@push.rocks/smartnftables 3.0.0 → 4.0.1

package/rust/src/egress.rs

@@ -484,7 +484,7 @@ pub fn destination(grant: &Grant, protection: &Protection) -> Result<String> {
 /// with the leased outbound source ports translated to that same transit address.
 fn normalize_router_published(value: &mut RouterScope) -> Result<()> {
     let mut ports = std::mem::take(&mut value.published_ports);
-    require(ports.len() <= PUBLISHED_PORTS)?;
+    crate::capacity("publishedPorts", PUBLISHED_PORTS, ports.len())?;
     ports.sort();
     for (index, port) in ports.iter().enumerate() {
         require(
@@ -599,11 +599,12 @@ fn exclusive_symmetric<'a>(
 /// the enclosing scope.
 fn normalize_host_grants(
     grants: &mut [HostGrant],
+    name: &'static str,
     bound: impl Fn(&HostGrant) -> Result<()>,
 ) -> Result<()> {
     // The contract maximum per projection; set lookups keep the rule graph
     // constant, and the element budget holds this many in every scope.
-    require(grants.len() <= 1024)?;
+    crate::capacity(name, HOST_GRANTS, grants.len())?;
     grants.sort();
     for (index, grant) in grants.iter().enumerate() {
         require(
@@ -648,7 +649,7 @@ fn normalize_router_host_grants(value: &mut RouterScope) -> Result<()> {
                 .any(|source| covers(source, &target) == Ok(true))
         })
     };
-    normalize_host_grants(&mut grants, |grant| {
+    normalize_host_grants(&mut grants, "hostGrants", |grant| {
         let endpoint = workload(&grant.destination_address).ok_or(Error::Invalid)?;
         require(
             endpoint.interface_kind == "veth"
@@ -695,7 +696,7 @@ fn normalize_router_workload_grants(value: &mut RouterScope) -> Result<()> {
         require(endpoint.interface_kind == "veth" && !local && !platform)?;
         Ok(endpoint)
     };
-    normalize_host_grants(&mut grants, |grant| {
+    normalize_host_grants(&mut grants, "workloadGrants", |grant| {
         let source = workload(&grant.source_address)?;
         let destination = workload(&grant.destination_address)?;
         require(source.id != destination.id)
@@ -711,8 +712,11 @@ pub const ROUTER_RULES: usize = 1024;
 pub const ROUTER_GRANTS: usize = 1024;
 /// Publications per scope; they are set elements on both hops.
 pub const PUBLISHED_PORTS: usize = 1024;
+/// Host grants per scope and workload grants per router, each a set element.
+pub const HOST_GRANTS: usize = 1024;
 fn normalize_router(value: &mut RouterScope, revision: u64) -> Result<()> {
-    require(value.links.len() <= ROUTER_LINKS && value.generations.len() <= 32)?;
+    crate::capacity("links", ROUTER_LINKS, value.links.len())?;
+    require(value.generations.len() <= 32)?;
     let private = policy::Policy {
         schema_version: 1,
         revision,
@@ -779,7 +783,11 @@ fn normalize_router(value: &mut RouterScope, revision: u64) -> Result<()> {
     let mut zones = BTreeSet::new();
     let mut labels = BTreeSet::new();
     let mut classifiers: Vec<(&Grant, String)> = Vec::new();
-    let mut count = 0;
+    crate::capacity(
+        "grants",
+        ROUTER_GRANTS,
+        value.generations.iter().map(|item| item.grants.len()).sum(),
+    )?;
     value
         .generations
         .sort_by(|a, b| (&a.lease.id, a.lease.generation).cmp(&(&b.lease.id, b.lease.generation)));
@@ -805,8 +813,6 @@ fn normalize_router(value: &mut RouterScope, revision: u64) -> Result<()> {
                 && generation.conntrack_label.bytes().any(|item| item != b'0')
                 && labels.insert(generation.conntrack_label.clone()),
         )?;
-        count += generation.grants.len();
-        require(count <= ROUTER_GRANTS)?;
         generation.grants.sort();
         for grant in &generation.grants {
             require(
@@ -903,7 +909,7 @@ fn normalize_pool_guard(value: &mut AllocationPoolGuardScope) -> Result<()> {
     }
     // An exception is only ever an exact flow into a guarded pool.
     let mut grants = std::mem::take(&mut value.host_grants);
-    normalize_host_grants(&mut grants, |grant| {
+    normalize_host_grants(&mut grants, "hostGrants", |grant| {
         require(covers_address(&value.prefixes, &grant.destination_address)?)
     })?;
     value.host_grants = grants;
@@ -913,7 +919,7 @@ fn normalize_pool_guard(value: &mut AllocationPoolGuardScope) -> Result<()> {
 /// wildcard or range, each with exactly one owning uid. `(uid_t)-1` is not a
 /// user; it is the kernel's "unchanged" sentinel.
 fn normalize_local_tcp_port_owners(owners: &mut [LocalTcpPortOwner]) -> Result<()> {
-    require(owners.len() <= LOCAL_TCP_PORT_OWNERS)?;
+    crate::capacity("localTcpPortOwners", LOCAL_TCP_PORT_OWNERS, owners.len())?;
     owners.sort();
     for (index, owner) in owners.iter().enumerate() {
         let ip = address(&owner.address)?;
@@ -939,7 +945,7 @@ const LOCAL_TCP_PORT_OWNERS: usize = 8;
 fn normalize_host_host_grants(value: &mut HostScope) -> Result<()> {
     let mut grants = std::mem::take(&mut value.host_grants);
     let scope = &*value;
-    normalize_host_grants(&mut grants, |grant| {
+    normalize_host_grants(&mut grants, "hostGrants", |grant| {
         let destination = &grant.destination_address;
         require(
             scope
@@ -984,7 +990,7 @@ fn normalize_host_host_grants(value: &mut HostScope) -> Result<()> {
 /// overlap with the leased outbound source ports translated to that same address.
 fn normalize_published(value: &mut HostScope) -> Result<()> {
     let mut ports = std::mem::take(&mut value.published_ports);
-    require(ports.len() <= PUBLISHED_PORTS)?;
+    crate::capacity("publishedPorts", PUBLISHED_PORTS, ports.len())?;
     ports.sort();
     for (index, port) in ports.iter().enumerate() {
         require(
@@ -1096,13 +1102,14 @@ fn normalize_host(value: &mut HostScope) -> Result<()> {
             .ok_or(Error::Invalid)?;
         require(local_addresses.contains(&endpoint.address))?;
     }
+    // Handoff addresses lie in protected space, checked per handoff below. An
+    // uplink address need not: the uplink lease and SNAT address is the host's
+    // public side, usually outside the protected authority, and the compiler
+    // adds each uncovered one to the host barrier as a protected destination.
     for ip in &local_addresses {
-        require(
-            covers_address(&value.protection.prefixes, ip)?
-                && value.protection.platform_endpoints.iter().all(|endpoint| {
-                    endpoint.address != *ip || value.local_platform_endpoints.contains(&endpoint.id)
-                }),
-        )?;
+        require(value.protection.platform_endpoints.iter().all(|endpoint| {
+            endpoint.address != *ip || value.local_platform_endpoints.contains(&endpoint.id)
+        }))?;
     }
     for handoff in &mut value.handoffs {
         normalize_link(&mut handoff.link)?;
@@ -1180,6 +1187,9 @@ mod routerequivalence_tests;
 #[path = "egress_tests.rs"]
 pub(crate) mod tests;
 #[cfg(test)]
+#[path = "egress_uplink_tests.rs"]
+mod uplink_tests;
+#[cfg(test)]
 #[path = "egress_workloadgrant_tests.rs"]
 pub(crate) mod workloadgrant_tests;
 impl Policy {

package/rust/src/egress_hostgrant_tests.rs

@@ -1051,8 +1051,15 @@ fn host_grants_meet_the_atomic_reserve_at_the_contract_maximum() {
             program.len() < 768 && graph <= super::compile::RULE_BYTES && graph + elements <= super::compile::TARGET_BYTES
         );
         assert!(deletion + graph + elements + 64 <= crate::wire::BATCH_BYTES);
-        // The contract maximum is the validation bound.
-        assert!(normalized(granted(fixture, many(1025))).is_err());
+        // The contract maximum is a capacity bound.
+        assert_eq!(
+            normalized(granted(fixture, many(1025))).unwrap_err(),
+            crate::Error::Exhausted(crate::Bound {
+                name: "hostGrants",
+                limit: 1024,
+                actual: 1025
+            })
+        );
         println!(
             "HOST_GRANT_MAX scope={name} grants=1024 operations={} rule_bytes={graph} element_bytes={elements} batch_bound={}",
             program.len(),

package/rust/src/egress_localport_tests.rs

@@ -262,5 +262,12 @@ fn local_tcp_port_owners_meet_the_atomic_reserve_at_the_contract_maximum() {
         .as_array_mut()
         .unwrap()
         .push(owner("127.0.0.1", 10008, 0));
-    assert!(normalized(value).is_err());
+    assert_eq!(
+        normalized(value).unwrap_err(),
+        crate::Error::Exhausted(crate::Bound {
+            name: "localTcpPortOwners",
+            limit: 8,
+            actual: 9
+        })
+    );
 }

package/rust/src/egress_tests.rs

@@ -992,3 +992,160 @@ fn router_v2_published_endpoint_traffic_is_classified_before_the_leased_grants()
         );
     }
 }
+
+fn exhausted(value: super::Result<Prepared>) -> crate::Bound {
+    match value {
+        Err(crate::Error::Exhausted(bound)) => bound,
+        other => panic!("expected a capacity refusal, got {other:?}"),
+    }
+}
+fn bound(name: &'static str, limit: usize, actual: usize) -> crate::Bound {
+    crate::Bound {
+        name,
+        limit,
+        actual,
+    }
+}
+fn prepare(value: Value) -> super::Result<Prepared> {
+    normalized(value)?.prepare()
+}
+
+/// The compiled budget and the input counts that exist to hold it refuse with
+/// EXHAUSTED and their bound; bounds of the topology's shape stay INVALID.
+#[test]
+fn v2_capacity_refusals_name_their_bound_and_shape_bounds_stay_invalid() {
+    // Router rules grow with protected prefixes: 128 exceed the rule reserve.
+    let mut value = router();
+    let mut prefixes = vec![
+        json!("10.0.0.0/8"),
+        json!("192.0.2.0/24"),
+        json!("203.0.113.10/32"),
+    ];
+    prefixes.extend((0..125).map(|index| json!(format!("172.16.{index}.0/24"))));
+    value["scope"]["protection"]["prefixes"] = json!(prefixes);
+    let refused = exhausted(prepare(value.clone()));
+    assert_eq!((refused.name, refused.limit), ("ruleBytes", 100_000));
+    assert!(refused.actual > refused.limit);
+    // 129 protected prefixes are outside the schema, not over capacity.
+    value["scope"]["protection"]["prefixes"]
+        .as_array_mut()
+        .unwrap()
+        .push(json!("172.17.0.0/24"));
+    assert_eq!(prepare(value).unwrap_err(), crate::Error::Invalid);
+
+    // Host transit rules grow with its handoffs and their leased ranges.
+    let handoff = |index: u32, ranges: u32| {
+        let mut item = allocation();
+        item["lease"]["id"] = json!(format!("lease-{index}"));
+        item["transitSourceAddress"] = json!(format!("10.240.{index}.2"));
+        item["sourcePortRanges"] = json!((0..ranges)
+            .map(
+                |range| json!({"protocol":if range % 2 == 0 { "tcp" } else { "udp" },
+                "first":10000 + range * 100,"last":10099 + range * 100})
+            )
+            .collect::<Vec<_>>());
+        json!({"link":link(10 + index, &format!("h{index}"), "veth", &format!("10.240.{index}.1")),
+            "allocations":[item]})
+    };
+    let handoffs = |count: u32, ranges: u32| {
+        json!((0..count)
+            .map(|index| handoff(index, ranges))
+            .collect::<Vec<_>>())
+    };
+    let mut value = host();
+    value["scope"]["handoffs"] = handoffs(4, 2);
+    assert_eq!(prepare(value.clone()).map(|_| ()), Ok(()));
+    value["scope"]["handoffs"] = handoffs(32, 16);
+    let refused = exhausted(prepare(value.clone()));
+    assert_eq!((refused.name, refused.limit), ("ruleBytes", 100_000));
+    assert!(refused.actual > refused.limit);
+    // 33 handoffs are outside the schema, not over capacity.
+    value["scope"]["handoffs"] = handoffs(33, 2);
+    assert_eq!(prepare(value).unwrap_err(), crate::Error::Invalid);
+
+    // Router input counts.
+    let mut value = router();
+    let template = value["scope"]["links"][0].clone();
+    value["scope"]["links"] = json!((0..129u32)
+        .map(|index| {
+            let mut item = template.clone();
+            item["interfaceIndex"] = json!(10 + index);
+            item["interfaceName"] = json!(format!("l{index}"));
+            item
+        })
+        .collect::<Vec<_>>());
+    assert_eq!(exhausted(prepare(value)), bound("links", 128, 129));
+    let mut value = router();
+    let template = value["scope"]["endpoints"][0].clone();
+    value["scope"]["endpoints"] = json!((0..129u32)
+        .map(|index| {
+            let mut item = template.clone();
+            item["id"] = json!(format!("e{index}"));
+            item
+        })
+        .collect::<Vec<_>>());
+    assert_eq!(exhausted(prepare(value)), bound("endpoints", 128, 129));
+    let mut value = router();
+    let template = value["scope"]["rules"][0].clone();
+    value["scope"]["rules"] = json!((0..1025u16)
+        .map(|index| {
+            let mut item = template.clone();
+            item["destinationPort"] = json!(1 + index);
+            item
+        })
+        .collect::<Vec<_>>());
+    assert_eq!(exhausted(prepare(value)), bound("rules", 1024, 1025));
+    // Egress grants count across every generation.
+    let mut value = router();
+    let generation = value["scope"]["generations"][0].clone();
+    let template = generation["grants"][0].clone();
+    value["scope"]["generations"] = json!((0..2u16)
+        .map(|part| {
+            let mut item = generation.clone();
+            item["grants"] = json!((0..(512 + part))
+                .map(|index| {
+                    let mut grant = template.clone();
+                    grant["destinationPort"] = json!(1 + index);
+                    grant
+                })
+                .collect::<Vec<_>>());
+            item
+        })
+        .collect::<Vec<_>>());
+    assert_eq!(exhausted(prepare(value)), bound("grants", 1024, 1025));
+    // Active generations are lease lifecycle, not capacity.
+    let mut value = router();
+    let generation = value["scope"]["generations"][0].clone();
+    value["scope"]["generations"] = json!(vec![generation; 33]);
+    assert_eq!(prepare(value).unwrap_err(), crate::Error::Invalid);
+
+    // Publications on both hops.
+    let ports = json!((0..1025u16)
+        .map(|index| published_port("tcp", 20000 + index, 20000 + index))
+        .collect::<Vec<_>>());
+    assert_eq!(
+        exhausted(prepare(published_host(ports.clone()))),
+        bound("publishedPorts", 1024, 1025)
+    );
+    let ports = json!((0..1025u16)
+        .map(|index| router_published_port("tcp", 20000 + index, 20000 + index))
+        .collect::<Vec<_>>());
+    assert_eq!(
+        exhausted(prepare(published_router(ports))),
+        bound("publishedPorts", 1024, 1025)
+    );
+
+    // Within the input bound, the grant elements exceed the target budget.
+    let mut value = router();
+    let template = value["scope"]["generations"][0]["grants"][0].clone();
+    value["scope"]["generations"][0]["grants"] = json!((0..1024u16)
+        .map(|index| {
+            let mut grant = template.clone();
+            grant["destinationPort"] = json!(1000 + index);
+            grant
+        })
+        .collect::<Vec<_>>());
+    let refused = exhausted(prepare(value));
+    assert_eq!((refused.name, refused.limit), ("targetBytes", 212_000));
+    assert!(refused.actual > refused.limit);
+}

package/rust/src/egress_uplink_tests.rs

@@ -0,0 +1,159 @@
+//! Host transit on an uplink whose own addresses lie outside the protected
+//! authority: the cluster-wide authority covers pools, resolvers, platform
+//! endpoints and the VPN, not a node's uplink lease, which is usually public.
+//! The scope prepares, and the host barrier protects the uplink addresses itself.
+use super::hostgrant_tests::{
+    chains, decide, normalized, opening, prepared, Flow, ACK, ESTABLISHED,
+};
+use super::tests::host;
+use serde_json::{json, Value};
+
+const TRANSIT: [u8; 4] = [10, 240, 0, 2];
+const UPLINK: [u8; 4] = [198, 51, 100, 7];
+const PUBLIC: [u8; 4] = [198, 51, 100, 200];
+const HANDOFF_LINK: Option<(u32, &str)> = Some((4, "handoff"));
+const UPLINK_LINK: Option<(u32, &str)> = Some((2, "ens18"));
+
+/// The `preparePolicy` request Pallet 35.1.0 sent pallet-guard on a lab node,
+/// captured on the native IPC (lab-only private addresses). Its uplink lease and
+/// SNAT address 10.92.26.30 lies outside the protected prefix 10.240.0.0/12; the
+/// two other uplink addresses hold host-local platform endpoints inside it.
+fn captured() -> Value {
+    json!({"schemaVersion":2,"revision":1,"scope":{"kind":"hostTransit",
+        "protection":{
+            "authorityDigest":"sha256:f436a15c8c8f4d4f0f23bc9fc69f45a8c9137a9586db1d2c2be8c09dac3467c9",
+            "prefixes":["10.240.0.0/12"],
+            "platformEndpoints":[
+                {"id":"5aaa706266a3c4e9b0cc99eb354496a732f88cdf3d36fd5911ab6fbb98ef7489","address":"10.244.0.30","port":8443,"protocol":"udp"},
+                {"id":"0298aa0b89b4248e058b7a279abc9d9c1793d2d012752432e95881367b43d6ac","address":"10.245.0.30","port":27017,"protocol":"tcp"},
+                {"id":"f0808a59e876a51c1a8a5b8cf38e0fc323dd5309dec3a8890468a1afc69dc9ff","address":"10.245.0.30","port":9000,"protocol":"tcp"},
+                {"id":"f4744ddb8e7d63883a7fbd4635f3ee4a031650effaaf5c13a1c664182b2b0501","address":"10.245.0.30","port":8443,"protocol":"tcp"},
+                {"id":"8933bdd0997dc2b230b0be7960c1708a57d72a0fa9481ec4aa56b9311ae68751","address":"10.243.0.1","port":53,"protocol":"tcp"},
+                {"id":"6e88da7a803f69d77d8d8fd86c5952ae87c26c3172b2f9a751662793e0ee8a7e","address":"10.243.0.1","port":53,"protocol":"udp"}]},
+        "handoffs":[{
+            "link":{"interfaceIndex":11,"interfaceName":"phc05f15afde9d","interfaceKind":"veth",
+                "macAddress":"4a:d5:5b:95:91:fa","interfaceLinkIndex":2,"requiredIpv4Addresses":["10.240.0.0"]},
+            "allocations":[{
+                "lease":{"id":"049eda6820b222e7e371bb4d1e24a325ac92422cff1900443c1e74a9efbb5d5e","generation":1,
+                    "digest":"sha256:9a5635b213263796ac3b883cce942a0ca45161d9412ec6c6c9a5d748c22a3a7c"},
+                "transitSourceAddress":"10.240.0.1",
+                "sourcePortRanges":[{"protocol":"tcp","first":1024,"last":65535},{"protocol":"udp","first":1024,"last":65535}]}]}],
+        "uplink":{"interfaceIndex":2,"interfaceName":"enp1s0","interfaceKind":"ethernet",
+            "macAddress":"52:54:00:92:26:30","interfaceLinkIndex":2,
+            "requiredIpv4Addresses":["10.244.0.30","10.245.0.30","10.92.26.30"]},
+        "snatAddress":"10.92.26.30",
+        "localPlatformEndpoints":[
+            "0298aa0b89b4248e058b7a279abc9d9c1793d2d012752432e95881367b43d6ac",
+            "5aaa706266a3c4e9b0cc99eb354496a732f88cdf3d36fd5911ab6fbb98ef7489",
+            "f0808a59e876a51c1a8a5b8cf38e0fc323dd5309dec3a8890468a1afc69dc9ff",
+            "f4744ddb8e7d63883a7fbd4635f3ee4a031650effaaf5c13a1c664182b2b0501"]}})
+}
+/// The host fixture on a public uplink lease outside every protected prefix.
+fn public() -> Value {
+    let mut value = host();
+    value["scope"]["uplink"]["requiredIpv4Addresses"] = json!(["198.51.100.7"]);
+    value["scope"]["snatAddress"] = json!("198.51.100.7");
+    value
+}
+/// A leased opening from the handoff out through the uplink, to `destination`
+/// in the live tuple and `original` in the originally tracked one.
+fn egress(destination: [u8; 4], original: [u8; 4]) -> Flow {
+    Flow {
+        source: TRANSIT,
+        destination,
+        source_port: 10500,
+        destination_port: 443,
+        original: (TRANSIT, original, 10500, 443),
+        ..opening(HANDOFF_LINK, UPLINK_LINK)
+    }
+}
+
+#[test]
+fn host_transit_prepares_the_captured_lab_request_with_an_unprotected_uplink_lease() {
+    // Refused INVALID by 4.0.0: the uplink lease was required to be protected.
+    let lab = prepared(captured());
+    // The lease joins the barrier as a /32, exactly as if the authority had
+    // named it; the covered uplink addresses meet their prefix already.
+    let mut value = captured();
+    value["scope"]["protection"]["prefixes"] = json!(["10.240.0.0/12", "10.92.26.30/32"]);
+    assert_eq!(chains(&lab), chains(&prepared(value)));
+}
+
+#[test]
+fn host_transit_uplink_addresses_need_no_protected_prefix_but_handoff_addresses_do() {
+    assert!(normalized(public()).is_ok());
+    // A handoff address outside the authority still refuses; the control
+    // covering it prepares.
+    let handoff = |prefix: &str| {
+        let mut value = public();
+        value["scope"]["protection"]["prefixes"] =
+            json!([prefix, "192.0.2.0/24", "203.0.113.10/32"]);
+        normalized(value)
+    };
+    assert!(handoff("10.240.0.2/32").is_err());
+    assert!(handoff("10.240.0.0/30").is_ok());
+    // A platform endpoint on the uplink lease lies in protected space, and it
+    // still refuses unless declared host-local.
+    let mut value = public();
+    value["scope"]["protection"]["prefixes"] =
+        json!(["10.0.0.0/8", "192.0.2.0/24", "198.51.100.7/32"]);
+    value["scope"]["protection"]["platformEndpoints"] = json!([
+        {"id":"hub","address":"198.51.100.7","protocol":"tcp","port":8443}]);
+    assert!(normalized(value.clone()).is_err());
+    value["scope"]["localPlatformEndpoints"] = json!(["hub"]);
+    assert!(normalized(value).is_ok());
+}
+
+#[test]
+fn host_transit_barrier_protects_an_unprotected_uplink_lease_as_a_destination() {
+    let with = prepared(public());
+    // Positive control: leased egress to public space passes, including a flow
+    // another owner translated between two public destinations.
+    for flow in [egress(PUBLIC, PUBLIC), egress(PUBLIC, [198, 51, 100, 201])] {
+        assert_eq!(decide(&with, "forward", &flow).verdict, 1);
+    }
+    // A flow whose live or originally tracked destination is the host's own
+    // uplink lease is a translation into the host: the barrier refuses it.
+    for flow in [egress(PUBLIC, UPLINK), egress(UPLINK, PUBLIC)] {
+        let decision = decide(&with, "forward", &flow);
+        assert_eq!(
+            (decision.verdict, decision.chain.as_str()),
+            (0, "protected_out")
+        );
+    }
+    // A packet forwarded toward the handoff from the uplink lease is a spoof.
+    let reply = Flow {
+        input: UPLINK_LINK,
+        output: HANDOFF_LINK,
+        source: UPLINK,
+        destination: TRANSIT,
+        source_port: 443,
+        destination_port: 10500,
+        tcp_flags: ACK,
+        state: ESTABLISHED,
+        reply: true,
+        ..egress(PUBLIC, PUBLIC)
+    };
+    let decision = decide(&with, "forward", &reply);
+    assert_eq!(
+        (decision.verdict, decision.chain.as_str()),
+        (0, "protected_back")
+    );
+    let reply = Flow {
+        source: PUBLIC,
+        ..reply
+    };
+    assert_eq!(decide(&with, "forward", &reply).verdict, 1);
+}
+
+#[test]
+fn host_transit_covered_uplink_compiles_exactly_the_authority_barrier() {
+    // The fixture's uplink lies inside the authority: no address joins the
+    // barrier, and its compiled bytes stay frozen by the golden host test.
+    let covered = chains(&prepared(host()));
+    let public = chains(&prepared(public()));
+    for name in ["protected_out", "protected_back"] {
+        // One /32 adds a live and an originally tracked destination check.
+        assert_eq!(public[name].len(), covered[name].len() + 2, "{name}");
+    }
+}

package/rust/src/egress_workloadgrant_tests.rs

@@ -241,12 +241,6 @@ fn workload_grants_reject_unbound_same_link_local_platform_and_tun_ends() {
             json!([{"protocol":"tcp","sourceAddress":"10.241.0.2","destinationAddress":"10.241.1.2",
                 "destinationPort":80,"bidirectional":true}]),
         ),
-        granted(
-            two_workloads(),
-            json!((0..1025_u16)
-                .map(|port| workload_grant("tcp", "10.241.0.2", "10.241.1.2", 1 + port))
-                .collect::<Vec<_>>()),
-        ),
     ] {
         assert!(
             normalized(invalid.clone()).is_err(),
@@ -254,6 +248,21 @@ fn workload_grants_reject_unbound_same_link_local_platform_and_tun_ends() {
             invalid["scope"]["workloadGrants"]
         );
     }
+    // The contract maximum is a capacity bound.
+    assert_eq!(
+        normalized(granted(
+            two_workloads(),
+            json!((0..1025_u16)
+                .map(|port| workload_grant("tcp", "10.241.0.2", "10.241.1.2", 1 + port))
+                .collect::<Vec<_>>()),
+        ))
+        .unwrap_err(),
+        crate::Error::Exhausted(crate::Bound {
+            name: "workloadGrants",
+            limit: 1024,
+            actual: 1025
+        })
+    );
     // Both directions between two workloads are two separate grants.
     assert!(normalized(granted(
         two_workloads(),

package/rust/src/main.rs

@@ -15,9 +15,22 @@ use std::io::{BufRead, Read, Write};
 /// same lines. A transition carries two complete policies.
 pub(crate) const IPC_BYTES: usize = 1_048_576;
 
+/// A capacity bound of the atomic replacement budget that a policy exceeded: the
+/// stable bound name, its limit and the size the policy reached. Input counts and
+/// the schema-v1 budget are exact; the other compiled budgets stop at the first
+/// message or rule past the limit, so the complete policy needs at least `actual`.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct Bound {
+    pub name: &'static str,
+    pub limit: usize,
+    pub actual: usize,
+}
+
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum Error {
     Invalid,
+    /// The policy does not fit a capacity bound; a smaller policy may fit.
+    Exhausted(Bound),
     Unsupported,
     UnsupportedBackend,
     Permission,
@@ -28,10 +41,23 @@ pub enum Error {
     Unavailable,
 }
 pub type Result<T> = std::result::Result<T, Error>;
+/// Refuses `actual` above the capacity bound `name`.
+pub fn capacity(name: &'static str, limit: usize, actual: usize) -> Result<()> {
+    if actual > limit {
+        Err(Error::Exhausted(Bound {
+            name,
+            limit,
+            actual,
+        }))
+    } else {
+        Ok(())
+    }
+}
 impl Error {
     pub fn code(self) -> &'static str {
         match self {
             Self::Invalid => "INVALID",
+            Self::Exhausted(_) => "EXHAUSTED",
             Self::Unsupported => "UNSUPPORTED_KERNEL",
             Self::UnsupportedBackend => "UNSUPPORTED_BACKEND",
             Self::Permission => "PERMISSION",
@@ -42,6 +68,26 @@ impl Error {
             Self::Unavailable => "UNAVAILABLE",
         }
     }
+    /// The bounded, non-secret refusal text of the response.
+    pub fn message(self) -> String {
+        match self {
+            Self::Invalid => "Managed policy input is invalid.".into(),
+            Self::Exhausted(bound) => format!(
+                "Managed policy exceeds the {} capacity of {}: it reached {}.",
+                bound.name, bound.limit, bound.actual
+            ),
+            _ => "Managed policy operation failed.".into(),
+        }
+    }
+    /// The structured refusal details of the response, if any.
+    pub fn data(self) -> Option<serde_json::Value> {
+        match self {
+            Self::Exhausted(bound) => Some(
+                serde_json::json!({"bound":bound.name,"limit":bound.limit,"actual":bound.actual}),
+            ),
+            _ => None,
+        }
+    }
     pub fn kernel(code: i32) -> Self {
         match -code {
             libc::ENOENT => Self::Absent,
@@ -114,6 +160,16 @@ fn dispatch(owner: &mut Option<owner::Owner>, request: Request) -> Result<serde_
     }
 }
 
+/// The failure response line: the refusal text, the stable code and, for a
+/// capacity refusal, its bound.
+fn failure(id: &str, error: Error) -> serde_json::Value {
+    let mut value = serde_json::json!({"id":id,"success":false,"error":error.message(),"errorCode":error.code()});
+    if let Some(data) = error.data() {
+        value["errorData"] = data;
+    }
+    value
+}
+
 fn main() {
     let arguments = std::env::args().skip(1).collect::<Vec<_>>();
     let (docker_mode, descriptor) = match arguments.as_slice() {
@@ -163,9 +219,7 @@ fn main() {
         let id = request.id.clone();
         let response = match if docker_mode { docker::dispatch(&mut docker, request) } else { dispatch(&mut owner, request) } {
             Ok(result) => serde_json::json!({"id":id,"success":true,"result":result}),
-            Err(error) => {
-                serde_json::json!({"id":id,"success":false,"error":"Managed policy operation failed.","errorCode":error.code()})
-            }
+            Err(error) => failure(&id, error),
         };
         if writeln!(output, "{response}")
             .and_then(|_| output.flush())

package/rust/src/policy.rs

@@ -101,29 +101,26 @@ impl Policy {
         let program = prepared.program(&format!("snft_{}", "x".repeat(59)))?;
         // Reserve enough of the batch for deleting a previous maximum
         // graph, then installing this complete graph in the same transaction.
-        if program.len() > 768
-            || program
+        crate::capacity("operations", 768, program.len())?;
+        crate::capacity(
+            "ruleBytes",
+            100_000,
+            program
                 .iter()
                 .map(|(_, attrs)| wire::encode_attrs(attrs).len() + 20)
-                .sum::<usize>()
-                > 100_000
-        {
-            return Err(Error::Invalid);
-        }
+                .sum(),
+        )?;
         Ok(prepared)
     }
     /// Validates and orders the endpoints and rules. Schema v1 compiles one rule
     /// per endpoint and grant, so it admits 32 endpoints and 128 rules; the
     /// set-backed router scope of schema v2 admits more.
     pub(crate) fn normalize(mut self, endpoints: usize, rules: usize) -> Result<Self> {
-        if self.schema_version != 1
-            || self.revision == 0
-            || self.revision > 9_007_199_254_740_991
-            || self.endpoints.len() > endpoints
-            || self.rules.len() > rules
-        {
+        if self.schema_version != 1 || self.revision == 0 || self.revision > 9_007_199_254_740_991 {
             return Err(Error::Invalid);
         }
+        crate::capacity("endpoints", endpoints, self.endpoints.len())?;
+        crate::capacity("rules", rules, self.rules.len())?;
         let mut ids = BTreeSet::new();
         let mut indices = BTreeSet::new();
         let mut names = BTreeSet::new();