@push.rocks/smartnftables 2.6.0 → 4.0.0

package/rust/src/egress.keys.rs

@@ -0,0 +1,305 @@
+//! Concatenated set keys shared by every set-backed part of the compiled graph:
+//! the loads that build a key in consecutive 32-bit registers, element bounds
+//! built field by field, the disjoint union the kernel's interval backend needs,
+//! and set declarations that are never created empty.
+use super::hostgrant::{ct_to, lookup, meta_to, payload_to, register};
+use super::*;
+
+/// Field byte lengths. Each field occupies whole 32-bit registers of the key.
+pub(super) const INDEX: u32 = 4;
+pub(super) const NAME: u32 = 16;
+pub(super) const PROTOCOL: u32 = 1;
+pub(super) const ADDRESS: u32 = 4;
+pub(super) const PORT: u32 = 2;
+pub(super) const ZONE: u32 = 2;
+pub(super) const LABEL: u32 = 16;
+
+/// Key loads into consecutive 32-bit registers, starting where a lookup reads.
+pub(super) struct Loads {
+    expressions: Vec<Attr>,
+    index: u32,
+}
+impl Loads {
+    pub(super) fn new() -> Self {
+        Self {
+            expressions: Vec::new(),
+            index: 4,
+        }
+    }
+    pub(super) fn push(&mut self, load: impl FnOnce(u32) -> Attr, length: u32) -> &mut Self {
+        self.expressions.push(load(self.index));
+        self.index += length.div_ceil(4);
+        self
+    }
+    /// An interface index; an absent interface loads as index 0.
+    pub(super) fn index(&mut self, incoming: bool) -> &mut Self {
+        self.push(|at| meta_to(if incoming { 4 } else { 5 }, at), INDEX)
+    }
+    /// An interface index and name; an absent interface loads as 0 and "".
+    pub(super) fn link(&mut self, incoming: bool) -> &mut Self {
+        self.index(incoming)
+            .push(|at| meta_to(if incoming { 6 } else { 7 }, at), NAME)
+    }
+    pub(super) fn protocol(&mut self) -> &mut Self {
+        self.push(|at| meta_to(16, at), PROTOCOL)
+    }
+    pub(super) fn protocols(&mut self) -> &mut Self {
+        self.protocol().push(|at| ct_to(10, false, at), PROTOCOL)
+    }
+    pub(super) fn address(&mut self, source: bool) -> &mut Self {
+        self.push(
+            |at| payload_to(1, if source { 12 } else { 16 }, 4, at),
+            ADDRESS,
+        )
+    }
+    pub(super) fn port(&mut self, source: bool) -> &mut Self {
+        self.push(|at| payload_to(2, if source { 0 } else { 2 }, 2, at), PORT)
+    }
+    /// The originally tracked address and port of one side.
+    pub(super) fn original(&mut self, source: bool) -> &mut Self {
+        self.original_address(source).original_port(source)
+    }
+    pub(super) fn original_address(&mut self, source: bool) -> &mut Self {
+        self.push(|at| ct_to(if source { 19 } else { 20 }, true, at), ADDRESS)
+    }
+    pub(super) fn original_port(&mut self, source: bool) -> &mut Self {
+        self.push(|at| ct_to(if source { 11 } else { 12 }, true, at), PORT)
+    }
+    pub(super) fn zone(&mut self) -> &mut Self {
+        self.push(|at| ct_to(17, false, at), ZONE)
+    }
+    pub(super) fn label(&mut self) -> &mut Self {
+        self.push(|at| ct_to(13, false, at), LABEL)
+    }
+    fn finish(&mut self, set: &str, data: bool, invert: bool) -> Vec<Attr> {
+        let mut result = std::mem::take(&mut self.expressions);
+        self.index = 4;
+        let mut expression = lookup(set);
+        if data || invert {
+            let mut fields = vec![Attr::string(1, set), Attr::u32(2, register(4))];
+            if data {
+                // The map's data replaces the key from the first register on.
+                fields.push(Attr::u32(3, register(4)));
+            }
+            fields.push(Attr::u32(5, u32::from(invert)));
+            expression = expr("lookup", fields);
+        }
+        result.push(expression);
+        result
+    }
+    /// Membership of the loaded key.
+    pub(super) fn lookup(&mut self, set: &str) -> Vec<Attr> {
+        self.finish(set, false, false)
+    }
+    /// A map lookup storing the element's data from the first key register on.
+    pub(super) fn map(&mut self, set: &str) -> Vec<Attr> {
+        self.finish(set, true, false)
+    }
+    /// Absence of the loaded key.
+    pub(super) fn absent(&mut self, set: &str) -> Vec<Attr> {
+        self.finish(set, false, true)
+    }
+}
+/// Stores `length` bytes of map data from the first key register into a
+/// conntrack key: the zone (17) or the label (13).
+pub(super) fn set_ct_from_data(key: u32) -> Attr {
+    expr("ct", vec![Attr::u32(2, key), Attr::u32(4, register(4))])
+}
+
+pub(super) fn word(bytes: &[u8]) -> Vec<u8> {
+    let mut result = bytes.to_vec();
+    result.resize(bytes.len().div_ceil(4) * 4, 0);
+    result
+}
+/// Element bounds built field by field: an exact field repeats in both bounds.
+#[derive(Default)]
+pub(super) struct Key {
+    first: Vec<u8>,
+    last: Vec<u8>,
+}
+impl Key {
+    pub(super) fn exact(self, bytes: &[u8]) -> Self {
+        self.range(bytes, bytes)
+    }
+    pub(super) fn range(mut self, first: &[u8], last: &[u8]) -> Self {
+        self.first.extend(word(first));
+        self.last.extend(word(last));
+        self
+    }
+    pub(super) fn span(self, first: u16, last: u16) -> Self {
+        self.range(&first.to_be_bytes(), &last.to_be_bytes())
+    }
+    /// One port, or every port for none.
+    pub(super) fn port(self, port: Option<u16>) -> Self {
+        match port {
+            Some(port) => self.span(port, port),
+            None => self.span(0, u16::MAX),
+        }
+    }
+    pub(super) fn index(self, index: u32) -> Self {
+        self.exact(&index.to_ne_bytes())
+    }
+    pub(super) fn link(self, link: &LocalLink) -> Self {
+        self.index(link.interface_index).name(&link.interface_name)
+    }
+    pub(super) fn name(self, name: &str) -> Self {
+        let mut bytes = name.as_bytes().to_vec();
+        bytes.resize(16, 0);
+        self.exact(&bytes)
+    }
+    pub(super) fn protocol(self, name: &str) -> Self {
+        self.exact(&[protocol(name)])
+    }
+    pub(super) fn protocols(self, name: &str) -> Self {
+        self.protocol(name).protocol(name)
+    }
+    pub(super) fn address(self, address: &str) -> Result<Self> {
+        Ok(self.exact(&super::super::address(address)?.to_be_bytes()))
+    }
+    /// Every address of a canonical prefix.
+    pub(super) fn prefix(self, value: &str) -> Result<Self> {
+        let (address, mask) = super::super::prefix(value)?;
+        Ok(self.range(&address.to_be_bytes(), &(address | !mask).to_be_bytes()))
+    }
+    pub(super) fn zone(self, zone: u16) -> Self {
+        self.exact(&zone.to_ne_bytes())
+    }
+    pub(super) fn element(self, data: Option<Vec<u8>>) -> IntervalElement {
+        IntervalElement {
+            first: self.first,
+            last: self.last,
+            data,
+        }
+    }
+}
+
+/// The byte range of each field inside the padded key.
+fn layout(fields: &[u32]) -> Vec<std::ops::Range<usize>> {
+    let mut at = 0;
+    fields
+        .iter()
+        .map(|length| {
+            let range = at..at + *length as usize;
+            at += length.div_ceil(4) as usize * 4;
+            range
+        })
+        .collect()
+}
+fn overlaps(layout: &[std::ops::Range<usize>], a: &IntervalElement, b: &IntervalElement) -> bool {
+    layout.iter().all(|field| {
+        a.first[field.clone()] <= b.last[field.clone()]
+            && b.first[field.clone()] <= a.last[field.clone()]
+    })
+}
+/// Big-endian successor and predecessor of a field value; only called strictly
+/// inside a range, so they never wrap.
+fn step(value: &mut [u8], up: bool) {
+    for byte in value.iter_mut().rev() {
+        if up {
+            let (next, carry) = byte.overflowing_add(1);
+            *byte = next;
+            if !carry {
+                return;
+            }
+        } else {
+            let (next, borrow) = byte.overflowing_sub(1);
+            *byte = next;
+            if !borrow {
+                return;
+            }
+        }
+    }
+}
+/// `a` without `b`, as disjoint pieces; `a` and `b` overlap.
+fn subtract(
+    layout: &[std::ops::Range<usize>],
+    mut a: IntervalElement,
+    b: &IntervalElement,
+) -> Vec<IntervalElement> {
+    let mut pieces = Vec::new();
+    for field in layout {
+        if a.first[field.clone()] < b.first[field.clone()] {
+            let mut piece = a.clone();
+            piece.last[field.clone()].copy_from_slice(&b.first[field.clone()]);
+            step(&mut piece.last[field.clone()], false);
+            pieces.push(piece);
+            a.first[field.clone()].copy_from_slice(&b.first[field.clone()]);
+        }
+        if a.last[field.clone()] > b.last[field.clone()] {
+            let mut piece = a.clone();
+            piece.first[field.clone()].copy_from_slice(&b.last[field.clone()]);
+            step(&mut piece.first[field.clone()], true);
+            pieces.push(piece);
+            a.last[field.clone()].copy_from_slice(&b.last[field.clone()]);
+        }
+    }
+    pieces
+}
+/// The union of elements as disjoint elements, which the kernel's interval
+/// backend requires: it detects an overlap only at an element's bounds. Elements
+/// of a map may overlap only where they carry the same data; anything else is a
+/// policy the compiler cannot express and rejects.
+pub(super) fn disjoint(
+    fields: &[u32],
+    mut elements: Vec<IntervalElement>,
+) -> Result<Vec<IntervalElement>> {
+    let layout = layout(fields);
+    elements.sort();
+    let mut result: Vec<IntervalElement> = Vec::new();
+    for element in elements {
+        let mut pieces = vec![element];
+        for existing in &result {
+            let mut next = Vec::new();
+            for piece in pieces {
+                if !overlaps(&layout, &piece, existing) {
+                    next.push(piece);
+                    continue;
+                }
+                require(piece.data == existing.data)?;
+                next.extend(subtract(&layout, piece, existing));
+            }
+            pieces = next;
+        }
+        result.extend(pieces);
+    }
+    result.sort();
+    Ok(result)
+}
+/// An interval set or map with its disjoint elements; an empty one is never
+/// created, so a scope without such entries compiles neither it nor its rules.
+/// Returns whether the set exists.
+pub(super) fn interval(
+    program: &mut Program<'_>,
+    name: &str,
+    id: u32,
+    fields: &[u32],
+    data: Option<u32>,
+    elements: Vec<IntervalElement>,
+) -> Result<bool> {
+    if elements.is_empty() {
+        return Ok(false);
+    }
+    let elements = disjoint(fields, elements)?;
+    program.interval_set(name, id, fields, data)?;
+    program.interval_elements(name, elements)?;
+    Ok(true)
+}
+/// An exact-key hash set or map; like `interval`, never created empty.
+pub(super) fn exact(
+    program: &mut Program<'_>,
+    name: &str,
+    id: u32,
+    key_length: u32,
+    data: Option<u32>,
+    mut elements: Vec<(Vec<u8>, Option<Vec<u8>>)>,
+) -> Result<bool> {
+    if elements.is_empty() {
+        return Ok(false);
+    }
+    elements.sort();
+    elements.dedup();
+    require(elements.windows(2).all(|pair| pair[0].0 != pair[1].0))?;
+    program.exact_set(name, id, key_length, data)?;
+    program.exact_elements(name, elements)?;
+    Ok(true)
+}

package/rust/src/egress.leased.rs

@@ -0,0 +1,399 @@
+//! Leased egress grants compile to a constant number of rules around interval
+//! maps, so the rule graph does not grow with grants or generations. Platform
+//! and public grants keep separate maps because their rules sit on either side of
+//! the protected barrier. Each map carries every operand the per-grant rules
+//! compared: the workload link index (0 for the router itself, whose name the
+//! rules prove through `private_link`), the protocols, the live and originally
+//! tracked tuple and the generation's conntrack zone. Generation labels live in
+//! two exact sets, so a label alone never authorizes a changed grant.
+use super::keys::{self, Key, Loads, ADDRESS, INDEX, LABEL, PORT, PROTOCOL, ZONE};
+use super::private::known;
+use super::*;
+
+const LABEL_SET: &str = "leased_label";
+const GENERATION_MAP: &str = "leased_generation";
+const RETURN: [u32; 5] = [PROTOCOL, ADDRESS, ADDRESS, PORT, PORT];
+
+/// Platform grants precede the protected barrier and public grants follow it.
+#[derive(Clone, Copy, PartialEq, Eq)]
+pub(super) enum Kind {
+    Platform,
+    Public,
+}
+impl Kind {
+    fn of(grant: &Grant) -> Self {
+        match grant.destination {
+            Destination::Platform { .. } => Self::Platform,
+            Destination::Public { .. } => Self::Public,
+        }
+    }
+    fn label(self) -> &'static str {
+        if self == Self::Platform {
+            "platform"
+        } else {
+            "public"
+        }
+    }
+    fn returns(self) -> String {
+        format!("leased_{}_return", self.label())
+    }
+}
+/// The maps of one kind split by whether their grants name a source port: a
+/// grant without one matches every source port, so its keys carry no source
+/// port field at all, and a platform grant's key is then exact. A shape's maps
+/// and rules exist only while it has grants.
+#[derive(Clone, Copy, PartialEq, Eq)]
+struct Shape {
+    kind: Kind,
+    sourced: bool,
+}
+impl Shape {
+    fn of(grant: &Grant) -> Self {
+        Self {
+            kind: Kind::of(grant),
+            sourced: grant.source_port.is_some(),
+        }
+    }
+    fn all(kind: Kind) -> [Self; 2] {
+        [false, true].map(|sourced| Self { kind, sourced })
+    }
+    fn name(self, part: &str) -> String {
+        format!(
+            "leased_{}{}_{part}",
+            self.kind.label(),
+            if self.sourced { "_sourced" } else { "" }
+        )
+    }
+    fn id(self, part: u32) -> u32 {
+        48 + part * 4 + u32::from(self.kind == Kind::Public) * 2 + u32::from(self.sourced)
+    }
+    /// A source port field only where the grants name one, then the
+    /// destination port.
+    fn ports(self) -> Vec<u32> {
+        if self.sourced {
+            vec![PORT, PORT]
+        } else {
+            vec![PORT]
+        }
+    }
+    fn classification(self) -> Vec<u32> {
+        let mut fields = vec![INDEX, PROTOCOL, ADDRESS, ADDRESS];
+        fields.extend(self.ports());
+        fields
+    }
+    fn flow(self) -> Vec<u32> {
+        let mut fields = vec![INDEX, PROTOCOL, PROTOCOL, ADDRESS, ADDRESS];
+        fields.extend(self.ports());
+        fields.extend([ADDRESS, ADDRESS]);
+        fields.extend(self.ports());
+        fields.push(ZONE);
+        fields
+    }
+    fn key_ports(self, key: Key, grant: &Grant) -> Key {
+        let key = if self.sourced {
+            key.port(grant.source_port)
+        } else {
+            key
+        };
+        key.port(grant.destination_port)
+    }
+    /// Live port loads of one direction: the grant's source port where the
+    /// shape names it, then its destination port.
+    fn load_ports(self, loads: &mut Loads, reply: bool) {
+        if self.sourced {
+            loads.port(!reply);
+        }
+        loads.port(reply);
+    }
+    fn load_original_ports(self, loads: &mut Loads) {
+        if self.sourced {
+            loads.original_port(true);
+        }
+        loads.original_port(false);
+    }
+}
+
+fn grants(scope: &RouterScope) -> impl Iterator<Item = (&Generation, &Grant)> {
+    scope.generations.iter().flat_map(|generation| {
+        generation
+            .grants
+            .iter()
+            .map(move |grant| (generation, grant))
+    })
+}
+fn link_index(scope: &RouterScope, grant: &Grant) -> Result<u32> {
+    match &grant.source_endpoint {
+        Some(id) => scope
+            .endpoints
+            .iter()
+            .find(|endpoint| endpoint.id == *id)
+            .map(|endpoint| endpoint.interface_index)
+            .ok_or(Error::Invalid),
+        None => Ok(0),
+    }
+}
+fn zone_word(zone: u16) -> Vec<u8> {
+    let mut word = zone.to_ne_bytes().to_vec();
+    word.resize(4, 0);
+    word
+}
+
+pub(super) fn sets(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
+    if grants(scope).next().is_none() {
+        return Ok(());
+    }
+    let mut labels = Vec::new();
+    let mut generations = Vec::new();
+    for generation in &scope.generations {
+        let label = super::label(generation);
+        let mut key = zone_word(generation.conntrack_zone);
+        key.extend(&label);
+        labels.push((key, None));
+        generations.push((zone_word(generation.conntrack_zone), Some(label)));
+    }
+    keys::exact(program, LABEL_SET, 38, 4 + LABEL, None, labels)?;
+    keys::exact(program, GENERATION_MAP, 39, 4, Some(LABEL), generations)?;
+    for kind in [Kind::Platform, Kind::Public] {
+        let mut returns = Vec::new();
+        for shape in Shape::all(kind) {
+            let (mut classification, mut flows) = (Vec::new(), Vec::new());
+            for (generation, grant) in grants(scope).filter(|(_, grant)| Shape::of(grant) == shape)
+            {
+                let destination = super::super::destination(grant, &scope.protection)?;
+                let zone = generation.conntrack_zone;
+                let zone_data = Some(zone.to_ne_bytes().to_vec());
+                let index = link_index(scope, grant)?;
+                let classified = Key::default()
+                    .index(if index == 0 {
+                        scope.handoff.interface_index
+                    } else {
+                        index
+                    })
+                    .protocol(&grant.protocol)
+                    .prefix(&grant.source_prefix)?
+                    .prefix(&destination)?;
+                classification.push(
+                    shape
+                        .key_ports(classified, grant)
+                        .element(zone_data.clone()),
+                );
+                returns.push(
+                    Key::default()
+                        .protocol(&grant.protocol)
+                        .prefix(&destination)?
+                        .address(&generation.transit_source_address)?
+                        .port(grant.destination_port)
+                        .span(grant.source_port_range.first, grant.source_port_range.last)
+                        .element(zone_data),
+                );
+                let mut translation = super::super::address(&generation.transit_source_address)?
+                    .to_be_bytes()
+                    .to_vec();
+                translation.extend(keys::word(&grant.source_port_range.first.to_be_bytes()));
+                translation.extend(keys::word(&grant.source_port_range.last.to_be_bytes()));
+                let live = Key::default()
+                    .index(index)
+                    .protocols(&grant.protocol)
+                    .prefix(&grant.source_prefix)?
+                    .prefix(&destination)?;
+                let original = shape
+                    .key_ports(live, grant)
+                    .prefix(&grant.source_prefix)?
+                    .prefix(&destination)?;
+                flows.push(
+                    shape
+                        .key_ports(original, grant)
+                        .zone(zone)
+                        .element(Some(translation)),
+                );
+            }
+            keys::interval(
+                program,
+                &shape.name("zone"),
+                shape.id(0),
+                &shape.classification(),
+                Some(ZONE),
+                classification,
+            )?;
+            keys::interval(
+                program,
+                &shape.name("flow"),
+                shape.id(1),
+                &shape.flow(),
+                Some(12),
+                flows,
+            )?;
+        }
+        let id = 48 + 8 + u32::from(kind == Kind::Public);
+        keys::interval(program, &kind.returns(), id, &RETURN, Some(ZONE), returns)?;
+    }
+    Ok(())
+}
+
+fn present(scope: &RouterScope, shape: Shape, local: bool) -> BTreeSet<&str> {
+    grants(scope)
+        .filter(|(_, grant)| Shape::of(grant) == shape && grant.source_endpoint.is_none() == local)
+        .map(|(_, grant)| grant.protocol.as_str())
+        .collect()
+}
+fn zone_from_data() -> Attr {
+    keys::set_ct_from_data(17)
+}
+/// Raw classification into the generation's zone, before conntrack: workload
+/// flows in prerouting by their workload link, router flows in output toward the
+/// handoff, and their translated returns arriving on the handoff.
+pub(super) fn classification(
+    program: &mut Program<'_>,
+    scope: &RouterScope,
+    kind: Kind,
+) -> Result<()> {
+    for shape in Shape::all(kind) {
+        let tuple = |incoming: bool| {
+            let mut loads = Loads::new();
+            loads
+                .index(incoming)
+                .protocol()
+                .address(true)
+                .address(false);
+            shape.load_ports(&mut loads, false);
+            loads
+        };
+        if !present(scope, shape, false).is_empty() {
+            let mut expressions = ipv4();
+            expressions.extend(known(true));
+            expressions.extend(tuple(true).map(&shape.name("zone")));
+            expressions.push(zone_from_data());
+            program.end("raw_in", expressions, 1)?;
+        }
+        if !present(scope, shape, true).is_empty() {
+            let mut expressions = ipv4();
+            expressions.extend(link(&scope.handoff, false));
+            expressions.extend(tuple(false).map(&shape.name("zone")));
+            expressions.push(zone_from_data());
+            program.end("raw_out", expressions, 1)?;
+        }
+    }
+    if grants(scope).any(|(_, grant)| Kind::of(grant) == kind) {
+        let mut expressions = ipv4();
+        expressions.extend(link(&scope.handoff, true));
+        let mut loads = Loads::new();
+        loads
+            .protocol()
+            .address(true)
+            .address(false)
+            .port(true)
+            .port(false);
+        expressions.extend(loads.map(&kind.returns()));
+        expressions.push(zone_from_data());
+        program.end("raw_return", expressions, 1)?;
+    }
+    Ok(())
+}
+/// The flow key of one direction: the grant's source and destination are the
+/// packet's own in the original direction and swapped in the reply; the
+/// originally tracked tuple and the zone follow.
+fn flow(shape: Shape, reply: bool) -> Loads {
+    let mut loads = Loads::new();
+    loads
+        .index(!reply)
+        .protocols()
+        .address(!reply)
+        .address(reply);
+    shape.load_ports(&mut loads, reply);
+    loads.original_address(true).original_address(false);
+    shape.load_original_ports(&mut loads);
+    loads.zone();
+    loads
+}
+fn labelled() -> Vec<Attr> {
+    Loads::new().zone().label().lookup(LABEL_SET)
+}
+/// Admissions of one kind in one filter chain. The original direction leaves
+/// through the handoff: ESTABLISHED or NEW with the generation's label, or a
+/// fresh NEW flow (a TCP opening only with SYN) that receives it. The reply
+/// arrives on the handoff ESTABLISHED with the label. Workload flows cross
+/// forward; the router's own leave in output and answer in input.
+pub(super) fn admissions(
+    program: &mut Program<'_>,
+    scope: &RouterScope,
+    chain: &str,
+    kind: Kind,
+) -> Result<()> {
+    for shape in Shape::all(kind) {
+        let name = shape.name("flow");
+        let original = match chain {
+            "forward" => present(scope, shape, false),
+            "output" => present(scope, shape, true),
+            _ => BTreeSet::new(),
+        };
+        let reply = match chain {
+            "forward" => !present(scope, shape, false).is_empty(),
+            "input" => !present(scope, shape, true).is_empty(),
+            _ => false,
+        };
+        let envelope = |reply: bool, connection_state: u32| {
+            let mut result = ipv4();
+            result.extend(link(&scope.handoff, reply));
+            result.extend(ct(1, None, vec![u8::from(reply)]));
+            result.extend(state(connection_state));
+            result
+        };
+        if !original.is_empty() {
+            let mut established = envelope(false, 2);
+            established.extend(known(true));
+            established.extend(flow(shape, false).lookup(&name));
+            established.extend(labelled());
+            program.end(chain, established, 1)?;
+            for transport in &original {
+                let opening = || {
+                    let mut result = envelope(false, 8);
+                    result.extend(meta(16, vec![protocol(transport)]));
+                    if *transport == "tcp" {
+                        result.extend(opening_tcp());
+                    }
+                    result.extend(known(true));
+                    result.extend(flow(shape, false).lookup(&name));
+                    result
+                };
+                let mut labelled_opening = opening();
+                labelled_opening.extend(labelled());
+                program.end(chain, labelled_opening, 1)?;
+                let mut fresh = opening();
+                fresh.extend(ct(13, None, vec![0; 16]));
+                fresh.extend(Loads::new().zone().map(GENERATION_MAP));
+                fresh.push(keys::set_ct_from_data(13));
+                program.end(chain, fresh, 1)?;
+            }
+        }
+        if reply {
+            let mut answer = envelope(true, 2);
+            answer.extend(known(false));
+            answer.extend(flow(shape, true).lookup(&name));
+            answer.extend(labelled());
+            program.end(chain, answer, 1)?;
+        }
+    }
+    Ok(())
+}
+/// Source NAT of labelled original flows to the transit address and the grant's
+/// leased port range.
+pub(super) fn translation(
+    program: &mut Program<'_>,
+    scope: &RouterScope,
+    kind: Kind,
+) -> Result<()> {
+    for shape in Shape::all(kind) {
+        if present(scope, shape, false).is_empty() && present(scope, shape, true).is_empty() {
+            continue;
+        }
+        let mut expressions = ipv4();
+        expressions.extend(link(&scope.handoff, false));
+        expressions.extend(ct(1, None, vec![0]));
+        expressions.extend(labelled());
+        expressions.extend(known(true));
+        expressions.extend(flow(shape, false).map(&shape.name("flow")));
+        expressions.push(super::published::nat(0, 2));
+        program.rule("post", expressions)?;
+    }
+    Ok(())
+}