@push.rocks/smartnftables 2.6.0 → 4.0.0

package/rust/src/owner_scale_traffic_tests.rs

@@ -0,0 +1,383 @@
+//! A 64-workload router: every workload with local DNS, public TCP and UDP
+//! egress, four platform endpoints and a publication, the first with the SIP
+//! shape, applied in one batch and proven on first, middle and last workloads.
+use super::egress_traffic_tests::{allocation, binding, connect, denied, ns_ip, roundtrip};
+use super::host_traffic_tests::{control, published_udp};
+use super::*;
+use crate::egress;
+use serde_json::{json, Value};
+use std::io::{Read, Write};
+use std::net::{TcpListener, TcpStream, UdpSocket};
+use std::time::Duration;
+
+const WORKLOADS: u32 = 64;
+const ROUTER: &str = "sc_router";
+const HOST: &str = "sc_host";
+const PEER: &str = "sc_peer";
+/// The proven workloads: first, middle and last.
+const PROBED: [u32; 3] = [0, 31, 63];
+
+fn workload(index: u32) -> String {
+    format!("sc_w{index}")
+}
+fn socket_at(namespace: &str, address: String) -> UdpSocket {
+    let socket = in_namespace(namespace, move || UdpSocket::bind(address).unwrap());
+    socket
+        .set_read_timeout(Some(Duration::from_millis(250)))
+        .unwrap();
+    socket
+}
+/// Four platform endpoints on the peer, beside the protected prefixes.
+fn protection() -> Value {
+    json!({"authorityDigest":format!("sha256:{}","b".repeat(64)),"prefixes":["10.0.0.0/8","192.0.2.0/24"],
+        "platformEndpoints":[{"id":"dns","address":"192.0.2.3","protocol":"udp","port":5300},
+            {"id":"mail","address":"192.0.2.3","protocol":"tcp","port":3000},
+            {"id":"metrics","address":"192.0.2.3","protocol":"tcp","port":9100},
+            {"id":"registry","address":"192.0.2.3","protocol":"udp","port":5301}]})
+}
+/// Publication `index`: one TCP port per workload, and the SIP shape on the
+/// first.
+fn publications(router: bool) -> Vec<Value> {
+    let entry = |protocol: &str,
+                 port: u16,
+                 end: Option<u16>,
+                 endpoint: u16,
+                 address: String,
+                 symmetric: bool| {
+        let mut value = if router {
+            json!({"protocol":protocol,"transitPort":port,"endpointPort":endpoint,
+                "endpointAddress":address,"transitSourceAddress":"10.240.0.2","symmetric":symmetric})
+        } else {
+            json!({"protocol":protocol,"hostPort":port,"targetPort":port,
+                "targetAddress":"10.240.0.2","hostIp":"192.0.2.2","symmetric":symmetric})
+        };
+        if let Some(end) = end {
+            value[if router {
+                "transitPortEnd"
+            } else {
+                "hostPortEnd"
+            }] = json!(end);
+        }
+        value
+    };
+    let mut result = vec![
+        entry("udp", 5070, None, 5070, "10.241.0.2".into(), true),
+        entry("tcp", 5070, None, 5070, "10.241.0.2".into(), true),
+        entry("udp", 20000, Some(20200), 20000, "10.241.0.2".into(), true),
+    ];
+    for index in 0..WORKLOADS {
+        let port = 30000 + index as u16;
+        result.push(entry(
+            "tcp",
+            port,
+            None,
+            if router { 8080 } else { port },
+            format!("10.241.{index}.2"),
+            false,
+        ));
+    }
+    result
+}
+fn router_policy() -> egress::Policy {
+    let mut endpoints = Vec::new();
+    let mut links = Vec::new();
+    let mut rules = Vec::new();
+    let mut grants = Vec::new();
+    for index in 0..WORKLOADS {
+        let name = format!("w{index}");
+        let gateway = format!("10.241.{index}.1");
+        let address = format!("10.241.{index}.2");
+        let link = binding(&name, &gateway, "veth");
+        endpoints.push(
+            json!({"id":name,"interfaceIndex":link["interfaceIndex"],"interfaceName":name,
+            "interfaceKind":"veth","sourcePrefixes":[format!("{address}/32")]}),
+        );
+        links.push(link);
+        for protocol in ["tcp", "udp"] {
+            rules.push(json!({"sourceEndpoint":name,"destinationEndpoint":null,
+                "sourcePrefix":format!("{address}/32"),"destinationPrefix":format!("{gateway}/32"),
+                "protocol":protocol,"sourcePort":null,"destinationPort":53}));
+            rules.push(json!({"sourceEndpoint":null,"destinationEndpoint":name,
+                "sourcePrefix":format!("{gateway}/32"),"destinationPrefix":format!("{address}/32"),
+                "protocol":protocol,"sourcePort":53,"destinationPort":null}));
+            let range = if protocol == "udp" {
+                (10000, 10015)
+            } else {
+                (10016, 10031)
+            };
+            grants.push(
+                json!({"sourceEndpoint":name,"sourcePrefix":format!("{address}/32"),
+                "destination":{"kind":"public","prefix":"0.0.0.0/0"},"protocol":protocol,
+                "sourcePort":null,"destinationPort":null,
+                "sourcePortRange":{"first":range.0,"last":range.1}}),
+            );
+        }
+        for (id, protocol, port) in [
+            ("dns", "udp", 5300),
+            ("mail", "tcp", 3000),
+            ("metrics", "tcp", 9100),
+            ("registry", "udp", 5301),
+        ] {
+            let range = if protocol == "udp" {
+                (10000, 10015)
+            } else {
+                (10016, 10031)
+            };
+            grants.push(
+                json!({"sourceEndpoint":name,"sourcePrefix":format!("{address}/32"),
+                "destination":{"kind":"platform","endpointId":id},"protocol":protocol,
+                "sourcePort":null,"destinationPort":port,
+                "sourcePortRange":{"first":range.0,"last":range.1}}),
+            );
+        }
+    }
+    let mut generation = allocation();
+    generation["conntrackZone"] = json!(17);
+    generation["conntrackLabel"] = json!("a".repeat(32));
+    generation["grants"] = json!(grants);
+    serde_json::from_value(json!({"schemaVersion":2,"revision":1,"scope":{"kind":"routerEgress",
+        "endpoints":endpoints,"rules":rules,"links":links,"handoff":binding("handoff","10.240.0.2","veth"),
+        "protection":protection(),"generations":[generation],"publishedPorts":publications(true)}}))
+    .unwrap()
+}
+fn host_policy() -> egress::Policy {
+    let mut value = egress::tests::host();
+    value["scope"]["protection"] = protection();
+    value["scope"]["handoffs"][0]["link"] = binding("router", "10.240.0.1", "veth");
+    value["scope"]["handoffs"][0]["allocations"] = json!([allocation()]);
+    value["scope"]["uplink"] = binding("uplink", "192.0.2.2", "veth");
+    value["scope"]["publishedPorts"] = json!(publications(false));
+    serde_json::from_value(value).unwrap()
+}
+fn apply(
+    namespace: &str,
+    name: &'static str,
+    policy: fn() -> egress::Policy,
+) -> (Owner, Applied, usize, Vec<(String, usize)>) {
+    in_namespace(namespace, move || {
+        let mut owner = Owner::new(options(name)).unwrap();
+        let target: Prepared = policy().prepare().unwrap().into();
+        target.validate_interfaces().expect("scale fixture binding");
+        let applied = owner
+            .reconcile(Transition {
+                previous: None,
+                target,
+            })
+            .unwrap();
+        assert!(owner.inspect().enforced);
+        let graph = owner.graph().unwrap().expect("owned table present");
+        let sets = graph
+            .sets
+            .iter()
+            .map(|(attributes, elements)| (wire::text(attributes, 2).unwrap(), elements.len()))
+            .collect();
+        (owner, applied, graph.rules.len(), sets)
+    })
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn v2_sixty_four_workload_router_enforces_every_workload_from_set_elements() {
+    isolated();
+    for name in [ROUTER, HOST, PEER] {
+        ip(&["netns", "add", name]);
+        ns_ip(name, &["link", "set", "lo", "up"]);
+        in_namespace(name, || {
+            std::fs::write("/proc/sys/net/ipv4/ip_forward", "1").unwrap()
+        });
+    }
+    for index in 0..WORKLOADS {
+        let name = workload(index);
+        ip(&["netns", "add", &name]);
+        connect(
+            &name,
+            "client",
+            &format!("10.241.{index}.2/24"),
+            ROUTER,
+            &format!("w{index}"),
+            &format!("10.241.{index}.1/24"),
+        );
+        ns_ip(
+            &name,
+            &[
+                "route",
+                "add",
+                "default",
+                "via",
+                &format!("10.241.{index}.1"),
+            ],
+        );
+    }
+    connect(
+        ROUTER,
+        "handoff",
+        "10.240.0.2/30",
+        HOST,
+        "router",
+        "10.240.0.1/30",
+    );
+    connect(
+        HOST,
+        "uplink",
+        "192.0.2.2/24",
+        PEER,
+        "underlay",
+        "192.0.2.3/24",
+    );
+    ns_ip(ROUTER, &["route", "add", "default", "via", "10.240.0.1"]);
+    ns_ip(
+        HOST,
+        &["route", "add", "10.241.0.0/16", "via", "10.240.0.2"],
+    );
+    ns_ip(
+        HOST,
+        &["route", "add", "203.0.113.2/32", "via", "192.0.2.3"],
+    );
+    ns_ip(PEER, &["address", "add", "203.0.113.2/32", "dev", "lo"]);
+    ns_ip(PEER, &["route", "add", "default", "via", "192.0.2.2"]);
+    // Positive controls before any policy: a workload reaches another workload,
+    // the protected peer address, and the peer with another workload's source.
+    let neighbour = socket_at(&workload(1), "10.241.1.2:8081".into());
+    let protected_peer = socket_at(PEER, "192.0.2.3:40300".into());
+    let spoof_target = socket_at(PEER, "203.0.113.2:42100".into());
+    control(
+        &socket_at(&workload(0), "10.241.0.2:40400".into()),
+        "10.241.1.2:8081",
+        &neighbour,
+        true,
+    );
+    control(
+        &socket_at(&workload(0), "10.241.0.2:40401".into()),
+        "192.0.2.3:40300",
+        &protected_peer,
+        true,
+    );
+    ns_ip(
+        &workload(0),
+        &["address", "add", "10.241.1.99/32", "dev", "client"],
+    );
+    control(
+        &socket_at(&workload(0), "10.241.1.99:40402".into()),
+        "203.0.113.2:42100",
+        &spoof_target,
+        true,
+    );
+    let (host_owner, host_applied, _, _) = apply(HOST, "scale_host", host_policy);
+    let (router_owner, router_applied, router_rules, router_sets) =
+        apply(ROUTER, "scale_router", router_policy);
+    // Every workload is set elements: links, endpoint indices and names, source
+    // prefixes, the four DNS rules each, and six leased grants each.
+    let named = |name: &str| {
+        router_sets
+            .iter()
+            .find(|(set, _)| set == name)
+            .map(|(_, count)| *count)
+    };
+    assert_eq!(named("private_link"), Some(WORKLOADS as usize + 1));
+    assert_eq!(named("private_source"), Some(WORKLOADS as usize));
+    assert_eq!(named("private_port"), Some(WORKLOADS as usize * 4));
+    assert_eq!(named("leased_public_flow"), Some(WORKLOADS as usize * 2));
+    assert_eq!(named("leased_platform_flow"), Some(WORKLOADS as usize * 4));
+    assert_eq!(named("published_forward"), Some(WORKLOADS as usize + 3));
+    // The rule graph a single workload compiles, independent of the count.
+    assert!(router_rules < 100, "{router_rules}");
+    let public = socket_at(PEER, "203.0.113.2:42000".into());
+    let platform = socket_at(PEER, "192.0.2.3:5300".into());
+    let registry = socket_at(PEER, "192.0.2.3:5301".into());
+    let metrics = in_namespace(PEER, || TcpListener::bind("192.0.2.3:9100").unwrap());
+    for index in PROBED {
+        let name = workload(index);
+        let address = format!("10.241.{index}.2");
+        // Local DNS on the workload's own gateway.
+        let dns = socket_at(ROUTER, format!("10.241.{index}.1:53"));
+        let client = socket_at(&name, format!("{address}:40001"));
+        assert_eq!(
+            roundtrip(&client, &dns).to_string(),
+            format!("{address}:40001")
+        );
+        // Public egress through both hops from the leased range.
+        let outer = roundtrip(&socket_at(&name, format!("{address}:40002")), &public);
+        assert_eq!(outer.ip().to_string(), "192.0.2.2");
+        assert!((10000..=10015).contains(&outer.port()), "{outer}");
+        // Two platform endpoints over UDP and one over TCP.
+        for target in [&platform, &registry] {
+            let outer = roundtrip(&socket_at(&name, format!("{address}:40003")), target);
+            assert_eq!(outer.ip().to_string(), "192.0.2.2");
+        }
+        let mut stream = in_namespace(&name, || {
+            TcpStream::connect_timeout(&"192.0.2.3:9100".parse().unwrap(), Duration::from_secs(1))
+        })
+        .expect("platform tcp opening");
+        let (mut served, peer) = metrics.accept().unwrap();
+        assert_eq!(peer.ip().to_string(), "192.0.2.2");
+        assert!((10016..=10031).contains(&peer.port()));
+        stream
+            .set_read_timeout(Some(Duration::from_secs(1)))
+            .unwrap();
+        served.write_all(b"pong").unwrap();
+        stream.read_exact(&mut [0; 4]).unwrap();
+        // The workload's publication, with the client address preserved.
+        let listener = in_namespace(&name, move || {
+            TcpListener::bind(format!("10.241.{index}.2:8080")).unwrap()
+        });
+        let mut inbound = in_namespace(PEER, move || {
+            TcpStream::connect_timeout(
+                &format!("192.0.2.2:{}", 30000 + index).parse().unwrap(),
+                Duration::from_secs(1),
+            )
+        })
+        .expect("published tcp opening");
+        let (mut accepted, client) = listener.accept().unwrap();
+        assert_eq!(client.ip().to_string(), "192.0.2.3");
+        accepted.write_all(b"pong").unwrap();
+        inbound
+            .set_read_timeout(Some(Duration::from_secs(1)))
+            .unwrap();
+        inbound.read_exact(&mut [0; 4]).unwrap();
+        // Nothing unnamed: another workload, a protected address outside the
+        // platform endpoints, and a platform port that is not granted.
+        denied(
+            &socket_at(&name, format!("{address}:40005")),
+            &neighbour,
+            false,
+        );
+        denied(
+            &socket_at(&name, format!("{address}:40006")),
+            &protected_peer,
+            false,
+        );
+        let ungranted = socket_at(PEER, format!("192.0.2.3:{}", 5400 + index));
+        denied(
+            &socket_at(&name, format!("{address}:40007")),
+            &ungranted,
+            false,
+        );
+    }
+    // The first workload's SIP publication leaves from its own port.
+    let sip = socket_at(&workload(0), "10.241.0.2:5070".into());
+    let sip_peer = socket_at(PEER, "203.0.113.2:42002".into());
+    assert_eq!(roundtrip(&sip, &sip_peer).to_string(), "192.0.2.2:5070");
+    published_udp(
+        &socket_at(PEER, "192.0.2.3:40500".into()),
+        &socket_at(&workload(0), "10.241.0.2:20100".into()),
+        "192.0.2.2:20100",
+        "192.0.2.3:40500",
+    );
+    // Another workload's source address stays behind the anti-spoof guard.
+    denied(
+        &socket_at(&workload(0), "10.241.1.99:40403".into()),
+        &spoof_target,
+        false,
+    );
+    in_namespace(ROUTER, move || {
+        let mut owner = router_owner;
+        assert!(owner.inspect().enforced);
+        owner.release(router_applied).unwrap();
+    });
+    in_namespace(HOST, move || {
+        let mut owner = host_owner;
+        assert!(owner.inspect().enforced);
+        owner.release(host_applied).unwrap();
+    });
+    println!("V2_SCALE_PROOF workloads=64 router_rules={router_rules} set_elements_verified=true private_dns=true public_egress=true platform_udp=true platform_tcp=true published_inbound=true client_address_preserved=true cross_workload_denied=true protected_denied=true ungranted_platform_port_denied=true symmetric_sip=true published_range=true spoof_denied=true positive_controls=true released=true");
+}

package/rust/src/owner_tests.rs

@@ -24,6 +24,12 @@ mod host_traffic_tests;
 #[path = "owner_router_traffic_tests.rs"]
 mod router_traffic_tests;
 
+#[path = "owner_publishedrange_traffic_tests.rs"]
+mod publishedrange_traffic_tests;
+
+#[path = "owner_scale_traffic_tests.rs"]
+mod scale_traffic_tests;
+
 #[path = "owner_poolguard_tests.rs"]
 mod poolguard_tests;
 

package/rust/src/policy.rs

@@ -90,15 +90,37 @@ fn covers(parent: &str, child: &str) -> Result<bool> {
 }
 
 impl Policy {
-    pub fn prepare(mut self) -> Result<Prepared> {
-        if self.schema_version != 1
-            || self.revision == 0
-            || self.revision > 9_007_199_254_740_991
-            || self.endpoints.len() > 32
-            || self.rules.len() > 128
-        {
+    pub fn prepare(self) -> Result<Prepared> {
+        let policy = self.normalize(32, 128)?;
+        let digest = format!(
+            "sha256:{:x}",
+            Sha256::digest(serde_json::to_vec(&policy).map_err(|_| Error::Invalid)?)
+        );
+        let prepared = Prepared { policy, digest };
+        // Compile during preparation; an oversized native batch never reaches the kernel.
+        let program = prepared.program(&format!("snft_{}", "x".repeat(59)))?;
+        // Reserve enough of the batch for deleting a previous maximum
+        // graph, then installing this complete graph in the same transaction.
+        crate::capacity("operations", 768, program.len())?;
+        crate::capacity(
+            "ruleBytes",
+            100_000,
+            program
+                .iter()
+                .map(|(_, attrs)| wire::encode_attrs(attrs).len() + 20)
+                .sum(),
+        )?;
+        Ok(prepared)
+    }
+    /// Validates and orders the endpoints and rules. Schema v1 compiles one rule
+    /// per endpoint and grant, so it admits 32 endpoints and 128 rules; the
+    /// set-backed router scope of schema v2 admits more.
+    pub(crate) fn normalize(mut self, endpoints: usize, rules: usize) -> Result<Self> {
+        if self.schema_version != 1 || self.revision == 0 || self.revision > 9_007_199_254_740_991 {
             return Err(Error::Invalid);
         }
+        crate::capacity("endpoints", endpoints, self.endpoints.len())?;
+        crate::capacity("rules", rules, self.rules.len())?;
         let mut ids = BTreeSet::new();
         let mut indices = BTreeSet::new();
         let mut names = BTreeSet::new();
@@ -185,28 +207,7 @@ impl Policy {
                 }
             }
         }
-        let digest = format!(
-            "sha256:{:x}",
-            Sha256::digest(serde_json::to_vec(&self).map_err(|_| Error::Invalid)?)
-        );
-        let prepared = Prepared {
-            policy: self,
-            digest,
-        };
-        // Compile during preparation; an oversized native batch never reaches the kernel.
-        let program = prepared.program(&format!("snft_{}", "x".repeat(59)))?;
-        // Reserve enough of the batch for deleting a previous maximum
-        // graph, then installing this complete graph in the same transaction.
-        if program.len() > 768
-            || program
-                .iter()
-                .map(|(_, attrs)| wire::encode_attrs(attrs).len() + 20)
-                .sum::<usize>()
-                > 100_000
-        {
-            return Err(Error::Invalid);
-        }
-        Ok(prepared)
+        Ok(self)
     }
 }
 

package/rust/src/tests.rs

@@ -117,3 +117,103 @@ fn compiler_bounds_full_policy_and_keeps_directed_port_grants() {
     value.revision = 9_007_199_254_740_992;
     assert_eq!(value.prepare(), Err(Error::Invalid));
 }
+
+fn exhausted<T>(name: &'static str, limit: usize, actual: usize) -> crate::Result<T> {
+    Err(Error::Exhausted(crate::Bound {
+        name,
+        limit,
+        actual,
+    }))
+}
+
+/// Every endpoint with 16 prefixes and `rules` distinct directed rules between
+/// them: well-formed input whose only fault can be its size.
+fn sized(endpoints: u32, rules: u16) -> Policy {
+    let mut value = policy();
+    let template = value.endpoints[0].clone();
+    value.endpoints = (0..endpoints)
+        .map(|index| {
+            let mut endpoint = template.clone();
+            endpoint.id = format!("e{index}");
+            endpoint.interface_index = 10 + index;
+            endpoint.interface_name = format!("w{index}");
+            endpoint.source_prefixes = (0..16)
+                .map(|part| format!("10.{}.{part}.0/24", 100 + index))
+                .collect();
+            endpoint
+        })
+        .collect();
+    let template = value.rules[0].clone();
+    value.rules = (0..rules)
+        .map(|index| {
+            let (from, to) = (
+                u32::from(index) % endpoints,
+                (u32::from(index) + 1) % endpoints,
+            );
+            let mut rule = template.clone();
+            rule.source_endpoint = Some(format!("e{from}"));
+            rule.destination_endpoint = Some(format!("e{to}"));
+            rule.source_prefix = format!("10.{}.0.0/24", 100 + from);
+            rule.destination_prefix = format!("10.{}.0.0/24", 100 + to);
+            rule.destination_port = Some(1000 + index);
+            rule
+        })
+        .collect();
+    value
+}
+
+#[test]
+fn v1_capacity_refusals_name_their_bound_and_invalid_input_stays_invalid() {
+    assert_eq!(sized(2, 2).prepare().map(|_| ()), Ok(()));
+    // Within the schema's counts, the complete graph exceeds the byte and the
+    // operation budget; the complete program is measured, so both are exact.
+    assert_eq!(
+        sized(8, 16).prepare(),
+        exhausted("ruleBytes", 100_000, 186_952)
+    );
+    assert_eq!(sized(32, 128).prepare(), exhausted("operations", 768, 1667));
+    assert_eq!(sized(33, 16).prepare(), exhausted("endpoints", 32, 33));
+    assert_eq!(sized(8, 129).prepare(), exhausted("rules", 128, 129));
+    // Invalid input is never reported as capacity, whatever its size.
+    let mut value = sized(33, 129);
+    value.schema_version = 2;
+    assert_eq!(value.prepare(), Err(Error::Invalid));
+    let mut value = sized(2, 2);
+    value.endpoints[0].interface_name = "w".repeat(16);
+    assert_eq!(value.prepare(), Err(Error::Invalid));
+    let mut value = sized(2, 2);
+    value.endpoints[0]
+        .source_prefixes
+        .push("10.200.0.0/24".into());
+    assert_eq!(value.prepare(), Err(Error::Invalid));
+}
+
+#[test]
+fn failure_responses_carry_the_refusal_reason_and_capacity_bound() {
+    let bound = crate::Bound {
+        name: "targetBytes",
+        limit: 212_000,
+        actual: 212_345,
+    };
+    assert_eq!(
+        crate::failure("7", Error::Exhausted(bound)),
+        serde_json::json!({"id":"7","success":false,
+            "error":"Managed policy exceeds the targetBytes capacity of 212000: it reached 212345.",
+            "errorCode":"EXHAUSTED","errorData":{"bound":"targetBytes","limit":212_000,"actual":212_345}})
+    );
+    assert_eq!(
+        crate::failure("8", Error::Invalid),
+        serde_json::json!({"id":"8","success":false,"error":"Managed policy input is invalid.","errorCode":"INVALID"})
+    );
+    for error in [
+        Error::Conflict,
+        Error::Permission,
+        Error::Protocol,
+        Error::Unavailable,
+    ] {
+        assert_eq!(
+            crate::failure("9", error),
+            serde_json::json!({"id":"9","success":false,"error":"Managed policy operation failed.","errorCode":error.code()})
+        );
+    }
+}

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartnftables',
-  version: '2.6.0',
+  version: '4.0.0',
   description: 'A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.'
 }

package/ts/classes.manageddockerforwarding.ts

@@ -1,5 +1,5 @@
 import * as plugins from './plugins.js';
-import { snapshot, managedIpcBytes, ManagedNftablesError } from './classes.managednftables.js';
+import { snapshot, managedIpcBytes, ManagedNftablesError, nativeError } from './classes.managednftables.js';
 import type { IManagedDockerForwardingOptions, IManagedDockerForwardingStatus, IManagedDockerForwardingPolicy, IPreparedManagedDockerForwardingPolicy, IManagedDockerForwardingTransition, IAppliedManagedDockerForwardingPolicy, TManagedDockerForwardingCommands } from './managed.docker.types.js';
 
 /** One node-level Docker DOCKER-USER contribution. Caller owns durable intents and handoff lifetimes. */
@@ -103,8 +103,7 @@ export class ManagedDockerForwarding {
   #track<T>(work: Promise<T>): Promise<T> {
     const owned = work.catch((error) => {
       if (this.#state !== 'closing') this.#state = 'failed-owned';
-      const code = error instanceof plugins.smartrust.RustBridgeRequestError ? error.responseErrorCode : undefined;
-      throw new ManagedNftablesError(typeof code === 'string' && /^[A-Z_]{1,64}$/.test(code) ? code : 'UNAVAILABLE');
+      throw nativeError(error);
     });
     this.#work = owned;
     void owned.then(() => { this.#work = null; }, () => { this.#work = null; });