@push.rocks/smartnftables 2.6.0 → 3.0.0

package/rust/src/egress.router.rs

@@ -1,52 +1,6 @@
+use super::leased::Kind;
 use super::*;
 
-fn endpoint<'a>(scope: &'a RouterScope, grant: &Grant) -> Option<&'a LocalLink> {
-    grant.source_endpoint.as_ref().and_then(|id| {
-        let endpoint = scope.endpoints.iter().find(|item| &item.id == id)?;
-        scope
-            .links
-            .iter()
-            .find(|item| item.interface_index == endpoint.interface_index)
-    })
-}
-fn raw_original(scope: &RouterScope, grant: &Grant) -> Result<Vec<Attr>> {
-    let mut result = tuple(grant, &scope.protection, false, false)?;
-    result.extend(match endpoint(scope, grant) {
-        Some(endpoint) => link(endpoint, true),
-        None => link(&scope.handoff, false),
-    });
-    Ok(result)
-}
-fn filter(scope: &RouterScope, grant: &Grant, reply: bool) -> Result<Vec<Attr>> {
-    let mut result = tuple(grant, &scope.protection, reply, true)?;
-    result.extend(link(&scope.handoff, reply));
-    if let Some(endpoint) = endpoint(scope, grant) {
-        result.extend(link(endpoint, !reply));
-    }
-    Ok(result)
-}
-fn raw_return(scope: &RouterScope, grant: &Grant, generation: &Generation) -> Result<Vec<Attr>> {
-    let mut result = ipv4();
-    result.extend(link(&scope.handoff, true));
-    result.extend(meta(16, vec![protocol(&grant.protocol)]));
-    result.extend(current_address(
-        &super::super::destination(grant, &scope.protection)?,
-        true,
-    )?);
-    result.extend(current_address(
-        &format!("{}/32", generation.transit_source_address),
-        false,
-    )?);
-    if let Some(port) = grant.destination_port {
-        result.extend(current_port(port, true));
-    }
-    result.extend(current_range(
-        grant.source_port_range.first,
-        grant.source_port_range.last,
-        false,
-    ));
-    Ok(result)
-}
 /// The exact veth link of the workload endpoint that holds an endpoint address.
 /// Validation admits only a current endpoint address, and endpoint prefixes are
 /// pairwise disjoint, so one publication or host grant never spans two links.
@@ -68,70 +22,30 @@ pub(super) fn endpoint_link<'a>(scope: &'a RouterScope, address: &str) -> Result
         .find(|link| link.interface_index == endpoint.interface_index)
         .ok_or(crate::Error::Invalid)
 }
-fn published_link<'a>(scope: &'a RouterScope, port: &RouterPublishedPort) -> Result<&'a LocalLink> {
-    endpoint_link(scope, &port.endpoint_address)
-}
-/// Inbound publication envelope. Both directions check the exact links, the
-/// translated current tuple and the original conntrack destination, so foreign
-/// NAT cannot borrow this admission for another flow.
-fn published_envelope(
-    scope: &RouterScope,
-    endpoint: &LocalLink,
-    port: &RouterPublishedPort,
-    reply: bool,
-) -> Result<Vec<Attr>> {
-    let mut expressions = ipv4();
-    expressions.extend(link(&scope.handoff, !reply));
-    expressions.extend(link(endpoint, reply));
-    expressions.extend(meta(16, vec![protocol(&port.protocol)]));
-    expressions.extend(ct(10, None, vec![protocol(&port.protocol)]));
-    expressions.extend(ct(17, None, 0_u16.to_ne_bytes().to_vec()));
-    expressions.extend(ct(1, None, vec![u8::from(reply)]));
-    let target = format!("{}/32", port.endpoint_address);
-    expressions.extend(current_address(&target, reply)?);
-    expressions.extend(current_port(port.endpoint_port, reply));
-    let published = format!("{}/32", port.transit_source_address);
-    expressions.extend(original_address(&published, false)?);
-    expressions.extend(original_port(port.transit_port, false));
-    Ok(expressions)
-}
-/// Handoff ingress classification for an exact current publication. Raw runs
-/// before conntrack, so it matches the arriving tuple only and never sets a
-/// generation zone: a publication is an ordinary default-zone flow.
-fn published_return(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
-    for port in &scope.published_ports {
-        let mut expressions = ipv4();
-        expressions.extend(link(&scope.handoff, true));
-        expressions.extend(meta(16, vec![protocol(&port.protocol)]));
-        expressions.extend(current_address(
-            &format!("{}/32", port.transit_source_address),
-            false,
-        )?);
-        expressions.extend(current_port(port.transit_port, false));
-        program.end("raw_return", expressions, 1)?;
-    }
-    Ok(())
-}
-/// Endpoint ingress classification for an exact current publication. The workload
-/// side of a publication is an ordinary default-zone flow too, so it is matched on
-/// its exact link, address and dedicated published port before the leased
-/// classifiers below can zone it: a client whose source port equals a leased
-/// grant's destination port would otherwise move the workload's published packets
-/// into that generation, where they are not its flow. This only classifies; both
-/// the anti-spoof guards and the publication's admissions still decide admission.
-fn published_endpoint(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
+/// The publications of this hop, each behind the veth link of its workload.
+fn hop(scope: &RouterScope) -> Result<published::Hop<'_>> {
+    let mut publications = Vec::new();
     for port in &scope.published_ports {
-        let mut expressions = ipv4();
-        expressions.extend(link(published_link(scope, port)?, true));
-        expressions.extend(meta(16, vec![protocol(&port.protocol)]));
-        expressions.extend(current_address(
-            &format!("{}/32", port.endpoint_address),
-            true,
-        )?);
-        expressions.extend(current_port(port.endpoint_port, true));
-        program.end("raw_in", expressions, 1)?;
-    }
-    Ok(())
+        publications.push(published::Publication {
+            protocol: &port.protocol,
+            outside: (
+                &port.transit_source_address,
+                port.transit_port,
+                port.transit_last(),
+            ),
+            inside: (
+                &port.endpoint_address,
+                port.endpoint_port,
+                port.endpoint_last(),
+            ),
+            link: endpoint_link(scope, &port.endpoint_address)?,
+            symmetric: port.symmetric,
+        });
+    }
+    Ok(published::Hop {
+        publications,
+        fixed: &scope.handoff,
+    })
 }
 /// Handoff ingress classification for an exact host grant. Like a publication it
 /// is the explicit authority for its tuple, so it leads the protected-source
@@ -166,42 +80,6 @@ fn host_grant_sets(program: &mut Program<'_>, scope: &RouterScope) -> Result<()>
     }
     Ok(())
 }
-fn published_translation(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
-    for port in &scope.published_ports {
-        let mut expressions = ipv4();
-        expressions.extend(link(&scope.handoff, true));
-        expressions.extend(meta(16, vec![protocol(&port.protocol)]));
-        expressions.extend(ct(10, None, vec![protocol(&port.protocol)]));
-        expressions.extend(ct(17, None, 0_u16.to_ne_bytes().to_vec()));
-        expressions.extend(ct(1, None, vec![0]));
-        expressions.extend(current_address(
-            &format!("{}/32", port.transit_source_address),
-            false,
-        )?);
-        expressions.extend(current_port(port.transit_port, false));
-        expressions.extend(dnat(&port.endpoint_address, port.endpoint_port)?);
-        program.rule("pre", expressions)?;
-    }
-    Ok(())
-}
-fn published_admissions(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
-    for port in &scope.published_ports {
-        let endpoint = published_link(scope, port)?;
-        let original = published_envelope(scope, endpoint, port, false)?;
-        for connection_state in [2, 8] {
-            let mut expressions = original.clone();
-            expressions.extend(state(connection_state));
-            if connection_state == 8 && port.protocol == "tcp" {
-                expressions.extend(opening_tcp());
-            }
-            program.end("forward", expressions, 1)?;
-        }
-        let mut reply = published_envelope(scope, endpoint, port, true)?;
-        reply.extend(state(2));
-        program.end("forward", reply, 1)?;
-    }
-    Ok(())
-}
 fn protected(
     program: &mut Program<'_>,
     chain: &str,
@@ -221,7 +99,7 @@ fn protected(
     }
     program.end(chain, vec![], -5)
 }
-fn raw(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
+fn raw(program: &mut Program<'_>, scope: &RouterScope, hop: &published::Hop<'_>) -> Result<()> {
     // Handoff ingress must classify only exact leased return envelopes and exact
     // inbound publications. Unknown ingress never reaches private/default-zone
     // rules, even after a rename.
@@ -231,120 +109,28 @@ fn raw(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
     // classified ahead of the protected-source denial below, exactly as a
     // platform return envelope is. The host publishes into this address, so its
     // clients are not confined to unprotected space.
-    published_return(program, scope)?;
+    published::arrival(program, hop)?;
     host_grant_return(program, scope)?;
     // Both sides of a publication lead the leased classifiers of every generation,
     // so neither direction depends on the client's choice of source port.
-    published_endpoint(program, scope)?;
-    for platform in [true, false] {
-        if !platform {
-            for prefix in &scope.protection.prefixes {
-                for chain in ["raw_in", "raw_out"] {
-                    let mut expressions = ipv4();
-                    expressions.extend(current_address(prefix, false)?);
-                    program.end(chain, expressions, -5)?;
-                }
-                let mut expressions = ipv4();
-                expressions.extend(current_address(prefix, true)?);
-                program.end("raw_return", expressions, 0)?;
-            }
-        }
-        for generation in &scope.generations {
-            for grant in &generation.grants {
-                if matches!(grant.destination, Destination::Platform { .. }) != platform {
-                    continue;
-                }
-                let mut original = raw_original(scope, grant)?;
-                original.extend(set_ct(17, generation.conntrack_zone.to_ne_bytes().to_vec()));
-                program.end(
-                    if grant.source_endpoint.is_some() {
-                        "raw_in"
-                    } else {
-                        "raw_out"
-                    },
-                    original,
-                    1,
-                )?;
-                let mut reply = raw_return(scope, grant, generation)?;
-                reply.extend(set_ct(17, generation.conntrack_zone.to_ne_bytes().to_vec()));
-                program.end("raw_return", reply, 1)?;
-            }
+    published::endpoint(program, hop)?;
+    // Platform grants are classified ahead of the protected barrier, public
+    // grants behind it, whose protected destinations stay in the default zone.
+    leased::classification(program, scope, Kind::Platform)?;
+    for prefix in &scope.protection.prefixes {
+        for chain in ["raw_in", "raw_out"] {
+            let mut expressions = ipv4();
+            expressions.extend(current_address(prefix, false)?);
+            program.end(chain, expressions, -5)?;
         }
+        let mut expressions = ipv4();
+        expressions.extend(current_address(prefix, true)?);
+        program.end("raw_return", expressions, 0)?;
     }
+    leased::classification(program, scope, Kind::Public)?;
     program.end("raw_return", vec![], 0)
 }
-fn original_states(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
-    for (index, allocation) in scope.generations.iter().enumerate() {
-        for protocol in ["tcp", "udp"] {
-            if !allocation
-                .grants
-                .iter()
-                .any(|grant| grant.protocol == protocol)
-            {
-                continue;
-            }
-            let chain = format!("original_{index}_{protocol}");
-            program.chain(&chain, None)?;
-            // Only exact tuple/link/zone/direction classifiers jump here. Share
-            // state checks instead of repeating those classifiers three times.
-            for connection_state in [2, 8] {
-                let mut labelled = ct(13, None, label(allocation));
-                labelled.extend(state(connection_state));
-                if connection_state == 8 && protocol == "tcp" {
-                    labelled.extend(opening_tcp());
-                }
-                program.end(&chain, labelled, 1)?;
-            }
-            let mut fresh = state(8);
-            fresh.extend(ct(13, None, vec![0; 16]));
-            if protocol == "tcp" {
-                fresh.extend(opening_tcp());
-            }
-            fresh.extend(set_ct(13, label(allocation)));
-            program.end(&chain, fresh, 1)?;
-            // A failed state/label match returns to the caller's remaining
-            // classifiers and terminal denials, exactly as the inlined rules.
-        }
-    }
-    Ok(())
-}
-fn grants(
-    program: &mut Program<'_>,
-    scope: &RouterScope,
-    chain: &str,
-    platform: bool,
-) -> Result<()> {
-    for (index, allocation) in scope.generations.iter().enumerate() {
-        for grant in &allocation.grants {
-            if matches!(grant.destination, Destination::Platform { .. }) != platform {
-                continue;
-            }
-            let local = grant.source_endpoint.is_none();
-            if chain == "forward" && local || chain != "forward" && !local {
-                continue;
-            }
-            if chain != "input" {
-                let mut original = filter(scope, grant, false)?;
-                original.extend(generation(allocation, 0, false));
-                // Current and original tuples remain checked on every packet;
-                // a label alone never authorizes a changed grant or endpoint.
-                program.jump(
-                    chain,
-                    original,
-                    &format!("original_{index}_{}", grant.protocol),
-                )?;
-            }
-            if chain != "output" {
-                let mut reply = filter(scope, grant, true)?;
-                reply.extend(generation(allocation, 1, true));
-                reply.extend(state(2));
-                program.end(chain, reply, 1)?;
-            }
-        }
-    }
-    Ok(())
-}
-pub(super) fn compile(program: &mut Program<'_>, scope: &RouterScope, revision: u64) -> Result<()> {
+pub(super) fn compile(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
     for (name, hook, priority, kind) in [
         ("raw_in", 0, -300, "filter"),
         ("raw_out", 3, -300, "filter"),
@@ -358,37 +144,24 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &RouterScope, revision:
     if !scope.published_ports.is_empty() {
         // Published destination NAT lives in this table's own prerouting chain, so
         // it is created, replaced and deleted with the exact generation. An empty
-        // publication list keeps the previous chain set and compiled bytes.
+        // publication list keeps the previous chain set.
         program.chain("pre", Some((0, -100, "nat")))?;
     }
     for name in ["raw_return", "protected_out", "protected_back"] {
         program.chain(name, None)?;
     }
+    let hop = hop(scope)?;
+    published::sets(program, &hop, true)?;
     host_grant_sets(program, scope)?;
     workloadgrant::sets(program, scope)?;
-    let private = policy::Policy {
-        schema_version: 1,
-        revision,
-        endpoints: scope.endpoints.clone(),
-        rules: scope.rules.clone(),
-    }
-    .prepare()?;
-    for (name, rules) in private.guard_chains()? {
-        program.chain(&name, None)?;
-        for expressions in rules {
-            program.rule(&name, expressions)?;
-        }
-    }
-    original_states(program, scope)?;
-    raw(program, scope)?;
+    private::sets(program, scope)?;
+    leased::sets(program, scope)?;
+    raw(program, scope, &hop)?;
     protected(program, "protected_out", scope, false)?;
     protected(program, "protected_back", scope, true)?;
-    published_translation(program, scope)?;
+    published::translations(program, &hop)?;
     for chain in ["input", "forward", "output"] {
-        let parts = private.filter_rules(chain)?;
-        for expressions in parts.guards {
-            program.rule(chain, expressions)?;
-        }
+        private::guards(program, scope, chain)?;
         // Published admission keeps the private anti-spoof guards ahead of it and
         // precedes the capture barrier: the barrier denies every protected original
         // destination, which includes this transit address, and an exact inbound
@@ -396,14 +169,12 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &RouterScope, revision:
         // Host grants take the same position for the same reason: the barrier
         // denies the host's protected transit address in both directions.
         if chain == "forward" {
-            published_admissions(program, scope)?;
+            published::inbound(program, &hop)?;
             host_grant_admissions(program, scope)?;
             workloadgrant::admissions(program, scope)?;
         }
-        for expressions in parts.grants {
-            program.rule(chain, expressions)?;
-        }
-        grants(program, scope, chain, true)?;
+        private::grants(program, scope, chain)?;
+        leased::admissions(program, scope, chain, Kind::Platform)?;
         for incoming in [true, false] {
             if chain == "input" && !incoming || chain == "output" && incoming {
                 continue;
@@ -418,10 +189,14 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &RouterScope, revision:
                 },
             )?;
         }
-        grants(program, scope, chain, false)?;
-        for expressions in parts.denials {
-            program.rule(chain, expressions)?;
+        // Symmetric flows follow the capture barrier, so protected destinations
+        // stay denied; the endpoint classification already keeps them, and
+        // their replies, in the default zone.
+        if chain == "forward" {
+            published::symmetric(program, &hop)?;
         }
+        leased::admissions(program, scope, chain, Kind::Public)?;
+        private::denials(program, scope, chain)?;
         for incoming in [true, false] {
             if chain == "input" && !incoming || chain == "output" && incoming {
                 continue;
@@ -429,16 +204,8 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &RouterScope, revision:
             program.deny_link(chain, &scope.handoff, incoming)?;
         }
     }
-    for allocation in &scope.generations {
-        for grant in &allocation.grants {
-            let mut expressions = filter(scope, grant, false)?;
-            expressions.extend(generation(allocation, 0, true));
-            expressions.extend(snat(
-                &allocation.transit_source_address,
-                Some((grant.source_port_range.first, grant.source_port_range.last)),
-            )?);
-            program.rule("post", expressions)?;
-        }
+    for kind in [Kind::Platform, Kind::Public] {
+        leased::translation(program, scope, kind)?;
     }
-    Ok(())
+    published::symmetric_translation(program, &hop)
 }

package/rust/src/egress.rs

@@ -99,9 +99,28 @@ pub struct Generation {
 pub struct RouterPublishedPort {
     pub protocol: String,
     pub transit_port: u16,
+    /// Last port of a published range starting at `transit_port`. A range keeps
+    /// every port: `endpoint_port` equals `transit_port`. Absent for one port.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub transit_port_end: Option<u16>,
     pub endpoint_port: u16,
     pub endpoint_address: String,
     pub transit_source_address: String,
+    /// The workload may open flows from its published port(s), translated to
+    /// `transit_source_address` and the published port. Absent and false are the
+    /// same canonical policy.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub symmetric: bool,
+}
+impl RouterPublishedPort {
+    /// Last published transit port; equal to `transit_port` for one port.
+    pub fn transit_last(&self) -> u16 {
+        self.transit_port_end.unwrap_or(self.transit_port)
+    }
+    /// Last workload port the publication translates to.
+    pub fn endpoint_last(&self) -> u16 {
+        self.endpoint_port + (self.transit_last() - self.transit_port)
+    }
 }
 /// One exact host-origin flow: the node's own host network namespace dials one
 /// port of one local workload at its lease address, from the transit host
@@ -150,9 +169,28 @@ pub struct HostHandoff {
 pub struct PublishedPort {
     pub protocol: String,
     pub host_port: u16,
+    /// Last port of a published range starting at `host_port`. A range keeps
+    /// every port: `target_port` equals `host_port`. Absent for one port.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub host_port_end: Option<u16>,
     pub target_port: u16,
     pub target_address: String,
     pub host_ip: String,
+    /// Flows from `target_address` and the published target port(s) may leave
+    /// through the uplink, translated to `host_ip` and the published port. Absent
+    /// and false are the same canonical policy.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub symmetric: bool,
+}
+impl PublishedPort {
+    /// Last published uplink port; equal to `host_port` for one port.
+    pub fn host_last(&self) -> u16 {
+        self.host_port_end.unwrap_or(self.host_port)
+    }
+    /// Last transit port the publication translates to.
+    pub fn target_last(&self) -> u16 {
+        self.target_port + (self.host_last() - self.host_port)
+    }
 }
 #[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
@@ -446,16 +484,19 @@ pub fn destination(grant: &Grant, protection: &Protection) -> Result<String> {
 /// with the leased outbound source ports translated to that same transit address.
 fn normalize_router_published(value: &mut RouterScope) -> Result<()> {
     let mut ports = std::mem::take(&mut value.published_ports);
-    require(ports.len() <= 64)?;
+    require(ports.len() <= PUBLISHED_PORTS)?;
     ports.sort();
     for (index, port) in ports.iter().enumerate() {
         require(
             protocol(&port.protocol)
                 && port.transit_port > 0
                 && port.endpoint_port > 0
+                && published_span(port.transit_port, port.transit_port_end, port.endpoint_port)
+                // Sorted by protocol and first port, so disjoint neighbours are
+                // disjoint spans: one protocol/port is published exactly once.
                 && (index == 0
                     || ports[index - 1].protocol != port.protocol
-                    || ports[index - 1].transit_port != port.transit_port),
+                    || ports[index - 1].transit_last() < port.transit_port),
         )?;
         // rtnetlink verifies this exact handoff address at apply, recovery and
         // inspection, and only a current leased transit source address receives a
@@ -511,15 +552,47 @@ fn normalize_router_published(value: &mut RouterScope) -> Result<()> {
                 // port inside a leased outbound range is a translation conflict.
                 require(
                     range.protocol != port.protocol
-                        || port.transit_port < range.first
+                        || port.transit_last() < range.first
                         || port.transit_port > range.last,
                 )?;
             }
         }
     }
+    // A symmetric publication translates its workload's own flows back to its
+    // published ports, so its workload ports belong to it alone.
+    exclusive_symmetric(ports.iter().map(|port| {
+        (
+            port.symmetric,
+            (&port.protocol, &port.endpoint_address),
+            (port.endpoint_port, port.endpoint_last()),
+        )
+    }))?;
     value.published_ports = ports;
     Ok(())
 }
+/// One published port, or a range `first..=end` that keeps every port. The range
+/// is strictly ascending: one port has exactly one canonical form, without an end.
+fn published_span(first: u16, end: Option<u16>, inside: u16) -> bool {
+    end.is_none_or(|end| end > first && inside == first)
+}
+/// A symmetric publication's inside span may not overlap the inside span of any
+/// other publication of the same protocol and address, or its workload's flows
+/// would have two published sources.
+fn exclusive_symmetric<'a>(
+    spans: impl Iterator<Item = (bool, (&'a String, &'a String), (u16, u16))> + Clone,
+) -> Result<()> {
+    for (index, (symmetric, key, (first, last))) in spans.clone().enumerate() {
+        if !symmetric {
+            continue;
+        }
+        for (other, (_, other_key, (other_first, other_last))) in spans.clone().enumerate() {
+            require(
+                other == index || other_key != key || last < other_first || other_last < first,
+            )?;
+        }
+    }
+    Ok(())
+}
 /// Exact tuples only: one protocol, one unicast source and destination address
 /// and one destination port. Addresses never carry a prefix and ports never a
 /// range, so a grant cannot widen past its flow. `bound` checks the authority of
@@ -630,17 +703,25 @@ fn normalize_router_workload_grants(value: &mut RouterScope) -> Result<()> {
     value.workload_grants = grants;
     Ok(())
 }
+/// Router input bounds. Endpoints, rules and grants are set elements, so the
+/// graph budgets bind them, not the rule reserve: the node shape of 128
+/// workloads with local DNS, public egress and four platform endpoints each fits.
+pub const ROUTER_LINKS: usize = 128;
+pub const ROUTER_RULES: usize = 1024;
+pub const ROUTER_GRANTS: usize = 1024;
+/// Publications per scope; they are set elements on both hops.
+pub const PUBLISHED_PORTS: usize = 1024;
 fn normalize_router(value: &mut RouterScope, revision: u64) -> Result<()> {
-    require(value.links.len() <= 32 && value.generations.len() <= 32)?;
+    require(value.links.len() <= ROUTER_LINKS && value.generations.len() <= 32)?;
     let private = policy::Policy {
         schema_version: 1,
         revision,
         endpoints: value.endpoints.clone(),
         rules: value.rules.clone(),
     }
-    .prepare()?;
-    value.endpoints = private.policy.endpoints;
-    value.rules = private.policy.rules;
+    .normalize(ROUTER_LINKS, ROUTER_RULES)?;
+    value.endpoints = private.endpoints;
+    value.rules = private.rules;
     normalize_protection(&mut value.protection)?;
     normalize_link(&mut value.handoff)?;
     require(
@@ -725,7 +806,7 @@ fn normalize_router(value: &mut RouterScope, revision: u64) -> Result<()> {
                 && labels.insert(generation.conntrack_label.clone()),
         )?;
         count += generation.grants.len();
-        require(count <= 128)?;
+        require(count <= ROUTER_GRANTS)?;
         generation.grants.sort();
         for grant in &generation.grants {
             require(
@@ -903,16 +984,19 @@ fn normalize_host_host_grants(value: &mut HostScope) -> Result<()> {
 /// overlap with the leased outbound source ports translated to that same address.
 fn normalize_published(value: &mut HostScope) -> Result<()> {
     let mut ports = std::mem::take(&mut value.published_ports);
-    require(ports.len() <= 64)?;
+    require(ports.len() <= PUBLISHED_PORTS)?;
     ports.sort();
     for (index, port) in ports.iter().enumerate() {
         require(
             protocol(&port.protocol)
                 && port.host_port > 0
                 && port.target_port > 0
+                && published_span(port.host_port, port.host_port_end, port.target_port)
+                // Sorted by protocol and first port, so disjoint neighbours are
+                // disjoint spans: one protocol/port is published exactly once.
                 && (index == 0
                     || ports[index - 1].protocol != port.protocol
-                    || ports[index - 1].host_port != port.host_port),
+                    || ports[index - 1].host_last() < port.host_port),
         )?;
         // rtnetlink verifies this exact uplink address at apply, recovery and
         // inspection. No wildcard, secondary-link or default-route inference.
@@ -934,14 +1018,39 @@ fn normalize_published(value: &mut HostScope) -> Result<()> {
                         // port inside a leased outbound range is a translation conflict.
                         require(
                             range.protocol != port.protocol
-                                || port.host_port < range.first
+                                || port.host_last() < range.first
                                 || port.host_port > range.last,
                         )?;
                     }
                 }
             }
         }
+        if port.symmetric {
+            // The workload's flows leave from its target ports; a leased range of
+            // the same address would claim them for the outer leased translation.
+            for allocation in value
+                .handoffs
+                .iter()
+                .flat_map(|handoff| handoff.allocations.iter())
+                .filter(|allocation| allocation.transit_source_address == port.target_address)
+            {
+                for range in &allocation.source_port_ranges {
+                    require(
+                        range.protocol != port.protocol
+                            || port.target_last() < range.first
+                            || port.target_port > range.last,
+                    )?;
+                }
+            }
+        }
     }
+    exclusive_symmetric(ports.iter().map(|port| {
+        (
+            port.symmetric,
+            (&port.protocol, &port.target_address),
+            (port.target_port, port.target_last()),
+        )
+    }))?;
     value.published_ports = ports;
     Ok(())
 }
@@ -1062,6 +1171,12 @@ pub(crate) mod localplatform_tests;
 #[path = "egress_localport_tests.rs"]
 pub(crate) mod localport_tests;
 #[cfg(test)]
+#[path = "egress_publishedrange_tests.rs"]
+mod publishedrange_tests;
+#[cfg(test)]
+#[path = "egress_routerequivalence_tests.rs"]
+mod routerequivalence_tests;
+#[cfg(test)]
 #[path = "egress_tests.rs"]
 pub(crate) mod tests;
 #[cfg(test)]