@push.rocks/smartnftables 2.6.0 → 3.0.0

package/rust/src/egress_tests.rs

@@ -281,14 +281,10 @@ fn prepared_v2_compiles_both_scopes_with_bounded_and_identifiable_graphs() {
         prepared.validate().unwrap();
         let program = prepared.program("snft_v2_fixture").unwrap();
         assert!(program.len() <= 768);
-        assert!(
-            program
-                .iter()
-                .map(|(_, attributes)| crate::wire::encode_attrs(attributes).len() + 20)
-                .sum::<usize>()
-                <= 100_000
-        );
-        assert!(program.iter().all(|(kind, _)| [3, 6].contains(kind)));
+        let (_, rule_bytes, element_bytes) = cost(&prepared);
+        assert!(rule_bytes <= 100_000 && rule_bytes + element_bytes <= 212_000);
+        // Chains, rules, sets and their elements only.
+        assert!(program.iter().all(|(kind, _)| [3, 6, 9, 12].contains(kind)));
         let mut changed = prepared.clone();
         changed.policy.revision += 1;
         assert!(changed.validate().is_err());
@@ -366,17 +362,31 @@ fn combined_router_full_transports_and_protection_fit_atomic_reserve() {
 }
 
 #[test]
-fn v2_compiled_graph_limit_rejects_bounded_but_excessive_cross_products() {
-    let mut value = router();
-    let mut grants = Vec::new();
-    for port in 1000..1032 {
-        let mut grant = value["scope"]["generations"][0]["grants"][0].clone();
-        grant["destinationPort"] = json!(port);
-        grants.push(grant);
-    }
-    value["scope"]["generations"][0]["grants"] = json!(grants);
-    let policy = normalized(value).unwrap();
-    assert!(policy.prepare().is_err());
+fn v2_router_grants_are_elements_and_the_target_budget_rejects_excessive_ones() {
+    let grants = |count: u16| {
+        let mut value = router();
+        let template = value["scope"]["generations"][0]["grants"][0].clone();
+        value["scope"]["generations"][0]["grants"] = json!((0..count)
+            .map(|index| {
+                let mut grant = template.clone();
+                grant["destinationPort"] = json!(1000 + index);
+                grant
+            })
+            .collect::<Vec<_>>());
+        value
+    };
+    // The rule graph is the same for one grant and for 32; the elements carry them.
+    let rules = |value: Value| {
+        prepared(value)
+            .program("snft_v2_grants")
+            .unwrap()
+            .into_iter()
+            .filter(|(kind, _)| *kind == 6)
+            .count()
+    };
+    assert_eq!(rules(grants(1)), rules(grants(32)));
+    // Within the input bound, the elements still meet the atomic target budget.
+    assert!(normalized(grants(1024)).unwrap().prepare().is_err());
 }
 
 #[test]
@@ -516,6 +526,9 @@ fn graph(prepared: &Prepared, table: &str) -> (Vec<String>, Vec<(String, Vec<Str
             chains.push(crate::wire::text(&attributes, 3).unwrap());
             continue;
         }
+        if kind != 6 {
+            continue;
+        }
         let expressions = crate::wire::attrs(&crate::wire::one(&attributes, 4).unwrap().value).unwrap();
         rules.push((
             crate::wire::text(&attributes, 2).unwrap(),
@@ -575,27 +588,29 @@ fn host_v2_published_ports_compile_uplink_dnat_and_exact_forward_admission() {
     let (chains, rules) = graph(&published, "snft_v2_host_golden");
     assert_eq!(chains.len(), baseline.0.len() + 1);
     assert_eq!(chains.iter().filter(|name| *name == "pre").count(), 1);
-    assert_eq!(rules.len(), baseline.1.len() + 8);
+    // One map translation and four admissions whatever the number of
+    // publications: ESTABLISHED, a NEW opening per protocol and the reply.
+    assert_eq!(rules.len(), baseline.1.len() + 5);
     let translations: Vec<_> = rules.iter().filter(|(chain, _)| chain == "pre").collect();
-    assert_eq!(translations.len(), 2);
-    for (_, expressions) in &translations {
-        assert_eq!(expressions.last().unwrap(), "nat");
-        assert_eq!(expressions.iter().filter(|name| *name == "immediate").count(), 2);
+    assert_eq!(translations.len(), 1);
+    let (_, translation) = translations[0];
+    assert_eq!(translation.last().unwrap(), "nat");
+    assert!(translation.contains(&"lookup".to_string()));
+    assert!(!translation.contains(&"immediate".to_string()));
+    let forward: Vec<_> = rules.iter().filter(|(chain, _)| chain == "forward").collect();
+    assert_eq!(
+        forward.len(),
+        baseline.1.iter().filter(|(chain, _)| chain == "forward").count() + 4
+    );
+    // The admissions lead the forward chain, ahead of the capture barrier.
+    for (_, expressions) in &forward[..4] {
+        assert_eq!(expressions[expressions.len() - 2], "lookup");
     }
-    // The three admissions precede the capture barrier jumps of their handoff.
-    let forward: Vec<_> = rules
-        .iter()
-        .filter(|(chain, _)| chain == "forward")
-        .map(|(_, expressions)| expressions.len())
-        .collect();
-    assert_eq!(forward.len(), baseline.1.iter().filter(|(chain, _)| chain == "forward").count() + 6);
-    let (_, first) = rules.iter().find(|(chain, _)| chain == "forward").unwrap();
-    assert!(first.contains(&"ct".to_string()) && first.len() > 4);
     let bytes = program_bytes(&published, "snft_v2_host_golden");
-    assert_eq!(bytes.len(), 36322);
+    assert_eq!(bytes.len(), 30988);
     assert_eq!(
         format!("{:x}", Sha256::digest(&bytes)),
-        "1d3485bb739ac3601642610eba465b80c9b5ac34df22a5374cfbc8773623710b"
+        "b36f359c6439e9fcd77c291c7dac7854014225d3de1f8a4e49df6fec6ae570c4"
     );
 }
 
@@ -653,28 +668,39 @@ fn host_v2_published_ports_reject_unbound_targets_conflicts_and_out_of_range_por
         // One protocol/port is published exactly once, including across addresses.
         published_host(json!([published_port("tcp", 443, 8443), published_port("tcp", 443, 9443)])),
         duplicate_across_addresses,
-        published_host(json!((0..65).map(|index| published_port("tcp", 20000 + index, 8443)).collect::<Vec<_>>())),
+        published_host(json!((0..1025).map(|index| published_port("tcp", 20000 + index, 8443)).collect::<Vec<_>>())),
     ] {
         assert!(normalized(invalid).is_err());
     }
-    // Bounded input still meets the atomic reserve first: every publication costs
-    // one translation and three admissions, so prepare rejects before any kernel work.
+    // Publications are set elements: the input maximum compiles the same rules
+    // as one publication, and its elements fit their own budget.
     let ports = |count: u16| -> Value {
         json!((0..count)
             .map(|index| published_port("tcp", 20000 + index, 8443))
             .collect::<Vec<_>>())
     };
-    let prepared = prepared(published_host(ports(12)));
+    let one = graph(&prepared(published_host(ports(1))), "snft_v2_host_max");
+    let maximum = prepared(published_host(ports(64)));
+    let (_, rules) = graph(&maximum, "snft_v2_host_max");
+    assert_eq!(rules, one.1);
+    let (operations, rule_bytes, element_bytes) = cost(&maximum);
+    assert!(operations <= 768 && rule_bytes <= 100_000 && element_bytes <= 100_000);
+    println!("PUBLISHED_MAX ports=64 operations={operations} rule_bytes={rule_bytes} element_bytes={element_bytes}");
+}
+/// Operations, rule graph bytes and set element bytes at the longest table name,
+/// against the atomic graph reserve and the element budget.
+pub(crate) fn cost(prepared: &Prepared) -> (usize, usize, usize) {
     let program = prepared
         .program(&format!("snft_{}", "x".repeat(59)))
         .unwrap();
-    let bytes: usize = program
-        .iter()
-        .map(|(_, attributes)| crate::wire::encode_attrs(attributes).len() + 20)
-        .sum();
-    assert!(program.len() <= 768 && bytes <= 100_000);
-    assert!(normalized(published_host(ports(13))).unwrap().prepare().is_err());
-    println!("PUBLISHED_MAX ports=12 operations={} bytes={bytes}", program.len());
+    let bytes = |elements: bool| -> usize {
+        program
+            .iter()
+            .filter(|(kind, _)| (*kind == 12) == elements)
+            .map(|(_, attributes)| crate::wire::encode_attrs(attributes).len() + 20)
+            .sum()
+    };
+    (program.len(), bytes(false), bytes(true))
 }
 
 pub(crate) fn router_published_port(protocol: &str, transit_port: u16, endpoint_port: u16) -> Value {
@@ -696,11 +722,13 @@ fn router_v2_without_published_ports_keeps_its_exact_digest_and_compiled_bytes()
         baseline.digest,
         "sha256:762a556e0bf512b653acfcf86699ac7681f26e6cc9ea1d26671443e3d2ca0b61"
     );
+    // Re-frozen with the set-backed router graph of 3.0.0: the digest is the
+    // policy's and did not change, the compiled graph did.
     let bytes = program_bytes(&baseline, "snft_v2_router_golden");
-    assert_eq!(bytes.len(), 53272);
+    assert_eq!(bytes.len(), 47674);
     assert_eq!(
         format!("{:x}", Sha256::digest(&bytes)),
-        "66850722fbd38a45a986cebeddcc75a541ebb1e2f003ea4375621decb2e08f99"
+        "ea609865f32031f6835ef4fc7f67f5754a15f466580308bdccc9db87d4ccd2c5"
     );
     let serialized = serde_json::to_string(&baseline.policy).unwrap();
     assert!(!serialized.contains("publishedPorts"));
@@ -731,25 +759,18 @@ fn router_v2_published_ports_compile_handoff_dnat_classification_and_admission()
     let (chains, rules) = graph(&published, "snft_v2_router_golden");
     assert_eq!(chains.len(), baseline.0.len() + 1);
     assert_eq!(chains.iter().filter(|name| *name == "pre").count(), 1);
-    // Six rules per publication: one translation, one handoff ingress and one
-    // endpoint ingress classification, and the three forward admissions.
-    assert_eq!(rules.len(), baseline.1.len() + 12);
+    // Seven rules whatever the number of publications: one map translation, one
+    // handoff ingress and one endpoint ingress classification, and four
+    // admissions (ESTABLISHED, a NEW opening per protocol and the reply).
+    assert_eq!(rules.len(), baseline.1.len() + 7);
     let translations: Vec<_> = rules.iter().filter(|(chain, _)| chain == "pre").collect();
-    assert_eq!(translations.len(), 2);
-    for (_, expressions) in &translations {
-        assert_eq!(expressions.last().unwrap(), "nat");
-        assert_eq!(
-            expressions.iter().filter(|name| *name == "immediate").count(),
-            2
-        );
-    }
+    assert_eq!(translations.len(), 1);
+    assert_eq!(translations[0].1.last().unwrap(), "nat");
+    assert!(!translations[0].1.contains(&"immediate".to_string()));
     let counted = |graph: &Vec<(String, Vec<String>)>, chain: &str| {
         graph.iter().filter(|(name, _)| name == chain).count()
     };
-    assert_eq!(
-        counted(&rules, "forward"),
-        counted(&baseline.1, "forward") + 6
-    );
+    assert_eq!(counted(&rules, "forward"), counted(&baseline.1, "forward") + 4);
     // The classification leads the handoff ingress barrier, ahead of every denial
     // in it, and never touches conntrack because raw runs before it.
     let returns: Vec<_> = rules
@@ -757,11 +778,9 @@ fn router_v2_published_ports_compile_handoff_dnat_classification_and_admission()
         .filter(|(chain, _)| chain == "raw_return")
         .map(|(_, expressions)| expressions)
         .collect();
-    assert_eq!(returns.len(), counted(&baseline.1, "raw_return") + 2);
-    for expressions in &returns[..2] {
-        assert!(!expressions.contains(&"ct".to_string()));
-    }
-    assert!(returns[2..]
+    assert_eq!(returns.len(), counted(&baseline.1, "raw_return") + 1);
+    assert!(returns[0].contains(&"lookup".to_string()) && !returns[0].contains(&"ct".to_string()));
+    assert!(returns[1..]
         .iter()
         .any(|expressions| expressions.contains(&"ct".to_string())));
     assert_eq!(returns.last().unwrap().len(), 1);
@@ -772,18 +791,16 @@ fn router_v2_published_ports_compile_handoff_dnat_classification_and_admission()
         .filter(|(chain, _)| chain == "raw_in")
         .map(|(_, expressions)| expressions)
         .collect();
-    assert_eq!(incoming.len(), counted(&baseline.1, "raw_in") + 2);
-    for expressions in &incoming[3..5] {
-        assert!(!expressions.contains(&"ct".to_string()));
-    }
-    assert!(incoming[5..]
+    assert_eq!(incoming.len(), counted(&baseline.1, "raw_in") + 1);
+    assert!(incoming[3].contains(&"lookup".to_string()) && !incoming[3].contains(&"ct".to_string()));
+    assert!(incoming[4..]
         .iter()
         .any(|expressions| expressions.contains(&"ct".to_string())));
     let bytes = program_bytes(&published, "snft_v2_router_golden");
-    assert_eq!(bytes.len(), 67818);
+    assert_eq!(bytes.len(), 55494);
     assert_eq!(
         format!("{:x}", Sha256::digest(&bytes)),
-        "62bf0f5aace2a19fb8a92571d1c4d45d774aa003884c239e473c67a7e103bb12"
+        "60a7ba1c15d49e5ff54cfbf9fbe2d72f03973acd1a897eef2d975547ef4abf5b"
     );
 }
 
@@ -892,201 +909,86 @@ fn router_v2_published_ports_reject_unbound_endpoints_conflicts_and_out_of_range
             router_published_port("tcp", 443, 8443),
             router_published_port("tcp", 443, 9443)
         ])),
-        published_router(json!((0..65)
+        published_router(json!((0..1025)
             .map(|index| router_published_port("tcp", 20000 + index, 8443))
             .collect::<Vec<_>>())),
     ] {
         assert!(normalized(invalid).is_err());
     }
-    // Bounded input still meets the atomic reserve first: every publication costs
-    // six operations, so prepare rejects before any kernel work.
+    // Publications are set elements: the input maximum compiles the same rules
+    // as one publication, and its elements fit their own budget.
     let ports = |count: u16| -> Value {
         json!((0..count)
             .map(|index| router_published_port("tcp", 20000 + index, 8443))
             .collect::<Vec<_>>())
     };
-    let prepared = prepared(published_router(ports(5)));
-    let program = prepared
-        .program(&format!("snft_{}", "x".repeat(59)))
-        .unwrap();
-    let bytes: usize = program
-        .iter()
-        .map(|(_, attributes)| crate::wire::encode_attrs(attributes).len() + 20)
-        .sum();
-    assert!(program.len() <= 768 && bytes <= 100_000);
-    assert!(normalized(published_router(ports(6)))
-        .unwrap()
-        .prepare()
-        .is_err());
-    println!("ROUTER_PUBLISHED_MAX ports=5 operations={} bytes={bytes}", program.len());
-}
-
-/// One arriving IPv4 tuple for the ordered raw classifiers of a compiled chain.
-#[derive(Clone, Copy)]
-struct Arrival {
-    interface_index: u32,
-    interface_name: &'static str,
-    protocol: u8,
-    source: [u8; 4],
-    destination: [u8; 4],
-    source_port: u16,
-    destination_port: u16,
-}
-/// Walks one compiled chain in program order and reports the first rule that
-/// matches an arriving tuple as (position, verdict, conntrack zone it sets). Raw
-/// prerouting classification is the only hook this covers, so an unexpected
-/// expression panics instead of being silently ignored.
-fn classify(prepared: &Prepared, chain: &str, arrival: &Arrival) -> Option<(usize, i32, u16)> {
-    let table = "snft_v2_router_order";
-    let mut position = 0;
-    for (kind, attributes) in prepared.program(table).unwrap() {
-        if kind == 3 || crate::wire::text(&attributes, 2).unwrap() != chain {
-            continue;
-        }
-        let index = position;
-        position += 1;
-        let mut pending: Option<Vec<u8>> = None;
-        let mut immediate: Option<Vec<u8>> = None;
-        let mut verdict = 0;
-        let mut zone = 0;
-        let mut matched = true;
-        for expression in
-            crate::wire::attrs(&crate::wire::one(&attributes, 4).unwrap().value).unwrap()
-        {
-            let fields = crate::wire::attrs(&expression.value).unwrap();
-            let data = crate::wire::attrs(&crate::wire::one(&fields, 2).unwrap().value).unwrap();
-            match crate::wire::text(&fields, 1).unwrap().as_str() {
-                "meta" => {
-                    pending = Some(match crate::wire::number(&data, 2).unwrap() {
-                        4 => arrival.interface_index.to_ne_bytes().to_vec(),
-                        6 => [arrival.interface_name.as_bytes(), &[0]].concat(),
-                        15 => vec![libc::NFPROTO_IPV4 as u8],
-                        16 => vec![arrival.protocol],
-                        key => panic!("meta {key}"),
-                    })
-                }
-                "payload" => {
-                    pending = Some(
-                        match (
-                            crate::wire::number(&data, 2).unwrap(),
-                            crate::wire::number(&data, 3).unwrap(),
-                        ) {
-                            (1, 12) => arrival.source.to_vec(),
-                            (1, 16) => arrival.destination.to_vec(),
-                            (2, 0) => arrival.source_port.to_be_bytes().to_vec(),
-                            (2, 2) => arrival.destination_port.to_be_bytes().to_vec(),
-                            load => panic!("payload {load:?}"),
-                        },
-                    )
-                }
-                "bitwise" => {
-                    let mask = crate::wire::attrs(&crate::wire::one(&data, 4).unwrap().value)
-                        .unwrap()[0]
-                        .value
-                        .clone();
-                    let loaded = pending.take().unwrap();
-                    pending = Some(
-                        loaded
-                            .iter()
-                            .zip(&mask)
-                            .map(|(byte, mask)| byte & mask)
-                            .collect(),
-                    );
-                }
-                "cmp" => {
-                    assert_eq!(crate::wire::number(&data, 2).unwrap(), 0);
-                    let expected = crate::wire::attrs(&crate::wire::one(&data, 3).unwrap().value)
-                        .unwrap()[0]
-                        .value
-                        .clone();
-                    matched = pending.take().unwrap() == expected;
-                }
-                "ct" => {
-                    // Only the zone store reaches raw classification; a loaded
-                    // conntrack key would need a conntrack lookup that has not run.
-                    assert_eq!(crate::wire::number(&data, 2).unwrap(), 17);
-                    assert_eq!(crate::wire::number(&data, 4).unwrap(), 1);
-                    zone = u16::from_ne_bytes(immediate.take().unwrap().try_into().unwrap());
-                }
-                "immediate" => {
-                    let inner =
-                        crate::wire::attrs(&crate::wire::one(&data, 2).unwrap().value).unwrap();
-                    if crate::wire::number(&data, 1).unwrap() == 0 {
-                        let code = crate::wire::attrs(&crate::wire::one(&inner, 2).unwrap().value)
-                            .unwrap();
-                        verdict = crate::wire::number(&code, 1).unwrap() as i32;
-                    } else {
-                        immediate = Some(crate::wire::one(&inner, 1).unwrap().value.clone());
-                    }
-                }
-                other => panic!("{other}"),
-            }
-            if !matched {
-                break;
-            }
-        }
-        if matched {
-            return Some((index, verdict, zone));
-        }
-    }
-    None
+    let one = graph(&prepared(published_router(ports(1))), "snft_v2_router_max");
+    let maximum = prepared(published_router(ports(64)));
+    let (_, rules) = graph(&maximum, "snft_v2_router_max");
+    assert_eq!(rules, one.1);
+    let (operations, rule_bytes, element_bytes) = cost(&maximum);
+    assert!(operations <= 768 && rule_bytes <= 100_000 && element_bytes <= 100_000);
+    println!("ROUTER_PUBLISHED_MAX ports=64 operations={operations} rule_bytes={rule_bytes} element_bytes={element_bytes}");
 }
 
 #[test]
 fn router_v2_published_endpoint_traffic_is_classified_before_the_leased_grants() {
+    use super::hostgrant_tests::{decide, Flow, ESTABLISHED};
     // A published reply to a client whose source port equals the leased grant's
     // destination port on its public prefix. Raw runs before conntrack, so only
     // the payload tuple separates it from ordinary leased egress.
-    let reply = Arrival {
-        interface_index: 2,
-        interface_name: "work",
+    let reply = Flow {
+        input: Some((2, "work")),
+        output: None,
         protocol: 6,
         source: [10, 241, 0, 2],
         destination: [198, 51, 100, 7],
         source_port: 9443,
         destination_port: 443,
+        tcp_flags: 0x10,
+        state: ESTABLISHED,
+        reply: true,
+        zone: 0,
+        original: ([198, 51, 100, 7], [10, 240, 0, 2], 443, 443),
+        uid: None,
+        label: [0; 16],
     };
     // Without the publication that exact tuple is leased into the generation zone,
-    // so the ordering below is what keeps the publication usable at all.
-    let leased = classify(&prepared(router()), "raw_in", &reply).unwrap();
-    assert_eq!((leased.1, leased.2), (1, 1));
+    // so the precedence below is what keeps the publication usable at all.
+    let baseline = prepared(router());
+    let leased = decide(&baseline, "raw_in", &reply);
+    assert_eq!((leased.verdict, leased.zone), (1, 1));
     let published = prepared(published_router(json!([router_published_port(
         "tcp", 443, 9443
     )])));
-    let (index, verdict, zone) = classify(&published, "raw_in", &reply).unwrap();
     // Accepted with no zone set: the reply stays in the default zone, where the
     // translated publication and its admission live.
-    assert_eq!((verdict, zone), (1, 0));
-    // Every other workload flow keeps its leased classification, and the leased
-    // classifier that claims the tuple above is reached only after this one.
-    let (leased_index, leased_verdict, leased_zone) = classify(
-        &published,
-        "raw_in",
-        &Arrival {
+    let classified = decide(&published, "raw_in", &reply);
+    assert_eq!((classified.verdict, classified.zone), (1, 0));
+    // Every other workload flow keeps its leased classification, and the
+    // classification is exact: another link, another workload address and
+    // another protocol meet exactly the decision the unpublished scope makes.
+    for foreign in [
+        Flow {
             source_port: 50000,
             ..reply
         },
-    )
-    .unwrap();
-    assert_eq!((leased_verdict, leased_zone), (1, 1));
-    assert!(index < leased_index, "{index} {leased_index}");
-    // The classification is exact: another link, another workload address and
-    // another protocol are not published and are not classified here.
-    for foreign in [
-        Arrival {
-            interface_index: 3,
-            interface_name: "vpn",
+        Flow {
+            input: Some((3, "vpn")),
             ..reply
         },
-        Arrival {
+        Flow {
             source: [10, 241, 0, 3],
             ..reply
         },
-        Arrival {
+        Flow {
             protocol: 17,
             ..reply
         },
     ] {
-        assert!(classify(&published, "raw_in", &foreign).is_none());
+        assert_eq!(
+            decide(&published, "raw_in", &foreign),
+            decide(&baseline, "raw_in", &foreign)
+        );
     }
 }

package/rust/src/egress_workloadgrant_tests.rs

@@ -297,18 +297,17 @@ fn workload_grants_meet_the_atomic_reserve_at_the_contract_maximum() {
             .sum()
     };
     let (graph, elements) = (size(&[3, 6, 9]), size(&[12]));
-    assert!(program.len() < 768 && graph <= 100_000 && elements <= super::compile::ELEMENT_BYTES);
+    assert!(program.len() < 768 && graph <= super::compile::RULE_BYTES && graph + elements <= super::compile::TARGET_BYTES);
     assert!(deletion + graph + elements + 64 <= wire::BATCH_BYTES);
     println!(
         "WORKLOAD_GRANT_MAX grants=1024 operations={} rule_bytes={graph} element_bytes={elements}",
         program.len()
     );
-    // Host grants and workload grants share one element budget per target:
-    // half the host grant maximum fits beside the workload maximum, both maxima
-    // together are refused before any kernel work.
+    // Host grants and workload grants share the target budget with the rest of
+    // the scope's elements; both maxima together fit it.
     let mut both = granted(two_workloads(), json!(maximum));
-    both["scope"]["hostGrants"] = many(512);
-    normalized(both.clone()).unwrap().prepare().unwrap();
     both["scope"]["hostGrants"] = many(1024);
-    assert!(normalized(both).unwrap().prepare().is_err());
+    let both = normalized(both).unwrap().prepare().unwrap();
+    let (operations, rule_bytes, element_bytes) = super::tests::cost(&both);
+    assert!(operations < 768 && rule_bytes + element_bytes <= super::compile::TARGET_BYTES);
 }

package/rust/src/owner.rs

@@ -680,7 +680,8 @@ fn chain_identity(attributes: &[Attr]) -> Result<Vec<u8>> {
     }
     serde_json::to_vec(&wire::canonical(&identity, false)?).map_err(|_| Error::Protocol)
 }
-/// A set is its table, name, flags, key type and key length. The handle, the
+/// A set is its table, name, flags, key type and key length, a map's data type
+/// and length, and the field lengths of a concatenation. The handle, the
 /// informational backend type and count, the transaction ID and an empty
 /// description are not identity; anything else rejects.
 fn set_identity(attributes: &[Attr]) -> Result<Vec<u8>> {
@@ -688,30 +689,78 @@ fn set_identity(attributes: &[Attr]) -> Result<Vec<u8>> {
     for attribute in attributes {
         match attribute.id() {
             10 | 16 | 19 | 20 => {}
-            9 if wire::attrs(&attribute.value)?.is_empty() => {}
-            1..=5 => identity.push(attribute.clone()),
+            9 => {
+                if let Some(fields) = concatenation(&attribute.value)? {
+                    identity.push(Attr::bytes(9, fields));
+                }
+            }
+            1..=7 => identity.push(attribute.clone()),
             _ => return Err(Error::Conflict),
         }
     }
     for id in [1, 2, 3, 4, 5] {
         wire::one(&identity, id)?;
     }
+    // A map carries its data type and length, and nothing else does.
+    let map = wire::number(&identity, 3)? & 8 != 0;
+    for id in [6, 7] {
+        if wire::one(&identity, id).is_ok() != map {
+            return Err(Error::Conflict);
+        }
+    }
     serde_json::to_vec(&wire::canonical(&identity, false)?).map_err(|_| Error::Protocol)
 }
-/// Only plain keys: an element with data, flags, timeouts, expressions or any
-/// other extension is not one the compiler created.
+/// The field lengths of a set description: only a concatenation, never a size.
+/// An empty description is none.
+fn concatenation(value: &[u8]) -> Result<Option<Vec<u8>>> {
+    let description = wire::attrs(value)?;
+    if description.is_empty() {
+        return Ok(None);
+    }
+    if description.len() != 1 || description[0].id() != 2 {
+        return Err(Error::Conflict);
+    }
+    let mut lengths = Vec::new();
+    for field in wire::attrs(&description[0].value)? {
+        let length = wire::attrs(&field.value)?;
+        if field.id() != 1 || length.len() != 1 {
+            return Err(Error::Conflict);
+        }
+        lengths.extend(wire::number(&length, 1)?.to_be_bytes());
+    }
+    Ok(Some(lengths))
+}
+/// Only compiler elements: a key, the last key of an interval and a map's data.
+/// Flags, timeouts, expressions or any other extension reject. The identity is
+/// the three values, so any changed bound or datum is a changed element.
 fn element_keys(list: &[Attr]) -> Result<Vec<Vec<u8>>> {
     let mut keys = Vec::new();
     for element in list {
-        let fields = wire::attrs(&element.value)?;
-        if element.id() != 1 || fields.len() != 1 {
+        if element.id() != 1 {
             return Err(Error::Conflict);
         }
-        let key = wire::attrs(&wire::one(&fields, 1)?.value)?;
-        if key.len() != 1 {
-            return Err(Error::Conflict);
+        let mut values: [Option<Vec<u8>>; 3] = [None, None, None];
+        for field in wire::attrs(&element.value)? {
+            let slot = match field.id() {
+                1 => 0,
+                10 => 1,
+                2 => 2,
+                _ => return Err(Error::Conflict),
+            };
+            let value = wire::attrs(&field.value)?;
+            if value.len() != 1 || values[slot].is_some() {
+                return Err(Error::Conflict);
+            }
+            values[slot] = Some(wire::one(&value, 1)?.value.clone());
         }
-        keys.push(wire::one(&key, 1)?.value.clone());
+        let [Some(key), last, data] = values else {
+            return Err(Error::Conflict);
+        };
+        keys.push(if last.is_none() && data.is_none() {
+            key
+        } else {
+            serde_json::to_vec(&(key, last, data)).map_err(|_| Error::Protocol)?
+        });
     }
     Ok(keys)
 }
@@ -772,7 +821,7 @@ fn rule_identity(attributes: &[Attr]) -> Result<(String, Vec<u8>)> {
 /// neither unknown fields nor default repair may hide a changed kernel rule.
 fn validate_egress_expression(name: &str, data: &[Attr]) -> Result<()> {
     let allowed: &[u16] = match name {
-        "lookup" => &[1, 2, 5],
+        "lookup" => &[1, 2, 3, 5],
         "ct" | "range" => &[1, 2, 3, 4],
         "nat" => &[1, 2, 3, 4, 5, 6, 7],
         "reject" => &[1],
@@ -786,10 +835,16 @@ fn validate_egress_expression(name: &str, data: &[Attr]) -> Result<()> {
     }
     match name {
         "lookup" => {
-            // A plain membership test of a named set: no map, no inversion.
+            // A membership or absence test of a named set, or a map lookup into
+            // a data register, which is never inverted.
             wire::text(data, 1)?;
             wire::number(data, 2)?;
-            if data.len() != 3 || wire::number(data, 5)? != 0 {
+            let map = wire::one(data, 3).is_ok();
+            if map {
+                wire::number(data, 3)?;
+            }
+            let flags = wire::number(data, 5)?;
+            if data.len() != 3 + usize::from(map) || flags > 1 || map && flags != 0 {
                 return Err(Error::Conflict);
             }
         }