@push.rocks/smartnftables 2.6.0 → 3.0.0

package/rust/src/owner_host_traffic_tests.rs

@@ -389,6 +389,8 @@ fn v2_host_publishes_exact_uplink_ports_and_removes_them_with_the_generation() {
                 target_port: 8443,
                 target_address: "10.240.0.2".into(),
                 host_ip: "192.0.2.2".into(),
+                host_port_end: None,
+                symmetric: false,
             },
             egress::PublishedPort {
                 protocol: "udp".into(),
@@ -396,6 +398,8 @@ fn v2_host_publishes_exact_uplink_ports_and_removes_them_with_the_generation() {
                 target_port: 8125,
                 target_address: "10.240.0.2".into(),
                 host_ip: "192.0.2.2".into(),
+                host_port_end: None,
+                symmetric: false,
             },
         ];
         let mut owner = Owner::new(options("host_published")).unwrap();

package/rust/src/owner_identity_tests.rs

@@ -168,94 +168,162 @@ fn egress_identity_rejects_unknown_duplicate_or_incomplete_operands() {
     }
 }
 
+/// The compiled chains, rules, and sets with their element identities of one
+/// prepared policy, as the owner's graph comparison sees them.
+type Compiled = (
+    Vec<Vec<u8>>,
+    Vec<(String, Vec<u8>)>,
+    std::collections::BTreeMap<String, (Vec<u8>, Vec<Vec<u8>>)>,
+);
+fn compiled(value: serde_json::Value) -> Compiled {
+    let prepared = serde_json::from_value::<crate::egress::Policy>(value)
+        .unwrap()
+        .prepare()
+        .unwrap();
+    let (mut chains, mut rules) = (Vec::new(), Vec::new());
+    let mut sets = std::collections::BTreeMap::new();
+    for (kind, attributes) in prepared.program("snft_identity").unwrap() {
+        match kind {
+            3 => chains.push(super::chain_identity(&attributes).unwrap()),
+            6 => {
+                // The stamp carries the policy digest; compare the rule itself.
+                let unstamped: Vec<Attr> = attributes
+                    .iter()
+                    .map(|attribute| match attribute.id() {
+                        7 => Attr::bytes(7, b"stamp".to_vec()),
+                        _ => attribute.clone(),
+                    })
+                    .collect();
+                rules.push(rule_identity(&unstamped).unwrap());
+            }
+            9 => {
+                // The kernel's dump of the same set has the same identity.
+                let identity = set_identity(&attributes).unwrap();
+                assert_eq!(set_identity(&dumped_set(&attributes)).unwrap(), identity);
+                sets.insert(wire::text(&attributes, 2).unwrap(), (identity, Vec::new()));
+            }
+            12 => {
+                let list = wire::attrs(&wire::one(&attributes, 3).unwrap().value).unwrap();
+                sets.get_mut(&wire::text(&attributes, 2).unwrap())
+                    .unwrap()
+                    .1
+                    .extend(element_keys(&list).unwrap());
+            }
+            other => panic!("operation {other}"),
+        }
+    }
+    (chains, rules, sets)
+}
+
 /// A published host-transit generation must survive the same apply-time graph
-/// identity as the rest of the table: the kernel dump is compared operand by
-/// operand, so destination NAT and its admissions cannot be silently rewritten.
+/// identity as the rest of the table: its rules and every set element are
+/// compared operand by operand, so destination NAT and its admissions cannot be
+/// silently rewritten, while the rules stay the same for any publication.
 #[test]
 fn published_host_graph_identity_preserves_destination_nat_and_admission_operands() {
-    let compiled = |target_port: u16| {
-        let value = crate::egress::tests::published_host(serde_json::json!([
+    let host = |target_port: u16| {
+        compiled(crate::egress::tests::published_host(serde_json::json!([
             crate::egress::tests::published_port("tcp", 443, target_port)
-        ]));
-        let prepared = serde_json::from_value::<crate::egress::Policy>(value)
-            .unwrap()
-            .prepare()
-            .unwrap();
-        let mut chains = Vec::new();
-        let mut rules = Vec::new();
-        for (kind, attributes) in prepared.program("snft_identity").unwrap() {
-            if kind == 3 {
-                chains.push(super::chain_identity(&attributes).unwrap());
-            } else {
-                rules.push(rule_identity(&attributes).unwrap());
-            }
-        }
-        (chains, rules)
+        ])))
     };
-    let (chains, rules) = compiled(8443);
+    let (chains, rules, sets) = host(8443);
     assert_eq!(rules.iter().filter(|(chain, _)| chain == "pre").count(), 1);
     assert_eq!(chains.len(), 7);
-    let translation = rules.iter().find(|(chain, _)| chain == "pre").unwrap();
-    let (_, changed) = compiled(9443);
-    let other = changed.iter().find(|(chain, _)| chain == "pre").unwrap();
-    assert_ne!(translation.1, other.1);
-    assert_eq!(
-        rules.iter().filter(|(chain, _)| chain == "forward").count(),
-        changed.iter().filter(|(chain, _)| chain == "forward").count()
-    );
+    let (_, changed_rules, changed_sets) = host(9443);
+    assert_eq!(rules, changed_rules);
+    // The translation's port is map data and the admission's port is a key.
+    for name in ["published_port", "published_forward"] {
+        assert_eq!(sets[name].0, changed_sets[name].0);
+        assert_ne!(sets[name].1, changed_sets[name].1, "{name}");
+    }
 }
 
 /// A published router generation must survive the same apply-time graph identity
-/// as the rest of the table: the kernel dump is compared operand by operand, so
-/// the workload translation and its admissions cannot be silently rewritten.
+/// as the rest of the table: its rules and every set element are compared operand
+/// by operand, so the workload translation, both classifications and the
+/// admissions cannot be silently rewritten.
 #[test]
 fn published_router_graph_identity_preserves_destination_nat_and_admission_operands() {
-    let compiled = |endpoint_port: u16| {
-        let value = crate::egress::tests::published_router(serde_json::json!([
+    let router = |endpoint_port: u16| {
+        compiled(crate::egress::tests::published_router(serde_json::json!([
             crate::egress::tests::router_published_port("tcp", 443, endpoint_port)
-        ]));
-        let prepared = serde_json::from_value::<crate::egress::Policy>(value)
-            .unwrap()
-            .prepare()
-            .unwrap();
-        let mut chains = Vec::new();
-        let mut rules = Vec::new();
-        for (kind, attributes) in prepared.program("snft_identity").unwrap() {
-            if kind == 3 {
-                chains.push(super::chain_identity(&attributes).unwrap());
-            } else {
-                rules.push(rule_identity(&attributes).unwrap());
-            }
-        }
-        (chains, rules)
+        ])))
     };
-    let (chains, rules) = compiled(8443);
+    let (chains, rules, sets) = router(8443);
     assert_eq!(rules.iter().filter(|(chain, _)| chain == "pre").count(), 1);
-    assert_eq!(chains.len(), 16);
-    let translation = rules.iter().find(|(chain, _)| chain == "pre").unwrap();
-    let (_, changed) = compiled(9443);
-    let other = changed.iter().find(|(chain, _)| chain == "pre").unwrap();
-    assert_ne!(translation.1, other.1);
-    assert_eq!(
-        rules.iter().filter(|(chain, _)| chain == "forward").count(),
-        changed.iter().filter(|(chain, _)| chain == "forward").count()
-    );
-    // The handoff ingress classification is part of the same identity.
+    // The router's base chains, the pre chain and its three regular chains.
+    assert_eq!(chains.len(), 10);
+    let (_, changed_rules, changed_sets) = router(9443);
+    assert_eq!(rules, changed_rules);
+    for name in ["published_port", "published_forward", "published_endpoint"] {
+        assert_ne!(sets[name].1, changed_sets[name].1, "{name}");
+    }
+    assert_eq!(sets["published_arrival"], changed_sets["published_arrival"]);
+}
+
+/// Interval elements carry their last key and a map's data in their identity;
+/// a changed bound or datum is a changed element, and a set description is only
+/// ever a concatenation.
+#[test]
+fn interval_sets_and_elements_have_exact_graph_identity() {
+    let (_, _, sets) = compiled(crate::egress::tests::published_router(serde_json::json!([
+        crate::egress::tests::router_published_port("tcp", 443, 8443)
+    ])));
     assert_eq!(
-        rules.iter().filter(|(chain, _)| chain == "raw_return").count(),
-        changed
-            .iter()
-            .filter(|(chain, _)| chain == "raw_return")
-            .count()
+        sets.keys().filter(|name| name.starts_with("published_")).count(),
+        4
     );
+    let element = |last: u8, data: Option<u8>| {
+        let value = |kind: u16, byte: u8| Attr::nested(kind, vec![Attr::bytes(1, vec![byte; 8])]);
+        let mut fields = vec![value(1, 1), value(10, last)];
+        if let Some(data) = data {
+            fields.push(value(2, data));
+        }
+        Attr::nested(1, fields)
+    };
+    let identity = |attribute: Attr| element_keys(&[attribute]).unwrap();
+    let exact = identity(element(1, Some(4)));
+    assert_ne!(identity(element(2, Some(4))), exact);
+    assert_ne!(identity(element(1, Some(5))), exact);
+    assert_ne!(identity(element(1, None)), exact);
+    for extension in [
+        Attr::u32(3, 1),
+        Attr::nested(10, vec![Attr::bytes(1, vec![1; 8])]),
+    ] {
+        let Attr { value, .. } = element(1, Some(4));
+        let mut fields = wire::attrs(&value).unwrap();
+        fields.push(extension);
+        assert!(element_keys(&[Attr::nested(1, fields)]).is_err());
+    }
 }
 
-/// A host-grant set as Linux dumps it: the compiled creation plus the kernel's
-/// handle, an empty description, the backend type and the element count.
+/// A set as Linux dumps it: the compiled creation plus the kernel's handle, its
+/// description (empty for a plain key, the concatenation's field lengths without
+/// nesting flags otherwise), the backend type and the element count.
 fn dumped_set(created: &[Attr]) -> Vec<Attr> {
-    let mut dump: Vec<Attr> = created.iter().filter(|attribute| attribute.id() != 10).cloned().collect();
+    let mut dump: Vec<Attr> = created
+        .iter()
+        .filter(|attribute| ![9, 10].contains(&attribute.id()))
+        .cloned()
+        .collect();
     dump.push(Attr::u64(16, 7));
-    dump.push(Attr::nested(9, vec![]));
+    let fields = created
+        .iter()
+        .find(|attribute| attribute.id() == 9)
+        .map(|description| {
+            let concatenation = wire::attrs(&description.value).unwrap();
+            wire::attrs(&wire::one(&concatenation, 2).unwrap().value)
+                .unwrap()
+                .iter()
+                .map(|field| {
+                    Attr::bytes(1, wire::encode_attrs(&[Attr::u32(1, wire::number(&wire::attrs(&field.value).unwrap(), 1).unwrap())]))
+                })
+                .collect::<Vec<_>>()
+        });
+    dump.push(match fields {
+        Some(fields) => Attr::bytes(9, wire::encode_attrs(&[Attr::bytes(2, wire::encode_attrs(&fields))])),
+        None => Attr::nested(9, vec![]),
+    });
     dump.push(Attr::string(19, "nft_rhash_type"));
     dump.push(Attr::u32(20, 1024));
     dump
@@ -273,7 +341,11 @@ fn host_grant_sets_elements_and_lookups_have_exact_graph_identity() {
     .prepare()
     .unwrap();
     let program = prepared.program("snft_identity").unwrap();
-    let sets: Vec<_> = program.iter().filter(|(kind, _)| *kind == 9).map(|(_, attributes)| attributes.clone()).collect();
+    let sets: Vec<_> = program
+        .iter()
+        .filter(|(kind, attributes)| *kind == 9 && wire::text(attributes, 2).unwrap().starts_with("host_grant"))
+        .map(|(_, attributes)| attributes.clone())
+        .collect();
     assert_eq!(sets.len(), 2);
     for created in &sets {
         // The kernel's informational attributes are not identity.
@@ -294,21 +366,30 @@ fn host_grant_sets_elements_and_lookups_have_exact_graph_identity() {
             assert!(set_identity(&changed).is_err());
         }
     }
-    // Elements are plain keys; any extension rejects.
-    let (_, elements) = program.iter().find(|(kind, _)| *kind == 12).unwrap();
+    // Elements are plain keys; flags reject, and data is a different element.
+    let (_, elements) = program
+        .iter()
+        .find(|(kind, attributes)| *kind == 12 && wire::text(attributes, 2).unwrap() == "host_grant")
+        .unwrap();
     let list = wire::attrs(&wire::one(elements, 3).unwrap().value).unwrap();
     assert_eq!(element_keys(&list).unwrap().len(), 1);
     let key = wire::attrs(&list[0].value).unwrap();
-    for extension in [Attr::u32(3, 1), Attr::nested(2, vec![Attr::bytes(1, vec![1; 4])])] {
-        let mut changed = key.clone();
-        changed.push(extension);
-        assert!(element_keys(&[Attr::nested(1, changed)]).is_err());
-    }
-    // Every lookup names its set with a plain, uninverted membership test, and
-    // the key registers are part of identity.
+    let mut flagged = key.clone();
+    flagged.push(Attr::u32(3, 1));
+    assert!(element_keys(&[Attr::nested(1, flagged)]).is_err());
+    let mut mapped = key.clone();
+    mapped.push(Attr::nested(2, vec![Attr::bytes(1, vec![1; 4])]));
+    assert_ne!(
+        element_keys(&[Attr::nested(1, mapped)]).unwrap(),
+        element_keys(&list[..1]).unwrap()
+    );
+    // Five rules look up the host grant sets (the router's private and leased
+    // sets have their own lookups); the set name and key registers are identity.
     let lookups: Vec<_> = program
         .iter()
-        .filter(|(kind, attributes)| *kind == 6 && rule_identity(attributes).unwrap().1.windows(6).any(|window| window == b"lookup"))
+        .filter(|(kind, attributes)| {
+            *kind == 6 && wire::encode_attrs(attributes).windows(10).any(|window| window == b"host_grant")
+        })
         .collect();
     assert_eq!(lookups.len(), 5);
     let lookup = |data: Vec<Attr>| rule(vec![expression("lookup", data)]);
@@ -317,13 +398,18 @@ fn host_grant_sets_elements_and_lookups_have_exact_graph_identity() {
     for changed in [
         vec![Attr::string(1, "host_grant_arrival"), Attr::u32(2, 1), Attr::u32(5, 0)],
         vec![Attr::string(1, "host_grant"), Attr::u32(2, 9), Attr::u32(5, 0)],
+        // A map lookup's data register and an absence test are identity.
+        vec![Attr::string(1, "host_grant"), Attr::u32(2, 1), Attr::u32(3, 2), Attr::u32(5, 0)],
+        vec![Attr::string(1, "host_grant"), Attr::u32(2, 1), Attr::u32(5, 1)],
     ] {
         assert_ne!(rule_identity(&lookup(changed)).unwrap(), identity);
     }
     for invalid in [
-        vec![Attr::string(1, "host_grant"), Attr::u32(2, 1), Attr::u32(5, 1)],
+        vec![Attr::string(1, "host_grant"), Attr::u32(2, 1), Attr::u32(5, 2)],
         vec![Attr::string(1, "host_grant"), Attr::u32(2, 1)],
-        vec![Attr::string(1, "host_grant"), Attr::u32(2, 1), Attr::u32(3, 2), Attr::u32(5, 0)],
+        vec![Attr::string(1, "host_grant"), Attr::u32(2, 1), Attr::u32(3, 2)],
+        // A map lookup is never inverted.
+        vec![Attr::string(1, "host_grant"), Attr::u32(2, 1), Attr::u32(3, 2), Attr::u32(5, 1)],
     ] {
         assert!(rule_identity(&lookup(invalid)).is_err());
     }

package/rust/src/owner_publishedrange_traffic_tests.rs

@@ -0,0 +1,306 @@
+//! Published port ranges and symmetric publications across both hops, in the
+//! four-namespace topology of the router publication qualification.
+use super::egress_traffic_tests::{allocation, binding, connect, denied, host_policy, ns_ip};
+use super::egress_traffic_tests::{protection, roundtrip, socket};
+use super::host_traffic_tests::{control, dark_udp, published_udp};
+use super::router_traffic_tests::connect_from;
+use super::*;
+use crate::egress;
+use serde_json::json;
+use std::io::{Read, Write};
+use std::net::TcpListener;
+use std::time::Duration;
+
+const WORK: &str = "pr_work";
+const ROUTER: &str = "pr_router";
+const HOST: &str = "pr_host";
+const PEER: &str = "pr_peer";
+
+/// The SIP/RTP shape on both hops: UDP and TCP signalling on one port and one UDP
+/// RTP range, all symmetric, beside a plain publication and leased egress.
+fn host_ranges() -> egress::Policy {
+    let mut policy = host_policy();
+    let egress::Scope::HostTransit(scope) = &mut policy.scope else {
+        panic!()
+    };
+    scope.published_ports = [
+        ("udp", 20000, Some(20200), 20000, true),
+        ("udp", 5070, None, 5070, true),
+        ("tcp", 5070, None, 5070, true),
+        ("udp", 8125, None, 8125, false),
+    ]
+    .into_iter()
+    .map(
+        |(protocol, host_port, host_port_end, target_port, symmetric)| egress::PublishedPort {
+            protocol: protocol.into(),
+            host_port,
+            host_port_end,
+            target_port,
+            target_address: "10.240.0.2".into(),
+            host_ip: "192.0.2.2".into(),
+            symmetric,
+        },
+    )
+    .collect();
+    policy
+}
+fn router_ranges() -> egress::Policy {
+    let link = binding("work", "10.241.0.1", "veth");
+    let mut generation = allocation();
+    generation["conntrackZone"] = json!(17);
+    generation["conntrackLabel"] = json!("a".repeat(32));
+    generation["grants"] = json!([
+        {"sourceEndpoint":"work","sourcePrefix":"10.241.0.2/32","destination":{"kind":"public","prefix":"203.0.113.2/32"},
+            "protocol":"udp","sourcePort":null,"destinationPort":42000,"sourcePortRange":{"first":10000,"last":10015}}
+    ]);
+    let publication = |protocol: &str,
+                       port: u16,
+                       end: Option<u16>,
+                       endpoint: u16,
+                       symmetric: bool| {
+        let mut value = json!({"protocol":protocol,"transitPort":port,"endpointPort":endpoint,
+            "endpointAddress":"10.241.0.2","transitSourceAddress":"10.240.0.2","symmetric":symmetric});
+        if let Some(end) = end {
+            value["transitPortEnd"] = json!(end);
+        }
+        value
+    };
+    serde_json::from_value(
+        json!({"schemaVersion":2,"revision":1,"scope":{"kind":"routerEgress",
+        "endpoints":[{"id":"work","interfaceIndex":link["interfaceIndex"],"interfaceName":"work",
+            "interfaceKind":"veth","sourcePrefixes":["10.241.0.2/32"]}],
+        "rules":[],"links":[link],"handoff":binding("handoff","10.240.0.2","veth"),
+        "protection":protection(),"generations":[generation],"publishedPorts":[
+            publication("udp", 20000, Some(20200), 20000, true),
+            publication("udp", 5070, None, 5070, true),
+            publication("tcp", 5070, None, 5070, true),
+            publication("udp", 8125, None, 9125, false)
+        ]}}),
+    )
+    .unwrap()
+}
+/// Binds and applies a policy inside its namespace, where its links exist, and
+/// returns the owned sets with their element counts as the kernel dumps them.
+/// Enforcement means the dump, every interval element and map datum included,
+/// matched the compiled graph.
+fn apply(
+    namespace: &str,
+    name: &'static str,
+    policy: fn() -> egress::Policy,
+) -> (Owner, Applied, Vec<(String, usize)>) {
+    in_namespace(namespace, move || {
+        let mut owner = Owner::new(options(name)).unwrap();
+        let target: Prepared = policy().prepare().unwrap().into();
+        target
+            .validate_interfaces()
+            .expect("published range fixture binding");
+        let applied = owner
+            .reconcile(Transition {
+                previous: None,
+                target,
+            })
+            .unwrap();
+        assert!(owner.inspect().enforced);
+        let sets = owner
+            .graph()
+            .unwrap()
+            .expect("owned table present")
+            .sets
+            .iter()
+            .map(|(attributes, elements)| (wire::text(attributes, 2).unwrap(), elements.len()))
+            .collect();
+        (owner, applied, sets)
+    })
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn v2_published_ranges_and_symmetric_publications_cross_both_hops() {
+    isolated();
+    for name in [WORK, ROUTER, HOST, PEER] {
+        ip(&["netns", "add", name]);
+        ns_ip(name, &["link", "set", "lo", "up"]);
+        in_namespace(name, || {
+            std::fs::write("/proc/sys/net/ipv4/ip_forward", "1").unwrap()
+        });
+    }
+    connect(
+        WORK,
+        "client",
+        "10.241.0.2/24",
+        ROUTER,
+        "work",
+        "10.241.0.1/24",
+    );
+    connect(
+        ROUTER,
+        "handoff",
+        "10.240.0.2/30",
+        HOST,
+        "router",
+        "10.240.0.1/30",
+    );
+    connect(
+        HOST,
+        "uplink",
+        "192.0.2.2/24",
+        PEER,
+        "underlay",
+        "192.0.2.3/24",
+    );
+    ns_ip(WORK, &["route", "add", "default", "via", "10.241.0.1"]);
+    ns_ip(ROUTER, &["route", "add", "default", "via", "10.240.0.1"]);
+    // The workload route exists throughout, so every later denial is caused by
+    // policy and not by a missing route.
+    ns_ip(
+        HOST,
+        &["route", "add", "10.241.0.0/24", "via", "10.240.0.2"],
+    );
+    ns_ip(
+        HOST,
+        &["route", "add", "203.0.113.2/32", "via", "192.0.2.3"],
+    );
+    ns_ip(PEER, &["address", "add", "203.0.113.2/32", "dev", "lo"]);
+    ns_ip(PEER, &["route", "add", "default", "via", "192.0.2.2"]);
+    let first = socket(WORK, "10.241.0.2:20000");
+    let middle = socket(WORK, "10.241.0.2:20100");
+    let last = socket(WORK, "10.241.0.2:20200");
+    let above = socket(WORK, "10.241.0.2:20201");
+    let below = socket(WORK, "10.241.0.2:19999");
+    let rtp = socket(WORK, "10.241.0.2:20150");
+    let sip = socket(WORK, "10.241.0.2:5070");
+    let plain = socket(WORK, "10.241.0.2:9125");
+    let work_egress = socket(WORK, "10.241.0.2:40001");
+    let public = socket(PEER, "203.0.113.2:42000");
+    let rtp_peer = socket(PEER, "203.0.113.2:42001");
+    let sip_peer = socket(PEER, "203.0.113.2:42002");
+    let plain_peer = socket(PEER, "203.0.113.2:42003");
+    let protected_peer = socket(PEER, "192.0.2.3:40300");
+    // Positive controls: without policy the workload is routed directly and its
+    // packets reach the protected peer address, so every later result is caused
+    // by policy. Each probe uses its own tuple, so no unreplied conntrack entry
+    // carries a null translation across the policy change.
+    control(
+        &socket(PEER, "192.0.2.3:40010"),
+        "10.241.0.2:20201",
+        &above,
+        true,
+    );
+    control(
+        &socket(PEER, "192.0.2.3:40011"),
+        "10.241.0.2:19999",
+        &below,
+        true,
+    );
+    control(
+        &socket(WORK, "10.241.0.2:5071"),
+        "192.0.2.3:40300",
+        &protected_peer,
+        true,
+    );
+    dark_udp(&socket(PEER, "192.0.2.3:40012"), &middle, "192.0.2.2:20100");
+    let (host_owner, host_applied, host_sets) = apply(HOST, "published_range_host", host_ranges);
+    let (router_owner, router_applied, router_sets) =
+        apply(ROUTER, "published_range", router_ranges);
+    // Publications are set elements: one-port translations, range translations,
+    // the inbound admissions and the symmetric map on both hops, and the two raw
+    // classifications in the router.
+    let named = |sets: &[(String, usize)], name: &str| {
+        sets.iter()
+            .find(|(set, _)| set == name)
+            .map(|(_, count)| *count)
+    };
+    for (name, host, router) in [
+        ("published_port", Some(3), Some(3)),
+        ("published_address", Some(1), Some(1)),
+        ("published_forward", Some(4), Some(4)),
+        ("published_symmetric", Some(3), Some(3)),
+        ("published_arrival", None, Some(4)),
+        // 9125 and the 5070 ports of both protocols and the 20000 range.
+        ("published_endpoint", None, Some(4)),
+    ] {
+        assert_eq!(named(&host_sets, name), host, "host {name}");
+        assert_eq!(named(&router_sets, name), router, "router {name}");
+    }
+    // First, middle and last port of the range reach the listener behind both
+    // hops with the client address preserved, and the reply comes back from the
+    // published address and port.
+    for (port, client_port, workload) in [
+        (20000, 40100, &first),
+        (20100, 40101, &middle),
+        (20200, 40102, &last),
+    ] {
+        let client = in_namespace(PEER, move || {
+            std::net::UdpSocket::bind(format!("192.0.2.3:{client_port}")).unwrap()
+        });
+        client
+            .set_read_timeout(Some(Duration::from_millis(250)))
+            .unwrap();
+        published_udp(
+            &client,
+            workload,
+            &format!("192.0.2.2:{port}"),
+            &format!("192.0.2.3:{client_port}"),
+        );
+    }
+    // The ports just outside the range stay dark.
+    dark_udp(&socket(PEER, "192.0.2.3:40103"), &above, "192.0.2.2:20201");
+    dark_udp(&socket(PEER, "192.0.2.3:40104"), &below, "192.0.2.2:19999");
+    // Symmetric outbound flows reach the uplink with their own port, from a range
+    // port and from the single signalling port, and their replies return.
+    let observed = roundtrip(&rtp, &rtp_peer);
+    assert_eq!(observed.to_string(), "192.0.2.2:20150");
+    let observed = roundtrip(&sip, &sip_peer);
+    assert_eq!(observed.to_string(), "192.0.2.2:5070");
+    // A later request from the same peer tuple toward the published port is the
+    // flow's own reply direction and reaches the workload from that peer.
+    assert_eq!(sip_peer.send_to(b"invite", "192.0.2.2:5070").unwrap(), 6);
+    let mut bytes = [0; 64];
+    let (size, from) = sip
+        .recv_from(&mut bytes)
+        .expect("request on the symmetric flow");
+    assert_eq!(
+        (&bytes[..size], from.to_string().as_str()),
+        (&b"invite"[..], "203.0.113.2:42002")
+    );
+    // An unrelated client still reaches the publication inbound.
+    let unrelated = socket(PEER, "192.0.2.3:40105");
+    published_udp(&unrelated, &sip, "192.0.2.2:5070", "192.0.2.3:40105");
+    let listener = in_namespace(PEER, || TcpListener::bind("203.0.113.2:5060").unwrap());
+    let mut outbound = in_namespace(WORK, || connect_from("10.241.0.2:5070", "203.0.113.2:5060"))
+        .expect("symmetric tcp opening");
+    let (mut served, peer) = listener.accept().unwrap();
+    assert_eq!(peer.to_string(), "192.0.2.2:5070");
+    for stream in [&outbound, &served] {
+        stream
+            .set_read_timeout(Some(Duration::from_secs(1)))
+            .unwrap();
+    }
+    outbound.write_all(b"ping").unwrap();
+    served.read_exact(&mut [0; 4]).unwrap();
+    served.write_all(b"pong").unwrap();
+    outbound.read_exact(&mut [0; 4]).unwrap();
+    drop(outbound);
+    drop(served);
+    // Negative controls: a plain publication's workload port opens nothing, and a
+    // symmetric flow into the protected union stays denied from either port kind.
+    denied(&plain, &plain_peer, false);
+    denied(&sip, &protected_peer, false);
+    denied(&rtp, &protected_peer, false);
+    // Leased egress keeps its own leased source range.
+    let outer = roundtrip(&work_egress, &public);
+    assert_eq!(outer.ip().to_string(), "192.0.2.2");
+    assert!((10000..=10015).contains(&outer.port()));
+    in_namespace(ROUTER, move || {
+        let mut owner = router_owner;
+        assert!(owner.inspect().enforced);
+        owner.release(router_applied).unwrap();
+    });
+    in_namespace(HOST, move || {
+        let mut owner = host_owner;
+        assert!(owner.inspect().enforced);
+        owner.release(host_applied).unwrap();
+    });
+    dark_udp(&socket(PEER, "192.0.2.3:40106"), &middle, "192.0.2.2:20100");
+    println!("V2_PUBLISHED_RANGE_PROOF set_backed_graph_verified=true range_first_delivered=true range_middle_delivered=true range_last_delivered=true client_address_preserved=true range_outside_dark=true symmetric_range_source_port_kept=true symmetric_udp_source_port_kept=true symmetric_tcp_source_port_kept=true peer_request_on_symmetric_flow=true inbound_beside_symmetric=true plain_publication_outbound_denied=true symmetric_protected_denied=true leased_egress_unaffected=true protected_positive_control=true released_range_dark=true");
+}

package/rust/src/owner_router_traffic_tests.rs

@@ -135,6 +135,8 @@ fn published_host_policy() -> egress::Policy {
             target_port,
             target_address: "10.240.0.2".into(),
             host_ip: "192.0.2.2".into(),
+            host_port_end: None,
+            symmetric: false,
         })
         .collect();
     policy