@push.rocks/smartnftables 2.6.0 → 4.0.0

package/rust/src/egress_workloadgrant_tests.rs

@@ -241,12 +241,6 @@ fn workload_grants_reject_unbound_same_link_local_platform_and_tun_ends() {
             json!([{"protocol":"tcp","sourceAddress":"10.241.0.2","destinationAddress":"10.241.1.2",
                 "destinationPort":80,"bidirectional":true}]),
         ),
-        granted(
-            two_workloads(),
-            json!((0..1025_u16)
-                .map(|port| workload_grant("tcp", "10.241.0.2", "10.241.1.2", 1 + port))
-                .collect::<Vec<_>>()),
-        ),
     ] {
         assert!(
             normalized(invalid.clone()).is_err(),
@@ -254,6 +248,21 @@ fn workload_grants_reject_unbound_same_link_local_platform_and_tun_ends() {
             invalid["scope"]["workloadGrants"]
         );
     }
+    // The contract maximum is a capacity bound.
+    assert_eq!(
+        normalized(granted(
+            two_workloads(),
+            json!((0..1025_u16)
+                .map(|port| workload_grant("tcp", "10.241.0.2", "10.241.1.2", 1 + port))
+                .collect::<Vec<_>>()),
+        ))
+        .unwrap_err(),
+        crate::Error::Exhausted(crate::Bound {
+            name: "workloadGrants",
+            limit: 1024,
+            actual: 1025
+        })
+    );
     // Both directions between two workloads are two separate grants.
     assert!(normalized(granted(
         two_workloads(),
@@ -297,18 +306,17 @@ fn workload_grants_meet_the_atomic_reserve_at_the_contract_maximum() {
             .sum()
     };
     let (graph, elements) = (size(&[3, 6, 9]), size(&[12]));
-    assert!(program.len() < 768 && graph <= 100_000 && elements <= super::compile::ELEMENT_BYTES);
+    assert!(program.len() < 768 && graph <= super::compile::RULE_BYTES && graph + elements <= super::compile::TARGET_BYTES);
     assert!(deletion + graph + elements + 64 <= wire::BATCH_BYTES);
     println!(
         "WORKLOAD_GRANT_MAX grants=1024 operations={} rule_bytes={graph} element_bytes={elements}",
         program.len()
     );
-    // Host grants and workload grants share one element budget per target:
-    // half the host grant maximum fits beside the workload maximum, both maxima
-    // together are refused before any kernel work.
+    // Host grants and workload grants share the target budget with the rest of
+    // the scope's elements; both maxima together fit it.
     let mut both = granted(two_workloads(), json!(maximum));
-    both["scope"]["hostGrants"] = many(512);
-    normalized(both.clone()).unwrap().prepare().unwrap();
     both["scope"]["hostGrants"] = many(1024);
-    assert!(normalized(both).unwrap().prepare().is_err());
+    let both = normalized(both).unwrap().prepare().unwrap();
+    let (operations, rule_bytes, element_bytes) = super::tests::cost(&both);
+    assert!(operations < 768 && rule_bytes + element_bytes <= super::compile::TARGET_BYTES);
 }

package/rust/src/main.rs

@@ -15,9 +15,22 @@ use std::io::{BufRead, Read, Write};
 /// same lines. A transition carries two complete policies.
 pub(crate) const IPC_BYTES: usize = 1_048_576;
 
+/// A capacity bound of the atomic replacement budget that a policy exceeded: the
+/// stable bound name, its limit and the size the policy reached. Input counts and
+/// the schema-v1 budget are exact; the other compiled budgets stop at the first
+/// message or rule past the limit, so the complete policy needs at least `actual`.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct Bound {
+    pub name: &'static str,
+    pub limit: usize,
+    pub actual: usize,
+}
+
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum Error {
     Invalid,
+    /// The policy does not fit a capacity bound; a smaller policy may fit.
+    Exhausted(Bound),
     Unsupported,
     UnsupportedBackend,
     Permission,
@@ -28,10 +41,23 @@ pub enum Error {
     Unavailable,
 }
 pub type Result<T> = std::result::Result<T, Error>;
+/// Refuses `actual` above the capacity bound `name`.
+pub fn capacity(name: &'static str, limit: usize, actual: usize) -> Result<()> {
+    if actual > limit {
+        Err(Error::Exhausted(Bound {
+            name,
+            limit,
+            actual,
+        }))
+    } else {
+        Ok(())
+    }
+}
 impl Error {
     pub fn code(self) -> &'static str {
         match self {
             Self::Invalid => "INVALID",
+            Self::Exhausted(_) => "EXHAUSTED",
             Self::Unsupported => "UNSUPPORTED_KERNEL",
             Self::UnsupportedBackend => "UNSUPPORTED_BACKEND",
             Self::Permission => "PERMISSION",
@@ -42,6 +68,26 @@ impl Error {
             Self::Unavailable => "UNAVAILABLE",
         }
     }
+    /// The bounded, non-secret refusal text of the response.
+    pub fn message(self) -> String {
+        match self {
+            Self::Invalid => "Managed policy input is invalid.".into(),
+            Self::Exhausted(bound) => format!(
+                "Managed policy exceeds the {} capacity of {}: it reached {}.",
+                bound.name, bound.limit, bound.actual
+            ),
+            _ => "Managed policy operation failed.".into(),
+        }
+    }
+    /// The structured refusal details of the response, if any.
+    pub fn data(self) -> Option<serde_json::Value> {
+        match self {
+            Self::Exhausted(bound) => Some(
+                serde_json::json!({"bound":bound.name,"limit":bound.limit,"actual":bound.actual}),
+            ),
+            _ => None,
+        }
+    }
     pub fn kernel(code: i32) -> Self {
         match -code {
             libc::ENOENT => Self::Absent,
@@ -114,6 +160,16 @@ fn dispatch(owner: &mut Option<owner::Owner>, request: Request) -> Result<serde_
     }
 }
 
+/// The failure response line: the refusal text, the stable code and, for a
+/// capacity refusal, its bound.
+fn failure(id: &str, error: Error) -> serde_json::Value {
+    let mut value = serde_json::json!({"id":id,"success":false,"error":error.message(),"errorCode":error.code()});
+    if let Some(data) = error.data() {
+        value["errorData"] = data;
+    }
+    value
+}
+
 fn main() {
     let arguments = std::env::args().skip(1).collect::<Vec<_>>();
     let (docker_mode, descriptor) = match arguments.as_slice() {
@@ -163,9 +219,7 @@ fn main() {
         let id = request.id.clone();
         let response = match if docker_mode { docker::dispatch(&mut docker, request) } else { dispatch(&mut owner, request) } {
             Ok(result) => serde_json::json!({"id":id,"success":true,"result":result}),
-            Err(error) => {
-                serde_json::json!({"id":id,"success":false,"error":"Managed policy operation failed.","errorCode":error.code()})
-            }
+            Err(error) => failure(&id, error),
         };
         if writeln!(output, "{response}")
             .and_then(|_| output.flush())

package/rust/src/owner.rs

@@ -680,7 +680,8 @@ fn chain_identity(attributes: &[Attr]) -> Result<Vec<u8>> {
     }
     serde_json::to_vec(&wire::canonical(&identity, false)?).map_err(|_| Error::Protocol)
 }
-/// A set is its table, name, flags, key type and key length. The handle, the
+/// A set is its table, name, flags, key type and key length, a map's data type
+/// and length, and the field lengths of a concatenation. The handle, the
 /// informational backend type and count, the transaction ID and an empty
 /// description are not identity; anything else rejects.
 fn set_identity(attributes: &[Attr]) -> Result<Vec<u8>> {
@@ -688,30 +689,78 @@ fn set_identity(attributes: &[Attr]) -> Result<Vec<u8>> {
     for attribute in attributes {
         match attribute.id() {
             10 | 16 | 19 | 20 => {}
-            9 if wire::attrs(&attribute.value)?.is_empty() => {}
-            1..=5 => identity.push(attribute.clone()),
+            9 => {
+                if let Some(fields) = concatenation(&attribute.value)? {
+                    identity.push(Attr::bytes(9, fields));
+                }
+            }
+            1..=7 => identity.push(attribute.clone()),
             _ => return Err(Error::Conflict),
         }
     }
     for id in [1, 2, 3, 4, 5] {
         wire::one(&identity, id)?;
     }
+    // A map carries its data type and length, and nothing else does.
+    let map = wire::number(&identity, 3)? & 8 != 0;
+    for id in [6, 7] {
+        if wire::one(&identity, id).is_ok() != map {
+            return Err(Error::Conflict);
+        }
+    }
     serde_json::to_vec(&wire::canonical(&identity, false)?).map_err(|_| Error::Protocol)
 }
-/// Only plain keys: an element with data, flags, timeouts, expressions or any
-/// other extension is not one the compiler created.
+/// The field lengths of a set description: only a concatenation, never a size.
+/// An empty description is none.
+fn concatenation(value: &[u8]) -> Result<Option<Vec<u8>>> {
+    let description = wire::attrs(value)?;
+    if description.is_empty() {
+        return Ok(None);
+    }
+    if description.len() != 1 || description[0].id() != 2 {
+        return Err(Error::Conflict);
+    }
+    let mut lengths = Vec::new();
+    for field in wire::attrs(&description[0].value)? {
+        let length = wire::attrs(&field.value)?;
+        if field.id() != 1 || length.len() != 1 {
+            return Err(Error::Conflict);
+        }
+        lengths.extend(wire::number(&length, 1)?.to_be_bytes());
+    }
+    Ok(Some(lengths))
+}
+/// Only compiler elements: a key, the last key of an interval and a map's data.
+/// Flags, timeouts, expressions or any other extension reject. The identity is
+/// the three values, so any changed bound or datum is a changed element.
 fn element_keys(list: &[Attr]) -> Result<Vec<Vec<u8>>> {
     let mut keys = Vec::new();
     for element in list {
-        let fields = wire::attrs(&element.value)?;
-        if element.id() != 1 || fields.len() != 1 {
+        if element.id() != 1 {
             return Err(Error::Conflict);
         }
-        let key = wire::attrs(&wire::one(&fields, 1)?.value)?;
-        if key.len() != 1 {
-            return Err(Error::Conflict);
+        let mut values: [Option<Vec<u8>>; 3] = [None, None, None];
+        for field in wire::attrs(&element.value)? {
+            let slot = match field.id() {
+                1 => 0,
+                10 => 1,
+                2 => 2,
+                _ => return Err(Error::Conflict),
+            };
+            let value = wire::attrs(&field.value)?;
+            if value.len() != 1 || values[slot].is_some() {
+                return Err(Error::Conflict);
+            }
+            values[slot] = Some(wire::one(&value, 1)?.value.clone());
         }
-        keys.push(wire::one(&key, 1)?.value.clone());
+        let [Some(key), last, data] = values else {
+            return Err(Error::Conflict);
+        };
+        keys.push(if last.is_none() && data.is_none() {
+            key
+        } else {
+            serde_json::to_vec(&(key, last, data)).map_err(|_| Error::Protocol)?
+        });
     }
     Ok(keys)
 }
@@ -772,7 +821,7 @@ fn rule_identity(attributes: &[Attr]) -> Result<(String, Vec<u8>)> {
 /// neither unknown fields nor default repair may hide a changed kernel rule.
 fn validate_egress_expression(name: &str, data: &[Attr]) -> Result<()> {
     let allowed: &[u16] = match name {
-        "lookup" => &[1, 2, 5],
+        "lookup" => &[1, 2, 3, 5],
         "ct" | "range" => &[1, 2, 3, 4],
         "nat" => &[1, 2, 3, 4, 5, 6, 7],
         "reject" => &[1],
@@ -786,10 +835,16 @@ fn validate_egress_expression(name: &str, data: &[Attr]) -> Result<()> {
     }
     match name {
         "lookup" => {
-            // A plain membership test of a named set: no map, no inversion.
+            // A membership or absence test of a named set, or a map lookup into
+            // a data register, which is never inverted.
             wire::text(data, 1)?;
             wire::number(data, 2)?;
-            if data.len() != 3 || wire::number(data, 5)? != 0 {
+            let map = wire::one(data, 3).is_ok();
+            if map {
+                wire::number(data, 3)?;
+            }
+            let flags = wire::number(data, 5)?;
+            if data.len() != 3 + usize::from(map) || flags > 1 || map && flags != 0 {
                 return Err(Error::Conflict);
             }
         }

package/rust/src/owner_host_traffic_tests.rs

@@ -389,6 +389,8 @@ fn v2_host_publishes_exact_uplink_ports_and_removes_them_with_the_generation() {
                 target_port: 8443,
                 target_address: "10.240.0.2".into(),
                 host_ip: "192.0.2.2".into(),
+                host_port_end: None,
+                symmetric: false,
             },
             egress::PublishedPort {
                 protocol: "udp".into(),
@@ -396,6 +398,8 @@ fn v2_host_publishes_exact_uplink_ports_and_removes_them_with_the_generation() {
                 target_port: 8125,
                 target_address: "10.240.0.2".into(),
                 host_ip: "192.0.2.2".into(),
+                host_port_end: None,
+                symmetric: false,
             },
         ];
         let mut owner = Owner::new(options("host_published")).unwrap();

package/rust/src/owner_identity_tests.rs

@@ -168,94 +168,162 @@ fn egress_identity_rejects_unknown_duplicate_or_incomplete_operands() {
     }
 }
 
+/// The compiled chains, rules, and sets with their element identities of one
+/// prepared policy, as the owner's graph comparison sees them.
+type Compiled = (
+    Vec<Vec<u8>>,
+    Vec<(String, Vec<u8>)>,
+    std::collections::BTreeMap<String, (Vec<u8>, Vec<Vec<u8>>)>,
+);
+fn compiled(value: serde_json::Value) -> Compiled {
+    let prepared = serde_json::from_value::<crate::egress::Policy>(value)
+        .unwrap()
+        .prepare()
+        .unwrap();
+    let (mut chains, mut rules) = (Vec::new(), Vec::new());
+    let mut sets = std::collections::BTreeMap::new();
+    for (kind, attributes) in prepared.program("snft_identity").unwrap() {
+        match kind {
+            3 => chains.push(super::chain_identity(&attributes).unwrap()),
+            6 => {
+                // The stamp carries the policy digest; compare the rule itself.
+                let unstamped: Vec<Attr> = attributes
+                    .iter()
+                    .map(|attribute| match attribute.id() {
+                        7 => Attr::bytes(7, b"stamp".to_vec()),
+                        _ => attribute.clone(),
+                    })
+                    .collect();
+                rules.push(rule_identity(&unstamped).unwrap());
+            }
+            9 => {
+                // The kernel's dump of the same set has the same identity.
+                let identity = set_identity(&attributes).unwrap();
+                assert_eq!(set_identity(&dumped_set(&attributes)).unwrap(), identity);
+                sets.insert(wire::text(&attributes, 2).unwrap(), (identity, Vec::new()));
+            }
+            12 => {
+                let list = wire::attrs(&wire::one(&attributes, 3).unwrap().value).unwrap();
+                sets.get_mut(&wire::text(&attributes, 2).unwrap())
+                    .unwrap()
+                    .1
+                    .extend(element_keys(&list).unwrap());
+            }
+            other => panic!("operation {other}"),
+        }
+    }
+    (chains, rules, sets)
+}
+
 /// A published host-transit generation must survive the same apply-time graph
-/// identity as the rest of the table: the kernel dump is compared operand by
-/// operand, so destination NAT and its admissions cannot be silently rewritten.
+/// identity as the rest of the table: its rules and every set element are
+/// compared operand by operand, so destination NAT and its admissions cannot be
+/// silently rewritten, while the rules stay the same for any publication.
 #[test]
 fn published_host_graph_identity_preserves_destination_nat_and_admission_operands() {
-    let compiled = |target_port: u16| {
-        let value = crate::egress::tests::published_host(serde_json::json!([
+    let host = |target_port: u16| {
+        compiled(crate::egress::tests::published_host(serde_json::json!([
             crate::egress::tests::published_port("tcp", 443, target_port)
-        ]));
-        let prepared = serde_json::from_value::<crate::egress::Policy>(value)
-            .unwrap()
-            .prepare()
-            .unwrap();
-        let mut chains = Vec::new();
-        let mut rules = Vec::new();
-        for (kind, attributes) in prepared.program("snft_identity").unwrap() {
-            if kind == 3 {
-                chains.push(super::chain_identity(&attributes).unwrap());
-            } else {
-                rules.push(rule_identity(&attributes).unwrap());
-            }
-        }
-        (chains, rules)
+        ])))
     };
-    let (chains, rules) = compiled(8443);
+    let (chains, rules, sets) = host(8443);
     assert_eq!(rules.iter().filter(|(chain, _)| chain == "pre").count(), 1);
     assert_eq!(chains.len(), 7);
-    let translation = rules.iter().find(|(chain, _)| chain == "pre").unwrap();
-    let (_, changed) = compiled(9443);
-    let other = changed.iter().find(|(chain, _)| chain == "pre").unwrap();
-    assert_ne!(translation.1, other.1);
-    assert_eq!(
-        rules.iter().filter(|(chain, _)| chain == "forward").count(),
-        changed.iter().filter(|(chain, _)| chain == "forward").count()
-    );
+    let (_, changed_rules, changed_sets) = host(9443);
+    assert_eq!(rules, changed_rules);
+    // The translation's port is map data and the admission's port is a key.
+    for name in ["published_port", "published_forward"] {
+        assert_eq!(sets[name].0, changed_sets[name].0);
+        assert_ne!(sets[name].1, changed_sets[name].1, "{name}");
+    }
 }
 
 /// A published router generation must survive the same apply-time graph identity
-/// as the rest of the table: the kernel dump is compared operand by operand, so
-/// the workload translation and its admissions cannot be silently rewritten.
+/// as the rest of the table: its rules and every set element are compared operand
+/// by operand, so the workload translation, both classifications and the
+/// admissions cannot be silently rewritten.
 #[test]
 fn published_router_graph_identity_preserves_destination_nat_and_admission_operands() {
-    let compiled = |endpoint_port: u16| {
-        let value = crate::egress::tests::published_router(serde_json::json!([
+    let router = |endpoint_port: u16| {
+        compiled(crate::egress::tests::published_router(serde_json::json!([
             crate::egress::tests::router_published_port("tcp", 443, endpoint_port)
-        ]));
-        let prepared = serde_json::from_value::<crate::egress::Policy>(value)
-            .unwrap()
-            .prepare()
-            .unwrap();
-        let mut chains = Vec::new();
-        let mut rules = Vec::new();
-        for (kind, attributes) in prepared.program("snft_identity").unwrap() {
-            if kind == 3 {
-                chains.push(super::chain_identity(&attributes).unwrap());
-            } else {
-                rules.push(rule_identity(&attributes).unwrap());
-            }
-        }
-        (chains, rules)
+        ])))
     };
-    let (chains, rules) = compiled(8443);
+    let (chains, rules, sets) = router(8443);
     assert_eq!(rules.iter().filter(|(chain, _)| chain == "pre").count(), 1);
-    assert_eq!(chains.len(), 16);
-    let translation = rules.iter().find(|(chain, _)| chain == "pre").unwrap();
-    let (_, changed) = compiled(9443);
-    let other = changed.iter().find(|(chain, _)| chain == "pre").unwrap();
-    assert_ne!(translation.1, other.1);
-    assert_eq!(
-        rules.iter().filter(|(chain, _)| chain == "forward").count(),
-        changed.iter().filter(|(chain, _)| chain == "forward").count()
-    );
-    // The handoff ingress classification is part of the same identity.
+    // The router's base chains, the pre chain and its three regular chains.
+    assert_eq!(chains.len(), 10);
+    let (_, changed_rules, changed_sets) = router(9443);
+    assert_eq!(rules, changed_rules);
+    for name in ["published_port", "published_forward", "published_endpoint"] {
+        assert_ne!(sets[name].1, changed_sets[name].1, "{name}");
+    }
+    assert_eq!(sets["published_arrival"], changed_sets["published_arrival"]);
+}
+
+/// Interval elements carry their last key and a map's data in their identity;
+/// a changed bound or datum is a changed element, and a set description is only
+/// ever a concatenation.
+#[test]
+fn interval_sets_and_elements_have_exact_graph_identity() {
+    let (_, _, sets) = compiled(crate::egress::tests::published_router(serde_json::json!([
+        crate::egress::tests::router_published_port("tcp", 443, 8443)
+    ])));
     assert_eq!(
-        rules.iter().filter(|(chain, _)| chain == "raw_return").count(),
-        changed
-            .iter()
-            .filter(|(chain, _)| chain == "raw_return")
-            .count()
+        sets.keys().filter(|name| name.starts_with("published_")).count(),
+        4
     );
+    let element = |last: u8, data: Option<u8>| {
+        let value = |kind: u16, byte: u8| Attr::nested(kind, vec![Attr::bytes(1, vec![byte; 8])]);
+        let mut fields = vec![value(1, 1), value(10, last)];
+        if let Some(data) = data {
+            fields.push(value(2, data));
+        }
+        Attr::nested(1, fields)
+    };
+    let identity = |attribute: Attr| element_keys(&[attribute]).unwrap();
+    let exact = identity(element(1, Some(4)));
+    assert_ne!(identity(element(2, Some(4))), exact);
+    assert_ne!(identity(element(1, Some(5))), exact);
+    assert_ne!(identity(element(1, None)), exact);
+    for extension in [
+        Attr::u32(3, 1),
+        Attr::nested(10, vec![Attr::bytes(1, vec![1; 8])]),
+    ] {
+        let Attr { value, .. } = element(1, Some(4));
+        let mut fields = wire::attrs(&value).unwrap();
+        fields.push(extension);
+        assert!(element_keys(&[Attr::nested(1, fields)]).is_err());
+    }
 }
 
-/// A host-grant set as Linux dumps it: the compiled creation plus the kernel's
-/// handle, an empty description, the backend type and the element count.
+/// A set as Linux dumps it: the compiled creation plus the kernel's handle, its
+/// description (empty for a plain key, the concatenation's field lengths without
+/// nesting flags otherwise), the backend type and the element count.
 fn dumped_set(created: &[Attr]) -> Vec<Attr> {
-    let mut dump: Vec<Attr> = created.iter().filter(|attribute| attribute.id() != 10).cloned().collect();
+    let mut dump: Vec<Attr> = created
+        .iter()
+        .filter(|attribute| ![9, 10].contains(&attribute.id()))
+        .cloned()
+        .collect();
     dump.push(Attr::u64(16, 7));
-    dump.push(Attr::nested(9, vec![]));
+    let fields = created
+        .iter()
+        .find(|attribute| attribute.id() == 9)
+        .map(|description| {
+            let concatenation = wire::attrs(&description.value).unwrap();
+            wire::attrs(&wire::one(&concatenation, 2).unwrap().value)
+                .unwrap()
+                .iter()
+                .map(|field| {
+                    Attr::bytes(1, wire::encode_attrs(&[Attr::u32(1, wire::number(&wire::attrs(&field.value).unwrap(), 1).unwrap())]))
+                })
+                .collect::<Vec<_>>()
+        });
+    dump.push(match fields {
+        Some(fields) => Attr::bytes(9, wire::encode_attrs(&[Attr::bytes(2, wire::encode_attrs(&fields))])),
+        None => Attr::nested(9, vec![]),
+    });
     dump.push(Attr::string(19, "nft_rhash_type"));
     dump.push(Attr::u32(20, 1024));
     dump
@@ -273,7 +341,11 @@ fn host_grant_sets_elements_and_lookups_have_exact_graph_identity() {
     .prepare()
     .unwrap();
     let program = prepared.program("snft_identity").unwrap();
-    let sets: Vec<_> = program.iter().filter(|(kind, _)| *kind == 9).map(|(_, attributes)| attributes.clone()).collect();
+    let sets: Vec<_> = program
+        .iter()
+        .filter(|(kind, attributes)| *kind == 9 && wire::text(attributes, 2).unwrap().starts_with("host_grant"))
+        .map(|(_, attributes)| attributes.clone())
+        .collect();
     assert_eq!(sets.len(), 2);
     for created in &sets {
         // The kernel's informational attributes are not identity.
@@ -294,21 +366,30 @@ fn host_grant_sets_elements_and_lookups_have_exact_graph_identity() {
             assert!(set_identity(&changed).is_err());
         }
     }
-    // Elements are plain keys; any extension rejects.
-    let (_, elements) = program.iter().find(|(kind, _)| *kind == 12).unwrap();
+    // Elements are plain keys; flags reject, and data is a different element.
+    let (_, elements) = program
+        .iter()
+        .find(|(kind, attributes)| *kind == 12 && wire::text(attributes, 2).unwrap() == "host_grant")
+        .unwrap();
     let list = wire::attrs(&wire::one(elements, 3).unwrap().value).unwrap();
     assert_eq!(element_keys(&list).unwrap().len(), 1);
     let key = wire::attrs(&list[0].value).unwrap();
-    for extension in [Attr::u32(3, 1), Attr::nested(2, vec![Attr::bytes(1, vec![1; 4])])] {
-        let mut changed = key.clone();
-        changed.push(extension);
-        assert!(element_keys(&[Attr::nested(1, changed)]).is_err());
-    }
-    // Every lookup names its set with a plain, uninverted membership test, and
-    // the key registers are part of identity.
+    let mut flagged = key.clone();
+    flagged.push(Attr::u32(3, 1));
+    assert!(element_keys(&[Attr::nested(1, flagged)]).is_err());
+    let mut mapped = key.clone();
+    mapped.push(Attr::nested(2, vec![Attr::bytes(1, vec![1; 4])]));
+    assert_ne!(
+        element_keys(&[Attr::nested(1, mapped)]).unwrap(),
+        element_keys(&list[..1]).unwrap()
+    );
+    // Five rules look up the host grant sets (the router's private and leased
+    // sets have their own lookups); the set name and key registers are identity.
     let lookups: Vec<_> = program
         .iter()
-        .filter(|(kind, attributes)| *kind == 6 && rule_identity(attributes).unwrap().1.windows(6).any(|window| window == b"lookup"))
+        .filter(|(kind, attributes)| {
+            *kind == 6 && wire::encode_attrs(attributes).windows(10).any(|window| window == b"host_grant")
+        })
         .collect();
     assert_eq!(lookups.len(), 5);
     let lookup = |data: Vec<Attr>| rule(vec![expression("lookup", data)]);
@@ -317,13 +398,18 @@ fn host_grant_sets_elements_and_lookups_have_exact_graph_identity() {
     for changed in [
         vec![Attr::string(1, "host_grant_arrival"), Attr::u32(2, 1), Attr::u32(5, 0)],
         vec![Attr::string(1, "host_grant"), Attr::u32(2, 9), Attr::u32(5, 0)],
+        // A map lookup's data register and an absence test are identity.
+        vec![Attr::string(1, "host_grant"), Attr::u32(2, 1), Attr::u32(3, 2), Attr::u32(5, 0)],
+        vec![Attr::string(1, "host_grant"), Attr::u32(2, 1), Attr::u32(5, 1)],
     ] {
         assert_ne!(rule_identity(&lookup(changed)).unwrap(), identity);
     }
     for invalid in [
-        vec![Attr::string(1, "host_grant"), Attr::u32(2, 1), Attr::u32(5, 1)],
+        vec![Attr::string(1, "host_grant"), Attr::u32(2, 1), Attr::u32(5, 2)],
         vec![Attr::string(1, "host_grant"), Attr::u32(2, 1)],
-        vec![Attr::string(1, "host_grant"), Attr::u32(2, 1), Attr::u32(3, 2), Attr::u32(5, 0)],
+        vec![Attr::string(1, "host_grant"), Attr::u32(2, 1), Attr::u32(3, 2)],
+        // A map lookup is never inverted.
+        vec![Attr::string(1, "host_grant"), Attr::u32(2, 1), Attr::u32(3, 2), Attr::u32(5, 1)],
     ] {
         assert!(rule_identity(&lookup(invalid)).is_err());
     }