@push.rocks/smartnftables 4.1.0 → 4.3.0

package/rust/src/docker_tests.rs

@@ -2,8 +2,9 @@ use super::*;
 use serde_json::json;
 
 fn options() -> Options {Options {owner_id:"dockerfixture".into(),instance_id:"qualification_20260913".into()}}
-fn policy() -> policy::Policy {
-    let prepared:crate::managed::Prepared=serde_json::from_value::<crate::egress::Policy>(crate::egress::tests::host()).unwrap().prepare().unwrap().into();
+fn policy() -> policy::Policy {policy_from(crate::egress::tests::host())}
+fn policy_from(host: serde_json::Value) -> policy::Policy {
+    let prepared:crate::managed::Prepared=serde_json::from_value::<crate::egress::Policy>(host).unwrap().prepare().unwrap().into();
     policy::Policy {schema_version:1,revision:1,barrier:owner::Applied {
         receipt:owner::Receipt {identity:owner::Identity {owner_id:"barrier".into(),instance_id:"qualification_20260913".into(),table_name:"snft_fixture".into(),boot_id:"00000000-0000-4000-8000-000000000000".into(),namespace_device:"4".into(),namespace_inode:"1".into()},table_handle:"1".into(),revision:1,digest:prepared.digest.clone()},prepared}}
 }
@@ -149,3 +150,206 @@ fn docker_forward_jumps_require_exact_unconditional_order() {
         assert!(!graph::matches_forward(&row(expected),if target=="DOCKER-USER" {"DOCKER-FORWARD"} else {"DOCKER-USER"}).unwrap());
     }
 }
+
+/// The exact 4.1.0 contribution of a scope without publications: arguments,
+/// order, comments and native graph bytes are unchanged.
+#[test]
+fn docker_leased_contribution_keeps_its_exact_previous_rules_and_graphs() {
+    let rules=policy().prepare("v1.8.11 (nf_tables)".into()).unwrap().rules(&options()).unwrap();
+    let comment="snftd1:dockerfixture:qualification_20260913:2023fff251e6e68c6ec275e6b5e76f609b8bc0210b18ae3f3c88bfac3a54f5ee";
+    let expected=[
+        "-i handoff -o ens18 -s 10.240.0.2/32 -p tcp -m tcp --sport 10000:10999 --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW --ctproto 6 --ctorigsrc 10.240.0.2 --ctorigsrcport 10000:10999 --ctdir ORIGINAL",
+        "-i handoff -o ens18 -s 10.240.0.2/32 -p tcp -m tcp --sport 10000:10999 -m conntrack --ctstate ESTABLISHED --ctproto 6 --ctorigsrc 10.240.0.2 --ctorigsrcport 10000:10999 --ctdir ORIGINAL",
+        "-i ens18 -o handoff -d 10.240.0.2/32 -p tcp -m tcp --dport 10000:10999 -m conntrack --ctstate ESTABLISHED --ctproto 6 --ctorigsrc 10.240.0.2 --ctorigsrcport 10000:10999 --ctdir REPLY",
+        "-i handoff -o ens18 -s 10.240.0.2/32 -p udp -m udp --sport 10000:10999 -m conntrack --ctstate NEW --ctproto 17 --ctorigsrc 10.240.0.2 --ctorigsrcport 10000:10999 --ctdir ORIGINAL",
+        "-i handoff -o ens18 -s 10.240.0.2/32 -p udp -m udp --sport 10000:10999 -m conntrack --ctstate ESTABLISHED --ctproto 17 --ctorigsrc 10.240.0.2 --ctorigsrcport 10000:10999 --ctdir ORIGINAL",
+        "-i ens18 -o handoff -d 10.240.0.2/32 -p udp -m udp --dport 10000:10999 -m conntrack --ctstate ESTABLISHED --ctproto 17 --ctorigsrc 10.240.0.2 --ctorigsrcport 10000:10999 --ctdir REPLY",
+    ];
+    assert_eq!(rules.len(),expected.len());
+    for (index,(rule,args)) in rules.iter().zip(expected).enumerate() {
+        assert_eq!(rule.args.join(" "),format!("{args} -m comment --comment {comment}:{index} -j ACCEPT"));
+    }
+    let mut digest=<sha2::Sha256 as sha2::Digest>::new();
+    for rule in &rules {sha2::Digest::update(&mut digest,crate::wire::encode_attrs(&graph::expected(rule).unwrap()));}
+    assert_eq!(format!("{:x}",sha2::Digest::finalize(digest)),"dc46825f57c6f0001c1a517760e9e5560e4a5ee90f00322075c4b96e41e24c79");
+}
+
+fn published() -> policy::Policy {
+    let mut range=crate::egress::tests::published_port("udp",20000,20000);
+    range["hostPortEnd"]=json!(20200);range["symmetric"]=json!(true);
+    policy_from(crate::egress::tests::published_host(json!([range,crate::egress::tests::published_port("tcp",443,8443)])))
+}
+fn conntrack(expressions: &[crate::wire::Attr]) -> Vec<u8> {
+    for expression in expressions {
+        let fields=crate::wire::attrs(&expression.value).unwrap();
+        if crate::wire::text(&fields,1).unwrap()!="match" {continue;}
+        let data=crate::wire::attrs(&crate::wire::one(&fields,2).unwrap().value).unwrap();
+        if crate::wire::text(&data,1).unwrap()=="conntrack" {return crate::wire::one(&data,3).unwrap().value.clone();}
+    }
+    panic!("no conntrack match")
+}
+fn word(bytes: &[u8], offset: usize) -> u16 {u16::from_ne_bytes([bytes[offset],bytes[offset+1]])}
+
+/// Inbound publications and their replies, and the flows a symmetric
+/// publication opens from its target ports, as the barrier's forward chain
+/// admits them: leased ranges first, then publications in canonical order.
+#[test]
+fn docker_contribution_admits_every_published_and_symmetric_flow_of_the_barrier() {
+    let prepared=published().prepare("v1.8.11 (nf_tables)".into()).unwrap();
+    let rules=prepared.rules(&options()).unwrap();
+    // 2 leased ranges, 2 inbound publications and 1 symmetric publication, each
+    // NEW, ESTABLISHED and the ESTABLISHED reply.
+    assert_eq!(rules.len(),15);
+    let args=|index: usize|rules[index].args[..rules[index].args.len()-6].join(" ");
+    assert_eq!(args(6),"-i ens18 -o handoff -d 10.240.0.2/32 -p tcp -m tcp --dport 8443 --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW --ctproto 6 --ctorigdst 192.0.2.2 --ctorigdstport 443 --ctdir ORIGINAL");
+    assert_eq!(args(7),"-i ens18 -o handoff -d 10.240.0.2/32 -p tcp -m tcp --dport 8443 -m conntrack --ctstate ESTABLISHED --ctproto 6 --ctorigdst 192.0.2.2 --ctorigdstport 443 --ctdir ORIGINAL");
+    assert_eq!(args(8),"-i handoff -o ens18 -s 10.240.0.2/32 -p tcp -m tcp --sport 8443 -m conntrack --ctstate ESTABLISHED --ctproto 6 --ctorigdst 192.0.2.2 --ctorigdstport 443 --ctdir REPLY");
+    assert_eq!(args(9),"-i ens18 -o handoff -d 10.240.0.2/32 -p udp -m udp --dport 20000:20200 -m conntrack --ctstate NEW --ctproto 17 --ctorigdst 192.0.2.2 --ctorigdstport 20000:20200 --ctdir ORIGINAL");
+    assert_eq!(args(11),"-i handoff -o ens18 -s 10.240.0.2/32 -p udp -m udp --sport 20000:20200 -m conntrack --ctstate ESTABLISHED --ctproto 17 --ctorigdst 192.0.2.2 --ctorigdstport 20000:20200 --ctdir REPLY");
+    assert_eq!(args(12),"-i handoff -o ens18 -s 10.240.0.2/32 -p udp -m udp --sport 20000:20200 -m conntrack --ctstate NEW --ctproto 17 --ctorigsrc 10.240.0.2 --ctorigsrcport 20000:20200 --ctdir ORIGINAL");
+    assert_eq!(args(13),"-i handoff -o ens18 -s 10.240.0.2/32 -p udp -m udp --sport 20000:20200 -m conntrack --ctstate ESTABLISHED --ctproto 17 --ctorigsrc 10.240.0.2 --ctorigsrcport 20000:20200 --ctdir ORIGINAL");
+    assert_eq!(args(14),"-i ens18 -o handoff -d 10.240.0.2/32 -p udp -m udp --dport 20000:20200 -m conntrack --ctstate ESTABLISHED --ctproto 17 --ctorigsrc 10.240.0.2 --ctorigsrcport 20000:20200 --ctdir REPLY");
+    // Without publications only the leased rules remain; a non-symmetric
+    // publication opens nothing from its target ports.
+    let mut plain=crate::egress::tests::published_port("udp",20000,20000);plain["hostPortEnd"]=json!(20200);
+    let plain=policy_from(crate::egress::tests::published_host(json!([plain]))).prepare("v1.8.11 (nf_tables)".into()).unwrap().rules(&options()).unwrap();
+    assert_eq!(plain.len(),9);
+    assert!(plain.iter().all(|rule|!rule.args.windows(2).any(|w|w==["--ctorigsrcport","20000:20200"])));
+    assert!(snapshot(&text(&rules)).matches(&options(),&rules).unwrap());
+}
+
+#[test]
+fn docker_inbound_graph_binds_the_original_destination_tuple() {
+    let rules=published().prepare("v1.8.11 (nf_tables)".into()).unwrap().rules(&options()).unwrap();
+    for (index,reply) in [(6,false),(8,true)] {
+        let expressions=graph::expected(&rules[index]).unwrap();
+        let data=conntrack(&expressions);
+        assert_eq!(data.len(),168);
+        assert!(data[..32].iter().all(|byte|*byte==0));
+        assert_eq!(&data[32..36],&[192,0,2,2]);
+        assert!(data[36..48].iter().all(|byte|*byte==0) && data[48..64].iter().all(|byte|*byte==0xff));
+        assert_eq!((word(&data,136),word(&data,138),word(&data,140),word(&data,146),word(&data,148),word(&data,150)),
+            (6,0,443,0x120b,if reply {0x1000} else {0},if reply {2} else {8}));
+        assert_eq!((word(&data,154),word(&data,156)),(0,443));
+        // The live tuple: the translated inside destination, or its reply source.
+        let payload=crate::wire::attrs(&expressions[0].value).unwrap();
+        let fields=crate::wire::attrs(&crate::wire::one(&payload,2).unwrap().value).unwrap();
+        assert_eq!(crate::wire::one(&fields,3).unwrap().value,(if reply {12_u32} else {16}).to_be_bytes());
+        let row=|expressions|vec![crate::wire::Attr::string(1,"filter"),crate::wire::Attr::string(2,"DOCKER-USER"),
+            crate::wire::Attr::u64(3,42),crate::wire::Attr::nested(4,expressions)];
+        assert!(graph::matches_rule(&row(expressions.clone()),&rules[index]).unwrap());
+        let mut hidden=expressions.clone();
+        for expression in &mut hidden {
+            let mut fields=crate::wire::attrs(&expression.value).unwrap();
+            if crate::wire::text(&fields,1).unwrap()!="match" {continue;}
+            let mut data=crate::wire::attrs(&crate::wire::one(&fields,2).unwrap().value).unwrap();
+            if crate::wire::text(&data,1).unwrap()!="conntrack" {continue;}
+            data.iter_mut().find(|a|a.id()==3).unwrap().value[52..64].fill(0);
+            *fields.iter_mut().find(|a|a.id()==2).unwrap()=crate::wire::Attr::nested(2,data);
+            expression.value=crate::wire::encode_attrs(&fields);
+        }
+        assert!(!graph::matches_rule(&row(hidden),&rules[index]).unwrap());
+    }
+    // A ranged inbound publication binds its whole outside span.
+    let data=conntrack(&graph::expected(&rules[9]).unwrap());
+    assert_eq!((word(&data,140),word(&data,156)),(20000,20200));
+}
+
+#[test]
+fn docker_snapshot_accepts_rendered_destination_tuples_and_rejects_changed_ones() {
+    let rules=published().prepare("v1.8.11 (nf_tables)".into()).unwrap().rules(&options()).unwrap();
+    let original=text(&rules);
+    assert!(snapshot(&original.replace("--ctorigdst 192.0.2.2 ","--ctorigdst 192.0.2.2/32 ")).matches(&options(),&rules).unwrap());
+    for (before,after) in [("--ctorigdstport 443","--ctorigdstport 444"),("--ctorigdst 192.0.2.2","--ctorigsrc 192.0.2.2"),
+        ("--dport 8443","--dport 8444"),("--ctorigdst 192.0.2.2","--ctorigdst 192.0.2.3")] {
+        assert!(!snapshot(&original.replacen(before,after,1)).matches(&options(),&rules).unwrap());
+    }
+}
+
+#[test]
+fn docker_contribution_keeps_its_restore_bound() {
+    let ports:Vec<_>=(0..64_u16).map(|index|crate::egress::tests::published_port("tcp",443+index,443+index)).collect();
+    let error=policy_from(crate::egress::tests::published_host(json!(ports))).prepare("v1.8.11 (nf_tables)".into()).unwrap_err();
+    assert_eq!(error.code(),"EXHAUSTED");
+}
+
+fn absent(mut host: serde_json::Value) -> serde_json::Value {
+    // No link holds this index on a test host.
+    host["scope"]["handoffs"][0]["link"]["interfaceIndex"]=json!(2_147_483_000_u32);host
+}
+
+#[test]
+fn docker_reconcile_fence_lets_only_links_both_generations_bind_carry_packets() {
+    let target=policy().prepare("v1.8.11 (nf_tables)".into()).unwrap();
+    let amended=published().prepare("v1.8.11 (nf_tables)".into()).unwrap();
+    let moved=policy_from(absent(crate::egress::tests::host())).prepare("v1.8.11 (nf_tables)".into()).unwrap();
+    let names=|links: Vec<&crate::egress::LocalLink>|links.iter().map(|link|link.interface_index).collect::<Vec<_>>();
+    let (kept,changed)=Owner::fenced(None,&target).unwrap();
+    assert_eq!((names(kept),names(changed)),(vec![],vec![4]));
+    let (kept,changed)=Owner::fenced(Some(&target),&amended).unwrap();
+    assert_eq!((names(kept),names(changed)),(vec![4],vec![]));
+    let (kept,changed)=Owner::fenced(Some(&target),&moved).unwrap();
+    assert_eq!((names(kept),names(changed)),(vec![],vec![4,2_147_483_000]));
+    // A link the transition keeps must still exist exactly.
+    assert!(Owner::fence(Some(&moved),&moved).is_err());
+    assert!(Owner::fence(None,&moved).is_err());
+}
+
+#[test]
+fn docker_cleanup_fence_counts_a_vanished_handoff_as_down() {
+    let gone=policy_from(absent(crate::egress::tests::host())).prepare("v1.8.11 (nf_tables)".into()).unwrap();
+    Owner::cleanup_fence(&gone).unwrap();
+    // The mutation fence still requires the exact link.
+    let link=&gone.policy.scope().unwrap().handoffs[0].link;
+    assert!(crate::wire::verify_bound_interfaces_down(std::iter::once(Owner::bound(link))).is_err());
+    // A different link at a bound index is not the bound link.
+    let mut loopback=crate::egress::tests::host();
+    loopback["scope"]["handoffs"][0]["link"]["interfaceIndex"]=json!(1);
+    let loopback=policy_from(loopback).prepare("v1.8.11 (nf_tables)".into()).unwrap();
+    assert_eq!(Owner::cleanup_fence(&loopback),Err(Error::Conflict));
+}
+
+/// A host whose forwarding path refuses every apply, such as one with FORWARD
+/// policy ACCEPT or without Docker, still reads as a complete filter table, so an
+/// owner whose first apply was refused can prove that it holds no rule there.
+#[test]
+fn docker_absence_proof_reads_a_filter_table_the_apply_path_refuses() {
+    let rules=policy().prepare("v1.8.11 (nf_tables)".into()).unwrap().rules(&options()).unwrap();
+    let prefix="snftd1:dockerfixture:";
+    let accept=text(&[]).replace(":FORWARD DROP",":FORWARD ACCEPT");
+    let dockerless="# Warning: iptables-legacy tables present\n*filter\n:INPUT ACCEPT [0:0]\n:FORWARD ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\nCOMMIT\n";
+    for host in [accept.as_str(),dockerless,"*filter\nCOMMIT\n"] {
+        assert_eq!(frontend::Snapshot::parse("v1.8.11 (nf_tables)".into(),host).err(),Some(Error::Conflict));
+        let observed=frontend::Snapshot::table("v1.8.11 (nf_tables)".into(),host).unwrap();
+        assert!(!observed.mentions(prefix));
+        // Text alone never proves absence: the native rules must be read too.
+        assert_eq!(observed.owns_nothing(&options()),Err(Error::Conflict));
+    }
+    // Owned rules anywhere in the table are found, also off the admitted path.
+    let owned=text(&rules).replace(":FORWARD DROP",":FORWARD ACCEPT");
+    assert!(frontend::Snapshot::table("v1.8.11 (nf_tables)".into(),&owned).unwrap().mentions(prefix));
+    let moved=text(&rules).replacen("-A DOCKER-USER","-A INPUT",1);
+    assert!(frontend::Snapshot::table("v1.8.11 (nf_tables)".into(),&moved).unwrap().mentions(prefix));
+    // Another owner's rules are not this owner's.
+    let foreign=owned.replace(prefix,"snftd1:anotherowner:");
+    assert!(!frontend::Snapshot::table("v1.8.11 (nf_tables)".into(),&foreign).unwrap().mentions(prefix));
+    // An incompatible or partial table is not a complete read.
+    for partial in ["# Table `filter' is incompatible, use 'nft' tool.\n","*filter\n:INPUT ACCEPT [0:0]\n",""] {
+        assert_eq!(frontend::Snapshot::table("v1.8.11 (nf_tables)".into(),partial).err(),Some(Error::Conflict));
+    }
+}
+
+#[test]
+fn docker_absence_proof_finds_the_owner_comment_in_native_rules() {
+    let rules=policy().prepare("v1.8.11 (nf_tables)".into()).unwrap().rules(&options()).unwrap();
+    let row=|rule: &policy::Rule|vec![crate::wire::Attr::string(1,"filter"),crate::wire::Attr::string(2,"DOCKER-USER"),
+        crate::wire::Attr::u64(3,42),crate::wire::Attr::nested(4,graph::expected(rule).unwrap())];
+    let owned:Vec<_>=rules.iter().map(row).collect();
+    assert!(graph::mentions(&owned,b"snftd1:dockerfixture:"));
+    assert!(graph::mentions(&owned[5..],b"snftd1:dockerfixture:"));
+    assert!(!graph::mentions(&owned,b"snftd1:anotherowner:"));
+    assert!(!graph::mentions(&Vec::new(),b"snftd1:dockerfixture:"));
+    // Wherever a frontend stores the comment, such as rule userdata, it is found.
+    let userdata=vec![vec![crate::wire::Attr::string(1,"filter"),crate::wire::Attr::bytes(7,rules[0].comment.as_bytes().to_vec())]];
+    assert!(graph::mentions(&userdata,b"snftd1:dockerfixture:"));
+}

package/rust/src/egress.host.rs

@@ -84,34 +84,31 @@ fn leased(
     expressions.extend(original_range(range.first, range.last));
     Ok(expressions)
 }
-/// The publications of this hop. Validation admits only leased transit source
-/// addresses as targets, and one address never spans two active handoff links,
-/// so each publication has exactly one handoff.
-fn hop(scope: &HostScope) -> Result<published::Hop<'_>> {
-    let mut publications = Vec::new();
-    for port in &scope.published_ports {
-        let handoff = scope
-            .handoffs
-            .iter()
-            .find(|handoff| {
-                handoff
-                    .allocations
-                    .iter()
-                    .any(|allocation| allocation.transit_source_address == port.target_address)
-            })
-            .ok_or(crate::Error::Invalid)?;
-        publications.push(published::Publication {
-            protocol: &port.protocol,
-            outside: (&port.host_ip, port.host_port, port.host_last()),
-            inside: (&port.target_address, port.target_port, port.target_last()),
-            link: &handoff.link,
-            symmetric: port.symmetric,
-        });
-    }
-    Ok(published::Hop {
+/// The publications of this hop, from the scope's forwarding enumeration.
+fn hop<'a>(scope: &'a HostScope, forwarding: &Forwarding<'a>) -> published::Hop<'a> {
+    let publications = forwarding
+        .published
+        .iter()
+        .map(|item| published::Publication {
+            protocol: &item.port.protocol,
+            outside: (
+                &item.port.host_ip,
+                item.port.host_port,
+                item.port.host_last(),
+            ),
+            inside: (
+                &item.port.target_address,
+                item.port.target_port,
+                item.port.target_last(),
+            ),
+            link: item.link,
+            symmetric: item.port.symmetric,
+        })
+        .collect();
+    published::Hop {
         publications,
         fixed: &scope.uplink,
-    })
+    }
 }
 /// The exact platform endpoints served on host addresses. Every packet is
 /// checked against the live and the originally tracked destination tuple, so a
@@ -219,7 +216,8 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &HostScope) -> Result<()
                 .ok_or(crate::Error::Invalid)
         })?;
     }
-    let hop = hop(scope)?;
+    let forwarding = scope.forwarding()?;
+    let hop = hop(scope, &forwarding);
     published::sets(program, &hop, false)?;
     protection(program, scope, false)?;
     protection(program, scope, true)?;
@@ -241,26 +239,27 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &HostScope) -> Result<()
         program.jump("forward", link(&handoff.link, true), "protected_out")?;
         program.jump("forward", link(&handoff.link, false), "protected_back")?;
     }
-    for handoff in &scope.handoffs {
-        for allocation in &handoff.allocations {
-            for range in &allocation.source_port_ranges {
-                let original = envelope(scope, handoff, allocation, range, false)?;
-                for connection_state in [2, 8] {
-                    let mut expressions = original.clone();
-                    expressions.extend(state(connection_state));
-                    if connection_state == 8 && range.protocol == "tcp" {
-                        expressions.extend(opening_tcp());
-                    }
-                    program.end("forward", expressions, 1)?;
-                }
-                let mut reply = envelope(scope, handoff, allocation, range, true)?;
-                reply.extend(state(2));
-                program.end("forward", reply, 1)?;
-                let mut nat = original;
-                nat.extend(snat(&scope.snat_address, None)?);
-                program.rule("post", nat)?;
+    for LeasedForward {
+        handoff,
+        allocation,
+        range,
+    } in &forwarding.leased
+    {
+        let original = envelope(scope, handoff, allocation, range, false)?;
+        for connection_state in [2, 8] {
+            let mut expressions = original.clone();
+            expressions.extend(state(connection_state));
+            if connection_state == 8 && range.protocol == "tcp" {
+                expressions.extend(opening_tcp());
             }
+            program.end("forward", expressions, 1)?;
         }
+        let mut reply = envelope(scope, handoff, allocation, range, true)?;
+        reply.extend(state(2));
+        program.end("forward", reply, 1)?;
+        let mut nat = original;
+        nat.extend(snat(&scope.snat_address, None)?);
+        program.rule("post", nat)?;
     }
     // Symmetric flows leave from ports outside every leased range of their
     // address, after the capture barrier and before the terminal handoff denials.

package/rust/src/egress.rs

@@ -216,6 +216,62 @@ pub struct HostScope {
     #[serde(default, skip_serializing_if = "std::ops::Not::not")]
     pub exclusive_forwarding: bool,
 }
+/// One leased source port range of one allocation, on the handoff that holds it.
+pub struct LeasedForward<'a> {
+    pub handoff: &'a HostHandoff,
+    pub allocation: &'a Allocation,
+    pub range: &'a PortRange,
+}
+/// One publication, on the handoff link that holds its leased target address.
+pub struct PublishedForward<'a> {
+    pub port: &'a PublishedPort,
+    pub link: &'a LocalLink,
+}
+/// The forwarded flows a host-transit scope admits, in canonical scope order:
+/// leased flows from a handoff to the uplink, and per publication its inbound
+/// flows from the uplink to the handoff and, when symmetric, the flows it opens
+/// from its target ports to the uplink; each with its replies. The scope's nft
+/// forward chain and the Docker contribution both derive from this one list.
+pub struct Forwarding<'a> {
+    pub leased: Vec<LeasedForward<'a>>,
+    pub published: Vec<PublishedForward<'a>>,
+}
+impl HostScope {
+    pub fn forwarding(&self) -> Result<Forwarding<'_>> {
+        let mut leased = Vec::new();
+        for handoff in &self.handoffs {
+            for allocation in &handoff.allocations {
+                for range in &allocation.source_port_ranges {
+                    leased.push(LeasedForward {
+                        handoff,
+                        allocation,
+                        range,
+                    });
+                }
+            }
+        }
+        // Validation admits only leased transit source addresses as targets, and
+        // one address never spans two active handoff links, so each publication
+        // has exactly one handoff.
+        let mut published = Vec::new();
+        for port in &self.published_ports {
+            let handoff =
+                self.handoffs
+                    .iter()
+                    .find(|handoff| {
+                        handoff.allocations.iter().any(|allocation| {
+                            allocation.transit_source_address == port.target_address
+                        })
+                    })
+                    .ok_or(Error::Invalid)?;
+            published.push(PublishedForward {
+                port,
+                link: &handoff.link,
+            });
+        }
+        Ok(Forwarding { leased, published })
+    }
+}
 /// One loopback TCP service that only one local user may dial: packets the host
 /// sends to the exact address and port from a socket of any other user reject,
 /// and packets arriving there on any interface but loopback drop.

package/rust/src/forwardhooks.rs

@@ -0,0 +1,176 @@
+//! Read-only view of every packet-filter owner on the IPv4/IPv6 forward hook of
+//! this network namespace. It claims, adopts and changes nothing.
+use crate::wire::{self, Attr, Socket};
+use crate::{decode, encode, Error, Request, Result};
+use serde::Serialize;
+
+#[cfg(test)]
+#[path = "forwardhooks_tests.rs"]
+mod tests;
+
+/// One nf_tables base chain on the forward hook.
+#[derive(Clone, Debug, Serialize, PartialEq, Eq, PartialOrd, Ord)]
+#[serde(rename_all = "camelCase")]
+pub struct Chain {
+    pub family: &'static str,
+    pub table: String,
+    pub table_handle: String,
+    pub chain: String,
+    #[serde(rename = "type")]
+    pub chain_type: String,
+    pub priority: i32,
+    pub policy: &'static str,
+}
+/// Docker's iptables-nft dispatch chains in table `ip filter`.
+#[derive(Clone, Debug, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct Docker {
+    pub docker_user: bool,
+    pub docker_forward: bool,
+}
+/// Registered legacy xtables tables. Their hooks, including FORWARD, are not
+/// nf_tables objects and never appear in `chains`.
+#[derive(Clone, Debug, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct Legacy {
+    pub ipv4: Vec<String>,
+    pub ipv6: Vec<String>,
+}
+#[derive(Clone, Debug, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct Inspection {
+    pub chains: Vec<Chain>,
+    pub docker: Docker,
+    pub legacy_tables: Legacy,
+}
+
+/// The families whose forward hook sees routed IPv4 or IPv6 packets.
+fn family(value: u8) -> Option<&'static str> {
+    match value {
+        1 => Some("inet"),
+        2 => Some("ip"),
+        10 => Some("ip6"),
+        _ => None,
+    }
+}
+const NF_INET_FORWARD: u32 = 2;
+
+/// Classify one consistent table and chain dump.
+pub(crate) fn classify(
+    tables: &[(u8, Vec<Attr>)],
+    chains: &[(u8, Vec<Attr>)],
+) -> Result<(Vec<Chain>, Docker)> {
+    let mut result = Vec::new();
+    let mut docker = Docker {
+        docker_user: false,
+        docker_forward: false,
+    };
+    for (number, attributes) in chains {
+        let table = wire::text(attributes, 1)?;
+        let name = wire::text(attributes, 3)?;
+        if *number == 2 && table == "filter" {
+            match name.as_str() {
+                "DOCKER-USER" => docker.docker_user = true,
+                "DOCKER-FORWARD" => docker.docker_forward = true,
+                _ => {}
+            }
+        }
+        let Some(family) = family(*number) else {
+            continue;
+        };
+        // Only base chains carry a hook.
+        if !attributes.iter().any(|attribute| attribute.id() == 4) {
+            continue;
+        }
+        let hook = wire::attrs(&wire::one(attributes, 4)?.value)?;
+        if wire::number(&hook, 1)? != NF_INET_FORWARD {
+            continue;
+        }
+        let priority = wire::number(&hook, 2)? as i32;
+        let policy = match wire::number(attributes, 5)? {
+            0 => "drop",
+            1 => "accept",
+            _ => return Err(Error::Protocol),
+        };
+        let handle = tables
+            .iter()
+            .filter(|(owner, table_attributes)| {
+                owner == number
+                    && wire::text(table_attributes, 1).ok().as_deref() == Some(table.as_str())
+            })
+            .map(|(_, table_attributes)| wire::handle(table_attributes, 4))
+            .collect::<Result<Vec<_>>>()?;
+        let [handle] = handle.as_slice() else {
+            return Err(Error::Conflict);
+        };
+        result.push(Chain {
+            family,
+            table,
+            table_handle: handle.to_string(),
+            chain: name,
+            chain_type: wire::text(attributes, 7)?,
+            priority,
+            policy,
+        });
+    }
+    result.sort();
+    Ok((result, docker))
+}
+
+/// One registered table name per line; an absent file means none is registered.
+fn legacy(path: &str) -> Result<Vec<String>> {
+    use std::io::Read;
+    let file = match std::fs::File::open(path) {
+        Ok(file) => file,
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(Vec::new()),
+        Err(_) => return Err(Error::Unavailable),
+    };
+    let mut text = String::new();
+    file.take(4097)
+        .read_to_string(&mut text)
+        .map_err(|_| Error::Protocol)?;
+    if text.len() > 4096 {
+        return Err(Error::Protocol);
+    }
+    let mut names = Vec::new();
+    for line in text.lines() {
+        if !crate::policy::identifier(line) {
+            return Err(Error::Protocol);
+        }
+        names.push(line.to_owned());
+    }
+    names.sort();
+    Ok(names)
+}
+
+pub fn inspect() -> Result<Inspection> {
+    let mut socket = Socket::open()?;
+    let generation = socket.generation()?;
+    let tables = socket.dump_all_families(1)?;
+    let chains = socket.dump_all_families(4)?;
+    // Both dumps describe one ruleset generation, or the view is inconclusive.
+    if socket.generation()? != generation {
+        return Err(Error::Conflict);
+    }
+    let (chains, docker) = classify(&tables, &chains)?;
+    Ok(Inspection {
+        chains,
+        docker,
+        legacy_tables: Legacy {
+            ipv4: legacy("/proc/self/net/ip_tables_names")?,
+            ipv6: legacy("/proc/self/net/ip6_tables_names")?,
+        },
+    })
+}
+
+pub fn dispatch(request: Request) -> Result<serde_json::Value> {
+    match request.method.as_str() {
+        "inspectForwardHooks" => {
+            if decode::<serde_json::Value>(request.params)? != serde_json::json!({}) {
+                return Err(Error::Invalid);
+            }
+            encode(inspect()?)
+        }
+        _ => Err(Error::Invalid),
+    }
+}