@push.rocks/smartnftables 4.4.0 → 4.5.0

package/rust/src/egress.leased.rs

@@ -6,13 +6,26 @@
 //! rules prove through `private_link`), the protocols, the live and originally
 //! tracked tuple and the generation's conntrack zone. Generation labels live in
 //! two exact sets, so a label alone never authorizes a changed grant.
-use super::keys::{self, Key, Loads, ADDRESS, INDEX, LABEL, PORT, PROTOCOL, ZONE};
+use super::keys::{
+    self, Field, Key, Loads, CT_LABEL, CT_ORIGINAL_DADDR, CT_ORIGINAL_DPORT, CT_ORIGINAL_SADDR,
+    CT_ORIGINAL_SPORT, CT_PROTOCOL, CT_ZONE, IIF, IP_DADDR, IP_SADDR, L4PROTO, TH_DPORT, TH_SPORT,
+};
 use super::private::known;
 use super::*;
 
 const LABEL_SET: &str = "leased_label";
 const GENERATION_MAP: &str = "leased_generation";
-const RETURN: [u32; 5] = [PROTOCOL, ADDRESS, ADDRESS, PORT, PORT];
+const LABEL_KEY: [Field; 2] = [CT_ZONE, CT_LABEL];
+/// The generation map's key is the zone padded to its register, as every
+/// release before typed sets declared it.
+const GENERATION_KEY: [Field; 1] = [CT_ZONE];
+const GENERATION_DATA: [Field; 1] = [CT_LABEL];
+const RETURN: [Field; 5] = [L4PROTO, IP_SADDR, IP_DADDR, TH_SPORT, TH_DPORT];
+/// The zone a classification stores.
+const ZONE_DATA: [Field; 1] = [CT_ZONE];
+/// The source NAT a flow map stores: the transit address and the first and
+/// last port of the leased range.
+const TRANSLATION: [Field; 3] = [IP_SADDR, TH_SPORT, TH_SPORT];
 
 /// Platform grants precede the protected barrier and public grants follow it.
 #[derive(Clone, Copy, PartialEq, Eq)]
@@ -69,24 +82,26 @@ impl Shape {
     }
     /// A source port field only where the grants name one, then the
     /// destination port.
-    fn ports(self) -> Vec<u32> {
+    fn ports(self, source: Field, destination: Field) -> Vec<Field> {
         if self.sourced {
-            vec![PORT, PORT]
+            vec![source, destination]
         } else {
-            vec![PORT]
+            vec![destination]
         }
     }
-    fn classification(self) -> Vec<u32> {
-        let mut fields = vec![INDEX, PROTOCOL, ADDRESS, ADDRESS];
-        fields.extend(self.ports());
+    /// The classification key, as the incoming direction loads it.
+    fn classification(self) -> Vec<Field> {
+        let mut fields = vec![IIF, L4PROTO, IP_SADDR, IP_DADDR];
+        fields.extend(self.ports(TH_SPORT, TH_DPORT));
         fields
     }
-    fn flow(self) -> Vec<u32> {
-        let mut fields = vec![INDEX, PROTOCOL, PROTOCOL, ADDRESS, ADDRESS];
-        fields.extend(self.ports());
-        fields.extend([ADDRESS, ADDRESS]);
-        fields.extend(self.ports());
-        fields.push(ZONE);
+    /// The flow key, as the original direction loads it.
+    fn flow(self) -> Vec<Field> {
+        let mut fields = vec![IIF, L4PROTO, CT_PROTOCOL, IP_SADDR, IP_DADDR];
+        fields.extend(self.ports(TH_SPORT, TH_DPORT));
+        fields.extend([CT_ORIGINAL_SADDR, CT_ORIGINAL_DADDR]);
+        fields.extend(self.ports(CT_ORIGINAL_SPORT, CT_ORIGINAL_DPORT));
+        fields.push(CT_ZONE);
         fields
     }
     fn key_ports(self, key: Key, grant: &Grant) -> Key {
@@ -151,8 +166,15 @@ pub(super) fn sets(program: &mut Program<'_>, scope: &RouterScope) -> Result<()>
         labels.push((key, None));
         generations.push((zone_word(generation.conntrack_zone), Some(label)));
     }
-    keys::exact(program, LABEL_SET, 38, 4 + LABEL, None, labels)?;
-    keys::exact(program, GENERATION_MAP, 39, 4, Some(LABEL), generations)?;
+    keys::exact(program, LABEL_SET, 38, &LABEL_KEY, None, labels)?;
+    keys::exact(
+        program,
+        GENERATION_MAP,
+        39,
+        &GENERATION_KEY,
+        Some(&GENERATION_DATA),
+        generations,
+    )?;
     for kind in [Kind::Platform, Kind::Public] {
         let mut returns = Vec::new();
         for shape in Shape::all(kind) {
@@ -212,7 +234,7 @@ pub(super) fn sets(program: &mut Program<'_>, scope: &RouterScope) -> Result<()>
                 &shape.name("zone"),
                 shape.id(0),
                 &shape.classification(),
-                Some(ZONE),
+                Some(&ZONE_DATA),
                 classification,
             )?;
             keys::interval(
@@ -220,12 +242,19 @@ pub(super) fn sets(program: &mut Program<'_>, scope: &RouterScope) -> Result<()>
                 &shape.name("flow"),
                 shape.id(1),
                 &shape.flow(),
-                Some(12),
+                Some(&TRANSLATION),
                 flows,
             )?;
         }
         let id = 48 + 8 + u32::from(kind == Kind::Public);
-        keys::interval(program, &kind.returns(), id, &RETURN, Some(ZONE), returns)?;
+        keys::interval(
+            program,
+            &kind.returns(),
+            id,
+            &RETURN,
+            Some(&ZONE_DATA),
+            returns,
+        )?;
     }
     Ok(())
 }
@@ -260,15 +289,15 @@ pub(super) fn classification(
         };
         if !present(scope, shape, false).is_empty() {
             let mut expressions = ipv4();
-            expressions.extend(known(true));
-            expressions.extend(tuple(true).map(&shape.name("zone")));
+            expressions.extend(known(true)?);
+            expressions.extend(tuple(true).map(&shape.name("zone"), &shape.classification())?);
             expressions.push(zone_from_data());
             program.end("raw_in", expressions, 1)?;
         }
         if !present(scope, shape, true).is_empty() {
             let mut expressions = ipv4();
             expressions.extend(link(&scope.handoff, false));
-            expressions.extend(tuple(false).map(&shape.name("zone")));
+            expressions.extend(tuple(false).map(&shape.name("zone"), &shape.classification())?);
             expressions.push(zone_from_data());
             program.end("raw_out", expressions, 1)?;
         }
@@ -283,7 +312,7 @@ pub(super) fn classification(
             .address(false)
             .port(true)
             .port(false);
-        expressions.extend(loads.map(&kind.returns()));
+        expressions.extend(loads.map(&kind.returns(), &RETURN)?);
         expressions.push(zone_from_data());
         program.end("raw_return", expressions, 1)?;
     }
@@ -305,8 +334,8 @@ fn flow(shape: Shape, reply: bool) -> Loads {
     loads.zone();
     loads
 }
-fn labelled() -> Vec<Attr> {
-    Loads::new().zone().label().lookup(LABEL_SET)
+fn labelled() -> Result<Vec<Attr>> {
+    Loads::new().zone().label().lookup(LABEL_SET, &LABEL_KEY)
 }
 /// Admissions of one kind in one filter chain. The original direction leaves
 /// through the handoff: ESTABLISHED or NEW with the generation's label, or a
@@ -340,36 +369,36 @@ pub(super) fn admissions(
         };
         if !original.is_empty() {
             let mut established = envelope(false, 2);
-            established.extend(known(true));
-            established.extend(flow(shape, false).lookup(&name));
-            established.extend(labelled());
+            established.extend(known(true)?);
+            established.extend(flow(shape, false).lookup(&name, &shape.flow())?);
+            established.extend(labelled()?);
             program.end(chain, established, 1)?;
             for transport in &original {
-                let opening = || {
+                let opening = || -> Result<Vec<Attr>> {
                     let mut result = envelope(false, 8);
                     result.extend(meta(16, vec![protocol(transport)]));
                     if *transport == "tcp" {
                         result.extend(opening_tcp());
                     }
-                    result.extend(known(true));
-                    result.extend(flow(shape, false).lookup(&name));
-                    result
+                    result.extend(known(true)?);
+                    result.extend(flow(shape, false).lookup(&name, &shape.flow())?);
+                    Ok(result)
                 };
-                let mut labelled_opening = opening();
-                labelled_opening.extend(labelled());
+                let mut labelled_opening = opening()?;
+                labelled_opening.extend(labelled()?);
                 program.end(chain, labelled_opening, 1)?;
-                let mut fresh = opening();
+                let mut fresh = opening()?;
                 fresh.extend(ct(13, None, vec![0; 16]));
-                fresh.extend(Loads::new().zone().map(GENERATION_MAP));
+                fresh.extend(Loads::new().zone().map(GENERATION_MAP, &GENERATION_KEY)?);
                 fresh.push(keys::set_ct_from_data(13));
                 program.end(chain, fresh, 1)?;
             }
         }
         if reply {
             let mut answer = envelope(true, 2);
-            answer.extend(known(false));
-            answer.extend(flow(shape, true).lookup(&name));
-            answer.extend(labelled());
+            answer.extend(known(false)?);
+            answer.extend(flow(shape, true).lookup(&name, &shape.flow())?);
+            answer.extend(labelled()?);
             program.end(chain, answer, 1)?;
         }
     }
@@ -389,9 +418,9 @@ pub(super) fn translation(
         let mut expressions = ipv4();
         expressions.extend(link(&scope.handoff, false));
         expressions.extend(ct(1, None, vec![0]));
-        expressions.extend(labelled());
-        expressions.extend(known(true));
-        expressions.extend(flow(shape, false).map(&shape.name("flow")));
+        expressions.extend(labelled()?);
+        expressions.extend(known(true)?);
+        expressions.extend(flow(shape, false).map(&shape.name("flow"), &shape.flow())?);
         expressions.push(super::published::nat(0, 2));
         program.rule("post", expressions)?;
     }

package/rust/src/egress.poolguard.rs

@@ -1,10 +1,13 @@
-use super::keys::{self, Key, Loads, ADDRESS, PORT, PROTOCOL};
+use super::keys::{
+    self, Field, Key, Loads, CT_ORIGINAL_DPORT, CT_REPLY_SADDR, CT_REPLY_SPORT, L4PROTO,
+};
 use super::*;
 
 /// Publications translated into a pool: the protocol, the address and port the
 /// flow was translated to, and its originally tracked destination port. Port fields are inclusive intervals, so one element holds
 /// one port or a whole range.
 const PUBLISHED: &str = "pool_published";
+const PUBLISHED_KEY: [Field; 4] = [L4PROTO, CT_REPLY_SADDR, CT_REPLY_SPORT, CT_ORIGINAL_DPORT];
 
 pub(super) fn compile(program: &mut Program<'_>, scope: &AllocationPoolGuardScope) -> Result<()> {
     for (name, hook) in [("input", 1), ("forward", 2), ("output", 3)] {
@@ -67,15 +70,7 @@ fn published_set(program: &mut Program<'_>, scope: &AllocationPoolGuardScope) ->
                 .element(None),
         );
     }
-    keys::interval(
-        program,
-        PUBLISHED,
-        2,
-        &[PROTOCOL, ADDRESS, PORT, PORT],
-        None,
-        elements,
-    )
-    .map(|_| ())
+    keys::interval(program, PUBLISHED, 2, &PUBLISHED_KEY, None, elements).map(|_| ())
 }
 /// The admissions of every publication, whatever their number: behind the
 /// default conntrack zone, an ESTABLISHED packet of either direction, and a NEW
@@ -90,7 +85,7 @@ fn published(program: &mut Program<'_>, scope: &AllocationPoolGuardScope) -> Res
     let lookup = || {
         let mut loads = Loads::new();
         loads.protocol().translated().original_port(false);
-        loads.lookup(PUBLISHED)
+        loads.lookup(PUBLISHED, &PUBLISHED_KEY)
     };
     let envelope = |connection_state: u32| {
         let mut result = ct(17, None, 0_u16.to_ne_bytes().to_vec());
@@ -98,7 +93,7 @@ fn published(program: &mut Program<'_>, scope: &AllocationPoolGuardScope) -> Res
         result
     };
     let mut established = envelope(2);
-    established.extend(lookup());
+    established.extend(lookup()?);
     program.end("pool_guard", established, 1)?;
     let transports: std::collections::BTreeSet<&str> = scope
         .published_ports
@@ -111,7 +106,7 @@ fn published(program: &mut Program<'_>, scope: &AllocationPoolGuardScope) -> Res
         if transport == "tcp" {
             opening.extend(opening_tcp());
         }
-        opening.extend(lookup());
+        opening.extend(lookup()?);
         program.end("pool_guard", opening, 1)?;
     }
     Ok(())

package/rust/src/egress.private.rs

@@ -4,7 +4,9 @@
 //! anti-spoof guard, the directed rules and the terminal denials look the packet
 //! up there and in sets keyed on the link index, so a renamed or reused interface
 //! never matches an element of another link.
-use super::keys::{self, Key, Loads, ADDRESS, INDEX, NAME, PORT, PROTOCOL};
+use super::keys::{
+    self, Field, Key, Loads, IIF, IIFNAME, IP_DADDR, IP_SADDR, L4PROTO, OIF, TH_DPORT, TH_SPORT,
+};
 use super::*;
 
 /// Every endpoint link, index and name, and the absent interface (0, "") of
@@ -21,6 +23,14 @@ const SOURCE: &str = "private_source";
 const ANY: &str = "private_any";
 const PORTED: &str = "private_port";
 
+/// The keys, as the incoming direction loads them where both directions do.
+const LINK_KEY: [Field; 2] = [IIF, IIFNAME];
+const INDEX_KEY: [Field; 1] = [IIF];
+const NAME_KEY: [Field; 1] = [IIFNAME];
+const SOURCE_KEY: [Field; 2] = [IIF, IP_SADDR];
+const ANY_KEY: [Field; 4] = [IIF, OIF, IP_SADDR, IP_DADDR];
+const PORTED_KEY: [Field; 7] = [IIF, OIF, IP_SADDR, IP_DADDR, L4PROTO, TH_SPORT, TH_DPORT];
+
 fn name(value: &str) -> Vec<u8> {
     let mut bytes = value.as_bytes().to_vec();
     bytes.resize(16, 0);
@@ -64,10 +74,10 @@ pub(super) fn sets(program: &mut Program<'_>, scope: &RouterScope) -> Result<()>
             );
         }
     }
-    keys::exact(program, LINK, 32, INDEX + NAME, None, links)?;
-    keys::exact(program, INDEX_SET, 33, INDEX, None, indices)?;
-    keys::exact(program, NAME_SET, 34, NAME, None, names)?;
-    keys::interval(program, SOURCE, 35, &[INDEX, ADDRESS], None, sources)?;
+    keys::exact(program, LINK, 32, &LINK_KEY, None, links)?;
+    keys::exact(program, INDEX_SET, 33, &INDEX_KEY, None, indices)?;
+    keys::exact(program, NAME_SET, 34, &NAME_KEY, None, names)?;
+    keys::interval(program, SOURCE, 35, &SOURCE_KEY, None, sources)?;
     let (mut any, mut ported) = (Vec::new(), Vec::new());
     for rule in &scope.rules {
         let key = Key::default()
@@ -86,22 +96,8 @@ pub(super) fn sets(program: &mut Program<'_>, scope: &RouterScope) -> Result<()>
             );
         }
     }
-    keys::interval(
-        program,
-        ANY,
-        36,
-        &[INDEX, INDEX, ADDRESS, ADDRESS],
-        None,
-        any,
-    )?;
-    keys::interval(
-        program,
-        PORTED,
-        37,
-        &[INDEX, INDEX, ADDRESS, ADDRESS, PROTOCOL, PORT, PORT],
-        None,
-        ported,
-    )?;
+    keys::interval(program, ANY, 36, &ANY_KEY, None, any)?;
+    keys::interval(program, PORTED, 37, &PORTED_KEY, None, ported)?;
     Ok(())
 }
 /// The directions a filter chain sees an endpoint link in.
@@ -114,8 +110,8 @@ fn directions(chain: &str) -> Vec<bool> {
 }
 /// The interface of one direction is an endpoint link or absent, by index and
 /// name.
-pub(super) fn known(incoming: bool) -> Vec<Attr> {
-    Loads::new().link(incoming).lookup(LINK)
+pub(super) fn known(incoming: bool) -> Result<Vec<Attr>> {
+    Loads::new().link(incoming).lookup(LINK, &LINK_KEY)
 }
 /// Anti-spoof guards: a packet arriving from an endpoint link must carry one of
 /// its source prefixes, and one leaving to it one of its prefixes as destination;
@@ -126,7 +122,7 @@ pub(super) fn guards(program: &mut Program<'_>, scope: &RouterScope, chain: &str
         return Ok(());
     }
     for incoming in directions(chain) {
-        let mut foreign = known(incoming);
+        let mut foreign = known(incoming)?;
         foreign.push(expr("meta", vec![Attr::u32(1, 1), Attr::u32(2, 15)]));
         foreign.push(expr(
             "cmp",
@@ -138,12 +134,12 @@ pub(super) fn guards(program: &mut Program<'_>, scope: &RouterScope, chain: &str
         ));
         program.end(chain, foreign, 0)?;
         let mut spoofed = ipv4();
-        spoofed.extend(known(incoming));
+        spoofed.extend(known(incoming)?);
         spoofed.extend(
             Loads::new()
                 .index(incoming)
                 .address(incoming)
-                .absent(SOURCE),
+                .absent(SOURCE, &SOURCE_KEY)?,
         );
         program.end(chain, spoofed, 0)?;
     }
@@ -154,7 +150,7 @@ pub(super) fn guards(program: &mut Program<'_>, scope: &RouterScope, chain: &str
 /// protocol and ports. Input sees no outgoing and output no incoming interface,
 /// so each chain matches exactly the rules that were compiled into it.
 pub(super) fn grants(program: &mut Program<'_>, scope: &RouterScope, chain: &str) -> Result<()> {
-    for (set, ported) in [(ANY, false), (PORTED, true)] {
+    for (set, key, ported) in [(ANY, &ANY_KEY[..], false), (PORTED, &PORTED_KEY[..], true)] {
         if !scope
             .rules
             .iter()
@@ -163,14 +159,14 @@ pub(super) fn grants(program: &mut Program<'_>, scope: &RouterScope, chain: &str
             continue;
         }
         let mut expressions = ipv4();
-        expressions.extend(known(true));
-        expressions.extend(known(false));
+        expressions.extend(known(true)?);
+        expressions.extend(known(false)?);
         let mut loads = Loads::new();
         loads.index(true).index(false).address(true).address(false);
         if ported {
             loads.protocol().port(true).port(false);
         }
-        expressions.extend(loads.lookup(set));
+        expressions.extend(loads.lookup(set, key)?);
         program.end(chain, expressions, 1)?;
     }
     Ok(())
@@ -181,15 +177,14 @@ pub(super) fn denials(program: &mut Program<'_>, scope: &RouterScope, chain: &st
         return Ok(());
     }
     for incoming in directions(chain) {
-        program.end(chain, Loads::new().index(incoming).lookup(INDEX_SET), 0)?;
         program.end(
             chain,
-            Loads::new()
-                .push(
-                    |at| super::hostgrant::meta_to(if incoming { 6 } else { 7 }, at),
-                    NAME,
-                )
-                .lookup(NAME_SET),
+            Loads::new().index(incoming).lookup(INDEX_SET, &INDEX_KEY)?,
+            0,
+        )?;
+        program.end(
+            chain,
+            Loads::new().name(incoming).lookup(NAME_SET, &NAME_KEY)?,
             0,
         )?;
     }

package/rust/src/egress.published.rs

@@ -6,8 +6,12 @@
 //! protocols, the live address and port, and the originally tracked address and
 //! port. A port field is an inclusive interval, so one element holds one port or
 //! a whole range, and every other field is exact.
-use super::hostgrant::{meta_to, register};
-use super::keys::{self, word, Key, Loads, ADDRESS, INDEX, NAME, PORT, PROTOCOL};
+use super::hostgrant::register;
+use super::keys::{
+    self, word, Field, Key, Loads, CT_ORIGINAL_DADDR, CT_ORIGINAL_DPORT, CT_ORIGINAL_SADDR,
+    CT_ORIGINAL_SPORT, CT_PROTOCOL, IIF, IIFNAME, IP_DADDR, IP_SADDR, L4PROTO, OIF, OIFNAME,
+    TH_DPORT, TH_SPORT,
+};
 use super::*;
 
 /// Router handoff arrivals of a publication, classified before conntrack.
@@ -24,7 +28,39 @@ pub(super) const FORWARD: &str = "published_forward";
 /// the data is the source NAT to the outside address and port span.
 pub(super) const SYMMETRIC: &str = "published_symmetric";
 
-const LINK: [u32; 2] = [INDEX, NAME];
+const ARRIVAL_KEY: [Field; 3] = [L4PROTO, IP_DADDR, TH_DPORT];
+const ENDPOINT_KEY: [Field; 5] = [IIF, IIFNAME, L4PROTO, IP_SADDR, TH_SPORT];
+/// The translation maps' key, and their data: the inside address and port, or
+/// the inside address alone.
+const TRANSLATION_KEY: [Field; 4] = [L4PROTO, CT_PROTOCOL, IP_DADDR, TH_DPORT];
+const PORT_DATA: [Field; 2] = [IP_DADDR, TH_DPORT];
+const ADDRESS_DATA: [Field; 1] = [IP_DADDR];
+/// `[link, protocols, address, port, original address, original port]`, the key
+/// of both admission sets, as their original direction loads it: inbound
+/// toward the inside link and destination, symmetric from them.
+const INBOUND_KEY: [Field; 8] = [
+    OIF,
+    OIFNAME,
+    L4PROTO,
+    CT_PROTOCOL,
+    IP_DADDR,
+    TH_DPORT,
+    CT_ORIGINAL_DADDR,
+    CT_ORIGINAL_DPORT,
+];
+const SYMMETRIC_KEY: [Field; 8] = [
+    IIF,
+    IIFNAME,
+    L4PROTO,
+    CT_PROTOCOL,
+    IP_SADDR,
+    TH_SPORT,
+    CT_ORIGINAL_SADDR,
+    CT_ORIGINAL_SPORT,
+];
+/// The source NAT a symmetric flow stores: the outside address and the first
+/// and last port of its span.
+const SYMMETRIC_DATA: [Field; 3] = [IP_SADDR, TH_SPORT, TH_SPORT];
 
 /// One publication on one hop. The outside is what clients reach (the uplink
 /// address and port on the host, the transit address and port in the router);
@@ -44,13 +80,6 @@ pub(super) struct Hop<'a> {
     pub(super) fixed: &'a LocalLink,
 }
 
-/// `[link, protocols, address, port, original address, original port]`, the key
-/// of both admission sets.
-fn flow_fields() -> Vec<u32> {
-    let mut fields = LINK.to_vec();
-    fields.extend([PROTOCOL, PROTOCOL, ADDRESS, PORT, ADDRESS, PORT]);
-    fields
-}
 fn inbound_key(publication: &Publication<'_>) -> Result<IntervalElement> {
     let (outside, outside_first, outside_last) = publication.outside;
     let (inside, inside_first, inside_last) = publication.inside;
@@ -108,9 +137,6 @@ fn translation_loads() -> Loads {
     loads.protocols().address(false).port(false);
     loads
 }
-fn translation_fields() -> [u32; 4] {
-    [PROTOCOL, PROTOCOL, ADDRESS, PORT]
-}
 fn ranged(publication: &Publication<'_>) -> bool {
     publication.outside.1 != publication.outside.2
 }
@@ -133,14 +159,7 @@ pub(super) fn sets(program: &mut Program<'_>, hop: &Hop<'_>, router: bool) -> Re
                     .element(None),
             );
         }
-        declare(
-            program,
-            ARRIVAL,
-            16,
-            &[PROTOCOL, ADDRESS, PORT],
-            None,
-            arrivals,
-        )?;
+        declare(program, ARRIVAL, 16, &ARRIVAL_KEY, None, arrivals)?;
         // Several publications may share inside ports that are not symmetric;
         // the classification is their union, as disjoint intervals.
         let mut endpoints = Vec::new();
@@ -155,9 +174,7 @@ pub(super) fn sets(program: &mut Program<'_>, hop: &Hop<'_>, router: bool) -> Re
                     .element(None),
             );
         }
-        let mut fields = LINK.to_vec();
-        fields.extend([PROTOCOL, ADDRESS, PORT]);
-        declare(program, ENDPOINT, 17, &fields, None, endpoints)?;
+        declare(program, ENDPOINT, 17, &ENDPOINT_KEY, None, endpoints)?;
     }
     let (mut ports, mut addresses) = (Vec::new(), Vec::new());
     for publication in &hop.publications {
@@ -175,13 +192,20 @@ pub(super) fn sets(program: &mut Program<'_>, hop: &Hop<'_>, router: bool) -> Re
             ports.push(key.element(Some(data)));
         }
     }
-    declare(program, PORT_MAP, 18, &translation_fields(), Some(8), ports)?;
+    declare(
+        program,
+        PORT_MAP,
+        18,
+        &TRANSLATION_KEY,
+        Some(&PORT_DATA),
+        ports,
+    )?;
     declare(
         program,
         ADDRESS_MAP,
         19,
-        &translation_fields(),
-        Some(4),
+        &TRANSLATION_KEY,
+        Some(&ADDRESS_DATA),
         addresses,
     )?;
     let inbound = hop
@@ -189,21 +213,28 @@ pub(super) fn sets(program: &mut Program<'_>, hop: &Hop<'_>, router: bool) -> Re
         .iter()
         .map(inbound_key)
         .collect::<Result<Vec<_>>>()?;
-    declare(program, FORWARD, 20, &flow_fields(), None, inbound)?;
+    declare(program, FORWARD, 20, &INBOUND_KEY, None, inbound)?;
     let symmetric = hop
         .publications
         .iter()
         .filter(|publication| publication.symmetric)
         .map(symmetric_key)
         .collect::<Result<Vec<_>>>()?;
-    declare(program, SYMMETRIC, 21, &flow_fields(), Some(12), symmetric)
+    declare(
+        program,
+        SYMMETRIC,
+        21,
+        &SYMMETRIC_KEY,
+        Some(&SYMMETRIC_DATA),
+        symmetric,
+    )
 }
 fn declare(
     program: &mut Program<'_>,
     name: &str,
     id: u32,
-    fields: &[u32],
-    data: Option<u32>,
+    fields: &[Field],
+    data: Option<&[Field]>,
     elements: Vec<IntervalElement>,
 ) -> Result<()> {
     keys::interval(program, name, id, fields, data, elements).map(|_| ())
@@ -217,6 +248,7 @@ fn admissions(
     program: &mut Program<'_>,
     hop: &Hop<'_>,
     set: &str,
+    key: &[Field],
     protocols: &BTreeSet<&str>,
     fixed_incoming: bool,
     loads: fn(bool) -> Loads,
@@ -233,7 +265,7 @@ fn admissions(
         result
     };
     let mut established = envelope(false, 2);
-    established.extend(loads(false).lookup(set));
+    established.extend(loads(false).lookup(set, key)?);
     program.end("forward", established, 1)?;
     for transport in protocols {
         let mut opening = envelope(false, 8);
@@ -241,11 +273,11 @@ fn admissions(
         if *transport == "tcp" {
             opening.extend(opening_tcp());
         }
-        opening.extend(loads(false).lookup(set));
+        opening.extend(loads(false).lookup(set, key)?);
         program.end("forward", opening, 1)?;
     }
     let mut reply = envelope(true, 2);
-    reply.extend(loads(true).lookup(set));
+    reply.extend(loads(true).lookup(set, key)?);
     program.end("forward", reply, 1)
 }
 fn protocols<'a>(hop: &Hop<'a>, symmetric: bool) -> BTreeSet<&'a str> {
@@ -262,6 +294,7 @@ pub(super) fn inbound(program: &mut Program<'_>, hop: &Hop<'_>) -> Result<()> {
         program,
         hop,
         FORWARD,
+        &INBOUND_KEY,
         &protocols(hop, false),
         true,
         inbound_loads,
@@ -275,6 +308,7 @@ pub(super) fn symmetric(program: &mut Program<'_>, hop: &Hop<'_>) -> Result<()>
         program,
         hop,
         SYMMETRIC,
+        &SYMMETRIC_KEY,
         &protocols(hop, true),
         false,
         symmetric_loads,
@@ -317,7 +351,7 @@ pub(super) fn translations(program: &mut Program<'_>, hop: &Hop<'_>) -> Result<(
     ] {
         if present {
             let mut expressions = tracked(hop.fixed, true);
-            expressions.extend(translation_loads().map(set));
+            expressions.extend(translation_loads().map(set, &TRANSLATION_KEY)?);
             expressions.push(nat(1, ports));
             program.rule("pre", expressions)?;
         }
@@ -329,7 +363,7 @@ pub(super) fn translations(program: &mut Program<'_>, hop: &Hop<'_>) -> Result<(
 pub(super) fn symmetric_translation(program: &mut Program<'_>, hop: &Hop<'_>) -> Result<()> {
     if hop.publications.iter().any(|item| item.symmetric) {
         let mut expressions = tracked(hop.fixed, false);
-        expressions.extend(symmetric_loads(false).map(SYMMETRIC));
+        expressions.extend(symmetric_loads(false).map(SYMMETRIC, &SYMMETRIC_KEY)?);
         expressions.push(nat(0, 2));
         program.rule("post", expressions)?;
     }
@@ -343,11 +377,8 @@ pub(super) fn arrival(program: &mut Program<'_>, hop: &Hop<'_>) -> Result<()> {
         let mut expressions = ipv4();
         expressions.extend(link(hop.fixed, true));
         let mut loads = Loads::new();
-        loads
-            .push(|index| meta_to(16, index), PROTOCOL)
-            .address(false)
-            .port(false);
-        expressions.extend(loads.lookup(ARRIVAL));
+        loads.protocol().address(false).port(false);
+        expressions.extend(loads.lookup(ARRIVAL, &ARRIVAL_KEY)?);
         program.end("raw_return", expressions, 1)?;
     }
     Ok(())
@@ -358,12 +389,8 @@ pub(super) fn endpoint(program: &mut Program<'_>, hop: &Hop<'_>) -> Result<()> {
     if !hop.publications.is_empty() {
         let mut expressions = ipv4();
         let mut loads = Loads::new();
-        loads
-            .link(true)
-            .push(|index| meta_to(16, index), PROTOCOL)
-            .address(true)
-            .port(true);
-        expressions.extend(loads.lookup(ENDPOINT));
+        loads.link(true).protocol().address(true).port(true);
+        expressions.extend(loads.lookup(ENDPOINT, &ENDPOINT_KEY)?);
         program.end("raw_in", expressions, 1)?;
     }
     Ok(())