{index}");
+        let gateway = format!("10.241.{index}.1");
+        let address = format!("10.241.{index}.2");
+        let link = binding(&name, &gateway, "veth");
+        endpoints.push(
+            json!({"id":name,"interfaceIndex":link["interfaceIndex"],"interfaceName":name,
+            "interfaceKind":"veth","sourcePrefixes":[format!("{address}/32")]}),
+        );
+        links.push(link);
+        for protocol in ["tcp", "udp"] {
+            rules.push(json!({"sourceEndpoint":name,"destinationEndpoint":null,
+                "sourcePrefix":format!("{address}/32"),"destinationPrefix":format!("{gateway}/32"),
+                "protocol":protocol,"sourcePort":null,"destinationPort":53}));
+            rules.push(json!({"sourceEndpoint":null,"destinationEndpoint":name,
+                "sourcePrefix":format!("{gateway}/32"),"destinationPrefix":format!("{address}/32"),
+                "protocol":protocol,"sourcePort":53,"destinationPort":null}));
+            let range = if protocol == "udp" {
+                (10000, 10015)
+            } else {
+                (10016, 10031)
+            };
+            grants.push(
+                json!({"sourceEndpoint":name,"sourcePrefix":format!("{address}/32"),
+                "destination":{"kind":"public","prefix":"0.0.0.0/0"},"protocol":protocol,
+                "sourcePort":null,"destinationPort":null,
+                "sourcePortRange":{"first":range.0,"last":range.1}}),
+            );
+        }
+        for (id, protocol, port) in [
+            ("dns", "udp", 5300),
+            ("mail", "tcp", 3000),
+            ("metrics", "tcp", 9100),
+            ("registry", "udp", 5301),
+        ] {
+            let range = if protocol == "udp" {
+                (10000, 10015)
+            } else {
+                (10016, 10031)
+            };
+            grants.push(
+                json!({"sourceEndpoint":name,"sourcePrefix":format!("{address}/32"),
+                "destination":{"kind":"platform","endpointId":id},"protocol":protocol,
+                "sourcePort":null,"destinationPort":port,
+                "sourcePortRange":{"first":range.0,"last":range.1}}),
+            );
+        }
+    }
+    let mut generation = allocation();
+    generation["conntrackZone"] = json!(17);
+    generation["conntrackLabel"] = json!("a".repeat(32));
+    generation["grants"] = json!(grants);
+    serde_json::from_value(json!({"schemaVersion":2,"revision":1,"scope":{"kind":"routerEgress",
+        "endpoints":endpoints,"rules":rules,"links":links,"handoff":binding("handoff","10.240.0.2","veth"),
+        "protection":protection(),"generations":[generation],"publishedPorts":publications(true)}}))
+    .unwrap()
+}
+fn host_policy() -> egress::Policy {
+    let mut value = egress::tests::host();
+    value["scope"]["protection"] = protection();
+    value["scope"]["handoffs"][0]["link"] = binding("router", "10.240.0.1", "veth");
+    value["scope"]["handoffs"][0]["allocations"] = json!([allocation()]);
+    value["scope"]["uplink"] = binding("uplink", "192.0.2.2", "veth");
+    value["scope"]["publishedPorts"] = json!(publications(false));
+    serde_json::from_value(value).unwrap()
+}
+fn apply(
+    namespace: &str,
+    name: &'static str,
+    policy: fn() -> egress::Policy,
+) -> (Owner, Applied, usize, Vec<(String, usize)>) {
+    in_namespace(namespace, move || {
+        let mut owner = Owner::new(options(name)).unwrap();
+        let target: Prepared = policy().prepare().unwrap().into();
+        target.validate_interfaces().expect("scale fixture binding");
+        let applied = owner
+            .reconcile(Transition {
+                previous: None,
+                target,
+            })
+            .unwrap();
+        assert!(owner.inspect().enforced);
+        let graph = owner.graph().unwrap().expect("owned table present");
+        let sets = graph
+            .sets
+            .iter()
+            .map(|(attributes, elements)| (wire::text(attributes, 2).unwrap(), elements.len()))
+            .collect();
+        (owner, applied, graph.rules.len(), sets)
+    })
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn v2_sixty_four_workload_router_enforces_every_workload_from_set_elements() {
+    isolated();
+    for name in [ROUTER, HOST, PEER] {
+        ip(&["netns", "add", name]);
+        ns_ip(name, &["link", "set", "lo", "up"]);
+        in_namespace(name, || {
+            std::fs::write("/proc/sys/net/ipv4/ip_forward", "1").unwrap()
+        });
+    }
+    for index in 0..WORKLOADS {
+        let name = workload(index);
+        ip(&["netns", "add", &name]);
+        connect(
+            &name,
+            "client",
+            &format!("10.241.{index}.2/24"),
+            ROUTER,
+            &format!("w{index}"),
+            &format!("10.241.{index}.1/24"),
+        );
+        ns_ip(
+            &name,
+            &[
+                "route",
+                "add",
+                "default",
+                "via",
+                &format!("10.241.{index}.1"),
+            ],
+        );
+    }
+    connect(
+        ROUTER,
+        "handoff",
+        "10.240.0.2/30",
+        HOST,
+        "router",
+        "10.240.0.1/30",
+    );
+    connect(
+        HOST,
+        "uplink",
+        "192.0.2.2/24",
+        PEER,
+        "underlay",
+        "192.0.2.3/24",
+    );
+    ns_ip(ROUTER, &["route", "add", "default", "via", "10.240.0.1"]);
+    ns_ip(
+        HOST,
+        &["route", "add", "10.241.0.0/16", "via", "10.240.0.2"],
+    );
+    ns_ip(
+        HOST,
+        &["route", "add", "203.0.113.2/32", "via", "192.0.2.3"],
+    );
+    ns_ip(PEER, &["address", "add", "203.0.113.2/32", "dev", "lo"]);
+    ns_ip(PEER, &["route", "add", "default", "via", "192.0.2.2"]);
+    // Positive controls before any policy: a workload reaches another workload,
+    // the protected peer address, and the peer with another workload's source.
+    let neighbour = socket_at(&workload(1), "10.241.1.2:8081".into());
+    let protected_peer = socket_at(PEER, "192.0.2.3:40300".into());
+    let spoof_target = socket_at(PEER, "203.0.113.2:42100".into());
+    control(
+        &socket_at(&workload(0), "10.241.0.2:40400".into()),
+        "10.241.1.2:8081",
+        &neighbour,
+        true,
+    );
+    control(
+        &socket_at(&workload(0), "10.241.0.2:40401".into()),
+        "192.0.2.3:40300",
+        &protected_peer,
+        true,
+    );
+    ns_ip(
+        &workload(0),
+        &["address", "add", "10.241.1.99/32", "dev", "client"],
+    );
+    control(
+        &socket_at(&workload(0), "10.241.1.99:40402".into()),
+        "203.0.113.2:42100",
+        &spoof_target,
+        true,
+    );
+    let (host_owner, host_applied, _, _) = apply(HOST, "scale_host", host_policy);
+    let (router_owner, router_applied, router_rules, router_sets) =
+        apply(ROUTER, "scale_router", router_policy);
+    // Every workload is set elements: links, endpoint indices and names, source
+    // prefixes, the four DNS rules each, and six leased grants each.
+    let named = |name: &str| {
+        router_sets
+            .iter()
+            .find(|(set, _)| set == name)
+            .map(|(_, count)| *count)
+    };
+    assert_eq!(named("private_link"), Some(WORKLOADS as usize + 1));
+    assert_eq!(named("private_source"), Some(WORKLOADS as usize));
+    assert_eq!(named("private_port"), Some(WORKLOADS as usize * 4));
+    assert_eq!(named("leased_public_flow"), Some(WORKLOADS as usize * 2));
+    assert_eq!(named("leased_platform_flow"), Some(WORKLOADS as usize * 4));
+    assert_eq!(named("published_forward"), Some(WORKLOADS as usize + 3));
+    // The rule graph a single workload compiles, independent of the count.
+    assert!(router_rules < 100, "{router_rules}");
+    let public = socket_at(PEER, "203.0.113.2:42000".into());
+    let platform = socket_at(PEER, "192.0.2.3:5300".into());
+    let registry = socket_at(PEER, "192.0.2.3:5301".into());
+    let metrics = in_namespace(PEER, || TcpListener::bind("192.0.2.3:9100").unwrap());
+    for index in PROBED {
+        let name = workload(index);
+        let address = format!("10.241.{index}.2");
+        // Local DNS on the workload's own gateway.
+        let dns = socket_at(ROUTER, format!("10.241.{index}.1:53"));
+        let client = socket_at(&name, format!("{address}:40001"));
+        assert_eq!(
+            roundtrip(&client, &dns).to_string(),
+            format!("{address}:40001")
+        );
+        // Public egress through both hops from the leased range.
+        let outer = roundtrip(&socket_at(&name, format!("{address}:40002")), &public);
+        assert_eq!(outer.ip().to_string(), "192.0.2.2");
+        assert!((10000..=10015).contains(&outer.port()), "{outer}");
+        // Two platform endpoints over UDP and one over TCP.
+        for target in [&platform, &registry] {
+            let outer = roundtrip(&socket_at(&name, format!("{address}:40003")), target);
+            assert_eq!(outer.ip().to_string(), "192.0.2.2");
+        }
+        let mut stream = in_namespace(&name, || {
+            TcpStream::connect_timeout(&"192.0.2.3:9100".parse().unwrap(), Duration::from_secs(1))
+        })
+        .expect("platform tcp opening");
+        let (mut served, peer) = metrics.accept().unwrap();
+        assert_eq!(peer.ip().to_string(), "192.0.2.2");
+        assert!((10016..=10031).contains(&peer.port()));
+        stream
+            .set_read_timeout(Some(Duration::from_secs(1)))
+            .unwrap();
+        served.write_all(b"pong").unwrap();
+        stream.read_exact(&mut [0; 4]).unwrap();
+        // The workload's publication, with the client address preserved.
+        let listener = in_namespace(&name, move || {
+            TcpListener::bind(format!("10.241.{index}.2:8080")).unwrap()
+        });
+        let mut inbound = in_namespace(PEER, move || {
+            TcpStream::connect_timeout(
+                &format!("192.0.2.2:{}", 30000 + index).parse().unwrap(),
+                Duration::from_secs(1),
+            )
+        })
+        .expect("published tcp opening");
+        let (mut accepted, client) = listener.accept().unwrap();
+        assert_eq!(client.ip().to_string(), "192.0.2.3");
+        accepted.write_all(b"pong").unwrap();
+        inbound
+            .set_read_timeout(Some(Duration::from_secs(1)))
+            .unwrap();
+        inbound.read_exact(&mut [0; 4]).unwrap();
+        // Nothing unnamed: another workload, a protected address outside the
+        // platform endpoints, and a platform port that is not granted.
+        denied(
+            &socket_at(&name, format!("{address}:40005")),
+            &neighbour,
+            false,
+        );
+        denied(
+            &socket_at(&name, format!("{address}:40006")),
+            &protected_peer,
+            false,
+        );
+        let ungranted = socket_at(PEER, format!("192.0.2.3:{}", 5400 + index));
+        denied(
+            &socket_at(&name, format!("{address}:40007")),
+            &ungranted,
+            false,
+        );
+    }
+    // The first workload's SIP publication leaves from its own port.
+    let sip = socket_at(&workload(0), "10.241.0.2:5070".into());
+    let sip_peer = socket_at(PEER, "203.0.113.2:42002".into());
+    assert_eq!(roundtrip(&sip, &sip_peer).to_string(), "192.0.2.2:5070");
+    published_udp(
+        &socket_at(PEER, "192.0.2.3:40500".into()),
+        &socket_at(&workload(0), "10.241.0.2:20100".into()),
+        "192.0.2.2:20100",
+        "192.0.2.3:40500",
+    );
+    // Another workload's source address stays behind the anti-spoof guard.
+    denied(
+        &socket_at(&workload(0), "10.241.1.99:40403".into()),
+        &spoof_target,
+        false,
+    );
+    in_namespace(ROUTER, move || {
+        let mut owner = router_owner;
+        assert!(owner.inspect().enforced);
+        owner.release(router_applied).unwrap();
+    });
+    in_namespace(HOST, move || {
+        let mut owner = host_owner;
+        assert!(owner.inspect().enforced);
+        owner.release(host_applied).unwrap();
+    });
+    println!("V2_SCALE_PROOF workloads=64 router_rules={router_rules} set_elements_verified=true private_dns=true public_egress=true platform_udp=true platform_tcp=true published_inbound=true client_address_preserved=true cross_workload_denied=true protected_denied=true ungranted_platform_port_denied=true symmetric_sip=true published_range=true spoof_denied=true positive_controls=true released=true");
+}

package/rust/src/owner_tests.rs

@@ -24,9 +24,24 @@ mod host_traffic_tests;
 #[path = "owner_router_traffic_tests.rs"]
 mod router_traffic_tests;
 
+#[path = "owner_publishedrange_traffic_tests.rs"]
+mod publishedrange_traffic_tests;
+
+#[path = "owner_scale_traffic_tests.rs"]
+mod scale_traffic_tests;
+
 #[path = "owner_poolguard_tests.rs"]
 mod poolguard_tests;
 
+#[path = "owner_localport_tests.rs"]
+mod localport_tests;
+
+#[path = "owner_localplatform_tests.rs"]
+mod localplatform_tests;
+
+#[path = "owner_workloadgrant_tests.rs"]
+mod workloadgrant_tests;
+
 #[path = "owner_hostgrant_traffic_tests.rs"]
 mod hostgrant_traffic_tests;
 

package/rust/src/owner_workloadgrant_tests.rs

@@ -0,0 +1,278 @@
+use super::egress_traffic_tests::{
+    allocation, binding, connect, denied, ns_ip, protection, roundtrip,
+};
+use super::hostgrant_traffic_tests::Hop;
+use super::router_traffic_tests::connect_from;
+use super::*;
+use crate::egress;
+use serde_json::{json, Value};
+use std::io::{Read, Write};
+use std::net::{TcpListener, TcpStream, UdpSocket};
+use std::time::Duration;
+
+const A: &str = "wg_a";
+const B: &str = "wg_b";
+const C: &str = "wg_c";
+const ROUTER: &str = "wg_router";
+const HOST: &str = "wg_host";
+
+fn endpoint(name: &str, prefix: &str, link: &Value) -> Value {
+    json!({"id":name,"interfaceIndex":link["interfaceIndex"],"interfaceName":name,
+        "interfaceKind":"veth","sourcePrefixes":[prefix]})
+}
+/// Three workloads behind the router, each with leased public egress on every
+/// port of both protocols, exactly as a node composes it: a leased classifier
+/// would claim a workload's packets if grants were not default-zone flows.
+fn router_policy(revision: u64, granted: bool) -> egress::Policy {
+    let links: Vec<_> = [
+        ("wka", "10.241.0.1"),
+        ("wkb", "10.241.1.1"),
+        ("wkc", "10.241.2.1"),
+    ]
+    .into_iter()
+    .map(|(name, address)| binding(name, address, "veth"))
+    .collect();
+    let mut generation = allocation();
+    generation["conntrackZone"] = json!(17);
+    generation["conntrackLabel"] = json!("a".repeat(32));
+    let mut grants = Vec::new();
+    for (name, source) in [
+        ("wka", "10.241.0.2"),
+        ("wkb", "10.241.1.2"),
+        ("wkc", "10.241.2.2"),
+    ] {
+        for (protocol, first, last) in [("udp", 10000, 10015), ("tcp", 10016, 10031)] {
+            grants.push(json!({"sourceEndpoint":name,"sourcePrefix":format!("{source}/32"),
+                "destination":{"kind":"public","prefix":"0.0.0.0/0"},"protocol":protocol,
+                "sourcePort":null,"destinationPort":null,"sourcePortRange":{"first":first,"last":last}}));
+        }
+    }
+    generation["grants"] = json!(grants);
+    let workload_grants = if granted {
+        json!([
+            {"protocol":"tcp","sourceAddress":"10.241.0.2","destinationAddress":"10.241.1.2","destinationPort":8080},
+            {"protocol":"udp","sourceAddress":"10.241.0.2","destinationAddress":"10.241.1.2","destinationPort":5353}
+        ])
+    } else {
+        json!([])
+    };
+    serde_json::from_value(json!({"schemaVersion":2,"revision":revision,"scope":{"kind":"routerEgress",
+        "endpoints":[endpoint("wka","10.241.0.2/32",&links[0]),endpoint("wkb","10.241.1.2/32",&links[1]),
+            endpoint("wkc","10.241.2.2/32",&links[2])],
+        "rules":[],"links":links,"handoff":binding("handoff","10.240.0.2","veth"),
+        "protection":protection(),"generations":[generation],"workloadGrants":workload_grants}}))
+    .unwrap()
+}
+fn udp(namespace: &str, address: &str) -> UdpSocket {
+    let address = address.to_owned();
+    let socket = in_namespace(namespace, move || UdpSocket::bind(address).unwrap());
+    socket
+        .set_read_timeout(Some(Duration::from_millis(250)))
+        .unwrap();
+    socket
+}
+/// A TCP flow from an exact source; on success the listener observes it and
+/// data crosses both ways.
+fn dial(
+    namespace: &str,
+    source: &str,
+    destination: &str,
+    listener: &TcpListener,
+) -> Option<(TcpStream, TcpStream)> {
+    let (from, to) = (source.to_owned(), destination.to_owned());
+    let client = in_namespace(namespace, move || connect_from(&from, &to)).ok()?;
+    let (server, peer) = listener.accept().unwrap();
+    assert_eq!(peer.to_string(), source);
+    let (mut client, mut server) = (client, server);
+    for stream in [&client, &server] {
+        stream
+            .set_read_timeout(Some(Duration::from_secs(1)))
+            .unwrap();
+    }
+    client.write_all(b"ping").unwrap();
+    server.read_exact(&mut [0; 4]).unwrap();
+    server.write_all(b"pong").unwrap();
+    client.read_exact(&mut [0; 4]).unwrap();
+    Some((client, server))
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn v2_workload_grant_opens_one_way_between_workloads_and_never_in_reverse() {
+    isolated();
+    for name in [A, B, C, ROUTER, HOST] {
+        ip(&["netns", "add", name]);
+        ns_ip(name, &["link", "set", "lo", "up"]);
+    }
+    in_namespace(ROUTER, || {
+        std::fs::write("/proc/sys/net/ipv4/ip_forward", "1").unwrap()
+    });
+    for (namespace, name, octet) in [(A, "wka", 0), (B, "wkb", 1), (C, "wkc", 2)] {
+        connect(
+            namespace,
+            "eth0",
+            &format!("10.241.{octet}.2/24"),
+            ROUTER,
+            name,
+            &format!("10.241.{octet}.1/24"),
+        );
+        ns_ip(
+            namespace,
+            &[
+                "route",
+                "add",
+                "default",
+                "via",
+                &format!("10.241.{octet}.1"),
+            ],
+        );
+    }
+    connect(
+        ROUTER,
+        "handoff",
+        "10.240.0.2/30",
+        HOST,
+        "router",
+        "10.240.0.1/30",
+    );
+    let granted = in_namespace(B, || TcpListener::bind("10.241.1.2:8080").unwrap());
+    let other = in_namespace(B, || TcpListener::bind("10.241.1.2:8081").unwrap());
+    let third = in_namespace(C, || TcpListener::bind("10.241.2.2:8080").unwrap());
+    let source = in_namespace(A, || TcpListener::bind("10.241.0.2:9000").unwrap());
+    let served = udp(B, "10.241.1.2:5353");
+    let other_served = udp(B, "10.241.1.2:5354");
+    // Each phase uses its own client ports; TCP ports that closed stay in TIME_WAIT
+    // and an unreplied UDP entry would carry a decision over a policy change.
+    let exact = |phase: u16| {
+        let result = dial(
+            A,
+            &format!("10.241.0.2:{}", 40000 + phase),
+            "10.241.1.2:8080",
+            &granted,
+        );
+        let client = udp(A, &format!("10.241.0.2:{}", 41000 + phase));
+        (result, client)
+    };
+    let refused = |phase: u16| {
+        // Another port, another source workload, another destination workload.
+        assert!(dial(
+            A,
+            &format!("10.241.0.2:{}", 42000 + phase),
+            "10.241.1.2:8081",
+            &other
+        )
+        .is_none());
+        assert!(dial(
+            C,
+            &format!("10.241.2.2:{}", 40000 + phase),
+            "10.241.1.2:8080",
+            &granted
+        )
+        .is_none());
+        assert!(dial(
+            A,
+            &format!("10.241.0.2:{}", 43000 + phase),
+            "10.241.2.2:8080",
+            &third
+        )
+        .is_none());
+        // No reverse opening: the destination cannot open toward the source.
+        assert!(dial(
+            B,
+            &format!("10.241.1.2:{}", 44000 + phase),
+            "10.241.0.2:9000",
+            &source
+        )
+        .is_none());
+        let reverse = udp(B, &format!("10.241.1.2:{}", 45000 + phase));
+        denied(
+            &reverse,
+            &udp(A, &format!("10.241.0.2:{}", 46000 + phase)),
+            false,
+        );
+        denied(
+            &udp(A, &format!("10.241.0.2:{}", 47000 + phase)),
+            &other_served,
+            false,
+        );
+    };
+    // Positive controls without policy: every probe below can succeed.
+    let (flow, client) = exact(0);
+    assert!(flow.is_some());
+    roundtrip(&client, &served);
+    assert!(dial(A, "10.241.0.2:42000", "10.241.1.2:8081", &other).is_some());
+    assert!(dial(C, "10.241.2.2:40000", "10.241.1.2:8080", &granted).is_some());
+    assert!(dial(A, "10.241.0.2:43000", "10.241.2.2:8080", &third).is_some());
+    assert!(dial(B, "10.241.1.2:44000", "10.241.0.2:9000", &source).is_some());
+    roundtrip(&udp(B, "10.241.1.2:45000"), &udp(A, "10.241.0.2:46000"));
+    roundtrip(&udp(A, "10.241.0.2:47000"), &other_served);
+
+    let mut router = Hop::new(ROUTER, "workload_grant_router");
+    // Without grants the private endpoint denials refuse every workload flow.
+    router.apply(router_policy, 1, false);
+    let (flow, client) = exact(1);
+    assert!(flow.is_none());
+    denied(&client, &served, false);
+    refused(1);
+    // With them, exactly the source's openings and their answers pass.
+    router.apply(router_policy, 2, true);
+    let (flow, client) = exact(2);
+    let (mut established, mut accepted) = flow.expect("granted workload tcp");
+    let observed = roundtrip(&client, &served);
+    assert_eq!(observed.to_string(), "10.241.0.2:41002");
+    refused(2);
+    // Withdrawal stops new flows and the established one.
+    router.apply(router_policy, 3, false);
+    let (flow, client) = exact(3);
+    assert!(flow.is_none());
+    denied(&client, &served, false);
+    established.write_all(b"late").unwrap();
+    assert!(accepted.read_exact(&mut [0; 4]).is_err());
+    drop((established, accepted));
+    router.release();
+    // Release control.
+    let (flow, client) = exact(4);
+    assert!(flow.is_some());
+    roundtrip(&client, &served);
+    println!("V2_WORKLOAD_GRANT_PROOF positive_controls=true ungranted_dark=true exact_tcp=true exact_udp=true source_preserved=true leased_egress_unaffected=true other_port_denied=true other_source_denied=true other_destination_denied=true reverse_tcp_denied=true reverse_udp_denied=true withdrawn_dark=true established_withdrawn=true release_control=true");
+}
+
+/// A full grant set of 1024 persists across owner loss, is re-verified element
+/// by element before adoption, and is replaced and released like the rest.
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn v2_workload_grant_set_persist_and_lost_ack_recovery() {
+    isolated();
+    // Peers live in another namespace, as the bound veth facts expect.
+    ip(&["netns", "add", HOST]);
+    for (name, address) in [
+        ("wka", "10.241.0.1/24"),
+        ("wkb", "10.241.1.1/24"),
+        ("wkc", "10.241.2.1/24"),
+        ("handoff", "10.240.0.2/30"),
+    ] {
+        ip(&[
+            "link", "add", name, "type", "veth", "peer", "name", name, "netns", HOST,
+        ]);
+        ip(&["address", "add", address, "dev", name]);
+        ip(&["link", "set", name, "up"]);
+    }
+    let mut policy = router_policy(1, true);
+    let egress::Scope::RouterEgress(scope) = &mut policy.scope else {
+        panic!()
+    };
+    scope.workload_grants = (0..1024_u16)
+        .map(|index| egress::WorkloadGrant {
+            protocol: if index % 2 == 0 { "tcp" } else { "udp" }.into(),
+            source_address: "10.241.0.2".into(),
+            destination_address: if index < 512 {
+                "10.241.1.2"
+            } else {
+                "10.241.2.2"
+            }
+            .into(),
+            destination_port: 20000 + index,
+        })
+        .collect();
+    super::egress_tests::recover("workload_grant_v2", policy);
+}