@push.rocks/smartnftables 2.6.0 → 4.0.0

package/rust/src/egress_tests.rs

@@ -281,14 +281,10 @@ fn prepared_v2_compiles_both_scopes_with_bounded_and_identifiable_graphs() {
         prepared.validate().unwrap();
         let program = prepared.program("snft_v2_fixture").unwrap();
         assert!(program.len() <= 768);
-        assert!(
-            program
-                .iter()
-                .map(|(_, attributes)| crate::wire::encode_attrs(attributes).len() + 20)
-                .sum::<usize>()
-                <= 100_000
-        );
-        assert!(program.iter().all(|(kind, _)| [3, 6].contains(kind)));
+        let (_, rule_bytes, element_bytes) = cost(&prepared);
+        assert!(rule_bytes <= 100_000 && rule_bytes + element_bytes <= 212_000);
+        // Chains, rules, sets and their elements only.
+        assert!(program.iter().all(|(kind, _)| [3, 6, 9, 12].contains(kind)));
         let mut changed = prepared.clone();
         changed.policy.revision += 1;
         assert!(changed.validate().is_err());
@@ -366,17 +362,31 @@ fn combined_router_full_transports_and_protection_fit_atomic_reserve() {
 }
 
 #[test]
-fn v2_compiled_graph_limit_rejects_bounded_but_excessive_cross_products() {
-    let mut value = router();
-    let mut grants = Vec::new();
-    for port in 1000..1032 {
-        let mut grant = value["scope"]["generations"][0]["grants"][0].clone();
-        grant["destinationPort"] = json!(port);
-        grants.push(grant);
-    }
-    value["scope"]["generations"][0]["grants"] = json!(grants);
-    let policy = normalized(value).unwrap();
-    assert!(policy.prepare().is_err());
+fn v2_router_grants_are_elements_and_the_target_budget_rejects_excessive_ones() {
+    let grants = |count: u16| {
+        let mut value = router();
+        let template = value["scope"]["generations"][0]["grants"][0].clone();
+        value["scope"]["generations"][0]["grants"] = json!((0..count)
+            .map(|index| {
+                let mut grant = template.clone();
+                grant["destinationPort"] = json!(1000 + index);
+                grant
+            })
+            .collect::<Vec<_>>());
+        value
+    };
+    // The rule graph is the same for one grant and for 32; the elements carry them.
+    let rules = |value: Value| {
+        prepared(value)
+            .program("snft_v2_grants")
+            .unwrap()
+            .into_iter()
+            .filter(|(kind, _)| *kind == 6)
+            .count()
+    };
+    assert_eq!(rules(grants(1)), rules(grants(32)));
+    // Within the input bound, the elements still meet the atomic target budget.
+    assert!(normalized(grants(1024)).unwrap().prepare().is_err());
 }
 
 #[test]
@@ -516,6 +526,9 @@ fn graph(prepared: &Prepared, table: &str) -> (Vec<String>, Vec<(String, Vec<Str
             chains.push(crate::wire::text(&attributes, 3).unwrap());
             continue;
         }
+        if kind != 6 {
+            continue;
+        }
         let expressions = crate::wire::attrs(&crate::wire::one(&attributes, 4).unwrap().value).unwrap();
         rules.push((
             crate::wire::text(&attributes, 2).unwrap(),
@@ -575,27 +588,29 @@ fn host_v2_published_ports_compile_uplink_dnat_and_exact_forward_admission() {
     let (chains, rules) = graph(&published, "snft_v2_host_golden");
     assert_eq!(chains.len(), baseline.0.len() + 1);
     assert_eq!(chains.iter().filter(|name| *name == "pre").count(), 1);
-    assert_eq!(rules.len(), baseline.1.len() + 8);
+    // One map translation and four admissions whatever the number of
+    // publications: ESTABLISHED, a NEW opening per protocol and the reply.
+    assert_eq!(rules.len(), baseline.1.len() + 5);
     let translations: Vec<_> = rules.iter().filter(|(chain, _)| chain == "pre").collect();
-    assert_eq!(translations.len(), 2);
-    for (_, expressions) in &translations {
-        assert_eq!(expressions.last().unwrap(), "nat");
-        assert_eq!(expressions.iter().filter(|name| *name == "immediate").count(), 2);
+    assert_eq!(translations.len(), 1);
+    let (_, translation) = translations[0];
+    assert_eq!(translation.last().unwrap(), "nat");
+    assert!(translation.contains(&"lookup".to_string()));
+    assert!(!translation.contains(&"immediate".to_string()));
+    let forward: Vec<_> = rules.iter().filter(|(chain, _)| chain == "forward").collect();
+    assert_eq!(
+        forward.len(),
+        baseline.1.iter().filter(|(chain, _)| chain == "forward").count() + 4
+    );
+    // The admissions lead the forward chain, ahead of the capture barrier.
+    for (_, expressions) in &forward[..4] {
+        assert_eq!(expressions[expressions.len() - 2], "lookup");
     }
-    // The three admissions precede the capture barrier jumps of their handoff.
-    let forward: Vec<_> = rules
-        .iter()
-        .filter(|(chain, _)| chain == "forward")
-        .map(|(_, expressions)| expressions.len())
-        .collect();
-    assert_eq!(forward.len(), baseline.1.iter().filter(|(chain, _)| chain == "forward").count() + 6);
-    let (_, first) = rules.iter().find(|(chain, _)| chain == "forward").unwrap();
-    assert!(first.contains(&"ct".to_string()) && first.len() > 4);
     let bytes = program_bytes(&published, "snft_v2_host_golden");
-    assert_eq!(bytes.len(), 36322);
+    assert_eq!(bytes.len(), 30988);
     assert_eq!(
         format!("{:x}", Sha256::digest(&bytes)),
-        "1d3485bb739ac3601642610eba465b80c9b5ac34df22a5374cfbc8773623710b"
+        "b36f359c6439e9fcd77c291c7dac7854014225d3de1f8a4e49df6fec6ae570c4"
     );
 }
 
@@ -653,28 +668,39 @@ fn host_v2_published_ports_reject_unbound_targets_conflicts_and_out_of_range_por
         // One protocol/port is published exactly once, including across addresses.
         published_host(json!([published_port("tcp", 443, 8443), published_port("tcp", 443, 9443)])),
         duplicate_across_addresses,
-        published_host(json!((0..65).map(|index| published_port("tcp", 20000 + index, 8443)).collect::<Vec<_>>())),
+        published_host(json!((0..1025).map(|index| published_port("tcp", 20000 + index, 8443)).collect::<Vec<_>>())),
     ] {
         assert!(normalized(invalid).is_err());
     }
-    // Bounded input still meets the atomic reserve first: every publication costs
-    // one translation and three admissions, so prepare rejects before any kernel work.
+    // Publications are set elements: the input maximum compiles the same rules
+    // as one publication, and its elements fit their own budget.
     let ports = |count: u16| -> Value {
         json!((0..count)
             .map(|index| published_port("tcp", 20000 + index, 8443))
             .collect::<Vec<_>>())
     };
-    let prepared = prepared(published_host(ports(12)));
+    let one = graph(&prepared(published_host(ports(1))), "snft_v2_host_max");
+    let maximum = prepared(published_host(ports(64)));
+    let (_, rules) = graph(&maximum, "snft_v2_host_max");
+    assert_eq!(rules, one.1);
+    let (operations, rule_bytes, element_bytes) = cost(&maximum);
+    assert!(operations <= 768 && rule_bytes <= 100_000 && element_bytes <= 100_000);
+    println!("PUBLISHED_MAX ports=64 operations={operations} rule_bytes={rule_bytes} element_bytes={element_bytes}");
+}
+/// Operations, rule graph bytes and set element bytes at the longest table name,
+/// against the atomic graph reserve and the element budget.
+pub(crate) fn cost(prepared: &Prepared) -> (usize, usize, usize) {
     let program = prepared
         .program(&format!("snft_{}", "x".repeat(59)))
         .unwrap();
-    let bytes: usize = program
-        .iter()
-        .map(|(_, attributes)| crate::wire::encode_attrs(attributes).len() + 20)
-        .sum();
-    assert!(program.len() <= 768 && bytes <= 100_000);
-    assert!(normalized(published_host(ports(13))).unwrap().prepare().is_err());
-    println!("PUBLISHED_MAX ports=12 operations={} bytes={bytes}", program.len());
+    let bytes = |elements: bool| -> usize {
+        program
+            .iter()
+            .filter(|(kind, _)| (*kind == 12) == elements)
+            .map(|(_, attributes)| crate::wire::encode_attrs(attributes).len() + 20)
+            .sum()
+    };
+    (program.len(), bytes(false), bytes(true))
 }
 
 pub(crate) fn router_published_port(protocol: &str, transit_port: u16, endpoint_port: u16) -> Value {
@@ -696,11 +722,13 @@ fn router_v2_without_published_ports_keeps_its_exact_digest_and_compiled_bytes()
         baseline.digest,
         "sha256:762a556e0bf512b653acfcf86699ac7681f26e6cc9ea1d26671443e3d2ca0b61"
     );
+    // Re-frozen with the set-backed router graph of 3.0.0: the digest is the
+    // policy's and did not change, the compiled graph did.
     let bytes = program_bytes(&baseline, "snft_v2_router_golden");
-    assert_eq!(bytes.len(), 53272);
+    assert_eq!(bytes.len(), 47674);
     assert_eq!(
         format!("{:x}", Sha256::digest(&bytes)),
-        "66850722fbd38a45a986cebeddcc75a541ebb1e2f003ea4375621decb2e08f99"
+        "ea609865f32031f6835ef4fc7f67f5754a15f466580308bdccc9db87d4ccd2c5"
     );
     let serialized = serde_json::to_string(&baseline.policy).unwrap();
     assert!(!serialized.contains("publishedPorts"));
@@ -731,25 +759,18 @@ fn router_v2_published_ports_compile_handoff_dnat_classification_and_admission()
     let (chains, rules) = graph(&published, "snft_v2_router_golden");
     assert_eq!(chains.len(), baseline.0.len() + 1);
     assert_eq!(chains.iter().filter(|name| *name == "pre").count(), 1);
-    // Six rules per publication: one translation, one handoff ingress and one
-    // endpoint ingress classification, and the three forward admissions.
-    assert_eq!(rules.len(), baseline.1.len() + 12);
+    // Seven rules whatever the number of publications: one map translation, one
+    // handoff ingress and one endpoint ingress classification, and four
+    // admissions (ESTABLISHED, a NEW opening per protocol and the reply).
+    assert_eq!(rules.len(), baseline.1.len() + 7);
     let translations: Vec<_> = rules.iter().filter(|(chain, _)| chain == "pre").collect();
-    assert_eq!(translations.len(), 2);
-    for (_, expressions) in &translations {
-        assert_eq!(expressions.last().unwrap(), "nat");
-        assert_eq!(
-            expressions.iter().filter(|name| *name == "immediate").count(),
-            2
-        );
-    }
+    assert_eq!(translations.len(), 1);
+    assert_eq!(translations[0].1.last().unwrap(), "nat");
+    assert!(!translations[0].1.contains(&"immediate".to_string()));
     let counted = |graph: &Vec<(String, Vec<String>)>, chain: &str| {
         graph.iter().filter(|(name, _)| name == chain).count()
     };
-    assert_eq!(
-        counted(&rules, "forward"),
-        counted(&baseline.1, "forward") + 6
-    );
+    assert_eq!(counted(&rules, "forward"), counted(&baseline.1, "forward") + 4);
     // The classification leads the handoff ingress barrier, ahead of every denial
     // in it, and never touches conntrack because raw runs before it.
     let returns: Vec<_> = rules
@@ -757,11 +778,9 @@ fn router_v2_published_ports_compile_handoff_dnat_classification_and_admission()
         .filter(|(chain, _)| chain == "raw_return")
         .map(|(_, expressions)| expressions)
         .collect();
-    assert_eq!(returns.len(), counted(&baseline.1, "raw_return") + 2);
-    for expressions in &returns[..2] {
-        assert!(!expressions.contains(&"ct".to_string()));
-    }
-    assert!(returns[2..]
+    assert_eq!(returns.len(), counted(&baseline.1, "raw_return") + 1);
+    assert!(returns[0].contains(&"lookup".to_string()) && !returns[0].contains(&"ct".to_string()));
+    assert!(returns[1..]
         .iter()
         .any(|expressions| expressions.contains(&"ct".to_string())));
     assert_eq!(returns.last().unwrap().len(), 1);
@@ -772,18 +791,16 @@ fn router_v2_published_ports_compile_handoff_dnat_classification_and_admission()
         .filter(|(chain, _)| chain == "raw_in")
         .map(|(_, expressions)| expressions)
         .collect();
-    assert_eq!(incoming.len(), counted(&baseline.1, "raw_in") + 2);
-    for expressions in &incoming[3..5] {
-        assert!(!expressions.contains(&"ct".to_string()));
-    }
-    assert!(incoming[5..]
+    assert_eq!(incoming.len(), counted(&baseline.1, "raw_in") + 1);
+    assert!(incoming[3].contains(&"lookup".to_string()) && !incoming[3].contains(&"ct".to_string()));
+    assert!(incoming[4..]
         .iter()
         .any(|expressions| expressions.contains(&"ct".to_string())));
     let bytes = program_bytes(&published, "snft_v2_router_golden");
-    assert_eq!(bytes.len(), 67818);
+    assert_eq!(bytes.len(), 55494);
     assert_eq!(
         format!("{:x}", Sha256::digest(&bytes)),
-        "62bf0f5aace2a19fb8a92571d1c4d45d774aa003884c239e473c67a7e103bb12"
+        "60a7ba1c15d49e5ff54cfbf9fbe2d72f03973acd1a897eef2d975547ef4abf5b"
     );
 }
 
@@ -892,201 +909,243 @@ fn router_v2_published_ports_reject_unbound_endpoints_conflicts_and_out_of_range
             router_published_port("tcp", 443, 8443),
             router_published_port("tcp", 443, 9443)
         ])),
-        published_router(json!((0..65)
+        published_router(json!((0..1025)
             .map(|index| router_published_port("tcp", 20000 + index, 8443))
             .collect::<Vec<_>>())),
     ] {
         assert!(normalized(invalid).is_err());
     }
-    // Bounded input still meets the atomic reserve first: every publication costs
-    // six operations, so prepare rejects before any kernel work.
+    // Publications are set elements: the input maximum compiles the same rules
+    // as one publication, and its elements fit their own budget.
     let ports = |count: u16| -> Value {
         json!((0..count)
             .map(|index| router_published_port("tcp", 20000 + index, 8443))
             .collect::<Vec<_>>())
     };
-    let prepared = prepared(published_router(ports(5)));
-    let program = prepared
-        .program(&format!("snft_{}", "x".repeat(59)))
-        .unwrap();
-    let bytes: usize = program
-        .iter()
-        .map(|(_, attributes)| crate::wire::encode_attrs(attributes).len() + 20)
-        .sum();
-    assert!(program.len() <= 768 && bytes <= 100_000);
-    assert!(normalized(published_router(ports(6)))
-        .unwrap()
-        .prepare()
-        .is_err());
-    println!("ROUTER_PUBLISHED_MAX ports=5 operations={} bytes={bytes}", program.len());
-}
-
-/// One arriving IPv4 tuple for the ordered raw classifiers of a compiled chain.
-#[derive(Clone, Copy)]
-struct Arrival {
-    interface_index: u32,
-    interface_name: &'static str,
-    protocol: u8,
-    source: [u8; 4],
-    destination: [u8; 4],
-    source_port: u16,
-    destination_port: u16,
-}
-/// Walks one compiled chain in program order and reports the first rule that
-/// matches an arriving tuple as (position, verdict, conntrack zone it sets). Raw
-/// prerouting classification is the only hook this covers, so an unexpected
-/// expression panics instead of being silently ignored.
-fn classify(prepared: &Prepared, chain: &str, arrival: &Arrival) -> Option<(usize, i32, u16)> {
-    let table = "snft_v2_router_order";
-    let mut position = 0;
-    for (kind, attributes) in prepared.program(table).unwrap() {
-        if kind == 3 || crate::wire::text(&attributes, 2).unwrap() != chain {
-            continue;
-        }
-        let index = position;
-        position += 1;
-        let mut pending: Option<Vec<u8>> = None;
-        let mut immediate: Option<Vec<u8>> = None;
-        let mut verdict = 0;
-        let mut zone = 0;
-        let mut matched = true;
-        for expression in
-            crate::wire::attrs(&crate::wire::one(&attributes, 4).unwrap().value).unwrap()
-        {
-            let fields = crate::wire::attrs(&expression.value).unwrap();
-            let data = crate::wire::attrs(&crate::wire::one(&fields, 2).unwrap().value).unwrap();
-            match crate::wire::text(&fields, 1).unwrap().as_str() {
-                "meta" => {
-                    pending = Some(match crate::wire::number(&data, 2).unwrap() {
-                        4 => arrival.interface_index.to_ne_bytes().to_vec(),
-                        6 => [arrival.interface_name.as_bytes(), &[0]].concat(),
-                        15 => vec![libc::NFPROTO_IPV4 as u8],
-                        16 => vec![arrival.protocol],
-                        key => panic!("meta {key}"),
-                    })
-                }
-                "payload" => {
-                    pending = Some(
-                        match (
-                            crate::wire::number(&data, 2).unwrap(),
-                            crate::wire::number(&data, 3).unwrap(),
-                        ) {
-                            (1, 12) => arrival.source.to_vec(),
-                            (1, 16) => arrival.destination.to_vec(),
-                            (2, 0) => arrival.source_port.to_be_bytes().to_vec(),
-                            (2, 2) => arrival.destination_port.to_be_bytes().to_vec(),
-                            load => panic!("payload {load:?}"),
-                        },
-                    )
-                }
-                "bitwise" => {
-                    let mask = crate::wire::attrs(&crate::wire::one(&data, 4).unwrap().value)
-                        .unwrap()[0]
-                        .value
-                        .clone();
-                    let loaded = pending.take().unwrap();
-                    pending = Some(
-                        loaded
-                            .iter()
-                            .zip(&mask)
-                            .map(|(byte, mask)| byte & mask)
-                            .collect(),
-                    );
-                }
-                "cmp" => {
-                    assert_eq!(crate::wire::number(&data, 2).unwrap(), 0);
-                    let expected = crate::wire::attrs(&crate::wire::one(&data, 3).unwrap().value)
-                        .unwrap()[0]
-                        .value
-                        .clone();
-                    matched = pending.take().unwrap() == expected;
-                }
-                "ct" => {
-                    // Only the zone store reaches raw classification; a loaded
-                    // conntrack key would need a conntrack lookup that has not run.
-                    assert_eq!(crate::wire::number(&data, 2).unwrap(), 17);
-                    assert_eq!(crate::wire::number(&data, 4).unwrap(), 1);
-                    zone = u16::from_ne_bytes(immediate.take().unwrap().try_into().unwrap());
-                }
-                "immediate" => {
-                    let inner =
-                        crate::wire::attrs(&crate::wire::one(&data, 2).unwrap().value).unwrap();
-                    if crate::wire::number(&data, 1).unwrap() == 0 {
-                        let code = crate::wire::attrs(&crate::wire::one(&inner, 2).unwrap().value)
-                            .unwrap();
-                        verdict = crate::wire::number(&code, 1).unwrap() as i32;
-                    } else {
-                        immediate = Some(crate::wire::one(&inner, 1).unwrap().value.clone());
-                    }
-                }
-                other => panic!("{other}"),
-            }
-            if !matched {
-                break;
-            }
-        }
-        if matched {
-            return Some((index, verdict, zone));
-        }
-    }
-    None
+    let one = graph(&prepared(published_router(ports(1))), "snft_v2_router_max");
+    let maximum = prepared(published_router(ports(64)));
+    let (_, rules) = graph(&maximum, "snft_v2_router_max");
+    assert_eq!(rules, one.1);
+    let (operations, rule_bytes, element_bytes) = cost(&maximum);
+    assert!(operations <= 768 && rule_bytes <= 100_000 && element_bytes <= 100_000);
+    println!("ROUTER_PUBLISHED_MAX ports=64 operations={operations} rule_bytes={rule_bytes} element_bytes={element_bytes}");
 }
 
 #[test]
 fn router_v2_published_endpoint_traffic_is_classified_before_the_leased_grants() {
+    use super::hostgrant_tests::{decide, Flow, ESTABLISHED};
     // A published reply to a client whose source port equals the leased grant's
     // destination port on its public prefix. Raw runs before conntrack, so only
     // the payload tuple separates it from ordinary leased egress.
-    let reply = Arrival {
-        interface_index: 2,
-        interface_name: "work",
+    let reply = Flow {
+        input: Some((2, "work")),
+        output: None,
         protocol: 6,
         source: [10, 241, 0, 2],
         destination: [198, 51, 100, 7],
         source_port: 9443,
         destination_port: 443,
+        tcp_flags: 0x10,
+        state: ESTABLISHED,
+        reply: true,
+        zone: 0,
+        original: ([198, 51, 100, 7], [10, 240, 0, 2], 443, 443),
+        uid: None,
+        label: [0; 16],
     };
     // Without the publication that exact tuple is leased into the generation zone,
-    // so the ordering below is what keeps the publication usable at all.
-    let leased = classify(&prepared(router()), "raw_in", &reply).unwrap();
-    assert_eq!((leased.1, leased.2), (1, 1));
+    // so the precedence below is what keeps the publication usable at all.
+    let baseline = prepared(router());
+    let leased = decide(&baseline, "raw_in", &reply);
+    assert_eq!((leased.verdict, leased.zone), (1, 1));
     let published = prepared(published_router(json!([router_published_port(
         "tcp", 443, 9443
     )])));
-    let (index, verdict, zone) = classify(&published, "raw_in", &reply).unwrap();
     // Accepted with no zone set: the reply stays in the default zone, where the
     // translated publication and its admission live.
-    assert_eq!((verdict, zone), (1, 0));
-    // Every other workload flow keeps its leased classification, and the leased
-    // classifier that claims the tuple above is reached only after this one.
-    let (leased_index, leased_verdict, leased_zone) = classify(
-        &published,
-        "raw_in",
-        &Arrival {
+    let classified = decide(&published, "raw_in", &reply);
+    assert_eq!((classified.verdict, classified.zone), (1, 0));
+    // Every other workload flow keeps its leased classification, and the
+    // classification is exact: another link, another workload address and
+    // another protocol meet exactly the decision the unpublished scope makes.
+    for foreign in [
+        Flow {
             source_port: 50000,
             ..reply
         },
-    )
-    .unwrap();
-    assert_eq!((leased_verdict, leased_zone), (1, 1));
-    assert!(index < leased_index, "{index} {leased_index}");
-    // The classification is exact: another link, another workload address and
-    // another protocol are not published and are not classified here.
-    for foreign in [
-        Arrival {
-            interface_index: 3,
-            interface_name: "vpn",
+        Flow {
+            input: Some((3, "vpn")),
             ..reply
         },
-        Arrival {
+        Flow {
             source: [10, 241, 0, 3],
             ..reply
         },
-        Arrival {
+        Flow {
             protocol: 17,
             ..reply
         },
     ] {
-        assert!(classify(&published, "raw_in", &foreign).is_none());
+        assert_eq!(
+            decide(&published, "raw_in", &foreign),
+            decide(&baseline, "raw_in", &foreign)
+        );
     }
 }
+
+fn exhausted(value: super::Result<Prepared>) -> crate::Bound {
+    match value {
+        Err(crate::Error::Exhausted(bound)) => bound,
+        other => panic!("expected a capacity refusal, got {other:?}"),
+    }
+}
+fn bound(name: &'static str, limit: usize, actual: usize) -> crate::Bound {
+    crate::Bound {
+        name,
+        limit,
+        actual,
+    }
+}
+fn prepare(value: Value) -> super::Result<Prepared> {
+    normalized(value)?.prepare()
+}
+
+/// The compiled budget and the input counts that exist to hold it refuse with
+/// EXHAUSTED and their bound; bounds of the topology's shape stay INVALID.
+#[test]
+fn v2_capacity_refusals_name_their_bound_and_shape_bounds_stay_invalid() {
+    // Router rules grow with protected prefixes: 128 exceed the rule reserve.
+    let mut value = router();
+    let mut prefixes = vec![
+        json!("10.0.0.0/8"),
+        json!("192.0.2.0/24"),
+        json!("203.0.113.10/32"),
+    ];
+    prefixes.extend((0..125).map(|index| json!(format!("172.16.{index}.0/24"))));
+    value["scope"]["protection"]["prefixes"] = json!(prefixes);
+    let refused = exhausted(prepare(value.clone()));
+    assert_eq!((refused.name, refused.limit), ("ruleBytes", 100_000));
+    assert!(refused.actual > refused.limit);
+    // 129 protected prefixes are outside the schema, not over capacity.
+    value["scope"]["protection"]["prefixes"]
+        .as_array_mut()
+        .unwrap()
+        .push(json!("172.17.0.0/24"));
+    assert_eq!(prepare(value).unwrap_err(), crate::Error::Invalid);
+
+    // Host transit rules grow with its handoffs and their leased ranges.
+    let handoff = |index: u32, ranges: u32| {
+        let mut item = allocation();
+        item["lease"]["id"] = json!(format!("lease-{index}"));
+        item["transitSourceAddress"] = json!(format!("10.240.{index}.2"));
+        item["sourcePortRanges"] = json!((0..ranges)
+            .map(
+                |range| json!({"protocol":if range % 2 == 0 { "tcp" } else { "udp" },
+                "first":10000 + range * 100,"last":10099 + range * 100})
+            )
+            .collect::<Vec<_>>());
+        json!({"link":link(10 + index, &format!("h{index}"), "veth", &format!("10.240.{index}.1")),
+            "allocations":[item]})
+    };
+    let handoffs = |count: u32, ranges: u32| {
+        json!((0..count)
+            .map(|index| handoff(index, ranges))
+            .collect::<Vec<_>>())
+    };
+    let mut value = host();
+    value["scope"]["handoffs"] = handoffs(4, 2);
+    assert_eq!(prepare(value.clone()).map(|_| ()), Ok(()));
+    value["scope"]["handoffs"] = handoffs(32, 16);
+    let refused = exhausted(prepare(value.clone()));
+    assert_eq!((refused.name, refused.limit), ("ruleBytes", 100_000));
+    assert!(refused.actual > refused.limit);
+    // 33 handoffs are outside the schema, not over capacity.
+    value["scope"]["handoffs"] = handoffs(33, 2);
+    assert_eq!(prepare(value).unwrap_err(), crate::Error::Invalid);
+
+    // Router input counts.
+    let mut value = router();
+    let template = value["scope"]["links"][0].clone();
+    value["scope"]["links"] = json!((0..129u32)
+        .map(|index| {
+            let mut item = template.clone();
+            item["interfaceIndex"] = json!(10 + index);
+            item["interfaceName"] = json!(format!("l{index}"));
+            item
+        })
+        .collect::<Vec<_>>());
+    assert_eq!(exhausted(prepare(value)), bound("links", 128, 129));
+    let mut value = router();
+    let template = value["scope"]["endpoints"][0].clone();
+    value["scope"]["endpoints"] = json!((0..129u32)
+        .map(|index| {
+            let mut item = template.clone();
+            item["id"] = json!(format!("e{index}"));
+            item
+        })
+        .collect::<Vec<_>>());
+    assert_eq!(exhausted(prepare(value)), bound("endpoints", 128, 129));
+    let mut value = router();
+    let template = value["scope"]["rules"][0].clone();
+    value["scope"]["rules"] = json!((0..1025u16)
+        .map(|index| {
+            let mut item = template.clone();
+            item["destinationPort"] = json!(1 + index);
+            item
+        })
+        .collect::<Vec<_>>());
+    assert_eq!(exhausted(prepare(value)), bound("rules", 1024, 1025));
+    // Egress grants count across every generation.
+    let mut value = router();
+    let generation = value["scope"]["generations"][0].clone();
+    let template = generation["grants"][0].clone();
+    value["scope"]["generations"] = json!((0..2u16)
+        .map(|part| {
+            let mut item = generation.clone();
+            item["grants"] = json!((0..(512 + part))
+                .map(|index| {
+                    let mut grant = template.clone();
+                    grant["destinationPort"] = json!(1 + index);
+                    grant
+                })
+                .collect::<Vec<_>>());
+            item
+        })
+        .collect::<Vec<_>>());
+    assert_eq!(exhausted(prepare(value)), bound("grants", 1024, 1025));
+    // Active generations are lease lifecycle, not capacity.
+    let mut value = router();
+    let generation = value["scope"]["generations"][0].clone();
+    value["scope"]["generations"] = json!(vec![generation; 33]);
+    assert_eq!(prepare(value).unwrap_err(), crate::Error::Invalid);
+
+    // Publications on both hops.
+    let ports = json!((0..1025u16)
+        .map(|index| published_port("tcp", 20000 + index, 20000 + index))
+        .collect::<Vec<_>>());
+    assert_eq!(
+        exhausted(prepare(published_host(ports.clone()))),
+        bound("publishedPorts", 1024, 1025)
+    );
+    let ports = json!((0..1025u16)
+        .map(|index| router_published_port("tcp", 20000 + index, 20000 + index))
+        .collect::<Vec<_>>());
+    assert_eq!(
+        exhausted(prepare(published_router(ports))),
+        bound("publishedPorts", 1024, 1025)
+    );
+
+    // Within the input bound, the grant elements exceed the target budget.
+    let mut value = router();
+    let template = value["scope"]["generations"][0]["grants"][0].clone();
+    value["scope"]["generations"][0]["grants"] = json!((0..1024u16)
+        .map(|index| {
+            let mut grant = template.clone();
+            grant["destinationPort"] = json!(1000 + index);
+            grant
+        })
+        .collect::<Vec<_>>());
+    let refused = exhausted(prepare(value));
+    assert_eq!((refused.name, refused.limit), ("targetBytes", 212_000));
+    assert!(refused.actual > refused.limit);
+}