@push.rocks/smartnftables 4.3.1 → 4.5.0

package/changelog.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 2026-10-06 - 4.5.0
+
+### Features
+
+- Typed sets: `nft` decodes every managed set and lists the rules that look them up, up to nftables' own limit below (Pallet lab RUN 9, O9-1). Every set was declared with key type 0, data type 0 and no userdata, so nftables 1.0.9 aborted listing any rule that looked one up (`netlink_delinearize.c`: `dtype != &invalid_type`) and segfaulted listing the sets themselves. Each key field now has one descriptor (length, nft type, byte order, `typeof` expression) from which both the rule's loads and the set declaration derive, and a lookup whose loads do not fit its set's key refuses to compile (`INVALID`). Sets carry their key and data types and nft's userdata (byte orders, `typeof` key and data, data interval) byte for byte as nftables 1.0.9 writes them for the same `typeof` declaration; keys beyond four fields carry their type and byte order alone, as nft cannot describe them by `typeof`. Policy digests are unchanged; compiled bytes change for every graph with sets, and stripping the types again reproduces the 4.4.0 goldens byte for byte. nftables itself still crashes listing a rule that tests membership of seven or more concatenated fields (host grants, workload grants, published flows, ported private rules), also on nftables master; readme "Listing the managed tables with `nft`" states what lists today. Tests: nft-captured userdata bytes (`egress_keys_tests`), and in the isolated guest, now carrying the host's nftables 1.0.9, every declared set against the set nft creates from the same `typeof`, every set, chain and ruleset listed, the nft crash pinned, and the untyped control aborting.
+- Upgrading over a table applied by 4.4.x or earlier: its graph with untyped sets is adopted, inspected, verified (`verify_external`) and released as the applied graph, and `reconcile()` never treats it as already applied but replaces the whole graph with typed sets in its single batch, including a retry of the transition that applied it. This acceptance is legacy for kernel state left by 4.4.x and goes with the next major. The step is one-way per boot: 4.4.x refuses typed sets (`CONFLICT`). Tests: graph agreement (exact, untyped, mixed, retyped, changed element) and, in the isolated guest, adoption and replacement of a 4.4.x graph by a new and by the same transition (claim plus one batch), external verification and release.
+
+## 2026-10-06 - 4.4.0
+
+### Features
+
+- `allocationPoolGuard.publishedPorts`: publications are exceptions of the allocation-pool guard. A `hostTransit` publication translates an inbound uplink flow to the router's transit address, which lies in a guarded pool, so the guard dropped every published flow in FORWARD by its current destination (and every reply by its current source) on any host that runs both tables: Pallet's docker-shared lab node delivered nothing on its published ports (serve.zone lab 2026-10-06, D12). Each entry `{ protocol, hostPort, hostPortEnd?, targetPort, targetAddress }` admits the flow translated from outside every pool to that exact pool address and port, and its replies, in the default conntrack zone: two or three rules in the guard chain after the original-destination denial, around the CONSTANT interval set `pool_published`. Absent and empty keep every guard's digest and compiled bytes. Readme: "Publications through the allocation-pool guard". Tests: `egress_poolguardpublished_tests` (exact admission, and the guard's own refusal for 18 foreign flows (other address, port, protocol, zone and untranslated flows), unchanged local and reply chains, canonical form, refusals, the largest guard's atomic budget).
+
+### Maintenance
+
+- Release tooling: pnpm 12.8.1, `@git.zone/cli` ^8.8.2, `@git.zone/tstest` ^7.1.0 and `@git.zone/tsrust` 4.0.0. tsrust 4 always remaps local paths and fails a build whose binary still records one, so the obsolete `remapLocalPaths` setting leaves `.smartconfig.json`.
+
 ## 2026-10-02 - 4.3.1
 
 ### Fixes

package/dist_rust/smartnftables_linux_amd64_musl.tsrust-build.json

@@ -1,13 +1,13 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "cf73bfcf658ee25f8a084e50cefb3f43d2f949b0cdcc46a57b4e91a9c0497a20",
+  "binarySha256": "f30fb315a0059adfc4afe0728a8304fe14a5a45e2437cb4e76d5c79c7dbf8917",
   "buildInfo": {
     "projectName": "@push.rocks/smartnftables",
-    "projectVersion": "4.3.1",
-    "gitCommit": "134a7f1fd3986cc97c9450108f7a79c7b5b395ec",
+    "projectVersion": "4.5.0",
+    "gitCommit": "f648edff675c7693b2ec8bca6138bd7d1e2da65b",
     "gitDirty": false,
-    "builtAt": "2026-10-02T22:57:27.524Z",
-    "tsrustVersion": "3.0.0",
+    "builtAt": "2026-10-06T05:09:47.306Z",
+    "tsrustVersion": "4.0.0",
     "binary": "smartnftables",
     "target": "linux_amd64_musl"
   }

package/dist_rust/smartnftables_linux_arm64_musl.tsrust-build.json

@@ -1,13 +1,13 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "ae5bf59b529f990c5f0a5ff8c8898cb42d3dcb5ce724c3786f64c69eb5f03bdd",
+  "binarySha256": "3347480d9c39a2ee4891c13f7c6a12d50d9175e15776f1c6999e1574a491dfd8",
   "buildInfo": {
     "projectName": "@push.rocks/smartnftables",
-    "projectVersion": "4.3.1",
-    "gitCommit": "134a7f1fd3986cc97c9450108f7a79c7b5b395ec",
+    "projectVersion": "4.5.0",
+    "gitCommit": "f648edff675c7693b2ec8bca6138bd7d1e2da65b",
     "gitDirty": false,
-    "builtAt": "2026-10-02T22:57:37.239Z",
-    "tsrustVersion": "3.0.0",
+    "builtAt": "2026-10-06T05:09:57.015Z",
+    "tsrustVersion": "4.0.0",
     "binary": "smartnftables",
     "target": "linux_arm64_musl"
   }

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@push.rocks/smartnftables',
-    version: '4.3.1',
+    version: '4.5.0',
     description: 'A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSwyQkFBMkI7SUFDakMsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLG1IQUFtSDtDQUNqSSxDQUFBIn0=

package/dist_ts/managed.egress.types.d.ts

@@ -217,17 +217,38 @@ export interface IManagedNftLocalTcpPortOwner {
      * which only privileged mounts create. */
     uid: number;
 }
+/** One publication an allocation-pool guard admits into a pool: a flow whose original destination lies
+ * outside every listed pool, on `hostPort` (or the range `hostPort..hostPortEnd`), translated to exactly
+ * `targetAddress` and `targetPort`, and its replies, in the default conntrack zone. The guard checks
+ * no link and no uplink address: the scope that translates the flow (`hostTransit.publishedPorts`)
+ * binds those. Compile the same publication into the guard and the host-transit scope it crosses. */
+export interface IManagedNftPoolGuardPublishedPort {
+    protocol: 'tcp' | 'udp';
+    /** Published port, 1–65535; each protocol and port is published at most once per guard. */
+    hostPort: number;
+    /** Optional last port of a published range, greater than `hostPort`; a range keeps every port,
+     * so `targetPort` must equal `hostPort`. Absent for one port, its only canonical form. */
+    hostPortEnd?: number;
+    targetPort: number;
+    /** Exact unicast address inside a listed pool that the publication is translated to. */
+    targetAddress: string;
+}
 /** Host-wide IPv4 destination denial for caller-authenticated private allocation pools.
- * It has no link dependency; exact host grants are its only exceptions. It is not allocation-release or boot-order proof. */
+ * It has no link dependency; exact host grants and publications are its only exceptions. It is not
+ * allocation-release or boot-order proof. */
 export interface IManagedNftAllocationPoolGuardScopeV2 {
     kind: 'allocationPoolGuard';
     authorityDigest: string;
     /** Complete current pool list: 1–64 canonical, disjoint RFC1918 prefixes. */
     prefixes: string[];
-    /** The only exceptions to the guard: exact host-origin flows whose `destinationAddress` lies in a
-     * listed pool, and their replies. Absent and empty are the same canonical policy; at most 1024,
-     * held in a named set behind a constant number of rules. */
+    /** Exceptions to the guard: exact host-origin flows whose `destinationAddress` lies in a listed
+     * pool, and their replies. Absent and empty are the same canonical policy; at most 1024, held in a
+     * named set behind a constant number of rules. */
     hostGrants?: IManagedNftHostGrant[];
+    /** Exceptions to the guard: publications translated from outside every listed pool into one, and
+     * their replies. Absent and empty are the same canonical policy, digest and compiled graph; at most
+     * 1024, held in a named set behind a constant number of rules. */
+    publishedPorts?: IManagedNftPoolGuardPublishedPort[];
     /** Optional host-wide loopback port ownership, compiled ahead of the guard in the same table.
      * Absent and empty are the same canonical policy, digest and compiled graph; at most 8, one per
      * exact address and port. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartnftables",
-  "version": "4.3.1",
+  "version": "4.5.0",
   "private": false,
   "description": "A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.",
   "main": "dist_ts/index.js",
@@ -9,11 +9,11 @@
   "author": "Task Venture Capital GmbH",
   "license": "MIT",
   "devDependencies": {
-    "@git.zone/cli": "^8.4.0",
+    "@git.zone/cli": "^8.8.2",
     "@git.zone/tsbuild": "^5.1.2",
     "@git.zone/tsrun": "^3.0.2",
-    "@git.zone/tsrust": "3.0.0",
-    "@git.zone/tstest": "^7.0.0",
+    "@git.zone/tsrust": "4.0.0",
+    "@git.zone/tstest": "^7.1.0",
     "@types/node": "^26.6.3",
     "typescript": "^7.0.2"
   },

package/readme.md

@@ -324,7 +324,7 @@ allocation-pool guard policy kinds.
 | --- | --- |
 | `routerEgress` | Private `endpoints` and `rules`, one exact `links` binding per endpoint, a separate veth `handoff`, `protection`, and active `generations`. Private veth/TUN/local DNS and egress share one table so terminal private denial cannot override a separate egress table. Optional `publishedPorts` add the inbound second hop from the handoff to a workload endpoint, one port or a port range; both directions are classified into the default conntrack zone ahead of every leased classifier, so a published endpoint port is dedicated to its publication and never becomes leased egress. A `symmetric` publication also lets the workload open flows from its published ports. Optional `hostGrants` forward exact host-origin flows from the handoff to a workload endpoint. Optional `workloadGrants` let one workload open one exact port of another, one way. |
 | `hostTransit` | Exact handoff `link`/`allocations` pairs, complete `protection`, an explicit veth or Ethernet `uplink`, and its current `snatAddress`. It checks each handoff's leased source address and protocol/port range, default conntrack zone, direction, uplink, and protected destinations before outer SNAT. Optional `publishedPorts` add inbound uplink destination NAT inside the same generation, one port or a port range, and a `symmetric` publication also carries the workload's own flows from its published ports out through the uplink. Optional `hostGrants` let the host's own address on a handoff dial exact workload ports. Optional `localPlatformEndpoints` serve platform endpoints on the host's own addresses to leased flows. Optional `exclusiveForwarding` makes the table the host's only forwarding owner: every other forwarded packet drops. |
-| `allocationPoolGuard` | An authenticated `authorityDigest` and complete current allocation-pool `prefixes`. Installs host-wide IPv4 destination denial before any handoff exists, without link, uplink or SNAT dependencies. Optional `hostGrants` are its only exceptions. Optional `localTcpPortOwners` restrict loopback TCP ports to one local user each. |
+| `allocationPoolGuard` | An authenticated `authorityDigest` and complete current allocation-pool `prefixes`. Installs host-wide IPv4 destination denial before any handoff exists, without link, uplink or SNAT dependencies. Optional `hostGrants` and `publishedPorts` are its only exceptions. Optional `localTcpPortOwners` restrict loopback TCP ports to one local user each. |
 
 `allocationPoolGuard` accepts 1–64 canonical, disjoint RFC1918 prefixes. Supply
 the actual allocation pools, not the broader protected union containing management
@@ -742,6 +742,42 @@ These flows need no private `rules`. A private rule is stateless: answering thro
 private rules needs a reverse rule, which would also let the destination open toward
 the source.
 
+#### Publications through the allocation-pool guard
+
+A `hostTransit` publication translates an inbound flow from the uplink into the
+router's transit address, which lies in a guarded pool, so the guard denies it by
+its current destination and its replies by their current source.
+`allocationPoolGuard.publishedPorts` is optional and lists the publications the
+guard admits: each `{ protocol, hostPort, hostPortEnd?, targetPort, targetAddress }`
+names the published port or range, and the exact pool address and port it is
+translated to (a range keeps every port, so `targetPort` equals `hostPort`). The
+target must be a unicast address inside a listed pool; each protocol and port is
+published at most once; up to 1024 fit. Compile the same publications into the
+guard and into the host-transit scope that translates them, which binds the uplink
+address and the handoff link the guard does not check.
+
+```typescript
+const guard: IManagedNftPolicyV2 = { schemaVersion: 2, revision: 1, scope: {
+  kind: 'allocationPoolGuard', authorityDigest, prefixes: ['10.240.0.0/16', '10.241.0.0/16'],
+  publishedPorts: [{ protocol: 'tcp', hostPort: 443, targetPort: 443, targetAddress: '10.240.0.1' },
+    { protocol: 'udp', hostPort: 20000, hostPortEnd: 20200, targetPort: 20000, targetAddress: '10.240.0.1' }] } };
+```
+
+The admissions sit in the guard chain right after its denial of every pool as an
+original destination, so only a flow translated from outside every pool can match,
+and ahead of every current-address denial: an ESTABLISHED packet of either
+direction and a NEW opening per protocol (TCP only with SYN and FIN/RST/ACK clear),
+in the default conntrack zone, each one lookup of the protocol, the reply tuple's
+source address and port (where the flow was translated to, in both directions) and
+the originally tracked destination port in the CONSTANT interval set
+`pool_published`. Another target, target port, published port, protocol or zone, a
+non-SYN opening and an original destination inside a pool meet the guard unchanged.
+A publication is the exception of every hook it crosses; a forwarded publication
+crosses FORWARD alone. Absent and empty are the same canonical policy, digest and
+compiled bytes. The largest guard (64 pools, 1024 host grants, 8 loopback port
+owners and 1024 publications) compiles to 99,688 rule bytes and 74,640 element
+bytes at revision 1.
+
 #### Loopback TCP port owners
 
 `allocationPoolGuard.localTcpPortOwners` is optional and restricts a loopback TCP
@@ -1005,6 +1041,56 @@ and netdev hooks do not see routed packets and are not reported. Guard
 either Docker chain or any legacy table is present. The read is a point in time;
 the caller still owns exclusive authority over who may add a forward owner later.
 
+### Listing the managed tables with `nft`
+
+Every set the compiler declares carries the types `nft` needs to decode it: the
+key and data types, their byte orders and, for keys of up to four fields, the
+`typeof` expressions, byte for byte as nftables 1.0.9 writes them for the same
+`typeof` declaration (`nft add set ... '{ typeof meta iif . meta iifname; ... }'`).
+A lookup's loads must fit its set's declared key field by field, or compiling
+refuses with `INVALID`. Before 4.5.0 every set was declared with key type 0 and
+no userdata, so `nft list` aborted (`dtype != &invalid_type`) or crashed on any
+table that held one.
+
+What an operator can list today with nftables 1.0.9:
+
+- `nft list set|map inet <table> <set>` for every set. Keys of up to four fields
+  list as `typeof ...`; longer keys as `type ...`. nftables 1.0.9 cannot
+  describe a longer key by `typeof` (it stops at four fields, `NFT_REG32_SIZE`),
+  and its 32-bit type holds at most five fields, so the elements of a key of six
+  or more fields, or of five with a `ct zone`, print wrongly. The generation map
+  `leased_generation` lists as `type 0 : ct_label`: its key is the zone padded to
+  a register, as every release before typed sets declared it.
+- `nft list chain` for every chain whose rules test membership of keys of at most
+  six fields. A map lookup of a key of more than four fields lists, but nft may
+  render its data wrongly or drop the statement (seen for the leased flow maps
+  and `published_symmetric`).
+- `nft list ruleset`, `nft list table` and `nft list chain` crash (SIGSEGV) on any
+  rule that tests membership of a concatenation of seven or more fields. This is
+  an nftables defect, also on nftables master: `expr_postprocess_concat` walks
+  past the five fields the 32-bit type holds, for sets nft created itself just
+  as for these. Host grants (8 or 10 fields), workload grants (8), published
+  flows (8) and ported private rules (7) use such lookups, so on nodes that use
+  them `nft list ruleset` crashes until a fixed nftables is installed. List the
+  sets and the other chains individually meanwhile.
+
+The isolated qualification below proves each of these against the host's
+nftables 1.0.9 and pins the crash, so it fails once a fixed `nft` lands.
+
+#### Tables applied before 4.5.0
+
+A table applied by 4.4.x or earlier holds the same graph with untyped sets, and
+Linux enforces it identically: the kernel stores and dumps the key type and
+userdata but never interprets them. This release adopts such a graph, inspects,
+verifies and releases it as the applied graph, and never treats it as already
+applied: the next `reconcile()`, including a retry of the transition that
+applied it, replaces the whole graph with typed sets in the same single batch
+as any replacement, so enforcement never lapses. No migration step is needed.
+The transition is one-way per boot: 4.4.x refuses a table holding typed sets
+(`CONFLICT`), so a downgrade on the same boot cannot adopt it, while a reboot
+drops the table for either version. The acceptance of untyped sets is legacy
+support for kernel state left by 4.4.x and goes with the next major release.
+
 ### Native qualification
 
 The separate [Docker fixture](test/native/readme.docker.md) exercises the native
@@ -1016,7 +1102,8 @@ Its checked-in input manifest and per-run receipts identify the tested artifacts
 snapshot and bounded-subprocess tests. The ignored native cases require the explicitly marked disposable guest
 from `test/native/qualify.py`; requesting them on an ordinary host fails its scope
 check. Qualification uses an offline Linux 6.18.35 x86_64 guest with no host disks,
-mounts or external network backend. One VirtIO device connects only to a singleton
+mounts or external network backend; it carries the host's nftables 1.0.9 binary
+and libraries for the listing proof. One VirtIO device connects only to a singleton
 QEMU-internal hub; packet-path tests use guest-owned namespaces, veth pairs and TUN.
 It covers
 UDP/TCP grants, direct-IP denial, source spoofing, IPv6 denial, renamed interfaces,

package/rust/src/egress.compile.rs

@@ -21,6 +21,8 @@ mod router;
 #[path = "egress.workloadgrant.rs"]
 mod workloadgrant;
 
+use keys::Field;
+
 /// The atomic replacement budget. One replacement is one nfnetlink batch in one
 /// `sendmsg`, and Linux refuses a netlink message above the socket send buffer:
 /// `SO_SNDBUF` clamped to `net.core.wmem_max` and doubled, 425,984 bytes with the
@@ -54,6 +56,22 @@ pub(super) struct Program<'a> {
     bytes: usize,
     element_bytes: usize,
     operations: Vec<(u16, Vec<Attr>)>,
+    /// Each declared set's key and a map's data.
+    declared: std::collections::BTreeMap<String, Declared>,
+}
+/// One declared set: its key fields and a map's data fields.
+struct Declared {
+    key: Vec<Field>,
+    data: Option<Vec<Field>>,
+}
+/// A declared set as nft names it: its key's and a map's data's `typeof`
+/// expressions, and whether it is an interval set.
+#[cfg(test)]
+#[derive(Clone, Debug)]
+pub(crate) struct SetDeclaration {
+    pub(crate) key: Vec<&'static str>,
+    pub(crate) data: Option<Vec<&'static str>>,
+    pub(crate) interval: bool,
 }
 impl<'a> Program<'a> {
     fn push(&mut self, operation: u16, attributes: Vec<Attr>) -> Result<()> {
@@ -76,26 +94,59 @@ impl<'a> Program<'a> {
         self.element_bytes += wire::encode_attrs(&attributes).len() + 20;
         self.admit(12, attributes)
     }
-    /// One named exact-key hash set, or a map to `data_length` bytes. CONSTANT
-    /// like every set here.
+    /// The key's type and length and a map's data type and length, as nft
+    /// declares them, after which the userdata carries their byte orders and
+    /// `typeof` descriptions. Remembers the lengths every element must have.
+    fn typed(&mut self, name: &str, key: &[Field], data: Option<&[Field]>) -> Vec<Attr> {
+        let mut attributes = vec![
+            Attr::u32(4, keys::datatype(key)),
+            Attr::u32(5, keys::key_length(key)),
+        ];
+        if let Some(data) = data {
+            attributes.extend([
+                Attr::u32(6, keys::datatype(data)),
+                Attr::u32(7, keys::data_length(data)),
+            ]);
+        }
+        self.declared.insert(
+            name.to_string(),
+            Declared {
+                key: key.to_vec(),
+                data: data.map(<[Field]>::to_vec),
+            },
+        );
+        attributes
+    }
+    /// Whether an element's key and data have the lengths its set declares.
+    fn fits(&self, name: &str, key: &[u8], data: Option<&Vec<u8>>) -> Result<()> {
+        let declared = self.declared.get(name).ok_or(crate::Error::Invalid)?;
+        let length = |bytes: &[u8]| u32::try_from(bytes.len()).ok();
+        require(
+            length(key) == Some(keys::key_length(&declared.key))
+                && data.map(|data| length(data))
+                    == declared
+                        .data
+                        .as_deref()
+                        .map(|data| Some(keys::data_length(data))),
+        )
+    }
+    /// One named exact-key hash set, or a map to `data`. CONSTANT like every
+    /// set here.
     fn exact_set(
         &mut self,
         name: &str,
         id: u32,
-        key_length: u32,
-        data_length: Option<u32>,
+        key: &[Field],
+        data: Option<&[Field]>,
     ) -> Result<()> {
         let mut attributes = vec![
             Attr::string(1, self.table),
             Attr::string(2, name),
-            Attr::u32(3, 2 | if data_length.is_some() { 8 } else { 0 }),
-            Attr::u32(4, 0),
-            Attr::u32(5, key_length),
+            Attr::u32(3, 2 | if data.is_some() { 8 } else { 0 }),
         ];
-        if let Some(length) = data_length {
-            attributes.extend([Attr::u32(6, 0), Attr::u32(7, length)]);
-        }
+        attributes.extend(self.typed(name, key, data));
         attributes.push(Attr::u32(10, id));
+        attributes.push(Attr::bytes(13, keys::userdata(key, data)?));
         self.push(9, attributes)
     }
     fn exact_elements(
@@ -103,6 +154,9 @@ impl<'a> Program<'a> {
         name: &str,
         elements: Vec<(Vec<u8>, Option<Vec<u8>>)>,
     ) -> Result<()> {
+        for (key, data) in &elements {
+            self.fits(name, key, data.as_ref())?;
+        }
         for chunk in elements.chunks(256) {
             let list = chunk
                 .iter()
@@ -122,21 +176,6 @@ impl<'a> Program<'a> {
         }
         Ok(())
     }
-    /// One named exact-match set. CONSTANT: its elements cannot change once a
-    /// rule binds it, so replacement always creates a complete new set.
-    fn set(&mut self, name: &str, id: u32, key_length: usize) -> Result<()> {
-        self.push(
-            9,
-            vec![
-                Attr::string(1, self.table),
-                Attr::string(2, name),
-                Attr::u32(3, 2),
-                Attr::u32(4, 0),
-                Attr::u32(5, key_length as u32),
-                Attr::u32(10, id),
-            ],
-        )
-    }
     /// The elements of one set, 256 to a message so every nested attribute
     /// stays far below netlink's 16-bit attribute length. Elements have their
     /// own budget: a replacement deletes the previous set, and so its elements,
@@ -146,27 +185,21 @@ impl<'a> Program<'a> {
     }
     /// One named CONSTANT set of concatenated fields in which every field is an
     /// inclusive interval (the kernel's pipapo backend), optionally a map to
-    /// `data_length` bytes. `fields` are byte lengths; each occupies whole
-    /// 32-bit registers of the key.
+    /// `data`. Each field occupies whole 32-bit registers of the key.
     fn interval_set(
         &mut self,
         name: &str,
         id: u32,
-        fields: &[u32],
-        data_length: Option<u32>,
+        fields: &[Field],
+        data: Option<&[Field]>,
     ) -> Result<()> {
-        let key_length: u32 = fields.iter().map(|length| length.div_ceil(4) * 4).sum();
         let mut attributes = vec![
             Attr::string(1, self.table),
             Attr::string(2, name),
             // CONSTANT | INTERVAL | CONCAT, and MAP for a map.
-            Attr::u32(3, 2 | 4 | 0x80 | if data_length.is_some() { 8 } else { 0 }),
-            Attr::u32(4, 0),
-            Attr::u32(5, key_length),
+            Attr::u32(3, 2 | 4 | 0x80 | if data.is_some() { 8 } else { 0 }),
         ];
-        if let Some(length) = data_length {
-            attributes.extend([Attr::u32(6, 0), Attr::u32(7, length)]);
-        }
+        attributes.extend(self.typed(name, fields, data));
         attributes.extend([
             Attr::nested(
                 9,
@@ -174,11 +207,12 @@ impl<'a> Program<'a> {
                     2,
                     fields
                         .iter()
-                        .map(|length| Attr::nested(1, vec![Attr::u32(1, *length)]))
+                        .map(|field| Attr::nested(1, vec![Attr::u32(1, field.length)]))
                         .collect(),
                 )],
             ),
             Attr::u32(10, id),
+            Attr::bytes(13, keys::userdata(fields, data)?),
         ]);
         self.push(9, attributes)
     }
@@ -186,6 +220,10 @@ impl<'a> Program<'a> {
     /// An element whose bounds are equal carries no last key; Linux takes the
     /// first as the last and dumps it the same way.
     fn interval_elements(&mut self, name: &str, elements: Vec<IntervalElement>) -> Result<()> {
+        for element in &elements {
+            self.fits(name, &element.first, element.data.as_ref())?;
+            self.fits(name, &element.last, element.data.as_ref())?;
+        }
         for chunk in elements.chunks(256) {
             let list = chunk
                 .iter()
@@ -421,6 +459,34 @@ fn snat(address: &str, range: Option<(u16, u16)>) -> Result<Vec<Attr>> {
     Ok(result)
 }
 pub(super) fn compile(prepared: &Prepared, table: &str) -> Result<Vec<(u16, Vec<Attr>)>> {
+    Ok(compiled(prepared, table)?.operations)
+}
+/// Every set the compiled graph declares, by name.
+#[cfg(test)]
+pub(super) fn declared(
+    prepared: &Prepared,
+    table: &str,
+) -> Result<std::collections::BTreeMap<String, SetDeclaration>> {
+    let program = compiled(prepared, table)?;
+    let names = |fields: &[Field]| fields.iter().map(|field| field.name).collect();
+    let mut result = std::collections::BTreeMap::new();
+    for (kind, attributes) in &program.operations {
+        if *kind == 9 {
+            let name = wire::text(attributes, 2)?;
+            let declared = program.declared.get(&name).ok_or(crate::Error::Invalid)?;
+            result.insert(
+                name,
+                SetDeclaration {
+                    key: names(&declared.key),
+                    data: declared.data.as_deref().map(names),
+                    interval: wire::number(attributes, 3)? & 4 != 0,
+                },
+            );
+        }
+    }
+    Ok(result)
+}
+fn compiled<'a>(prepared: &Prepared, table: &'a str) -> Result<Program<'a>> {
     let mut program = Program {
         table,
         stamp: format!("snft2:{}:{}", prepared.policy.revision, prepared.digest),
@@ -428,11 +494,12 @@ pub(super) fn compile(prepared: &Prepared, table: &str) -> Result<Vec<(u16, Vec<
         bytes: 0,
         element_bytes: 0,
         operations: Vec::new(),
+        declared: std::collections::BTreeMap::new(),
     };
     match &prepared.policy.scope {
         Scope::RouterEgress(scope) => router::compile(&mut program, scope)?,
         Scope::HostTransit(scope) => host::compile(&mut program, scope)?,
         Scope::AllocationPoolGuard(scope) => poolguard::compile(&mut program, scope)?,
     }
-    Ok(program.operations)
+    Ok(program)
 }