@push.rocks/smartnftables 2.6.0 → 4.0.0

package/rust/src/egress_publishedrange_tests.rs

@@ -0,0 +1,812 @@
+//! Published port ranges and symmetric publications on both hops: a range is one
+//! interval match that keeps every port, and a symmetric publication lets its
+//! workload open flows from its published ports toward unprotected space only.
+use super::hostgrant_tests::{
+    bytes, decide, normalized, prepared, Flow, Translation, ACK, ESTABLISHED,
+};
+use super::tests::{published_host, published_port, published_router, router_published_port};
+use super::Prepared;
+use serde_json::{json, Value};
+
+const NEW: u32 = 8;
+const SYN: u8 = 0x02;
+const CLIENT: [u8; 4] = [198, 51, 100, 7];
+const TRANSIT: [u8; 4] = [10, 240, 0, 2];
+const UPLINK: [u8; 4] = [192, 0, 2, 2];
+const WORK: [u8; 4] = [10, 241, 0, 2];
+const HANDOFF: Option<(u32, &str)> = Some((4, "handoff"));
+const ENS18: Option<(u32, &str)> = Some((2, "ens18"));
+const WORK_LINK: Option<(u32, &str)> = Some((2, "work"));
+/// The fixture ranges: first, middle and last port, then the ports just outside.
+const INSIDE: [u16; 3] = [20000, 20100, 20200];
+const OUTSIDE: [u16; 2] = [19999, 20201];
+
+/// A published uplink range `first..=end` that keeps every port.
+fn host_range(protocol: &str, first: u16, end: u16) -> Value {
+    let mut value = published_port(protocol, first, first);
+    value["hostPortEnd"] = json!(end);
+    value
+}
+/// A published transit range `first..=end` that keeps every port.
+fn router_range(protocol: &str, first: u16, end: u16) -> Value {
+    let mut value = router_published_port(protocol, first, first);
+    value["transitPortEnd"] = json!(end);
+    value
+}
+fn symmetric(mut value: Value) -> Value {
+    value["symmetric"] = json!(true);
+    value
+}
+fn operations(prepared: &Prepared) -> usize {
+    prepared.program("snft_published_range").unwrap().len()
+}
+use super::tests::cost;
+/// One packet of a default-zone flow; `original` is the tracked original tuple.
+fn packet(
+    input: Option<(u32, &'static str)>,
+    output: Option<(u32, &'static str)>,
+    protocol: u8,
+    (source, source_port): ([u8; 4], u16),
+    (destination, destination_port): ([u8; 4], u16),
+    original: ([u8; 4], [u8; 4], u16, u16),
+) -> Flow {
+    Flow {
+        input,
+        output,
+        protocol,
+        source,
+        destination,
+        source_port,
+        destination_port,
+        tcp_flags: SYN,
+        state: NEW,
+        reply: false,
+        zone: 0,
+        original,
+        uid: None,
+        label: [0; 16],
+    }
+}
+/// The answer to an original-direction packet on the reverse links.
+fn reply(flow: Flow) -> Flow {
+    Flow {
+        input: flow.output,
+        output: flow.input,
+        source: flow.destination,
+        destination: flow.source,
+        source_port: flow.destination_port,
+        destination_port: flow.source_port,
+        tcp_flags: ACK,
+        state: ESTABLISHED,
+        reply: true,
+        ..flow
+    }
+}
+fn snat(address: [u8; 4], first: u16, last: u16) -> Option<Translation> {
+    Some(Translation {
+        kind: 0,
+        address,
+        ports: Some((first, last)),
+    })
+}
+
+#[test]
+fn absent_range_and_symmetric_fields_keep_the_exact_policy_digest_and_bytes() {
+    // The single-port goldens of the host and router publication tests were
+    // frozen before these fields existed and still hold; here the explicit
+    // `symmetric: false` is the same canonical policy as the absent field.
+    for (fixture, entry) in [
+        (
+            published_host as fn(Value) -> Value,
+            published_port("udp", 8125, 8125),
+        ),
+        (published_router, router_published_port("udp", 8125, 9125)),
+    ] {
+        let baseline = prepared(fixture(json!([entry.clone()])));
+        let mut explicit = entry.clone();
+        explicit["symmetric"] = json!(false);
+        let same = prepared(fixture(json!([explicit])));
+        assert_eq!(same, baseline);
+        assert_eq!(bytes(&same), bytes(&baseline));
+        let serialized = serde_json::to_string(&baseline.policy).unwrap();
+        for field in ["symmetric", "hostPortEnd", "transitPortEnd"] {
+            assert!(!serialized.contains(field), "{field}");
+        }
+        let changed = prepared(fixture(json!([symmetric(entry)])));
+        assert_ne!(changed.digest, baseline.digest);
+        assert!(serde_json::to_string(&changed.policy)
+            .unwrap()
+            .contains("\"symmetric\":true"));
+    }
+}
+
+#[test]
+fn host_range_translates_every_port_by_address_and_costs_one_port() {
+    let single = prepared(published_host(json!([published_port("udp", 20000, 20000)])));
+    let ranged = prepared(published_host(json!([host_range("udp", 20000, 20200)])));
+    assert_eq!(operations(&ranged), operations(&single));
+    assert!(serde_json::to_string(&ranged.policy)
+        .unwrap()
+        .contains("\"hostPortEnd\":20200"));
+    for port in INSIDE {
+        let arrival = packet(
+            ENS18,
+            None,
+            17,
+            (CLIENT, 40000),
+            (UPLINK, port),
+            (CLIENT, UPLINK, 40000, port),
+        );
+        // Address-only destination NAT keeps the port, and the client address.
+        assert_eq!(
+            decide(&ranged, "pre", &arrival).translation,
+            Some(Translation {
+                kind: 1,
+                address: TRANSIT,
+                ports: None,
+            }),
+            "{port}"
+        );
+        let translated = Flow {
+            output: HANDOFF,
+            destination: TRANSIT,
+            ..arrival
+        };
+        assert_eq!(decide(&ranged, "forward", &translated).verdict, 1, "{port}");
+        assert_eq!(
+            decide(&ranged, "forward", &reply(translated)).verdict,
+            1,
+            "{port}"
+        );
+    }
+    for port in OUTSIDE {
+        let arrival = packet(
+            ENS18,
+            None,
+            17,
+            (CLIENT, 40000),
+            (UPLINK, port),
+            (CLIENT, UPLINK, 40000, port),
+        );
+        assert_eq!(decide(&ranged, "pre", &arrival).translation, None, "{port}");
+        // Even a flow translated by another owner meets the capture barrier.
+        let translated = Flow {
+            output: HANDOFF,
+            destination: TRANSIT,
+            ..arrival
+        };
+        assert_eq!(decide(&ranged, "forward", &translated).verdict, 0, "{port}");
+    }
+}
+
+#[test]
+fn router_range_classifies_translates_and_admits_every_port_and_costs_one_port() {
+    let single = prepared(published_router(json!([router_published_port(
+        "tcp", 20000, 20000
+    )])));
+    let ranged = prepared(published_router(json!([router_range("tcp", 20000, 20200)])));
+    assert_eq!(operations(&ranged), operations(&single));
+    for port in INSIDE {
+        let arrival = packet(
+            HANDOFF,
+            None,
+            6,
+            (CLIENT, 40000),
+            (TRANSIT, port),
+            (CLIENT, TRANSIT, 40000, port),
+        );
+        let classified = decide(&ranged, "raw_in", &arrival);
+        assert_eq!((classified.verdict, classified.zone), (1, 0), "{port}");
+        assert_eq!(
+            decide(&ranged, "pre", &arrival).translation,
+            Some(Translation {
+                kind: 1,
+                address: WORK,
+                ports: None,
+            }),
+            "{port}"
+        );
+        let translated = Flow {
+            output: WORK_LINK,
+            destination: WORK,
+            ..arrival
+        };
+        assert_eq!(decide(&ranged, "forward", &translated).verdict, 1, "{port}");
+        let answer = reply(translated);
+        assert_eq!(decide(&ranged, "forward", &answer).verdict, 1, "{port}");
+        // The workload's published packets stay in the default zone ahead of the
+        // leased grant to any address on destination port 443.
+        let endpoint = decide(
+            &ranged,
+            "raw_in",
+            &Flow {
+                destination_port: 443,
+                ..answer
+            },
+        );
+        assert_eq!((endpoint.verdict, endpoint.zone), (1, 0), "{port}");
+    }
+    for port in OUTSIDE {
+        let arrival = packet(
+            HANDOFF,
+            None,
+            6,
+            (CLIENT, 40000),
+            (TRANSIT, port),
+            (CLIENT, TRANSIT, 40000, port),
+        );
+        assert_eq!(decide(&ranged, "raw_in", &arrival).verdict, 0, "{port}");
+        assert_eq!(decide(&ranged, "pre", &arrival).translation, None, "{port}");
+        // Just outside the range the leased classifier still claims the workload.
+        let leased = decide(
+            &ranged,
+            "raw_in",
+            &packet(
+                WORK_LINK,
+                None,
+                6,
+                (WORK, port),
+                (CLIENT, 443),
+                (WORK, CLIENT, port, 443),
+            ),
+        );
+        assert_eq!((leased.verdict, leased.zone), (1, 1), "{port}");
+    }
+}
+
+#[test]
+fn router_symmetric_publications_open_from_their_ports_toward_unprotected_space_only() {
+    let ports = json!([
+        symmetric(router_range("udp", 20000, 20200)),
+        symmetric(router_published_port("udp", 5070, 5070)),
+        symmetric(router_published_port("tcp", 5070, 5070))
+    ]);
+    let published = prepared(published_router(ports.clone()));
+    let mut plain = ports;
+    for entry in plain.as_array_mut().unwrap() {
+        entry.as_object_mut().unwrap().remove("symmetric");
+    }
+    let plain = prepared(published_router(plain));
+    // An admission jump, a reply admission and a translation per symmetric
+    // publication, and one shared state chain: ESTABLISHED and a NEW opening
+    // per protocol.
+    // One map with its elements, four admissions and one translation, whatever
+    // the number of symmetric publications.
+    assert_eq!(operations(&published), operations(&plain) + 7);
+    let outbound = |protocol: u8, port: u16, destination: [u8; 4]| {
+        packet(
+            WORK_LINK,
+            HANDOFF,
+            protocol,
+            (WORK, port),
+            (destination, 5060),
+            (WORK, destination, port, 5060),
+        )
+    };
+    for (protocol, port, span) in [
+        (17, 20000, (20000, 20200)),
+        (17, 20100, (20000, 20200)),
+        (17, 20200, (20000, 20200)),
+        (17, 5070, (5070, 5070)),
+        (6, 5070, (5070, 5070)),
+    ] {
+        let flow = outbound(protocol, port, CLIENT);
+        // Without `symmetric` the flow from a published port is denied.
+        assert_eq!(decide(&plain, "forward", &flow).verdict, 0, "{port}");
+        assert_eq!(decide(&published, "forward", &flow).verdict, 1, "{port}");
+        let established = Flow {
+            state: ESTABLISHED,
+            tcp_flags: ACK,
+            ..flow
+        };
+        assert_eq!(decide(&published, "forward", &established).verdict, 1);
+        assert_eq!(decide(&published, "forward", &reply(flow)).verdict, 1);
+        // Source NAT to the transit address and the published port span, which
+        // keeps the workload's port.
+        assert_eq!(
+            decide(&published, "post", &flow).translation,
+            snat(TRANSIT, span.0, span.1),
+            "{port}"
+        );
+        // Both directions stay in the default zone in raw classification.
+        assert_eq!(decide(&published, "raw_in", &flow).zone, 0);
+        let answer = Flow {
+            destination: TRANSIT,
+            ..reply(flow)
+        };
+        let classified = decide(&published, "raw_in", &answer);
+        assert_eq!((classified.verdict, classified.zone), (1, 0), "{port}");
+        // The protected union stays denied: a protected current destination, a
+        // protected platform endpoint, and a protected original destination
+        // behind foreign destination NAT.
+        for denied in [
+            outbound(protocol, port, [192, 0, 2, 3]),
+            outbound(protocol, port, [203, 0, 113, 10]),
+            outbound(protocol, port, [10, 250, 0, 2]),
+            Flow {
+                original: (WORK, [192, 0, 2, 3], port, 5060),
+                ..flow
+            },
+        ] {
+            assert_eq!(decide(&published, "forward", &denied).verdict, 0, "{port}");
+        }
+        // A foreign zone, the reply direction and a changed original source never
+        // borrow the admission.
+        for foreign in [
+            Flow { zone: 7, ..flow },
+            Flow {
+                reply: true,
+                state: ESTABLISHED,
+                ..flow
+            },
+            Flow {
+                original: (WORK, CLIENT, port + 1000, 5060),
+                ..flow
+            },
+        ] {
+            assert_ne!(decide(&published, "forward", &foreign).verdict, 1, "{port}");
+        }
+    }
+    // A TCP opening needs SYN with FIN/RST/ACK clear.
+    let tcp = outbound(6, 5070, CLIENT);
+    assert_eq!(
+        decide(
+            &published,
+            "forward",
+            &Flow {
+                tcp_flags: ACK,
+                ..tcp
+            }
+        )
+        .verdict,
+        0
+    );
+    // Ports just outside the range and beside the single port stay denied.
+    for (protocol, port) in [(17, 20201), (17, 19999), (6, 5071)] {
+        assert_eq!(
+            decide(&published, "forward", &outbound(protocol, port, CLIENT)).verdict,
+            0,
+            "{port}"
+        );
+    }
+}
+
+#[test]
+fn host_symmetric_publications_open_from_their_target_ports_toward_unprotected_space_only() {
+    let ports = json!([
+        symmetric(host_range("udp", 20000, 20200)),
+        symmetric(published_port("udp", 5070, 5070)),
+        symmetric(published_port("tcp", 5080, 6080)),
+        published_port("udp", 8125, 8125)
+    ]);
+    let published = prepared(published_host(ports.clone()));
+    let mut plain = ports;
+    for entry in plain.as_array_mut().unwrap() {
+        entry.as_object_mut().unwrap().remove("symmetric");
+    }
+    let plain = prepared(published_host(plain));
+    // One map with its elements, four admissions and one translation, whatever
+    // the number of symmetric publications.
+    assert_eq!(operations(&published), operations(&plain) + 7);
+    let outbound = |protocol: u8, port: u16, destination: [u8; 4]| {
+        packet(
+            HANDOFF,
+            ENS18,
+            protocol,
+            (TRANSIT, port),
+            (destination, 5060),
+            (TRANSIT, destination, port, 5060),
+        )
+    };
+    for (protocol, port, span) in [
+        (17, 20000, (20000, 20200)),
+        (17, 20100, (20000, 20200)),
+        (17, 20200, (20000, 20200)),
+        (17, 5070, (5070, 5070)),
+        // One port maps its target port to the published uplink port.
+        (6, 6080, (5080, 5080)),
+    ] {
+        let flow = outbound(protocol, port, CLIENT);
+        assert_eq!(decide(&plain, "forward", &flow).verdict, 0, "{port}");
+        assert_eq!(decide(&published, "forward", &flow).verdict, 1, "{port}");
+        assert_eq!(
+            decide(&published, "forward", &reply(flow)).verdict,
+            1,
+            "{port}"
+        );
+        assert_eq!(
+            decide(&published, "post", &flow).translation,
+            snat(UPLINK, span.0, span.1),
+            "{port}"
+        );
+        for denied in [
+            outbound(protocol, port, [192, 0, 2, 3]),
+            outbound(protocol, port, [203, 0, 113, 10]),
+            Flow {
+                original: (TRANSIT, [192, 0, 2, 3], port, 5060),
+                ..flow
+            },
+        ] {
+            assert_eq!(decide(&published, "forward", &denied).verdict, 0, "{port}");
+        }
+        assert_eq!(
+            decide(&published, "forward", &Flow { zone: 7, ..flow }).verdict,
+            0
+        );
+    }
+    for (protocol, port) in [(17, 8125), (17, 20201), (6, 5080)] {
+        assert_eq!(
+            decide(&published, "forward", &outbound(protocol, port, CLIENT)).verdict,
+            0,
+            "{port}"
+        );
+    }
+    // Leased flows keep their own outer translation, without a port.
+    let leased = outbound(17, 10500, CLIENT);
+    assert_eq!(decide(&published, "forward", &leased).verdict, 1);
+    assert_eq!(
+        decide(&published, "post", &leased).translation,
+        Some(Translation {
+            kind: 0,
+            address: UPLINK,
+            ports: None,
+        })
+    );
+}
+
+#[test]
+fn host_publications_refuse_ambiguous_ranges_and_symmetric_conflicts() {
+    let accepted = |ports: Value| normalized(published_host(ports)).is_ok();
+    assert!(accepted(json!([host_range("udp", 20000, 20200)])));
+    // Adjacent to the leased range and to another publication, and the same span
+    // for another protocol.
+    assert!(accepted(json!([
+        host_range("udp", 11000, 11100),
+        host_range("udp", 11101, 11200),
+        host_range("tcp", 11000, 11100)
+    ])));
+    // Two publications may share one target port while neither is symmetric.
+    assert!(accepted(json!([
+        published_port("tcp", 443, 8443),
+        published_port("tcp", 444, 8443)
+    ])));
+    // A target port inside a leased range stays valid for a plain publication.
+    assert!(accepted(json!([published_port("tcp", 443, 10500)])));
+    for (name, ports) in [
+        (
+            "range with a differing inside port",
+            json!([changed(
+                host_range("udp", 20000, 20200),
+                "/targetPort",
+                21000
+            )]),
+        ),
+        ("inverted range", json!([host_range("udp", 20000, 19999)])),
+        ("one-port range", json!([host_range("udp", 20000, 20000)])),
+        (
+            "range end beyond 65535",
+            json!([beyond(host_range("udp", 20000, 20001), "/hostPortEnd")]),
+        ),
+        (
+            "overlap with the leased range start",
+            json!([host_range("udp", 9990, 10000)]),
+        ),
+        (
+            "overlap with the leased range end",
+            json!([host_range("tcp", 10999, 11005)]),
+        ),
+        (
+            "range overlapping a single port",
+            json!([
+                host_range("udp", 20000, 20200),
+                published_port("udp", 20100, 20100)
+            ]),
+        ),
+        (
+            "ranges sharing their boundary port",
+            json!([
+                host_range("udp", 20000, 20200),
+                host_range("udp", 20200, 20300)
+            ]),
+        ),
+        (
+            "symmetric target port inside a leased range",
+            json!([symmetric(published_port("tcp", 443, 10500))]),
+        ),
+        (
+            "symmetric target port shared with another publication",
+            json!([
+                symmetric(published_port("tcp", 443, 8443)),
+                published_port("tcp", 444, 8443)
+            ]),
+        ),
+    ] {
+        assert!(normalized(published_host(ports)).is_err(), "{name}");
+    }
+}
+
+#[test]
+fn router_publications_refuse_ambiguous_ranges_and_symmetric_conflicts() {
+    let accepted = |ports: Value| normalized(published_router(ports)).is_ok();
+    assert!(accepted(json!([router_range("udp", 20000, 20200)])));
+    assert!(accepted(json!([
+        router_range("udp", 11000, 11100),
+        router_range("udp", 11101, 11200),
+        router_range("tcp", 11000, 11100)
+    ])));
+    assert!(accepted(json!([
+        router_published_port("tcp", 443, 8443),
+        router_published_port("tcp", 444, 8443)
+    ])));
+    for (name, ports) in [
+        (
+            "range with a differing inside port",
+            json!([changed(
+                router_range("udp", 20000, 20200),
+                "/endpointPort",
+                21000
+            )]),
+        ),
+        ("inverted range", json!([router_range("udp", 20000, 19999)])),
+        ("one-port range", json!([router_range("udp", 20000, 20000)])),
+        (
+            "range end beyond 65535",
+            json!([beyond(router_range("udp", 20000, 20001), "/transitPortEnd")]),
+        ),
+        (
+            "overlap with the leased range start",
+            json!([router_range("udp", 9990, 10000)]),
+        ),
+        (
+            "overlap with the leased range end",
+            json!([router_range("tcp", 10999, 11005)]),
+        ),
+        (
+            "range overlapping a single port",
+            json!([
+                router_range("udp", 20000, 20200),
+                router_published_port("udp", 20100, 20100)
+            ]),
+        ),
+        (
+            "ranges sharing their boundary port",
+            json!([
+                router_range("udp", 20000, 20200),
+                router_range("udp", 20200, 20300)
+            ]),
+        ),
+        (
+            "symmetric endpoint port shared with another publication",
+            json!([
+                symmetric(router_published_port("tcp", 443, 8443)),
+                router_published_port("tcp", 444, 8443)
+            ]),
+        ),
+        (
+            "symmetric endpoint range overlapping another publication",
+            json!([
+                symmetric(router_range("udp", 20000, 20200)),
+                router_published_port("udp", 8125, 20150)
+            ]),
+        ),
+    ] {
+        assert!(normalized(published_router(ports)).is_err(), "{name}");
+    }
+}
+
+fn link_json(index: u32, name: &str, kind: &str, address: &str) -> Value {
+    json!({"interfaceIndex":index,"interfaceName":name,"interfaceKind":kind,
+        "macAddress":format!("02:00:00:00:{:02x}:{:02x}", index / 256, index % 256),
+        "interfaceLinkIndex":index + 1000,"requiredIpv4Addresses":[address]})
+}
+/// A Pallet-shaped node: `workloads` veth workloads behind one router, each with
+/// local DNS on its gateway and public TCP and UDP egress when `leased`, grants
+/// to the first `platforms` of four platform endpoints, and `published` of them
+/// with one to three publications; the first carries the SIP shape.
+pub(super) fn node(
+    workloads: u32,
+    leased: bool,
+    platforms: usize,
+    published: u32,
+    symmetric_all: bool,
+) -> (Value, Value) {
+    let catalog = [
+        ("dns", "192.0.2.1", "udp", 53),
+        ("registry", "192.0.2.10", "tcp", 443),
+        ("relay", "192.0.2.11", "tcp", 443),
+        ("metrics", "192.0.2.12", "tcp", 9100),
+    ];
+    let mut endpoints = Vec::new();
+    let mut links = Vec::new();
+    let mut rules = Vec::new();
+    let mut grants = Vec::new();
+    let mut router_ports = Vec::new();
+    let mut host_ports = Vec::new();
+    let mut next_port = 30000;
+    for index in 0..workloads {
+        let name = format!("w{index}");
+        let gateway = format!("10.241.{index}.1");
+        let address = format!("10.241.{index}.2");
+        endpoints.push(
+            json!({"id":name,"interfaceIndex":10 + index,"interfaceName":name,
+            "interfaceKind":"veth","sourcePrefixes":[format!("{address}/32")]}),
+        );
+        links.push(link_json(10 + index, &name, "veth", &gateway));
+        for protocol in ["tcp", "udp"].into_iter().filter(|_| leased) {
+            rules.push(json!({"sourceEndpoint":name,"destinationEndpoint":null,
+                "sourcePrefix":format!("{address}/32"),"destinationPrefix":format!("{gateway}/32"),
+                "protocol":protocol,"sourcePort":null,"destinationPort":53}));
+            rules.push(json!({"sourceEndpoint":null,"destinationEndpoint":name,
+                "sourcePrefix":format!("{gateway}/32"),"destinationPrefix":format!("{address}/32"),
+                "protocol":protocol,"sourcePort":53,"destinationPort":null}));
+            grants.push(json!({"sourceEndpoint":name,"sourcePrefix":format!("{address}/32"),
+                "destination":{"kind":"public","prefix":"0.0.0.0/0"},"protocol":protocol,
+                "sourcePort":null,"destinationPort":null,"sourcePortRange":{"first":10000,"last":10999}}));
+        }
+        for (id, _, protocol, port) in &catalog[..platforms] {
+            grants.push(json!({"sourceEndpoint":name,"sourcePrefix":format!("{address}/32"),
+                "destination":{"kind":"platform","endpointId":id},"protocol":protocol,
+                "sourcePort":null,"destinationPort":port,"sourcePortRange":{"first":10000,"last":10999}}));
+        }
+        if index >= published {
+            continue;
+        }
+        let shape: Vec<(&str, u16, Option<u16>)> = if index == 0 {
+            vec![
+                ("udp", 5070, None),
+                ("tcp", 5070, None),
+                ("udp", 20000, Some(20200)),
+            ]
+        } else {
+            (0..=(index % 3))
+                .map(|_| {
+                    next_port += 1;
+                    ("tcp", next_port, None)
+                })
+                .collect()
+        };
+        for (protocol, port, end) in shape {
+            let symmetric = symmetric_all || index == 0;
+            let mut routed = json!({"protocol":protocol,"transitPort":port,"endpointPort":port,
+                "endpointAddress":address,"transitSourceAddress":"10.240.0.2","symmetric":symmetric});
+            let mut hosted = json!({"protocol":protocol,"hostPort":port,"targetPort":port,
+                "targetAddress":"10.240.0.2","hostIp":"192.0.2.2","symmetric":symmetric});
+            if let Some(end) = end {
+                routed["transitPortEnd"] = json!(end);
+                hosted["hostPortEnd"] = json!(end);
+            }
+            router_ports.push(routed);
+            host_ports.push(hosted);
+        }
+    }
+    let protection = json!({"authorityDigest":format!("sha256:{}","b".repeat(64)),
+        "prefixes":["10.0.0.0/8","192.0.2.0/24"],
+        "platformEndpoints":catalog[..platforms.max(3)]
+            .iter()
+            .map(|(id, address, protocol, port)| json!({"id":id,"address":address,"protocol":protocol,"port":port}))
+            .collect::<Vec<_>>()});
+    let ranges = json!([{"protocol":"tcp","first":10000,"last":10999},{"protocol":"udp","first":10000,"last":10999}]);
+    let lease = json!({"id":"lease-a","generation":1,"digest":format!("sha256:{}","a".repeat(64))});
+    let router = json!({"schemaVersion":2,"revision":1,"scope":{"kind":"routerEgress",
+        "endpoints":endpoints,"rules":rules,"links":links,
+        "handoff":link_json(4,"handoff","veth","10.240.0.2"),"protection":protection,
+        "generations":[{"lease":lease,"transitSourceAddress":"10.240.0.2","sourcePortRanges":ranges,
+            "conntrackZone":1,"conntrackLabel":"a".repeat(32),"grants":grants}],
+        "publishedPorts":router_ports}});
+    let host = json!({"schemaVersion":2,"revision":1,"scope":{"kind":"hostTransit","protection":protection,
+        "handoffs":[{"link":link_json(4,"handoff","veth","10.240.0.1"),
+            "allocations":[{"lease":lease,"transitSourceAddress":"10.240.0.2","sourcePortRanges":ranges}]}],
+        "uplink":link_json(2,"ens18","ethernet","192.0.2.2"),"snatAddress":"192.0.2.2",
+        "publishedPorts":host_ports}});
+    (router, host)
+}
+fn without_publications(mut value: Value) -> Value {
+    value["scope"]
+        .as_object_mut()
+        .unwrap()
+        .remove("publishedPorts");
+    value
+}
+
+/// The rule expressions of a prepared policy, without the digest stamps.
+fn rule_expressions(value: Value) -> Vec<Vec<u8>> {
+    prepared(value)
+        .program("snft_published_range")
+        .unwrap()
+        .into_iter()
+        .filter(|(kind, _)| *kind == 6)
+        .map(|(_, attributes)| crate::wire::one(&attributes, 4).unwrap().value.clone())
+        .collect()
+}
+
+#[test]
+fn a_realistic_node_costs_constant_rules_and_bounded_elements() {
+    // Every workload with local DNS, public TCP and UDP egress, grants to four
+    // platform endpoints and one to three publications, the first with the SIP
+    // shape. The router's rules are the same for every size; its elements, and
+    // the host's publications, grow with the node.
+    for workloads in [1, 8, 32, 64] {
+        let (router, host) = node(workloads, true, 4, workloads, false);
+        for (hop, value) in [("router", router), ("host", host)] {
+            let (operations, rule_bytes, element_bytes) = cost(&prepared(value));
+            assert!(operations < 768 && rule_bytes <= 100_000 && rule_bytes + element_bytes <= 212_000);
+            println!(
+                "NODE_COST workloads={workloads} {hop} operations={operations} rule_bytes={rule_bytes} element_bytes={element_bytes} target={}",
+                rule_bytes + element_bytes
+            );
+        }
+    }
+    let (eight, _) = node(8, true, 4, 8, false);
+    let (sixty_four, _) = node(64, true, 4, 64, false);
+    assert_eq!(rule_expressions(eight), rule_expressions(sixty_four));
+    // The largest such node the target budget holds; beyond it the policy is
+    // refused before any kernel work.
+    let fits = |workloads: u32| {
+        let (router, _) = node(workloads, true, 4, workloads, false);
+        serde_json::from_value::<super::Policy>(router)
+            .unwrap()
+            .prepare()
+            .is_ok()
+    };
+    let capacity = (64..=128).take_while(|workloads| fits(*workloads)).last().unwrap();
+    assert!(!fits(capacity + 1));
+    println!("NODE_COST capacity workloads={capacity}");
+}
+
+#[test]
+fn publications_cost_constant_rules_on_a_node() {
+    // One publishing workload and eight compile exactly the same rules on both
+    // hops, whatever their publications.
+    let rules = |published: u32| {
+        let (router, host) = node(8, false, 0, published, true);
+        [rule_expressions(router), rule_expressions(host)]
+    };
+    assert_eq!(rules(1), rules(8));
+}
+
+#[test]
+fn the_publication_maximum_fits_both_budgets() {
+    // The input maximum of 64 publications per scope, every one a symmetric
+    // range of 100 ports, spread over eight workloads.
+    let (mut router, mut host) = node(8, false, 0, 0, false);
+    router["scope"]["publishedPorts"] = json!((0..64u16)
+        .map(|index| {
+            let first = 20000 + index * 100;
+            symmetric(json!({"protocol":if index % 2 == 0 { "udp" } else { "tcp" },
+                "transitPort":first,"transitPortEnd":first + 99,"endpointPort":first,
+                "endpointAddress":format!("10.241.{}.2", index % 8),"transitSourceAddress":"10.240.0.2"}))
+        })
+        .collect::<Vec<_>>());
+    host["scope"]["publishedPorts"] = json!((0..64u16)
+        .map(|index| {
+            let first = 20000 + index * 100;
+            symmetric(
+                json!({"protocol":if index % 2 == 0 { "udp" } else { "tcp" },
+                "hostPort":first,"hostPortEnd":first + 99,"targetPort":first,
+                "targetAddress":"10.240.0.2","hostIp":"192.0.2.2"}),
+            )
+        })
+        .collect::<Vec<_>>());
+    for (hop, value) in [("router", router), ("host", host)] {
+        let bare = cost(&prepared(without_publications(value.clone())));
+        let (operations, rule_bytes, element_bytes) = cost(&prepared(value));
+        assert!(
+            operations <= 768 && rule_bytes <= 100_000 && element_bytes <= 100_000,
+            "{hop}"
+        );
+        println!(
+            "PUBLISHED_WORST {hop} publications=64 operations={operations} (+{}) rule_bytes={rule_bytes} (+{}) element_bytes={element_bytes}",
+            operations - bare.0,
+            rule_bytes - bare.1
+        );
+    }
+}
+
+fn changed(mut value: Value, path: &str, replacement: u16) -> Value {
+    *value.pointer_mut(path).unwrap() = json!(replacement);
+    value
+}
+fn beyond(mut value: Value, path: &str) -> Value {
+    *value.pointer_mut(path).unwrap() = json!(65536);
+    value
+}