@push.rocks/smartnftables 2.5.2 → 3.0.0

package/rust/src/egress.compile.rs

@@ -6,15 +6,46 @@ use crate::wire::{self, Attr};
 mod host;
 #[path = "egress.hostgrant.rs"]
 mod hostgrant;
+#[path = "egress.keys.rs"]
+mod keys;
+#[path = "egress.leased.rs"]
+mod leased;
 #[path = "egress.poolguard.rs"]
 mod poolguard;
+#[path = "egress.private.rs"]
+mod private;
+#[path = "egress.published.rs"]
+mod published;
 #[path = "egress.router.rs"]
 mod router;
+#[path = "egress.workloadgrant.rs"]
+mod workloadgrant;
 
-/// Set elements of one target. Together with the 100,000-byte rule graph and the
-/// handle-only deletion of a previous maximum graph this bounds one replacement
-/// batch below `wire::BATCH_BYTES`.
-pub(super) const ELEMENT_BYTES: usize = 100_000;
+/// The atomic replacement budget. One replacement is one nfnetlink batch in one
+/// `sendmsg`, and Linux refuses a netlink message above the socket send buffer:
+/// `SO_SNDBUF` clamped to `net.core.wmem_max` and doubled, 425,984 bytes with the
+/// default `wmem_max` of 212,992. That is the hard ceiling; `wire::BATCH_BYTES`
+/// (320,000) is this package's choice, which fits every `wmem_max` from 160,016
+/// up. A batch carries its begin and end messages (at most 64 bytes), the
+/// handle-only deletion of the previous graph — fewer than `OPERATIONS` rules,
+/// chains and sets, each message at most 140 bytes (the longest table name, a
+/// chain name of up to 32 bytes and a handle), 107,520 bytes — and the complete
+/// target: its rules, chains and sets within `RULE_BYTES`, and together with its
+/// set elements within `TARGET_BYTES`. 64 + 107,520 + 212,000 = 319,584 bytes.
+/// The elements take whatever the rules leave: a set replaces a rule per entry,
+/// so the element share grows exactly where the rule share shrinks.
+pub(super) const OPERATIONS: usize = 768;
+pub(super) const RULE_BYTES: usize = 100_000;
+pub(super) const TARGET_BYTES: usize = 212_000;
+
+/// One element of an interval set: the first and last key, each field of the
+/// last at or above the same field of the first, and the data of a map.
+#[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord)]
+pub(super) struct IntervalElement {
+    pub(super) first: Vec<u8>,
+    pub(super) last: Vec<u8>,
+    pub(super) data: Option<Vec<u8>>,
+}
 
 pub(super) struct Program<'a> {
     table: &'a str,
@@ -30,10 +61,69 @@ impl<'a> Program<'a> {
         // Same atomic replacement reserve as v1: a previous bounded graph must
         // fit its handle-only deletions beside the complete target, and the
         // target's set elements, in one `wire::BATCH_BYTES` batch.
-        require(self.bytes <= 100_000 && self.operations.len() < 768)?;
+        require(
+            self.bytes <= RULE_BYTES
+                && self.bytes + self.element_bytes <= TARGET_BYTES
+                && self.operations.len() < OPERATIONS,
+        )?;
         self.operations.push((operation, attributes));
         Ok(())
     }
+    /// Element messages count against the target, beside the rules.
+    fn push_elements(&mut self, attributes: Vec<Attr>) -> Result<()> {
+        self.element_bytes += wire::encode_attrs(&attributes).len() + 20;
+        require(
+            self.bytes + self.element_bytes <= TARGET_BYTES && self.operations.len() < OPERATIONS,
+        )?;
+        self.operations.push((12, attributes));
+        Ok(())
+    }
+    /// One named exact-key hash set, or a map to `data_length` bytes. CONSTANT
+    /// like every set here.
+    fn exact_set(
+        &mut self,
+        name: &str,
+        id: u32,
+        key_length: u32,
+        data_length: Option<u32>,
+    ) -> Result<()> {
+        let mut attributes = vec![
+            Attr::string(1, self.table),
+            Attr::string(2, name),
+            Attr::u32(3, 2 | if data_length.is_some() { 8 } else { 0 }),
+            Attr::u32(4, 0),
+            Attr::u32(5, key_length),
+        ];
+        if let Some(length) = data_length {
+            attributes.extend([Attr::u32(6, 0), Attr::u32(7, length)]);
+        }
+        attributes.push(Attr::u32(10, id));
+        self.push(9, attributes)
+    }
+    fn exact_elements(
+        &mut self,
+        name: &str,
+        elements: Vec<(Vec<u8>, Option<Vec<u8>>)>,
+    ) -> Result<()> {
+        for chunk in elements.chunks(256) {
+            let list = chunk
+                .iter()
+                .map(|(key, data)| {
+                    let mut fields = vec![Attr::nested(1, vec![Attr::bytes(1, key.clone())])];
+                    if let Some(data) = data {
+                        fields.push(Attr::nested(2, vec![Attr::bytes(1, data.clone())]));
+                    }
+                    Attr::nested(1, fields)
+                })
+                .collect();
+            self.push_elements(vec![
+                Attr::string(1, self.table),
+                Attr::string(2, name),
+                Attr::nested(3, list),
+            ])?;
+        }
+        Ok(())
+    }
     /// One named exact-match set. CONSTANT: its elements cannot change once a
     /// rule binds it, so replacement always creates a complete new set.
     fn set(&mut self, name: &str, id: u32, key_length: usize) -> Result<()> {
@@ -54,21 +144,72 @@ impl<'a> Program<'a> {
     /// own budget: a replacement deletes the previous set, and so its elements,
     /// by one handle.
     fn elements(&mut self, name: &str, keys: Vec<Vec<u8>>) -> Result<()> {
-        for chunk in keys.chunks(256) {
-            let elements = chunk
+        self.exact_elements(name, keys.into_iter().map(|key| (key, None)).collect())
+    }
+    /// One named CONSTANT set of concatenated fields in which every field is an
+    /// inclusive interval (the kernel's pipapo backend), optionally a map to
+    /// `data_length` bytes. `fields` are byte lengths; each occupies whole
+    /// 32-bit registers of the key.
+    fn interval_set(
+        &mut self,
+        name: &str,
+        id: u32,
+        fields: &[u32],
+        data_length: Option<u32>,
+    ) -> Result<()> {
+        let key_length: u32 = fields.iter().map(|length| length.div_ceil(4) * 4).sum();
+        let mut attributes = vec![
+            Attr::string(1, self.table),
+            Attr::string(2, name),
+            // CONSTANT | INTERVAL | CONCAT, and MAP for a map.
+            Attr::u32(3, 2 | 4 | 0x80 | if data_length.is_some() { 8 } else { 0 }),
+            Attr::u32(4, 0),
+            Attr::u32(5, key_length),
+        ];
+        if let Some(length) = data_length {
+            attributes.extend([Attr::u32(6, 0), Attr::u32(7, length)]);
+        }
+        attributes.extend([
+            Attr::nested(
+                9,
+                vec![Attr::nested(
+                    2,
+                    fields
+                        .iter()
+                        .map(|length| Attr::nested(1, vec![Attr::u32(1, *length)]))
+                        .collect(),
+                )],
+            ),
+            Attr::u32(10, id),
+        ]);
+        self.push(9, attributes)
+    }
+    /// Interval elements `(first, last, data)`, 256 to a message like `elements`.
+    /// An element whose bounds are equal carries no last key; Linux takes the
+    /// first as the last and dumps it the same way.
+    fn interval_elements(&mut self, name: &str, elements: Vec<IntervalElement>) -> Result<()> {
+        for chunk in elements.chunks(256) {
+            let list = chunk
                 .iter()
-                .map(|key| {
-                    Attr::nested(1, vec![Attr::nested(1, vec![Attr::bytes(1, key.clone())])])
+                .map(|element| {
+                    let value = |kind: u16, bytes: &[u8]| {
+                        Attr::nested(kind, vec![Attr::bytes(1, bytes.to_vec())])
+                    };
+                    let mut fields = vec![value(1, &element.first)];
+                    if element.last != element.first {
+                        fields.push(value(10, &element.last));
+                    }
+                    if let Some(data) = &element.data {
+                        fields.push(value(2, data));
+                    }
+                    Attr::nested(1, fields)
                 })
                 .collect();
-            let attributes = vec![
+            self.push_elements(vec![
                 Attr::string(1, self.table),
                 Attr::string(2, name),
-                Attr::nested(3, elements),
-            ];
-            self.element_bytes += wire::encode_attrs(&attributes).len() + 20;
-            require(self.element_bytes <= ELEMENT_BYTES && self.operations.len() < 768)?;
-            self.operations.push((12, attributes));
+                Attr::nested(3, list),
+            ])?;
         }
         Ok(())
     }
@@ -241,12 +382,6 @@ fn immediate(register: u32, value: Vec<u8>) -> Attr {
         ],
     )
 }
-fn set_ct(key: u32, value: Vec<u8>) -> Vec<Attr> {
-    vec![
-        immediate(1, value),
-        expr("ct", vec![Attr::u32(2, key), Attr::u32(4, 1)]),
-    ]
-}
 fn label(generation: &Generation) -> Vec<u8> {
     // A label is an opaque canonical 16-byte value, never a host-endian integer.
     generation
@@ -256,14 +391,6 @@ fn label(generation: &Generation) -> Vec<u8> {
         .map(|pair| u8::from_str_radix(std::str::from_utf8(pair).unwrap(), 16).unwrap())
         .collect()
 }
-fn generation(generation: &Generation, direction: u8, labelled: bool) -> Vec<Attr> {
-    let mut result = ct(17, None, generation.conntrack_zone.to_ne_bytes().to_vec());
-    result.extend(ct(1, None, vec![direction]));
-    if labelled {
-        result.extend(ct(13, None, label(generation)));
-    }
-    result
-}
 fn state(value: u32) -> Vec<Attr> {
     ct(0, None, value.to_ne_bytes().to_vec())
 }
@@ -295,50 +422,6 @@ fn snat(address: &str, range: Option<(u16, u16)>) -> Result<Vec<Attr>> {
     result.push(expr("nat", data));
     Ok(result)
 }
-/// Published inbound translation. Address and port are always both specified, so
-/// the kernel never picks a port and the graph identity carries explicit registers.
-fn dnat(address: &str, port: u16) -> Result<Vec<Attr>> {
-    Ok(vec![
-        immediate(1, super::address(address)?.to_be_bytes().to_vec()),
-        immediate(2, port.to_be_bytes().to_vec()),
-        expr(
-            "nat",
-            vec![
-                Attr::u32(1, 1),
-                Attr::u32(2, 2),
-                Attr::u32(3, 1),
-                Attr::u32(4, 1),
-                Attr::u32(5, 2),
-                Attr::u32(6, 2),
-                Attr::u32(7, 3),
-            ],
-        ),
-    ])
-}
-fn tuple(grant: &Grant, protection: &Protection, reply: bool, original: bool) -> Result<Vec<Attr>> {
-    let destination = super::destination(grant, protection)?;
-    let mut result = ipv4();
-    result.extend(meta(16, vec![protocol(&grant.protocol)]));
-    result.extend(current_address(&grant.source_prefix, !reply)?);
-    result.extend(current_address(&destination, reply)?);
-    for (port, source) in [(grant.source_port, !reply), (grant.destination_port, reply)] {
-        if let Some(port) = port {
-            result.extend(current_port(port, source));
-        }
-    }
-    if original {
-        result.extend(original_address(&grant.source_prefix, true)?);
-        result.extend(original_address(&destination, false)?);
-        result.extend(ct(10, None, vec![protocol(&grant.protocol)]));
-        for (port, source) in [(grant.source_port, true), (grant.destination_port, false)] {
-            if let Some(port) = port {
-                result.extend(original_port(port, source));
-            }
-        }
-    }
-    Ok(result)
-}
-
 pub(super) fn compile(prepared: &Prepared, table: &str) -> Result<Vec<(u16, Vec<Attr>)>> {
     let mut program = Program {
         table,
@@ -349,9 +432,7 @@ pub(super) fn compile(prepared: &Prepared, table: &str) -> Result<Vec<(u16, Vec<
         operations: Vec::new(),
     };
     match &prepared.policy.scope {
-        Scope::RouterEgress(scope) => {
-            router::compile(&mut program, scope, prepared.policy.revision)?
-        }
+        Scope::RouterEgress(scope) => router::compile(&mut program, scope)?,
         Scope::HostTransit(scope) => host::compile(&mut program, scope)?,
         Scope::AllocationPoolGuard(scope) => poolguard::compile(&mut program, scope)?,
     }

package/rust/src/egress.host.rs

@@ -36,10 +36,25 @@ fn envelope(
     allocation: &Allocation,
     range: &PortRange,
     reply: bool,
+) -> Result<Vec<Attr>> {
+    leased(handoff, Some(&scope.uplink), allocation, range, reply)
+}
+/// One leased range of one allocation on its exact handoff: the default zone, the
+/// direction, the protocols, and the transit source address and port range in
+/// both the live and the originally tracked tuple. A forwarded envelope adds the
+/// uplink; a host-local one has none.
+fn leased(
+    handoff: &HostHandoff,
+    uplink: Option<&LocalLink>,
+    allocation: &Allocation,
+    range: &PortRange,
+    reply: bool,
 ) -> Result<Vec<Attr>> {
     let mut expressions = ipv4();
     expressions.extend(link(&handoff.link, !reply));
-    expressions.extend(link(&scope.uplink, reply));
+    if let Some(uplink) = uplink {
+        expressions.extend(link(uplink, reply));
+    }
     expressions.extend(meta(16, vec![protocol(&range.protocol)]));
     expressions.extend(ct(10, None, vec![protocol(&range.protocol)]));
     expressions.extend(ct(17, None, 0_u16.to_ne_bytes().to_vec()));
@@ -51,34 +66,12 @@ fn envelope(
     expressions.extend(original_range(range.first, range.last));
     Ok(expressions)
 }
-/// Inbound publication envelope. Both directions check the exact links, the
-/// translated current tuple and the original conntrack destination, so foreign
-/// NAT cannot borrow this admission for another flow.
-fn published_envelope(
-    scope: &HostScope,
-    handoff: &HostHandoff,
-    port: &PublishedPort,
-    reply: bool,
-) -> Result<Vec<Attr>> {
-    let mut expressions = ipv4();
-    expressions.extend(link(&scope.uplink, !reply));
-    expressions.extend(link(&handoff.link, reply));
-    expressions.extend(meta(16, vec![protocol(&port.protocol)]));
-    expressions.extend(ct(10, None, vec![protocol(&port.protocol)]));
-    expressions.extend(ct(17, None, 0_u16.to_ne_bytes().to_vec()));
-    expressions.extend(ct(1, None, vec![u8::from(reply)]));
-    let target = format!("{}/32", port.target_address);
-    expressions.extend(current_address(&target, reply)?);
-    expressions.extend(current_port(port.target_port, reply));
-    let published = format!("{}/32", port.host_ip);
-    expressions.extend(original_address(&published, false)?);
-    expressions.extend(original_port(port.host_port, false));
-    Ok(expressions)
-}
-fn published(program: &mut Program<'_>, scope: &HostScope) -> Result<()> {
+/// The publications of this hop. Validation admits only leased transit source
+/// addresses as targets, and one address never spans two active handoff links,
+/// so each publication has exactly one handoff.
+fn hop(scope: &HostScope) -> Result<published::Hop<'_>> {
+    let mut publications = Vec::new();
     for port in &scope.published_ports {
-        // Validation admits only leased transit source addresses, and one address
-        // never spans two active handoff links.
         let handoff = scope
             .handoffs
             .iter()
@@ -89,28 +82,80 @@ fn published(program: &mut Program<'_>, scope: &HostScope) -> Result<()> {
                     .any(|allocation| allocation.transit_source_address == port.target_address)
             })
             .ok_or(crate::Error::Invalid)?;
-        let original = published_envelope(scope, handoff, port, false)?;
+        publications.push(published::Publication {
+            protocol: &port.protocol,
+            outside: (&port.host_ip, port.host_port, port.host_last()),
+            inside: (&port.target_address, port.target_port, port.target_last()),
+            link: &handoff.link,
+            symmetric: port.symmetric,
+        });
+    }
+    Ok(published::Hop {
+        publications,
+        fixed: &scope.uplink,
+    })
+}
+/// The exact platform endpoints served on host addresses. Every packet is
+/// checked against the live and the originally tracked destination tuple, so a
+/// flow rewritten in transit never matches.
+fn local_endpoints(scope: &HostScope) -> Vec<&PlatformEndpoint> {
+    scope
+        .protection
+        .platform_endpoints
+        .iter()
+        .filter(|endpoint| scope.local_platform_endpoints.contains(&endpoint.id))
+        .collect()
+}
+fn local_endpoint(endpoint: &PlatformEndpoint, reply: bool) -> Result<Vec<Attr>> {
+    let mut expressions = meta(16, vec![protocol(&endpoint.protocol)]);
+    expressions.extend(ct(10, None, vec![protocol(&endpoint.protocol)]));
+    let address = format!("{}/32", endpoint.address);
+    expressions.extend(current_address(&address, reply)?);
+    expressions.extend(current_port(endpoint.port, reply));
+    expressions.extend(original_address(&address, false)?);
+    expressions.extend(original_port(endpoint.port, false));
+    Ok(expressions)
+}
+/// Leased flows into host-local platform endpoints, the reverse of a host grant:
+/// INPUT admits the original direction only from an exact handoff with a leased
+/// source address and port range of that handoff, NEW (a TCP opening only with
+/// SYN) or ESTABLISHED; OUTPUT admits only the ESTABLISHED reply back to it. Each
+/// leased range jumps once per direction, and the endpoint chains hold one tuple
+/// check per endpoint, so the graph grows with ranges plus endpoints.
+fn local_platform(program: &mut Program<'_>, scope: &HostScope) -> Result<()> {
+    let endpoints = local_endpoints(scope);
+    for endpoint in &endpoints {
+        let original = local_endpoint(endpoint, false)?;
         for connection_state in [2, 8] {
             let mut expressions = original.clone();
             expressions.extend(state(connection_state));
-            if connection_state == 8 && port.protocol == "tcp" {
+            if connection_state == 8 && endpoint.protocol == "tcp" {
                 expressions.extend(opening_tcp());
             }
-            program.end("forward", expressions, 1)?;
+            program.end("local_platform_in", expressions, 1)?;
         }
-        let mut reply = published_envelope(scope, handoff, port, true)?;
+        let mut reply = local_endpoint(endpoint, true)?;
         reply.extend(state(2));
-        program.end("forward", reply, 1)?;
-        let mut translation = ipv4();
-        translation.extend(link(&scope.uplink, true));
-        translation.extend(meta(16, vec![protocol(&port.protocol)]));
-        translation.extend(ct(10, None, vec![protocol(&port.protocol)]));
-        translation.extend(ct(17, None, 0_u16.to_ne_bytes().to_vec()));
-        translation.extend(ct(1, None, vec![0]));
-        translation.extend(current_address(&format!("{}/32", port.host_ip), false)?);
-        translation.extend(current_port(port.host_port, false));
-        translation.extend(dnat(&port.target_address, port.target_port)?);
-        program.rule("pre", translation)?;
+        program.end("local_platform_back", reply, 1)?;
+    }
+    for handoff in &scope.handoffs {
+        for allocation in &handoff.allocations {
+            for range in &allocation.source_port_ranges {
+                if endpoints
+                    .iter()
+                    .all(|endpoint| endpoint.protocol != range.protocol)
+                {
+                    continue;
+                }
+                for (chain, target, reply) in [
+                    ("input", "local_platform_in", false),
+                    ("output", "local_platform_back", true),
+                ] {
+                    let expressions = leased(handoff, None, allocation, range, reply)?;
+                    program.jump(chain, expressions, target)?;
+                }
+            }
+        }
     }
     Ok(())
 }
@@ -135,6 +180,11 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &HostScope) -> Result<()
     for name in ["protected_out", "protected_back"] {
         program.chain(name, None)?;
     }
+    if !scope.local_platform_endpoints.is_empty() {
+        for name in ["local_platform_in", "local_platform_back"] {
+            program.chain(name, None)?;
+        }
+    }
     if !scope.host_grants.is_empty() {
         // Validation admits only an address of exactly one handoff link.
         hostgrant::tuple_set(program, &scope.host_grants, |grant| {
@@ -151,18 +201,24 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &HostScope) -> Result<()
                 .ok_or(crate::Error::Invalid)
         })?;
     }
+    let hop = hop(scope)?;
+    published::sets(program, &hop, false)?;
     protection(program, scope, false)?;
     protection(program, scope, true)?;
+    published::translations(program, &hop)?;
     // Published admission precedes the capture barrier: the barrier denies every
     // protected original destination, which includes this uplink address, and an
     // exact inbound publication is the explicit authority for that exception.
-    published(program, scope)?;
+    published::inbound(program, &hop)?;
     // Host-origin grants leave through the exact handoff that holds their source
     // address, which is part of every set key, and precede the terminal output
     // and input denials. Nothing else of the host's own traffic crosses a handoff.
     if !scope.host_grants.is_empty() {
         hostgrant::admissions(program, ["output", "input"], true, |_| vec![])?;
     }
+    // Leased flows into host-local platform endpoints precede the same terminal
+    // handoff denials, which remain for everything else.
+    local_platform(program, scope)?;
     for handoff in &scope.handoffs {
         program.jump("forward", link(&handoff.link, true), "protected_out")?;
         program.jump("forward", link(&handoff.link, false), "protected_back")?;
@@ -188,6 +244,10 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &HostScope) -> Result<()
             }
         }
     }
+    // Symmetric flows leave from ports outside every leased range of their
+    // address, after the capture barrier and before the terminal handoff denials.
+    published::symmetric(program, &hop)?;
+    published::symmetric_translation(program, &hop)?;
     for handoff in &scope.handoffs {
         program.deny_link("input", &handoff.link, true)?;
         program.deny_link("output", &handoff.link, false)?;

package/rust/src/egress.hostgrant.rs

@@ -13,7 +13,7 @@ pub(super) const ARRIVAL_SET: &str = "host_grant_arrival";
 
 /// Register numbers as Linux dumps them: 16-byte aligned registers use the
 /// legacy NFT_REG_1..4 names, every other 4-byte register NFT_REG32_xx.
-fn register(index: u32) -> u32 {
+pub(super) fn register(index: u32) -> u32 {
     if index % 4 == 0 {
         index / 4
     } else {
@@ -24,10 +24,10 @@ fn store(name: &str, mut data: Vec<Attr>, index: u32) -> Attr {
     data.insert(0, Attr::u32(1, register(index)));
     expr(name, data)
 }
-fn meta_to(key: u32, index: u32) -> Attr {
+pub(super) fn meta_to(key: u32, index: u32) -> Attr {
     store("meta", vec![Attr::u32(2, key)], index)
 }
-fn payload_to(base: u32, offset: u32, length: u32, index: u32) -> Attr {
+pub(super) fn payload_to(base: u32, offset: u32, length: u32, index: u32) -> Attr {
     store(
         "payload",
         vec![
@@ -38,14 +38,14 @@ fn payload_to(base: u32, offset: u32, length: u32, index: u32) -> Attr {
         index,
     )
 }
-fn ct_to(key: u32, original: bool, index: u32) -> Attr {
+pub(super) fn ct_to(key: u32, original: bool, index: u32) -> Attr {
     let mut data = vec![Attr::u32(2, key)];
     if original {
         data.push(Attr::bytes(3, vec![0]));
     }
     store("ct", data, index)
 }
-fn lookup(set: &str) -> Attr {
+pub(super) fn lookup(set: &str) -> Attr {
     expr(
         "lookup",
         vec![
@@ -61,10 +61,10 @@ fn word(bytes: &[u8]) -> Vec<u8> {
     result
 }
 
-/// Key loads for one direction, then the lookup. `linked` adds the variable
-/// interface: the outgoing interface of the original direction, the incoming
-/// interface of the reply.
-fn tuple_lookup(linked: bool, reply: bool) -> Vec<Attr> {
+/// Key loads for one direction, then the lookup in `set`. `linked` adds the
+/// variable interface: the outgoing interface of the original direction, the
+/// incoming interface of the reply.
+pub(super) fn tuple_lookup(set: &str, linked: bool, reply: bool) -> Vec<Attr> {
     let mut result = Vec::new();
     let mut index = 4;
     if linked {
@@ -82,10 +82,10 @@ fn tuple_lookup(linked: bool, reply: bool) -> Vec<Attr> {
     result.push(ct_to(19, true, index + 5));
     result.push(ct_to(20, true, index + 6));
     result.push(ct_to(12, true, index + 7));
-    result.push(lookup(TUPLE_SET));
+    result.push(lookup(set));
     result
 }
-fn tuple_key(grant: &HostGrant, link: Option<&LocalLink>) -> Result<Vec<u8>> {
+pub(super) fn tuple_key(grant: &HostGrant, link: Option<&LocalLink>) -> Result<Vec<u8>> {
     let protocol = word(&[protocol(&grant.protocol)]);
     let source = address(&grant.source_address)?.to_be_bytes();
     let destination = address(&grant.destination_address)?.to_be_bytes();
@@ -170,7 +170,7 @@ pub(super) fn admissions(
         result
     };
     let mut established = envelope(false, 2);
-    established.extend(tuple_lookup(linked, false));
+    established.extend(tuple_lookup(TUPLE_SET, linked, false));
     program.end(chains[0], established, 1)?;
     for transport in ["udp", "tcp"] {
         let mut opening = envelope(false, 8);
@@ -178,10 +178,10 @@ pub(super) fn admissions(
         if transport == "tcp" {
             opening.extend(opening_tcp());
         }
-        opening.extend(tuple_lookup(linked, false));
+        opening.extend(tuple_lookup(TUPLE_SET, linked, false));
         program.end(chains[0], opening, 1)?;
     }
     let mut reply = envelope(true, 2);
-    reply.extend(tuple_lookup(linked, true));
+    reply.extend(tuple_lookup(TUPLE_SET, linked, true));
     program.end(chains[1], reply, 1)
 }