@push.rocks/smartnftables 4.4.0 → 4.5.0

package/rust/src/egress.router.rs

@@ -57,7 +57,7 @@ fn host_grant_return(program: &mut Program<'_>, scope: &RouterScope) -> Result<(
     if !scope.host_grants.is_empty() {
         let mut expressions = ipv4();
         expressions.extend(link(&scope.handoff, true));
-        expressions.extend(hostgrant::arrival_lookup());
+        expressions.extend(hostgrant::arrival_lookup()?);
         program.end("raw_return", expressions, 1)?;
     }
     Ok(())

package/rust/src/egress.rs

@@ -1344,6 +1344,14 @@ impl Prepared {
     pub fn program(&self, table: &str) -> Result<Vec<(u16, Vec<crate::wire::Attr>)>> {
         compile::compile(self, table)
     }
+    /// Every set the compiled graph declares, with its key and data fields.
+    #[cfg(test)]
+    pub(crate) fn declared(
+        &self,
+        table: &str,
+    ) -> Result<std::collections::BTreeMap<String, compile::SetDeclaration>> {
+        compile::declared(self, table)
+    }
     pub fn validate_interfaces(&self) -> Result<()> {
         let links: Vec<&LocalLink> = match &self.policy.scope {
             Scope::RouterEgress(scope) => scope

package/rust/src/egress.workloadgrant.rs

@@ -6,7 +6,8 @@
 //! exact link that holds it (index and name), and both the incoming and the
 //! outgoing link are looked up on every packet. Only the grant's source opens;
 //! the destination only answers.
-use super::hostgrant::{lookup, meta_to, payload_to, tuple_key, tuple_lookup};
+use super::hostgrant::{tuple_key, tuple_lookup, TUPLE};
+use super::keys::{Field, Loads, IIF, IIFNAME, IP_SADDR};
 use super::*;
 use std::collections::BTreeSet;
 
@@ -14,16 +15,16 @@ use std::collections::BTreeSet;
 pub(super) const TUPLE_SET: &str = "workload_grant";
 /// Every grant address with the exact link that holds it.
 pub(super) const LINK_SET: &str = "workload_link";
+/// A grant address and its link, as the incoming direction loads them.
+const LINK: [Field; 3] = [IIF, IIFNAME, IP_SADDR];
 
 /// The link a packet crosses and the address on its side of that link: the
 /// incoming link and the source, or the outgoing link and the destination.
-fn link_lookup(incoming: bool) -> Vec<Attr> {
-    vec![
-        meta_to(if incoming { 4 } else { 5 }, 4),
-        meta_to(if incoming { 6 } else { 7 }, 5),
-        payload_to(1, if incoming { 12 } else { 16 }, 4, 9),
-        lookup(LINK_SET),
-    ]
+fn link_lookup(incoming: bool) -> Result<Vec<Attr>> {
+    Loads::new()
+        .link(incoming)
+        .address(incoming)
+        .lookup(LINK_SET, &LINK)
 }
 fn link_key(link: &LocalLink, address: &str) -> Result<Vec<u8>> {
     let mut key = link.interface_index.to_ne_bytes().to_vec();
@@ -49,9 +50,9 @@ pub(super) fn sets(program: &mut Program<'_>, scope: &RouterScope) -> Result<()>
             )?);
         }
     }
-    program.set(TUPLE_SET, 3, 32)?;
+    program.exact_set(TUPLE_SET, 3, &TUPLE, None)?;
     program.elements(TUPLE_SET, keys)?;
-    program.set(LINK_SET, 4, 24)?;
+    program.exact_set(LINK_SET, 4, &LINK, None)?;
     program.elements(LINK_SET, links.into_iter().collect())
 }
 
@@ -64,25 +65,26 @@ pub(super) fn admissions(program: &mut Program<'_>, scope: &RouterScope) -> Resu
     if scope.workload_grants.is_empty() {
         return Ok(());
     }
-    let admission = |reply: bool, connection_state: u32, transport: Option<&str>| {
-        let mut result = ipv4();
-        result.extend(ct(17, None, 0_u16.to_ne_bytes().to_vec()));
-        result.extend(ct(1, None, vec![u8::from(reply)]));
-        result.extend(state(connection_state));
-        if let Some(transport) = transport {
-            result.extend(meta(16, vec![protocol(transport)]));
-            if transport == "tcp" {
-                result.extend(opening_tcp());
+    let admission =
+        |reply: bool, connection_state: u32, transport: Option<&str>| -> Result<Vec<Attr>> {
+            let mut result = ipv4();
+            result.extend(ct(17, None, 0_u16.to_ne_bytes().to_vec()));
+            result.extend(ct(1, None, vec![u8::from(reply)]));
+            result.extend(state(connection_state));
+            if let Some(transport) = transport {
+                result.extend(meta(16, vec![protocol(transport)]));
+                if transport == "tcp" {
+                    result.extend(opening_tcp());
+                }
             }
-        }
-        result.extend(link_lookup(true));
-        result.extend(link_lookup(false));
-        result.extend(tuple_lookup(TUPLE_SET, false, reply));
-        result
-    };
-    program.end("forward", admission(false, 2, None), 1)?;
+            result.extend(link_lookup(true)?);
+            result.extend(link_lookup(false)?);
+            result.extend(tuple_lookup(TUPLE_SET, false, reply)?);
+            Ok(result)
+        };
+    program.end("forward", admission(false, 2, None)?, 1)?;
     for transport in ["udp", "tcp"] {
-        program.end("forward", admission(false, 8, Some(transport)), 1)?;
+        program.end("forward", admission(false, 8, Some(transport))?, 1)?;
     }
-    program.end("forward", admission(true, 2, None), 1)
+    program.end("forward", admission(true, 2, None)?, 1)
 }

package/rust/src/egress_keys_tests.rs

@@ -0,0 +1,150 @@
+//! Set declarations against what nftables 1.0.9 itself writes. Each expected
+//! value was dumped from `nft --debug=mnl add set|map ...` with the host nft
+//! 1.0.9 (libnftnl 1.2.6) on x86_64; userdata numbers are host byte order.
+use super::*;
+
+fn hex(text: &str) -> Vec<u8> {
+    let digits: String = text.split_whitespace().collect();
+    (0..digits.len())
+        .step_by(2)
+        .map(|at| u8::from_str_radix(&digits[at..at + 2], 16).unwrap())
+        .collect()
+}
+
+/// `typeof ip saddr . th dport . ct original ip saddr . ct zone`
+#[test]
+#[cfg(target_endian = "little")]
+fn concatenated_key_types_and_userdata_are_nfts() {
+    let key = [IP_SADDR, TH_DPORT, CT_ORIGINAL_SADDR, CT_ZONE];
+    assert_eq!(datatype(&key), 0x001c_d1c4);
+    assert_eq!(key_length(&key), 16);
+    assert_eq!(
+        userdata(&key, None).unwrap(),
+        hex("00 04 00000000 03 60 00 04 0d000000 01 58
+             00 14 00 04 07000000 01 0c 00 04 0c000000 01 04 0b000000
+             01 14 00 04 07000000 01 0c 00 04 0b000000 01 04 02000000
+             02 14 00 04 0c000000 01 0c 00 04 13000000 01 04 00000000
+             03 14 00 04 0c000000 01 0c 00 04 11000000 01 04 ffffffff")
+    );
+    // `typeof meta oif . meta oifname . ct reply ip saddr . ct reply proto-src`
+    let key = [OIF, OIFNAME, CT_REPLY_SADDR, CT_REPLY_SPORT];
+    assert_eq!(datatype(&key), 0x0052_91cd);
+    assert_eq!(key_length(&key), 28);
+    assert_eq!(
+        userdata(&key, None).unwrap(),
+        hex("00 04 00000000 03 54 00 04 0d000000 01 4c
+             00 0e 00 04 09000000 01 06 00 04 05000000
+             01 0e 00 04 09000000 01 06 00 04 07000000
+             02 14 00 04 0c000000 01 0c 00 04 13000000 01 04 01000000
+             03 14 00 04 0c000000 01 0c 00 04 0b000000 01 04 01000000")
+    );
+}
+
+/// `typeof meta l4proto . ct protocol . ip daddr : ip saddr . th sport . th dport`
+/// and `typeof ct zone : ct label`.
+#[test]
+#[cfg(target_endian = "little")]
+fn map_data_types_and_userdata_are_nfts() {
+    let key = [L4PROTO, CT_PROTOCOL, IP_DADDR];
+    let data = [IP_SADDR, TH_SPORT, TH_DPORT];
+    assert_eq!(datatype(&key), 0xc307);
+    assert_eq!(datatype(&data), 0x734d);
+    assert_eq!((key_length(&key), data_length(&data)), (12, 12));
+    assert_eq!(
+        userdata(&key, Some(&data)).unwrap(),
+        hex("00 04 00000000 01 04 00000000
+             03 44 00 04 0d000000 01 3c
+             00 0e 00 04 09000000 01 06 00 04 10000000
+             01 14 00 04 0c000000 01 0c 00 04 0a000000 01 04 ffffffff
+             02 14 00 04 07000000 01 0c 00 04 0c000000 01 04 0c000000
+             04 4a 00 04 0d000000 01 42
+             00 14 00 04 07000000 01 0c 00 04 0c000000 01 04 0b000000
+             01 14 00 04 07000000 01 0c 00 04 0b000000 01 04 01000000
+             02 14 00 04 07000000 01 0c 00 04 0b000000 01 04 02000000
+             06 04 00000000")
+    );
+    let (key, data) = ([CT_ZONE], [CT_LABEL]);
+    assert_eq!((datatype(&key), datatype(&data)), (4, 30));
+    assert_eq!(data_length(&data), 16);
+    assert_eq!(
+        userdata(&key, Some(&data)).unwrap(),
+        hex("00 04 01000000 01 04 01000000
+             03 14 00 04 0c000000 01 0c 00 04 11000000 01 04 ffffffff
+             04 14 00 04 0c000000 01 0c 00 04 0d000000 01 04 ffffffff
+             06 04 00000000")
+    );
+    // nft declares the zone alone as its 2 bytes; this map keeps the zone
+    // padded to its register, as every release before typed sets did.
+    assert_eq!(key_length(&key), 4);
+}
+
+/// Beyond four fields nft 1.0.9 cannot describe a key by `typeof`: its
+/// concatenation userdata stops at `NFT_REG32_SIZE` (4) entries, and the type
+/// keeps 32 bits, six per field, dropping what a longer key shifts out.
+#[test]
+fn longer_keys_carry_their_type_and_byte_order_alone() {
+    let key = [IIF, L4PROTO, IP_SADDR, IP_DADDR, TH_DPORT];
+    assert_eq!(
+        datatype(&key),
+        (20 << 24) | (12 << 18) | (7 << 12) | (7 << 6) | 13
+    );
+    assert_eq!(userdata(&key, None).unwrap(), hex("00 04 00000000"));
+    let flow = [
+        IIF,
+        L4PROTO,
+        CT_PROTOCOL,
+        IP_SADDR,
+        IP_DADDR,
+        TH_DPORT,
+        CT_ORIGINAL_SADDR,
+        CT_ORIGINAL_DADDR,
+        CT_ORIGINAL_DPORT,
+        CT_ZONE,
+    ];
+    let truncated = flow.iter().fold(0_u64, |result, field| {
+        (result << 6) | u64::from(field.datatype)
+    });
+    assert_eq!(u64::from(datatype(&flow)), truncated & u64::from(u32::MAX));
+    let data = [IP_SADDR, TH_SPORT, TH_SPORT];
+    let mut expected = hex("00 04 00000000 01 04 00000000");
+    expected.extend(hex("04 4a 00 04 0d000000 01 42
+         00 14 00 04 07000000 01 0c 00 04 0c000000 01 04 0b000000
+         01 14 00 04 07000000 01 0c 00 04 0b000000 01 04 01000000
+         02 14 00 04 07000000 01 0c 00 04 0b000000 01 04 01000000
+         06 04 00000000"));
+    #[cfg(target_endian = "little")]
+    assert_eq!(userdata(&flow, Some(&data)).unwrap(), expected);
+}
+
+/// A lookup loads every field of the set's key, by length and type; the other
+/// direction's field of the same kind fits, anything else refuses.
+#[test]
+fn lookups_must_fit_the_declared_key() {
+    let declared = [IIF, IIFNAME, IP_SADDR];
+    assert!(Loads::new()
+        .link(true)
+        .address(true)
+        .lookup("s", &declared)
+        .is_ok());
+    assert!(Loads::new()
+        .link(false)
+        .address(false)
+        .lookup("s", &declared)
+        .is_ok());
+    assert_eq!(
+        Loads::new().link(true).port(true).lookup("s", &declared),
+        Err(Error::Invalid)
+    );
+    assert_eq!(
+        Loads::new().link(true).lookup("s", &declared),
+        Err(Error::Invalid)
+    );
+    assert_eq!(
+        Loads::new()
+            .index(true)
+            .address(true)
+            .address(true)
+            .lookup("s", &declared),
+        Err(Error::Invalid)
+    );
+}

package/rust/src/egress_tests.rs

@@ -507,8 +507,27 @@ fn prepared(value: Value) -> Prepared {
     normalized(value).unwrap().prepare().unwrap()
 }
 fn program_bytes(prepared: &Prepared, table: &str) -> Vec<u8> {
+    encoded(prepared.program(table).unwrap())
+}
+/// LEGACY(<=4.4.x): the program as releases before typed sets compiled it,
+/// whose goldens it must still reproduce byte for byte, so their kernel graphs
+/// stay adoptable.
+fn untyped_program_bytes(prepared: &Prepared, table: &str) -> Vec<u8> {
+    encoded(
+        prepared
+            .program(table)
+            .unwrap()
+            .into_iter()
+            .map(|(kind, attributes)| match kind {
+                9 => (kind, crate::owner::untyped_set(&attributes)),
+                _ => (kind, attributes),
+            })
+            .collect(),
+    )
+}
+fn encoded(program: Vec<(u16, Vec<crate::wire::Attr>)>) -> Vec<u8> {
     let mut bytes = Vec::new();
-    for (kind, attributes) in prepared.program(table).unwrap() {
+    for (kind, attributes) in program {
         let encoded = crate::wire::encode_attrs(&attributes);
         bytes.extend(kind.to_be_bytes());
         bytes.extend((encoded.len() as u32).to_be_bytes());
@@ -606,12 +625,20 @@ fn host_v2_published_ports_compile_uplink_dnat_and_exact_forward_admission() {
     for (_, expressions) in &forward[..4] {
         assert_eq!(expressions[expressions.len() - 2], "lookup");
     }
-    let bytes = program_bytes(&published, "snft_v2_host_golden");
+    // The graph of 4.4.x, byte for byte, once its sets are untyped again.
+    let bytes = untyped_program_bytes(&published, "snft_v2_host_golden");
     assert_eq!(bytes.len(), 30988);
     assert_eq!(
         format!("{:x}", Sha256::digest(&bytes)),
         "b36f359c6439e9fcd77c291c7dac7854014225d3de1f8a4e49df6fec6ae570c4"
     );
+    // Re-frozen with typed sets in 4.5.0.
+    let bytes = program_bytes(&published, "snft_v2_host_golden");
+    assert_eq!(bytes.len(), 31168);
+    assert_eq!(
+        format!("{:x}", Sha256::digest(&bytes)),
+        "609f2388e3c5cf45b921182c17252c072c4db2f07e3cc605e282faddd937d458"
+    );
 }
 
 #[test]
@@ -724,12 +751,20 @@ fn router_v2_without_published_ports_keeps_its_exact_digest_and_compiled_bytes()
     );
     // Re-frozen with the set-backed router graph of 3.0.0: the digest is the
     // policy's and did not change, the compiled graph did.
-    let bytes = program_bytes(&baseline, "snft_v2_router_golden");
+    // The graph of 4.4.x, byte for byte, once its sets are untyped again.
+    let bytes = untyped_program_bytes(&baseline, "snft_v2_router_golden");
     assert_eq!(bytes.len(), 47674);
     assert_eq!(
         format!("{:x}", Sha256::digest(&bytes)),
         "ea609865f32031f6835ef4fc7f67f5754a15f466580308bdccc9db87d4ccd2c5"
     );
+    // Re-frozen with typed sets in 4.5.0.
+    let bytes = program_bytes(&baseline, "snft_v2_router_golden");
+    assert_eq!(bytes.len(), 48362);
+    assert_eq!(
+        format!("{:x}", Sha256::digest(&bytes)),
+        "47280ecb596125d6421b1ab42e2d768e53844f55d7d0f130fe31a8cd5b9a5668"
+    );
     let serialized = serde_json::to_string(&baseline.policy).unwrap();
     assert!(!serialized.contains("publishedPorts"));
     // An explicit empty publication is the same canonical policy, digest and graph.
@@ -796,12 +831,20 @@ fn router_v2_published_ports_compile_handoff_dnat_classification_and_admission()
     assert!(incoming[4..]
         .iter()
         .any(|expressions| expressions.contains(&"ct".to_string())));
-    let bytes = program_bytes(&published, "snft_v2_router_golden");
+    // The graph of 4.4.x, byte for byte, once its sets are untyped again.
+    let bytes = untyped_program_bytes(&published, "snft_v2_router_golden");
     assert_eq!(bytes.len(), 55494);
     assert_eq!(
         format!("{:x}", Sha256::digest(&bytes)),
         "60a7ba1c15d49e5ff54cfbf9fbe2d72f03973acd1a897eef2d975547ef4abf5b"
     );
+    // Re-frozen with typed sets in 4.5.0.
+    let bytes = program_bytes(&published, "snft_v2_router_golden");
+    assert_eq!(bytes.len(), 56454);
+    assert_eq!(
+        format!("{:x}", Sha256::digest(&bytes)),
+        "1d2a72707bc10ed689e3f9b4c1cb3e798e89c01fc97115078dcd32e891b22306"
+    );
 }
 
 #[test]

package/rust/src/owner.rs

@@ -302,7 +302,13 @@ impl Owner {
         }
         Ok(())
     }
+    /// Whether `graph` is `prepared`'s compiled graph. LEGACY(<=4.4.x): this
+    /// includes the untyped sets of a release before typed sets; with the next
+    /// major it becomes exact agreement alone.
     fn matches(&self, graph: &Graph, prepared: &Prepared) -> Result<bool> {
+        Ok(self.agreement(graph, prepared)? != Agreement::Different)
+    }
+    fn agreement(&self, graph: &Graph, prepared: &Prepared) -> Result<Agreement> {
         let program = prepared.program(&self.identity.table_name)?;
         let expected_chains: Vec<_> = program
             .iter()
@@ -336,21 +342,8 @@ impl Owner {
             }
             result
         };
-        // Element order is the set backend's; element keys are the identity.
-        let mut expected_sets = std::collections::BTreeMap::<String, (Vec<u8>, Vec<Vec<u8>>)>::new();
-        for (kind, attrs) in &program {
-            match kind {
-                9 => {
-                    expected_sets.insert(wire::text(attrs, 2)?, (set_identity(attrs)?, Vec::new()));
-                }
-                12 => {
-                    let entry = expected_sets
-                        .get_mut(&wire::text(attrs, 2)?)
-                        .ok_or(Error::Invalid)?;
-                    entry.1.extend(element_keys(&wire::attrs(&wire::one(attrs, 3)?.value)?)?);
-                }
-                _ => {}
-            }
+        if expected_chains != actual_chains || regroup(expected_rules) != regroup(actual_rules) {
+            return Ok(Agreement::Different);
         }
         let mut actual_sets = std::collections::BTreeMap::new();
         for (attrs, keys) in &graph.sets {
@@ -361,12 +354,22 @@ impl Owner {
                 return Err(Error::Conflict);
             }
         }
-        for entry in expected_sets.values_mut().chain(actual_sets.values_mut()) {
+        for entry in actual_sets.values_mut() {
             entry.1.sort();
         }
-        Ok(expected_chains == actual_chains
-            && regroup(expected_rules) == regroup(actual_rules)
-            && expected_sets == actual_sets)
+        if expected_sets(&program, false)? == actual_sets {
+            return Ok(Agreement::Exact);
+        }
+        // LEGACY(<=4.4.x): kernel state applied before typed sets carries every
+        // set with key and data type 0 and no userdata, which Linux stores and
+        // dumps but never interprets, so it enforces exactly the same graph.
+        // Such a graph is adopted, inspected and released as this graph, and
+        // reconciliation always replaces it. Remove with the next major.
+        Ok(if expected_sets(&program, true)? == actual_sets {
+            Agreement::Untyped
+        } else {
+            Agreement::Different
+        })
     }
     fn adopt(&mut self, graph: Graph, transition: &Transition) -> Result<Graph> {
         self.binding(&graph, transition.previous.as_ref())?;
@@ -464,13 +467,18 @@ impl Owner {
         let mut operations = Vec::new();
         let generation = if let Some(graph) = graph {
             let graph = self.adopt(graph, transition)?;
-            if self.matches(&graph, &transition.target)? {
+            let target = self.agreement(&graph, &transition.target)?;
+            if target == Agreement::Exact {
                 transition.target.validate_interfaces()?;
                 return self.applied(&graph, transition.target.clone());
             }
-            let previous = transition.previous.as_ref().ok_or(Error::Conflict)?;
-            if !self.matches(&graph, &previous.prepared)? {
-                return Err(Error::Conflict);
+            // LEGACY(<=4.4.x): the target's own untyped graph is never already
+            // applied; it is replaced like a previous graph, in the same batch.
+            if target == Agreement::Different {
+                let previous = transition.previous.as_ref().ok_or(Error::Conflict)?;
+                if !self.matches(&graph, &previous.prepared)? {
+                    return Err(Error::Conflict);
+                }
             }
             for rule in &graph.rules {
                 operations.push((
@@ -533,7 +541,7 @@ impl Owner {
         self.binding(&graph, transition.previous.as_ref())?;
         if wire::number(&graph.table, 2)? != 6
             || wire::number(&graph.table, 7)? != self.socket()?.port
-            || !self.matches(&graph, &transition.target)?
+            || self.agreement(&graph, &transition.target)? != Agreement::Exact
         {
             return Err(Error::Conflict);
         }
@@ -668,6 +676,61 @@ impl Owner {
     }
 }
 
+/// How a kernel graph agrees with a compiled one.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum Agreement {
+    /// Every chain, rule, set and element, with every set's types.
+    Exact,
+    /// LEGACY(<=4.4.x): the same graph with untyped sets. Remove with the next
+    /// major.
+    Untyped,
+    Different,
+}
+
+/// Sets by name, each with its identity and sorted element keys.
+type Sets = std::collections::BTreeMap<String, (Vec<u8>, Vec<Vec<u8>>)>;
+/// The compiled graph's sets. LEGACY(<=4.4.x): `untyped` declares them as a
+/// release before typed sets did; remove the parameter with the next major.
+fn expected_sets(program: &[(u16, Vec<Attr>)], untyped: bool) -> Result<Sets> {
+    // Element order is the set backend's; element keys are the identity.
+    let mut sets = Sets::new();
+    for (kind, attrs) in program {
+        match kind {
+            9 => {
+                let identity = if untyped {
+                    set_identity(&untyped_set(attrs))?
+                } else {
+                    set_identity(attrs)?
+                };
+                sets.insert(wire::text(attrs, 2)?, (identity, Vec::new()));
+            }
+            12 => {
+                let entry = sets
+                    .get_mut(&wire::text(attrs, 2)?)
+                    .ok_or(Error::Invalid)?;
+                entry.1.extend(element_keys(&wire::attrs(&wire::one(attrs, 3)?.value)?)?);
+            }
+            _ => {}
+        }
+    }
+    for entry in sets.values_mut() {
+        entry.1.sort();
+    }
+    Ok(sets)
+}
+/// LEGACY(<=4.4.x): a set declaration as releases before typed sets wrote it:
+/// key and data type 0 and no userdata. Remove with the next major.
+pub(super) fn untyped_set(attributes: &[Attr]) -> Vec<Attr> {
+    attributes
+        .iter()
+        .filter(|attribute| attribute.id() != 13)
+        .map(|attribute| match attribute.id() {
+            4 | 6 => Attr::u32(attribute.id(), 0),
+            _ => attribute.clone(),
+        })
+        .collect()
+}
+
 fn chain_identity(attributes: &[Attr]) -> Result<Vec<u8>> {
     let mut identity = Vec::new();
     for attribute in attributes {
@@ -681,9 +744,10 @@ fn chain_identity(attributes: &[Attr]) -> Result<Vec<u8>> {
     serde_json::to_vec(&wire::canonical(&identity, false)?).map_err(|_| Error::Protocol)
 }
 /// A set is its table, name, flags, key type and key length, a map's data type
-/// and length, and the field lengths of a concatenation. The handle, the
-/// informational backend type and count, the transaction ID and an empty
-/// description are not identity; anything else rejects.
+/// and length, the field lengths of a concatenation and its userdata (byte
+/// orders and `typeof` descriptions). The handle, the informational backend
+/// type and count, the transaction ID and an empty description are not
+/// identity; anything else rejects.
 fn set_identity(attributes: &[Attr]) -> Result<Vec<u8>> {
     let mut identity = Vec::new();
     for attribute in attributes {
@@ -694,13 +758,17 @@ fn set_identity(attributes: &[Attr]) -> Result<Vec<u8>> {
                     identity.push(Attr::bytes(9, fields));
                 }
             }
-            1..=7 => identity.push(attribute.clone()),
+            1..=7 | 13 => identity.push(attribute.clone()),
             _ => return Err(Error::Conflict),
         }
     }
     for id in [1, 2, 3, 4, 5] {
         wire::one(&identity, id)?;
     }
+    // At most one userdata: a typed set carries it, a legacy untyped one not.
+    if identity.iter().filter(|attribute| attribute.id() == 13).count() > 1 {
+        return Err(Error::Conflict);
+    }
     // A map carries its data type and length, and nothing else does.
     let map = wire::number(&identity, 3)? & 8 != 0;
     for id in [6, 7] {