Rename the CLI package to tsunagi and its executable to tsng

The command line package is now `tsunagi` and builds the `tsng` executable,
which the packages, the unit, the installers and the workflows install and
run. The core library package becomes `tsunagi-core`, keeping the library name
`tsunagi`, so no code changes `use tsunagi::...`. Directories follow
(crates/tsunagi-core, crates/tsunagi). Every command shown to a person is now
`tsng ...`.

Co-Authored-By: Claude <noreply@anthropic.com>

crates/tsunagi-core/src/overlay/hostrules/exit.rs

@@ -0,0 +1,231 @@
+//! Host rules for exit nodes: what the operating system needs for this agent
+//! to carry other members' internet traffic, and for this device's own
+//! traffic to go through a member.
+//!
+//! Two independent halves, planned together because one interface carries
+//! both:
+//!
+//! * **Offering** — one set of rules per network that offers this agent as an
+//!   exit node, chosen by that network's range: masquerade the range out of
+//!   every other interface and let it through the forward chain. A network
+//!   that does not offer has no rules, so its members' packets are dropped by
+//!   the firewall as well as by the agent.
+//! * **Using** — policy routing that sends everything the host does not have
+//!   a more specific route for into the overlay interface, while the agent's
+//!   own sockets keep the ordinary route (see `linux_exit`).
+//!
+//! Nothing a peer announces becomes a host setting. Offering is the owner's
+//! switch; using is the user's choice of a member. Every object is tagged,
+//! reversible, and removed when it is no longer wanted, when the network
+//! leaves or stops, and when the agent stops.
+
+use std::sync::{Arc, Mutex};
+
+use crate::BoxFuture;
+use crate::state::Ipv4Range;
+
+use super::RuleOutcome;
+
+/// What the host should hold for one interface's exit settings.
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct ExitHostPlan {
+    /// The overlay interface.
+    pub interface: String,
+    /// The ranges of every network that offers this agent as an exit node.
+    pub offer: Vec<Ipv4Range>,
+    /// Whether this device sends its internet traffic through a member.
+    pub client: bool,
+}
+
+impl ExitHostPlan {
+    /// Whether there is nothing to hold.
+    pub fn is_empty(&self) -> bool {
+        self.offer.is_empty() && !self.client
+    }
+}
+
+/// What applying a plan achieved.
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct ExitHostReport {
+    /// One outcome per offered range: its masquerade and forward rules.
+    pub offer: Vec<(Ipv4Range, RuleOutcome)>,
+    /// Whether the kernel forwards packets for the interface. `None` when it
+    /// could not be read. The agent only reads this: turning forwarding on is
+    /// the owner's decision.
+    pub forwarding: Option<bool>,
+    /// The routes and rules that send this device's traffic through the
+    /// interface, when the plan asked for them.
+    pub client: Option<RuleOutcome>,
+}
+
+/// Installs and removes exit-node rules for an overlay interface.
+///
+/// Like the broadcast rules, no call fails as a whole: a step that cannot be
+/// done is in the report, because the caller's only useful response is to
+/// say so.
+pub trait ExitHostRules: Send + Sync + std::fmt::Debug + 'static {
+    /// Makes the host match the plan, replacing what this agent put there
+    /// for the interface before.
+    fn apply<'a>(&'a self, plan: &'a ExitHostPlan) -> BoxFuture<'a, ExitHostReport>;
+
+    /// Removes everything this agent put there for the interface. Succeeds
+    /// when nothing is there: it runs on the shutdown path, and once at
+    /// startup to take away what a crashed run left.
+    fn clear<'a>(&'a self, interface: &'a str) -> BoxFuture<'a, ()>;
+}
+
+/// The tag every firewall object of one offered range carries.
+pub fn exit_tag(interface: &str, range: &Ipv4Range) -> String {
+    format!("{}{range}", exit_tag_prefix(interface))
+}
+
+/// The start of every tag for an interface; what cleanup selects by.
+pub fn exit_tag_prefix(interface: &str) -> String {
+    format!("tsunagi-exit:{interface}:")
+}
+
+/// The one-line detail for a set of offer outcomes.
+pub fn offer_detail(outcome: &RuleOutcome, range: &Ipv4Range) -> String {
+    match outcome {
+        RuleOutcome::Applied => format!("masquerade + forward for {range} in place"),
+        RuleOutcome::Failed(reason) => reason.clone(),
+    }
+}
+
+/// An in-memory host for exit rules, for tests: nothing is touched.
+#[derive(Debug, Clone, Default)]
+pub struct MockExitRules {
+    state: Arc<Mutex<Option<ExitHostPlan>>>,
+    calls: Arc<Mutex<Vec<String>>>,
+    forwarding: Arc<Mutex<Option<bool>>>,
+    failure: Arc<Mutex<Option<String>>>,
+}
+
+impl MockExitRules {
+    /// An empty host with forwarding turned on.
+    pub fn new() -> Self {
+        let rules = Self::default();
+        *lock(&rules.forwarding) = Some(true);
+        rules
+    }
+
+    /// What the host reports for kernel forwarding from now on.
+    pub fn set_forwarding(&self, forwarding: Option<bool>) {
+        *lock(&self.forwarding) = forwarding;
+    }
+
+    /// Makes every step fail with this reason from now on.
+    pub fn fail_with(&self, reason: Option<String>) {
+        *lock(&self.failure) = reason;
+    }
+
+    /// What is installed now.
+    pub fn installed(&self) -> Option<ExitHostPlan> {
+        lock(&self.state).clone()
+    }
+
+    /// Every `apply:<interface>` / `clear:<interface>` call, in order.
+    pub fn calls(&self) -> Vec<String> {
+        lock(&self.calls).clone()
+    }
+}
+
+fn lock<T>(mutex: &Mutex<T>) -> std::sync::MutexGuard<'_, T> {
+    match mutex.lock() {
+        Ok(guard) => guard,
+        Err(poisoned) => poisoned.into_inner(),
+    }
+}
+
+impl ExitHostRules for MockExitRules {
+    fn apply<'a>(&'a self, plan: &'a ExitHostPlan) -> BoxFuture<'a, ExitHostReport> {
+        Box::pin(async move {
+            lock(&self.calls).push(format!("apply:{}", plan.interface));
+            let outcome = match lock(&self.failure).clone() {
+                Some(reason) => RuleOutcome::Failed(reason),
+                None => {
+                    *lock(&self.state) = Some(plan.clone());
+                    RuleOutcome::Applied
+                }
+            };
+            ExitHostReport {
+                offer: plan
+                    .offer
+                    .iter()
+                    .map(|range| (*range, outcome.clone()))
+                    .collect(),
+                forwarding: *lock(&self.forwarding),
+                client: plan.client.then_some(outcome),
+            }
+        })
+    }
+
+    fn clear<'a>(&'a self, interface: &'a str) -> BoxFuture<'a, ()> {
+        Box::pin(async move {
+            lock(&self.calls).push(format!("clear:{interface}"));
+            *lock(&self.state) = None;
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    #![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+    use super::*;
+
+    fn range() -> Ipv4Range {
+        "10.13.37.0/24".parse().unwrap()
+    }
+
+    #[test]
+    fn tags_name_the_interface_and_the_range() {
+        assert_eq!(
+            exit_tag("tsun0", &range()),
+            "tsunagi-exit:tsun0:10.13.37.0/24"
+        );
+        assert!(exit_tag("tsun0", &range()).starts_with(&exit_tag_prefix("tsun0")));
+        // Another interface's tag never matches this one's prefix.
+        assert!(!exit_tag("tsun01", &range()).starts_with(&exit_tag_prefix("tsun0")));
+    }
+
+    #[test]
+    fn an_empty_plan_is_nothing_to_hold() {
+        let mut plan = ExitHostPlan::default();
+        assert!(plan.is_empty());
+        plan.client = true;
+        assert!(!plan.is_empty());
+    }
+
+    #[tokio::test]
+    async fn the_mock_applies_reports_and_clears() {
+        let rules = MockExitRules::new();
+        let plan = ExitHostPlan {
+            interface: "tsun0".into(),
+            offer: vec![range()],
+            client: true,
+        };
+        let report = rules.apply(&plan).await;
+        assert_eq!(report.offer[0].1, RuleOutcome::Applied);
+        assert_eq!(report.forwarding, Some(true));
+        assert_eq!(report.client, Some(RuleOutcome::Applied));
+        assert_eq!(rules.installed(), Some(plan));
+
+        rules.set_forwarding(Some(false));
+        rules.fail_with(Some("denied".into()));
+        let report = rules
+            .apply(&ExitHostPlan {
+                interface: "tsun0".into(),
+                offer: vec![range()],
+                client: false,
+            })
+            .await;
+        assert_eq!(report.forwarding, Some(false));
+        assert!(matches!(report.offer[0].1, RuleOutcome::Failed(_)));
+        assert_eq!(report.client, None);
+
+        rules.clear("tsun0").await;
+        assert_eq!(rules.installed(), None);
+        assert_eq!(rules.calls(), ["apply:tsun0", "apply:tsun0", "clear:tsun0"]);
+    }
+}

crates/tsunagi-core/src/overlay/hostrules/linux.rs

@@ -0,0 +1,570 @@
+//! Broadcast host rules on Linux: a netlink route and an `iptables` rule.
+//!
+//! The route is added by the netlink thread the interface provisioner already
+//! owns (see [`super::super::provision`]), because that thread is the only one
+//! that ever holds `CAP_NET_ADMIN`. It belongs to the interface and goes away
+//! with it.
+//!
+//! The firewall allowance is a rule in the `INPUT` chain, inserted at the top
+//! so a default-deny chain further down cannot drop discovery replies first:
+//!
+//! ```text
+//! iptables -I INPUT 1 -i <if> -p udp -s <range> -m comment --comment tsunagi:<if> -j ACCEPT
+//! ```
+//!
+//! `iptables` is a program, not a netlink call, so it is looked up in fixed
+//! system directories rather than on `PATH`, and its arguments are built from
+//! values this agent computed. It works with both the legacy backend and
+//! `iptables-nft`. A host with only `nft` or `firewalld` has no `iptables`;
+//! that is reported on the firewall half and the route is still installed.
+//!
+//! The rule carries a comment tag. That is how a rule left behind by a crashed
+//! run is found and replaced, and why nothing else in the chain is ever
+//! deleted.
+
+use std::net::Ipv4Addr;
+
+use crate::BoxFuture;
+use crate::overlay::provision::RouteHandle;
+
+use super::{BroadcastHostRules, BroadcastRulesPlan, BroadcastRulesReport, RuleOutcome, tag_for};
+
+const CHAIN: &str = "INPUT";
+
+/// Fixed places `iptables` is installed. Never `PATH`: the agent is
+/// privileged and a directory a user controls must not decide what it runs.
+const IPTABLES_DIRECTORIES: [&str; 5] = [
+    "/usr/sbin/iptables",
+    "/sbin/iptables",
+    "/usr/bin/iptables",
+    "/bin/iptables",
+    "/usr/local/sbin/iptables",
+];
+
+/// The first candidate that exists.
+fn pick_iptables(exists: impl Fn(&str) -> bool) -> Option<&'static str> {
+    IPTABLES_DIRECTORIES
+        .into_iter()
+        .find(|candidate| exists(candidate))
+}
+
+/// What running `iptables` produced.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(super) enum Ran {
+    /// There is no `iptables` to run.
+    Missing,
+    /// It ran, and exited like this.
+    Exited {
+        success: bool,
+        stdout: String,
+        stderr: String,
+    },
+}
+
+/// Runs `iptables` with these arguments. A function value so the flow below
+/// can be tested without touching the host.
+pub(super) type Run<'a> = &'a dyn Fn(&[String]) -> Ran;
+
+/// The match and target of the rule, without the chain or position.
+fn rule_spec(plan: &BroadcastRulesPlan) -> Vec<String> {
+    [
+        "-i",
+        plan.interface.as_str(),
+        "-p",
+        "udp",
+        "-s",
+        &plan.range.to_string(),
+        "-m",
+        "comment",
+        "--comment",
+        &plan.tag(),
+        "-j",
+        "ACCEPT",
+    ]
+    .into_iter()
+    .map(str::to_string)
+    .collect()
+}
+
+/// Waits briefly for the xtables lock instead of failing when another tool
+/// holds it.
+pub(super) fn locked(args: impl IntoIterator<Item = String>) -> Vec<String> {
+    ["-w", "5"]
+        .into_iter()
+        .map(str::to_string)
+        .chain(args)
+        .collect()
+}
+
+fn check_args(plan: &BroadcastRulesPlan) -> Vec<String> {
+    locked(
+        ["-C".to_string(), CHAIN.to_string()]
+            .into_iter()
+            .chain(rule_spec(plan)),
+    )
+}
+
+fn insert_args(plan: &BroadcastRulesPlan) -> Vec<String> {
+    locked(
+        ["-I".to_string(), CHAIN.to_string(), "1".to_string()]
+            .into_iter()
+            .chain(rule_spec(plan)),
+    )
+}
+
+fn list_args() -> Vec<String> {
+    locked(["-S".to_string(), CHAIN.to_string()])
+}
+
+/// Splits one `iptables -S` line into words, honouring double quotes, which
+/// `iptables` puts around comments that need them.
+pub(super) fn split_rule_line(line: &str) -> Vec<String> {
+    let mut words = Vec::new();
+    let mut current = String::new();
+    let mut quoted = false;
+    let mut started = false;
+    for c in line.chars() {
+        match c {
+            '"' => {
+                quoted = !quoted;
+                started = true;
+            }
+            c if c.is_whitespace() && !quoted => {
+                if started {
+                    words.push(std::mem::take(&mut current));
+                    started = false;
+                }
+            }
+            c => {
+                current.push(c);
+                started = true;
+            }
+        }
+    }
+    if started {
+        words.push(current);
+    }
+    words
+}
+
+/// The delete commands for every rule in an `iptables -S INPUT` listing that
+/// carries exactly this tag. Anything else in the chain is left alone.
+fn tagged_deletions(listing: &str, tag: &str) -> Vec<Vec<String>> {
+    listing
+        .lines()
+        .filter_map(|line| {
+            let words = split_rule_line(line);
+            let [append, chain, rest @ ..] = words.as_slice() else {
+                return None;
+            };
+            if append != "-A" || chain != CHAIN {
+                return None;
+            }
+            let tagged = rest
+                .windows(2)
+                .any(|pair| pair[0] == "--comment" && pair[1] == tag);
+            tagged.then(|| {
+                locked(
+                    ["-D".to_string(), CHAIN.to_string()]
+                        .into_iter()
+                        .chain(rest.iter().cloned()),
+                )
+            })
+        })
+        .collect()
+}
+
+/// A failure message with the likely fix for the likely cause.
+pub(super) fn failure(stderr: &str) -> String {
+    let text = stderr.trim();
+    let lower = text.to_ascii_lowercase();
+    if lower.contains("permission denied") || lower.contains("must be root") {
+        format!("iptables needs root: {text}")
+    } else if text.is_empty() {
+        "iptables failed without saying why".to_string()
+    } else {
+        format!("iptables failed: {text}")
+    }
+}
+
+fn missing(plan: &BroadcastRulesPlan) -> String {
+    format!(
+        "iptables not found; install it (the iptables-nft package is enough) or allow inbound \
+         UDP from {} on `{}` in your firewall",
+        plan.range, plan.interface
+    )
+}
+
+/// Makes the firewall hold exactly one rule for this interface, the planned one.
+fn apply_firewall(run: Run<'_>, plan: &BroadcastRulesPlan) -> RuleOutcome {
+    let present = match run(&check_args(plan)) {
+        Ran::Missing => return RuleOutcome::Failed(missing(plan)),
+        Ran::Exited { success, .. } => success,
+    };
+    let listing = match run(&list_args()) {
+        Ran::Missing => return RuleOutcome::Failed(missing(plan)),
+        Ran::Exited {
+            success: true,
+            stdout,
+            ..
+        } => stdout,
+        Ran::Exited { stderr, .. } => return RuleOutcome::Failed(failure(&stderr)),
+    };
+    let stale = tagged_deletions(&listing, &plan.tag());
+    // `-C` matched an identical rule and nothing else carries our tag, so
+    // there is nothing to do. Otherwise start from a clean slate for this
+    // interface: a rule from an earlier run may name another range.
+    if present && stale.len() == 1 {
+        return RuleOutcome::Applied;
+    }
+    for delete in &stale {
+        if let Ran::Exited {
+            success: false,
+            stderr,
+            ..
+        } = run(delete)
+        {
+            return RuleOutcome::Failed(failure(&stderr));
+        }
+    }
+    match run(&insert_args(plan)) {
+        Ran::Missing => RuleOutcome::Failed(missing(plan)),
+        Ran::Exited { success: true, .. } => RuleOutcome::Applied,
+        Ran::Exited { stderr, .. } => RuleOutcome::Failed(failure(&stderr)),
+    }
+}
+
+/// Removes every rule tagged for this interface. Best effort.
+fn clear_firewall(run: Run<'_>, interface: &str) {
+    let Ran::Exited {
+        success: true,
+        stdout,
+        ..
+    } = run(&list_args())
+    else {
+        return;
+    };
+    for delete in tagged_deletions(&stdout, &tag_for(interface)) {
+        if let Ran::Exited {
+            success: false,
+            stderr,
+            ..
+        } = run(&delete)
+        {
+            tracing::warn!(
+                interface,
+                "cannot remove the broadcast firewall rule: {}",
+                failure(&stderr)
+            );
+        }
+    }
+}
+
+/// Runs the real `iptables`.
+pub(super) fn run_iptables(args: &[String]) -> Ran {
+    let Some(program) = pick_iptables(|path| std::path::Path::new(path).is_file()) else {
+        return Ran::Missing;
+    };
+    match std::process::Command::new(program).args(args).output() {
+        Ok(output) => Ran::Exited {
+            success: output.status.success(),
+            stdout: String::from_utf8_lossy(&output.stdout).into_owned(),
+            stderr: String::from_utf8_lossy(&output.stderr).into_owned(),
+        },
+        Err(err) if err.kind() == std::io::ErrorKind::NotFound => Ran::Missing,
+        Err(err) => Ran::Exited {
+            success: false,
+            stdout: String::new(),
+            stderr: err.to_string(),
+        },
+    }
+}
+
+/// The Linux implementation: netlink for the route, `iptables` for the rule.
+#[derive(Debug)]
+pub struct LinuxHostRules {
+    pub(super) route: RouteHandle,
+}
+
+impl LinuxHostRules {
+    pub(crate) fn new(route: RouteHandle) -> Self {
+        Self { route }
+    }
+
+    async fn set_route(&self, interface: String, source: Ipv4Addr) -> RuleOutcome {
+        let route = self.route.clone();
+        match tokio::task::spawn_blocking(move || route.set(&interface, source)).await {
+            Ok(Ok(())) => RuleOutcome::Applied,
+            Ok(Err(err)) => RuleOutcome::Failed(err.to_string()),
+            Err(err) => RuleOutcome::Failed(format!("the route task failed: {err}")),
+        }
+    }
+}
+
+impl BroadcastHostRules for LinuxHostRules {
+    fn name(&self) -> &str {
+        "netlink+iptables"
+    }
+
+    fn exit_rules(&self) -> Option<&dyn super::ExitHostRules> {
+        Some(self)
+    }
+
+    fn apply<'a>(&'a self, plan: &'a BroadcastRulesPlan) -> BoxFuture<'a, BroadcastRulesReport> {
+        Box::pin(async move {
+            let route = self.set_route(plan.interface.clone(), plan.source).await;
+            let owned = plan.clone();
+            let firewall =
+                tokio::task::spawn_blocking(move || apply_firewall(&run_iptables, &owned))
+                    .await
+                    .unwrap_or_else(|err| {
+                        RuleOutcome::Failed(format!("the firewall task failed: {err}"))
+                    });
+            BroadcastRulesReport {
+                plan: plan.clone(),
+                route,
+                firewall,
+            }
+        })
+    }
+
+    fn clear<'a>(&'a self, interface: &'a str) -> BoxFuture<'a, ()> {
+        Box::pin(async move {
+            let route = self.route.clone();
+            let name = interface.to_string();
+            let route_name = name.clone();
+            if let Ok(Err(err)) =
+                tokio::task::spawn_blocking(move || route.clear(&route_name)).await
+            {
+                tracing::warn!(interface = %name, %err, "cannot remove the broadcast route");
+            }
+            let name = interface.to_string();
+            let _ = tokio::task::spawn_blocking(move || clear_firewall(&run_iptables, &name)).await;
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    #![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+    use super::*;
+    use std::cell::RefCell;
+
+    fn plan() -> BroadcastRulesPlan {
+        BroadcastRulesPlan {
+            interface: "tsun0".into(),
+            source: Ipv4Addr::new(10, 13, 37, 142),
+            range: "10.13.37.0/24".parse().unwrap(),
+        }
+    }
+
+    fn words(args: &[String]) -> String {
+        args.join(" ")
+    }
+
+    #[test]
+    fn the_rule_is_udp_only_from_the_overlay_range_on_this_interface() {
+        let spec = words(&rule_spec(&plan()));
+        assert_eq!(
+            spec,
+            "-i tsun0 -p udp -s 10.13.37.0/24 -m comment --comment tsunagi:tsun0 -j ACCEPT"
+        );
+        // Nothing here may widen to other protocols or every source.
+        assert!(spec.contains("-p udp"));
+        assert!(!spec.contains("0.0.0.0/0"));
+        assert!(words(&insert_args(&plan())).starts_with("-w 5 -I INPUT 1 -i tsun0"));
+        assert!(words(&check_args(&plan())).starts_with("-w 5 -C INPUT -i tsun0"));
+    }
+
+    #[test]
+    fn iptables_is_found_in_fixed_directories_never_on_path() {
+        assert_eq!(pick_iptables(|_| false), None);
+        assert_eq!(
+            pick_iptables(|p| p == "/sbin/iptables"),
+            Some("/sbin/iptables")
+        );
+        assert_eq!(pick_iptables(|_| true), Some("/usr/sbin/iptables"));
+    }
+
+    #[test]
+    fn only_rules_with_our_exact_tag_are_selected_for_deletion() {
+        let listing = "\
+-P INPUT DROP
+-A INPUT -s 10.13.37.0/24 -i tsun0 -p udp -m comment --comment \"tsunagi:tsun0\" -j ACCEPT
+-A INPUT -i tsun0 -m comment --comment tsunagi:tsun0 -j ACCEPT
+-A INPUT -i tsun1 -p udp -m comment --comment tsunagi:tsun1 -j ACCEPT
+-A INPUT -p tcp --dport 22 -m comment --comment \"allow ssh tsunagi:tsun0\" -j ACCEPT
+-A FORWARD -i tsun0 -m comment --comment tsunagi:tsun0 -j ACCEPT
+-A INPUT -p tcp --dport 22 -j ACCEPT
+";
+        let deletions = tagged_deletions(listing, "tsunagi:tsun0");
+        assert_eq!(deletions.len(), 2, "{deletions:?}");
+        assert_eq!(
+            words(&deletions[0]),
+            "-w 5 -D INPUT -s 10.13.37.0/24 -i tsun0 -p udp -m comment --comment tsunagi:tsun0 -j ACCEPT"
+        );
+        assert!(words(&deletions[1]).contains("-D INPUT -i tsun0 -m comment"));
+        assert!(tagged_deletions("", "tsunagi:tsun0").is_empty());
+    }
+
+    /// A scripted `iptables`: answers by the leading verb, records every call.
+    struct Fake {
+        calls: RefCell<Vec<String>>,
+        check_ok: bool,
+        listing: String,
+        insert_stderr: Option<&'static str>,
+        missing: bool,
+    }
+
+    impl Fake {
+        fn new(check_ok: bool, listing: &str) -> Self {
+            Self {
+                calls: RefCell::new(Vec::new()),
+                check_ok,
+                listing: listing.to_string(),
+                insert_stderr: None,
+                missing: false,
+            }
+        }
+        fn run(&self, args: &[String]) -> Ran {
+            self.calls.borrow_mut().push(words(args));
+            if self.missing {
+                return Ran::Missing;
+            }
+            let ok = |stdout: &str| Ran::Exited {
+                success: true,
+                stdout: stdout.to_string(),
+                stderr: String::new(),
+            };
+            match args.get(2).map(String::as_str) {
+                Some("-C") if self.check_ok => ok(""),
+                Some("-C") => Ran::Exited {
+                    success: false,
+                    stdout: String::new(),
+                    stderr: "Bad rule".into(),
+                },
+                Some("-S") => ok(&self.listing),
+                Some("-I") => match self.insert_stderr {
+                    Some(stderr) => Ran::Exited {
+                        success: false,
+                        stdout: String::new(),
+                        stderr: stderr.into(),
+                    },
+                    None => ok(""),
+                },
+                _ => ok(""),
+            }
+        }
+        fn verbs(&self) -> Vec<String> {
+            self.calls
+                .borrow()
+                .iter()
+                .map(|call| call.split(' ').nth(2).unwrap().to_string())
+                .collect()
+        }
+    }
+
+    const ONE_OURS: &str =
+        "-A INPUT -s 10.13.37.0/24 -i tsun0 -p udp -m comment --comment tsunagi:tsun0 -j ACCEPT\n";
+
+    #[test]
+    fn an_identical_rule_already_in_place_is_left_alone() {
+        let fake = Fake::new(true, ONE_OURS);
+        assert_eq!(
+            apply_firewall(&|a| fake.run(a), &plan()),
+            RuleOutcome::Applied
+        );
+        assert_eq!(fake.verbs(), ["-C", "-S"], "no insert, no delete");
+    }
+
+    #[test]
+    fn a_missing_rule_is_inserted_once() {
+        let fake = Fake::new(false, "-P INPUT ACCEPT\n");
+        assert_eq!(
+            apply_firewall(&|a| fake.run(a), &plan()),
+            RuleOutcome::Applied
+        );
+        assert_eq!(fake.verbs(), ["-C", "-S", "-I"]);
+    }
+
+    #[test]
+    fn a_stale_rule_for_another_range_is_replaced_not_stacked() {
+        // A crashed run left a rule for an old range under our tag.
+        let stale = "-A INPUT -s 10.99.0.0/16 -i tsun0 -p udp -m comment --comment tsunagi:tsun0 -j ACCEPT\n";
+        let fake = Fake::new(false, stale);
+        assert_eq!(
+            apply_firewall(&|a| fake.run(a), &plan()),
+            RuleOutcome::Applied
+        );
+        assert_eq!(fake.verbs(), ["-C", "-S", "-D", "-I"]);
+    }
+
+    #[test]
+    fn duplicates_of_the_rule_collapse_to_one() {
+        let doubled = format!("{ONE_OURS}{ONE_OURS}");
+        let fake = Fake::new(true, &doubled);
+        assert_eq!(
+            apply_firewall(&|a| fake.run(a), &plan()),
+            RuleOutcome::Applied
+        );
+        assert_eq!(fake.verbs(), ["-C", "-S", "-D", "-D", "-I"]);
+    }
+
+    #[test]
+    fn a_missing_iptables_says_what_to_install_and_what_to_allow() {
+        let mut fake = Fake::new(false, "");
+        fake.missing = true;
+        let RuleOutcome::Failed(reason) = apply_firewall(&|a| fake.run(a), &plan()) else {
+            panic!("expected a failure");
+        };
+        assert!(reason.contains("iptables not found"), "{reason}");
+        assert!(reason.contains("10.13.37.0/24"), "{reason}");
+        assert!(reason.contains("tsun0"), "{reason}");
+    }
+
+    #[test]
+    fn a_refused_insert_is_reported_with_the_cause() {
+        let mut fake = Fake::new(false, "");
+        fake.insert_stderr = Some(
+            "iptables v1.8.10: can't initialize iptables table `filter': Permission denied (you must be root)",
+        );
+        let RuleOutcome::Failed(reason) = apply_firewall(&|a| fake.run(a), &plan()) else {
+            panic!("expected a failure");
+        };
+        assert!(reason.starts_with("iptables needs root"), "{reason}");
+    }
+
+    #[test]
+    fn clearing_removes_only_tagged_rules_and_ignores_a_missing_iptables() {
+        let listing = format!(
+            "-A INPUT -p tcp --dport 22 -j ACCEPT\n{ONE_OURS}-A INPUT -i tsun1 -m comment --comment tsunagi:tsun1 -j ACCEPT\n"
+        );
+        let fake = Fake::new(true, &listing);
+        clear_firewall(&|a| fake.run(a), "tsun0");
+        assert_eq!(fake.verbs(), ["-S", "-D"]);
+
+        let mut gone = Fake::new(true, "");
+        gone.missing = true;
+        clear_firewall(&|a| gone.run(a), "tsun0");
+        assert_eq!(gone.verbs(), ["-S"]);
+    }
+
+    #[test]
+    fn rule_listing_words_honour_quotes() {
+        assert_eq!(
+            split_rule_line("-A INPUT -m comment --comment \"a b\" -j ACCEPT"),
+            [
+                "-A",
+                "INPUT",
+                "-m",
+                "comment",
+                "--comment",
+                "a b",
+                "-j",
+                "ACCEPT"
+            ]
+        );
+        assert!(split_rule_line("   ").is_empty());
+    }
+}

crates/tsunagi-core/src/overlay/hostrules/linux_exit.rs

@@ -0,0 +1,728 @@
+//! Exit-node host rules on Linux: `iptables` for the offering side, policy
+//! routing over netlink for the using side.
+//!
+//! # Offering
+//!
+//! For every network that offers this agent as an exit node, three rules,
+//! selected by that network's range and carrying the tag
+//! `tsunagi-exit:<if>:<range>`:
+//!
+//! ```text
+//! -t nat    POSTROUTING  -s <range> ! -o <if> -j MASQUERADE
+//! -t filter FORWARD      -i <if> -s <range> ! -o <if> -j ACCEPT
+//! -t filter FORWARD      -o <if> -d <range> -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+//! ```
+//!
+//! `! -o <if>` is the egress without naming it: whatever interface the
+//! default route uses, now or after it changes. Kernel forwarding is only
+//! *read*. Turning it on changes how the whole host behaves, which is the
+//! owner's decision, so when it is off the rules are installed anyway and the
+//! report says so.
+//!
+//! # Using
+//!
+//! Policy routing, with no `/1` routes and nothing in the main table:
+//!
+//! ```text
+//! table 0x7473:  default dev <if>
+//! 5280: from all uidrange <euid>-<euid> lookup main
+//! 5290: from all lookup main suppress_prefixlength 0
+//! 5300: from all lookup 0x7473
+//! ```
+//!
+//! The first keeps the agent's *own* sockets off the tunnel: its QUIC, relay,
+//! DHT and DNS traffic would otherwise be routed into the interface it is
+//! carrying, a loop. The second lets every specific route — the LAN, another
+//! VPN, a tunnel to somewhere else — keep working, because only the default
+//! route is suppressed. The priorities sit after Tailscale's 5270.
+//!
+//! The first rule exempts a *user id*, so it is only right when the agent has
+//! one of its own, as the packaged service does. An agent started from a login
+//! session would take that user's own applications out of the tunnel with it,
+//! and the exit node would silently do nothing for them. That is refused, not
+//! guessed at: see [`client_refusal`].
+
+use crate::BoxFuture;
+use crate::state::Ipv4Range;
+
+use super::RuleOutcome;
+use super::exit::{ExitHostPlan, ExitHostReport, ExitHostRules, exit_tag, exit_tag_prefix};
+use super::linux::{LinuxHostRules, Ran, Run, failure, locked, run_iptables, split_rule_line};
+
+/// The chains the offering rules live in: `(table, chain)`.
+const CHAINS: [(&str, &str); 2] = [("nat", "POSTROUTING"), ("filter", "FORWARD")];
+
+/// One firewall rule: where it goes, and its match and target.
+#[derive(Debug, Clone, PartialEq, Eq)]
+struct Rule {
+    table: &'static str,
+    chain: &'static str,
+    spec: Vec<String>,
+}
+
+fn owned(words: &[&str]) -> Vec<String> {
+    words.iter().map(|word| word.to_string()).collect()
+}
+
+/// The three rules of one offered range.
+fn offer_rules(interface: &str, range: &Ipv4Range) -> Vec<Rule> {
+    let range_text = range.to_string();
+    let tag = exit_tag(interface, range);
+    let comment = ["-m", "comment", "--comment", tag.as_str()];
+    let spec = |head: &[&str], tail: &[&str]| -> Vec<String> {
+        owned(head)
+            .into_iter()
+            .chain(owned(&comment))
+            .chain(owned(tail))
+            .collect()
+    };
+    vec![
+        Rule {
+            table: "nat",
+            chain: "POSTROUTING",
+            spec: spec(
+                &["-s", &range_text, "!", "-o", interface],
+                &["-j", "MASQUERADE"],
+            ),
+        },
+        Rule {
+            table: "filter",
+            chain: "FORWARD",
+            spec: spec(
+                &["-i", interface, "-s", &range_text, "!", "-o", interface],
+                &["-j", "ACCEPT"],
+            ),
+        },
+        Rule {
+            table: "filter",
+            chain: "FORWARD",
+            spec: spec(
+                &[
+                    "-o",
+                    interface,
+                    "-d",
+                    &range_text,
+                    "-m",
+                    "conntrack",
+                    "--ctstate",
+                    "RELATED,ESTABLISHED",
+                ],
+                &["-j", "ACCEPT"],
+            ),
+        },
+    ]
+}
+
+fn check_args(rule: &Rule) -> Vec<String> {
+    locked(
+        owned(&["-t", rule.table, "-C", rule.chain])
+            .into_iter()
+            .chain(rule.spec.iter().cloned()),
+    )
+}
+
+fn insert_args(rule: &Rule) -> Vec<String> {
+    locked(
+        owned(&["-t", rule.table, "-I", rule.chain, "1"])
+            .into_iter()
+            .chain(rule.spec.iter().cloned()),
+    )
+}
+
+fn list_args(table: &str, chain: &str) -> Vec<String> {
+    locked(owned(&["-t", table, "-S", chain]))
+}
+
+/// A rule found in a listing whose comment starts with our prefix.
+#[derive(Debug, Clone, PartialEq, Eq)]
+struct Found {
+    /// The whole tag.
+    tag: String,
+    /// The words after `-A <chain>`, which is what `-D` needs.
+    rest: Vec<String>,
+}
+
+/// Every rule in an `iptables -S <chain>` listing carrying a tag that starts
+/// with `prefix`. Anything else in the chain is left alone.
+fn tagged_rules(listing: &str, chain: &str, prefix: &str) -> Vec<Found> {
+    listing
+        .lines()
+        .filter_map(|line| {
+            let words = split_rule_line(line);
+            let [append, found_chain, rest @ ..] = words.as_slice() else {
+                return None;
+            };
+            if append != "-A" || found_chain != chain {
+                return None;
+            }
+            let tag = rest
+                .windows(2)
+                .find(|pair| pair[0] == "--comment" && pair[1].starts_with(prefix))
+                .map(|pair| pair[1].clone())?;
+            Some(Found {
+                tag,
+                rest: rest.to_vec(),
+            })
+        })
+        .collect()
+}
+
+fn delete_args(table: &str, chain: &str, found: &Found) -> Vec<String> {
+    locked(
+        owned(&["-t", table, "-D", chain])
+            .into_iter()
+            .chain(found.rest.iter().cloned()),
+    )
+}
+
+fn missing_iptables(range: &Ipv4Range, interface: &str) -> String {
+    format!(
+        "iptables not found; install it (the iptables-nft package is enough), or masquerade \
+         {range} out of every interface but `{interface}` and forward it yourself"
+    )
+}
+
+/// Reads one chain, or says why not.
+fn read_chain(run: Run<'_>, table: &str, chain: &str) -> Result<String, Failure> {
+    match run(&list_args(table, chain)) {
+        Ran::Missing => Err(Failure::Missing),
+        Ran::Exited {
+            success: true,
+            stdout,
+            ..
+        } => Ok(stdout),
+        Ran::Exited { stderr, .. } => Err(Failure::Failed(failure(&stderr))),
+    }
+}
+
+enum Failure {
+    Missing,
+    Failed(String),
+}
+
+/// Deletes found rules; the first failure ends it.
+fn delete_all(
+    run: Run<'_>,
+    table: &str,
+    chain: &str,
+    found: &[Found],
+    keep: impl Fn(&Found) -> bool,
+) -> Result<(), String> {
+    for rule in found.iter().filter(|rule| !keep(rule)) {
+        if let Ran::Exited {
+            success: false,
+            stderr,
+            ..
+        } = run(&delete_args(table, chain, rule))
+        {
+            return Err(failure(&stderr));
+        }
+    }
+    Ok(())
+}
+
+/// Makes the firewall hold exactly the offering rules of these ranges for the
+/// interface, and no others of ours.
+fn apply_offer(
+    run: Run<'_>,
+    interface: &str,
+    ranges: &[Ipv4Range],
+) -> Vec<(Ipv4Range, RuleOutcome)> {
+    let fail_all = |reason: String| -> Vec<(Ipv4Range, RuleOutcome)> {
+        ranges
+            .iter()
+            .map(|range| (*range, RuleOutcome::Failed(reason.clone())))
+            .collect()
+    };
+    let prefix = exit_tag_prefix(interface);
+    let wanted: Vec<String> = ranges.iter().map(|r| exit_tag(interface, r)).collect();
+
+    // What is there now, per chain.
+    let mut present: Vec<(&str, &str, Vec<Found>)> = Vec::new();
+    for (table, chain) in CHAINS {
+        match read_chain(run, table, chain) {
+            Ok(listing) => present.push((table, chain, tagged_rules(&listing, chain, &prefix))),
+            Err(Failure::Missing) => {
+                return match ranges.first() {
+                    Some(range) => fail_all(missing_iptables(range, interface)),
+                    None => Vec::new(),
+                };
+            }
+            Err(Failure::Failed(reason)) => return fail_all(reason),
+        }
+    }
+
+    // Rules for a range no longer offered, or left by an earlier run.
+    for (table, chain, found) in &present {
+        if let Err(reason) = delete_all(run, table, chain, found, |rule| wanted.contains(&rule.tag))
+        {
+            return fail_all(reason);
+        }
+    }
+
+    ranges
+        .iter()
+        .map(|range| {
+            let rules = offer_rules(interface, range);
+            let tag = exit_tag(interface, range);
+            let in_place = rules
+                .iter()
+                .all(|rule| matches!(run(&check_args(rule)), Ran::Exited { success: true, .. }))
+                && present.iter().all(|(_, chain, found)| {
+                    let have = found.iter().filter(|rule| rule.tag == tag).count();
+                    have == rules.iter().filter(|rule| rule.chain == *chain).count()
+                });
+            if in_place {
+                return (*range, RuleOutcome::Applied);
+            }
+            // Start this range from a clean slate: a half-installed set, or
+            // one that differs from the plan, is replaced as a whole.
+            for (table, chain, found) in &present {
+                if let Err(reason) = delete_all(run, table, chain, found, |rule| rule.tag != tag) {
+                    return (*range, RuleOutcome::Failed(reason));
+                }
+            }
+            for rule in &rules {
+                match run(&insert_args(rule)) {
+                    Ran::Missing => {
+                        return (
+                            *range,
+                            RuleOutcome::Failed(missing_iptables(range, interface)),
+                        );
+                    }
+                    Ran::Exited { success: true, .. } => {}
+                    Ran::Exited { stderr, .. } => {
+                        return (*range, RuleOutcome::Failed(failure(&stderr)));
+                    }
+                }
+            }
+            (*range, RuleOutcome::Applied)
+        })
+        .collect()
+}
+
+/// Removes every offering rule of ours for the interface. Best effort.
+fn clear_offer(run: Run<'_>, interface: &str) {
+    let prefix = exit_tag_prefix(interface);
+    for (table, chain) in CHAINS {
+        let Ok(listing) = read_chain(run, table, chain) else {
+            continue;
+        };
+        let found = tagged_rules(&listing, chain, &prefix);
+        if let Err(reason) = delete_all(run, table, chain, &found, |_| false) {
+            tracing::warn!(
+                interface,
+                "cannot remove an exit node firewall rule: {reason}"
+            );
+        }
+    }
+}
+
+/// The kernel's forwarding switch for packets arriving on the interface,
+/// read from the text of the sysctl files. Never written.
+fn forwarding_state(read: impl Fn(&str) -> Option<String>, interface: &str) -> Option<bool> {
+    let flag = |text: String| match text.trim() {
+        "1" => Some(true),
+        "0" => Some(false),
+        _ => None,
+    };
+    // The name is derived here, but it ends up in a path.
+    if !interface.is_empty() && !interface.contains(['/', '\0']) && interface != ".." {
+        let per_interface = format!("/proc/sys/net/ipv4/conf/{interface}/forwarding");
+        if let Some(state) = read(&per_interface).and_then(flag) {
+            return Some(state);
+        }
+    }
+    read("/proc/sys/net/ipv4/ip_forward").and_then(flag)
+}
+
+fn read_sysctl(path: &str) -> Option<String> {
+    std::fs::read_to_string(path).ok()
+}
+
+/// The effective user id from the text of `/proc/self/status`.
+fn parse_euid(status: &str) -> Option<u32> {
+    status
+        .lines()
+        .find_map(|line| line.strip_prefix("Uid:"))
+        .and_then(|rest| rest.split_whitespace().nth(1))
+        .and_then(|effective| effective.parse().ok())
+}
+
+/// Why the using side must not be installed for this process, if it must not.
+///
+/// The bypass rule exempts this process's *user id* from the tunnel. That is
+/// right for a service with an id of its own and wrong for a process started
+/// from somebody's login session, which shares its id with every application
+/// that person runs. A login session is recognised by `XDG_RUNTIME_DIR`,
+/// which `systemd --user` and the login managers set and a system service
+/// does not. Crude on purpose: refusing a service that was started oddly is
+/// a message, and exempting a user's applications is a silent failure.
+fn client_refusal(xdg_runtime_dir: Option<&str>) -> Option<String> {
+    xdg_runtime_dir.filter(|dir| !dir.is_empty()).map(|_| {
+        "the exit node needs the agent to run as a system service with a user of its own: \
+         this agent was started from a login session, so routing everything through the \
+         overlay would take that user's own applications out of the tunnel with it"
+            .to_string()
+    })
+}
+
+impl LinuxHostRules {
+    async fn blocking<T: Send + 'static>(
+        work: impl FnOnce() -> T + Send + 'static,
+    ) -> Result<T, String> {
+        tokio::task::spawn_blocking(work)
+            .await
+            .map_err(|err| format!("the task failed: {err}"))
+    }
+
+    async fn apply_client(&self, interface: &str) -> RuleOutcome {
+        let xdg = std::env::var("XDG_RUNTIME_DIR").ok();
+        if let Some(reason) = client_refusal(xdg.as_deref()) {
+            // Whatever an earlier run left must not stay in force.
+            self.clear_client().await;
+            return RuleOutcome::Failed(reason);
+        }
+        let Some(euid) = std::fs::read_to_string("/proc/self/status")
+            .ok()
+            .and_then(|status| parse_euid(&status))
+        else {
+            return RuleOutcome::Failed("cannot tell which user this agent runs as".to_string());
+        };
+        let route = self.route.clone();
+        let interface = interface.to_string();
+        match Self::blocking(move || route.set_exit_client(&interface, euid)).await {
+            Ok(Ok(())) => RuleOutcome::Applied,
+            Ok(Err(err)) => RuleOutcome::Failed(err.to_string()),
+            Err(reason) => RuleOutcome::Failed(reason),
+        }
+    }
+
+    async fn clear_client(&self) {
+        let route = self.route.clone();
+        if let Ok(Err(err)) = Self::blocking(move || route.clear_exit_client()).await {
+            tracing::warn!(%err, "cannot remove the exit node routing rules");
+        }
+    }
+}
+
+impl ExitHostRules for LinuxHostRules {
+    fn apply<'a>(&'a self, plan: &'a ExitHostPlan) -> BoxFuture<'a, ExitHostReport> {
+        Box::pin(async move {
+            let interface = plan.interface.clone();
+            let ranges = plan.offer.clone();
+            let offer = {
+                let (job_interface, job_ranges) = (interface.clone(), ranges.clone());
+                Self::blocking(move || apply_offer(&run_iptables, &job_interface, &job_ranges))
+                    .await
+                    .unwrap_or_else(|reason| {
+                        ranges
+                            .iter()
+                            .map(|range| (*range, RuleOutcome::Failed(reason.clone())))
+                            .collect()
+                    })
+            };
+            let forwarding = if ranges.is_empty() {
+                None
+            } else {
+                forwarding_state(read_sysctl, &interface)
+            };
+            let client = if plan.client {
+                Some(self.apply_client(&interface).await)
+            } else {
+                self.clear_client().await;
+                None
+            };
+            ExitHostReport {
+                offer,
+                forwarding,
+                client,
+            }
+        })
+    }
+
+    fn clear<'a>(&'a self, interface: &'a str) -> BoxFuture<'a, ()> {
+        Box::pin(async move {
+            let name = interface.to_string();
+            let _ = Self::blocking(move || clear_offer(&run_iptables, &name)).await;
+            self.clear_client().await;
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    #![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+    use std::cell::RefCell;
+
+    use super::*;
+
+    fn range() -> Ipv4Range {
+        "10.13.37.0/24".parse().unwrap()
+    }
+
+    fn words(args: &[String]) -> String {
+        args.join(" ")
+    }
+
+    #[test]
+    fn the_rules_masquerade_the_range_out_of_every_other_interface_and_forward_it() {
+        let rules = offer_rules("tsun0", &range());
+        assert_eq!(rules.len(), 3);
+        assert_eq!(
+            words(&rules[0].spec),
+            "-s 10.13.37.0/24 ! -o tsun0 -m comment --comment tsunagi-exit:tsun0:10.13.37.0/24 -j MASQUERADE"
+        );
+        assert_eq!((rules[0].table, rules[0].chain), ("nat", "POSTROUTING"));
+        assert_eq!(
+            words(&rules[1].spec),
+            "-i tsun0 -s 10.13.37.0/24 ! -o tsun0 -m comment --comment tsunagi-exit:tsun0:10.13.37.0/24 -j ACCEPT"
+        );
+        assert_eq!((rules[1].table, rules[1].chain), ("filter", "FORWARD"));
+        assert_eq!(
+            words(&rules[2].spec),
+            "-o tsun0 -d 10.13.37.0/24 -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment tsunagi-exit:tsun0:10.13.37.0/24 -j ACCEPT"
+        );
+        // Nothing may widen to every source or to the other direction.
+        for rule in &rules {
+            assert!(!words(&rule.spec).contains("0.0.0.0/0"));
+        }
+        assert!(words(&insert_args(&rules[1])).starts_with("-w 5 -t filter -I FORWARD 1 -i tsun0"));
+        assert!(words(&check_args(&rules[0])).starts_with("-w 5 -t nat -C POSTROUTING -s"));
+    }
+
+    #[test]
+    fn only_rules_with_our_tag_for_this_interface_are_selected() {
+        let listing = "\
+-P FORWARD DROP
+-A FORWARD -i tsun0 -s 10.13.37.0/24 ! -o tsun0 -m comment --comment tsunagi-exit:tsun0:10.13.37.0/24 -j ACCEPT
+-A FORWARD -i tsun1 -m comment --comment tsunagi-exit:tsun1:10.99.0.0/24 -j ACCEPT
+-A FORWARD -i tsun01 -m comment --comment tsunagi-exit:tsun01:10.5.0.0/24 -j ACCEPT
+-A FORWARD -m comment --comment \"allow tsunagi-exit:tsun0:x\" -j ACCEPT
+-A FORWARD -m comment --comment tsunagi:tsun0 -j ACCEPT
+-A INPUT -m comment --comment tsunagi-exit:tsun0:10.13.37.0/24 -j ACCEPT
+-A FORWARD -j ACCEPT
+";
+        let found = tagged_rules(listing, "FORWARD", &exit_tag_prefix("tsun0"));
+        assert_eq!(found.len(), 1, "{found:?}");
+        assert_eq!(found[0].tag, "tsunagi-exit:tsun0:10.13.37.0/24");
+        assert_eq!(
+            words(&delete_args("filter", "FORWARD", &found[0])),
+            "-w 5 -t filter -D FORWARD -i tsun0 -s 10.13.37.0/24 ! -o tsun0 -m comment --comment tsunagi-exit:tsun0:10.13.37.0/24 -j ACCEPT"
+        );
+        assert!(tagged_rules("", "FORWARD", "tsunagi-exit:tsun0:").is_empty());
+    }
+
+    /// A scripted `iptables` that remembers which rules it was given.
+    struct Fake {
+        calls: RefCell<Vec<String>>,
+        /// Rules present, as `-S` lines per `(table, chain)`.
+        listing: RefCell<Vec<(String, String)>>,
+        missing: bool,
+        check_ok: bool,
+    }
+
+    impl Fake {
+        fn new(check_ok: bool) -> Self {
+            Self {
+                calls: RefCell::new(Vec::new()),
+                listing: RefCell::new(Vec::new()),
+                missing: false,
+                check_ok,
+            }
+        }
+
+        fn with_rule(self, table: &str, line: &str) -> Self {
+            self.listing
+                .borrow_mut()
+                .push((table.to_string(), line.to_string()));
+            self
+        }
+
+        fn run(&self, args: &[String]) -> Ran {
+            if self.missing {
+                return Ran::Missing;
+            }
+            let line = args.join(" ");
+            self.calls.borrow_mut().push(line.clone());
+            let table = args
+                .iter()
+                .position(|word| word == "-t")
+                .map(|at| args[at + 1].clone())
+                .unwrap_or_default();
+            let ok = |stdout: String| Ran::Exited {
+                success: true,
+                stdout,
+                stderr: String::new(),
+            };
+            if line.contains(" -S ") {
+                let listing: Vec<String> = self
+                    .listing
+                    .borrow()
+                    .iter()
+                    .filter(|(t, _)| *t == table)
+                    .map(|(_, l)| l.clone())
+                    .collect();
+                return ok(listing.join("\n"));
+            }
+            if line.contains(" -C ") {
+                return Ran::Exited {
+                    success: self.check_ok,
+                    stdout: String::new(),
+                    stderr: String::new(),
+                };
+            }
+            ok(String::new())
+        }
+
+        fn verbs(&self, verb: &str) -> Vec<String> {
+            self.calls
+                .borrow()
+                .iter()
+                .filter(|call| call.contains(&format!(" {verb} ")))
+                .cloned()
+                .collect()
+        }
+    }
+
+    #[test]
+    fn a_fresh_host_gets_the_three_rules() {
+        let fake = Fake::new(false);
+        let outcome = apply_offer(&|args| fake.run(args), "tsun0", &[range()]);
+        assert_eq!(outcome, vec![(range(), RuleOutcome::Applied)]);
+        let inserted = fake.verbs("-I");
+        assert_eq!(inserted.len(), 3, "{inserted:?}");
+        assert!(inserted[0].contains("-t nat -I POSTROUTING 1"));
+        assert!(fake.verbs("-D").is_empty());
+    }
+
+    #[test]
+    fn rules_already_in_place_are_left_alone() {
+        let tag = exit_tag("tsun0", &range());
+        let fake = Fake::new(true)
+            .with_rule(
+                "nat",
+                &format!("-A POSTROUTING -s 10.13.37.0/24 ! -o tsun0 -m comment --comment {tag} -j MASQUERADE"),
+            )
+            .with_rule("filter", &format!("-A FORWARD -i tsun0 -m comment --comment {tag} -j ACCEPT"))
+            .with_rule("filter", &format!("-A FORWARD -o tsun0 -m comment --comment {tag} -j ACCEPT"));
+        let outcome = apply_offer(&|args| fake.run(args), "tsun0", &[range()]);
+        assert_eq!(outcome, vec![(range(), RuleOutcome::Applied)]);
+        assert!(fake.verbs("-I").is_empty());
+        assert!(fake.verbs("-D").is_empty());
+    }
+
+    #[test]
+    fn a_stale_range_is_removed_and_a_half_installed_set_is_replaced() {
+        let old: Ipv4Range = "10.99.0.0/24".parse().unwrap();
+        let old_tag = exit_tag("tsun0", &old);
+        let tag = exit_tag("tsun0", &range());
+        let fake = Fake::new(true)
+            .with_rule(
+                "nat",
+                &format!(
+                    "-A POSTROUTING -s 10.99.0.0/24 -m comment --comment {old_tag} -j MASQUERADE"
+                ),
+            )
+            // Only one of the three for the current range.
+            .with_rule(
+                "filter",
+                &format!("-A FORWARD -i tsun0 -m comment --comment {tag} -j ACCEPT"),
+            )
+            // Somebody else's rule, which must survive.
+            .with_rule("filter", "-A FORWARD -i eth0 -j ACCEPT");
+        let outcome = apply_offer(&|args| fake.run(args), "tsun0", &[range()]);
+        assert_eq!(outcome, vec![(range(), RuleOutcome::Applied)]);
+        let deleted = fake.verbs("-D");
+        assert!(
+            deleted.iter().any(|call| call.contains(&old_tag)),
+            "{deleted:?}"
+        );
+        assert!(
+            deleted.iter().any(|call| call.contains(&tag)),
+            "{deleted:?}"
+        );
+        assert!(
+            deleted.iter().all(|call| !call.contains("eth0")),
+            "{deleted:?}"
+        );
+        assert_eq!(fake.verbs("-I").len(), 3);
+    }
+
+    #[test]
+    fn clearing_removes_only_our_rules_for_the_interface() {
+        let tag = exit_tag("tsun0", &range());
+        let other = exit_tag("tsun1", &range());
+        let fake = Fake::new(true)
+            .with_rule(
+                "nat",
+                &format!("-A POSTROUTING -m comment --comment {tag} -j MASQUERADE"),
+            )
+            .with_rule(
+                "nat",
+                &format!("-A POSTROUTING -m comment --comment {other} -j MASQUERADE"),
+            )
+            .with_rule("filter", "-A FORWARD -j ACCEPT");
+        clear_offer(&|args| fake.run(args), "tsun0");
+        let deleted = fake.verbs("-D");
+        assert_eq!(deleted.len(), 1, "{deleted:?}");
+        assert!(deleted[0].contains(&tag));
+    }
+
+    #[test]
+    fn a_missing_iptables_is_a_failure_that_says_what_to_do() {
+        let mut fake = Fake::new(false);
+        fake.missing = true;
+        let outcome = apply_offer(&|args| fake.run(args), "tsun0", &[range()]);
+        let RuleOutcome::Failed(reason) = &outcome[0].1 else {
+            panic!("{outcome:?}");
+        };
+        assert!(reason.contains("iptables not found"), "{reason}");
+        assert!(reason.contains("10.13.37.0/24"), "{reason}");
+        // Nothing wanted and nothing to run is not a failure of anything.
+        assert!(apply_offer(&|args| fake.run(args), "tsun0", &[]).is_empty());
+    }
+
+    #[test]
+    fn forwarding_is_read_per_interface_then_globally_and_never_written() {
+        let files = |per: Option<&'static str>, global: Option<&'static str>| {
+            move |path: &str| match path {
+                "/proc/sys/net/ipv4/conf/tsun0/forwarding" => per.map(str::to_string),
+                "/proc/sys/net/ipv4/ip_forward" => global.map(str::to_string),
+                _ => None,
+            }
+        };
+        assert_eq!(
+            forwarding_state(files(Some("1\n"), Some("0\n")), "tsun0"),
+            Some(true)
+        );
+        assert_eq!(
+            forwarding_state(files(Some("0\n"), Some("1\n")), "tsun0"),
+            Some(false)
+        );
+        assert_eq!(
+            forwarding_state(files(None, Some("1\n")), "tsun0"),
+            Some(true)
+        );
+        assert_eq!(forwarding_state(files(None, None), "tsun0"), None);
+        assert_eq!(forwarding_state(files(Some("junk"), None), "tsun0"), None);
+        // A name that would leave the directory is not looked up.
+        assert_eq!(forwarding_state(files(Some("1"), None), "../../x"), None);
+    }
+
+    #[test]
+    fn the_effective_uid_is_the_second_field() {
+        let status = "Name:\ttsunagi\nUid:\t1001\t1002\t1001\t1001\nGid:\t5\t5\t5\t5\n";
+        assert_eq!(parse_euid(status), Some(1002));
+        assert_eq!(parse_euid("Name:\tx\n"), None);
+    }
+
+    #[test]
+    fn a_login_session_is_refused_and_a_service_is_not() {
+        let reason = client_refusal(Some("/run/user/1000")).unwrap();
+        assert!(reason.contains("system service"), "{reason}");
+        assert!(client_refusal(None).is_none());
+        assert!(client_refusal(Some("")).is_none());
+    }
+}

crates/tsunagi-core/src/overlay/hostrules/macos.rs

@@ -0,0 +1,189 @@
+//! Broadcast host rules on macOS: a `route` entry; the firewall is deferred.
+//!
+//! The limited-broadcast route is installed with `/sbin/route`, so a game's
+//! LAN discovery packet leaves through the overlay interface. It belongs to
+//! the interface and is removed when broadcast is turned off, the network
+//! leaves, or the agent stops — and, because a utun is torn down with the
+//! process, it also goes away on its own if the agent is killed.
+//!
+//! The inbound-UDP firewall allowance is **not** implemented here. On macOS
+//! that means a `pf` anchor, which is a good deal more machinery; until it is
+//! written the firewall half reports itself as missing with what to allow by
+//! hand, and the route is still installed. Failure is contained: neither half
+//! can stop the agent, and `status` shows exactly which is in place.
+//!
+//! `route` is a program, not a system call, so it is run by absolute path from
+//! `/sbin` rather than off `PATH`, and its arguments are built from values
+//! this agent computed — the interface name the kernel assigned, nothing a
+//! peer said.
+
+use crate::BoxFuture;
+
+use super::{BroadcastHostRules, BroadcastRulesPlan, BroadcastRulesReport, RuleOutcome};
+
+/// The limited-broadcast destination routed through the overlay interface.
+const LIMITED_BROADCAST: &str = "255.255.255.255";
+
+/// The `route` arguments that direct the limited broadcast out an interface.
+fn route_add_args(interface: &str) -> Vec<String> {
+    vec![
+        "-q".into(),
+        "-n".into(),
+        "add".into(),
+        "-host".into(),
+        LIMITED_BROADCAST.into(),
+        "-interface".into(),
+        interface.into(),
+    ]
+}
+
+/// The `route` arguments that remove it again.
+fn route_del_args(interface: &str) -> Vec<String> {
+    vec![
+        "-q".into(),
+        "-n".into(),
+        "delete".into(),
+        "-host".into(),
+        LIMITED_BROADCAST.into(),
+        "-interface".into(),
+        interface.into(),
+    ]
+}
+
+/// What to do by hand while the `pf` allowance is unimplemented.
+fn firewall_todo(plan: &BroadcastRulesPlan) -> String {
+    format!(
+        "the inbound-UDP firewall allowance is not implemented on macOS yet; if the host \
+         firewall drops discovery replies, allow inbound UDP from {} on `{}` with a pf rule \
+         yourself",
+        plan.range, plan.interface
+    )
+}
+
+/// The macOS implementation: `route` for the route, no firewall yet.
+#[derive(Debug, Default)]
+pub struct MacosHostRules;
+
+impl MacosHostRules {
+    /// Creates the host rules.
+    pub fn new() -> Self {
+        Self
+    }
+
+    /// Installs the route, replacing one this agent added earlier so the call
+    /// can be repeated. The delete is best effort: a route that is not there
+    /// is the state the add then reaches anyway.
+    async fn set_route(&self, interface: String) -> RuleOutcome {
+        let _ = run(route_del_args(&interface)).await;
+        match run(route_add_args(&interface)).await {
+            Ok(()) => RuleOutcome::Applied,
+            Err(reason) => RuleOutcome::Failed(reason),
+        }
+    }
+}
+
+impl BroadcastHostRules for MacosHostRules {
+    fn name(&self) -> &str {
+        "route"
+    }
+
+    fn apply<'a>(&'a self, plan: &'a BroadcastRulesPlan) -> BoxFuture<'a, BroadcastRulesReport> {
+        Box::pin(async move {
+            let route = self.set_route(plan.interface.clone()).await;
+            BroadcastRulesReport {
+                plan: plan.clone(),
+                route,
+                firewall: RuleOutcome::Failed(firewall_todo(plan)),
+            }
+        })
+    }
+
+    fn clear<'a>(&'a self, interface: &'a str) -> BoxFuture<'a, ()> {
+        Box::pin(async move {
+            if let Err(reason) = run(route_del_args(interface)).await {
+                tracing::debug!(interface = %interface, %reason, "cannot remove the broadcast route");
+            }
+        })
+    }
+}
+
+/// Runs `/sbin/route`, turning a non-zero exit into the message it printed.
+async fn run(args: Vec<String>) -> Result<(), String> {
+    let display = format!("route {}", args.join(" "));
+    let output = tokio::task::spawn_blocking(move || {
+        std::process::Command::new("/sbin/route")
+            .args(&args)
+            .output()
+    })
+    .await
+    .map_err(|err| format!("could not run {display}: {err}"))?
+    .map_err(|err| format!("could not run {display}: {err}"))?;
+
+    if output.status.success() {
+        return Ok(());
+    }
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    let text = stderr.trim();
+    if text.is_empty() {
+        Err(format!("{display} failed with {}", output.status))
+    } else {
+        Err(format!("{display} failed: {text}"))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    #![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+    use std::net::Ipv4Addr;
+
+    use super::*;
+
+    fn plan() -> BroadcastRulesPlan {
+        BroadcastRulesPlan {
+            interface: "utun5".into(),
+            source: Ipv4Addr::new(10, 13, 37, 142),
+            range: "10.13.37.0/24".parse().unwrap(),
+        }
+    }
+
+    #[test]
+    fn the_route_is_the_limited_broadcast_out_the_interface() {
+        assert_eq!(
+            route_add_args("utun5"),
+            vec![
+                "-q",
+                "-n",
+                "add",
+                "-host",
+                "255.255.255.255",
+                "-interface",
+                "utun5"
+            ]
+        );
+        assert_eq!(
+            route_del_args("utun5"),
+            vec![
+                "-q",
+                "-n",
+                "delete",
+                "-host",
+                "255.255.255.255",
+                "-interface",
+                "utun5"
+            ]
+        );
+    }
+
+    #[test]
+    fn the_firewall_todo_names_the_range_and_interface() {
+        let todo = firewall_todo(&plan());
+        assert!(todo.contains("10.13.37.0/24"), "{todo}");
+        assert!(todo.contains("utun5"), "{todo}");
+        assert!(todo.contains("pf"), "{todo}");
+        // Deferred, so the firewall half is always reported as not in place;
+        // the route runs for real and so is left to an on-host check. Running
+        // `route` here would need root and would change the host routing
+        // table, which the default test suite must never do.
+    }
+}

crates/tsunagi-core/src/overlay/hostrules/mod.rs

@@ -0,0 +1,360 @@
+//! Host rules that let a game's LAN discovery reach the overlay interface.
+//!
+//! Broadcast fanout happens at local TUN ingress (see [`super::broadcast`]),
+//! so a limited broadcast only reaches Tsunagi if the operating system routes
+//! it through the overlay interface, and a discovery *reply* only reaches the
+//! game if the host firewall lets it in. Left to the user that is two manual
+//! steps per host that nobody remembers, so when a network's broadcast is on
+//! the agent installs exactly these two things for the interface it owns:
+//!
+//! * a `255.255.255.255/32` route through the overlay interface, with the
+//!   overlay address as its preferred source, so the game's discovery packet
+//!   leaves with a source address the router recognises;
+//! * an inbound firewall allowance for **UDP only**, from the overlay range
+//!   only, on that interface only. Replies to a broadcast come from a
+//!   different address than the one the request was sent to, so a stateful
+//!   firewall never matches them to the request. Opening every protocol
+//!   would expose services such as SSH to every member of the network, which
+//!   is not what a game needs.
+//!
+//! # Why this is allowed here
+//!
+//! The architecture says plugins never touch routing or firewall settings,
+//! and nothing a peer announces becomes an OS setting. This is neither: it is
+//! the system level, which owns the interface, configuring that interface from
+//! values it computed itself (the interface name is derived locally, the
+//! address and range come from signed state it already verified). Every object
+//! is tagged `tsunagi:<interface>`, reversible, and removed when broadcast is
+//! turned off, the network leaves, or the agent stops. A crash can leave a
+//! firewall rule behind; the next apply for the same interface removes it.
+//!
+//! # Failure is contained
+//!
+//! Neither step can stop the agent. Each reports its own outcome, so a missing
+//! firewall tool still leaves the route in place and says what is missing.
+//!
+//! # Why a trait
+//!
+//! Linux, Windows and the tests do this very differently, while *what* to
+//! install is the same everywhere and lives in [`BroadcastRulesPlan`] and
+//! [`rules_summary`], tested on every platform.
+
+use std::net::Ipv4Addr;
+use std::sync::{Arc, Mutex};
+
+use crate::BoxFuture;
+use crate::state::Ipv4Range;
+
+mod exit;
+pub use exit::{
+    ExitHostPlan, ExitHostReport, ExitHostRules, MockExitRules, exit_tag, exit_tag_prefix,
+    offer_detail,
+};
+
+#[cfg(all(feature = "tun-device", target_os = "linux"))]
+mod linux;
+#[cfg(all(feature = "tun-device", target_os = "linux"))]
+mod linux_exit;
+#[cfg(all(feature = "tun-device", target_os = "linux"))]
+pub use linux::LinuxHostRules;
+
+// Compiled everywhere so the scripts it builds are tested everywhere; only
+// the type that runs them is exported on Windows.
+mod windows;
+#[cfg(all(feature = "tun-device", target_os = "windows"))]
+pub use windows::WindowsHostRules;
+
+#[cfg(all(feature = "tun-device", target_os = "macos"))]
+mod macos;
+#[cfg(all(feature = "tun-device", target_os = "macos"))]
+pub use macos::MacosHostRules;
+
+/// What the host should be told for one interface.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct BroadcastRulesPlan {
+    /// The overlay interface. Derived locally from the network id, never from
+    /// anything a peer said.
+    pub interface: String,
+    /// This agent's overlay address, the route's preferred source.
+    pub source: Ipv4Addr,
+    /// The overlay range inbound UDP is admitted from.
+    pub range: Ipv4Range,
+}
+
+impl BroadcastRulesPlan {
+    /// The tag every object carries, so it can be found again and nothing
+    /// else is ever touched.
+    pub fn tag(&self) -> String {
+        tag_for(&self.interface)
+    }
+}
+
+/// The tag for an interface's objects.
+pub fn tag_for(interface: &str) -> String {
+    format!("tsunagi:{interface}")
+}
+
+/// What happened to one of the two host objects.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum RuleOutcome {
+    /// It is in place.
+    Applied,
+    /// It is not, with a reason a person can act on.
+    Failed(String),
+}
+
+impl RuleOutcome {
+    /// Whether the object is in place.
+    pub fn is_applied(&self) -> bool {
+        matches!(self, Self::Applied)
+    }
+}
+
+/// What applying a plan achieved.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct BroadcastRulesReport {
+    /// What was asked for.
+    pub plan: BroadcastRulesPlan,
+    /// The `255.255.255.255` route.
+    pub route: RuleOutcome,
+    /// The inbound firewall allowance.
+    pub firewall: RuleOutcome,
+}
+
+impl BroadcastRulesReport {
+    /// Whether both objects are in place.
+    pub fn is_ok(&self) -> bool {
+        self.route.is_applied() && self.firewall.is_applied()
+    }
+
+    /// One line for `status`.
+    pub fn summary(&self) -> String {
+        rules_summary(&self.route, &self.firewall)
+    }
+}
+
+/// The status line for a pair of outcomes.
+pub fn rules_summary(route: &RuleOutcome, firewall: &RuleOutcome) -> String {
+    match (route, firewall) {
+        (RuleOutcome::Applied, RuleOutcome::Applied) => "ok (route + firewall)".to_string(),
+        (route, firewall) => {
+            let part = |what: &str, outcome: &RuleOutcome| match outcome {
+                RuleOutcome::Applied => format!("{what} ok"),
+                RuleOutcome::Failed(reason) => format!("{what} failed: {reason}"),
+            };
+            format!(
+                "incomplete; {}; {}",
+                part("route", route),
+                part("firewall", firewall)
+            )
+        }
+    }
+}
+
+/// Installs and removes the host rules for an overlay interface.
+///
+/// Both calls are idempotent. Neither can fail as a whole: a step that cannot
+/// be done is reported in the [`BroadcastRulesReport`], because the caller's
+/// only useful response is to say so.
+pub trait BroadcastHostRules: Send + Sync + std::fmt::Debug + 'static {
+    /// A short name used in diagnostics.
+    fn name(&self) -> &str;
+
+    /// Makes the host match the plan, replacing whatever this agent put there
+    /// for the same interface before.
+    fn apply<'a>(&'a self, plan: &'a BroadcastRulesPlan) -> BoxFuture<'a, BroadcastRulesReport>;
+
+    /// Removes what this agent put there for the interface. Succeeds when
+    /// nothing is there: it runs on the shutdown path.
+    fn clear<'a>(&'a self, interface: &'a str) -> BoxFuture<'a, ()>;
+
+    /// The exit-node rules that go with these, when the platform has them.
+    ///
+    /// One object per host, because both halves need the same privileged
+    /// helpers; the default is that this platform has none, which is said
+    /// where it matters rather than pretended.
+    fn exit_rules(&self) -> Option<&dyn ExitHostRules> {
+        None
+    }
+}
+
+/// The platform has no implementation, which is said rather than pretended.
+#[derive(Debug, Default)]
+pub struct UnsupportedHostRules;
+
+impl BroadcastHostRules for UnsupportedHostRules {
+    fn name(&self) -> &str {
+        "unsupported"
+    }
+
+    fn apply<'a>(&'a self, plan: &'a BroadcastRulesPlan) -> BoxFuture<'a, BroadcastRulesReport> {
+        Box::pin(async move {
+            let reason = "host rules are not implemented on this platform; route \
+                          255.255.255.255 through the overlay interface and allow inbound \
+                          UDP from the overlay range yourself"
+                .to_string();
+            BroadcastRulesReport {
+                plan: plan.clone(),
+                route: RuleOutcome::Failed(reason.clone()),
+                firewall: RuleOutcome::Failed(reason),
+            }
+        })
+    }
+
+    fn clear<'a>(&'a self, _interface: &'a str) -> BoxFuture<'a, ()> {
+        Box::pin(async move {})
+    }
+}
+
+/// What a [`MockHostRules`] currently holds, per interface.
+pub type MockRulesState = std::collections::BTreeMap<String, BroadcastRulesPlan>;
+
+/// An in-memory host, for tests: nothing is touched.
+#[derive(Debug, Clone, Default)]
+pub struct MockHostRules {
+    exit: MockExitRules,
+    state: Arc<Mutex<MockRulesState>>,
+    calls: Arc<Mutex<Vec<String>>>,
+    firewall_failure: Arc<Mutex<Option<String>>>,
+}
+
+impl MockHostRules {
+    /// An empty host.
+    pub fn new() -> Self {
+        Self {
+            exit: MockExitRules::new(),
+            ..Self::default()
+        }
+    }
+
+    /// The exit-node half of this host, for inspecting and steering tests.
+    pub fn exit(&self) -> &MockExitRules {
+        &self.exit
+    }
+
+    /// Makes the firewall step fail with this reason from now on.
+    pub fn fail_firewall(&self, reason: impl Into<String>) {
+        *lock(&self.firewall_failure) = Some(reason.into());
+    }
+
+    /// What is installed now.
+    pub fn installed(&self) -> MockRulesState {
+        lock(&self.state).clone()
+    }
+
+    /// Every `apply:<interface>` / `clear:<interface>` call, in order.
+    pub fn calls(&self) -> Vec<String> {
+        lock(&self.calls).clone()
+    }
+}
+
+fn lock<T>(mutex: &Mutex<T>) -> std::sync::MutexGuard<'_, T> {
+    match mutex.lock() {
+        Ok(guard) => guard,
+        Err(poisoned) => poisoned.into_inner(),
+    }
+}
+
+impl BroadcastHostRules for MockHostRules {
+    fn name(&self) -> &str {
+        "mock"
+    }
+
+    fn exit_rules(&self) -> Option<&dyn ExitHostRules> {
+        Some(&self.exit)
+    }
+
+    fn apply<'a>(&'a self, plan: &'a BroadcastRulesPlan) -> BoxFuture<'a, BroadcastRulesReport> {
+        Box::pin(async move {
+            lock(&self.calls).push(format!("apply:{}", plan.interface));
+            lock(&self.state).insert(plan.interface.clone(), plan.clone());
+            let firewall = match lock(&self.firewall_failure).clone() {
+                Some(reason) => RuleOutcome::Failed(reason),
+                None => RuleOutcome::Applied,
+            };
+            BroadcastRulesReport {
+                plan: plan.clone(),
+                route: RuleOutcome::Applied,
+                firewall,
+            }
+        })
+    }
+
+    fn clear<'a>(&'a self, interface: &'a str) -> BoxFuture<'a, ()> {
+        Box::pin(async move {
+            lock(&self.calls).push(format!("clear:{interface}"));
+            lock(&self.state).remove(interface);
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    #![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+    use super::*;
+
+    fn plan() -> BroadcastRulesPlan {
+        BroadcastRulesPlan {
+            interface: "tsun0".into(),
+            source: Ipv4Addr::new(10, 13, 37, 142),
+            range: "10.13.37.0/24".parse().unwrap(),
+        }
+    }
+
+    #[test]
+    fn every_object_is_tagged_with_its_interface() {
+        assert_eq!(plan().tag(), "tsunagi:tsun0");
+        assert_eq!(tag_for("tsun7"), "tsunagi:tsun7");
+    }
+
+    #[test]
+    fn the_summary_says_which_half_is_missing() {
+        assert_eq!(
+            rules_summary(&RuleOutcome::Applied, &RuleOutcome::Applied),
+            "ok (route + firewall)"
+        );
+        let line = rules_summary(
+            &RuleOutcome::Applied,
+            &RuleOutcome::Failed("iptables not found".into()),
+        );
+        assert!(line.contains("route ok"), "{line}");
+        assert!(
+            line.contains("firewall failed: iptables not found"),
+            "{line}"
+        );
+        let report = BroadcastRulesReport {
+            plan: plan(),
+            route: RuleOutcome::Failed("denied".into()),
+            firewall: RuleOutcome::Applied,
+        };
+        assert!(!report.is_ok());
+        assert!(report.summary().contains("route failed: denied"));
+    }
+
+    #[tokio::test]
+    async fn the_mock_applies_replaces_and_clears_idempotently() {
+        let rules = MockHostRules::new();
+        let first = rules.apply(&plan()).await;
+        assert!(first.is_ok());
+        assert_eq!(rules.installed().len(), 1);
+
+        let mut moved = plan();
+        moved.source = Ipv4Addr::new(10, 13, 37, 7);
+        rules.apply(&moved).await;
+        assert_eq!(rules.installed()["tsun0"].source, moved.source);
+
+        rules.clear("tsun0").await;
+        rules.clear("tsun0").await;
+        assert!(rules.installed().is_empty());
+        assert_eq!(rules.calls().len(), 4);
+    }
+
+    #[tokio::test]
+    async fn an_unsupported_platform_reports_both_steps_failed() {
+        let report = UnsupportedHostRules.apply(&plan()).await;
+        assert!(!report.route.is_applied());
+        assert!(!report.firewall.is_applied());
+        UnsupportedHostRules.clear("tsun0").await;
+    }
+}

crates/tsunagi-core/src/overlay/hostrules/windows.rs

@@ -0,0 +1,272 @@
+//! Broadcast host rules on Windows: a route and a Defender Firewall rule.
+//!
+//! Both are written with the `NetTCPIP` and `NetSecurity` PowerShell modules,
+//! run by absolute path from `%SystemRoot%` like the DNS publisher does: the
+//! in-process alternatives are `unsafe` IP Helper calls this crate forbids.
+//!
+//! * The route is `255.255.255.255/32` on the overlay interface, on-link, with
+//!   metric 1, written to the active store only so it cannot outlive a reboot.
+//!   Windows picks the interface's own address as the source of a packet sent
+//!   along it; with several networks on one interface that is whichever
+//!   address Windows treats as primary, which this cannot choose.
+//! * The firewall rule allows inbound UDP on that interface alias from the
+//!   overlay range only, in every profile. Wintun adapters are usually
+//!   classified as a public network, where inbound UDP is otherwise dropped.
+//!   Its display name is the tag `tsunagi:<interface>`, which is how it is
+//!   found again, replaced and removed.
+//!
+//! Every value in a script is one this agent produced: the interface name is
+//! derived from the network id and the range comes from signed state. They are
+//! still single-quoted and escaped, so nothing could be read as PowerShell
+//! rather than as data. Changing routes and firewall rules needs an elevated
+//! process, which is reported as its own cause.
+//!
+//! This module is compiled everywhere so its script building is tested
+//! everywhere. It could not be run against a real Windows host while it was
+//! written.
+
+#![cfg_attr(not(target_os = "windows"), allow(dead_code))]
+
+use crate::BoxFuture;
+
+use super::{BroadcastHostRules, BroadcastRulesPlan, BroadcastRulesReport, RuleOutcome, tag_for};
+
+/// A PowerShell single-quoted literal, with any embedded quote doubled.
+fn ps_literal(value: &str) -> String {
+    format!("'{}'", value.replace('\'', "''"))
+}
+
+/// The step that makes the route match the plan.
+///
+/// A leftover route (from a crashed run, or for an old interface index) is
+/// removed first so the result is exactly one route.
+fn route_script(plan: &BroadcastRulesPlan) -> String {
+    let alias = ps_literal(&plan.interface);
+    format!(
+        "$ErrorActionPreference = 'Stop'\n\
+         $alias = {alias}\n\
+         Get-NetRoute -DestinationPrefix '255.255.255.255/32' -InterfaceAlias $alias \
+         -PolicyStore ActiveStore -ErrorAction SilentlyContinue | \
+         Remove-NetRoute -Confirm:$false -ErrorAction SilentlyContinue\n\
+         New-NetRoute -DestinationPrefix '255.255.255.255/32' -InterfaceAlias $alias \
+         -NextHop '0.0.0.0' -RouteMetric 1 -PolicyStore ActiveStore | Out-Null\n"
+    )
+}
+
+/// The step that makes the firewall hold exactly one rule for the interface.
+fn firewall_script(plan: &BroadcastRulesPlan) -> String {
+    let alias = ps_literal(&plan.interface);
+    let tag = ps_literal(&plan.tag());
+    let range = ps_literal(&plan.range.to_string());
+    format!(
+        "$ErrorActionPreference = 'Stop'\n\
+         $alias = {alias}\n\
+         $tag = {tag}\n\
+         Get-NetFirewallRule -DisplayName $tag -ErrorAction SilentlyContinue | \
+         Remove-NetFirewallRule -ErrorAction SilentlyContinue\n\
+         New-NetFirewallRule -DisplayName $tag -Direction Inbound -Action Allow -Protocol UDP \
+         -InterfaceAlias $alias -RemoteAddress {range} -Profile Any | Out-Null\n"
+    )
+}
+
+/// The script that removes both, ignoring what is not there.
+fn clear_script(interface: &str) -> String {
+    let alias = ps_literal(interface);
+    let tag = ps_literal(&tag_for(interface));
+    format!(
+        "$ErrorActionPreference = 'SilentlyContinue'\n\
+         Get-NetRoute -DestinationPrefix '255.255.255.255/32' -InterfaceAlias {alias} \
+         -PolicyStore ActiveStore | Remove-NetRoute -Confirm:$false\n\
+         Get-NetFirewallRule -DisplayName {tag} | Remove-NetFirewallRule\n\
+         exit 0\n"
+    )
+}
+
+/// Turns what PowerShell said into a cause a person can act on.
+fn classify(what: &str, text: &str) -> String {
+    let lower = text.to_ascii_lowercase();
+    if lower.contains("access is denied")
+        || lower.contains("requires elevation")
+        || lower.contains("run as administrator")
+        || lower.contains("permissiondenied")
+    {
+        format!("{what}: Windows refused; run tsng from an elevated (administrator) process")
+    } else if lower.contains("is not recognized") || lower.contains("commandnotfound") {
+        format!("{what}: the NetTCPIP/NetSecurity PowerShell modules are not available: {text}")
+    } else if text.is_empty() {
+        format!("{what}: failed without saying why")
+    } else {
+        format!("{what}: {text}")
+    }
+}
+
+/// The absolute path to Windows PowerShell, so nothing on `PATH` can stand in
+/// for it.
+fn powershell_path() -> std::path::PathBuf {
+    let root = std::env::var_os("SystemRoot").unwrap_or_else(|| r"C:\Windows".into());
+    std::path::Path::new(&root)
+        .join("System32")
+        .join("WindowsPowerShell")
+        .join("v1.0")
+        .join("powershell.exe")
+}
+
+/// Runs a script and returns what it said on failure.
+fn run_powershell(script: &str) -> Result<(), String> {
+    let output = std::process::Command::new(powershell_path())
+        .args([
+            "-NoProfile",
+            "-NonInteractive",
+            "-ExecutionPolicy",
+            "Bypass",
+            "-Command",
+            script,
+        ])
+        .output()
+        .map_err(|err| format!("could not run PowerShell: {err}"))?;
+    if output.status.success() {
+        return Ok(());
+    }
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    let text = if stderr.trim().is_empty() {
+        String::from_utf8_lossy(&output.stdout).trim().to_string()
+    } else {
+        stderr.trim().to_string()
+    };
+    Err(text)
+}
+
+async fn step(what: &'static str, script: String) -> RuleOutcome {
+    match tokio::task::spawn_blocking(move || run_powershell(&script)).await {
+        Ok(Ok(())) => RuleOutcome::Applied,
+        Ok(Err(text)) => RuleOutcome::Failed(classify(what, &text)),
+        Err(err) => RuleOutcome::Failed(format!("{what}: the task failed: {err}")),
+    }
+}
+
+/// The Windows implementation, through PowerShell.
+#[derive(Debug, Default)]
+pub struct WindowsHostRules;
+
+impl WindowsHostRules {
+    /// Creates it. Nothing is run until [`BroadcastHostRules::apply`].
+    pub fn new() -> Self {
+        Self
+    }
+}
+
+impl BroadcastHostRules for WindowsHostRules {
+    fn name(&self) -> &str {
+        "windows-netsecurity"
+    }
+
+    fn apply<'a>(&'a self, plan: &'a BroadcastRulesPlan) -> BoxFuture<'a, BroadcastRulesReport> {
+        Box::pin(async move {
+            let route = step("route", route_script(plan)).await;
+            let firewall = step("firewall", firewall_script(plan)).await;
+            BroadcastRulesReport {
+                plan: plan.clone(),
+                route,
+                firewall,
+            }
+        })
+    }
+
+    fn clear<'a>(&'a self, interface: &'a str) -> BoxFuture<'a, ()> {
+        Box::pin(async move {
+            if let RuleOutcome::Failed(reason) = step("clear", clear_script(interface)).await {
+                tracing::warn!(
+                    interface,
+                    "cannot remove the broadcast host rules: {reason}"
+                );
+            }
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    #![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+    use super::*;
+    use std::net::Ipv4Addr;
+
+    fn plan() -> BroadcastRulesPlan {
+        BroadcastRulesPlan {
+            interface: "tsun0".into(),
+            source: Ipv4Addr::new(10, 13, 37, 142),
+            range: "10.13.37.0/24".parse().unwrap(),
+        }
+    }
+
+    #[test]
+    fn a_quote_in_a_value_cannot_escape_the_literal() {
+        assert_eq!(ps_literal("a'b"), "'a''b'");
+        let mut hostile = plan();
+        hostile.interface = "x'; Remove-Item C:\\ #".into();
+        let script = route_script(&hostile);
+        assert!(
+            script.contains("$alias = 'x''; Remove-Item C:\\ #'"),
+            "{script}"
+        );
+        assert!(firewall_script(&hostile).contains("'x''; Remove-Item C:\\ #'"));
+    }
+
+    #[test]
+    fn the_route_is_on_link_metric_one_in_the_active_store_and_replaces_its_own() {
+        let script = route_script(&plan());
+        assert!(script.contains("'255.255.255.255/32'"));
+        assert!(script.contains("-NextHop '0.0.0.0'"));
+        assert!(script.contains("-RouteMetric 1"));
+        assert!(script.contains("-PolicyStore ActiveStore"));
+        assert!(
+            script.find("Remove-NetRoute").unwrap() < script.find("New-NetRoute").unwrap(),
+            "a stale route goes before the new one:\n{script}"
+        );
+    }
+
+    #[test]
+    fn the_firewall_rule_is_udp_only_from_the_overlay_range_on_this_interface() {
+        let script = firewall_script(&plan());
+        assert!(script.contains("-Protocol UDP"));
+        assert!(script.contains("-Direction Inbound -Action Allow"));
+        assert!(script.contains("-InterfaceAlias $alias"));
+        assert!(script.contains("-RemoteAddress '10.13.37.0/24'"));
+        assert!(script.contains("$tag = 'tsunagi:tsun0'"));
+        assert!(!script.contains("-Protocol Any") && !script.contains("-Protocol TCP"));
+        assert!(
+            script.find("Remove-NetFirewallRule").unwrap()
+                < script.find("New-NetFirewallRule").unwrap(),
+            "{script}"
+        );
+    }
+
+    #[test]
+    fn clearing_touches_only_our_route_and_our_tagged_rule() {
+        let script = clear_script("tsun0");
+        assert!(script.contains("-InterfaceAlias 'tsun0'"));
+        assert!(script.contains("Get-NetFirewallRule -DisplayName 'tsunagi:tsun0'"));
+        assert!(script.contains("exit 0"));
+    }
+
+    #[test]
+    fn a_refusal_names_elevation_and_a_missing_module_names_the_module() {
+        assert!(classify("route", "Access is denied").contains("elevated"));
+        assert!(
+            classify(
+                "firewall",
+                "The term 'New-NetFirewallRule' is not recognized"
+            )
+            .contains("modules are not available")
+        );
+        assert_eq!(classify("route", "boom"), "route: boom");
+        assert!(classify("route", "").contains("without saying why"));
+    }
+
+    #[test]
+    fn powershell_is_found_by_absolute_path() {
+        let path = powershell_path();
+        assert!(path.ends_with("powershell.exe"));
+        assert!(path.to_string_lossy().contains("System32"), "{path:?}");
+    }
+}