cc1a9786

By: Tom Sydney Kerckhove <syd@cs-syd.eu>

Check the forwards against the machines that expect them

A lease table could already be checked against what else describes the
network. The forwards could not, and they are where the disagreements were: a
machine reached on a port nothing forwards is a machine nobody can reach that
way, and nobody finds out until they try.

So a host can say what it expects forwarded to it, and two checks compare that
with the rules both ways round: a declared forward with no rule, and a rule to
a declared machine that expects no such thing. The second one matters as much
as the first, because a forward nobody meant is a hole nobody is watching.

Compared as written rather than as arithmetic, so a rule saying
dst-port=60900-60999 answers a declaration of 60900-60999 and not one of
60950. That is the conservative way round: it complains about a rule that says
something different, rather than deciding for itself that a range covers a
port.

`forwards` is optional and its absence is not `[]`. Nothing said is not the
claim "nothing should be forwarded here", and only the second one can be
contradicted by a rule. Conflating them would have made every hosts.json that
predates this fail.