@push.rocks/smartnftables 4.0.1 → 4.2.0

package/rust/src/docker.graph.rs

@@ -9,17 +9,36 @@ fn payload(base: u32, offset: u32, length: u32) -> Attr {
     expr("payload",vec![Attr::u32(1,1),Attr::u32(2,base),Attr::u32(3,offset),Attr::u32(4,length)])
 }
 
+fn span(value: &str) -> Result<(u16, u16)> {
+    let (first,last)=value.split_once(':').unwrap_or((value,value));
+    Ok((first.parse::<u16>().map_err(|_|Error::Invalid)?,last.parse::<u16>().map_err(|_|Error::Invalid)?))
+}
+/// The one key of a rule among alternatives, with its value.
+fn either<'a>(rule: &'a Rule, keys: [&'static str; 2]) -> Result<(usize, &'a str)> {
+    let mut found=keys.iter().enumerate().filter_map(|(index,key)|value(rule,key).ok().map(|value|(index,value)));
+    let result=found.next().ok_or(Error::Invalid)?;
+    if found.next().is_some() {return Err(Error::Invalid);}
+    Ok(result)
+}
+
 /// Fixed Linux UAPI / xtables 1.8.10 and 1.8.11 constructors, not a raw rule API.
 pub(super) fn expected(rule: &Rule) -> Result<Vec<Attr>> {
     let reply=value(rule,"--ctdir")?=="REPLY";
     let new=value(rule,"--ctstate")?=="NEW";
     let protocol=match value(rule,"-p")? {"tcp"=>6_u16,"udp"=>17,_=>return Err(Error::Invalid)};
-    let address=value(rule,"--ctorigsrc")?.parse::<std::net::Ipv4Addr>().map_err(|_|Error::Invalid)?.octets();
-    let ports=value(rule,"--ctorigsrcport")?;
-    let (first,last)=ports.split_once(':').unwrap_or((ports,ports));
-    let first=first.parse::<u16>().map_err(|_|Error::Invalid)?;
-    let last=last.parse::<u16>().map_err(|_|Error::Invalid)?;
-    let mut result=vec![payload(1,if reply {16} else {12},4),compare(address.to_vec())];
+    // The packet's own source (0) or destination (1) address and port.
+    let (side,live)=either(rule,["-s","-d"])?;
+    let live=live.strip_suffix("/32").ok_or(Error::Invalid)?.parse::<std::net::Ipv4Addr>().map_err(|_|Error::Invalid)?.octets();
+    let (port_side,ports)=either(rule,["--sport","--dport"])?;
+    if port_side!=side {return Err(Error::Invalid);}
+    let (first,last)=span(ports)?;
+    // The originally tracked source (0) or destination (1) address and port.
+    let (tracked_side,tracked)=either(rule,["--ctorigsrc","--ctorigdst"])?;
+    let tracked=tracked.parse::<std::net::Ipv4Addr>().map_err(|_|Error::Invalid)?.octets();
+    let (tracked_port_side,tracked_ports)=either(rule,["--ctorigsrcport","--ctorigdstport"])?;
+    if tracked_port_side!=tracked_side {return Err(Error::Invalid);}
+    let (tracked_first,tracked_last)=span(tracked_ports)?;
+    let mut result=vec![payload(1,if side==0 {12} else {16},4),compare(live.to_vec())];
     for (key,argument) in [(6,"-i"),(7,"-o")] {
         result.extend(meta(key,[value(rule,argument)?.as_bytes(),&[0]].concat()));
     }
@@ -30,7 +49,7 @@ pub(super) fn expected(rule: &Rule) -> Result<Vec<Attr>> {
             Attr::nested(4,vec![Attr::bytes(1,vec![0x17])]),Attr::nested(5,vec![Attr::bytes(1,vec![0])]),
         ]),compare(vec![2])]);
     }
-    result.push(payload(2,if reply {2} else {0},2));
+    result.push(payload(2,if side==0 {0} else {2},2));
     result.push(if first==last {compare(first.to_be_bytes().to_vec())} else {
         expr("range",vec![Attr::u32(1,1),Attr::u32(2,0),
             Attr::nested(3,vec![Attr::bytes(1,first.to_be_bytes().to_vec())]),
@@ -38,11 +57,17 @@ pub(super) fn expected(rule: &Rule) -> Result<Vec<Attr>> {
     });
     // xt_conntrack_mtinfo3 is 164 bytes, XT_ALIGN'ed to 168 on both shipped
     // 64-bit Linux targets. All fields and padding are initialized explicitly.
+    // The original source address/mask are at 0/16, its ports at 138/154; the
+    // original destination's at 32/48 and 140/156.
     let mut conntrack=vec![0;168];
-    conntrack[..4].copy_from_slice(&address);
-    conntrack[16..32].fill(0xff); // canonical bare-host nf_inet_addr mask
-    for (offset,number) in [(136,protocol),(138,first),(146,0x1107),
-        (148,if reply {0x1000} else {0}),(150,if new {8} else {2}),(154,last)] {
+    let address=32*tracked_side;
+    conntrack[address..address+4].copy_from_slice(&tracked);
+    conntrack[address+16..address+32].fill(0xff); // canonical bare-host nf_inet_addr mask
+    // STATE|PROTO|DIRECTION with ORIGSRC|ORIGSRC_PORT or ORIGDST|ORIGDST_PORT.
+    let flags=0x1003|if tracked_side==0 {0x0104} else {0x0208};
+    let port=2*tracked_side;
+    for (offset,number) in [(136,protocol),(138+port,tracked_first),(146,flags),
+        (148,if reply {0x1000} else {0}),(150,if new {8} else {2}),(154+port,tracked_last)] {
         conntrack[offset..offset+2].copy_from_slice(&number.to_ne_bytes());
     }
     result.push(expr("match",vec![Attr::string(1,"conntrack"),Attr::u32(2,3),Attr::bytes(3,conntrack)]));

package/rust/src/docker.policy.rs

@@ -63,7 +63,11 @@ impl Policy {
             return Err(Error::Invalid);
         }
         self.barrier.prepared.validate()?;
-        self.scope()?;
+        // The contribution admits handoff flows through Docker's FORWARD path; an
+        // exclusive barrier would drop Docker's own container forwarding.
+        if self.scope()?.exclusive_forwarding {
+            return Err(Error::Invalid);
+        }
         let receipt = &self.barrier.receipt;
         let handle = receipt.table_handle.parse::<u64>().map_err(|_| Error::Invalid)?;
         if handle == 0 || handle.to_string() != receipt.table_handle
@@ -95,46 +99,105 @@ pub struct Rule {
 fn port_range(first: u16, last: u16) -> String {
     if first == last { first.to_string() } else { format!("{first}:{last}") }
 }
+/// One side of a packet or of its originally tracked tuple: an exact address
+/// and an inclusive port span.
+#[derive(Clone, Copy)]
+struct Tuple<'a> {
+    address: &'a str,
+    first: u16,
+    last: u16,
+}
+/// One flow class of the barrier's forward chain, in its original direction:
+/// it enters on `input`, leaves on `output`, carries `live` as its source
+/// (`source`) or destination, and conntrack tracked it with `tracked` as its
+/// original source (`source`) or destination. A leased or symmetric flow is
+/// keyed on its own source, before outer source NAT; an inbound publication on
+/// its translated inside destination and its published outside destination.
+struct Flow<'a> {
+    input: &'a str,
+    output: &'a str,
+    protocol: &'a str,
+    source: bool,
+    live: Tuple<'a>,
+    tracked: Tuple<'a>,
+}
+impl Flow<'_> {
+    /// The ESTABLISHED original direction, a NEW opening (TCP only with SYN and
+    /// FIN/RST/ACK clear) and the ESTABLISHED reply, as the barrier admits them.
+    fn rules(&self, mut push: impl FnMut(Vec<String>) -> Result<()>) -> Result<()> {
+        for state in ["NEW", "ESTABLISHED", "REPLY"] {
+            let reply = state == "REPLY";
+            // The reply swaps the interfaces and the packet's tuple sides; the
+            // originally tracked tuple stays the same.
+            let source = self.source != reply;
+            let mut args: Vec<String> = vec![
+                "-i".into(), if reply { self.output } else { self.input }.into(),
+                "-o".into(), if reply { self.input } else { self.output }.into(),
+                if source { "-s" } else { "-d" }.into(), format!("{}/32", self.live.address),
+                "-p".into(), self.protocol.into(), "-m".into(), self.protocol.into(),
+                if source { "--sport" } else { "--dport" }.into(), port_range(self.live.first, self.live.last),
+            ];
+            if state == "NEW" && self.protocol == "tcp" {
+                args.extend(["--tcp-flags","FIN,SYN,RST,ACK","SYN"].map(String::from));
+            }
+            let (address, port) = if self.source { ("--ctorigsrc", "--ctorigsrcport") } else { ("--ctorigdst", "--ctorigdstport") };
+            args.extend(["-m","conntrack","--ctstate",if reply {"ESTABLISHED"} else {state},"--ctproto",if self.protocol == "tcp" {"6"} else {"17"},address].map(String::from));
+            // Canonical xtables host form: explicit /32 has different unused
+            // conntrack mask bytes and does not survive a save/restore round trip.
+            args.push(self.tracked.address.into());
+            args.push(port.into());args.push(port_range(self.tracked.first,self.tracked.last));
+            args.extend(["--ctdir",if reply {"REPLY"} else {"ORIGINAL"}].map(String::from));
+            push(args)?;
+        }
+        Ok(())
+    }
+}
 impl Prepared {
     pub fn validate(&self) -> Result<()> {
         if self.policy.clone().prepare(self.backend.clone())? != *self { return Err(Error::Invalid); }
         Ok(())
     }
+    /// Every forwarded flow the barrier admits, from the scope's one forwarding
+    /// enumeration: leased ranges first, then each publication's inbound flows
+    /// and, when symmetric, the flows it opens from its target ports.
+    fn flows(&self) -> Result<Vec<Flow<'_>>> {
+        let scope = self.policy.scope()?;
+        let forwarding = scope.forwarding()?;
+        let uplink = scope.uplink.interface_name.as_str();
+        let mut flows = Vec::new();
+        for leased in &forwarding.leased {
+            let tuple = Tuple { address:&leased.allocation.transit_source_address, first:leased.range.first, last:leased.range.last };
+            flows.push(Flow { input:&leased.handoff.link.interface_name, output:uplink, protocol:&leased.range.protocol,
+                source:true, live:tuple, tracked:tuple });
+        }
+        for published in &forwarding.published {
+            let port = published.port;
+            let inside = Tuple { address:&port.target_address, first:port.target_port, last:port.target_last() };
+            let outside = Tuple { address:&port.host_ip, first:port.host_port, last:port.host_last() };
+            let link = published.link.interface_name.as_str();
+            flows.push(Flow { input:uplink, output:link, protocol:&port.protocol, source:false, live:inside, tracked:outside });
+            if port.symmetric {
+                flows.push(Flow { input:link, output:uplink, protocol:&port.protocol, source:true, live:inside, tracked:inside });
+            }
+        }
+        Ok(flows)
+    }
     pub fn rules(&self, options: &Options) -> Result<Vec<Rule>> {
         options.validate()?;
-        let scope = self.policy.scope()?;
+        let digest = self.digest.strip_prefix("sha256:").ok_or(Error::Invalid)?;
         let mut result = Vec::new();
         let mut bytes = 0;
-        for handoff in &scope.handoffs {
-            for allocation in &handoff.allocations {
-                for range in &allocation.source_port_ranges {
-                    for state in ["NEW", "ESTABLISHED", "REPLY"] {
-                        let reply = state == "REPLY";
-                        let mut args: Vec<String> = vec![
-                            "-i".into(), if reply { scope.uplink.interface_name.clone() } else { handoff.link.interface_name.clone() },
-                            "-o".into(), if reply { handoff.link.interface_name.clone() } else { scope.uplink.interface_name.clone() },
-                            if reply { "-d" } else { "-s" }.into(), format!("{}/32", allocation.transit_source_address),
-                            "-p".into(),range.protocol.clone(),"-m".into(),range.protocol.clone(),
-                            if reply { "--dport" } else { "--sport" }.into(),port_range(range.first,range.last),
-                        ];
-                        if state == "NEW" && range.protocol == "tcp" {
-                            args.extend(["--tcp-flags","FIN,SYN,RST,ACK","SYN"].map(String::from));
-                        }
-                        args.extend(["-m","conntrack","--ctstate",if reply {"ESTABLISHED"} else {state},"--ctproto",if range.protocol == "tcp" {"6"} else {"17"},"--ctorigsrc"].map(String::from));
-                        // Canonical xtables host form: explicit /32 has different unused
-                        // conntrack mask bytes and does not survive a save/restore round trip.
-                        args.push(allocation.transit_source_address.clone());
-                        args.push("--ctorigsrcport".into());args.push(port_range(range.first,range.last));
-                        args.extend(["--ctdir",if reply {"REPLY"} else {"ORIGINAL"},"-m","comment","--comment"].map(String::from));
-                        let comment = format!("snftd1:{}:{}:{}:{}",options.owner_id,options.instance_id,self.digest.strip_prefix("sha256:").ok_or(Error::Invalid)?,result.len());
-                        args.push(comment.clone());args.extend(["-j","ACCEPT"].map(String::from));
-                        bytes += args.iter().map(|arg|arg.len()+1).sum::<usize>()+32;
-                        crate::capacity("restoreRules", 192, result.len() + 1)?;
-                        crate::capacity("restoreBytes", 100_000, bytes)?;
-                        result.push(Rule {comment,args});
-                    }
-                }
-            }
+        for flow in self.flows()? {
+            flow.rules(|mut args| {
+                let comment = format!("snftd1:{}:{}:{}:{}",options.owner_id,options.instance_id,digest,result.len());
+                args.extend(["-m","comment","--comment"].map(String::from));
+                args.push(comment.clone());args.extend(["-j","ACCEPT"].map(String::from));
+                bytes += args.iter().map(|arg|arg.len()+1).sum::<usize>()+32;
+                crate::capacity("restoreRules", 192, result.len() + 1)?;
+                crate::capacity("restoreBytes", 100_000, bytes)?;
+                result.push(Rule {comment,args});
+                Ok(())
+            })?;
         }
         Ok(result)
     }

package/rust/src/docker.rs

@@ -71,13 +71,38 @@ impl Owner {
             || expected.receipt.backend!=expected.prepared.backend {return Err(Error::Conflict);}
         Ok(())
     }
-    fn fence(target: &Prepared) -> Result<()> {
-        let scope=target.policy.scope()?;
-        wire::verify_bound_interfaces_down(scope.handoffs.iter().map(|handoff| {
-            let link=&handoff.link;
-            wire::BoundInterface {index:link.interface_index,name:&link.interface_name,kind:&link.interface_kind,
-                mac:link.mac_address.as_deref(),link_index:link.interface_link_index,addresses:&link.required_ipv4_addresses}
-        }))
+    fn handoffs(prepared: &Prepared) -> Result<Vec<&crate::egress::LocalLink>> {
+        Ok(prepared.policy.scope()?.handoffs.iter().map(|handoff|&handoff.link).collect())
+    }
+    fn bound(link: &crate::egress::LocalLink) -> wire::BoundInterface<'_> {
+        wire::BoundInterface {index:link.interface_index,name:&link.interface_name,kind:&link.interface_kind,
+            mac:link.mac_address.as_deref(),link_index:link.interface_link_index,addresses:&link.required_ipv4_addresses}
+    }
+    /// The handoff links of a transition: those both generations bind exactly,
+    /// and those it adds or drops.
+    fn fenced<'a>(previous: Option<&'a Prepared>, target: &'a Prepared) -> Result<(Vec<&'a crate::egress::LocalLink>, Vec<&'a crate::egress::LocalLink>)> {
+        let previous=previous.map(Self::handoffs).transpose()?.unwrap_or_default();
+        let target=Self::handoffs(target)?;
+        let kept=target.iter().copied().filter(|link|previous.contains(link)).collect();
+        let changed=previous.iter().copied().filter(|link|!target.contains(link))
+            .chain(target.iter().copied().filter(|link|!previous.contains(link))).collect();
+        Ok((kept,changed))
+    }
+    /// Reconcile fence, before and after the single restore transaction. A handoff
+    /// link both generations bind exactly may carry packets: the transaction swaps
+    /// the owned block atomically, so a flow both contributions admit passes
+    /// throughout, and the referenced barrier already is the target. Every link
+    /// the transition adds or drops must be down.
+    fn fence(previous: Option<&Prepared>, target: &Prepared) -> Result<()> {
+        let (kept,changed)=Self::fenced(previous,target)?;
+        wire::verify_bound_interfaces(kept.into_iter().map(Self::bound))?;
+        wire::verify_bound_interfaces_down(changed.into_iter().map(Self::bound))
+    }
+    /// Cleanup fence: deletion only withdraws admission. A handoff link that no
+    /// longer exists, such as a veth that left with its router namespace, counts
+    /// as down; one that exists must still be the exact bound link, and down.
+    fn cleanup_fence(prepared: &Prepared) -> Result<()> {
+        wire::verify_bound_interfaces_down_or_absent(Self::handoffs(prepared)?.into_iter().map(Self::bound))
     }
     fn applied(&self, prepared: Prepared, backend: String) -> Applied {
         Applied {receipt:Receipt {identity:self.identity.clone(),backend,revision:prepared.policy.revision,digest:prepared.digest.clone()},prepared}
@@ -102,15 +127,14 @@ impl Owner {
                 return Ok(self.applied(transition.target.clone(),snapshot.backend));
             }
             if !snapshot.verified_matches(&self.options,&previous_rules,deadline)? {return Err(Error::Conflict);}
-            if let Some(previous)=&transition.previous {Self::fence(&previous.prepared)?;}
-            Self::fence(&transition.target)?;
+            let previous=transition.previous.as_ref().map(|v|&v.prepared);
+            Self::fence(previous,&transition.target)?;
             frontend::replace(&previous_rules,&target_rules,deadline)?;
             self.context()?;
             let current=frontend::Snapshot::read(deadline)?;
             if current.backend!=snapshot.backend || !current.verified_matches(&self.options,&target_rules,deadline)? {return Err(Error::Conflict);}
             owner::Owner::verify_external(&transition.target.policy.barrier)?;
-            if let Some(previous)=&transition.previous {Self::fence(&previous.prepared)?;}
-            Self::fence(&transition.target)?;
+            Self::fence(previous,&transition.target)?;
             Ok(self.applied(transition.target.clone(),current.backend))
         })();
         match result {
@@ -141,12 +165,12 @@ impl Owner {
             if current.verified_matches(&self.options,&[],deadline)? {return Ok(());}
             let rules=expected.prepared.rules(&self.options)?;
             if !current.verified_matches(&self.options,&rules,deadline)? {return Err(Error::Conflict);}
-            Self::fence(&expected.prepared)?;
+            Self::cleanup_fence(&expected.prepared)?;
             frontend::replace(&rules,&[],deadline)?;
             self.context()?;
             let after=frontend::Snapshot::read(deadline)?;
             if after.backend!=current.backend || !after.verified_matches(&self.options,&[],deadline)? {return Err(Error::Conflict);}
-            Self::fence(&expected.prepared)
+            Self::cleanup_fence(&expected.prepared)
         })();
         match result {Ok(())=>{self.applied=Some(expected);self.error=None;self.released=true;Ok(())},Err(error)=>{self.error=Some(error);Err(error)}}
     }

package/rust/src/docker_tests.rs

@@ -2,8 +2,9 @@ use super::*;
 use serde_json::json;
 
 fn options() -> Options {Options {owner_id:"dockerfixture".into(),instance_id:"qualification_20260913".into()}}
-fn policy() -> policy::Policy {
-    let prepared:crate::managed::Prepared=serde_json::from_value::<crate::egress::Policy>(crate::egress::tests::host()).unwrap().prepare().unwrap().into();
+fn policy() -> policy::Policy {policy_from(crate::egress::tests::host())}
+fn policy_from(host: serde_json::Value) -> policy::Policy {
+    let prepared:crate::managed::Prepared=serde_json::from_value::<crate::egress::Policy>(host).unwrap().prepare().unwrap().into();
     policy::Policy {schema_version:1,revision:1,barrier:owner::Applied {
         receipt:owner::Receipt {identity:owner::Identity {owner_id:"barrier".into(),instance_id:"qualification_20260913".into(),table_name:"snft_fixture".into(),boot_id:"00000000-0000-4000-8000-000000000000".into(),namespace_device:"4".into(),namespace_inode:"1".into()},table_handle:"1".into(),revision:1,digest:prepared.digest.clone()},prepared}}
 }
@@ -30,6 +31,9 @@ fn docker_prepare_rejects_router_receipts_bad_hashes_and_unbounded_restore() {
     let mut value=policy();value.schema_version=2;assert!(value.prepare("v1.8.11 (nf_tables)".into()).is_err());
     let mut value=policy();value.barrier.receipt.digest="sha256:wrong".into();assert!(value.prepare("v1.8.11 (nf_tables)".into()).is_err());
     let mut value=policy();value.barrier.prepared.policy=crate::managed::Policy::Egress(serde_json::from_value(crate::egress::tests::router()).unwrap());assert!(value.prepare("v1.8.11 (nf_tables)".into()).is_err());
+    let mut exclusive=crate::egress::tests::host();exclusive["scope"]["exclusiveForwarding"]=json!(true);
+    let prepared:crate::managed::Prepared=serde_json::from_value::<crate::egress::Policy>(exclusive).unwrap().prepare().unwrap().into();
+    let mut value=policy();value.barrier.receipt.digest=prepared.digest.clone();value.barrier.prepared=prepared;assert!(value.prepare("v1.8.11 (nf_tables)".into()).is_err());
     let value=serde_json::to_value(policy()).unwrap();
     let mut extra=value.clone();extra["rules"]=json!([]);assert!(serde_json::from_value::<policy::Policy>(extra).is_err());
     let mut extra=value;extra["barrier"]["receipt"]["tableHandle"]=json!("01");assert!(serde_json::from_value::<policy::Policy>(extra).unwrap().prepare("v1.8.11 (nf_tables)".into()).is_err());
@@ -146,3 +150,161 @@ fn docker_forward_jumps_require_exact_unconditional_order() {
         assert!(!graph::matches_forward(&row(expected),if target=="DOCKER-USER" {"DOCKER-FORWARD"} else {"DOCKER-USER"}).unwrap());
     }
 }
+
+/// The exact 4.1.0 contribution of a scope without publications: arguments,
+/// order, comments and native graph bytes are unchanged.
+#[test]
+fn docker_leased_contribution_keeps_its_exact_previous_rules_and_graphs() {
+    let rules=policy().prepare("v1.8.11 (nf_tables)".into()).unwrap().rules(&options()).unwrap();
+    let comment="snftd1:dockerfixture:qualification_20260913:2023fff251e6e68c6ec275e6b5e76f609b8bc0210b18ae3f3c88bfac3a54f5ee";
+    let expected=[
+        "-i handoff -o ens18 -s 10.240.0.2/32 -p tcp -m tcp --sport 10000:10999 --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW --ctproto 6 --ctorigsrc 10.240.0.2 --ctorigsrcport 10000:10999 --ctdir ORIGINAL",
+        "-i handoff -o ens18 -s 10.240.0.2/32 -p tcp -m tcp --sport 10000:10999 -m conntrack --ctstate ESTABLISHED --ctproto 6 --ctorigsrc 10.240.0.2 --ctorigsrcport 10000:10999 --ctdir ORIGINAL",
+        "-i ens18 -o handoff -d 10.240.0.2/32 -p tcp -m tcp --dport 10000:10999 -m conntrack --ctstate ESTABLISHED --ctproto 6 --ctorigsrc 10.240.0.2 --ctorigsrcport 10000:10999 --ctdir REPLY",
+        "-i handoff -o ens18 -s 10.240.0.2/32 -p udp -m udp --sport 10000:10999 -m conntrack --ctstate NEW --ctproto 17 --ctorigsrc 10.240.0.2 --ctorigsrcport 10000:10999 --ctdir ORIGINAL",
+        "-i handoff -o ens18 -s 10.240.0.2/32 -p udp -m udp --sport 10000:10999 -m conntrack --ctstate ESTABLISHED --ctproto 17 --ctorigsrc 10.240.0.2 --ctorigsrcport 10000:10999 --ctdir ORIGINAL",
+        "-i ens18 -o handoff -d 10.240.0.2/32 -p udp -m udp --dport 10000:10999 -m conntrack --ctstate ESTABLISHED --ctproto 17 --ctorigsrc 10.240.0.2 --ctorigsrcport 10000:10999 --ctdir REPLY",
+    ];
+    assert_eq!(rules.len(),expected.len());
+    for (index,(rule,args)) in rules.iter().zip(expected).enumerate() {
+        assert_eq!(rule.args.join(" "),format!("{args} -m comment --comment {comment}:{index} -j ACCEPT"));
+    }
+    let mut digest=<sha2::Sha256 as sha2::Digest>::new();
+    for rule in &rules {sha2::Digest::update(&mut digest,crate::wire::encode_attrs(&graph::expected(rule).unwrap()));}
+    assert_eq!(format!("{:x}",sha2::Digest::finalize(digest)),"dc46825f57c6f0001c1a517760e9e5560e4a5ee90f00322075c4b96e41e24c79");
+}
+
+fn published() -> policy::Policy {
+    let mut range=crate::egress::tests::published_port("udp",20000,20000);
+    range["hostPortEnd"]=json!(20200);range["symmetric"]=json!(true);
+    policy_from(crate::egress::tests::published_host(json!([range,crate::egress::tests::published_port("tcp",443,8443)])))
+}
+fn conntrack(expressions: &[crate::wire::Attr]) -> Vec<u8> {
+    for expression in expressions {
+        let fields=crate::wire::attrs(&expression.value).unwrap();
+        if crate::wire::text(&fields,1).unwrap()!="match" {continue;}
+        let data=crate::wire::attrs(&crate::wire::one(&fields,2).unwrap().value).unwrap();
+        if crate::wire::text(&data,1).unwrap()=="conntrack" {return crate::wire::one(&data,3).unwrap().value.clone();}
+    }
+    panic!("no conntrack match")
+}
+fn word(bytes: &[u8], offset: usize) -> u16 {u16::from_ne_bytes([bytes[offset],bytes[offset+1]])}
+
+/// Inbound publications and their replies, and the flows a symmetric
+/// publication opens from its target ports, as the barrier's forward chain
+/// admits them: leased ranges first, then publications in canonical order.
+#[test]
+fn docker_contribution_admits_every_published_and_symmetric_flow_of_the_barrier() {
+    let prepared=published().prepare("v1.8.11 (nf_tables)".into()).unwrap();
+    let rules=prepared.rules(&options()).unwrap();
+    // 2 leased ranges, 2 inbound publications and 1 symmetric publication, each
+    // NEW, ESTABLISHED and the ESTABLISHED reply.
+    assert_eq!(rules.len(),15);
+    let args=|index: usize|rules[index].args[..rules[index].args.len()-6].join(" ");
+    assert_eq!(args(6),"-i ens18 -o handoff -d 10.240.0.2/32 -p tcp -m tcp --dport 8443 --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW --ctproto 6 --ctorigdst 192.0.2.2 --ctorigdstport 443 --ctdir ORIGINAL");
+    assert_eq!(args(7),"-i ens18 -o handoff -d 10.240.0.2/32 -p tcp -m tcp --dport 8443 -m conntrack --ctstate ESTABLISHED --ctproto 6 --ctorigdst 192.0.2.2 --ctorigdstport 443 --ctdir ORIGINAL");
+    assert_eq!(args(8),"-i handoff -o ens18 -s 10.240.0.2/32 -p tcp -m tcp --sport 8443 -m conntrack --ctstate ESTABLISHED --ctproto 6 --ctorigdst 192.0.2.2 --ctorigdstport 443 --ctdir REPLY");
+    assert_eq!(args(9),"-i ens18 -o handoff -d 10.240.0.2/32 -p udp -m udp --dport 20000:20200 -m conntrack --ctstate NEW --ctproto 17 --ctorigdst 192.0.2.2 --ctorigdstport 20000:20200 --ctdir ORIGINAL");
+    assert_eq!(args(11),"-i handoff -o ens18 -s 10.240.0.2/32 -p udp -m udp --sport 20000:20200 -m conntrack --ctstate ESTABLISHED --ctproto 17 --ctorigdst 192.0.2.2 --ctorigdstport 20000:20200 --ctdir REPLY");
+    assert_eq!(args(12),"-i handoff -o ens18 -s 10.240.0.2/32 -p udp -m udp --sport 20000:20200 -m conntrack --ctstate NEW --ctproto 17 --ctorigsrc 10.240.0.2 --ctorigsrcport 20000:20200 --ctdir ORIGINAL");
+    assert_eq!(args(13),"-i handoff -o ens18 -s 10.240.0.2/32 -p udp -m udp --sport 20000:20200 -m conntrack --ctstate ESTABLISHED --ctproto 17 --ctorigsrc 10.240.0.2 --ctorigsrcport 20000:20200 --ctdir ORIGINAL");
+    assert_eq!(args(14),"-i ens18 -o handoff -d 10.240.0.2/32 -p udp -m udp --dport 20000:20200 -m conntrack --ctstate ESTABLISHED --ctproto 17 --ctorigsrc 10.240.0.2 --ctorigsrcport 20000:20200 --ctdir REPLY");
+    // Without publications only the leased rules remain; a non-symmetric
+    // publication opens nothing from its target ports.
+    let mut plain=crate::egress::tests::published_port("udp",20000,20000);plain["hostPortEnd"]=json!(20200);
+    let plain=policy_from(crate::egress::tests::published_host(json!([plain]))).prepare("v1.8.11 (nf_tables)".into()).unwrap().rules(&options()).unwrap();
+    assert_eq!(plain.len(),9);
+    assert!(plain.iter().all(|rule|!rule.args.windows(2).any(|w|w==["--ctorigsrcport","20000:20200"])));
+    assert!(snapshot(&text(&rules)).matches(&options(),&rules).unwrap());
+}
+
+#[test]
+fn docker_inbound_graph_binds_the_original_destination_tuple() {
+    let rules=published().prepare("v1.8.11 (nf_tables)".into()).unwrap().rules(&options()).unwrap();
+    for (index,reply) in [(6,false),(8,true)] {
+        let expressions=graph::expected(&rules[index]).unwrap();
+        let data=conntrack(&expressions);
+        assert_eq!(data.len(),168);
+        assert!(data[..32].iter().all(|byte|*byte==0));
+        assert_eq!(&data[32..36],&[192,0,2,2]);
+        assert!(data[36..48].iter().all(|byte|*byte==0) && data[48..64].iter().all(|byte|*byte==0xff));
+        assert_eq!((word(&data,136),word(&data,138),word(&data,140),word(&data,146),word(&data,148),word(&data,150)),
+            (6,0,443,0x120b,if reply {0x1000} else {0},if reply {2} else {8}));
+        assert_eq!((word(&data,154),word(&data,156)),(0,443));
+        // The live tuple: the translated inside destination, or its reply source.
+        let payload=crate::wire::attrs(&expressions[0].value).unwrap();
+        let fields=crate::wire::attrs(&crate::wire::one(&payload,2).unwrap().value).unwrap();
+        assert_eq!(crate::wire::one(&fields,3).unwrap().value,(if reply {12_u32} else {16}).to_be_bytes());
+        let row=|expressions|vec![crate::wire::Attr::string(1,"filter"),crate::wire::Attr::string(2,"DOCKER-USER"),
+            crate::wire::Attr::u64(3,42),crate::wire::Attr::nested(4,expressions)];
+        assert!(graph::matches_rule(&row(expressions.clone()),&rules[index]).unwrap());
+        let mut hidden=expressions.clone();
+        for expression in &mut hidden {
+            let mut fields=crate::wire::attrs(&expression.value).unwrap();
+            if crate::wire::text(&fields,1).unwrap()!="match" {continue;}
+            let mut data=crate::wire::attrs(&crate::wire::one(&fields,2).unwrap().value).unwrap();
+            if crate::wire::text(&data,1).unwrap()!="conntrack" {continue;}
+            data.iter_mut().find(|a|a.id()==3).unwrap().value[52..64].fill(0);
+            *fields.iter_mut().find(|a|a.id()==2).unwrap()=crate::wire::Attr::nested(2,data);
+            expression.value=crate::wire::encode_attrs(&fields);
+        }
+        assert!(!graph::matches_rule(&row(hidden),&rules[index]).unwrap());
+    }
+    // A ranged inbound publication binds its whole outside span.
+    let data=conntrack(&graph::expected(&rules[9]).unwrap());
+    assert_eq!((word(&data,140),word(&data,156)),(20000,20200));
+}
+
+#[test]
+fn docker_snapshot_accepts_rendered_destination_tuples_and_rejects_changed_ones() {
+    let rules=published().prepare("v1.8.11 (nf_tables)".into()).unwrap().rules(&options()).unwrap();
+    let original=text(&rules);
+    assert!(snapshot(&original.replace("--ctorigdst 192.0.2.2 ","--ctorigdst 192.0.2.2/32 ")).matches(&options(),&rules).unwrap());
+    for (before,after) in [("--ctorigdstport 443","--ctorigdstport 444"),("--ctorigdst 192.0.2.2","--ctorigsrc 192.0.2.2"),
+        ("--dport 8443","--dport 8444"),("--ctorigdst 192.0.2.2","--ctorigdst 192.0.2.3")] {
+        assert!(!snapshot(&original.replacen(before,after,1)).matches(&options(),&rules).unwrap());
+    }
+}
+
+#[test]
+fn docker_contribution_keeps_its_restore_bound() {
+    let ports:Vec<_>=(0..64_u16).map(|index|crate::egress::tests::published_port("tcp",443+index,443+index)).collect();
+    let error=policy_from(crate::egress::tests::published_host(json!(ports))).prepare("v1.8.11 (nf_tables)".into()).unwrap_err();
+    assert_eq!(error.code(),"EXHAUSTED");
+}
+
+fn absent(mut host: serde_json::Value) -> serde_json::Value {
+    // No link holds this index on a test host.
+    host["scope"]["handoffs"][0]["link"]["interfaceIndex"]=json!(2_147_483_000_u32);host
+}
+
+#[test]
+fn docker_reconcile_fence_lets_only_links_both_generations_bind_carry_packets() {
+    let target=policy().prepare("v1.8.11 (nf_tables)".into()).unwrap();
+    let amended=published().prepare("v1.8.11 (nf_tables)".into()).unwrap();
+    let moved=policy_from(absent(crate::egress::tests::host())).prepare("v1.8.11 (nf_tables)".into()).unwrap();
+    let names=|links: Vec<&crate::egress::LocalLink>|links.iter().map(|link|link.interface_index).collect::<Vec<_>>();
+    let (kept,changed)=Owner::fenced(None,&target).unwrap();
+    assert_eq!((names(kept),names(changed)),(vec![],vec![4]));
+    let (kept,changed)=Owner::fenced(Some(&target),&amended).unwrap();
+    assert_eq!((names(kept),names(changed)),(vec![4],vec![]));
+    let (kept,changed)=Owner::fenced(Some(&target),&moved).unwrap();
+    assert_eq!((names(kept),names(changed)),(vec![],vec![4,2_147_483_000]));
+    // A link the transition keeps must still exist exactly.
+    assert!(Owner::fence(Some(&moved),&moved).is_err());
+    assert!(Owner::fence(None,&moved).is_err());
+}
+
+#[test]
+fn docker_cleanup_fence_counts_a_vanished_handoff_as_down() {
+    let gone=policy_from(absent(crate::egress::tests::host())).prepare("v1.8.11 (nf_tables)".into()).unwrap();
+    Owner::cleanup_fence(&gone).unwrap();
+    // The mutation fence still requires the exact link.
+    let link=&gone.policy.scope().unwrap().handoffs[0].link;
+    assert!(crate::wire::verify_bound_interfaces_down(std::iter::once(Owner::bound(link))).is_err());
+    // A different link at a bound index is not the bound link.
+    let mut loopback=crate::egress::tests::host();
+    loopback["scope"]["handoffs"][0]["link"]["interfaceIndex"]=json!(1);
+    let loopback=policy_from(loopback).prepare("v1.8.11 (nf_tables)".into()).unwrap();
+    assert_eq!(Owner::cleanup_fence(&loopback),Err(Error::Conflict));
+}

package/rust/src/egress.host.rs

@@ -84,34 +84,31 @@ fn leased(
     expressions.extend(original_range(range.first, range.last));
     Ok(expressions)
 }
-/// The publications of this hop. Validation admits only leased transit source
-/// addresses as targets, and one address never spans two active handoff links,
-/// so each publication has exactly one handoff.
-fn hop(scope: &HostScope) -> Result<published::Hop<'_>> {
-    let mut publications = Vec::new();
-    for port in &scope.published_ports {
-        let handoff = scope
-            .handoffs
-            .iter()
-            .find(|handoff| {
-                handoff
-                    .allocations
-                    .iter()
-                    .any(|allocation| allocation.transit_source_address == port.target_address)
-            })
-            .ok_or(crate::Error::Invalid)?;
-        publications.push(published::Publication {
-            protocol: &port.protocol,
-            outside: (&port.host_ip, port.host_port, port.host_last()),
-            inside: (&port.target_address, port.target_port, port.target_last()),
-            link: &handoff.link,
-            symmetric: port.symmetric,
-        });
-    }
-    Ok(published::Hop {
+/// The publications of this hop, from the scope's forwarding enumeration.
+fn hop<'a>(scope: &'a HostScope, forwarding: &Forwarding<'a>) -> published::Hop<'a> {
+    let publications = forwarding
+        .published
+        .iter()
+        .map(|item| published::Publication {
+            protocol: &item.port.protocol,
+            outside: (
+                &item.port.host_ip,
+                item.port.host_port,
+                item.port.host_last(),
+            ),
+            inside: (
+                &item.port.target_address,
+                item.port.target_port,
+                item.port.target_last(),
+            ),
+            link: item.link,
+            symmetric: item.port.symmetric,
+        })
+        .collect();
+    published::Hop {
         publications,
         fixed: &scope.uplink,
-    })
+    }
 }
 /// The exact platform endpoints served on host addresses. Every packet is
 /// checked against the live and the originally tracked destination tuple, so a
@@ -219,7 +216,8 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &HostScope) -> Result<()
                 .ok_or(crate::Error::Invalid)
         })?;
     }
-    let hop = hop(scope)?;
+    let forwarding = scope.forwarding()?;
+    let hop = hop(scope, &forwarding);
     published::sets(program, &hop, false)?;
     protection(program, scope, false)?;
     protection(program, scope, true)?;
@@ -241,26 +239,27 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &HostScope) -> Result<()
         program.jump("forward", link(&handoff.link, true), "protected_out")?;
         program.jump("forward", link(&handoff.link, false), "protected_back")?;
     }
-    for handoff in &scope.handoffs {
-        for allocation in &handoff.allocations {
-            for range in &allocation.source_port_ranges {
-                let original = envelope(scope, handoff, allocation, range, false)?;
-                for connection_state in [2, 8] {
-                    let mut expressions = original.clone();
-                    expressions.extend(state(connection_state));
-                    if connection_state == 8 && range.protocol == "tcp" {
-                        expressions.extend(opening_tcp());
-                    }
-                    program.end("forward", expressions, 1)?;
-                }
-                let mut reply = envelope(scope, handoff, allocation, range, true)?;
-                reply.extend(state(2));
-                program.end("forward", reply, 1)?;
-                let mut nat = original;
-                nat.extend(snat(&scope.snat_address, None)?);
-                program.rule("post", nat)?;
+    for LeasedForward {
+        handoff,
+        allocation,
+        range,
+    } in &forwarding.leased
+    {
+        let original = envelope(scope, handoff, allocation, range, false)?;
+        for connection_state in [2, 8] {
+            let mut expressions = original.clone();
+            expressions.extend(state(connection_state));
+            if connection_state == 8 && range.protocol == "tcp" {
+                expressions.extend(opening_tcp());
             }
+            program.end("forward", expressions, 1)?;
         }
+        let mut reply = envelope(scope, handoff, allocation, range, true)?;
+        reply.extend(state(2));
+        program.end("forward", reply, 1)?;
+        let mut nat = original;
+        nat.extend(snat(&scope.snat_address, None)?);
+        program.rule("post", nat)?;
     }
     // Symmetric flows leave from ports outside every leased range of their
     // address, after the capture barrier and before the terminal handoff denials.
@@ -272,5 +271,14 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &HostScope) -> Result<()
         program.deny_link("forward", &handoff.link, true)?;
         program.deny_link("forward", &handoff.link, false)?;
     }
+    // Exclusive forwarding: everything the forward chain has not accepted by now
+    // drops, of every family and on every pair of interfaces, so the host
+    // forwards exactly this scope's leased, published and symmetric handoff
+    // flows. nftables runs every table's forward base chain, and a drop in any
+    // one is final: this denies forwarding that other owners would accept, and
+    // accepting here still cannot override their drops.
+    if scope.exclusive_forwarding {
+        program.end("forward", vec![], 0)?;
+    }
     Ok(())
 }