@push.rocks/smartnftables 4.3.1 → 4.5.0

package/rust/src/egress.published.rs

@@ -6,8 +6,12 @@
 //! protocols, the live address and port, and the originally tracked address and
 //! port. A port field is an inclusive interval, so one element holds one port or
 //! a whole range, and every other field is exact.
-use super::hostgrant::{meta_to, register};
-use super::keys::{self, word, Key, Loads, ADDRESS, INDEX, NAME, PORT, PROTOCOL};
+use super::hostgrant::register;
+use super::keys::{
+    self, word, Field, Key, Loads, CT_ORIGINAL_DADDR, CT_ORIGINAL_DPORT, CT_ORIGINAL_SADDR,
+    CT_ORIGINAL_SPORT, CT_PROTOCOL, IIF, IIFNAME, IP_DADDR, IP_SADDR, L4PROTO, OIF, OIFNAME,
+    TH_DPORT, TH_SPORT,
+};
 use super::*;
 
 /// Router handoff arrivals of a publication, classified before conntrack.
@@ -24,7 +28,39 @@ pub(super) const FORWARD: &str = "published_forward";
 /// the data is the source NAT to the outside address and port span.
 pub(super) const SYMMETRIC: &str = "published_symmetric";
 
-const LINK: [u32; 2] = [INDEX, NAME];
+const ARRIVAL_KEY: [Field; 3] = [L4PROTO, IP_DADDR, TH_DPORT];
+const ENDPOINT_KEY: [Field; 5] = [IIF, IIFNAME, L4PROTO, IP_SADDR, TH_SPORT];
+/// The translation maps' key, and their data: the inside address and port, or
+/// the inside address alone.
+const TRANSLATION_KEY: [Field; 4] = [L4PROTO, CT_PROTOCOL, IP_DADDR, TH_DPORT];
+const PORT_DATA: [Field; 2] = [IP_DADDR, TH_DPORT];
+const ADDRESS_DATA: [Field; 1] = [IP_DADDR];
+/// `[link, protocols, address, port, original address, original port]`, the key
+/// of both admission sets, as their original direction loads it: inbound
+/// toward the inside link and destination, symmetric from them.
+const INBOUND_KEY: [Field; 8] = [
+    OIF,
+    OIFNAME,
+    L4PROTO,
+    CT_PROTOCOL,
+    IP_DADDR,
+    TH_DPORT,
+    CT_ORIGINAL_DADDR,
+    CT_ORIGINAL_DPORT,
+];
+const SYMMETRIC_KEY: [Field; 8] = [
+    IIF,
+    IIFNAME,
+    L4PROTO,
+    CT_PROTOCOL,
+    IP_SADDR,
+    TH_SPORT,
+    CT_ORIGINAL_SADDR,
+    CT_ORIGINAL_SPORT,
+];
+/// The source NAT a symmetric flow stores: the outside address and the first
+/// and last port of its span.
+const SYMMETRIC_DATA: [Field; 3] = [IP_SADDR, TH_SPORT, TH_SPORT];
 
 /// One publication on one hop. The outside is what clients reach (the uplink
 /// address and port on the host, the transit address and port in the router);
@@ -44,13 +80,6 @@ pub(super) struct Hop<'a> {
     pub(super) fixed: &'a LocalLink,
 }
 
-/// `[link, protocols, address, port, original address, original port]`, the key
-/// of both admission sets.
-fn flow_fields() -> Vec<u32> {
-    let mut fields = LINK.to_vec();
-    fields.extend([PROTOCOL, PROTOCOL, ADDRESS, PORT, ADDRESS, PORT]);
-    fields
-}
 fn inbound_key(publication: &Publication<'_>) -> Result<IntervalElement> {
     let (outside, outside_first, outside_last) = publication.outside;
     let (inside, inside_first, inside_last) = publication.inside;
@@ -108,9 +137,6 @@ fn translation_loads() -> Loads {
     loads.protocols().address(false).port(false);
     loads
 }
-fn translation_fields() -> [u32; 4] {
-    [PROTOCOL, PROTOCOL, ADDRESS, PORT]
-}
 fn ranged(publication: &Publication<'_>) -> bool {
     publication.outside.1 != publication.outside.2
 }
@@ -133,14 +159,7 @@ pub(super) fn sets(program: &mut Program<'_>, hop: &Hop<'_>, router: bool) -> Re
                     .element(None),
             );
         }
-        declare(
-            program,
-            ARRIVAL,
-            16,
-            &[PROTOCOL, ADDRESS, PORT],
-            None,
-            arrivals,
-        )?;
+        declare(program, ARRIVAL, 16, &ARRIVAL_KEY, None, arrivals)?;
         // Several publications may share inside ports that are not symmetric;
         // the classification is their union, as disjoint intervals.
         let mut endpoints = Vec::new();
@@ -155,9 +174,7 @@ pub(super) fn sets(program: &mut Program<'_>, hop: &Hop<'_>, router: bool) -> Re
                     .element(None),
             );
         }
-        let mut fields = LINK.to_vec();
-        fields.extend([PROTOCOL, ADDRESS, PORT]);
-        declare(program, ENDPOINT, 17, &fields, None, endpoints)?;
+        declare(program, ENDPOINT, 17, &ENDPOINT_KEY, None, endpoints)?;
     }
     let (mut ports, mut addresses) = (Vec::new(), Vec::new());
     for publication in &hop.publications {
@@ -175,13 +192,20 @@ pub(super) fn sets(program: &mut Program<'_>, hop: &Hop<'_>, router: bool) -> Re
             ports.push(key.element(Some(data)));
         }
     }
-    declare(program, PORT_MAP, 18, &translation_fields(), Some(8), ports)?;
+    declare(
+        program,
+        PORT_MAP,
+        18,
+        &TRANSLATION_KEY,
+        Some(&PORT_DATA),
+        ports,
+    )?;
     declare(
         program,
         ADDRESS_MAP,
         19,
-        &translation_fields(),
-        Some(4),
+        &TRANSLATION_KEY,
+        Some(&ADDRESS_DATA),
         addresses,
     )?;
     let inbound = hop
@@ -189,21 +213,28 @@ pub(super) fn sets(program: &mut Program<'_>, hop: &Hop<'_>, router: bool) -> Re
         .iter()
         .map(inbound_key)
         .collect::<Result<Vec<_>>>()?;
-    declare(program, FORWARD, 20, &flow_fields(), None, inbound)?;
+    declare(program, FORWARD, 20, &INBOUND_KEY, None, inbound)?;
     let symmetric = hop
         .publications
         .iter()
         .filter(|publication| publication.symmetric)
         .map(symmetric_key)
         .collect::<Result<Vec<_>>>()?;
-    declare(program, SYMMETRIC, 21, &flow_fields(), Some(12), symmetric)
+    declare(
+        program,
+        SYMMETRIC,
+        21,
+        &SYMMETRIC_KEY,
+        Some(&SYMMETRIC_DATA),
+        symmetric,
+    )
 }
 fn declare(
     program: &mut Program<'_>,
     name: &str,
     id: u32,
-    fields: &[u32],
-    data: Option<u32>,
+    fields: &[Field],
+    data: Option<&[Field]>,
     elements: Vec<IntervalElement>,
 ) -> Result<()> {
     keys::interval(program, name, id, fields, data, elements).map(|_| ())
@@ -217,6 +248,7 @@ fn admissions(
     program: &mut Program<'_>,
     hop: &Hop<'_>,
     set: &str,
+    key: &[Field],
     protocols: &BTreeSet<&str>,
     fixed_incoming: bool,
     loads: fn(bool) -> Loads,
@@ -233,7 +265,7 @@ fn admissions(
         result
     };
     let mut established = envelope(false, 2);
-    established.extend(loads(false).lookup(set));
+    established.extend(loads(false).lookup(set, key)?);
     program.end("forward", established, 1)?;
     for transport in protocols {
         let mut opening = envelope(false, 8);
@@ -241,11 +273,11 @@ fn admissions(
         if *transport == "tcp" {
             opening.extend(opening_tcp());
         }
-        opening.extend(loads(false).lookup(set));
+        opening.extend(loads(false).lookup(set, key)?);
         program.end("forward", opening, 1)?;
     }
     let mut reply = envelope(true, 2);
-    reply.extend(loads(true).lookup(set));
+    reply.extend(loads(true).lookup(set, key)?);
     program.end("forward", reply, 1)
 }
 fn protocols<'a>(hop: &Hop<'a>, symmetric: bool) -> BTreeSet<&'a str> {
@@ -262,6 +294,7 @@ pub(super) fn inbound(program: &mut Program<'_>, hop: &Hop<'_>) -> Result<()> {
         program,
         hop,
         FORWARD,
+        &INBOUND_KEY,
         &protocols(hop, false),
         true,
         inbound_loads,
@@ -275,6 +308,7 @@ pub(super) fn symmetric(program: &mut Program<'_>, hop: &Hop<'_>) -> Result<()>
         program,
         hop,
         SYMMETRIC,
+        &SYMMETRIC_KEY,
         &protocols(hop, true),
         false,
         symmetric_loads,
@@ -317,7 +351,7 @@ pub(super) fn translations(program: &mut Program<'_>, hop: &Hop<'_>) -> Result<(
     ] {
         if present {
             let mut expressions = tracked(hop.fixed, true);
-            expressions.extend(translation_loads().map(set));
+            expressions.extend(translation_loads().map(set, &TRANSLATION_KEY)?);
             expressions.push(nat(1, ports));
             program.rule("pre", expressions)?;
         }
@@ -329,7 +363,7 @@ pub(super) fn translations(program: &mut Program<'_>, hop: &Hop<'_>) -> Result<(
 pub(super) fn symmetric_translation(program: &mut Program<'_>, hop: &Hop<'_>) -> Result<()> {
     if hop.publications.iter().any(|item| item.symmetric) {
         let mut expressions = tracked(hop.fixed, false);
-        expressions.extend(symmetric_loads(false).map(SYMMETRIC));
+        expressions.extend(symmetric_loads(false).map(SYMMETRIC, &SYMMETRIC_KEY)?);
         expressions.push(nat(0, 2));
         program.rule("post", expressions)?;
     }
@@ -343,11 +377,8 @@ pub(super) fn arrival(program: &mut Program<'_>, hop: &Hop<'_>) -> Result<()> {
         let mut expressions = ipv4();
         expressions.extend(link(hop.fixed, true));
         let mut loads = Loads::new();
-        loads
-            .push(|index| meta_to(16, index), PROTOCOL)
-            .address(false)
-            .port(false);
-        expressions.extend(loads.lookup(ARRIVAL));
+        loads.protocol().address(false).port(false);
+        expressions.extend(loads.lookup(ARRIVAL, &ARRIVAL_KEY)?);
         program.end("raw_return", expressions, 1)?;
     }
     Ok(())
@@ -358,12 +389,8 @@ pub(super) fn endpoint(program: &mut Program<'_>, hop: &Hop<'_>) -> Result<()> {
     if !hop.publications.is_empty() {
         let mut expressions = ipv4();
         let mut loads = Loads::new();
-        loads
-            .link(true)
-            .push(|index| meta_to(16, index), PROTOCOL)
-            .address(true)
-            .port(true);
-        expressions.extend(loads.lookup(ENDPOINT));
+        loads.link(true).protocol().address(true).port(true);
+        expressions.extend(loads.lookup(ENDPOINT, &ENDPOINT_KEY)?);
         program.end("raw_in", expressions, 1)?;
     }
     Ok(())

package/rust/src/egress.router.rs

@@ -57,7 +57,7 @@ fn host_grant_return(program: &mut Program<'_>, scope: &RouterScope) -> Result<(
     if !scope.host_grants.is_empty() {
         let mut expressions = ipv4();
         expressions.extend(link(&scope.handoff, true));
-        expressions.extend(hostgrant::arrival_lookup());
+        expressions.extend(hostgrant::arrival_lookup()?);
         program.end("raw_return", expressions, 1)?;
     }
     Ok(())

package/rust/src/egress.rs

@@ -282,15 +282,43 @@ pub struct LocalTcpPortOwner {
     pub port: u16,
     pub uid: u32,
 }
+/// One publication a guard admits into a pool: a forwarded flow whose original
+/// destination lies outside every guarded pool, on the published port or range,
+/// translated to exactly `target_address` and the target port(s), and its replies.
+/// A range keeps every port: `target_port` equals `host_port`. Absent for one port.
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq, PartialOrd, Ord)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct PoolGuardPublishedPort {
+    pub protocol: String,
+    pub host_port: u16,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub host_port_end: Option<u16>,
+    pub target_port: u16,
+    pub target_address: String,
+}
+impl PoolGuardPublishedPort {
+    /// Last published port; equal to `host_port` for one port.
+    pub fn host_last(&self) -> u16 {
+        self.host_port_end.unwrap_or(self.host_port)
+    }
+    /// Last target port the publication translates to.
+    pub fn target_last(&self) -> u16 {
+        self.target_port + (self.host_last() - self.host_port)
+    }
+}
 #[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct AllocationPoolGuardScope {
     pub authority_digest: String,
     pub prefixes: Vec<String>,
-    /// The only exceptions to the guard: exact host-origin flows into a pool.
+    /// Exceptions to the guard: exact host-origin flows into a pool.
     /// Absent and empty are the same canonical policy.
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub host_grants: Vec<HostGrant>,
+    /// Exceptions to the guard: forwarded publications translated into a pool,
+    /// and their replies. Absent and empty are the same canonical policy.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub published_ports: Vec<PoolGuardPublishedPort>,
     /// Host-wide loopback port ownership. Absent and empty are the same
     /// canonical policy.
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
@@ -974,8 +1002,33 @@ fn normalize_pool_guard(value: &mut AllocationPoolGuardScope) -> Result<()> {
         require(covers_address(&value.prefixes, &grant.destination_address)?)
     })?;
     value.host_grants = grants;
+    normalize_pool_guard_published(value)?;
     normalize_local_tcp_port_owners(&mut value.local_tcp_port_owners)
 }
+/// A guard publication translates into exactly one address of a guarded pool,
+/// keeping a range's ports, and publishes each protocol and port at most once,
+/// as a host-transit scope does: sorted by protocol and first port, disjoint
+/// neighbours are disjoint spans.
+fn normalize_pool_guard_published(value: &mut AllocationPoolGuardScope) -> Result<()> {
+    let mut ports = std::mem::take(&mut value.published_ports);
+    crate::capacity("publishedPorts", PUBLISHED_PORTS, ports.len())?;
+    ports.sort();
+    for (index, port) in ports.iter().enumerate() {
+        require(
+            protocol(&port.protocol)
+                && port.host_port > 0
+                && port.target_port > 0
+                && published_span(port.host_port, port.host_port_end, port.target_port)
+                && (index == 0
+                    || ports[index - 1].protocol != port.protocol
+                    || ports[index - 1].host_last() < port.host_port),
+        )?;
+        unicast(&port.target_address)?;
+        require(covers_address(&value.prefixes, &port.target_address)?)?;
+    }
+    value.published_ports = ports;
+    Ok(())
+}
 /// One exact IPv4 loopback host address and port per entry, never a prefix,
 /// wildcard or range, each with exactly one owning uid. `(uid_t)-1` is not a
 /// user; it is the kernel's "unchanged" sentinel.
@@ -1242,6 +1295,9 @@ pub(crate) mod localplatform_tests;
 #[path = "egress_localport_tests.rs"]
 pub(crate) mod localport_tests;
 #[cfg(test)]
+#[path = "egress_poolguardpublished_tests.rs"]
+mod poolguardpublished_tests;
+#[cfg(test)]
 #[path = "egress_publishedrange_tests.rs"]
 mod publishedrange_tests;
 #[cfg(test)]
@@ -1288,6 +1344,14 @@ impl Prepared {
     pub fn program(&self, table: &str) -> Result<Vec<(u16, Vec<crate::wire::Attr>)>> {
         compile::compile(self, table)
     }
+    /// Every set the compiled graph declares, with its key and data fields.
+    #[cfg(test)]
+    pub(crate) fn declared(
+        &self,
+        table: &str,
+    ) -> Result<std::collections::BTreeMap<String, compile::SetDeclaration>> {
+        compile::declared(self, table)
+    }
     pub fn validate_interfaces(&self) -> Result<()> {
         let links: Vec<&LocalLink> = match &self.policy.scope {
             Scope::RouterEgress(scope) => scope

package/rust/src/egress.workloadgrant.rs

@@ -6,7 +6,8 @@
 //! exact link that holds it (index and name), and both the incoming and the
 //! outgoing link are looked up on every packet. Only the grant's source opens;
 //! the destination only answers.
-use super::hostgrant::{lookup, meta_to, payload_to, tuple_key, tuple_lookup};
+use super::hostgrant::{tuple_key, tuple_lookup, TUPLE};
+use super::keys::{Field, Loads, IIF, IIFNAME, IP_SADDR};
 use super::*;
 use std::collections::BTreeSet;
 
@@ -14,16 +15,16 @@ use std::collections::BTreeSet;
 pub(super) const TUPLE_SET: &str = "workload_grant";
 /// Every grant address with the exact link that holds it.
 pub(super) const LINK_SET: &str = "workload_link";
+/// A grant address and its link, as the incoming direction loads them.
+const LINK: [Field; 3] = [IIF, IIFNAME, IP_SADDR];
 
 /// The link a packet crosses and the address on its side of that link: the
 /// incoming link and the source, or the outgoing link and the destination.
-fn link_lookup(incoming: bool) -> Vec<Attr> {
-    vec![
-        meta_to(if incoming { 4 } else { 5 }, 4),
-        meta_to(if incoming { 6 } else { 7 }, 5),
-        payload_to(1, if incoming { 12 } else { 16 }, 4, 9),
-        lookup(LINK_SET),
-    ]
+fn link_lookup(incoming: bool) -> Result<Vec<Attr>> {
+    Loads::new()
+        .link(incoming)
+        .address(incoming)
+        .lookup(LINK_SET, &LINK)
 }
 fn link_key(link: &LocalLink, address: &str) -> Result<Vec<u8>> {
     let mut key = link.interface_index.to_ne_bytes().to_vec();
@@ -49,9 +50,9 @@ pub(super) fn sets(program: &mut Program<'_>, scope: &RouterScope) -> Result<()>
             )?);
         }
     }
-    program.set(TUPLE_SET, 3, 32)?;
+    program.exact_set(TUPLE_SET, 3, &TUPLE, None)?;
     program.elements(TUPLE_SET, keys)?;
-    program.set(LINK_SET, 4, 24)?;
+    program.exact_set(LINK_SET, 4, &LINK, None)?;
     program.elements(LINK_SET, links.into_iter().collect())
 }
 
@@ -64,25 +65,26 @@ pub(super) fn admissions(program: &mut Program<'_>, scope: &RouterScope) -> Resu
     if scope.workload_grants.is_empty() {
         return Ok(());
     }
-    let admission = |reply: bool, connection_state: u32, transport: Option<&str>| {
-        let mut result = ipv4();
-        result.extend(ct(17, None, 0_u16.to_ne_bytes().to_vec()));
-        result.extend(ct(1, None, vec![u8::from(reply)]));
-        result.extend(state(connection_state));
-        if let Some(transport) = transport {
-            result.extend(meta(16, vec![protocol(transport)]));
-            if transport == "tcp" {
-                result.extend(opening_tcp());
+    let admission =
+        |reply: bool, connection_state: u32, transport: Option<&str>| -> Result<Vec<Attr>> {
+            let mut result = ipv4();
+            result.extend(ct(17, None, 0_u16.to_ne_bytes().to_vec()));
+            result.extend(ct(1, None, vec![u8::from(reply)]));
+            result.extend(state(connection_state));
+            if let Some(transport) = transport {
+                result.extend(meta(16, vec![protocol(transport)]));
+                if transport == "tcp" {
+                    result.extend(opening_tcp());
+                }
             }
-        }
-        result.extend(link_lookup(true));
-        result.extend(link_lookup(false));
-        result.extend(tuple_lookup(TUPLE_SET, false, reply));
-        result
-    };
-    program.end("forward", admission(false, 2, None), 1)?;
+            result.extend(link_lookup(true)?);
+            result.extend(link_lookup(false)?);
+            result.extend(tuple_lookup(TUPLE_SET, false, reply)?);
+            Ok(result)
+        };
+    program.end("forward", admission(false, 2, None)?, 1)?;
     for transport in ["udp", "tcp"] {
-        program.end("forward", admission(false, 8, Some(transport)), 1)?;
+        program.end("forward", admission(false, 8, Some(transport))?, 1)?;
     }
-    program.end("forward", admission(true, 2, None), 1)
+    program.end("forward", admission(true, 2, None)?, 1)
 }

package/rust/src/egress_hostgrant_tests.rs

@@ -357,6 +357,18 @@ fn load(flow: &Flow, name: &str, fields: &[Attr]) -> Option<Vec<u8>> {
             assert_eq!(loaded.len() as u32, wire::number(fields, 4).unwrap());
             loaded
         }
+        "ct" if wire::one(fields, 3).is_ok_and(|direction| direction.value == vec![1]) => {
+            // The reply tuple's source is where the flow was translated to: the
+            // live destination of the original direction, the live source of the
+            // reply, as a filter hook after destination NAT sees them.
+            match wire::number(fields, 2).unwrap() {
+                19 if flow.reply => flow.source.to_vec(),
+                19 => flow.destination.to_vec(),
+                11 if flow.reply => flow.source_port.to_be_bytes().to_vec(),
+                11 => flow.destination_port.to_be_bytes().to_vec(),
+                key => panic!("ct reply {key}"),
+            }
+        }
         "ct" => {
             if let Ok(direction) = wire::one(fields, 3) {
                 assert_eq!(direction.value, vec![0]);

package/rust/src/egress_keys_tests.rs

@@ -0,0 +1,150 @@
+//! Set declarations against what nftables 1.0.9 itself writes. Each expected
+//! value was dumped from `nft --debug=mnl add set|map ...` with the host nft
+//! 1.0.9 (libnftnl 1.2.6) on x86_64; userdata numbers are host byte order.
+use super::*;
+
+fn hex(text: &str) -> Vec<u8> {
+    let digits: String = text.split_whitespace().collect();
+    (0..digits.len())
+        .step_by(2)
+        .map(|at| u8::from_str_radix(&digits[at..at + 2], 16).unwrap())
+        .collect()
+}
+
+/// `typeof ip saddr . th dport . ct original ip saddr . ct zone`
+#[test]
+#[cfg(target_endian = "little")]
+fn concatenated_key_types_and_userdata_are_nfts() {
+    let key = [IP_SADDR, TH_DPORT, CT_ORIGINAL_SADDR, CT_ZONE];
+    assert_eq!(datatype(&key), 0x001c_d1c4);
+    assert_eq!(key_length(&key), 16);
+    assert_eq!(
+        userdata(&key, None).unwrap(),
+        hex("00 04 00000000 03 60 00 04 0d000000 01 58
+             00 14 00 04 07000000 01 0c 00 04 0c000000 01 04 0b000000
+             01 14 00 04 07000000 01 0c 00 04 0b000000 01 04 02000000
+             02 14 00 04 0c000000 01 0c 00 04 13000000 01 04 00000000
+             03 14 00 04 0c000000 01 0c 00 04 11000000 01 04 ffffffff")
+    );
+    // `typeof meta oif . meta oifname . ct reply ip saddr . ct reply proto-src`
+    let key = [OIF, OIFNAME, CT_REPLY_SADDR, CT_REPLY_SPORT];
+    assert_eq!(datatype(&key), 0x0052_91cd);
+    assert_eq!(key_length(&key), 28);
+    assert_eq!(
+        userdata(&key, None).unwrap(),
+        hex("00 04 00000000 03 54 00 04 0d000000 01 4c
+             00 0e 00 04 09000000 01 06 00 04 05000000
+             01 0e 00 04 09000000 01 06 00 04 07000000
+             02 14 00 04 0c000000 01 0c 00 04 13000000 01 04 01000000
+             03 14 00 04 0c000000 01 0c 00 04 0b000000 01 04 01000000")
+    );
+}
+
+/// `typeof meta l4proto . ct protocol . ip daddr : ip saddr . th sport . th dport`
+/// and `typeof ct zone : ct label`.
+#[test]
+#[cfg(target_endian = "little")]
+fn map_data_types_and_userdata_are_nfts() {
+    let key = [L4PROTO, CT_PROTOCOL, IP_DADDR];
+    let data = [IP_SADDR, TH_SPORT, TH_DPORT];
+    assert_eq!(datatype(&key), 0xc307);
+    assert_eq!(datatype(&data), 0x734d);
+    assert_eq!((key_length(&key), data_length(&data)), (12, 12));
+    assert_eq!(
+        userdata(&key, Some(&data)).unwrap(),
+        hex("00 04 00000000 01 04 00000000
+             03 44 00 04 0d000000 01 3c
+             00 0e 00 04 09000000 01 06 00 04 10000000
+             01 14 00 04 0c000000 01 0c 00 04 0a000000 01 04 ffffffff
+             02 14 00 04 07000000 01 0c 00 04 0c000000 01 04 0c000000
+             04 4a 00 04 0d000000 01 42
+             00 14 00 04 07000000 01 0c 00 04 0c000000 01 04 0b000000
+             01 14 00 04 07000000 01 0c 00 04 0b000000 01 04 01000000
+             02 14 00 04 07000000 01 0c 00 04 0b000000 01 04 02000000
+             06 04 00000000")
+    );
+    let (key, data) = ([CT_ZONE], [CT_LABEL]);
+    assert_eq!((datatype(&key), datatype(&data)), (4, 30));
+    assert_eq!(data_length(&data), 16);
+    assert_eq!(
+        userdata(&key, Some(&data)).unwrap(),
+        hex("00 04 01000000 01 04 01000000
+             03 14 00 04 0c000000 01 0c 00 04 11000000 01 04 ffffffff
+             04 14 00 04 0c000000 01 0c 00 04 0d000000 01 04 ffffffff
+             06 04 00000000")
+    );
+    // nft declares the zone alone as its 2 bytes; this map keeps the zone
+    // padded to its register, as every release before typed sets did.
+    assert_eq!(key_length(&key), 4);
+}
+
+/// Beyond four fields nft 1.0.9 cannot describe a key by `typeof`: its
+/// concatenation userdata stops at `NFT_REG32_SIZE` (4) entries, and the type
+/// keeps 32 bits, six per field, dropping what a longer key shifts out.
+#[test]
+fn longer_keys_carry_their_type_and_byte_order_alone() {
+    let key = [IIF, L4PROTO, IP_SADDR, IP_DADDR, TH_DPORT];
+    assert_eq!(
+        datatype(&key),
+        (20 << 24) | (12 << 18) | (7 << 12) | (7 << 6) | 13
+    );
+    assert_eq!(userdata(&key, None).unwrap(), hex("00 04 00000000"));
+    let flow = [
+        IIF,
+        L4PROTO,
+        CT_PROTOCOL,
+        IP_SADDR,
+        IP_DADDR,
+        TH_DPORT,
+        CT_ORIGINAL_SADDR,
+        CT_ORIGINAL_DADDR,
+        CT_ORIGINAL_DPORT,
+        CT_ZONE,
+    ];
+    let truncated = flow.iter().fold(0_u64, |result, field| {
+        (result << 6) | u64::from(field.datatype)
+    });
+    assert_eq!(u64::from(datatype(&flow)), truncated & u64::from(u32::MAX));
+    let data = [IP_SADDR, TH_SPORT, TH_SPORT];
+    let mut expected = hex("00 04 00000000 01 04 00000000");
+    expected.extend(hex("04 4a 00 04 0d000000 01 42
+         00 14 00 04 07000000 01 0c 00 04 0c000000 01 04 0b000000
+         01 14 00 04 07000000 01 0c 00 04 0b000000 01 04 01000000
+         02 14 00 04 07000000 01 0c 00 04 0b000000 01 04 01000000
+         06 04 00000000"));
+    #[cfg(target_endian = "little")]
+    assert_eq!(userdata(&flow, Some(&data)).unwrap(), expected);
+}
+
+/// A lookup loads every field of the set's key, by length and type; the other
+/// direction's field of the same kind fits, anything else refuses.
+#[test]
+fn lookups_must_fit_the_declared_key() {
+    let declared = [IIF, IIFNAME, IP_SADDR];
+    assert!(Loads::new()
+        .link(true)
+        .address(true)
+        .lookup("s", &declared)
+        .is_ok());
+    assert!(Loads::new()
+        .link(false)
+        .address(false)
+        .lookup("s", &declared)
+        .is_ok());
+    assert_eq!(
+        Loads::new().link(true).port(true).lookup("s", &declared),
+        Err(Error::Invalid)
+    );
+    assert_eq!(
+        Loads::new().link(true).lookup("s", &declared),
+        Err(Error::Invalid)
+    );
+    assert_eq!(
+        Loads::new()
+            .index(true)
+            .address(true)
+            .address(true)
+            .lookup("s", &declared),
+        Err(Error::Invalid)
+    );
+}