Implement canonical network readiness derivation

crates/lazaret-core/src/lib.rs

@@ -3,6 +3,7 @@
 pub mod codec;
 pub mod configuration;
 pub mod identity;
+pub mod network;
 pub mod protocol;
 pub mod records;
 

crates/lazaret-core/src/network.rs

@@ -0,0 +1,642 @@
+use std::collections::{BTreeMap, BTreeSet};
+use std::fmt;
+
+use sha2::{Digest, Sha256};
+
+use crate::codec::{CodecError, encode};
+use crate::configuration::ResolvedDomainConfiguration;
+use crate::identity::{
+    ConfigurationFingerprint, DerivedPolicyDigest, DomainId, GenerationId, NamespaceIdentity,
+    NetworkSidecarId, PidfsProcessIdentityV1, ReadinessFingerprint,
+};
+use crate::records::{
+    AddressFamily, AddressFamilyDisposition, AddressFamilyDispositionValue,
+    DERIVED_NETWORK_POLICY_SCHEMA_ID, DefaultAction, DerivedNetworkPolicy,
+    DerivedNetworkPolicyFields, IpAddress, IpNetwork, NETWORK_READINESS_IDENTITY_SCHEMA_ID,
+    NetworkObservation, NetworkReachabilityProbe, NetworkReadinessAttestation,
+    NetworkReadinessEvidence, NetworkReadinessIdentity, NetworkReadinessIdentityFields,
+    PolicyAction, PolicyDelivery, PrefixRule, Resolver,
+};
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct CanonicalDerivedNetworkPolicy {
+    policy: DerivedNetworkPolicy,
+    canonical_bytes: Vec<u8>,
+    digest: DerivedPolicyDigest,
+}
+
+impl CanonicalDerivedNetworkPolicy {
+    #[must_use]
+    pub const fn policy(&self) -> &DerivedNetworkPolicy {
+        &self.policy
+    }
+
+    #[must_use]
+    pub fn canonical_bytes(&self) -> &[u8] {
+        &self.canonical_bytes
+    }
+
+    #[must_use]
+    pub const fn digest(&self) -> DerivedPolicyDigest {
+        self.digest
+    }
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct ReachabilityExpectation {
+    pub denied_destinations: Vec<IpAddress>,
+    pub permitted_destinations: Vec<IpAddress>,
+    pub dns_queries: Vec<DnsQueryExpectation>,
+}
+
+#[derive(Clone, Debug, Eq, Ord, PartialEq, PartialOrd)]
+pub struct DnsQueryExpectation {
+    pub resolver: IpAddress,
+    pub query_name: String,
+}
+
+#[derive(Clone, Debug)]
+pub struct ReadinessExpectation<'a> {
+    pub domain_id: DomainId,
+    pub generation_id: GenerationId,
+    pub configuration_fingerprint: ConfigurationFingerprint,
+    pub network_sidecar_id: NetworkSidecarId,
+    pub enforcement_namespace: NamespaceIdentity,
+    pub runtime_supervisor: &'a PidfsProcessIdentityV1,
+    pub connectivity_helper: &'a PidfsProcessIdentityV1,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum NetworkValidationErrorKind {
+    AddressFamilies,
+    DefaultActions,
+    Prefix,
+    PrefixConflict,
+    Resolver,
+    CanonicalEncoding,
+    Attestation,
+    Reachability,
+    Evidence,
+}
+
+#[derive(Debug)]
+pub struct NetworkValidationError {
+    kind: NetworkValidationErrorKind,
+    detail: &'static str,
+}
+
+impl NetworkValidationError {
+    const fn new(kind: NetworkValidationErrorKind, detail: &'static str) -> Self {
+        Self { kind, detail }
+    }
+
+    #[must_use]
+    pub const fn kind(&self) -> NetworkValidationErrorKind {
+        self.kind
+    }
+}
+
+impl fmt::Display for NetworkValidationError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(formatter, "{}", self.detail)
+    }
+}
+
+impl std::error::Error for NetworkValidationError {}
+
+impl From<CodecError> for NetworkValidationError {
+    fn from(_: CodecError) -> Self {
+        Self::new(
+            NetworkValidationErrorKind::CanonicalEncoding,
+            "network document cannot be canonically encoded",
+        )
+    }
+}
+
+/// Derives the v1 policy from one resolved trusted-host configuration.
+///
+/// # Errors
+///
+/// Returns an error when resolver or canonical policy validation fails.
+pub fn derive_ipv4_policy(
+    configuration: &ResolvedDomainConfiguration,
+    resolvers: impl IntoIterator<Item = IpAddress>,
+) -> Result<CanonicalDerivedNetworkPolicy, NetworkValidationError> {
+    let prefix_rules = configuration
+        .effective_allow_prefixes()
+        .iter()
+        .map(|prefix| PrefixRule {
+            family: AddressFamily::Ipv4,
+            network: IpNetwork {
+                address: IpAddress::V4(prefix.address()),
+                prefix_length: prefix.prefix_length(),
+            },
+            action: PolicyAction::Allow,
+        })
+        .chain(
+            configuration
+                .effective_deny_prefixes()
+                .iter()
+                .map(|prefix| PrefixRule {
+                    family: AddressFamily::Ipv4,
+                    network: IpNetwork {
+                        address: IpAddress::V4(prefix.address()),
+                        prefix_length: prefix.prefix_length(),
+                    },
+                    action: PolicyAction::Deny,
+                }),
+        )
+        .collect();
+    derive_policy(DerivedNetworkPolicyFields {
+        address_families: vec![
+            AddressFamilyDisposition {
+                family: AddressFamily::Ipv4,
+                disposition: AddressFamilyDispositionValue::Enabled,
+            },
+            AddressFamilyDisposition {
+                family: AddressFamily::Ipv6,
+                disposition: AddressFamilyDispositionValue::Disabled,
+            },
+        ],
+        default_actions: vec![DefaultAction {
+            family: AddressFamily::Ipv4,
+            action: PolicyAction::Allow,
+        }],
+        prefix_rules,
+        resolvers: resolvers
+            .into_iter()
+            .map(|address| Resolver {
+                family: AddressFamily::Ipv4,
+                address,
+            })
+            .collect(),
+    })
+}
+
+/// Validates, normalizes, and fingerprints a derived policy document.
+///
+/// # Errors
+///
+/// Returns an error for an invalid family, prefix, resolver, conflict, or encoding.
+pub fn derive_policy(
+    mut fields: DerivedNetworkPolicyFields,
+) -> Result<CanonicalDerivedNetworkPolicy, NetworkValidationError> {
+    validate_address_families(&fields.address_families)?;
+    validate_default_actions(&fields.default_actions)?;
+    validate_prefix_rules(&fields.prefix_rules)?;
+    validate_resolvers(&fields.resolvers)?;
+
+    fields
+        .address_families
+        .sort_unstable_by_key(|item| item.family);
+    fields
+        .default_actions
+        .sort_unstable_by_key(|item| item.family);
+    fields.prefix_rules.sort_unstable();
+    fields.resolvers.sort_unstable();
+
+    let policy = DerivedNetworkPolicy::v1(fields);
+    let canonical_bytes = encode(&policy)?;
+    let digest = domain_digest(DERIVED_NETWORK_POLICY_SCHEMA_ID, &canonical_bytes);
+    Ok(CanonicalDerivedNetworkPolicy {
+        policy,
+        canonical_bytes,
+        digest: DerivedPolicyDigest::new(digest),
+    })
+}
+
+#[must_use]
+pub fn readiness_identity(attestation: &NetworkReadinessAttestation) -> NetworkReadinessIdentity {
+    NetworkReadinessIdentity::v1(NetworkReadinessIdentityFields {
+        domain_id: attestation.domain_id,
+        generation_id: attestation.generation_id,
+        configuration_fingerprint: attestation.configuration_fingerprint,
+        network_sidecar_id: attestation.network_sidecar_id,
+        derived_policy_digest: attestation.derived_policy_digest,
+        enforcement_namespace: attestation.enforcement_namespace,
+    })
+}
+
+/// Encodes the v1 readiness identity in its canonical form.
+///
+/// # Errors
+///
+/// Returns an error when canonical encoding fails.
+pub fn canonical_readiness_identity_bytes(
+    identity: &NetworkReadinessIdentity,
+) -> Result<Vec<u8>, NetworkValidationError> {
+    Ok(encode(identity)?)
+}
+
+/// Computes the domain-separated readiness fingerprint.
+///
+/// # Errors
+///
+/// Returns an error when canonical identity encoding fails.
+pub fn readiness_fingerprint(
+    identity: &NetworkReadinessIdentity,
+) -> Result<ReadinessFingerprint, NetworkValidationError> {
+    let canonical_bytes = canonical_readiness_identity_bytes(identity)?;
+    Ok(ReadinessFingerprint::new(domain_digest(
+        NETWORK_READINESS_IDENTITY_SCHEMA_ID,
+        &canonical_bytes,
+    )))
+}
+
+/// Binds validated attestation and reachability results into readiness evidence.
+///
+/// # Errors
+///
+/// Returns an error for any identity, observation, policy, or probe mismatch.
+pub fn accept_network_readiness(
+    policy: &CanonicalDerivedNetworkPolicy,
+    expectation: &ReadinessExpectation<'_>,
+    attestation: NetworkReadinessAttestation,
+    reachability: NetworkReachabilityProbe,
+    expected_reachability: &ReachabilityExpectation,
+) -> Result<NetworkReadinessEvidence, NetworkValidationError> {
+    validate_attestation(policy, expectation, &attestation)?;
+    validate_reachability(
+        policy.policy(),
+        expectation,
+        &reachability,
+        expected_reachability,
+    )?;
+    let identity = readiness_identity(&attestation);
+    let fingerprint = readiness_fingerprint(&identity)?;
+    Ok(NetworkReadinessEvidence {
+        domain_id: expectation.domain_id,
+        generation_id: expectation.generation_id,
+        network_sidecar_id: expectation.network_sidecar_id,
+        readiness_fingerprint: fingerprint,
+        attestation,
+        readiness_identity: identity,
+        reachability_probe: reachability,
+    })
+}
+
+/// Revalidates persisted readiness evidence against current generation authority.
+///
+/// # Errors
+///
+/// Returns an error for any identity, projection, fingerprint, or probe mismatch.
+pub fn validate_network_readiness_evidence(
+    policy: &CanonicalDerivedNetworkPolicy,
+    expectation: &ReadinessExpectation<'_>,
+    evidence: &NetworkReadinessEvidence,
+    expected_reachability: &ReachabilityExpectation,
+) -> Result<(), NetworkValidationError> {
+    if evidence.domain_id != expectation.domain_id
+        || evidence.generation_id != expectation.generation_id
+        || evidence.network_sidecar_id != expectation.network_sidecar_id
+    {
+        return Err(NetworkValidationError::new(
+            NetworkValidationErrorKind::Evidence,
+            "network readiness evidence identity mismatch",
+        ));
+    }
+    validate_attestation(policy, expectation, &evidence.attestation)?;
+    let projected = readiness_identity(&evidence.attestation);
+    let fingerprint = readiness_fingerprint(&projected)?;
+    if evidence.readiness_identity != projected || evidence.readiness_fingerprint != fingerprint {
+        return Err(NetworkValidationError::new(
+            NetworkValidationErrorKind::Evidence,
+            "network readiness projection or fingerprint mismatch",
+        ));
+    }
+    validate_reachability(
+        policy.policy(),
+        expectation,
+        &evidence.reachability_probe,
+        expected_reachability,
+    )
+}
+
+fn validate_address_families(
+    dispositions: &[AddressFamilyDisposition],
+) -> Result<(), NetworkValidationError> {
+    let expected = BTreeMap::from([
+        (AddressFamily::Ipv4, AddressFamilyDispositionValue::Enabled),
+        (AddressFamily::Ipv6, AddressFamilyDispositionValue::Disabled),
+    ]);
+    let actual: BTreeMap<_, _> = dispositions
+        .iter()
+        .map(|item| (item.family, item.disposition))
+        .collect();
+    if dispositions.len() != expected.len() || actual != expected {
+        return Err(NetworkValidationError::new(
+            NetworkValidationErrorKind::AddressFamilies,
+            "v1 requires IPv4 enabled and IPv6 disabled exactly once",
+        ));
+    }
+    Ok(())
+}
+
+fn validate_default_actions(actions: &[DefaultAction]) -> Result<(), NetworkValidationError> {
+    if actions
+        != [DefaultAction {
+            family: AddressFamily::Ipv4,
+            action: PolicyAction::Allow,
+        }]
+    {
+        return Err(NetworkValidationError::new(
+            NetworkValidationErrorKind::DefaultActions,
+            "v1 requires one IPv4 default-allow action",
+        ));
+    }
+    Ok(())
+}
+
+fn validate_prefix_rules(rules: &[PrefixRule]) -> Result<(), NetworkValidationError> {
+    let mut actions = BTreeMap::new();
+    for rule in rules {
+        validate_network(rule.family, rule.network)?;
+        if rule.family != AddressFamily::Ipv4 {
+            return Err(NetworkValidationError::new(
+                NetworkValidationErrorKind::AddressFamilies,
+                "disabled address family has a prefix rule",
+            ));
+        }
+        match actions.insert((rule.family, rule.network), rule.action) {
+            Some(previous) if previous != rule.action => {
+                return Err(NetworkValidationError::new(
+                    NetworkValidationErrorKind::PrefixConflict,
+                    "equal prefix has conflicting actions",
+                ));
+            }
+            Some(_) => {
+                return Err(NetworkValidationError::new(
+                    NetworkValidationErrorKind::Prefix,
+                    "duplicate prefix rule",
+                ));
+            }
+            None => {}
+        }
+    }
+    for network in [
+        ([10, 0, 0, 0], 8),
+        ([172, 16, 0, 0], 12),
+        ([192, 168, 0, 0], 16),
+    ] {
+        let required = IpNetwork {
+            address: IpAddress::V4(network.0),
+            prefix_length: network.1,
+        };
+        if actions.get(&(AddressFamily::Ipv4, required)) != Some(&PolicyAction::Deny) {
+            return Err(NetworkValidationError::new(
+                NetworkValidationErrorKind::Prefix,
+                "v1 policy is missing a default private-network deny",
+            ));
+        }
+    }
+    Ok(())
+}
+
+fn validate_resolvers(resolvers: &[Resolver]) -> Result<(), NetworkValidationError> {
+    if resolvers.is_empty() {
+        return Err(NetworkValidationError::new(
+            NetworkValidationErrorKind::Resolver,
+            "derived policy requires a resolver",
+        ));
+    }
+    let mut seen = BTreeSet::new();
+    for resolver in resolvers {
+        if resolver.family != AddressFamily::Ipv4
+            || address_family(resolver.address) != resolver.family
+        {
+            return Err(NetworkValidationError::new(
+                NetworkValidationErrorKind::Resolver,
+                "resolver address family is disabled or mismatched",
+            ));
+        }
+        if !seen.insert(*resolver) {
+            return Err(NetworkValidationError::new(
+                NetworkValidationErrorKind::Resolver,
+                "duplicate resolver",
+            ));
+        }
+    }
+    Ok(())
+}
+
+fn validate_network(
+    family: AddressFamily,
+    network: IpNetwork,
+) -> Result<(), NetworkValidationError> {
+    if address_family(network.address) != family {
+        return Err(NetworkValidationError::new(
+            NetworkValidationErrorKind::Prefix,
+            "prefix address family mismatch",
+        ));
+    }
+    let (bytes, maximum) = match network.address {
+        IpAddress::V4(bytes) => (bytes.to_vec(), 32),
+        IpAddress::V6(bytes) => (bytes.to_vec(), 128),
+    };
+    if network.prefix_length > maximum || !is_network_address(&bytes, network.prefix_length) {
+        return Err(NetworkValidationError::new(
+            NetworkValidationErrorKind::Prefix,
+            "prefix is not a canonical network",
+        ));
+    }
+    Ok(())
+}
+
+fn is_network_address(bytes: &[u8], prefix_length: u8) -> bool {
+    let complete = usize::from(prefix_length / 8);
+    let remainder = prefix_length % 8;
+    if remainder != 0 && bytes[complete] & (u8::MAX >> remainder) != 0 {
+        return false;
+    }
+    let start = complete + usize::from(remainder != 0);
+    bytes[start..].iter().all(|byte| *byte == 0)
+}
+
+fn validate_attestation(
+    policy: &CanonicalDerivedNetworkPolicy,
+    expected: &ReadinessExpectation<'_>,
+    attestation: &NetworkReadinessAttestation,
+) -> Result<(), NetworkValidationError> {
+    if attestation.domain_id != expected.domain_id
+        || attestation.generation_id != expected.generation_id
+        || attestation.configuration_fingerprint != expected.configuration_fingerprint
+        || attestation.network_sidecar_id != expected.network_sidecar_id
+        || attestation.derived_policy_digest != policy.digest()
+        || attestation.enforcement_namespace != expected.enforcement_namespace
+        || attestation.runtime_supervisor != *expected.runtime_supervisor
+        || attestation.connectivity_helper != *expected.connectivity_helper
+        || !valid_observation(&attestation.observation)
+    {
+        return Err(NetworkValidationError::new(
+            NetworkValidationErrorKind::Attestation,
+            "network readiness attestation mismatch",
+        ));
+    }
+    for route in &attestation.observation.observed_routes {
+        validate_network(address_family(route.address), *route)?;
+    }
+    Ok(())
+}
+
+fn valid_observation(observation: &NetworkObservation) -> bool {
+    observation.policy_delivery == PolicyDelivery::SealedMemfd
+        && observation.helper_ready
+        && observation.routes_attested
+}
+
+fn validate_reachability(
+    policy: &DerivedNetworkPolicy,
+    expected: &ReadinessExpectation<'_>,
+    probe: &NetworkReachabilityProbe,
+    expected_results: &ReachabilityExpectation,
+) -> Result<(), NetworkValidationError> {
+    if probe.domain_id != expected.domain_id
+        || probe.generation_id != expected.generation_id
+        || probe.enforcement_namespace != expected.enforcement_namespace
+        || expected_results.denied_destinations.is_empty()
+        || expected_results.permitted_destinations.is_empty()
+        || expected_results.dns_queries.is_empty()
+    {
+        return reachability_error();
+    }
+
+    let denied = exact_observations(
+        &expected_results.denied_destinations,
+        &probe.denied_destinations,
+        |item| (item.destination, item.unreachable),
+    )?;
+    let permitted = exact_observations(
+        &expected_results.permitted_destinations,
+        &probe.permitted_destinations,
+        |item| (item.destination, item.reachable),
+    )?;
+    if denied.iter().any(|(_, passed)| !passed)
+        || permitted.iter().any(|(_, passed)| !passed)
+        || expected_results
+            .denied_destinations
+            .iter()
+            .any(|address| effective_action(policy, *address) != Some(PolicyAction::Deny))
+        || expected_results
+            .permitted_destinations
+            .iter()
+            .any(|address| effective_action(policy, *address) != Some(PolicyAction::Allow))
+    {
+        return reachability_error();
+    }
+
+    let expected_dns: BTreeSet<_> = expected_results.dns_queries.iter().cloned().collect();
+    let actual_dns: BTreeSet<_> = probe
+        .dns_observations
+        .iter()
+        .map(|item| DnsQueryExpectation {
+            resolver: item.resolver,
+            query_name: item.query_name.clone(),
+        })
+        .collect();
+    let resolvers: BTreeSet<_> = policy
+        .resolvers
+        .iter()
+        .map(|resolver| resolver.address)
+        .collect();
+    if expected_dns.len() != expected_results.dns_queries.len()
+        || actual_dns.len() != probe.dns_observations.len()
+        || actual_dns != expected_dns
+        || probe.dns_observations.iter().any(|item| {
+            item.query_name.is_empty()
+                || !resolvers.contains(&item.resolver)
+                || item.resolved_addresses.is_empty()
+                || item
+                    .resolved_addresses
+                    .iter()
+                    .any(|address| address_family(*address) != AddressFamily::Ipv4)
+        })
+    {
+        return reachability_error();
+    }
+    Ok(())
+}
+
+fn exact_observations<T, F>(
+    expected: &[IpAddress],
+    actual: &[T],
+    project: F,
+) -> Result<BTreeSet<(IpAddress, bool)>, NetworkValidationError>
+where
+    F: Fn(&T) -> (IpAddress, bool),
+{
+    let expected_items: BTreeSet<_> = expected.iter().copied().collect();
+    let actual_items: BTreeSet<_> = actual.iter().map(project).collect();
+    let actual_addresses: BTreeSet<_> = actual_items.iter().map(|(address, _)| *address).collect();
+    if expected_items.len() != expected.len()
+        || actual_items.len() != actual.len()
+        || expected_items.len() != actual_items.len()
+        || expected_items.len() != actual_addresses.len()
+        || actual_addresses != expected_items
+    {
+        return reachability_error();
+    }
+    Ok(actual_items)
+}
+
+fn effective_action(policy: &DerivedNetworkPolicy, address: IpAddress) -> Option<PolicyAction> {
+    let family = address_family(address);
+    let disposition = policy
+        .address_families
+        .iter()
+        .find(|item| item.family == family)?;
+    if disposition.disposition != AddressFamilyDispositionValue::Enabled {
+        return None;
+    }
+    policy
+        .prefix_rules
+        .iter()
+        .filter(|rule| rule.family == family && network_contains(rule.network, address))
+        .max_by_key(|rule| rule.network.prefix_length)
+        .map(|rule| rule.action)
+        .or_else(|| {
+            policy
+                .default_actions
+                .iter()
+                .find(|item| item.family == family)
+                .map(|item| item.action)
+        })
+}
+
+fn network_contains(network: IpNetwork, address: IpAddress) -> bool {
+    let prefix_length = network.prefix_length;
+    let (network, address) = match (network.address, address) {
+        (IpAddress::V4(network), IpAddress::V4(address)) => (network.to_vec(), address.to_vec()),
+        (IpAddress::V6(network), IpAddress::V6(address)) => (network.to_vec(), address.to_vec()),
+        _ => return false,
+    };
+    let complete = usize::from(prefix_length / 8);
+    let remainder = prefix_length % 8;
+    if network[..complete] != address[..complete] {
+        return false;
+    }
+    remainder == 0
+        || network[complete] & (u8::MAX << (8 - remainder))
+            == address[complete] & (u8::MAX << (8 - remainder))
+}
+
+const fn address_family(address: IpAddress) -> AddressFamily {
+    match address {
+        IpAddress::V4(_) => AddressFamily::Ipv4,
+        IpAddress::V6(_) => AddressFamily::Ipv6,
+    }
+}
+
+fn domain_digest(schema_id: &str, canonical_bytes: &[u8]) -> [u8; 32] {
+    let mut hasher = Sha256::new();
+    hasher.update(schema_id.as_bytes());
+    hasher.update([0]);
+    hasher.update(canonical_bytes);
+    hasher.finalize().into()
+}
+
+fn reachability_error<T>() -> Result<T, NetworkValidationError> {
+    Err(NetworkValidationError::new(
+        NetworkValidationErrorKind::Reachability,
+        "network reachability evidence mismatch",
+    ))
+}

crates/lazaret-core/src/records/network.rs

@@ -3,56 +3,56 @@ use super::{
     NamespaceIdentity, NetworkSidecarId, PidfsProcessIdentityV1, ReadinessFingerprint, Serialize,
 };
 
-#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)]
 pub enum AddressFamily {
     Ipv4,
     Ipv6,
 }
 
-#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)]
 pub enum AddressFamilyDispositionValue {
     Enabled,
     Disabled,
 }
 
-#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)]
 pub struct AddressFamilyDisposition {
     pub family: AddressFamily,
     pub disposition: AddressFamilyDispositionValue,
 }
 
-#[derive(Clone, Copy, Debug, Deserialize, Eq, Hash, PartialEq, Serialize)]
+#[derive(Clone, Copy, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
 pub enum IpAddress {
     V4([u8; 4]),
     V6([u8; 16]),
 }
 
-#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)]
 pub struct IpNetwork {
     pub address: IpAddress,
     pub prefix_length: u8,
 }
 
-#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)]
 pub enum PolicyAction {
     Allow,
     Deny,
 }
 
-#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)]
 pub struct DefaultAction {
     pub family: AddressFamily,
     pub action: PolicyAction,
 }
 
-#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)]
 pub struct PrefixRule {
     pub family: AddressFamily,
     pub network: IpNetwork,
     pub action: PolicyAction,
 }
 
-#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)]
 pub struct Resolver {
     pub family: AddressFamily,
     pub address: IpAddress,

crates/lazaret-core/tests/network.rs

@@ -0,0 +1,485 @@
+use std::fmt::Write;
+
+use lazaret_core::identity::{
+    BootId, ConfigurationFingerprint, DerivedPolicyDigest, DeviceId, DomainId, GenerationId,
+    HostPidLocator, InodeId, NamespaceIdentity, NetworkSidecarId, PidfsDeviceId, PidfsInodeId,
+    PidfsProcessAuthorityV1, PidfsProcessIdentityV1, ProcessStartTimeTicks, ReadinessFingerprint,
+};
+use lazaret_core::network::{
+    DnsQueryExpectation, NetworkValidationErrorKind, ReachabilityExpectation, ReadinessExpectation,
+    accept_network_readiness, canonical_readiness_identity_bytes, derive_policy,
+    readiness_fingerprint, readiness_identity, validate_network_readiness_evidence,
+};
+use lazaret_core::records::{
+    AddressFamily, AddressFamilyDisposition, AddressFamilyDispositionValue, DefaultAction,
+    DeniedDestinationObservation, DerivedNetworkPolicyFields, DnsObservation, IpAddress, IpNetwork,
+    NetworkObservation, NetworkReachabilityProbe, NetworkReadinessAttestation,
+    NetworkReadinessAttestationFields, PermittedDestinationObservation, PolicyAction,
+    PolicyDelivery, PrefixRule, Resolver,
+};
+
+type AttestationMutation = fn(&mut NetworkReadinessAttestation);
+type EvidenceMutation = fn(&mut lazaret_core::records::NetworkReadinessEvidence);
+type ProbeMutation = fn(&mut NetworkReachabilityProbe);
+
+fn repeated(value: u8) -> [u8; 32] {
+    [value; 32]
+}
+
+fn namespace() -> NamespaceIdentity {
+    NamespaceIdentity {
+        device: DeviceId::new(41),
+        inode: InodeId::new(42),
+    }
+}
+
+fn process(value: u8) -> PidfsProcessIdentityV1 {
+    PidfsProcessIdentityV1::new(
+        PidfsProcessAuthorityV1 {
+            boot_id: BootId::new([value; 16]),
+            pidfs_st_dev: PidfsDeviceId::new(u64::from(value)),
+            pidfs_st_ino: PidfsInodeId::new(u64::from(value) + 1),
+        },
+        HostPidLocator::new(u32::from(value)),
+        ProcessStartTimeTicks::new(u64::from(value) + 2),
+    )
+}
+
+fn policy_fields() -> DerivedNetworkPolicyFields {
+    DerivedNetworkPolicyFields {
+        address_families: vec![
+            AddressFamilyDisposition {
+                family: AddressFamily::Ipv4,
+                disposition: AddressFamilyDispositionValue::Enabled,
+            },
+            AddressFamilyDisposition {
+                family: AddressFamily::Ipv6,
+                disposition: AddressFamilyDispositionValue::Disabled,
+            },
+        ],
+        default_actions: vec![DefaultAction {
+            family: AddressFamily::Ipv4,
+            action: PolicyAction::Allow,
+        }],
+        prefix_rules: vec![
+            PrefixRule {
+                family: AddressFamily::Ipv4,
+                network: IpNetwork {
+                    address: IpAddress::V4([10, 0, 0, 0]),
+                    prefix_length: 8,
+                },
+                action: PolicyAction::Deny,
+            },
+            PrefixRule {
+                family: AddressFamily::Ipv4,
+                network: IpNetwork {
+                    address: IpAddress::V4([10, 20, 0, 0]),
+                    prefix_length: 16,
+                },
+                action: PolicyAction::Allow,
+            },
+            PrefixRule {
+                family: AddressFamily::Ipv4,
+                network: IpNetwork {
+                    address: IpAddress::V4([172, 16, 0, 0]),
+                    prefix_length: 12,
+                },
+                action: PolicyAction::Deny,
+            },
+            PrefixRule {
+                family: AddressFamily::Ipv4,
+                network: IpNetwork {
+                    address: IpAddress::V4([192, 168, 0, 0]),
+                    prefix_length: 16,
+                },
+                action: PolicyAction::Deny,
+            },
+        ],
+        resolvers: vec![Resolver {
+            family: AddressFamily::Ipv4,
+            address: IpAddress::V4([192, 0, 2, 53]),
+        }],
+    }
+}
+
+struct Fixture {
+    policy: lazaret_core::network::CanonicalDerivedNetworkPolicy,
+    runtime_supervisor: PidfsProcessIdentityV1,
+    connectivity_helper: PidfsProcessIdentityV1,
+    attestation: NetworkReadinessAttestation,
+    probe: NetworkReachabilityProbe,
+    reachability: ReachabilityExpectation,
+}
+
+impl Fixture {
+    fn new() -> Self {
+        let policy = derive_policy(policy_fields()).unwrap();
+        let runtime_supervisor = process(51);
+        let connectivity_helper = process(61);
+        let attestation = NetworkReadinessAttestation::v1(NetworkReadinessAttestationFields {
+            domain_id: DomainId::new(repeated(1)),
+            generation_id: GenerationId::new(2),
+            configuration_fingerprint: ConfigurationFingerprint::new(repeated(3)),
+            network_sidecar_id: NetworkSidecarId::new(repeated(4)),
+            derived_policy_digest: policy.digest(),
+            enforcement_namespace: namespace(),
+            runtime_supervisor,
+            connectivity_helper,
+            observation: NetworkObservation {
+                policy_delivery: PolicyDelivery::SealedMemfd,
+                helper_ready: true,
+                observed_routes: vec![IpNetwork {
+                    address: IpAddress::V4([10, 0, 0, 0]),
+                    prefix_length: 8,
+                }],
+                routes_attested: true,
+            },
+        });
+        let probe = NetworkReachabilityProbe {
+            domain_id: DomainId::new(repeated(1)),
+            generation_id: GenerationId::new(2),
+            enforcement_namespace: namespace(),
+            denied_destinations: vec![DeniedDestinationObservation {
+                destination: IpAddress::V4([10, 1, 2, 3]),
+                unreachable: true,
+            }],
+            permitted_destinations: vec![PermittedDestinationObservation {
+                destination: IpAddress::V4([10, 20, 1, 2]),
+                reachable: true,
+            }],
+            dns_observations: vec![DnsObservation {
+                resolver: IpAddress::V4([192, 0, 2, 53]),
+                query_name: "sandbox.invalid".into(),
+                resolved_addresses: vec![IpAddress::V4([192, 0, 2, 10])],
+            }],
+        };
+        let reachability = ReachabilityExpectation {
+            denied_destinations: vec![IpAddress::V4([10, 1, 2, 3])],
+            permitted_destinations: vec![IpAddress::V4([10, 20, 1, 2])],
+            dns_queries: vec![DnsQueryExpectation {
+                resolver: IpAddress::V4([192, 0, 2, 53]),
+                query_name: "sandbox.invalid".into(),
+            }],
+        };
+        Self {
+            policy,
+            runtime_supervisor,
+            connectivity_helper,
+            attestation,
+            probe,
+            reachability,
+        }
+    }
+
+    fn expectation(&self) -> ReadinessExpectation<'_> {
+        ReadinessExpectation {
+            domain_id: DomainId::new(repeated(1)),
+            generation_id: GenerationId::new(2),
+            configuration_fingerprint: ConfigurationFingerprint::new(repeated(3)),
+            network_sidecar_id: NetworkSidecarId::new(repeated(4)),
+            enforcement_namespace: namespace(),
+            runtime_supervisor: &self.runtime_supervisor,
+            connectivity_helper: &self.connectivity_helper,
+        }
+    }
+
+    fn evidence(&self) -> lazaret_core::records::NetworkReadinessEvidence {
+        accept_network_readiness(
+            &self.policy,
+            &self.expectation(),
+            self.attestation.clone(),
+            self.probe.clone(),
+            &self.reachability,
+        )
+        .unwrap()
+    }
+}
+
+fn hex(bytes: &[u8]) -> String {
+    bytes.iter().fold(String::new(), |mut encoded, byte| {
+        write!(encoded, "{byte:02x}").unwrap();
+        encoded
+    })
+}
+
+#[test]
+fn canonical_policy_and_readiness_vectors_are_stable() {
+    let fixture = Fixture::new();
+    let identity = readiness_identity(&fixture.attestation);
+    assert_eq!(
+        hex(fixture.policy.canonical_bytes()),
+        "216c617a617265742d646572697665642d6e6574776f726b2d706f6c6963792d763102000001010100000400000a000000080100000a14000010000000ac1000000c010000c0a800001001010000c0000235"
+    );
+    assert_eq!(
+        hex(fixture.policy.digest().as_bytes()),
+        "01b72b130912b96c591271308b6b54f99431b90b0f6eee252eb4ada6aa0a42e3"
+    );
+    assert_eq!(
+        hex(&canonical_readiness_identity_bytes(&identity).unwrap()),
+        "256c617a617265742d6e6574776f726b2d72656164696e6573732d6964656e746974792d76310101010101010101010101010101010101010101010101010101010101010101020303030303030303030303030303030303030303030303030303030303030303040404040404040404040404040404040404040404040404040404040404040401b72b130912b96c591271308b6b54f99431b90b0f6eee252eb4ada6aa0a42e3292a"
+    );
+    assert_eq!(
+        hex(readiness_fingerprint(&identity).unwrap().as_bytes()),
+        "1faf0b0bb7807002e223a113d3da93520bfe91b350380d5d890e20caed3d95af"
+    );
+}
+
+#[test]
+fn semantically_reordered_policy_has_one_identity() {
+    let expected = derive_policy(policy_fields()).unwrap();
+    let mut reordered = policy_fields();
+    reordered.address_families.reverse();
+    reordered.prefix_rules.reverse();
+    let actual = derive_policy(reordered).unwrap();
+    assert_eq!(actual, expected);
+}
+
+#[test]
+fn malformed_policy_inputs_are_refused() {
+    let cases = [
+        ("missing family", {
+            let mut fields = policy_fields();
+            fields.address_families.pop();
+            fields
+        }),
+        ("enabled IPv6", {
+            let mut fields = policy_fields();
+            fields.address_families[1].disposition = AddressFamilyDispositionValue::Enabled;
+            fields
+        }),
+        ("wrong default", {
+            let mut fields = policy_fields();
+            fields.default_actions[0].action = PolicyAction::Deny;
+            fields
+        }),
+        ("missing default private deny", {
+            let mut fields = policy_fields();
+            fields.prefix_rules.pop();
+            fields
+        }),
+        ("noncanonical CIDR", {
+            let mut fields = policy_fields();
+            fields.prefix_rules[0].network.address = IpAddress::V4([10, 0, 0, 1]);
+            fields
+        }),
+        ("oversized prefix", {
+            let mut fields = policy_fields();
+            fields.prefix_rules[0].network.prefix_length = 33;
+            fields
+        }),
+        ("prefix family mismatch", {
+            let mut fields = policy_fields();
+            fields.prefix_rules[0].network.address = IpAddress::V6([0; 16]);
+            fields
+        }),
+        ("duplicate prefix", {
+            let mut fields = policy_fields();
+            fields.prefix_rules.push(fields.prefix_rules[0]);
+            fields
+        }),
+        ("conflicting prefix", {
+            let mut fields = policy_fields();
+            let mut conflicting = fields.prefix_rules[0];
+            conflicting.action = PolicyAction::Allow;
+            fields.prefix_rules.push(conflicting);
+            fields
+        }),
+        ("no resolver", {
+            let mut fields = policy_fields();
+            fields.resolvers.clear();
+            fields
+        }),
+        ("resolver family mismatch", {
+            let mut fields = policy_fields();
+            fields.resolvers[0].address = IpAddress::V6([0; 16]);
+            fields
+        }),
+        ("duplicate resolver", {
+            let mut fields = policy_fields();
+            fields.resolvers.push(fields.resolvers[0]);
+            fields
+        }),
+    ];
+    for (name, fields) in cases {
+        assert!(derive_policy(fields).is_err(), "accepted {name}");
+    }
+}
+
+#[test]
+fn every_attestation_identity_mismatch_is_refused() {
+    let fixture = Fixture::new();
+    let mutations: [(&str, AttestationMutation); 9] = [
+        ("domain", |value| {
+            value.domain_id = DomainId::new(repeated(71));
+        }),
+        ("generation", |value| {
+            value.generation_id = GenerationId::new(72);
+        }),
+        ("configuration", |value| {
+            value.configuration_fingerprint = ConfigurationFingerprint::new(repeated(73));
+        }),
+        ("sidecar", |value| {
+            value.network_sidecar_id = NetworkSidecarId::new(repeated(74));
+        }),
+        ("policy", |value| {
+            value.derived_policy_digest = DerivedPolicyDigest::new(repeated(75));
+        }),
+        ("namespace", |value| {
+            value.enforcement_namespace.inode = InodeId::new(76);
+        }),
+        ("namespace device", |value| {
+            value.enforcement_namespace.device = DeviceId::new(77);
+        }),
+        ("runtime supervisor", |value| {
+            value.runtime_supervisor = process(78);
+        }),
+        ("connectivity helper", |value| {
+            value.connectivity_helper = process(79);
+        }),
+    ];
+    for (name, mutate) in mutations {
+        let mut attestation = fixture.attestation.clone();
+        mutate(&mut attestation);
+        let error = accept_network_readiness(
+            &fixture.policy,
+            &fixture.expectation(),
+            attestation,
+            fixture.probe.clone(),
+            &fixture.reachability,
+        )
+        .unwrap_err();
+        assert_eq!(
+            error.kind(),
+            NetworkValidationErrorKind::Attestation,
+            "{name}"
+        );
+    }
+}
+
+#[test]
+fn every_evidence_identity_mismatch_is_refused() {
+    let fixture = Fixture::new();
+    let mutations: [(&str, EvidenceMutation); 13] = [
+        ("outer domain", |value| {
+            value.domain_id = DomainId::new(repeated(81));
+        }),
+        ("outer generation", |value| {
+            value.generation_id = GenerationId::new(82);
+        }),
+        ("outer sidecar", |value| {
+            value.network_sidecar_id = NetworkSidecarId::new(repeated(83));
+        }),
+        ("identity domain", |value| {
+            value.readiness_identity.domain_id = DomainId::new(repeated(84));
+        }),
+        ("identity generation", |value| {
+            value.readiness_identity.generation_id = GenerationId::new(85);
+        }),
+        ("identity configuration", |value| {
+            value.readiness_identity.configuration_fingerprint =
+                ConfigurationFingerprint::new(repeated(86));
+        }),
+        ("identity sidecar", |value| {
+            value.readiness_identity.network_sidecar_id = NetworkSidecarId::new(repeated(87));
+        }),
+        ("identity policy", |value| {
+            value.readiness_identity.derived_policy_digest = DerivedPolicyDigest::new(repeated(88));
+        }),
+        ("identity namespace", |value| {
+            value.readiness_identity.enforcement_namespace.inode = InodeId::new(89);
+        }),
+        ("fingerprint", |value| {
+            value.readiness_fingerprint = ReadinessFingerprint::new(repeated(90));
+        }),
+        ("probe domain", |value| {
+            value.reachability_probe.domain_id = DomainId::new(repeated(91));
+        }),
+        ("probe generation", |value| {
+            value.reachability_probe.generation_id = GenerationId::new(92);
+        }),
+        ("probe namespace", |value| {
+            value.reachability_probe.enforcement_namespace.inode = InodeId::new(93);
+        }),
+    ];
+    for (name, mutate) in mutations {
+        let mut evidence = fixture.evidence();
+        mutate(&mut evidence);
+        assert!(
+            validate_network_readiness_evidence(
+                &fixture.policy,
+                &fixture.expectation(),
+                &evidence,
+                &fixture.reachability,
+            )
+            .is_err(),
+            "accepted {name}"
+        );
+    }
+}
+
+#[test]
+fn incomplete_or_failed_reachability_is_refused() {
+    let fixture = Fixture::new();
+    let mutations: [(&str, ProbeMutation); 6] = [
+        ("deny reached", |value| {
+            value.denied_destinations[0].unreachable = false;
+        }),
+        ("permit unreachable", |value| {
+            value.permitted_destinations[0].reachable = false;
+        }),
+        ("missing deny", |value| value.denied_destinations.clear()),
+        ("missing permit", |value| {
+            value.permitted_destinations.clear();
+        }),
+        ("missing DNS", |value| value.dns_observations.clear()),
+        ("empty DNS result", |value| {
+            value.dns_observations[0].resolved_addresses.clear();
+        }),
+    ];
+    for (name, mutate) in mutations {
+        let mut probe = fixture.probe.clone();
+        mutate(&mut probe);
+        assert!(
+            accept_network_readiness(
+                &fixture.policy,
+                &fixture.expectation(),
+                fixture.attestation.clone(),
+                probe,
+                &fixture.reachability,
+            )
+            .is_err(),
+            "accepted {name}"
+        );
+    }
+}
+
+#[test]
+fn incomplete_or_malformed_attestation_is_refused() {
+    let fixture = Fixture::new();
+    let mutations: [(&str, AttestationMutation); 3] = [
+        ("helper not ready", |value| {
+            value.observation.helper_ready = false;
+        }),
+        ("routes not attested", |value| {
+            value.observation.routes_attested = false;
+        }),
+        ("noncanonical route", |value| {
+            value.observation.observed_routes[0].address = IpAddress::V4([10, 0, 0, 1]);
+        }),
+    ];
+    for (name, mutate) in mutations {
+        let mut attestation = fixture.attestation.clone();
+        mutate(&mut attestation);
+        assert!(
+            accept_network_readiness(
+                &fixture.policy,
+                &fixture.expectation(),
+                attestation,
+                fixture.probe.clone(),
+                &fixture.reachability,
+            )
+            .is_err(),
+            "accepted {name}"
+        );
+    }
+}

docs/schema.md

@@ -1188,6 +1188,15 @@ family has exactly one default action. Prefixes and addresses are canonical, and
 equal-prefix action conflicts are invalid. Policy identity is the SHA-256 digest
 of its canonical form with a schema-specific domain separator.
 
+`DerivedNetworkPolicy.schema_id` is exactly
+`lazaret-derived-network-policy-v1`. Its canonical form is the minimal Postcard
+encoding of the complete document after address-family dispositions, default
+actions, prefix rules, and resolvers are sorted respectively by family; family;
+`(family, address bytes, prefix length, action)`; and `(family, address bytes)`.
+Duplicate prefixes and resolvers are invalid rather than silently removed. The
+policy-digest domain separator is the UTF-8 schema ID followed by exactly one
+zero byte.
+
 ## Network readiness
 
 ```mermaid
@@ -1303,5 +1312,6 @@ interpretation.
 
 The readiness-fingerprint domain separator is the UTF-8 bytes of
 `lazaret-network-readiness-identity-v1` followed by exactly one zero byte. This
-fixes the domain-separation context only; it does not select the byte encoding of
+prefixes the minimal Postcard encoding of the complete
-the canonical readiness-identity fields.
+`NetworkReadinessIdentity` document. The schema ID is therefore present in both
+the domain-separation context and the encoded version-dispatched document.