@push.rocks/smartnftables 4.1.0 → 4.2.0

package/rust/src/docker.policy.rs

@@ -99,46 +99,105 @@ pub struct Rule {
 fn port_range(first: u16, last: u16) -> String {
     if first == last { first.to_string() } else { format!("{first}:{last}") }
 }
+/// One side of a packet or of its originally tracked tuple: an exact address
+/// and an inclusive port span.
+#[derive(Clone, Copy)]
+struct Tuple<'a> {
+    address: &'a str,
+    first: u16,
+    last: u16,
+}
+/// One flow class of the barrier's forward chain, in its original direction:
+/// it enters on `input`, leaves on `output`, carries `live` as its source
+/// (`source`) or destination, and conntrack tracked it with `tracked` as its
+/// original source (`source`) or destination. A leased or symmetric flow is
+/// keyed on its own source, before outer source NAT; an inbound publication on
+/// its translated inside destination and its published outside destination.
+struct Flow<'a> {
+    input: &'a str,
+    output: &'a str,
+    protocol: &'a str,
+    source: bool,
+    live: Tuple<'a>,
+    tracked: Tuple<'a>,
+}
+impl Flow<'_> {
+    /// The ESTABLISHED original direction, a NEW opening (TCP only with SYN and
+    /// FIN/RST/ACK clear) and the ESTABLISHED reply, as the barrier admits them.
+    fn rules(&self, mut push: impl FnMut(Vec<String>) -> Result<()>) -> Result<()> {
+        for state in ["NEW", "ESTABLISHED", "REPLY"] {
+            let reply = state == "REPLY";
+            // The reply swaps the interfaces and the packet's tuple sides; the
+            // originally tracked tuple stays the same.
+            let source = self.source != reply;
+            let mut args: Vec<String> = vec![
+                "-i".into(), if reply { self.output } else { self.input }.into(),
+                "-o".into(), if reply { self.input } else { self.output }.into(),
+                if source { "-s" } else { "-d" }.into(), format!("{}/32", self.live.address),
+                "-p".into(), self.protocol.into(), "-m".into(), self.protocol.into(),
+                if source { "--sport" } else { "--dport" }.into(), port_range(self.live.first, self.live.last),
+            ];
+            if state == "NEW" && self.protocol == "tcp" {
+                args.extend(["--tcp-flags","FIN,SYN,RST,ACK","SYN"].map(String::from));
+            }
+            let (address, port) = if self.source { ("--ctorigsrc", "--ctorigsrcport") } else { ("--ctorigdst", "--ctorigdstport") };
+            args.extend(["-m","conntrack","--ctstate",if reply {"ESTABLISHED"} else {state},"--ctproto",if self.protocol == "tcp" {"6"} else {"17"},address].map(String::from));
+            // Canonical xtables host form: explicit /32 has different unused
+            // conntrack mask bytes and does not survive a save/restore round trip.
+            args.push(self.tracked.address.into());
+            args.push(port.into());args.push(port_range(self.tracked.first,self.tracked.last));
+            args.extend(["--ctdir",if reply {"REPLY"} else {"ORIGINAL"}].map(String::from));
+            push(args)?;
+        }
+        Ok(())
+    }
+}
 impl Prepared {
     pub fn validate(&self) -> Result<()> {
         if self.policy.clone().prepare(self.backend.clone())? != *self { return Err(Error::Invalid); }
         Ok(())
     }
+    /// Every forwarded flow the barrier admits, from the scope's one forwarding
+    /// enumeration: leased ranges first, then each publication's inbound flows
+    /// and, when symmetric, the flows it opens from its target ports.
+    fn flows(&self) -> Result<Vec<Flow<'_>>> {
+        let scope = self.policy.scope()?;
+        let forwarding = scope.forwarding()?;
+        let uplink = scope.uplink.interface_name.as_str();
+        let mut flows = Vec::new();
+        for leased in &forwarding.leased {
+            let tuple = Tuple { address:&leased.allocation.transit_source_address, first:leased.range.first, last:leased.range.last };
+            flows.push(Flow { input:&leased.handoff.link.interface_name, output:uplink, protocol:&leased.range.protocol,
+                source:true, live:tuple, tracked:tuple });
+        }
+        for published in &forwarding.published {
+            let port = published.port;
+            let inside = Tuple { address:&port.target_address, first:port.target_port, last:port.target_last() };
+            let outside = Tuple { address:&port.host_ip, first:port.host_port, last:port.host_last() };
+            let link = published.link.interface_name.as_str();
+            flows.push(Flow { input:uplink, output:link, protocol:&port.protocol, source:false, live:inside, tracked:outside });
+            if port.symmetric {
+                flows.push(Flow { input:link, output:uplink, protocol:&port.protocol, source:true, live:inside, tracked:inside });
+            }
+        }
+        Ok(flows)
+    }
     pub fn rules(&self, options: &Options) -> Result<Vec<Rule>> {
         options.validate()?;
-        let scope = self.policy.scope()?;
+        let digest = self.digest.strip_prefix("sha256:").ok_or(Error::Invalid)?;
         let mut result = Vec::new();
         let mut bytes = 0;
-        for handoff in &scope.handoffs {
-            for allocation in &handoff.allocations {
-                for range in &allocation.source_port_ranges {
-                    for state in ["NEW", "ESTABLISHED", "REPLY"] {
-                        let reply = state == "REPLY";
-                        let mut args: Vec<String> = vec![
-                            "-i".into(), if reply { scope.uplink.interface_name.clone() } else { handoff.link.interface_name.clone() },
-                            "-o".into(), if reply { handoff.link.interface_name.clone() } else { scope.uplink.interface_name.clone() },
-                            if reply { "-d" } else { "-s" }.into(), format!("{}/32", allocation.transit_source_address),
-                            "-p".into(),range.protocol.clone(),"-m".into(),range.protocol.clone(),
-                            if reply { "--dport" } else { "--sport" }.into(),port_range(range.first,range.last),
-                        ];
-                        if state == "NEW" && range.protocol == "tcp" {
-                            args.extend(["--tcp-flags","FIN,SYN,RST,ACK","SYN"].map(String::from));
-                        }
-                        args.extend(["-m","conntrack","--ctstate",if reply {"ESTABLISHED"} else {state},"--ctproto",if range.protocol == "tcp" {"6"} else {"17"},"--ctorigsrc"].map(String::from));
-                        // Canonical xtables host form: explicit /32 has different unused
-                        // conntrack mask bytes and does not survive a save/restore round trip.
-                        args.push(allocation.transit_source_address.clone());
-                        args.push("--ctorigsrcport".into());args.push(port_range(range.first,range.last));
-                        args.extend(["--ctdir",if reply {"REPLY"} else {"ORIGINAL"},"-m","comment","--comment"].map(String::from));
-                        let comment = format!("snftd1:{}:{}:{}:{}",options.owner_id,options.instance_id,self.digest.strip_prefix("sha256:").ok_or(Error::Invalid)?,result.len());
-                        args.push(comment.clone());args.extend(["-j","ACCEPT"].map(String::from));
-                        bytes += args.iter().map(|arg|arg.len()+1).sum::<usize>()+32;
-                        crate::capacity("restoreRules", 192, result.len() + 1)?;
-                        crate::capacity("restoreBytes", 100_000, bytes)?;
-                        result.push(Rule {comment,args});
-                    }
-                }
-            }
+        for flow in self.flows()? {
+            flow.rules(|mut args| {
+                let comment = format!("snftd1:{}:{}:{}:{}",options.owner_id,options.instance_id,digest,result.len());
+                args.extend(["-m","comment","--comment"].map(String::from));
+                args.push(comment.clone());args.extend(["-j","ACCEPT"].map(String::from));
+                bytes += args.iter().map(|arg|arg.len()+1).sum::<usize>()+32;
+                crate::capacity("restoreRules", 192, result.len() + 1)?;
+                crate::capacity("restoreBytes", 100_000, bytes)?;
+                result.push(Rule {comment,args});
+                Ok(())
+            })?;
         }
         Ok(result)
     }

package/rust/src/docker.rs

@@ -71,13 +71,38 @@ impl Owner {
             || expected.receipt.backend!=expected.prepared.backend {return Err(Error::Conflict);}
         Ok(())
     }
-    fn fence(target: &Prepared) -> Result<()> {
-        let scope=target.policy.scope()?;
-        wire::verify_bound_interfaces_down(scope.handoffs.iter().map(|handoff| {
-            let link=&handoff.link;
-            wire::BoundInterface {index:link.interface_index,name:&link.interface_name,kind:&link.interface_kind,
-                mac:link.mac_address.as_deref(),link_index:link.interface_link_index,addresses:&link.required_ipv4_addresses}
-        }))
+    fn handoffs(prepared: &Prepared) -> Result<Vec<&crate::egress::LocalLink>> {
+        Ok(prepared.policy.scope()?.handoffs.iter().map(|handoff|&handoff.link).collect())
+    }
+    fn bound(link: &crate::egress::LocalLink) -> wire::BoundInterface<'_> {
+        wire::BoundInterface {index:link.interface_index,name:&link.interface_name,kind:&link.interface_kind,
+            mac:link.mac_address.as_deref(),link_index:link.interface_link_index,addresses:&link.required_ipv4_addresses}
+    }
+    /// The handoff links of a transition: those both generations bind exactly,
+    /// and those it adds or drops.
+    fn fenced<'a>(previous: Option<&'a Prepared>, target: &'a Prepared) -> Result<(Vec<&'a crate::egress::LocalLink>, Vec<&'a crate::egress::LocalLink>)> {
+        let previous=previous.map(Self::handoffs).transpose()?.unwrap_or_default();
+        let target=Self::handoffs(target)?;
+        let kept=target.iter().copied().filter(|link|previous.contains(link)).collect();
+        let changed=previous.iter().copied().filter(|link|!target.contains(link))
+            .chain(target.iter().copied().filter(|link|!previous.contains(link))).collect();
+        Ok((kept,changed))
+    }
+    /// Reconcile fence, before and after the single restore transaction. A handoff
+    /// link both generations bind exactly may carry packets: the transaction swaps
+    /// the owned block atomically, so a flow both contributions admit passes
+    /// throughout, and the referenced barrier already is the target. Every link
+    /// the transition adds or drops must be down.
+    fn fence(previous: Option<&Prepared>, target: &Prepared) -> Result<()> {
+        let (kept,changed)=Self::fenced(previous,target)?;
+        wire::verify_bound_interfaces(kept.into_iter().map(Self::bound))?;
+        wire::verify_bound_interfaces_down(changed.into_iter().map(Self::bound))
+    }
+    /// Cleanup fence: deletion only withdraws admission. A handoff link that no
+    /// longer exists, such as a veth that left with its router namespace, counts
+    /// as down; one that exists must still be the exact bound link, and down.
+    fn cleanup_fence(prepared: &Prepared) -> Result<()> {
+        wire::verify_bound_interfaces_down_or_absent(Self::handoffs(prepared)?.into_iter().map(Self::bound))
     }
     fn applied(&self, prepared: Prepared, backend: String) -> Applied {
         Applied {receipt:Receipt {identity:self.identity.clone(),backend,revision:prepared.policy.revision,digest:prepared.digest.clone()},prepared}
@@ -102,15 +127,14 @@ impl Owner {
                 return Ok(self.applied(transition.target.clone(),snapshot.backend));
             }
             if !snapshot.verified_matches(&self.options,&previous_rules,deadline)? {return Err(Error::Conflict);}
-            if let Some(previous)=&transition.previous {Self::fence(&previous.prepared)?;}
-            Self::fence(&transition.target)?;
+            let previous=transition.previous.as_ref().map(|v|&v.prepared);
+            Self::fence(previous,&transition.target)?;
             frontend::replace(&previous_rules,&target_rules,deadline)?;
             self.context()?;
             let current=frontend::Snapshot::read(deadline)?;
             if current.backend!=snapshot.backend || !current.verified_matches(&self.options,&target_rules,deadline)? {return Err(Error::Conflict);}
             owner::Owner::verify_external(&transition.target.policy.barrier)?;
-            if let Some(previous)=&transition.previous {Self::fence(&previous.prepared)?;}
-            Self::fence(&transition.target)?;
+            Self::fence(previous,&transition.target)?;
             Ok(self.applied(transition.target.clone(),current.backend))
         })();
         match result {
@@ -141,12 +165,12 @@ impl Owner {
             if current.verified_matches(&self.options,&[],deadline)? {return Ok(());}
             let rules=expected.prepared.rules(&self.options)?;
             if !current.verified_matches(&self.options,&rules,deadline)? {return Err(Error::Conflict);}
-            Self::fence(&expected.prepared)?;
+            Self::cleanup_fence(&expected.prepared)?;
             frontend::replace(&rules,&[],deadline)?;
             self.context()?;
             let after=frontend::Snapshot::read(deadline)?;
             if after.backend!=current.backend || !after.verified_matches(&self.options,&[],deadline)? {return Err(Error::Conflict);}
-            Self::fence(&expected.prepared)
+            Self::cleanup_fence(&expected.prepared)
         })();
         match result {Ok(())=>{self.applied=Some(expected);self.error=None;self.released=true;Ok(())},Err(error)=>{self.error=Some(error);Err(error)}}
     }

package/rust/src/docker_tests.rs

@@ -2,8 +2,9 @@ use super::*;
 use serde_json::json;
 
 fn options() -> Options {Options {owner_id:"dockerfixture".into(),instance_id:"qualification_20260913".into()}}
-fn policy() -> policy::Policy {
-    let prepared:crate::managed::Prepared=serde_json::from_value::<crate::egress::Policy>(crate::egress::tests::host()).unwrap().prepare().unwrap().into();
+fn policy() -> policy::Policy {policy_from(crate::egress::tests::host())}
+fn policy_from(host: serde_json::Value) -> policy::Policy {
+    let prepared:crate::managed::Prepared=serde_json::from_value::<crate::egress::Policy>(host).unwrap().prepare().unwrap().into();
     policy::Policy {schema_version:1,revision:1,barrier:owner::Applied {
         receipt:owner::Receipt {identity:owner::Identity {owner_id:"barrier".into(),instance_id:"qualification_20260913".into(),table_name:"snft_fixture".into(),boot_id:"00000000-0000-4000-8000-000000000000".into(),namespace_device:"4".into(),namespace_inode:"1".into()},table_handle:"1".into(),revision:1,digest:prepared.digest.clone()},prepared}}
 }
@@ -149,3 +150,161 @@ fn docker_forward_jumps_require_exact_unconditional_order() {
         assert!(!graph::matches_forward(&row(expected),if target=="DOCKER-USER" {"DOCKER-FORWARD"} else {"DOCKER-USER"}).unwrap());
     }
 }
+
+/// The exact 4.1.0 contribution of a scope without publications: arguments,
+/// order, comments and native graph bytes are unchanged.
+#[test]
+fn docker_leased_contribution_keeps_its_exact_previous_rules_and_graphs() {
+    let rules=policy().prepare("v1.8.11 (nf_tables)".into()).unwrap().rules(&options()).unwrap();
+    let comment="snftd1:dockerfixture:qualification_20260913:2023fff251e6e68c6ec275e6b5e76f609b8bc0210b18ae3f3c88bfac3a54f5ee";
+    let expected=[
+        "-i handoff -o ens18 -s 10.240.0.2/32 -p tcp -m tcp --sport 10000:10999 --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW --ctproto 6 --ctorigsrc 10.240.0.2 --ctorigsrcport 10000:10999 --ctdir ORIGINAL",
+        "-i handoff -o ens18 -s 10.240.0.2/32 -p tcp -m tcp --sport 10000:10999 -m conntrack --ctstate ESTABLISHED --ctproto 6 --ctorigsrc 10.240.0.2 --ctorigsrcport 10000:10999 --ctdir ORIGINAL",
+        "-i ens18 -o handoff -d 10.240.0.2/32 -p tcp -m tcp --dport 10000:10999 -m conntrack --ctstate ESTABLISHED --ctproto 6 --ctorigsrc 10.240.0.2 --ctorigsrcport 10000:10999 --ctdir REPLY",
+        "-i handoff -o ens18 -s 10.240.0.2/32 -p udp -m udp --sport 10000:10999 -m conntrack --ctstate NEW --ctproto 17 --ctorigsrc 10.240.0.2 --ctorigsrcport 10000:10999 --ctdir ORIGINAL",
+        "-i handoff -o ens18 -s 10.240.0.2/32 -p udp -m udp --sport 10000:10999 -m conntrack --ctstate ESTABLISHED --ctproto 17 --ctorigsrc 10.240.0.2 --ctorigsrcport 10000:10999 --ctdir ORIGINAL",
+        "-i ens18 -o handoff -d 10.240.0.2/32 -p udp -m udp --dport 10000:10999 -m conntrack --ctstate ESTABLISHED --ctproto 17 --ctorigsrc 10.240.0.2 --ctorigsrcport 10000:10999 --ctdir REPLY",
+    ];
+    assert_eq!(rules.len(),expected.len());
+    for (index,(rule,args)) in rules.iter().zip(expected).enumerate() {
+        assert_eq!(rule.args.join(" "),format!("{args} -m comment --comment {comment}:{index} -j ACCEPT"));
+    }
+    let mut digest=<sha2::Sha256 as sha2::Digest>::new();
+    for rule in &rules {sha2::Digest::update(&mut digest,crate::wire::encode_attrs(&graph::expected(rule).unwrap()));}
+    assert_eq!(format!("{:x}",sha2::Digest::finalize(digest)),"dc46825f57c6f0001c1a517760e9e5560e4a5ee90f00322075c4b96e41e24c79");
+}
+
+fn published() -> policy::Policy {
+    let mut range=crate::egress::tests::published_port("udp",20000,20000);
+    range["hostPortEnd"]=json!(20200);range["symmetric"]=json!(true);
+    policy_from(crate::egress::tests::published_host(json!([range,crate::egress::tests::published_port("tcp",443,8443)])))
+}
+fn conntrack(expressions: &[crate::wire::Attr]) -> Vec<u8> {
+    for expression in expressions {
+        let fields=crate::wire::attrs(&expression.value).unwrap();
+        if crate::wire::text(&fields,1).unwrap()!="match" {continue;}
+        let data=crate::wire::attrs(&crate::wire::one(&fields,2).unwrap().value).unwrap();
+        if crate::wire::text(&data,1).unwrap()=="conntrack" {return crate::wire::one(&data,3).unwrap().value.clone();}
+    }
+    panic!("no conntrack match")
+}
+fn word(bytes: &[u8], offset: usize) -> u16 {u16::from_ne_bytes([bytes[offset],bytes[offset+1]])}
+
+/// Inbound publications and their replies, and the flows a symmetric
+/// publication opens from its target ports, as the barrier's forward chain
+/// admits them: leased ranges first, then publications in canonical order.
+#[test]
+fn docker_contribution_admits_every_published_and_symmetric_flow_of_the_barrier() {
+    let prepared=published().prepare("v1.8.11 (nf_tables)".into()).unwrap();
+    let rules=prepared.rules(&options()).unwrap();
+    // 2 leased ranges, 2 inbound publications and 1 symmetric publication, each
+    // NEW, ESTABLISHED and the ESTABLISHED reply.
+    assert_eq!(rules.len(),15);
+    let args=|index: usize|rules[index].args[..rules[index].args.len()-6].join(" ");
+    assert_eq!(args(6),"-i ens18 -o handoff -d 10.240.0.2/32 -p tcp -m tcp --dport 8443 --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW --ctproto 6 --ctorigdst 192.0.2.2 --ctorigdstport 443 --ctdir ORIGINAL");
+    assert_eq!(args(7),"-i ens18 -o handoff -d 10.240.0.2/32 -p tcp -m tcp --dport 8443 -m conntrack --ctstate ESTABLISHED --ctproto 6 --ctorigdst 192.0.2.2 --ctorigdstport 443 --ctdir ORIGINAL");
+    assert_eq!(args(8),"-i handoff -o ens18 -s 10.240.0.2/32 -p tcp -m tcp --sport 8443 -m conntrack --ctstate ESTABLISHED --ctproto 6 --ctorigdst 192.0.2.2 --ctorigdstport 443 --ctdir REPLY");
+    assert_eq!(args(9),"-i ens18 -o handoff -d 10.240.0.2/32 -p udp -m udp --dport 20000:20200 -m conntrack --ctstate NEW --ctproto 17 --ctorigdst 192.0.2.2 --ctorigdstport 20000:20200 --ctdir ORIGINAL");
+    assert_eq!(args(11),"-i handoff -o ens18 -s 10.240.0.2/32 -p udp -m udp --sport 20000:20200 -m conntrack --ctstate ESTABLISHED --ctproto 17 --ctorigdst 192.0.2.2 --ctorigdstport 20000:20200 --ctdir REPLY");
+    assert_eq!(args(12),"-i handoff -o ens18 -s 10.240.0.2/32 -p udp -m udp --sport 20000:20200 -m conntrack --ctstate NEW --ctproto 17 --ctorigsrc 10.240.0.2 --ctorigsrcport 20000:20200 --ctdir ORIGINAL");
+    assert_eq!(args(13),"-i handoff -o ens18 -s 10.240.0.2/32 -p udp -m udp --sport 20000:20200 -m conntrack --ctstate ESTABLISHED --ctproto 17 --ctorigsrc 10.240.0.2 --ctorigsrcport 20000:20200 --ctdir ORIGINAL");
+    assert_eq!(args(14),"-i ens18 -o handoff -d 10.240.0.2/32 -p udp -m udp --dport 20000:20200 -m conntrack --ctstate ESTABLISHED --ctproto 17 --ctorigsrc 10.240.0.2 --ctorigsrcport 20000:20200 --ctdir REPLY");
+    // Without publications only the leased rules remain; a non-symmetric
+    // publication opens nothing from its target ports.
+    let mut plain=crate::egress::tests::published_port("udp",20000,20000);plain["hostPortEnd"]=json!(20200);
+    let plain=policy_from(crate::egress::tests::published_host(json!([plain]))).prepare("v1.8.11 (nf_tables)".into()).unwrap().rules(&options()).unwrap();
+    assert_eq!(plain.len(),9);
+    assert!(plain.iter().all(|rule|!rule.args.windows(2).any(|w|w==["--ctorigsrcport","20000:20200"])));
+    assert!(snapshot(&text(&rules)).matches(&options(),&rules).unwrap());
+}
+
+#[test]
+fn docker_inbound_graph_binds_the_original_destination_tuple() {
+    let rules=published().prepare("v1.8.11 (nf_tables)".into()).unwrap().rules(&options()).unwrap();
+    for (index,reply) in [(6,false),(8,true)] {
+        let expressions=graph::expected(&rules[index]).unwrap();
+        let data=conntrack(&expressions);
+        assert_eq!(data.len(),168);
+        assert!(data[..32].iter().all(|byte|*byte==0));
+        assert_eq!(&data[32..36],&[192,0,2,2]);
+        assert!(data[36..48].iter().all(|byte|*byte==0) && data[48..64].iter().all(|byte|*byte==0xff));
+        assert_eq!((word(&data,136),word(&data,138),word(&data,140),word(&data,146),word(&data,148),word(&data,150)),
+            (6,0,443,0x120b,if reply {0x1000} else {0},if reply {2} else {8}));
+        assert_eq!((word(&data,154),word(&data,156)),(0,443));
+        // The live tuple: the translated inside destination, or its reply source.
+        let payload=crate::wire::attrs(&expressions[0].value).unwrap();
+        let fields=crate::wire::attrs(&crate::wire::one(&payload,2).unwrap().value).unwrap();
+        assert_eq!(crate::wire::one(&fields,3).unwrap().value,(if reply {12_u32} else {16}).to_be_bytes());
+        let row=|expressions|vec![crate::wire::Attr::string(1,"filter"),crate::wire::Attr::string(2,"DOCKER-USER"),
+            crate::wire::Attr::u64(3,42),crate::wire::Attr::nested(4,expressions)];
+        assert!(graph::matches_rule(&row(expressions.clone()),&rules[index]).unwrap());
+        let mut hidden=expressions.clone();
+        for expression in &mut hidden {
+            let mut fields=crate::wire::attrs(&expression.value).unwrap();
+            if crate::wire::text(&fields,1).unwrap()!="match" {continue;}
+            let mut data=crate::wire::attrs(&crate::wire::one(&fields,2).unwrap().value).unwrap();
+            if crate::wire::text(&data,1).unwrap()!="conntrack" {continue;}
+            data.iter_mut().find(|a|a.id()==3).unwrap().value[52..64].fill(0);
+            *fields.iter_mut().find(|a|a.id()==2).unwrap()=crate::wire::Attr::nested(2,data);
+            expression.value=crate::wire::encode_attrs(&fields);
+        }
+        assert!(!graph::matches_rule(&row(hidden),&rules[index]).unwrap());
+    }
+    // A ranged inbound publication binds its whole outside span.
+    let data=conntrack(&graph::expected(&rules[9]).unwrap());
+    assert_eq!((word(&data,140),word(&data,156)),(20000,20200));
+}
+
+#[test]
+fn docker_snapshot_accepts_rendered_destination_tuples_and_rejects_changed_ones() {
+    let rules=published().prepare("v1.8.11 (nf_tables)".into()).unwrap().rules(&options()).unwrap();
+    let original=text(&rules);
+    assert!(snapshot(&original.replace("--ctorigdst 192.0.2.2 ","--ctorigdst 192.0.2.2/32 ")).matches(&options(),&rules).unwrap());
+    for (before,after) in [("--ctorigdstport 443","--ctorigdstport 444"),("--ctorigdst 192.0.2.2","--ctorigsrc 192.0.2.2"),
+        ("--dport 8443","--dport 8444"),("--ctorigdst 192.0.2.2","--ctorigdst 192.0.2.3")] {
+        assert!(!snapshot(&original.replacen(before,after,1)).matches(&options(),&rules).unwrap());
+    }
+}
+
+#[test]
+fn docker_contribution_keeps_its_restore_bound() {
+    let ports:Vec<_>=(0..64_u16).map(|index|crate::egress::tests::published_port("tcp",443+index,443+index)).collect();
+    let error=policy_from(crate::egress::tests::published_host(json!(ports))).prepare("v1.8.11 (nf_tables)".into()).unwrap_err();
+    assert_eq!(error.code(),"EXHAUSTED");
+}
+
+fn absent(mut host: serde_json::Value) -> serde_json::Value {
+    // No link holds this index on a test host.
+    host["scope"]["handoffs"][0]["link"]["interfaceIndex"]=json!(2_147_483_000_u32);host
+}
+
+#[test]
+fn docker_reconcile_fence_lets_only_links_both_generations_bind_carry_packets() {
+    let target=policy().prepare("v1.8.11 (nf_tables)".into()).unwrap();
+    let amended=published().prepare("v1.8.11 (nf_tables)".into()).unwrap();
+    let moved=policy_from(absent(crate::egress::tests::host())).prepare("v1.8.11 (nf_tables)".into()).unwrap();
+    let names=|links: Vec<&crate::egress::LocalLink>|links.iter().map(|link|link.interface_index).collect::<Vec<_>>();
+    let (kept,changed)=Owner::fenced(None,&target).unwrap();
+    assert_eq!((names(kept),names(changed)),(vec![],vec![4]));
+    let (kept,changed)=Owner::fenced(Some(&target),&amended).unwrap();
+    assert_eq!((names(kept),names(changed)),(vec![4],vec![]));
+    let (kept,changed)=Owner::fenced(Some(&target),&moved).unwrap();
+    assert_eq!((names(kept),names(changed)),(vec![],vec![4,2_147_483_000]));
+    // A link the transition keeps must still exist exactly.
+    assert!(Owner::fence(Some(&moved),&moved).is_err());
+    assert!(Owner::fence(None,&moved).is_err());
+}
+
+#[test]
+fn docker_cleanup_fence_counts_a_vanished_handoff_as_down() {
+    let gone=policy_from(absent(crate::egress::tests::host())).prepare("v1.8.11 (nf_tables)".into()).unwrap();
+    Owner::cleanup_fence(&gone).unwrap();
+    // The mutation fence still requires the exact link.
+    let link=&gone.policy.scope().unwrap().handoffs[0].link;
+    assert!(crate::wire::verify_bound_interfaces_down(std::iter::once(Owner::bound(link))).is_err());
+    // A different link at a bound index is not the bound link.
+    let mut loopback=crate::egress::tests::host();
+    loopback["scope"]["handoffs"][0]["link"]["interfaceIndex"]=json!(1);
+    let loopback=policy_from(loopback).prepare("v1.8.11 (nf_tables)".into()).unwrap();
+    assert_eq!(Owner::cleanup_fence(&loopback),Err(Error::Conflict));
+}

package/rust/src/egress.host.rs

@@ -84,34 +84,31 @@ fn leased(
     expressions.extend(original_range(range.first, range.last));
     Ok(expressions)
 }
-/// The publications of this hop. Validation admits only leased transit source
-/// addresses as targets, and one address never spans two active handoff links,
-/// so each publication has exactly one handoff.
-fn hop(scope: &HostScope) -> Result<published::Hop<'_>> {
-    let mut publications = Vec::new();
-    for port in &scope.published_ports {
-        let handoff = scope
-            .handoffs
-            .iter()
-            .find(|handoff| {
-                handoff
-                    .allocations
-                    .iter()
-                    .any(|allocation| allocation.transit_source_address == port.target_address)
-            })
-            .ok_or(crate::Error::Invalid)?;
-        publications.push(published::Publication {
-            protocol: &port.protocol,
-            outside: (&port.host_ip, port.host_port, port.host_last()),
-            inside: (&port.target_address, port.target_port, port.target_last()),
-            link: &handoff.link,
-            symmetric: port.symmetric,
-        });
-    }
-    Ok(published::Hop {
+/// The publications of this hop, from the scope's forwarding enumeration.
+fn hop<'a>(scope: &'a HostScope, forwarding: &Forwarding<'a>) -> published::Hop<'a> {
+    let publications = forwarding
+        .published
+        .iter()
+        .map(|item| published::Publication {
+            protocol: &item.port.protocol,
+            outside: (
+                &item.port.host_ip,
+                item.port.host_port,
+                item.port.host_last(),
+            ),
+            inside: (
+                &item.port.target_address,
+                item.port.target_port,
+                item.port.target_last(),
+            ),
+            link: item.link,
+            symmetric: item.port.symmetric,
+        })
+        .collect();
+    published::Hop {
         publications,
         fixed: &scope.uplink,
-    })
+    }
 }
 /// The exact platform endpoints served on host addresses. Every packet is
 /// checked against the live and the originally tracked destination tuple, so a
@@ -219,7 +216,8 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &HostScope) -> Result<()
                 .ok_or(crate::Error::Invalid)
         })?;
     }
-    let hop = hop(scope)?;
+    let forwarding = scope.forwarding()?;
+    let hop = hop(scope, &forwarding);
     published::sets(program, &hop, false)?;
     protection(program, scope, false)?;
     protection(program, scope, true)?;
@@ -241,26 +239,27 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &HostScope) -> Result<()
         program.jump("forward", link(&handoff.link, true), "protected_out")?;
         program.jump("forward", link(&handoff.link, false), "protected_back")?;
     }
-    for handoff in &scope.handoffs {
-        for allocation in &handoff.allocations {
-            for range in &allocation.source_port_ranges {
-                let original = envelope(scope, handoff, allocation, range, false)?;
-                for connection_state in [2, 8] {
-                    let mut expressions = original.clone();
-                    expressions.extend(state(connection_state));
-                    if connection_state == 8 && range.protocol == "tcp" {
-                        expressions.extend(opening_tcp());
-                    }
-                    program.end("forward", expressions, 1)?;
-                }
-                let mut reply = envelope(scope, handoff, allocation, range, true)?;
-                reply.extend(state(2));
-                program.end("forward", reply, 1)?;
-                let mut nat = original;
-                nat.extend(snat(&scope.snat_address, None)?);
-                program.rule("post", nat)?;
+    for LeasedForward {
+        handoff,
+        allocation,
+        range,
+    } in &forwarding.leased
+    {
+        let original = envelope(scope, handoff, allocation, range, false)?;
+        for connection_state in [2, 8] {
+            let mut expressions = original.clone();
+            expressions.extend(state(connection_state));
+            if connection_state == 8 && range.protocol == "tcp" {
+                expressions.extend(opening_tcp());
             }
+            program.end("forward", expressions, 1)?;
         }
+        let mut reply = envelope(scope, handoff, allocation, range, true)?;
+        reply.extend(state(2));
+        program.end("forward", reply, 1)?;
+        let mut nat = original;
+        nat.extend(snat(&scope.snat_address, None)?);
+        program.rule("post", nat)?;
     }
     // Symmetric flows leave from ports outside every leased range of their
     // address, after the capture barrier and before the terminal handoff denials.

package/rust/src/egress.rs

@@ -216,6 +216,62 @@ pub struct HostScope {
     #[serde(default, skip_serializing_if = "std::ops::Not::not")]
     pub exclusive_forwarding: bool,
 }
+/// One leased source port range of one allocation, on the handoff that holds it.
+pub struct LeasedForward<'a> {
+    pub handoff: &'a HostHandoff,
+    pub allocation: &'a Allocation,
+    pub range: &'a PortRange,
+}
+/// One publication, on the handoff link that holds its leased target address.
+pub struct PublishedForward<'a> {
+    pub port: &'a PublishedPort,
+    pub link: &'a LocalLink,
+}
+/// The forwarded flows a host-transit scope admits, in canonical scope order:
+/// leased flows from a handoff to the uplink, and per publication its inbound
+/// flows from the uplink to the handoff and, when symmetric, the flows it opens
+/// from its target ports to the uplink; each with its replies. The scope's nft
+/// forward chain and the Docker contribution both derive from this one list.
+pub struct Forwarding<'a> {
+    pub leased: Vec<LeasedForward<'a>>,
+    pub published: Vec<PublishedForward<'a>>,
+}
+impl HostScope {
+    pub fn forwarding(&self) -> Result<Forwarding<'_>> {
+        let mut leased = Vec::new();
+        for handoff in &self.handoffs {
+            for allocation in &handoff.allocations {
+                for range in &allocation.source_port_ranges {
+                    leased.push(LeasedForward {
+                        handoff,
+                        allocation,
+                        range,
+                    });
+                }
+            }
+        }
+        // Validation admits only leased transit source addresses as targets, and
+        // one address never spans two active handoff links, so each publication
+        // has exactly one handoff.
+        let mut published = Vec::new();
+        for port in &self.published_ports {
+            let handoff =
+                self.handoffs
+                    .iter()
+                    .find(|handoff| {
+                        handoff.allocations.iter().any(|allocation| {
+                            allocation.transit_source_address == port.target_address
+                        })
+                    })
+                    .ok_or(Error::Invalid)?;
+            published.push(PublishedForward {
+                port,
+                link: &handoff.link,
+            });
+        }
+        Ok(Forwarding { leased, published })
+    }
+}
 /// One loopback TCP service that only one local user may dial: packets the host
 /// sends to the exact address and port from a socket of any other user reject,
 /// and packets arriving there on any interface but loopback drop.