@push.rocks/smartnftables 4.1.0 → 4.3.0

package/readme.md

@@ -297,7 +297,9 @@ endpoint, addresses per link, protected prefixes, platform endpoints, active
 generations, handoffs and allocations, ranges per allocation, guarded pools, the
 IPC and capture limits) describes the shape of the topology and stays `INVALID`.
 Other codes, and the facade's own local rejections, carry neither `reason` nor
-`details`. A native refusal outside this shape is `PROTOCOL`.
+`details`. A native refusal outside this shape is `PROTOCOL`. A failed `close()`
+rejects `CLEANUP_UNCONFIRMED`, whose `cause` is the `ManagedNftablesError` that left
+cleanup unconfirmed, with the native code when the native owner refused.
 
 ```typescript
 try {
@@ -452,8 +454,8 @@ under host grants. 64 symmetric ranges take about 19,600 element bytes.
 The caller still owns the route to `targetAddress` through that handoff, the
 workload listener, and every other packet owner on the host. As with leased egress,
 an ACCEPT here cannot override Docker's independent FORWARD DROP; the
-`ManagedDockerForwarding` contribution below derives only leased handoff egress from
-the barrier and currently carries no inbound publication.
+`ManagedDockerForwarding` contribution below admits every inbound and symmetric
+publication of the barrier through it, with the leased flows.
 
 Each router generation binds an immutable lease reference, transit source address,
 leased TCP/UDP source-port ranges, a nonzero conntrack zone and a 16-byte label.
@@ -693,7 +695,8 @@ forwarding that another owner (Docker, a container or VM bridge, a VPN router, a
 second routing daemon) accepts, and accepting in this table still cannot override
 another owner's drop. Use it only on a host where this table is the sole forwarding
 owner; on a Docker host keep it absent and use the Docker contribution below, which
-refuses an exclusive barrier. The
+refuses an exclusive barrier. `inspectForwardHooks()`, described below, reports
+the other forward owners of the namespace for that decision. The
 member does not fence flowtable offload, packet queues, proxies or anything outside
 the forward hook.
 
@@ -880,7 +883,7 @@ drainage, conntrack cleanup, elapsed-time expiry, or safe address/port/zone reus
 
 ### Docker forwarding contribution
 
-`ManagedDockerForwarding` admits the leased handoff traffic from an exact applied
+`ManagedDockerForwarding` admits exactly the forwarded flows of an exact applied
 schema-v2 `hostTransit` receipt through Docker's existing IPv4 forwarding path.
 It reads and verifies that dedicated barrier's complete table and local links,
 without adopting its ownership. The contribution uses Docker's supported
@@ -916,32 +919,92 @@ and never changes a host forwarding policy. `prepare()` refuses a barrier with
 `exclusiveForwarding` as `INVALID`: its drop would also deny Docker's own container
 forwarding.
 
-Each contributed rule binds the handoff and uplink names, current and original
-transit source, exact leased TCP/UDP port range, packet direction and connection
-state. New TCP flows require SYN with FIN/RST/ACK clear; reverse traffic requires
-ESTABLISHED. The exact v2 host barrier independently checks interface indices,
-MAC/iflink facts, the default host conntrack zone, protected original/current
-destinations and explicit outer SNAT. A complete contribution is bounded to 192
-rules and 100,000 generated command bytes.
+The contribution and the barrier's forward chain derive from one enumeration of
+the scope's forwarded flows, so the contribution admits exactly the flow kinds the
+non-exclusive barrier admits, each with its replies:
+
+| Flow kind | Original direction | Live tuple | Conntrack original tuple |
+| --- | --- | --- | --- |
+| Leased range | handoff → uplink | transit source address and leased port range | same source |
+| Inbound publication | uplink → handoff, after the barrier's DNAT | inside target address and port(s) as destination | published `hostIp` and port(s) as destination |
+| Symmetric publication | handoff → uplink, before the barrier's SNAT | target address and port(s) as source | same source |
+
+Every flow kind has three rules: the NEW opening (TCP only with SYN and
+FIN/RST/ACK clear), the ESTABLISHED original direction and the ESTABLISHED reply
+with swapped interfaces and tuple sides. A router's own egress, such as a VPN client
+in the router namespace dialling its hub, reaches the host as a leased flow: the
+router translates it to the transit address and a leased port range, so it is
+admitted by the leased rules exactly when the barrier admits it. Host grants and
+host-local platform endpoints use INPUT/OUTPUT and never cross FORWARD. Each rule
+binds the handoff and uplink names. The exact v2 host barrier independently checks
+interface indices, MAC/iflink facts, the default host conntrack zone, protected
+original/current destinations and explicit outer SNAT; it governs every forwarded
+packet on its handoffs, so the host forwards the intersection, which is the
+barrier's admitted set. A scope without publications keeps its exact 4.1.0 rules,
+comments and graphs. A complete contribution is bounded to 192 rules and 100,000
+generated command bytes: three rules per leased range and per publication, and
+three more per symmetric publication. A larger scope is refused as `EXHAUSTED`
+(`restoreRules`/`restoreBytes`) before any subprocess.
 
 Create the class with `ownerId`, a caller-retained `instanceId` of at least 16
 identifier characters, and optional `binaryPath`/`networkNamespaceFd`. After
 `start()`, call `prepare({ schemaVersion: 1, revision, barrier })`, where `barrier`
 is the exact applied host policy. Persist the complete `{ previous, target }`
-transition before `reconcile()`. Keep every affected handoff link down through
-mutations; retain those exact links until cleanup finishes. The native owner
-verifies this down state before and after its single no-flush restore transaction.
-Exact target replay can recover a lost response without rewriting live rules.
+transition before `reconcile()`. The native owner fences the handoff links before
+and after its single no-flush restore transaction, which deletes the previous block
+and inserts the target block in one atomic nf_tables commit. A handoff link that
+`previous` and `target` both bind exactly may stay up, so a publication or lease
+amendment of a running generation applies in place: every flow both contributions
+admit passes throughout, a flow only the target admits passes from the commit, and
+the referenced barrier must already be the target. Every handoff link the
+transition adds or drops, and every link of a first apply, must be down; retain
+those exact links until cleanup finishes. Exact target replay can recover a lost
+response without rewriting live rules.
 
 `inspect().present` confirms the contribution and its referenced barrier, not
 the complete host packet path or durable controller authority. Errors retain
 failed-owned state and pending intent. `release(applied)` and `close()` delete
-only exact contributed rules under the same link fence. A cold boot needs a new
+only exact contributed rules. `close()` first reads the filter table through the
+same generation-consistent frontend and netlink read, without requiring Docker's
+forwarding path: when no saved rule in any chain and no native DOCKER-USER or
+FORWARD rule carries this owner's comment prefix, cleanup is confirmed. So an owner
+whose first apply was refused, for example on a host with FORWARD policy ACCEPT or
+without Docker, closes on that host. A read that fails rejects
+`CLEANUP_UNCONFIRMED` whose `cause` carries the native code (`UNAVAILABLE`,
+`UNSUPPORTED_BACKEND`, `PERMISSION`, `CONFLICT`); it is never reported as cleanup.
+The fence of `release(applied)` and `close()` requires every handoff link down or gone:
+a link whose index no link holds any more, such as a veth that left with its router
+namespace when the node process ended, counts as down, so a restarted process in
+the same boot can release the previous contribution before applying the next one.
+A different link at a bound index still rejects. A cold boot needs a new
 barrier receipt and caller-authorized replay; old boot receipts cannot authorize
 native operations. The caller owns restart ordering, disjoint retained leases,
 exclusive privileged mutation authority and activation. The frontend transaction
 does not provide compare-and-swap against other privileged processes.
 
+### Forward hook owners
+
+`inspectForwardHooks({ binaryPath?, networkNamespaceFd? })` reads every
+packet-filter owner on the routed forward path of one network namespace and
+changes nothing. One native process takes the read and exits:
+
+- `chains`: every nf_tables base chain on the forward hook of the `ip`, `ip6` and
+  `inet` families, with `family`, `table`, `tableHandle`, `chain`, `type`,
+  `priority` and `policy`, sorted by family, table and chain. Managed tables are
+  included; compare `table` and `tableHandle` with a receipt's
+  `identity.tableName` and `tableHandle` to find your own.
+- `docker`: whether Docker's iptables-nft `DOCKER-USER` and `DOCKER-FORWARD`
+  chains exist in table `ip filter`.
+- `legacyTables`: the registered legacy xtables `ipv4` and `ipv6` tables. Their
+  hooks, including FORWARD, are not nf_tables objects and never appear in `chains`.
+
+The table and chain dumps share one ruleset generation, or the read is
+`CONFLICT`. Without `CAP_NET_ADMIN` in the namespace it is `PERMISSION`. Bridge
+and netdev hooks do not see routed packets and are not reported. Guard
+`exclusiveForwarding` with it: refuse while any chain other than your own barrier's,
+either Docker chain or any legacy table is present. The read is a point in time;
+the caller still owns exclusive authority over who may add a forward owner later.
+
 ### Native qualification
 
 The separate [Docker fixture](test/native/readme.docker.md) exercises the native

package/rust/src/docker.frontend.rs

@@ -113,10 +113,10 @@ fn normalized(args: &[String]) -> Result<Vec<(String, Vec<String>)>> {
     let mut values=BTreeMap::new();let mut modules=BTreeSet::new();let mut index=0;
     while index<args.len() {
         let key=&args[index];let count=if key=="--tcp-flags" {2} else {1};
-        if !["-i","-o","-s","-d","-p","-m","--sport","--dport","--tcp-flags","--ctstate","--ctproto","--ctorigsrc","--ctorigsrcport","--ctdir","--comment","-j"].contains(&key.as_str()) {return Err(Error::Conflict);}
+        if !["-i","-o","-s","-d","-p","-m","--sport","--dport","--tcp-flags","--ctstate","--ctproto","--ctorigsrc","--ctorigsrcport","--ctorigdst","--ctorigdstport","--ctdir","--comment","-j"].contains(&key.as_str()) {return Err(Error::Conflict);}
         let mut value=args.get(index+1..index+1+count).ok_or(Error::Conflict)?.to_vec();index+=1+count;
         if key=="-m" {if !modules.insert(value[0].clone()) {return Err(Error::Conflict);}continue;}
-        if key=="--ctorigsrc" && !value[0].contains('/') {value[0].push_str("/32");}
+        if (key=="--ctorigsrc" || key=="--ctorigdst") && !value[0].contains('/') {value[0].push_str("/32");}
         if key=="--ctproto" {value[0]=match value[0].as_str() {"tcp"=>"6".into(),"udp"=>"17".into(),_=>value[0].clone()};}
         if values.insert(key.clone(),value).is_some() {return Err(Error::Conflict);}
     }
@@ -125,19 +125,39 @@ fn normalized(args: &[String]) -> Result<Vec<(String, Vec<String>)>> {
 }
 pub struct Snapshot {
     pub backend: String,
+    chains: BTreeMap<String, String>,
     pub rows: Vec<Vec<String>>,
     pub user: Vec<Vec<String>>,
     raw: Option<super::graph::Snapshot>,
 }
 impl Snapshot {
+    /// Docker's admitted forwarding path. Apply, inspection and every deletion
+    /// proof read through it.
     pub fn read(deadline: Instant) -> Result<Self> {
+        let snapshot=Self::observe(deadline)?;
+        snapshot.path()?;
+        snapshot.raw.as_ref().ok_or(Error::Conflict)?.path()?;
+        Ok(snapshot)
+    }
+    /// The same generation-consistent read of the filter table, without
+    /// requiring Docker's forwarding path. It proves only whether this owner
+    /// holds any rule there, never a placement or a deletion.
+    pub fn observe(deadline: Instant) -> Result<Self> {
         let backend=version(deadline)?;
         let (raw,text)=super::graph::Snapshot::read(||command(SAVE,&["-t","filter"],&[],deadline))?;
-        let mut snapshot=Self::parse(backend,&text)?;
+        let mut snapshot=Self::table(backend,&text)?;
         snapshot.raw=Some(raw);
         Ok(snapshot)
     }
+    /// The text half of `read`.
+    #[cfg(test)]
     pub fn parse(backend: String, text: &str) -> Result<Self> {
+        let snapshot=Self::table(backend,text)?;
+        snapshot.path()?;
+        Ok(snapshot)
+    }
+    /// One complete saved filter table: its chains and rules, in order.
+    pub(super) fn table(backend: String, text: &str) -> Result<Self> {
         if text.len()>MAX_OUTPUT {return Err(Error::Protocol);}
         let mut table=false;let mut committed=false;let mut chains=BTreeMap::new();let mut rows=Vec::new();
         for line in text.lines().filter(|line|!line.starts_with('#')&&!line.is_empty()) {
@@ -152,15 +172,33 @@ impl Snapshot {
                 rows.push(row);
             }
         }
-        if !committed || chains.get("FORWARD").map(String::as_str)!=Some("DROP")
-            || chains.get("DOCKER-USER").map(String::as_str)!=Some("-")
-            || chains.get("DOCKER-FORWARD").map(String::as_str)!=Some("-") {return Err(Error::Conflict);}
-        let forward:Vec<_>=rows.iter().filter(|r|r[1]=="FORWARD").collect();
+        if !committed {return Err(Error::Conflict);}
+        let user=rows.iter().filter(|r|r[1]=="DOCKER-USER").cloned().collect();
+        Ok(Self {backend,chains,rows,user,raw:None})
+    }
+    /// FORWARD has policy DROP and dispatches first to DOCKER-USER, then to
+    /// DOCKER-FORWARD.
+    fn path(&self) -> Result<()> {
+        if self.chains.get("FORWARD").map(String::as_str)!=Some("DROP")
+            || self.chains.get("DOCKER-USER").map(String::as_str)!=Some("-")
+            || self.chains.get("DOCKER-FORWARD").map(String::as_str)!=Some("-") {return Err(Error::Conflict);}
+        let forward:Vec<_>=self.rows.iter().filter(|r|r[1]=="FORWARD").collect();
         for (index,target) in ["DOCKER-USER","DOCKER-FORWARD"].iter().enumerate() {
             if forward.get(index).map(|r|r.iter().map(String::as_str).collect::<Vec<_>>())!=Some(vec!["-A","FORWARD","-j",target]) {return Err(Error::Conflict);}
         }
-        let user=rows.iter().filter(|r|r[1]=="DOCKER-USER").cloned().collect();
-        Ok(Self {backend,rows,user,raw:None})
+        Ok(())
+    }
+    /// No rule of this owner exists in the filter table: neither saved text in
+    /// any chain nor native DOCKER-USER/FORWARD attributes carry its comment
+    /// prefix. Rules of other owners are not this owner's to prove.
+    pub fn owns_nothing(&self, options: &Options) -> Result<bool> {
+        let prefix=format!("snftd1:{}:",options.owner_id);
+        let raw=self.raw.as_ref().ok_or(Error::Conflict)?;
+        Ok(!self.mentions(&prefix) && !raw.mentions(prefix.as_bytes()))
+    }
+    /// Whether any saved rule, in any chain, carries a token starting with `prefix`.
+    pub(super) fn mentions(&self, prefix: &str) -> bool {
+        self.rows.iter().any(|r|r.iter().any(|t|t.starts_with(prefix)))
     }
     /// Text proves placement/count and logical policy; -C additionally checks
     /// match-extension bytes hidden by save output. Deletion uses the same spec.

package/rust/src/docker.graph.rs

@@ -9,17 +9,36 @@ fn payload(base: u32, offset: u32, length: u32) -> Attr {
     expr("payload",vec![Attr::u32(1,1),Attr::u32(2,base),Attr::u32(3,offset),Attr::u32(4,length)])
 }
 
+fn span(value: &str) -> Result<(u16, u16)> {
+    let (first,last)=value.split_once(':').unwrap_or((value,value));
+    Ok((first.parse::<u16>().map_err(|_|Error::Invalid)?,last.parse::<u16>().map_err(|_|Error::Invalid)?))
+}
+/// The one key of a rule among alternatives, with its value.
+fn either<'a>(rule: &'a Rule, keys: [&'static str; 2]) -> Result<(usize, &'a str)> {
+    let mut found=keys.iter().enumerate().filter_map(|(index,key)|value(rule,key).ok().map(|value|(index,value)));
+    let result=found.next().ok_or(Error::Invalid)?;
+    if found.next().is_some() {return Err(Error::Invalid);}
+    Ok(result)
+}
+
 /// Fixed Linux UAPI / xtables 1.8.10 and 1.8.11 constructors, not a raw rule API.
 pub(super) fn expected(rule: &Rule) -> Result<Vec<Attr>> {
     let reply=value(rule,"--ctdir")?=="REPLY";
     let new=value(rule,"--ctstate")?=="NEW";
     let protocol=match value(rule,"-p")? {"tcp"=>6_u16,"udp"=>17,_=>return Err(Error::Invalid)};
-    let address=value(rule,"--ctorigsrc")?.parse::<std::net::Ipv4Addr>().map_err(|_|Error::Invalid)?.octets();
-    let ports=value(rule,"--ctorigsrcport")?;
-    let (first,last)=ports.split_once(':').unwrap_or((ports,ports));
-    let first=first.parse::<u16>().map_err(|_|Error::Invalid)?;
-    let last=last.parse::<u16>().map_err(|_|Error::Invalid)?;
-    let mut result=vec![payload(1,if reply {16} else {12},4),compare(address.to_vec())];
+    // The packet's own source (0) or destination (1) address and port.
+    let (side,live)=either(rule,["-s","-d"])?;
+    let live=live.strip_suffix("/32").ok_or(Error::Invalid)?.parse::<std::net::Ipv4Addr>().map_err(|_|Error::Invalid)?.octets();
+    let (port_side,ports)=either(rule,["--sport","--dport"])?;
+    if port_side!=side {return Err(Error::Invalid);}
+    let (first,last)=span(ports)?;
+    // The originally tracked source (0) or destination (1) address and port.
+    let (tracked_side,tracked)=either(rule,["--ctorigsrc","--ctorigdst"])?;
+    let tracked=tracked.parse::<std::net::Ipv4Addr>().map_err(|_|Error::Invalid)?.octets();
+    let (tracked_port_side,tracked_ports)=either(rule,["--ctorigsrcport","--ctorigdstport"])?;
+    if tracked_port_side!=tracked_side {return Err(Error::Invalid);}
+    let (tracked_first,tracked_last)=span(tracked_ports)?;
+    let mut result=vec![payload(1,if side==0 {12} else {16},4),compare(live.to_vec())];
     for (key,argument) in [(6,"-i"),(7,"-o")] {
         result.extend(meta(key,[value(rule,argument)?.as_bytes(),&[0]].concat()));
     }
@@ -30,7 +49,7 @@ pub(super) fn expected(rule: &Rule) -> Result<Vec<Attr>> {
             Attr::nested(4,vec![Attr::bytes(1,vec![0x17])]),Attr::nested(5,vec![Attr::bytes(1,vec![0])]),
         ]),compare(vec![2])]);
     }
-    result.push(payload(2,if reply {2} else {0},2));
+    result.push(payload(2,if side==0 {0} else {2},2));
     result.push(if first==last {compare(first.to_be_bytes().to_vec())} else {
         expr("range",vec![Attr::u32(1,1),Attr::u32(2,0),
             Attr::nested(3,vec![Attr::bytes(1,first.to_be_bytes().to_vec())]),
@@ -38,11 +57,17 @@ pub(super) fn expected(rule: &Rule) -> Result<Vec<Attr>> {
     });
     // xt_conntrack_mtinfo3 is 164 bytes, XT_ALIGN'ed to 168 on both shipped
     // 64-bit Linux targets. All fields and padding are initialized explicitly.
+    // The original source address/mask are at 0/16, its ports at 138/154; the
+    // original destination's at 32/48 and 140/156.
     let mut conntrack=vec![0;168];
-    conntrack[..4].copy_from_slice(&address);
-    conntrack[16..32].fill(0xff); // canonical bare-host nf_inet_addr mask
-    for (offset,number) in [(136,protocol),(138,first),(146,0x1107),
-        (148,if reply {0x1000} else {0}),(150,if new {8} else {2}),(154,last)] {
+    let address=32*tracked_side;
+    conntrack[address..address+4].copy_from_slice(&tracked);
+    conntrack[address+16..address+32].fill(0xff); // canonical bare-host nf_inet_addr mask
+    // STATE|PROTO|DIRECTION with ORIGSRC|ORIGSRC_PORT or ORIGDST|ORIGDST_PORT.
+    let flags=0x1003|if tracked_side==0 {0x0104} else {0x0208};
+    let port=2*tracked_side;
+    for (offset,number) in [(136,protocol),(138+port,tracked_first),(146,flags),
+        (148,if reply {0x1000} else {0}),(150,if new {8} else {2}),(154+port,tracked_last)] {
         conntrack[offset..offset+2].copy_from_slice(&number.to_ne_bytes());
     }
     result.push(expr("match",vec![Attr::string(1,"conntrack"),Attr::u32(2,3),Attr::bytes(3,conntrack)]));
@@ -105,19 +130,33 @@ fn matches_graph(row: &[Attr], chain: &str, expected: &[Attr]) -> Result<bool> {
     equivalent(&expressions,expected,true)
 }
 
-pub struct Snapshot { generation: u32, rows: Vec<Vec<Attr>> }
+/// Whether any rule carries `marker` anywhere in its native attributes. An owner
+/// comment is stored verbatim, whether the frontend can render the rule or not.
+pub(super) fn mentions<'a>(rows: impl IntoIterator<Item=&'a Vec<Attr>>, marker: &[u8]) -> bool {
+    rows.into_iter().any(|row|wire::encode_attrs(row).windows(marker.len()).any(|window|window==marker))
+}
+
+pub struct Snapshot { generation: u32, rows: Vec<Vec<Attr>>, forward: Vec<Vec<Attr>> }
 impl Snapshot {
+    /// The saved text and the native DOCKER-USER and FORWARD rules under one
+    /// unchanged ruleset generation. A missing table or chain dumps no rules.
     pub fn read(save: impl FnOnce()->Result<String>) -> Result<(Self,String)> {
         let mut socket=Socket::open()?;let generation=socket.generation()?;
         let text=save()?;
         let rows=socket.query_ipv4(7,vec![Attr::string(1,"filter"),Attr::string(2,"DOCKER-USER")],true)?;
         let forward=socket.query_ipv4(7,vec![Attr::string(1,"filter"),Attr::string(2,"FORWARD")],true)?;
         if socket.generation()!=Ok(generation) {return Err(Error::Conflict);}
+        Ok((Self {generation,rows,forward},text))
+    }
+    /// Docker's forwarding path: FORWARD's first two rules are its exact
+    /// unconditional jumps to DOCKER-USER and then DOCKER-FORWARD.
+    pub fn path(&self) -> Result<()> {
         for (index,target) in ["DOCKER-USER","DOCKER-FORWARD"].iter().enumerate() {
-            if !matches_forward(forward.get(index).ok_or(Error::Conflict)?,target)? {return Err(Error::Conflict);}
+            if !matches_forward(self.forward.get(index).ok_or(Error::Conflict)?,target)? {return Err(Error::Conflict);}
         }
-        Ok((Self {generation,rows},text))
+        Ok(())
     }
+    pub fn mentions(&self, marker: &[u8]) -> bool {mentions(self.rows.iter().chain(&self.forward),marker)}
     pub fn matches(&self, expected: &[Rule]) -> Result<bool> {
         if self.rows.len()<expected.len() {return Ok(false);}
         for (row,rule) in self.rows.iter().zip(expected) {

package/rust/src/docker.policy.rs

@@ -99,46 +99,105 @@ pub struct Rule {
 fn port_range(first: u16, last: u16) -> String {
     if first == last { first.to_string() } else { format!("{first}:{last}") }
 }
+/// One side of a packet or of its originally tracked tuple: an exact address
+/// and an inclusive port span.
+#[derive(Clone, Copy)]
+struct Tuple<'a> {
+    address: &'a str,
+    first: u16,
+    last: u16,
+}
+/// One flow class of the barrier's forward chain, in its original direction:
+/// it enters on `input`, leaves on `output`, carries `live` as its source
+/// (`source`) or destination, and conntrack tracked it with `tracked` as its
+/// original source (`source`) or destination. A leased or symmetric flow is
+/// keyed on its own source, before outer source NAT; an inbound publication on
+/// its translated inside destination and its published outside destination.
+struct Flow<'a> {
+    input: &'a str,
+    output: &'a str,
+    protocol: &'a str,
+    source: bool,
+    live: Tuple<'a>,
+    tracked: Tuple<'a>,
+}
+impl Flow<'_> {
+    /// The ESTABLISHED original direction, a NEW opening (TCP only with SYN and
+    /// FIN/RST/ACK clear) and the ESTABLISHED reply, as the barrier admits them.
+    fn rules(&self, mut push: impl FnMut(Vec<String>) -> Result<()>) -> Result<()> {
+        for state in ["NEW", "ESTABLISHED", "REPLY"] {
+            let reply = state == "REPLY";
+            // The reply swaps the interfaces and the packet's tuple sides; the
+            // originally tracked tuple stays the same.
+            let source = self.source != reply;
+            let mut args: Vec<String> = vec![
+                "-i".into(), if reply { self.output } else { self.input }.into(),
+                "-o".into(), if reply { self.input } else { self.output }.into(),
+                if source { "-s" } else { "-d" }.into(), format!("{}/32", self.live.address),
+                "-p".into(), self.protocol.into(), "-m".into(), self.protocol.into(),
+                if source { "--sport" } else { "--dport" }.into(), port_range(self.live.first, self.live.last),
+            ];
+            if state == "NEW" && self.protocol == "tcp" {
+                args.extend(["--tcp-flags","FIN,SYN,RST,ACK","SYN"].map(String::from));
+            }
+            let (address, port) = if self.source { ("--ctorigsrc", "--ctorigsrcport") } else { ("--ctorigdst", "--ctorigdstport") };
+            args.extend(["-m","conntrack","--ctstate",if reply {"ESTABLISHED"} else {state},"--ctproto",if self.protocol == "tcp" {"6"} else {"17"},address].map(String::from));
+            // Canonical xtables host form: explicit /32 has different unused
+            // conntrack mask bytes and does not survive a save/restore round trip.
+            args.push(self.tracked.address.into());
+            args.push(port.into());args.push(port_range(self.tracked.first,self.tracked.last));
+            args.extend(["--ctdir",if reply {"REPLY"} else {"ORIGINAL"}].map(String::from));
+            push(args)?;
+        }
+        Ok(())
+    }
+}
 impl Prepared {
     pub fn validate(&self) -> Result<()> {
         if self.policy.clone().prepare(self.backend.clone())? != *self { return Err(Error::Invalid); }
         Ok(())
     }
+    /// Every forwarded flow the barrier admits, from the scope's one forwarding
+    /// enumeration: leased ranges first, then each publication's inbound flows
+    /// and, when symmetric, the flows it opens from its target ports.
+    fn flows(&self) -> Result<Vec<Flow<'_>>> {
+        let scope = self.policy.scope()?;
+        let forwarding = scope.forwarding()?;
+        let uplink = scope.uplink.interface_name.as_str();
+        let mut flows = Vec::new();
+        for leased in &forwarding.leased {
+            let tuple = Tuple { address:&leased.allocation.transit_source_address, first:leased.range.first, last:leased.range.last };
+            flows.push(Flow { input:&leased.handoff.link.interface_name, output:uplink, protocol:&leased.range.protocol,
+                source:true, live:tuple, tracked:tuple });
+        }
+        for published in &forwarding.published {
+            let port = published.port;
+            let inside = Tuple { address:&port.target_address, first:port.target_port, last:port.target_last() };
+            let outside = Tuple { address:&port.host_ip, first:port.host_port, last:port.host_last() };
+            let link = published.link.interface_name.as_str();
+            flows.push(Flow { input:uplink, output:link, protocol:&port.protocol, source:false, live:inside, tracked:outside });
+            if port.symmetric {
+                flows.push(Flow { input:link, output:uplink, protocol:&port.protocol, source:true, live:inside, tracked:inside });
+            }
+        }
+        Ok(flows)
+    }
     pub fn rules(&self, options: &Options) -> Result<Vec<Rule>> {
         options.validate()?;
-        let scope = self.policy.scope()?;
+        let digest = self.digest.strip_prefix("sha256:").ok_or(Error::Invalid)?;
         let mut result = Vec::new();
         let mut bytes = 0;
-        for handoff in &scope.handoffs {
-            for allocation in &handoff.allocations {
-                for range in &allocation.source_port_ranges {
-                    for state in ["NEW", "ESTABLISHED", "REPLY"] {
-                        let reply = state == "REPLY";
-                        let mut args: Vec<String> = vec![
-                            "-i".into(), if reply { scope.uplink.interface_name.clone() } else { handoff.link.interface_name.clone() },
-                            "-o".into(), if reply { handoff.link.interface_name.clone() } else { scope.uplink.interface_name.clone() },
-                            if reply { "-d" } else { "-s" }.into(), format!("{}/32", allocation.transit_source_address),
-                            "-p".into(),range.protocol.clone(),"-m".into(),range.protocol.clone(),
-                            if reply { "--dport" } else { "--sport" }.into(),port_range(range.first,range.last),
-                        ];
-                        if state == "NEW" && range.protocol == "tcp" {
-                            args.extend(["--tcp-flags","FIN,SYN,RST,ACK","SYN"].map(String::from));
-                        }
-                        args.extend(["-m","conntrack","--ctstate",if reply {"ESTABLISHED"} else {state},"--ctproto",if range.protocol == "tcp" {"6"} else {"17"},"--ctorigsrc"].map(String::from));
-                        // Canonical xtables host form: explicit /32 has different unused
-                        // conntrack mask bytes and does not survive a save/restore round trip.
-                        args.push(allocation.transit_source_address.clone());
-                        args.push("--ctorigsrcport".into());args.push(port_range(range.first,range.last));
-                        args.extend(["--ctdir",if reply {"REPLY"} else {"ORIGINAL"},"-m","comment","--comment"].map(String::from));
-                        let comment = format!("snftd1:{}:{}:{}:{}",options.owner_id,options.instance_id,self.digest.strip_prefix("sha256:").ok_or(Error::Invalid)?,result.len());
-                        args.push(comment.clone());args.extend(["-j","ACCEPT"].map(String::from));
-                        bytes += args.iter().map(|arg|arg.len()+1).sum::<usize>()+32;
-                        crate::capacity("restoreRules", 192, result.len() + 1)?;
-                        crate::capacity("restoreBytes", 100_000, bytes)?;
-                        result.push(Rule {comment,args});
-                    }
-                }
-            }
+        for flow in self.flows()? {
+            flow.rules(|mut args| {
+                let comment = format!("snftd1:{}:{}:{}:{}",options.owner_id,options.instance_id,digest,result.len());
+                args.extend(["-m","comment","--comment"].map(String::from));
+                args.push(comment.clone());args.extend(["-j","ACCEPT"].map(String::from));
+                bytes += args.iter().map(|arg|arg.len()+1).sum::<usize>()+32;
+                crate::capacity("restoreRules", 192, result.len() + 1)?;
+                crate::capacity("restoreBytes", 100_000, bytes)?;
+                result.push(Rule {comment,args});
+                Ok(())
+            })?;
         }
         Ok(result)
     }

package/rust/src/docker.rs

@@ -71,13 +71,38 @@ impl Owner {
             || expected.receipt.backend!=expected.prepared.backend {return Err(Error::Conflict);}
         Ok(())
     }
-    fn fence(target: &Prepared) -> Result<()> {
-        let scope=target.policy.scope()?;
-        wire::verify_bound_interfaces_down(scope.handoffs.iter().map(|handoff| {
-            let link=&handoff.link;
-            wire::BoundInterface {index:link.interface_index,name:&link.interface_name,kind:&link.interface_kind,
-                mac:link.mac_address.as_deref(),link_index:link.interface_link_index,addresses:&link.required_ipv4_addresses}
-        }))
+    fn handoffs(prepared: &Prepared) -> Result<Vec<&crate::egress::LocalLink>> {
+        Ok(prepared.policy.scope()?.handoffs.iter().map(|handoff|&handoff.link).collect())
+    }
+    fn bound(link: &crate::egress::LocalLink) -> wire::BoundInterface<'_> {
+        wire::BoundInterface {index:link.interface_index,name:&link.interface_name,kind:&link.interface_kind,
+            mac:link.mac_address.as_deref(),link_index:link.interface_link_index,addresses:&link.required_ipv4_addresses}
+    }
+    /// The handoff links of a transition: those both generations bind exactly,
+    /// and those it adds or drops.
+    fn fenced<'a>(previous: Option<&'a Prepared>, target: &'a Prepared) -> Result<(Vec<&'a crate::egress::LocalLink>, Vec<&'a crate::egress::LocalLink>)> {
+        let previous=previous.map(Self::handoffs).transpose()?.unwrap_or_default();
+        let target=Self::handoffs(target)?;
+        let kept=target.iter().copied().filter(|link|previous.contains(link)).collect();
+        let changed=previous.iter().copied().filter(|link|!target.contains(link))
+            .chain(target.iter().copied().filter(|link|!previous.contains(link))).collect();
+        Ok((kept,changed))
+    }
+    /// Reconcile fence, before and after the single restore transaction. A handoff
+    /// link both generations bind exactly may carry packets: the transaction swaps
+    /// the owned block atomically, so a flow both contributions admit passes
+    /// throughout, and the referenced barrier already is the target. Every link
+    /// the transition adds or drops must be down.
+    fn fence(previous: Option<&Prepared>, target: &Prepared) -> Result<()> {
+        let (kept,changed)=Self::fenced(previous,target)?;
+        wire::verify_bound_interfaces(kept.into_iter().map(Self::bound))?;
+        wire::verify_bound_interfaces_down(changed.into_iter().map(Self::bound))
+    }
+    /// Cleanup fence: deletion only withdraws admission. A handoff link that no
+    /// longer exists, such as a veth that left with its router namespace, counts
+    /// as down; one that exists must still be the exact bound link, and down.
+    fn cleanup_fence(prepared: &Prepared) -> Result<()> {
+        wire::verify_bound_interfaces_down_or_absent(Self::handoffs(prepared)?.into_iter().map(Self::bound))
     }
     fn applied(&self, prepared: Prepared, backend: String) -> Applied {
         Applied {receipt:Receipt {identity:self.identity.clone(),backend,revision:prepared.policy.revision,digest:prepared.digest.clone()},prepared}
@@ -102,15 +127,14 @@ impl Owner {
                 return Ok(self.applied(transition.target.clone(),snapshot.backend));
             }
             if !snapshot.verified_matches(&self.options,&previous_rules,deadline)? {return Err(Error::Conflict);}
-            if let Some(previous)=&transition.previous {Self::fence(&previous.prepared)?;}
-            Self::fence(&transition.target)?;
+            let previous=transition.previous.as_ref().map(|v|&v.prepared);
+            Self::fence(previous,&transition.target)?;
             frontend::replace(&previous_rules,&target_rules,deadline)?;
             self.context()?;
             let current=frontend::Snapshot::read(deadline)?;
             if current.backend!=snapshot.backend || !current.verified_matches(&self.options,&target_rules,deadline)? {return Err(Error::Conflict);}
             owner::Owner::verify_external(&transition.target.policy.barrier)?;
-            if let Some(previous)=&transition.previous {Self::fence(&previous.prepared)?;}
-            Self::fence(&transition.target)?;
+            Self::fence(previous,&transition.target)?;
             Ok(self.applied(transition.target.clone(),current.backend))
         })();
         match result {
@@ -141,18 +165,25 @@ impl Owner {
             if current.verified_matches(&self.options,&[],deadline)? {return Ok(());}
             let rules=expected.prepared.rules(&self.options)?;
             if !current.verified_matches(&self.options,&rules,deadline)? {return Err(Error::Conflict);}
-            Self::fence(&expected.prepared)?;
+            Self::cleanup_fence(&expected.prepared)?;
             frontend::replace(&rules,&[],deadline)?;
             self.context()?;
             let after=frontend::Snapshot::read(deadline)?;
             if after.backend!=current.backend || !after.verified_matches(&self.options,&[],deadline)? {return Err(Error::Conflict);}
-            Self::fence(&expected.prepared)
+            Self::cleanup_fence(&expected.prepared)
         })();
         match result {Ok(())=>{self.applied=Some(expected);self.error=None;self.released=true;Ok(())},Err(error)=>{self.error=Some(error);Err(error)}}
     }
     fn close(&mut self, deadline: std::time::Instant) -> Result<()> {
+        self.context()?;
+        // Holding no rule is complete cleanup, whatever was refused before: the
+        // same generation-consistent read proves it without Docker's forwarding
+        // path. A read that fails is that read's error, never cleanup.
+        if frontend::Snapshot::observe(deadline)?.owns_nothing(&self.options)? {
+            self.pending=None;self.released=true;self.error=None;
+            return Ok(());
+        }
         if let Some(pending)=self.pending.clone() {
-            self.context()?;
             let current=frontend::Snapshot::read(deadline)?;
             if current.backend!=pending.target.backend {return Err(Error::Conflict);}
             let known=if current.verified_matches(&self.options,&pending.target.rules(&self.options)?,deadline)? {
@@ -163,12 +194,9 @@ impl Owner {
             } else if current.verified_matches(&self.options,&[],deadline)? {None} else {return Err(Error::Conflict);};
             self.applied=known;self.pending=None;
         }
-        if let Some(applied)=self.applied.clone() {self.release(applied,deadline)?;} else {
-            self.context()?;
-            if !frontend::Snapshot::read(deadline)?.verified_matches(&self.options,&[],deadline)? {return Err(Error::Conflict);}
-            self.released=true;self.error=None;
-        }
-        Ok(())
+        // Rules of this owner without a receipt for them are never deleted.
+        let applied=self.applied.clone().ok_or(Error::Conflict)?;
+        self.release(applied,deadline)
     }
 }
 pub fn dispatch(owner: &mut Option<Owner>, request: Request) -> Result<serde_json::Value> {