@push.rocks/smartnftables 2.5.2 → 3.0.0

package/rust/src/egress_hostgrant_tests.rs

@@ -15,15 +15,15 @@ pub(crate) fn granted(mut value: Value, grants: Value) -> Value {
     value["scope"]["hostGrants"] = grants;
     value
 }
-fn normalized(value: Value) -> crate::Result<Policy> {
+pub(super) fn normalized(value: Value) -> crate::Result<Policy> {
     serde_json::from_value::<Policy>(value)
         .map_err(|_| crate::Error::Invalid)?
         .normalize()
 }
-fn prepared(value: Value) -> Prepared {
+pub(super) fn prepared(value: Value) -> Prepared {
     normalized(value).unwrap().prepare().unwrap()
 }
-fn bytes(prepared: &Prepared) -> Vec<u8> {
+pub(super) fn bytes(prepared: &Prepared) -> Vec<u8> {
     let mut result = Vec::new();
     for (kind, attributes) in prepared.program("snft_host_grant").unwrap() {
         result.extend(kind.to_be_bytes());
@@ -38,28 +38,38 @@ fn exact() -> Value {
 
 /// One packet with the conntrack facts a filter hook observes.
 #[derive(Clone, Copy)]
-struct Flow {
-    input: Option<(u32, &'static str)>,
-    output: Option<(u32, &'static str)>,
-    protocol: u8,
-    source: [u8; 4],
-    destination: [u8; 4],
-    source_port: u16,
-    destination_port: u16,
-    tcp_flags: u8,
-    state: u32,
-    reply: bool,
-    zone: u16,
+pub(super) struct Flow {
+    pub(super) input: Option<(u32, &'static str)>,
+    pub(super) output: Option<(u32, &'static str)>,
+    pub(super) protocol: u8,
+    pub(super) source: [u8; 4],
+    pub(super) destination: [u8; 4],
+    pub(super) source_port: u16,
+    pub(super) destination_port: u16,
+    pub(super) tcp_flags: u8,
+    pub(super) state: u32,
+    pub(super) reply: bool,
+    pub(super) zone: u16,
     /// Original-direction conntrack tuple: source, destination, ports.
-    original: ([u8; 4], [u8; 4], u16, u16),
+    pub(super) original: ([u8; 4], [u8; 4], u16, u16),
+    /// The file system uid of the packet's user socket; None without one, when
+    /// `meta skuid` breaks the rule like the kernel.
+    pub(super) uid: Option<u32>,
+    /// The conntrack label of the flow's entry.
+    pub(super) label: [u8; 16],
 }
 const HOST: [u8; 4] = [10, 240, 0, 1];
 const WORK: [u8; 4] = [10, 241, 0, 2];
 const NEW: u32 = 8;
-const ESTABLISHED: u32 = 2;
+pub(super) const ESTABLISHED: u32 = 2;
 const SYN: u8 = 0x02;
-const ACK: u8 = 0x10;
-fn opening(input: Option<(u32, &'static str)>, output: Option<(u32, &'static str)>) -> Flow {
+pub(super) const ACK: u8 = 0x10;
+/// The `reject with tcp reset` decision, distinct from a plain drop.
+pub(super) const REJECT: i32 = i32::MIN;
+pub(super) fn opening(
+    input: Option<(u32, &'static str)>,
+    output: Option<(u32, &'static str)>,
+) -> Flow {
     Flow {
         input,
         output,
@@ -73,6 +83,8 @@ fn opening(input: Option<(u32, &'static str)>, output: Option<(u32, &'static str
         reply: false,
         zone: 0,
         original: (HOST, WORK, 443, 8080),
+        uid: None,
+        label: [0; 16],
     }
 }
 /// The workload's answer to `flow`, arriving on the reverse links.
@@ -181,22 +193,59 @@ fn foreign(flow: Flow) -> Vec<Flow> {
 /// kernel does: the terminal verdict, the chain that reached it (`policy` for the
 /// base chain's accept policy) and the conntrack zone a raw rule stored.
 #[derive(Debug, PartialEq, Eq)]
-struct Decision {
-    verdict: i32,
-    chain: String,
-    zone: u16,
+pub(super) struct Decision {
+    pub(super) verdict: i32,
+    pub(super) chain: String,
+    pub(super) zone: u16,
+    /// The NAT a nat-chain rule performed, which also ends that rule with an
+    /// accept exactly as the kernel's nat expression does.
+    pub(super) translation: Option<Translation>,
 }
-/// The compiled table: rules per chain and element keys per set.
+/// Source (0) or destination (1) NAT to an address and, when the rule names
+/// them, an inclusive port range.
+#[derive(Debug, PartialEq, Eq)]
+pub(super) struct Translation {
+    pub(super) kind: u32,
+    pub(super) address: [u8; 4],
+    pub(super) ports: Option<(u16, u16)>,
+}
+/// The compiled table: rules per chain, element keys per exact set, and the
+/// fields and elements of every interval set or map.
 struct Table {
     chains: BTreeMap<String, Vec<Vec<Attr>>>,
     sets: BTreeMap<String, Vec<Vec<u8>>>,
+    intervals: BTreeMap<String, Interval>,
 }
-fn chains(prepared: &Prepared) -> BTreeMap<String, Vec<Vec<Attr>>> {
+/// Field byte lengths, then `(first, last, data)` per element.
+#[derive(Default)]
+struct Interval {
+    fields: Vec<usize>,
+    elements: Vec<(Vec<u8>, Vec<u8>, Option<Vec<u8>>)>,
+}
+impl Interval {
+    /// Every field of the key within its bounds, compared as the kernel's
+    /// pipapo backend does: byte strings of the field's own length.
+    fn find(&self, key: &[u8]) -> Option<&(Vec<u8>, Vec<u8>, Option<Vec<u8>>)> {
+        self.elements.iter().find(|(first, last, _)| {
+            let mut at = 0;
+            self.fields.iter().all(|length| {
+                let range = at..at + length;
+                at += length.div_ceil(4) * 4;
+                first[range.clone()] <= key[range.clone()] && key[range.clone()] <= last[range]
+            })
+        })
+    }
+    fn width(&self) -> usize {
+        self.fields.iter().map(|length| length.div_ceil(4) * 4).sum()
+    }
+}
+pub(super) fn chains(prepared: &Prepared) -> BTreeMap<String, Vec<Vec<Attr>>> {
     table(prepared).chains
 }
 fn table(prepared: &Prepared) -> Table {
     let mut chains: BTreeMap<String, Vec<Vec<Attr>>> = BTreeMap::new();
     let mut sets: BTreeMap<String, Vec<Vec<u8>>> = BTreeMap::new();
+    let mut intervals: BTreeMap<String, Interval> = BTreeMap::new();
     for (kind, attributes) in prepared.program("snft_host_grant").unwrap() {
         match kind {
             3 => {
@@ -209,21 +258,59 @@ fn table(prepared: &Prepared) -> Table {
                 .or_default()
                 .push(wire::attrs(&wire::one(&attributes, 4).unwrap().value).unwrap()),
             9 => {
-                assert!(sets
-                    .insert(wire::text(&attributes, 2).unwrap(), Vec::new())
-                    .is_none());
+                let name = wire::text(&attributes, 2).unwrap();
+                if let Ok(description) = wire::one(&attributes, 9) {
+                    let concatenation = wire::attrs(&description.value).unwrap();
+                    let fields = wire::attrs(&wire::one(&concatenation, 2).unwrap().value)
+                        .unwrap()
+                        .iter()
+                        .map(|field| {
+                            wire::number(&wire::attrs(&field.value).unwrap(), 1).unwrap() as usize
+                        })
+                        .collect();
+                    assert!(intervals
+                        .insert(name, Interval { fields, elements: Vec::new() })
+                        .is_none());
+                } else if wire::number(&attributes, 3).unwrap() & 8 != 0 {
+                    // An exact map is one field of the whole key.
+                    let fields = vec![wire::number(&attributes, 5).unwrap() as usize];
+                    assert!(intervals
+                        .insert(name, Interval { fields, elements: Vec::new() })
+                        .is_none());
+                } else {
+                    assert!(sets.insert(name, Vec::new()).is_none());
+                }
             }
             12 => {
-                let keys = sets.get_mut(&wire::text(&attributes, 2).unwrap()).unwrap();
+                let name = wire::text(&attributes, 2).unwrap();
                 for element in wire::attrs(&wire::one(&attributes, 3).unwrap().value).unwrap() {
                     let key = wire::attrs(&element.value).unwrap();
-                    keys.push(data(&key, 1));
+                    if let Some(interval) = intervals.get_mut(&name) {
+                        // An element without a last key is one exact key.
+                        let first = data(&key, 1);
+                        let last = if wire::one(&key, 10).is_ok() {
+                            data(&key, 10)
+                        } else {
+                            first.clone()
+                        };
+                        interval.elements.push((
+                            first,
+                            last,
+                            wire::one(&key, 2).ok().map(|_| data(&key, 2)),
+                        ));
+                    } else {
+                        sets.get_mut(&name).unwrap().push(data(&key, 1));
+                    }
                 }
             }
             other => panic!("operation {other}"),
         }
     }
-    Table { chains, sets }
+    Table {
+        chains,
+        sets,
+        intervals,
+    }
 }
 fn data(attributes: &[Attr], id: u16) -> Vec<u8> {
     wire::attrs(&wire::one(attributes, id).unwrap().value).unwrap()[0]
@@ -246,6 +333,7 @@ fn load(flow: &Flow, name: &str, fields: &[Attr]) -> Option<Vec<u8>> {
     Some(match name {
         "meta" => match wire::number(fields, 2).unwrap() {
             4 => interface(flow.input, false),
+            10 => flow.uid?.to_ne_bytes().to_vec(),
             5 => interface(flow.output, false),
             6 => interface(flow.input, true),
             7 => interface(flow.output, true),
@@ -280,7 +368,7 @@ fn load(flow: &Flow, name: &str, fields: &[Attr]) -> Option<Vec<u8>> {
                 10 => vec![flow.protocol],
                 11 => source_port.to_be_bytes().to_vec(),
                 12 => destination_port.to_be_bytes().to_vec(),
-                13 => vec![0; 16],
+                13 => flow.label.to_vec(),
                 17 => flow.zone.to_ne_bytes().to_vec(),
                 19 => source.to_vec(),
                 20 => destination.to_vec(),
@@ -311,6 +399,7 @@ fn run(table: &Table, chain: &str, flow: &Flow, zone: &mut u16) -> Step {
         let mut registers = [0_u8; 80];
         let mut matched = true;
         let mut verdict: Option<(i32, Option<String>)> = None;
+        let mut translation = None;
         for expression in expressions {
             let parts = wire::attrs(&expression.value).unwrap();
             let name = wire::text(&parts, 1).unwrap();
@@ -340,10 +429,14 @@ fn run(table: &Table, chain: &str, flow: &Flow, zone: &mut u16) -> Step {
                     }
                 }
                 "cmp" => {
-                    assert_eq!(wire::number(&fields, 2).unwrap(), 0);
                     let expected = data(&fields, 3);
                     let at = offset(&fields, 1);
-                    matched = registers[at..at + expected.len()] == expected[..];
+                    let equal = registers[at..at + expected.len()] == expected[..];
+                    matched = match wire::number(&fields, 2).unwrap() {
+                        0 => equal,
+                        1 => !equal,
+                        operation => panic!("cmp {operation}"),
+                    };
                 }
                 "range" => {
                     assert_eq!(wire::number(&fields, 2).unwrap(), 0);
@@ -353,12 +446,29 @@ fn run(table: &Table, chain: &str, flow: &Flow, zone: &mut u16) -> Step {
                     matched = loaded >= &first[..] && loaded <= &last[..];
                 }
                 "lookup" => {
-                    assert_eq!(wire::number(&fields, 5).unwrap(), 0);
-                    let keys = &table.sets[&wire::text(&fields, 1).unwrap()];
+                    let inverted = wire::number(&fields, 5).unwrap() == 1;
+                    let name = wire::text(&fields, 1).unwrap();
                     let at = offset(&fields, 2);
-                    matched = keys
-                        .iter()
-                        .any(|key| registers[at..at + key.len()] == key[..]);
+                    if let Some(interval) = table.intervals.get(&name) {
+                        let key = registers[at..at + interval.width()].to_vec();
+                        let found = interval.find(&key);
+                        matched = found.is_some();
+                        if let (Some((_, _, data)), Ok(_)) = (found, wire::one(&fields, 3)) {
+                            // A map lookup stores the element's data.
+                            let data = data.as_ref().unwrap();
+                            let to = offset(&fields, 3);
+                            registers[to..to + data.len()].copy_from_slice(data);
+                        }
+                    } else {
+                        let keys = &table.sets[&name];
+                        matched = keys
+                            .iter()
+                            .any(|key| registers[at..at + key.len()] == key[..]);
+                    }
+                    if inverted {
+                        assert!(wire::one(&fields, 3).is_err());
+                        matched = !matched;
+                    }
                 }
                 "immediate" if wire::number(&fields, 1).unwrap() == 0 => {
                     let code = wire::attrs(
@@ -380,7 +490,23 @@ fn run(table: &Table, chain: &str, flow: &Flow, zone: &mut u16) -> Step {
                     let at = offset(&fields, 1);
                     registers[at..at + value.len()].copy_from_slice(&value);
                 }
-                "nat" => {}
+                "nat" => {
+                    let at = offset(&fields, 3);
+                    let port = |id: u16| {
+                        let at = offset(&fields, id);
+                        u16::from_be_bytes(registers[at..at + 2].try_into().unwrap())
+                    };
+                    translation = Some(Translation {
+                        kind: wire::number(&fields, 1).unwrap(),
+                        address: registers[at..at + 4].try_into().unwrap(),
+                        ports: wire::one(&fields, 5).ok().map(|_| (port(5), port(6))),
+                    });
+                    verdict = Some((1, None));
+                }
+                "reject" => {
+                    assert_eq!(fields, vec![Attr::u32(1, 1)]);
+                    verdict = Some((REJECT, None));
+                }
                 other => panic!("{other}"),
             }
             if !matched {
@@ -391,11 +517,12 @@ fn run(table: &Table, chain: &str, flow: &Flow, zone: &mut u16) -> Step {
             continue;
         }
         match verdict {
-            Some((code @ (0 | 1), _)) => {
+            Some((code @ (0 | 1 | REJECT), _)) => {
                 return Step::Final(Decision {
                     verdict: code,
                     chain: chain.into(),
                     zone: *zone,
+                    translation,
                 })
             }
             Some((-5, _)) => return Step::Next,
@@ -412,14 +539,35 @@ fn run(table: &Table, chain: &str, flow: &Flow, zone: &mut u16) -> Step {
     Step::Next
 }
 /// A base chain that ends without a terminal verdict accepts by policy.
-fn decide(prepared: &Prepared, chain: &str, flow: &Flow) -> Decision {
+pub(super) fn decide(prepared: &Prepared, chain: &str, flow: &Flow) -> Decision {
+    Simulator::new(prepared).decide(chain, flow)
+}
+/// One compiled table, parsed once for many decisions.
+pub(super) struct Simulator {
+    table: Table,
+}
+impl Simulator {
+    pub(super) fn new(prepared: &Prepared) -> Self {
+        Self {
+            table: table(prepared),
+        }
+    }
+    pub(super) fn has(&self, chain: &str) -> bool {
+        self.table.chains.contains_key(chain)
+    }
+    pub(super) fn decide(&self, chain: &str, flow: &Flow) -> Decision {
+        decide_in(&self.table, chain, flow)
+    }
+}
+fn decide_in(table: &Table, chain: &str, flow: &Flow) -> Decision {
     let mut zone = 0;
-    match run(&table(prepared), chain, flow, &mut zone) {
+    match run(table, chain, flow, &mut zone) {
         Step::Final(decision) => decision,
         Step::Next => Decision {
             verdict: 1,
             chain: "policy".into(),
             zone,
+            translation: None,
         },
     }
 }
@@ -793,7 +941,7 @@ fn host_grants_reject_ranges_wildcards_and_unbound_addresses() {
 }
 
 /// `count` distinct exact grants to the fixture workload, both protocols.
-fn many(count: usize) -> Value {
+pub(super) fn many(count: usize) -> Value {
     json!((0..count)
         .map(|index| host_grant(
             if index % 2 == 0 { "tcp" } else { "udp" },
@@ -817,7 +965,8 @@ fn host_grants_compile_a_constant_rule_graph_and_one_element_per_grant() {
         if let Some(arrival) = all.sets.get("host_grant_arrival") {
             assert_eq!(arrival.len(), 1024);
         }
-        assert!(table(&prepared(fixture)).sets.is_empty());
+        let without = table(&prepared(fixture));
+        assert!(without.sets.keys().all(|name| !name.starts_with("host_grant")));
     }
 }
 
@@ -899,7 +1048,7 @@ fn host_grants_meet_the_atomic_reserve_at_the_contract_maximum() {
         };
         let (graph, elements) = (size(&[3, 6, 9]), size(&[12]));
         assert!(
-            program.len() < 768 && graph <= 100_000 && elements <= super::compile::ELEMENT_BYTES
+            program.len() < 768 && graph <= super::compile::RULE_BYTES && graph + elements <= super::compile::TARGET_BYTES
         );
         assert!(deletion + graph + elements + 64 <= crate::wire::BATCH_BYTES);
         // The contract maximum is the validation bound.
@@ -911,7 +1060,7 @@ fn host_grants_meet_the_atomic_reserve_at_the_contract_maximum() {
         );
     }
     // The reserve itself: a maximum previous graph beside a maximum target.
-    assert!(deletion + 100_000 + super::compile::ELEMENT_BYTES + 64 <= crate::wire::BATCH_BYTES);
+    assert!(deletion + super::compile::TARGET_BYTES + 64 <= crate::wire::BATCH_BYTES);
 }
 
 /// A status carries up to three complete policies: the applied one and the

package/rust/src/egress_localplatform_tests.rs

@@ -0,0 +1,204 @@
+//! Host-local platform endpoints in host transit: leased flows from a handoff
+//! into a platform endpoint served on a host address, and nothing else.
+use super::hostgrant_tests::{
+    bytes, chains, decide, normalized, opening, prepared, Flow, ACK, ESTABLISHED,
+};
+use super::tests::host;
+use serde_json::{json, Value};
+
+const TRANSIT: [u8; 4] = [10, 240, 0, 2];
+const UPLINK: [u8; 4] = [192, 0, 2, 2];
+const HANDOFF: [u8; 4] = [10, 240, 0, 1];
+const LINK: Option<(u32, &str)> = Some((4, "handoff"));
+
+/// The host fixture with two platform endpoints on host addresses: a TCP hub
+/// on the uplink address and a UDP store on the handoff address.
+pub(crate) fn served(mut value: Value) -> Value {
+    value["scope"]["protection"]["platformEndpoints"]
+        .as_array_mut()
+        .unwrap()
+        .extend([
+            json!({"id":"hub","address":"192.0.2.2","protocol":"tcp","port":8443}),
+            json!({"id":"store","address":"10.240.0.1","protocol":"udp","port":7000}),
+        ]);
+    value
+}
+pub(crate) fn local(mut value: Value, ids: Value) -> Value {
+    value["scope"]["localPlatformEndpoints"] = ids;
+    value
+}
+fn exact() -> Value {
+    local(served(host()), json!(["store", "hub"]))
+}
+/// A leased opening from the transit source address arriving on the handoff.
+fn arrival(protocol: u8, source_port: u16, destination: [u8; 4], port: u16) -> Flow {
+    Flow {
+        input: LINK,
+        output: None,
+        protocol,
+        source: TRANSIT,
+        destination,
+        source_port,
+        destination_port: port,
+        original: (TRANSIT, destination, source_port, port),
+        ..opening(LINK, None)
+    }
+}
+/// The host's answer to `flow`, leaving on the handoff.
+fn answer(flow: Flow) -> Flow {
+    Flow {
+        input: None,
+        output: LINK,
+        source: flow.destination,
+        destination: flow.source,
+        source_port: flow.destination_port,
+        destination_port: flow.source_port,
+        tcp_flags: ACK,
+        state: ESTABLISHED,
+        reply: true,
+        ..flow
+    }
+}
+
+#[test]
+fn local_platform_endpoints_absent_and_empty_keep_the_host_digest_and_compiled_bytes() {
+    let baseline = prepared(host());
+    let empty = prepared(local(host(), json!([])));
+    assert_eq!(empty, baseline);
+    assert_eq!(bytes(&empty), bytes(&baseline));
+    let with = prepared(exact());
+    assert!(serde_json::to_string(&with.policy)
+        .unwrap()
+        .contains("\"localPlatformEndpoints\":[\"hub\",\"store\"]"));
+    // Canonical order.
+    assert_eq!(
+        prepared(local(served(host()), json!(["hub", "store"]))),
+        with
+    );
+    // The endpoints and the chains exist only when declared.
+    let graph = chains(&with);
+    assert!(
+        graph.contains_key("local_platform_in")
+            && !chains(&baseline).contains_key("local_platform_in")
+    );
+}
+
+#[test]
+fn local_platform_endpoint_on_a_host_address_is_refused_unless_declared() {
+    // The refusal stays for every undeclared endpoint on a host address.
+    assert!(normalized(served(host())).is_err());
+    assert!(normalized(local(served(host()), json!(["hub"]))).is_err());
+    assert!(normalized(local(served(host()), json!(["store"]))).is_err());
+    assert!(normalized(exact()).is_ok());
+    for invalid in [
+        // Unknown, duplicate, or an endpoint the host does not hold.
+        json!(["hub", "store", "missing"]),
+        json!(["hub", "store", "hub"]),
+        json!(["hub", "store", "dns"]),
+        json!(["hub", "store", "relay"]),
+        json!(["hub", "store", ""]),
+        json!(["hub", "store", 1]),
+        json!("hub"),
+        json!({"hub": true}),
+    ] {
+        assert!(
+            normalized(local(served(host()), invalid.clone())).is_err(),
+            "{invalid}"
+        );
+    }
+}
+
+#[test]
+fn local_platform_endpoint_admits_only_leased_exact_untranslated_flows_and_their_replies() {
+    let baseline = prepared(host());
+    let with = prepared(exact());
+    let tcp = arrival(6, 10500, UPLINK, 8443);
+    let udp = arrival(17, 10500, HANDOFF, 7000);
+    let decided = |flow: &Flow| {
+        let chain = if flow.input.is_some() {
+            "input"
+        } else {
+            "output"
+        };
+        (
+            decide(&baseline, chain, flow).verdict,
+            decide(&with, chain, flow).verdict,
+        )
+    };
+    // Every admitted packet: the TCP opening, established TCP, the UDP opening,
+    // and both replies. The baseline denies each at the handoff.
+    for flow in [
+        tcp,
+        Flow {
+            state: ESTABLISHED,
+            tcp_flags: ACK,
+            ..tcp
+        },
+        udp,
+        answer(tcp),
+        answer(udp),
+    ] {
+        assert_eq!(decided(&flow), (0, 1));
+    }
+    // Everything else keeps the baseline decision: a source port outside the
+    // leased range of the protocol, another source address, another port or
+    // protocol, a flow translated in transit, another zone, a TCP opening
+    // without SYN, and a host-origin opening toward the transit address.
+    for flow in [
+        arrival(6, 20000, UPLINK, 8443),
+        arrival(6, 9999, UPLINK, 8443),
+        arrival(6, 10500, UPLINK, 8444),
+        arrival(17, 10500, UPLINK, 8443),
+        arrival(6, 10500, HANDOFF, 7000),
+        arrival(17, 10500, HANDOFF, 7001),
+        Flow {
+            source: [10, 240, 0, 3],
+            original: ([10, 240, 0, 3], UPLINK, 10500, 8443),
+            ..tcp
+        },
+        Flow {
+            original: (TRANSIT, HANDOFF, 10500, 9000),
+            ..tcp
+        },
+        Flow { zone: 7, ..tcp },
+        Flow {
+            tcp_flags: ACK,
+            ..tcp
+        },
+        Flow {
+            reply: false,
+            state: 8,
+            tcp_flags: 0x02,
+            original: (UPLINK, TRANSIT, 8443, 10500),
+            ..answer(tcp)
+        },
+        Flow {
+            state: 8,
+            ..answer(tcp)
+        },
+    ] {
+        let (before, after) = decided(&flow);
+        assert_eq!(after, before, "{:?}", flow.original);
+    }
+    // A translated arrival that the source range admits is still refused: the
+    // original tuple is part of every check.
+    assert_eq!(
+        decided(&Flow {
+            original: (TRANSIT, HANDOFF, 10500, 9000),
+            ..tcp
+        }),
+        (0, 0)
+    );
+    // Forwarded traffic and the uplink keep their exact previous rules. (The
+    // protected chains list every platform endpoint, served here or not.)
+    let graph = chains(&with);
+    let reference = chains(&baseline);
+    for name in ["forward", "post"] {
+        assert_eq!(graph[name], reference[name], "{name}");
+    }
+    // One jump per leased range per direction, ahead of the handoff denials.
+    assert_eq!(graph["input"].len(), reference["input"].len() + 2);
+    assert_eq!(graph["output"].len(), reference["output"].len() + 2);
+    assert_eq!(graph["local_platform_in"].len(), 4);
+    assert_eq!(graph["local_platform_back"].len(), 2);
+}