@push.rocks/smartnftables 2.6.0 → 4.0.0

package/rust/src/egress.rs

@@ -99,9 +99,28 @@ pub struct Generation {
 pub struct RouterPublishedPort {
     pub protocol: String,
     pub transit_port: u16,
+    /// Last port of a published range starting at `transit_port`. A range keeps
+    /// every port: `endpoint_port` equals `transit_port`. Absent for one port.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub transit_port_end: Option<u16>,
     pub endpoint_port: u16,
     pub endpoint_address: String,
     pub transit_source_address: String,
+    /// The workload may open flows from its published port(s), translated to
+    /// `transit_source_address` and the published port. Absent and false are the
+    /// same canonical policy.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub symmetric: bool,
+}
+impl RouterPublishedPort {
+    /// Last published transit port; equal to `transit_port` for one port.
+    pub fn transit_last(&self) -> u16 {
+        self.transit_port_end.unwrap_or(self.transit_port)
+    }
+    /// Last workload port the publication translates to.
+    pub fn endpoint_last(&self) -> u16 {
+        self.endpoint_port + (self.transit_last() - self.transit_port)
+    }
 }
 /// One exact host-origin flow: the node's own host network namespace dials one
 /// port of one local workload at its lease address, from the transit host
@@ -150,9 +169,28 @@ pub struct HostHandoff {
 pub struct PublishedPort {
     pub protocol: String,
     pub host_port: u16,
+    /// Last port of a published range starting at `host_port`. A range keeps
+    /// every port: `target_port` equals `host_port`. Absent for one port.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub host_port_end: Option<u16>,
     pub target_port: u16,
     pub target_address: String,
     pub host_ip: String,
+    /// Flows from `target_address` and the published target port(s) may leave
+    /// through the uplink, translated to `host_ip` and the published port. Absent
+    /// and false are the same canonical policy.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub symmetric: bool,
+}
+impl PublishedPort {
+    /// Last published uplink port; equal to `host_port` for one port.
+    pub fn host_last(&self) -> u16 {
+        self.host_port_end.unwrap_or(self.host_port)
+    }
+    /// Last transit port the publication translates to.
+    pub fn target_last(&self) -> u16 {
+        self.target_port + (self.host_last() - self.host_port)
+    }
 }
 #[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
@@ -446,16 +484,19 @@ pub fn destination(grant: &Grant, protection: &Protection) -> Result<String> {
 /// with the leased outbound source ports translated to that same transit address.
 fn normalize_router_published(value: &mut RouterScope) -> Result<()> {
     let mut ports = std::mem::take(&mut value.published_ports);
-    require(ports.len() <= 64)?;
+    crate::capacity("publishedPorts", PUBLISHED_PORTS, ports.len())?;
     ports.sort();
     for (index, port) in ports.iter().enumerate() {
         require(
             protocol(&port.protocol)
                 && port.transit_port > 0
                 && port.endpoint_port > 0
+                && published_span(port.transit_port, port.transit_port_end, port.endpoint_port)
+                // Sorted by protocol and first port, so disjoint neighbours are
+                // disjoint spans: one protocol/port is published exactly once.
                 && (index == 0
                     || ports[index - 1].protocol != port.protocol
-                    || ports[index - 1].transit_port != port.transit_port),
+                    || ports[index - 1].transit_last() < port.transit_port),
         )?;
         // rtnetlink verifies this exact handoff address at apply, recovery and
         // inspection, and only a current leased transit source address receives a
@@ -511,26 +552,59 @@ fn normalize_router_published(value: &mut RouterScope) -> Result<()> {
                 // port inside a leased outbound range is a translation conflict.
                 require(
                     range.protocol != port.protocol
-                        || port.transit_port < range.first
+                        || port.transit_last() < range.first
                         || port.transit_port > range.last,
                 )?;
             }
         }
     }
+    // A symmetric publication translates its workload's own flows back to its
+    // published ports, so its workload ports belong to it alone.
+    exclusive_symmetric(ports.iter().map(|port| {
+        (
+            port.symmetric,
+            (&port.protocol, &port.endpoint_address),
+            (port.endpoint_port, port.endpoint_last()),
+        )
+    }))?;
     value.published_ports = ports;
     Ok(())
 }
+/// One published port, or a range `first..=end` that keeps every port. The range
+/// is strictly ascending: one port has exactly one canonical form, without an end.
+fn published_span(first: u16, end: Option<u16>, inside: u16) -> bool {
+    end.is_none_or(|end| end > first && inside == first)
+}
+/// A symmetric publication's inside span may not overlap the inside span of any
+/// other publication of the same protocol and address, or its workload's flows
+/// would have two published sources.
+fn exclusive_symmetric<'a>(
+    spans: impl Iterator<Item = (bool, (&'a String, &'a String), (u16, u16))> + Clone,
+) -> Result<()> {
+    for (index, (symmetric, key, (first, last))) in spans.clone().enumerate() {
+        if !symmetric {
+            continue;
+        }
+        for (other, (_, other_key, (other_first, other_last))) in spans.clone().enumerate() {
+            require(
+                other == index || other_key != key || last < other_first || other_last < first,
+            )?;
+        }
+    }
+    Ok(())
+}
 /// Exact tuples only: one protocol, one unicast source and destination address
 /// and one destination port. Addresses never carry a prefix and ports never a
 /// range, so a grant cannot widen past its flow. `bound` checks the authority of
 /// the enclosing scope.
 fn normalize_host_grants(
     grants: &mut [HostGrant],
+    name: &'static str,
     bound: impl Fn(&HostGrant) -> Result<()>,
 ) -> Result<()> {
     // The contract maximum per projection; set lookups keep the rule graph
     // constant, and the element budget holds this many in every scope.
-    require(grants.len() <= 1024)?;
+    crate::capacity(name, HOST_GRANTS, grants.len())?;
     grants.sort();
     for (index, grant) in grants.iter().enumerate() {
         require(
@@ -575,7 +649,7 @@ fn normalize_router_host_grants(value: &mut RouterScope) -> Result<()> {
                 .any(|source| covers(source, &target) == Ok(true))
         })
     };
-    normalize_host_grants(&mut grants, |grant| {
+    normalize_host_grants(&mut grants, "hostGrants", |grant| {
         let endpoint = workload(&grant.destination_address).ok_or(Error::Invalid)?;
         require(
             endpoint.interface_kind == "veth"
@@ -622,7 +696,7 @@ fn normalize_router_workload_grants(value: &mut RouterScope) -> Result<()> {
         require(endpoint.interface_kind == "veth" && !local && !platform)?;
         Ok(endpoint)
     };
-    normalize_host_grants(&mut grants, |grant| {
+    normalize_host_grants(&mut grants, "workloadGrants", |grant| {
         let source = workload(&grant.source_address)?;
         let destination = workload(&grant.destination_address)?;
         require(source.id != destination.id)
@@ -630,17 +704,28 @@ fn normalize_router_workload_grants(value: &mut RouterScope) -> Result<()> {
     value.workload_grants = grants;
     Ok(())
 }
+/// Router input bounds. Endpoints, rules and grants are set elements, so the
+/// graph budgets bind them, not the rule reserve: the node shape of 128
+/// workloads with local DNS, public egress and four platform endpoints each fits.
+pub const ROUTER_LINKS: usize = 128;
+pub const ROUTER_RULES: usize = 1024;
+pub const ROUTER_GRANTS: usize = 1024;
+/// Publications per scope; they are set elements on both hops.
+pub const PUBLISHED_PORTS: usize = 1024;
+/// Host grants per scope and workload grants per router, each a set element.
+pub const HOST_GRANTS: usize = 1024;
 fn normalize_router(value: &mut RouterScope, revision: u64) -> Result<()> {
-    require(value.links.len() <= 32 && value.generations.len() <= 32)?;
+    crate::capacity("links", ROUTER_LINKS, value.links.len())?;
+    require(value.generations.len() <= 32)?;
     let private = policy::Policy {
         schema_version: 1,
         revision,
         endpoints: value.endpoints.clone(),
         rules: value.rules.clone(),
     }
-    .prepare()?;
-    value.endpoints = private.policy.endpoints;
-    value.rules = private.policy.rules;
+    .normalize(ROUTER_LINKS, ROUTER_RULES)?;
+    value.endpoints = private.endpoints;
+    value.rules = private.rules;
     normalize_protection(&mut value.protection)?;
     normalize_link(&mut value.handoff)?;
     require(
@@ -698,7 +783,11 @@ fn normalize_router(value: &mut RouterScope, revision: u64) -> Result<()> {
     let mut zones = BTreeSet::new();
     let mut labels = BTreeSet::new();
     let mut classifiers: Vec<(&Grant, String)> = Vec::new();
-    let mut count = 0;
+    crate::capacity(
+        "grants",
+        ROUTER_GRANTS,
+        value.generations.iter().map(|item| item.grants.len()).sum(),
+    )?;
     value
         .generations
         .sort_by(|a, b| (&a.lease.id, a.lease.generation).cmp(&(&b.lease.id, b.lease.generation)));
@@ -724,8 +813,6 @@ fn normalize_router(value: &mut RouterScope, revision: u64) -> Result<()> {
                 && generation.conntrack_label.bytes().any(|item| item != b'0')
                 && labels.insert(generation.conntrack_label.clone()),
         )?;
-        count += generation.grants.len();
-        require(count <= 128)?;
         generation.grants.sort();
         for grant in &generation.grants {
             require(
@@ -822,7 +909,7 @@ fn normalize_pool_guard(value: &mut AllocationPoolGuardScope) -> Result<()> {
     }
     // An exception is only ever an exact flow into a guarded pool.
     let mut grants = std::mem::take(&mut value.host_grants);
-    normalize_host_grants(&mut grants, |grant| {
+    normalize_host_grants(&mut grants, "hostGrants", |grant| {
         require(covers_address(&value.prefixes, &grant.destination_address)?)
     })?;
     value.host_grants = grants;
@@ -832,7 +919,7 @@ fn normalize_pool_guard(value: &mut AllocationPoolGuardScope) -> Result<()> {
 /// wildcard or range, each with exactly one owning uid. `(uid_t)-1` is not a
 /// user; it is the kernel's "unchanged" sentinel.
 fn normalize_local_tcp_port_owners(owners: &mut [LocalTcpPortOwner]) -> Result<()> {
-    require(owners.len() <= LOCAL_TCP_PORT_OWNERS)?;
+    crate::capacity("localTcpPortOwners", LOCAL_TCP_PORT_OWNERS, owners.len())?;
     owners.sort();
     for (index, owner) in owners.iter().enumerate() {
         let ip = address(&owner.address)?;
@@ -858,7 +945,7 @@ const LOCAL_TCP_PORT_OWNERS: usize = 8;
 fn normalize_host_host_grants(value: &mut HostScope) -> Result<()> {
     let mut grants = std::mem::take(&mut value.host_grants);
     let scope = &*value;
-    normalize_host_grants(&mut grants, |grant| {
+    normalize_host_grants(&mut grants, "hostGrants", |grant| {
         let destination = &grant.destination_address;
         require(
             scope
@@ -903,16 +990,19 @@ fn normalize_host_host_grants(value: &mut HostScope) -> Result<()> {
 /// overlap with the leased outbound source ports translated to that same address.
 fn normalize_published(value: &mut HostScope) -> Result<()> {
     let mut ports = std::mem::take(&mut value.published_ports);
-    require(ports.len() <= 64)?;
+    crate::capacity("publishedPorts", PUBLISHED_PORTS, ports.len())?;
     ports.sort();
     for (index, port) in ports.iter().enumerate() {
         require(
             protocol(&port.protocol)
                 && port.host_port > 0
                 && port.target_port > 0
+                && published_span(port.host_port, port.host_port_end, port.target_port)
+                // Sorted by protocol and first port, so disjoint neighbours are
+                // disjoint spans: one protocol/port is published exactly once.
                 && (index == 0
                     || ports[index - 1].protocol != port.protocol
-                    || ports[index - 1].host_port != port.host_port),
+                    || ports[index - 1].host_last() < port.host_port),
         )?;
         // rtnetlink verifies this exact uplink address at apply, recovery and
         // inspection. No wildcard, secondary-link or default-route inference.
@@ -934,14 +1024,39 @@ fn normalize_published(value: &mut HostScope) -> Result<()> {
                         // port inside a leased outbound range is a translation conflict.
                         require(
                             range.protocol != port.protocol
-                                || port.host_port < range.first
+                                || port.host_last() < range.first
                                 || port.host_port > range.last,
                         )?;
                     }
                 }
             }
         }
+        if port.symmetric {
+            // The workload's flows leave from its target ports; a leased range of
+            // the same address would claim them for the outer leased translation.
+            for allocation in value
+                .handoffs
+                .iter()
+                .flat_map(|handoff| handoff.allocations.iter())
+                .filter(|allocation| allocation.transit_source_address == port.target_address)
+            {
+                for range in &allocation.source_port_ranges {
+                    require(
+                        range.protocol != port.protocol
+                            || port.target_last() < range.first
+                            || port.target_port > range.last,
+                    )?;
+                }
+            }
+        }
     }
+    exclusive_symmetric(ports.iter().map(|port| {
+        (
+            port.symmetric,
+            (&port.protocol, &port.target_address),
+            (port.target_port, port.target_last()),
+        )
+    }))?;
     value.published_ports = ports;
     Ok(())
 }
@@ -1062,6 +1177,12 @@ pub(crate) mod localplatform_tests;
 #[path = "egress_localport_tests.rs"]
 pub(crate) mod localport_tests;
 #[cfg(test)]
+#[path = "egress_publishedrange_tests.rs"]
+mod publishedrange_tests;
+#[cfg(test)]
+#[path = "egress_routerequivalence_tests.rs"]
+mod routerequivalence_tests;
+#[cfg(test)]
 #[path = "egress_tests.rs"]
 pub(crate) mod tests;
 #[cfg(test)]

package/rust/src/egress_hostgrant_tests.rs

@@ -55,6 +55,8 @@ pub(super) struct Flow {
     /// The file system uid of the packet's user socket; None without one, when
     /// `meta skuid` breaks the rule like the kernel.
     pub(super) uid: Option<u32>,
+    /// The conntrack label of the flow's entry.
+    pub(super) label: [u8; 16],
 }
 const HOST: [u8; 4] = [10, 240, 0, 1];
 const WORK: [u8; 4] = [10, 241, 0, 2];
@@ -82,6 +84,7 @@ pub(super) fn opening(
         zone: 0,
         original: (HOST, WORK, 443, 8080),
         uid: None,
+        label: [0; 16],
     }
 }
 /// The workload's answer to `flow`, arriving on the reverse links.
@@ -194,11 +197,47 @@ pub(super) struct Decision {
     pub(super) verdict: i32,
     pub(super) chain: String,
     pub(super) zone: u16,
+    /// The NAT a nat-chain rule performed, which also ends that rule with an
+    /// accept exactly as the kernel's nat expression does.
+    pub(super) translation: Option<Translation>,
 }
-/// The compiled table: rules per chain and element keys per set.
+/// Source (0) or destination (1) NAT to an address and, when the rule names
+/// them, an inclusive port range.
+#[derive(Debug, PartialEq, Eq)]
+pub(super) struct Translation {
+    pub(super) kind: u32,
+    pub(super) address: [u8; 4],
+    pub(super) ports: Option<(u16, u16)>,
+}
+/// The compiled table: rules per chain, element keys per exact set, and the
+/// fields and elements of every interval set or map.
 struct Table {
     chains: BTreeMap<String, Vec<Vec<Attr>>>,
     sets: BTreeMap<String, Vec<Vec<u8>>>,
+    intervals: BTreeMap<String, Interval>,
+}
+/// Field byte lengths, then `(first, last, data)` per element.
+#[derive(Default)]
+struct Interval {
+    fields: Vec<usize>,
+    elements: Vec<(Vec<u8>, Vec<u8>, Option<Vec<u8>>)>,
+}
+impl Interval {
+    /// Every field of the key within its bounds, compared as the kernel's
+    /// pipapo backend does: byte strings of the field's own length.
+    fn find(&self, key: &[u8]) -> Option<&(Vec<u8>, Vec<u8>, Option<Vec<u8>>)> {
+        self.elements.iter().find(|(first, last, _)| {
+            let mut at = 0;
+            self.fields.iter().all(|length| {
+                let range = at..at + length;
+                at += length.div_ceil(4) * 4;
+                first[range.clone()] <= key[range.clone()] && key[range.clone()] <= last[range]
+            })
+        })
+    }
+    fn width(&self) -> usize {
+        self.fields.iter().map(|length| length.div_ceil(4) * 4).sum()
+    }
 }
 pub(super) fn chains(prepared: &Prepared) -> BTreeMap<String, Vec<Vec<Attr>>> {
     table(prepared).chains
@@ -206,6 +245,7 @@ pub(super) fn chains(prepared: &Prepared) -> BTreeMap<String, Vec<Vec<Attr>>> {
 fn table(prepared: &Prepared) -> Table {
     let mut chains: BTreeMap<String, Vec<Vec<Attr>>> = BTreeMap::new();
     let mut sets: BTreeMap<String, Vec<Vec<u8>>> = BTreeMap::new();
+    let mut intervals: BTreeMap<String, Interval> = BTreeMap::new();
     for (kind, attributes) in prepared.program("snft_host_grant").unwrap() {
         match kind {
             3 => {
@@ -218,21 +258,59 @@ fn table(prepared: &Prepared) -> Table {
                 .or_default()
                 .push(wire::attrs(&wire::one(&attributes, 4).unwrap().value).unwrap()),
             9 => {
-                assert!(sets
-                    .insert(wire::text(&attributes, 2).unwrap(), Vec::new())
-                    .is_none());
+                let name = wire::text(&attributes, 2).unwrap();
+                if let Ok(description) = wire::one(&attributes, 9) {
+                    let concatenation = wire::attrs(&description.value).unwrap();
+                    let fields = wire::attrs(&wire::one(&concatenation, 2).unwrap().value)
+                        .unwrap()
+                        .iter()
+                        .map(|field| {
+                            wire::number(&wire::attrs(&field.value).unwrap(), 1).unwrap() as usize
+                        })
+                        .collect();
+                    assert!(intervals
+                        .insert(name, Interval { fields, elements: Vec::new() })
+                        .is_none());
+                } else if wire::number(&attributes, 3).unwrap() & 8 != 0 {
+                    // An exact map is one field of the whole key.
+                    let fields = vec![wire::number(&attributes, 5).unwrap() as usize];
+                    assert!(intervals
+                        .insert(name, Interval { fields, elements: Vec::new() })
+                        .is_none());
+                } else {
+                    assert!(sets.insert(name, Vec::new()).is_none());
+                }
             }
             12 => {
-                let keys = sets.get_mut(&wire::text(&attributes, 2).unwrap()).unwrap();
+                let name = wire::text(&attributes, 2).unwrap();
                 for element in wire::attrs(&wire::one(&attributes, 3).unwrap().value).unwrap() {
                     let key = wire::attrs(&element.value).unwrap();
-                    keys.push(data(&key, 1));
+                    if let Some(interval) = intervals.get_mut(&name) {
+                        // An element without a last key is one exact key.
+                        let first = data(&key, 1);
+                        let last = if wire::one(&key, 10).is_ok() {
+                            data(&key, 10)
+                        } else {
+                            first.clone()
+                        };
+                        interval.elements.push((
+                            first,
+                            last,
+                            wire::one(&key, 2).ok().map(|_| data(&key, 2)),
+                        ));
+                    } else {
+                        sets.get_mut(&name).unwrap().push(data(&key, 1));
+                    }
                 }
             }
             other => panic!("operation {other}"),
         }
     }
-    Table { chains, sets }
+    Table {
+        chains,
+        sets,
+        intervals,
+    }
 }
 fn data(attributes: &[Attr], id: u16) -> Vec<u8> {
     wire::attrs(&wire::one(attributes, id).unwrap().value).unwrap()[0]
@@ -290,7 +368,7 @@ fn load(flow: &Flow, name: &str, fields: &[Attr]) -> Option<Vec<u8>> {
                 10 => vec![flow.protocol],
                 11 => source_port.to_be_bytes().to_vec(),
                 12 => destination_port.to_be_bytes().to_vec(),
-                13 => vec![0; 16],
+                13 => flow.label.to_vec(),
                 17 => flow.zone.to_ne_bytes().to_vec(),
                 19 => source.to_vec(),
                 20 => destination.to_vec(),
@@ -321,6 +399,7 @@ fn run(table: &Table, chain: &str, flow: &Flow, zone: &mut u16) -> Step {
         let mut registers = [0_u8; 80];
         let mut matched = true;
         let mut verdict: Option<(i32, Option<String>)> = None;
+        let mut translation = None;
         for expression in expressions {
             let parts = wire::attrs(&expression.value).unwrap();
             let name = wire::text(&parts, 1).unwrap();
@@ -367,12 +446,29 @@ fn run(table: &Table, chain: &str, flow: &Flow, zone: &mut u16) -> Step {
                     matched = loaded >= &first[..] && loaded <= &last[..];
                 }
                 "lookup" => {
-                    assert_eq!(wire::number(&fields, 5).unwrap(), 0);
-                    let keys = &table.sets[&wire::text(&fields, 1).unwrap()];
+                    let inverted = wire::number(&fields, 5).unwrap() == 1;
+                    let name = wire::text(&fields, 1).unwrap();
                     let at = offset(&fields, 2);
-                    matched = keys
-                        .iter()
-                        .any(|key| registers[at..at + key.len()] == key[..]);
+                    if let Some(interval) = table.intervals.get(&name) {
+                        let key = registers[at..at + interval.width()].to_vec();
+                        let found = interval.find(&key);
+                        matched = found.is_some();
+                        if let (Some((_, _, data)), Ok(_)) = (found, wire::one(&fields, 3)) {
+                            // A map lookup stores the element's data.
+                            let data = data.as_ref().unwrap();
+                            let to = offset(&fields, 3);
+                            registers[to..to + data.len()].copy_from_slice(data);
+                        }
+                    } else {
+                        let keys = &table.sets[&name];
+                        matched = keys
+                            .iter()
+                            .any(|key| registers[at..at + key.len()] == key[..]);
+                    }
+                    if inverted {
+                        assert!(wire::one(&fields, 3).is_err());
+                        matched = !matched;
+                    }
                 }
                 "immediate" if wire::number(&fields, 1).unwrap() == 0 => {
                     let code = wire::attrs(
@@ -394,7 +490,19 @@ fn run(table: &Table, chain: &str, flow: &Flow, zone: &mut u16) -> Step {
                     let at = offset(&fields, 1);
                     registers[at..at + value.len()].copy_from_slice(&value);
                 }
-                "nat" => {}
+                "nat" => {
+                    let at = offset(&fields, 3);
+                    let port = |id: u16| {
+                        let at = offset(&fields, id);
+                        u16::from_be_bytes(registers[at..at + 2].try_into().unwrap())
+                    };
+                    translation = Some(Translation {
+                        kind: wire::number(&fields, 1).unwrap(),
+                        address: registers[at..at + 4].try_into().unwrap(),
+                        ports: wire::one(&fields, 5).ok().map(|_| (port(5), port(6))),
+                    });
+                    verdict = Some((1, None));
+                }
                 "reject" => {
                     assert_eq!(fields, vec![Attr::u32(1, 1)]);
                     verdict = Some((REJECT, None));
@@ -414,6 +522,7 @@ fn run(table: &Table, chain: &str, flow: &Flow, zone: &mut u16) -> Step {
                     verdict: code,
                     chain: chain.into(),
                     zone: *zone,
+                    translation,
                 })
             }
             Some((-5, _)) => return Step::Next,
@@ -431,13 +540,34 @@ fn run(table: &Table, chain: &str, flow: &Flow, zone: &mut u16) -> Step {
 }
 /// A base chain that ends without a terminal verdict accepts by policy.
 pub(super) fn decide(prepared: &Prepared, chain: &str, flow: &Flow) -> Decision {
+    Simulator::new(prepared).decide(chain, flow)
+}
+/// One compiled table, parsed once for many decisions.
+pub(super) struct Simulator {
+    table: Table,
+}
+impl Simulator {
+    pub(super) fn new(prepared: &Prepared) -> Self {
+        Self {
+            table: table(prepared),
+        }
+    }
+    pub(super) fn has(&self, chain: &str) -> bool {
+        self.table.chains.contains_key(chain)
+    }
+    pub(super) fn decide(&self, chain: &str, flow: &Flow) -> Decision {
+        decide_in(&self.table, chain, flow)
+    }
+}
+fn decide_in(table: &Table, chain: &str, flow: &Flow) -> Decision {
     let mut zone = 0;
-    match run(&table(prepared), chain, flow, &mut zone) {
+    match run(table, chain, flow, &mut zone) {
         Step::Final(decision) => decision,
         Step::Next => Decision {
             verdict: 1,
             chain: "policy".into(),
             zone,
+            translation: None,
         },
     }
 }
@@ -835,7 +965,8 @@ fn host_grants_compile_a_constant_rule_graph_and_one_element_per_grant() {
         if let Some(arrival) = all.sets.get("host_grant_arrival") {
             assert_eq!(arrival.len(), 1024);
         }
-        assert!(table(&prepared(fixture)).sets.is_empty());
+        let without = table(&prepared(fixture));
+        assert!(without.sets.keys().all(|name| !name.starts_with("host_grant")));
     }
 }
 
@@ -917,11 +1048,18 @@ fn host_grants_meet_the_atomic_reserve_at_the_contract_maximum() {
         };
         let (graph, elements) = (size(&[3, 6, 9]), size(&[12]));
         assert!(
-            program.len() < 768 && graph <= 100_000 && elements <= super::compile::ELEMENT_BYTES
+            program.len() < 768 && graph <= super::compile::RULE_BYTES && graph + elements <= super::compile::TARGET_BYTES
         );
         assert!(deletion + graph + elements + 64 <= crate::wire::BATCH_BYTES);
-        // The contract maximum is the validation bound.
-        assert!(normalized(granted(fixture, many(1025))).is_err());
+        // The contract maximum is a capacity bound.
+        assert_eq!(
+            normalized(granted(fixture, many(1025))).unwrap_err(),
+            crate::Error::Exhausted(crate::Bound {
+                name: "hostGrants",
+                limit: 1024,
+                actual: 1025
+            })
+        );
         println!(
             "HOST_GRANT_MAX scope={name} grants=1024 operations={} rule_bytes={graph} element_bytes={elements} batch_bound={}",
             program.len(),
@@ -929,7 +1067,7 @@ fn host_grants_meet_the_atomic_reserve_at_the_contract_maximum() {
         );
     }
     // The reserve itself: a maximum previous graph beside a maximum target.
-    assert!(deletion + 100_000 + super::compile::ELEMENT_BYTES + 64 <= crate::wire::BATCH_BYTES);
+    assert!(deletion + super::compile::TARGET_BYTES + 64 <= crate::wire::BATCH_BYTES);
 }
 
 /// A status carries up to three complete policies: the applied one and the

package/rust/src/egress_localport_tests.rs

@@ -118,6 +118,7 @@ fn local_tcp_port_owner_rejects_every_other_uid_at_its_exact_loopback_destinatio
         input,
         output: None,
         uid: None,
+        label: [0; 16],
         ..dial(10010, None)
     };
     assert_eq!(decide(&with, "input", &arriving(LO)).verdict, 1);
@@ -132,6 +133,7 @@ fn local_tcp_port_owner_rejects_every_other_uid_at_its_exact_loopback_destinatio
     // Guarded pool traffic from any user keeps the guard's decision.
     let pool = Flow {
         uid: Some(1000),
+        label: [0; 16],
         ..opening(None, Some((4, "handoff")))
     };
     assert_eq!(
@@ -250,7 +252,7 @@ fn local_tcp_port_owners_meet_the_atomic_reserve_at_the_contract_maximum() {
             .sum()
     };
     let (graph, elements) = (size(&[3, 6, 9]), size(&[12]));
-    assert!(program.len() < 768 && graph <= 100_000 && elements <= super::compile::ELEMENT_BYTES);
+    assert!(program.len() < 768 && graph <= super::compile::RULE_BYTES && graph + elements <= super::compile::TARGET_BYTES);
     assert!(deletion + graph + elements + 64 <= wire::BATCH_BYTES);
     println!(
         "LOCAL_TCP_PORT_OWNER_MAX owners=8 prefixes=64 grants=1024 operations={} rule_bytes={graph}",
@@ -260,5 +262,12 @@ fn local_tcp_port_owners_meet_the_atomic_reserve_at_the_contract_maximum() {
         .as_array_mut()
         .unwrap()
         .push(owner("127.0.0.1", 10008, 0));
-    assert!(normalized(value).is_err());
+    assert_eq!(
+        normalized(value).unwrap_err(),
+        crate::Error::Exhausted(crate::Bound {
+            name: "localTcpPortOwners",
+            limit: 8,
+            actual: 9
+        })
+    );
 }