@push.rocks/smartnftables 4.4.0 → 4.5.0

package/changelog.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 2026-10-06 - 4.5.0
+
+### Features
+
+- Typed sets: `nft` decodes every managed set and lists the rules that look them up, up to nftables' own limit below (Pallet lab RUN 9, O9-1). Every set was declared with key type 0, data type 0 and no userdata, so nftables 1.0.9 aborted listing any rule that looked one up (`netlink_delinearize.c`: `dtype != &invalid_type`) and segfaulted listing the sets themselves. Each key field now has one descriptor (length, nft type, byte order, `typeof` expression) from which both the rule's loads and the set declaration derive, and a lookup whose loads do not fit its set's key refuses to compile (`INVALID`). Sets carry their key and data types and nft's userdata (byte orders, `typeof` key and data, data interval) byte for byte as nftables 1.0.9 writes them for the same `typeof` declaration; keys beyond four fields carry their type and byte order alone, as nft cannot describe them by `typeof`. Policy digests are unchanged; compiled bytes change for every graph with sets, and stripping the types again reproduces the 4.4.0 goldens byte for byte. nftables itself still crashes listing a rule that tests membership of seven or more concatenated fields (host grants, workload grants, published flows, ported private rules), also on nftables master; readme "Listing the managed tables with `nft`" states what lists today. Tests: nft-captured userdata bytes (`egress_keys_tests`), and in the isolated guest, now carrying the host's nftables 1.0.9, every declared set against the set nft creates from the same `typeof`, every set, chain and ruleset listed, the nft crash pinned, and the untyped control aborting.
+- Upgrading over a table applied by 4.4.x or earlier: its graph with untyped sets is adopted, inspected, verified (`verify_external`) and released as the applied graph, and `reconcile()` never treats it as already applied but replaces the whole graph with typed sets in its single batch, including a retry of the transition that applied it. This acceptance is legacy for kernel state left by 4.4.x and goes with the next major. The step is one-way per boot: 4.4.x refuses typed sets (`CONFLICT`). Tests: graph agreement (exact, untyped, mixed, retyped, changed element) and, in the isolated guest, adoption and replacement of a 4.4.x graph by a new and by the same transition (claim plus one batch), external verification and release.
+
 ## 2026-10-06 - 4.4.0
 
 ### Features

package/dist_rust/smartnftables_linux_amd64_musl.tsrust-build.json

@@ -1,12 +1,12 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "92ddb3d386ae7d83ce27c0df8b54bb08ce3bb54cba71e80df8e0c3e808e4da7b",
+  "binarySha256": "f30fb315a0059adfc4afe0728a8304fe14a5a45e2437cb4e76d5c79c7dbf8917",
   "buildInfo": {
     "projectName": "@push.rocks/smartnftables",
-    "projectVersion": "4.4.0",
-    "gitCommit": "77c4a57ed74dce10ee91ef180972ebd9cc821211",
+    "projectVersion": "4.5.0",
+    "gitCommit": "f648edff675c7693b2ec8bca6138bd7d1e2da65b",
     "gitDirty": false,
-    "builtAt": "2026-10-06T03:48:00.001Z",
+    "builtAt": "2026-10-06T05:09:47.306Z",
     "tsrustVersion": "4.0.0",
     "binary": "smartnftables",
     "target": "linux_amd64_musl"

package/dist_rust/smartnftables_linux_arm64_musl.tsrust-build.json

@@ -1,12 +1,12 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "889d263bb28613ed54717f261f3fb75f5e394e88d9cf9632d611a7fbe621c582",
+  "binarySha256": "3347480d9c39a2ee4891c13f7c6a12d50d9175e15776f1c6999e1574a491dfd8",
   "buildInfo": {
     "projectName": "@push.rocks/smartnftables",
-    "projectVersion": "4.4.0",
-    "gitCommit": "77c4a57ed74dce10ee91ef180972ebd9cc821211",
+    "projectVersion": "4.5.0",
+    "gitCommit": "f648edff675c7693b2ec8bca6138bd7d1e2da65b",
     "gitDirty": false,
-    "builtAt": "2026-10-06T03:48:09.553Z",
+    "builtAt": "2026-10-06T05:09:57.015Z",
     "tsrustVersion": "4.0.0",
     "binary": "smartnftables",
     "target": "linux_arm64_musl"

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@push.rocks/smartnftables',
-    version: '4.4.0',
+    version: '4.5.0',
     description: 'A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSwyQkFBMkI7SUFDakMsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLG1IQUFtSDtDQUNqSSxDQUFBIn0=

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartnftables",
-  "version": "4.4.0",
+  "version": "4.5.0",
   "private": false,
   "description": "A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.",
   "main": "dist_ts/index.js",

package/readme.md

@@ -1041,6 +1041,56 @@ and netdev hooks do not see routed packets and are not reported. Guard
 either Docker chain or any legacy table is present. The read is a point in time;
 the caller still owns exclusive authority over who may add a forward owner later.
 
+### Listing the managed tables with `nft`
+
+Every set the compiler declares carries the types `nft` needs to decode it: the
+key and data types, their byte orders and, for keys of up to four fields, the
+`typeof` expressions, byte for byte as nftables 1.0.9 writes them for the same
+`typeof` declaration (`nft add set ... '{ typeof meta iif . meta iifname; ... }'`).
+A lookup's loads must fit its set's declared key field by field, or compiling
+refuses with `INVALID`. Before 4.5.0 every set was declared with key type 0 and
+no userdata, so `nft list` aborted (`dtype != &invalid_type`) or crashed on any
+table that held one.
+
+What an operator can list today with nftables 1.0.9:
+
+- `nft list set|map inet <table> <set>` for every set. Keys of up to four fields
+  list as `typeof ...`; longer keys as `type ...`. nftables 1.0.9 cannot
+  describe a longer key by `typeof` (it stops at four fields, `NFT_REG32_SIZE`),
+  and its 32-bit type holds at most five fields, so the elements of a key of six
+  or more fields, or of five with a `ct zone`, print wrongly. The generation map
+  `leased_generation` lists as `type 0 : ct_label`: its key is the zone padded to
+  a register, as every release before typed sets declared it.
+- `nft list chain` for every chain whose rules test membership of keys of at most
+  six fields. A map lookup of a key of more than four fields lists, but nft may
+  render its data wrongly or drop the statement (seen for the leased flow maps
+  and `published_symmetric`).
+- `nft list ruleset`, `nft list table` and `nft list chain` crash (SIGSEGV) on any
+  rule that tests membership of a concatenation of seven or more fields. This is
+  an nftables defect, also on nftables master: `expr_postprocess_concat` walks
+  past the five fields the 32-bit type holds, for sets nft created itself just
+  as for these. Host grants (8 or 10 fields), workload grants (8), published
+  flows (8) and ported private rules (7) use such lookups, so on nodes that use
+  them `nft list ruleset` crashes until a fixed nftables is installed. List the
+  sets and the other chains individually meanwhile.
+
+The isolated qualification below proves each of these against the host's
+nftables 1.0.9 and pins the crash, so it fails once a fixed `nft` lands.
+
+#### Tables applied before 4.5.0
+
+A table applied by 4.4.x or earlier holds the same graph with untyped sets, and
+Linux enforces it identically: the kernel stores and dumps the key type and
+userdata but never interprets them. This release adopts such a graph, inspects,
+verifies and releases it as the applied graph, and never treats it as already
+applied: the next `reconcile()`, including a retry of the transition that
+applied it, replaces the whole graph with typed sets in the same single batch
+as any replacement, so enforcement never lapses. No migration step is needed.
+The transition is one-way per boot: 4.4.x refuses a table holding typed sets
+(`CONFLICT`), so a downgrade on the same boot cannot adopt it, while a reboot
+drops the table for either version. The acceptance of untyped sets is legacy
+support for kernel state left by 4.4.x and goes with the next major release.
+
 ### Native qualification
 
 The separate [Docker fixture](test/native/readme.docker.md) exercises the native
@@ -1052,7 +1102,8 @@ Its checked-in input manifest and per-run receipts identify the tested artifacts
 snapshot and bounded-subprocess tests. The ignored native cases require the explicitly marked disposable guest
 from `test/native/qualify.py`; requesting them on an ordinary host fails its scope
 check. Qualification uses an offline Linux 6.18.35 x86_64 guest with no host disks,
-mounts or external network backend. One VirtIO device connects only to a singleton
+mounts or external network backend; it carries the host's nftables 1.0.9 binary
+and libraries for the listing proof. One VirtIO device connects only to a singleton
 QEMU-internal hub; packet-path tests use guest-owned namespaces, veth pairs and TUN.
 It covers
 UDP/TCP grants, direct-IP denial, source spoofing, IPv6 denial, renamed interfaces,

package/rust/src/egress.compile.rs

@@ -21,6 +21,8 @@ mod router;
 #[path = "egress.workloadgrant.rs"]
 mod workloadgrant;
 
+use keys::Field;
+
 /// The atomic replacement budget. One replacement is one nfnetlink batch in one
 /// `sendmsg`, and Linux refuses a netlink message above the socket send buffer:
 /// `SO_SNDBUF` clamped to `net.core.wmem_max` and doubled, 425,984 bytes with the
@@ -54,6 +56,22 @@ pub(super) struct Program<'a> {
     bytes: usize,
     element_bytes: usize,
     operations: Vec<(u16, Vec<Attr>)>,
+    /// Each declared set's key and a map's data.
+    declared: std::collections::BTreeMap<String, Declared>,
+}
+/// One declared set: its key fields and a map's data fields.
+struct Declared {
+    key: Vec<Field>,
+    data: Option<Vec<Field>>,
+}
+/// A declared set as nft names it: its key's and a map's data's `typeof`
+/// expressions, and whether it is an interval set.
+#[cfg(test)]
+#[derive(Clone, Debug)]
+pub(crate) struct SetDeclaration {
+    pub(crate) key: Vec<&'static str>,
+    pub(crate) data: Option<Vec<&'static str>>,
+    pub(crate) interval: bool,
 }
 impl<'a> Program<'a> {
     fn push(&mut self, operation: u16, attributes: Vec<Attr>) -> Result<()> {
@@ -76,26 +94,59 @@ impl<'a> Program<'a> {
         self.element_bytes += wire::encode_attrs(&attributes).len() + 20;
         self.admit(12, attributes)
     }
-    /// One named exact-key hash set, or a map to `data_length` bytes. CONSTANT
-    /// like every set here.
+    /// The key's type and length and a map's data type and length, as nft
+    /// declares them, after which the userdata carries their byte orders and
+    /// `typeof` descriptions. Remembers the lengths every element must have.
+    fn typed(&mut self, name: &str, key: &[Field], data: Option<&[Field]>) -> Vec<Attr> {
+        let mut attributes = vec![
+            Attr::u32(4, keys::datatype(key)),
+            Attr::u32(5, keys::key_length(key)),
+        ];
+        if let Some(data) = data {
+            attributes.extend([
+                Attr::u32(6, keys::datatype(data)),
+                Attr::u32(7, keys::data_length(data)),
+            ]);
+        }
+        self.declared.insert(
+            name.to_string(),
+            Declared {
+                key: key.to_vec(),
+                data: data.map(<[Field]>::to_vec),
+            },
+        );
+        attributes
+    }
+    /// Whether an element's key and data have the lengths its set declares.
+    fn fits(&self, name: &str, key: &[u8], data: Option<&Vec<u8>>) -> Result<()> {
+        let declared = self.declared.get(name).ok_or(crate::Error::Invalid)?;
+        let length = |bytes: &[u8]| u32::try_from(bytes.len()).ok();
+        require(
+            length(key) == Some(keys::key_length(&declared.key))
+                && data.map(|data| length(data))
+                    == declared
+                        .data
+                        .as_deref()
+                        .map(|data| Some(keys::data_length(data))),
+        )
+    }
+    /// One named exact-key hash set, or a map to `data`. CONSTANT like every
+    /// set here.
     fn exact_set(
         &mut self,
         name: &str,
         id: u32,
-        key_length: u32,
-        data_length: Option<u32>,
+        key: &[Field],
+        data: Option<&[Field]>,
     ) -> Result<()> {
         let mut attributes = vec![
             Attr::string(1, self.table),
             Attr::string(2, name),
-            Attr::u32(3, 2 | if data_length.is_some() { 8 } else { 0 }),
-            Attr::u32(4, 0),
-            Attr::u32(5, key_length),
+            Attr::u32(3, 2 | if data.is_some() { 8 } else { 0 }),
         ];
-        if let Some(length) = data_length {
-            attributes.extend([Attr::u32(6, 0), Attr::u32(7, length)]);
-        }
+        attributes.extend(self.typed(name, key, data));
         attributes.push(Attr::u32(10, id));
+        attributes.push(Attr::bytes(13, keys::userdata(key, data)?));
         self.push(9, attributes)
     }
     fn exact_elements(
@@ -103,6 +154,9 @@ impl<'a> Program<'a> {
         name: &str,
         elements: Vec<(Vec<u8>, Option<Vec<u8>>)>,
     ) -> Result<()> {
+        for (key, data) in &elements {
+            self.fits(name, key, data.as_ref())?;
+        }
         for chunk in elements.chunks(256) {
             let list = chunk
                 .iter()
@@ -122,21 +176,6 @@ impl<'a> Program<'a> {
         }
         Ok(())
     }
-    /// One named exact-match set. CONSTANT: its elements cannot change once a
-    /// rule binds it, so replacement always creates a complete new set.
-    fn set(&mut self, name: &str, id: u32, key_length: usize) -> Result<()> {
-        self.push(
-            9,
-            vec![
-                Attr::string(1, self.table),
-                Attr::string(2, name),
-                Attr::u32(3, 2),
-                Attr::u32(4, 0),
-                Attr::u32(5, key_length as u32),
-                Attr::u32(10, id),
-            ],
-        )
-    }
     /// The elements of one set, 256 to a message so every nested attribute
     /// stays far below netlink's 16-bit attribute length. Elements have their
     /// own budget: a replacement deletes the previous set, and so its elements,
@@ -146,27 +185,21 @@ impl<'a> Program<'a> {
     }
     /// One named CONSTANT set of concatenated fields in which every field is an
     /// inclusive interval (the kernel's pipapo backend), optionally a map to
-    /// `data_length` bytes. `fields` are byte lengths; each occupies whole
-    /// 32-bit registers of the key.
+    /// `data`. Each field occupies whole 32-bit registers of the key.
     fn interval_set(
         &mut self,
         name: &str,
         id: u32,
-        fields: &[u32],
-        data_length: Option<u32>,
+        fields: &[Field],
+        data: Option<&[Field]>,
     ) -> Result<()> {
-        let key_length: u32 = fields.iter().map(|length| length.div_ceil(4) * 4).sum();
         let mut attributes = vec![
             Attr::string(1, self.table),
             Attr::string(2, name),
             // CONSTANT | INTERVAL | CONCAT, and MAP for a map.
-            Attr::u32(3, 2 | 4 | 0x80 | if data_length.is_some() { 8 } else { 0 }),
-            Attr::u32(4, 0),
-            Attr::u32(5, key_length),
+            Attr::u32(3, 2 | 4 | 0x80 | if data.is_some() { 8 } else { 0 }),
         ];
-        if let Some(length) = data_length {
-            attributes.extend([Attr::u32(6, 0), Attr::u32(7, length)]);
-        }
+        attributes.extend(self.typed(name, fields, data));
         attributes.extend([
             Attr::nested(
                 9,
@@ -174,11 +207,12 @@ impl<'a> Program<'a> {
                     2,
                     fields
                         .iter()
-                        .map(|length| Attr::nested(1, vec![Attr::u32(1, *length)]))
+                        .map(|field| Attr::nested(1, vec![Attr::u32(1, field.length)]))
                         .collect(),
                 )],
             ),
             Attr::u32(10, id),
+            Attr::bytes(13, keys::userdata(fields, data)?),
         ]);
         self.push(9, attributes)
     }
@@ -186,6 +220,10 @@ impl<'a> Program<'a> {
     /// An element whose bounds are equal carries no last key; Linux takes the
     /// first as the last and dumps it the same way.
     fn interval_elements(&mut self, name: &str, elements: Vec<IntervalElement>) -> Result<()> {
+        for element in &elements {
+            self.fits(name, &element.first, element.data.as_ref())?;
+            self.fits(name, &element.last, element.data.as_ref())?;
+        }
         for chunk in elements.chunks(256) {
             let list = chunk
                 .iter()
@@ -421,6 +459,34 @@ fn snat(address: &str, range: Option<(u16, u16)>) -> Result<Vec<Attr>> {
     Ok(result)
 }
 pub(super) fn compile(prepared: &Prepared, table: &str) -> Result<Vec<(u16, Vec<Attr>)>> {
+    Ok(compiled(prepared, table)?.operations)
+}
+/// Every set the compiled graph declares, by name.
+#[cfg(test)]
+pub(super) fn declared(
+    prepared: &Prepared,
+    table: &str,
+) -> Result<std::collections::BTreeMap<String, SetDeclaration>> {
+    let program = compiled(prepared, table)?;
+    let names = |fields: &[Field]| fields.iter().map(|field| field.name).collect();
+    let mut result = std::collections::BTreeMap::new();
+    for (kind, attributes) in &program.operations {
+        if *kind == 9 {
+            let name = wire::text(attributes, 2)?;
+            let declared = program.declared.get(&name).ok_or(crate::Error::Invalid)?;
+            result.insert(
+                name,
+                SetDeclaration {
+                    key: names(&declared.key),
+                    data: declared.data.as_deref().map(names),
+                    interval: wire::number(attributes, 3)? & 4 != 0,
+                },
+            );
+        }
+    }
+    Ok(result)
+}
+fn compiled<'a>(prepared: &Prepared, table: &'a str) -> Result<Program<'a>> {
     let mut program = Program {
         table,
         stamp: format!("snft2:{}:{}", prepared.policy.revision, prepared.digest),
@@ -428,11 +494,12 @@ pub(super) fn compile(prepared: &Prepared, table: &str) -> Result<Vec<(u16, Vec<
         bytes: 0,
         element_bytes: 0,
         operations: Vec::new(),
+        declared: std::collections::BTreeMap::new(),
     };
     match &prepared.policy.scope {
         Scope::RouterEgress(scope) => router::compile(&mut program, scope)?,
         Scope::HostTransit(scope) => host::compile(&mut program, scope)?,
         Scope::AllocationPoolGuard(scope) => poolguard::compile(&mut program, scope)?,
     }
-    Ok(program.operations)
+    Ok(program)
 }

package/rust/src/egress.hostgrant.rs

@@ -4,6 +4,10 @@
 //! variable interface (index and name), the packet and conntrack protocols, the
 //! live tuple and the originally tracked tuple. An element is one grant with its
 //! live tuple equal to its original tuple, so translated flows never match.
+use super::keys::{
+    Field, Loads, CT_ORIGINAL_DADDR, CT_ORIGINAL_DPORT, CT_ORIGINAL_SADDR, CT_PROTOCOL, IP_DADDR,
+    IP_SADDR, L4PROTO, OIF, OIFNAME, TH_DPORT,
+};
 use super::*;
 
 /// Every exact host-origin flow of the scope, keyed on its full tuple.
@@ -11,6 +15,42 @@ pub(super) const TUPLE_SET: &str = "host_grant";
 /// Router raw ingress runs before conntrack: exact arriving tuples only.
 pub(super) const ARRIVAL_SET: &str = "host_grant_arrival";
 
+/// The tuple key of a link-independent scope: both protocols, the live tuple
+/// and the originally tracked tuple, as the original direction loads them.
+pub(super) const TUPLE: [Field; 8] = [
+    L4PROTO,
+    CT_PROTOCOL,
+    IP_SADDR,
+    IP_DADDR,
+    TH_DPORT,
+    CT_ORIGINAL_SADDR,
+    CT_ORIGINAL_DADDR,
+    CT_ORIGINAL_DPORT,
+];
+/// The tuple key behind the variable interface: its index and name first.
+const LINKED_TUPLE: [Field; 10] = [
+    OIF,
+    OIFNAME,
+    L4PROTO,
+    CT_PROTOCOL,
+    IP_SADDR,
+    IP_DADDR,
+    TH_DPORT,
+    CT_ORIGINAL_SADDR,
+    CT_ORIGINAL_DADDR,
+    CT_ORIGINAL_DPORT,
+];
+/// The exact arriving tuple: protocol, addresses and port.
+const ARRIVAL: [Field; 4] = [L4PROTO, IP_SADDR, IP_DADDR, TH_DPORT];
+
+fn tuple(linked: bool) -> &'static [Field] {
+    if linked {
+        &LINKED_TUPLE
+    } else {
+        &TUPLE
+    }
+}
+
 /// Register numbers as Linux dumps them: 16-byte aligned registers use the
 /// legacy NFT_REG_1..4 names, every other 4-byte register NFT_REG32_xx.
 pub(super) fn register(index: u32) -> u32 {
@@ -38,21 +78,14 @@ pub(super) fn payload_to(base: u32, offset: u32, length: u32, index: u32) -> Att
         index,
     )
 }
-pub(super) fn ct_to(key: u32, original: bool, index: u32) -> Attr {
+/// A conntrack key of the original (0) or reply (1) tuple, or of neither.
+pub(super) fn ct_to(key: u32, direction: Option<u8>, index: u32) -> Attr {
     let mut data = vec![Attr::u32(2, key)];
-    if original {
-        data.push(Attr::bytes(3, vec![0]));
+    if let Some(direction) = direction {
+        data.push(Attr::bytes(3, vec![direction]));
     }
     store("ct", data, index)
 }
-/// A conntrack key of the reply direction's tuple.
-pub(super) fn ct_reply_to(key: u32, index: u32) -> Attr {
-    store(
-        "ct",
-        vec![Attr::u32(2, key), Attr::bytes(3, vec![1])],
-        index,
-    )
-}
 pub(super) fn lookup(set: &str) -> Attr {
     expr(
         "lookup",
@@ -72,26 +105,22 @@ fn word(bytes: &[u8]) -> Vec<u8> {
 /// Key loads for one direction, then the lookup in `set`. `linked` adds the
 /// variable interface: the outgoing interface of the original direction, the
 /// incoming interface of the reply.
-pub(super) fn tuple_lookup(set: &str, linked: bool, reply: bool) -> Vec<Attr> {
-    let mut result = Vec::new();
-    let mut index = 4;
+pub(super) fn tuple_lookup(set: &str, linked: bool, reply: bool) -> Result<Vec<Attr>> {
+    let mut loads = Loads::new();
     if linked {
-        result.push(meta_to(if reply { 4 } else { 5 }, index));
-        result.push(meta_to(if reply { 6 } else { 7 }, index + 1));
-        index += 5;
+        loads.link(reply);
     }
-    result.push(meta_to(16, index));
-    result.push(ct_to(10, false, index + 1));
     // The grant's source and destination are the packet's own addresses in the
     // original direction and swapped on the reply; the port is the workload's.
-    result.push(payload_to(1, if reply { 16 } else { 12 }, 4, index + 2));
-    result.push(payload_to(1, if reply { 12 } else { 16 }, 4, index + 3));
-    result.push(payload_to(2, if reply { 0 } else { 2 }, 2, index + 4));
-    result.push(ct_to(19, true, index + 5));
-    result.push(ct_to(20, true, index + 6));
-    result.push(ct_to(12, true, index + 7));
-    result.push(lookup(set));
-    result
+    loads
+        .protocols()
+        .address(!reply)
+        .address(reply)
+        .port(reply)
+        .original_address(true)
+        .original_address(false)
+        .original_port(false);
+    loads.lookup(set, tuple(linked))
 }
 pub(super) fn tuple_key(grant: &HostGrant, link: Option<&LocalLink>) -> Result<Vec<u8>> {
     let protocol = word(&[protocol(&grant.protocol)]);
@@ -128,11 +157,15 @@ pub(super) fn tuple_set<'s>(
     link: impl Fn(&HostGrant) -> Result<Option<&'s LocalLink>>,
 ) -> Result<()> {
     let mut keys = Vec::new();
+    let mut linked = false;
     for grant in grants {
-        keys.push(tuple_key(grant, link(grant)?)?);
+        let link = link(grant)?;
+        linked = link.is_some();
+        keys.push(tuple_key(grant, link)?);
     }
-    let length = keys.first().map(Vec::len).ok_or(crate::Error::Invalid)?;
-    program.set(TUPLE_SET, 1, length)?;
+    // Every element has the declared key's length, so a scope never mixes them.
+    require(!keys.is_empty())?;
+    program.exact_set(TUPLE_SET, 1, tuple(linked), None)?;
     program.elements(TUPLE_SET, keys)
 }
 pub(super) fn arrival_set(program: &mut Program<'_>, grants: &[HostGrant]) -> Result<()> {
@@ -144,18 +177,17 @@ pub(super) fn arrival_set(program: &mut Program<'_>, grants: &[HostGrant]) -> Re
         key.extend(word(&grant.destination_port.to_be_bytes()));
         keys.push(key);
     }
-    program.set(ARRIVAL_SET, 2, 16)?;
+    program.exact_set(ARRIVAL_SET, 2, &ARRIVAL, None)?;
     program.elements(ARRIVAL_SET, keys)
 }
 /// Exact arriving tuple, before conntrack: protocol, addresses and port.
-pub(super) fn arrival_lookup() -> Vec<Attr> {
-    vec![
-        meta_to(16, 4),
-        payload_to(1, 12, 4, 5),
-        payload_to(1, 16, 4, 6),
-        payload_to(2, 2, 2, 7),
-        lookup(ARRIVAL_SET),
-    ]
+pub(super) fn arrival_lookup() -> Result<Vec<Attr>> {
+    Loads::new()
+        .protocol()
+        .address(true)
+        .address(false)
+        .port(false)
+        .lookup(ARRIVAL_SET, &ARRIVAL)
 }
 
 /// Four admissions whatever the number of grants: the ESTABLISHED original
@@ -178,7 +210,7 @@ pub(super) fn admissions(
         result
     };
     let mut established = envelope(false, 2);
-    established.extend(tuple_lookup(TUPLE_SET, linked, false));
+    established.extend(tuple_lookup(TUPLE_SET, linked, false)?);
     program.end(chains[0], established, 1)?;
     for transport in ["udp", "tcp"] {
         let mut opening = envelope(false, 8);
@@ -186,10 +218,10 @@ pub(super) fn admissions(
         if transport == "tcp" {
             opening.extend(opening_tcp());
         }
-        opening.extend(tuple_lookup(TUPLE_SET, linked, false));
+        opening.extend(tuple_lookup(TUPLE_SET, linked, false)?);
         program.end(chains[0], opening, 1)?;
     }
     let mut reply = envelope(true, 2);
-    reply.extend(tuple_lookup(TUPLE_SET, linked, true));
+    reply.extend(tuple_lookup(TUPLE_SET, linked, true)?);
     program.end(chains[1], reply, 1)
 }