@push.rocks/smartnftables 1.0.1

package/changelog.md

@@ -0,0 +1,10 @@
+# Changelog
+
+## 2026-03-26 - 1.0.1 - fix(repo)
+no changes to commit
+
+
+## 2026-03-26 - 1.0.0 - project
+Initial release.
+
+- Project initialized with first commit.

package/dist_ts/00_commitinfo_data.d.ts

@@ -0,0 +1,8 @@
+/**
+ * autocreated commitinfo by @push.rocks/commitinfo
+ */
+export declare const commitinfo: {
+    name: string;
+    version: string;
+    description: string;
+};

package/dist_ts/00_commitinfo_data.js

@@ -0,0 +1,9 @@
+/**
+ * autocreated commitinfo by @push.rocks/commitinfo
+ */
+export const commitinfo = {
+    name: '@push.rocks/smartnftables',
+    version: '1.0.1',
+    description: 'A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.'
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSwyQkFBMkI7SUFDakMsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLG1IQUFtSDtDQUNqSSxDQUFBIn0=

package/dist_ts/index.d.ts

@@ -0,0 +1,10 @@
+export { SmartNftables } from './nft.manager.js';
+export { NatManager } from './nft.manager.nat.js';
+export { FirewallManager } from './nft.manager.firewall.js';
+export { RateLimitManager } from './nft.manager.ratelimit.js';
+export { NftExecutor, NftNotRootError, NftCommandError } from './nft.executor.js';
+export { buildTableSetup, buildFilterChains, buildTableCleanup, } from './nft.rulebuilder.table.js';
+export { buildDnatRules, buildSnatRule, buildMasqueradeRule, } from './nft.rulebuilder.nat.js';
+export { buildRateLimitRule, buildPerIpRateLimitRule, buildConnectionRateRule, } from './nft.rulebuilder.ratelimit.js';
+export { buildFirewallRule, buildIPSetCreate, buildIPSetAddElements, buildIPSetRemoveElements, buildIPSetDelete, buildIPSetMatchRule, } from './nft.rulebuilder.firewall.js';
+export type { TNftProtocol, TNftFamily, TNftChainHook, TNftChainType, TNftPolicy, TFirewallAction, TCtState, INftDnatRule, INftSnatRule, INftMasqueradeRule, INftRateLimitRule, INftConnectionRateRule, INftFirewallRule, INftIPSetConfig, INftRuleGroup, ISmartNftablesOptions, INftStatus, } from './nft.types.js';

package/dist_ts/index.js

@@ -0,0 +1,14 @@
+// Main facade
+export { SmartNftables } from './nft.manager.js';
+// Sub-managers
+export { NatManager } from './nft.manager.nat.js';
+export { FirewallManager } from './nft.manager.firewall.js';
+export { RateLimitManager } from './nft.manager.ratelimit.js';
+// Executor
+export { NftExecutor, NftNotRootError, NftCommandError } from './nft.executor.js';
+// Rule builders (for advanced usage)
+export { buildTableSetup, buildFilterChains, buildTableCleanup, } from './nft.rulebuilder.table.js';
+export { buildDnatRules, buildSnatRule, buildMasqueradeRule, } from './nft.rulebuilder.nat.js';
+export { buildRateLimitRule, buildPerIpRateLimitRule, buildConnectionRateRule, } from './nft.rulebuilder.ratelimit.js';
+export { buildFirewallRule, buildIPSetCreate, buildIPSetAddElements, buildIPSetRemoveElements, buildIPSetDelete, buildIPSetMatchRule, } from './nft.rulebuilder.firewall.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxjQUFjO0FBQ2QsT0FBTyxFQUFFLGFBQWEsRUFBRSxNQUFNLGtCQUFrQixDQUFDO0FBRWpELGVBQWU7QUFDZixPQUFPLEVBQUUsVUFBVSxFQUFFLE1BQU0sc0JBQXNCLENBQUM7QUFDbEQsT0FBTyxFQUFFLGVBQWUsRUFBRSxNQUFNLDJCQUEyQixDQUFDO0FBQzVELE9BQU8sRUFBRSxnQkFBZ0IsRUFBRSxNQUFNLDRCQUE0QixDQUFDO0FBRTlELFdBQVc7QUFDWCxPQUFPLEVBQUUsV0FBVyxFQUFFLGVBQWUsRUFBRSxlQUFlLEVBQUUsTUFBTSxtQkFBbUIsQ0FBQztBQUVsRixxQ0FBcUM7QUFDckMsT0FBTyxFQUNMLGVBQWUsRUFDZixpQkFBaUIsRUFDakIsaUJBQWlCLEdBQ2xCLE1BQU0sNEJBQTRCLENBQUM7QUFFcEMsT0FBTyxFQUNMLGNBQWMsRUFDZCxhQUFhLEVBQ2IsbUJBQW1CLEdBQ3BCLE1BQU0sMEJBQTBCLENBQUM7QUFFbEMsT0FBTyxFQUNMLGtCQUFrQixFQUNsQix1QkFBdUIsRUFDdkIsdUJBQXVCLEdBQ3hCLE1BQU0sZ0NBQWdDLENBQUM7QUFFeEMsT0FBTyxFQUNMLGlCQUFpQixFQUNqQixnQkFBZ0IsRUFDaEIscUJBQXFCLEVBQ3JCLHdCQUF3QixFQUN4QixnQkFBZ0IsRUFDaEIsbUJBQW1CLEdBQ3BCLE1BQU0sK0JBQStCLENBQUMifQ==

package/dist_ts/nft.executor.d.ts

@@ -0,0 +1,32 @@
+export declare class NftNotRootError extends Error {
+    constructor();
+}
+export declare class NftCommandError extends Error {
+    readonly command: string;
+    readonly stderr: string;
+    constructor(command: string, stderr: string);
+}
+/**
+ * Low-level executor for nft CLI commands.
+ */
+export declare class NftExecutor {
+    private dryRun;
+    constructor(options?: {
+        dryRun?: boolean;
+    });
+    /** Check if running as root (euid 0). */
+    isRoot(): boolean;
+    /**
+     * Execute a single nft command.
+     * The command may or may not start with "nft " — the prefix is stripped if present.
+     * Returns stdout on success.
+     */
+    exec(command: string): Promise<string>;
+    /**
+     * Execute multiple nft commands sequentially.
+     * By default stops on first failure. Set continueOnError to keep going.
+     */
+    execBatch(commands: string[], options?: {
+        continueOnError?: boolean;
+    }): Promise<void>;
+}

package/dist_ts/nft.executor.js

@@ -0,0 +1,59 @@
+import * as plugins from './plugins.js';
+const execFile = plugins.util.promisify(plugins.childProcess.execFile);
+export class NftNotRootError extends Error {
+    constructor() {
+        super('Not running as root — nftables commands require root privileges');
+        this.name = 'NftNotRootError';
+    }
+}
+export class NftCommandError extends Error {
+    constructor(command, stderr) {
+        super(`nft command failed: ${command} — ${stderr}`);
+        this.name = 'NftCommandError';
+        this.command = command;
+        this.stderr = stderr;
+    }
+}
+/**
+ * Low-level executor for nft CLI commands.
+ */
+export class NftExecutor {
+    constructor(options) {
+        this.dryRun = options?.dryRun ?? false;
+    }
+    /** Check if running as root (euid 0). */
+    isRoot() {
+        return process.getuid?.() === 0;
+    }
+    /**
+     * Execute a single nft command.
+     * The command may or may not start with "nft " — the prefix is stripped if present.
+     * Returns stdout on success.
+     */
+    async exec(command) {
+        if (this.dryRun) {
+            return '';
+        }
+        // Strip "nft " prefix if present
+        const args = command.startsWith('nft ') ? command.slice(4) : command;
+        const { stdout } = await execFile('nft', args.split(/\s+/));
+        return stdout;
+    }
+    /**
+     * Execute multiple nft commands sequentially.
+     * By default stops on first failure. Set continueOnError to keep going.
+     */
+    async execBatch(commands, options) {
+        for (const cmd of commands) {
+            try {
+                await this.exec(cmd);
+            }
+            catch (err) {
+                if (!options?.continueOnError) {
+                    throw err;
+                }
+            }
+        }
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmZ0LmV4ZWN1dG9yLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvbmZ0LmV4ZWN1dG9yLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sY0FBYyxDQUFDO0FBRXhDLE1BQU0sUUFBUSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLENBQUM7QUFFdkUsTUFBTSxPQUFPLGVBQWdCLFNBQVEsS0FBSztJQUN4QztRQUNFLEtBQUssQ0FBQyxpRUFBaUUsQ0FBQyxDQUFDO1FBQ3pFLElBQUksQ0FBQyxJQUFJLEdBQUcsaUJBQWlCLENBQUM7SUFDaEMsQ0FBQztDQUNGO0FBRUQsTUFBTSxPQUFPLGVBQWdCLFNBQVEsS0FBSztJQUl4QyxZQUFZLE9BQWUsRUFBRSxNQUFjO1FBQ3pDLEtBQUssQ0FBQyx1QkFBdUIsT0FBTyxNQUFNLE1BQU0sRUFBRSxDQUFDLENBQUM7UUFDcEQsSUFBSSxDQUFDLElBQUksR0FBRyxpQkFBaUIsQ0FBQztRQUM5QixJQUFJLENBQUMsT0FBTyxHQUFHLE9BQU8sQ0FBQztRQUN2QixJQUFJLENBQUMsTUFBTSxHQUFHLE1BQU0sQ0FBQztJQUN2QixDQUFDO0NBQ0Y7QUFFRDs7R0FFRztBQUNILE1BQU0sT0FBTyxXQUFXO0lBR3RCLFlBQVksT0FBOEI7UUFDeEMsSUFBSSxDQUFDLE1BQU0sR0FBRyxPQUFPLEVBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQztJQUN6QyxDQUFDO0lBRUQseUNBQXlDO0lBQ2xDLE1BQU07UUFDWCxPQUFPLE9BQU8sQ0FBQyxNQUFNLEVBQUUsRUFBRSxLQUFLLENBQUMsQ0FBQztJQUNsQyxDQUFDO0lBRUQ7Ozs7T0FJRztJQUNJLEtBQUssQ0FBQyxJQUFJLENBQUMsT0FBZTtRQUMvQixJQUFJLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNoQixPQUFPLEVBQUUsQ0FBQztRQUNaLENBQUM7UUFFRCxpQ0FBaUM7UUFDakMsTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDO1FBRXJFLE1BQU0sRUFBRSxNQUFNLEVBQUUsR0FBRyxNQUFNLFFBQVEsQ0FBQyxLQUFLLEVBQUUsSUFBSSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO1FBQzVELE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7SUFFRDs7O09BR0c7SUFDSSxLQUFLLENBQUMsU0FBUyxDQUNwQixRQUFrQixFQUNsQixPQUF1QztRQUV2QyxLQUFLLE1BQU0sR0FBRyxJQUFJLFFBQVEsRUFBRSxDQUFDO1lBQzNCLElBQUksQ0FBQztnQkFDSCxNQUFNLElBQUksQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUM7WUFDdkIsQ0FBQztZQUFDLE9BQU8sR0FBRyxFQUFFLENBQUM7Z0JBQ2IsSUFBSSxDQUFDLE9BQU8sRUFBRSxlQUFlLEVBQUUsQ0FBQztvQkFDOUIsTUFBTSxHQUFHLENBQUM7Z0JBQ1osQ0FBQztZQUNILENBQUM7UUFDSCxDQUFDO0lBQ0gsQ0FBQztDQUNGIn0=

package/dist_ts/nft.manager.d.ts

@@ -0,0 +1,59 @@
+import { NftExecutor } from './nft.executor.js';
+import { NatManager } from './nft.manager.nat.js';
+import { FirewallManager } from './nft.manager.firewall.js';
+import { RateLimitManager } from './nft.manager.ratelimit.js';
+import type { TNftFamily, INftRuleGroup, INftStatus, ISmartNftablesOptions } from './nft.types.js';
+/**
+ * SmartNftables — high-level facade for managing nftables rules.
+ *
+ * Provides sub-managers for NAT, firewall, and rate limiting.
+ * All rules are tracked in logical groups and can be removed individually or cleaned up entirely.
+ */
+export declare class SmartNftables {
+    readonly nat: NatManager;
+    readonly firewall: FirewallManager;
+    readonly rateLimit: RateLimitManager;
+    readonly tableName: string;
+    readonly family: TNftFamily;
+    readonly executor: NftExecutor;
+    private initialized;
+    private hasFilterChains;
+    private warnedNonRoot;
+    private ruleGroups;
+    constructor(options?: ISmartNftablesOptions);
+    /**
+     * Initialize the nftables table and NAT chains. Idempotent.
+     */
+    initialize(): Promise<void>;
+    /**
+     * Ensure filter chains (input/forward/output) are created.
+     * Called automatically when firewall or rate-limit rules are added.
+     */
+    ensureFilterChains(): Promise<void>;
+    /**
+     * Ensure the table is initialized before applying rules.
+     */
+    ensureInitialized(): Promise<void>;
+    /**
+     * Apply a group of nft commands and track them under the given ID.
+     */
+    applyRuleGroup(groupId: string, commands: string[]): Promise<void>;
+    /**
+     * Remove a tracked rule group. Removes from tracking.
+     * Note: full kernel cleanup requires cleanup() — individual rule removal
+     * would require handle-based tracking.
+     */
+    removeRuleGroup(groupId: string): Promise<void>;
+    /**
+     * Get a tracked rule group by ID.
+     */
+    getRuleGroup(groupId: string): INftRuleGroup | undefined;
+    /**
+     * Delete the entire nftables table and clear all tracking.
+     */
+    cleanup(): Promise<void>;
+    /**
+     * Get status report of the managed nftables state.
+     */
+    status(): INftStatus;
+}

package/dist_ts/nft.manager.firewall.d.ts

@@ -0,0 +1,49 @@
+import type { SmartNftables } from './nft.manager.js';
+import type { INftFirewallRule, INftIPSetConfig } from './nft.types.js';
+/**
+ * Manages firewall (filter) rules, IP sets, and convenience methods.
+ */
+export declare class FirewallManager {
+    private parent;
+    constructor(parent: SmartNftables);
+    /**
+     * Add a firewall rule (input/output/forward).
+     */
+    addRule(groupId: string, rule: INftFirewallRule): Promise<void>;
+    /**
+     * Remove a firewall rule group.
+     */
+    removeRule(groupId: string): Promise<void>;
+    /**
+     * Create a named IP set.
+     */
+    createIPSet(config: INftIPSetConfig): Promise<void>;
+    /**
+     * Add elements to an existing IP set.
+     */
+    addToIPSet(setName: string, elements: string[]): Promise<void>;
+    /**
+     * Remove elements from an IP set.
+     */
+    removeFromIPSet(setName: string, elements: string[]): Promise<void>;
+    /**
+     * Delete an IP set entirely.
+     */
+    deleteIPSet(setName: string): Promise<void>;
+    /**
+     * Convenience: block an IP or CIDR subnet.
+     */
+    blockIP(ip: string, options?: {
+        direction?: 'input' | 'forward';
+    }): Promise<void>;
+    /**
+     * Convenience: allow only specific IPs on a port.
+     * Adds accept rules for each IP, then a drop rule for everything else on that port.
+     */
+    allowOnlyIPs(groupId: string, ips: string[], port?: number, protocol?: 'tcp' | 'udp' | 'both'): Promise<void>;
+    /**
+     * Convenience: enable stateful connection tracking.
+     * Allows established+related, drops invalid.
+     */
+    enableStatefulTracking(chain?: 'input' | 'forward' | 'output'): Promise<void>;
+}

package/dist_ts/nft.manager.firewall.js

@@ -0,0 +1,121 @@
+import { buildFirewallRule, buildIPSetCreate, buildIPSetAddElements, buildIPSetRemoveElements, buildIPSetDelete, buildIPSetMatchRule, } from './nft.rulebuilder.firewall.js';
+/**
+ * Manages firewall (filter) rules, IP sets, and convenience methods.
+ */
+export class FirewallManager {
+    constructor(parent) {
+        this.parent = parent;
+    }
+    /**
+     * Add a firewall rule (input/output/forward).
+     */
+    async addRule(groupId, rule) {
+        await this.parent.ensureFilterChains();
+        const commands = buildFirewallRule(this.parent.tableName, this.parent.family, rule);
+        await this.parent.applyRuleGroup(`fw:${groupId}`, commands);
+    }
+    /**
+     * Remove a firewall rule group.
+     */
+    async removeRule(groupId) {
+        await this.parent.removeRuleGroup(`fw:${groupId}`);
+    }
+    /**
+     * Create a named IP set.
+     */
+    async createIPSet(config) {
+        await this.parent.ensureInitialized();
+        const commands = buildIPSetCreate(this.parent.tableName, this.parent.family, config);
+        await this.parent.applyRuleGroup(`ipset:${config.name}`, commands);
+    }
+    /**
+     * Add elements to an existing IP set.
+     */
+    async addToIPSet(setName, elements) {
+        const commands = buildIPSetAddElements(this.parent.tableName, this.parent.family, setName, elements);
+        if (commands.length > 0) {
+            await this.parent.executor.execBatch(commands);
+        }
+    }
+    /**
+     * Remove elements from an IP set.
+     */
+    async removeFromIPSet(setName, elements) {
+        const commands = buildIPSetRemoveElements(this.parent.tableName, this.parent.family, setName, elements);
+        if (commands.length > 0) {
+            await this.parent.executor.execBatch(commands);
+        }
+    }
+    /**
+     * Delete an IP set entirely.
+     */
+    async deleteIPSet(setName) {
+        const commands = buildIPSetDelete(this.parent.tableName, this.parent.family, setName);
+        await this.parent.executor.execBatch(commands);
+        await this.parent.removeRuleGroup(`ipset:${setName}`);
+    }
+    /**
+     * Convenience: block an IP or CIDR subnet.
+     */
+    async blockIP(ip, options) {
+        const direction = options?.direction ?? 'input';
+        const safeId = ip.replace(/[/.]/g, '_');
+        await this.addRule(`block-${safeId}`, {
+            direction,
+            action: 'drop',
+            sourceIP: ip,
+        });
+    }
+    /**
+     * Convenience: allow only specific IPs on a port.
+     * Adds accept rules for each IP, then a drop rule for everything else on that port.
+     */
+    async allowOnlyIPs(groupId, ips, port, protocol) {
+        await this.parent.ensureFilterChains();
+        const commands = [];
+        for (const ip of ips) {
+            const acceptCmds = buildFirewallRule(this.parent.tableName, this.parent.family, {
+                direction: 'input',
+                action: 'accept',
+                sourceIP: ip,
+                destPort: port,
+                protocol,
+            });
+            commands.push(...acceptCmds);
+        }
+        // Drop everything else on that port
+        const dropCmds = buildFirewallRule(this.parent.tableName, this.parent.family, {
+            direction: 'input',
+            action: 'drop',
+            destPort: port,
+            protocol,
+        });
+        commands.push(...dropCmds);
+        await this.parent.applyRuleGroup(`fw:allowonly:${groupId}`, commands);
+    }
+    /**
+     * Convenience: enable stateful connection tracking.
+     * Allows established+related, drops invalid.
+     */
+    async enableStatefulTracking(chain) {
+        await this.parent.ensureFilterChains();
+        const direction = chain ?? 'input';
+        const commands = [];
+        // Allow established and related connections
+        const allowCmds = buildFirewallRule(this.parent.tableName, this.parent.family, {
+            direction,
+            action: 'accept',
+            ctStates: ['established', 'related'],
+        });
+        commands.push(...allowCmds);
+        // Drop invalid connections
+        const dropCmds = buildFirewallRule(this.parent.tableName, this.parent.family, {
+            direction,
+            action: 'drop',
+            ctStates: ['invalid'],
+        });
+        commands.push(...dropCmds);
+        await this.parent.applyRuleGroup(`fw:stateful:${direction}`, commands);
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmZ0Lm1hbmFnZXIuZmlyZXdhbGwuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9uZnQubWFuYWdlci5maXJld2FsbC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFFQSxPQUFPLEVBQ0wsaUJBQWlCLEVBQ2pCLGdCQUFnQixFQUNoQixxQkFBcUIsRUFDckIsd0JBQXdCLEVBQ3hCLGdCQUFnQixFQUNoQixtQkFBbUIsR0FDcEIsTUFBTSwrQkFBK0IsQ0FBQztBQUV2Qzs7R0FFRztBQUNILE1BQU0sT0FBTyxlQUFlO0lBQzFCLFlBQW9CLE1BQXFCO1FBQXJCLFdBQU0sR0FBTixNQUFNLENBQWU7SUFBRyxDQUFDO0lBRTdDOztPQUVHO0lBQ0ksS0FBSyxDQUFDLE9BQU8sQ0FBQyxPQUFlLEVBQUUsSUFBc0I7UUFDMUQsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLGtCQUFrQixFQUFFLENBQUM7UUFDdkMsTUFBTSxRQUFRLEdBQUcsaUJBQWlCLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDcEYsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLGNBQWMsQ0FBQyxNQUFNLE9BQU8sRUFBRSxFQUFFLFFBQVEsQ0FBQyxDQUFDO0lBQzlELENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxVQUFVLENBQUMsT0FBZTtRQUNyQyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsZUFBZSxDQUFDLE1BQU0sT0FBTyxFQUFFLENBQUMsQ0FBQztJQUNyRCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsV0FBVyxDQUFDLE1BQXVCO1FBQzlDLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO1FBQ3RDLE1BQU0sUUFBUSxHQUFHLGdCQUFnQixDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLE1BQU0sQ0FBQyxDQUFDO1FBQ3JGLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxjQUFjLENBQUMsU0FBUyxNQUFNLENBQUMsSUFBSSxFQUFFLEVBQUUsUUFBUSxDQUFDLENBQUM7SUFDckUsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFVBQVUsQ0FBQyxPQUFlLEVBQUUsUUFBa0I7UUFDekQsTUFBTSxRQUFRLEdBQUcscUJBQXFCLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsT0FBTyxFQUFFLFFBQVEsQ0FBQyxDQUFDO1FBQ3JHLElBQUksUUFBUSxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUN4QixNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUNqRCxDQUFDO0lBQ0gsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLGVBQWUsQ0FBQyxPQUFlLEVBQUUsUUFBa0I7UUFDOUQsTUFBTSxRQUFRLEdBQUcsd0JBQXdCLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsT0FBTyxFQUFFLFFBQVEsQ0FBQyxDQUFDO1FBQ3hHLElBQUksUUFBUSxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUN4QixNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUNqRCxDQUFDO0lBQ0gsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFdBQVcsQ0FBQyxPQUFlO1FBQ3RDLE1BQU0sUUFBUSxHQUFHLGdCQUFnQixDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLE9BQU8sQ0FBQyxDQUFDO1FBQ3RGLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQy9DLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxlQUFlLENBQUMsU0FBUyxPQUFPLEVBQUUsQ0FBQyxDQUFDO0lBQ3hELENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxPQUFPLENBQUMsRUFBVSxFQUFFLE9BQTZDO1FBQzVFLE1BQU0sU0FBUyxHQUFHLE9BQU8sRUFBRSxTQUFTLElBQUksT0FBTyxDQUFDO1FBQ2hELE1BQU0sTUFBTSxHQUFHLEVBQUUsQ0FBQyxPQUFPLENBQUMsT0FBTyxFQUFFLEdBQUcsQ0FBQyxDQUFDO1FBQ3hDLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxTQUFTLE1BQU0sRUFBRSxFQUFFO1lBQ3BDLFNBQVM7WUFDVCxNQUFNLEVBQUUsTUFBTTtZQUNkLFFBQVEsRUFBRSxFQUFFO1NBQ2IsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVEOzs7T0FHRztJQUNJLEtBQUssQ0FBQyxZQUFZLENBQ3ZCLE9BQWUsRUFDZixHQUFhLEVBQ2IsSUFBYSxFQUNiLFFBQWlDO1FBRWpDLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxrQkFBa0IsRUFBRSxDQUFDO1FBQ3ZDLE1BQU0sUUFBUSxHQUFhLEVBQUUsQ0FBQztRQUU5QixLQUFLLE1BQU0sRUFBRSxJQUFJLEdBQUcsRUFBRSxDQUFDO1lBQ3JCLE1BQU0sVUFBVSxHQUFHLGlCQUFpQixDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFO2dCQUM5RSxTQUFTLEVBQUUsT0FBTztnQkFDbEIsTUFBTSxFQUFFLFFBQVE7Z0JBQ2hCLFFBQVEsRUFBRSxFQUFFO2dCQUNaLFFBQVEsRUFBRSxJQUFJO2dCQUNkLFFBQVE7YUFDVCxDQUFDLENBQUM7WUFDSCxRQUFRLENBQUMsSUFBSSxDQUFDLEdBQUcsVUFBVSxDQUFDLENBQUM7UUFDL0IsQ0FBQztRQUVELG9DQUFvQztRQUNwQyxNQUFNLFFBQVEsR0FBRyxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRTtZQUM1RSxTQUFTLEVBQUUsT0FBTztZQUNsQixNQUFNLEVBQUUsTUFBTTtZQUNkLFFBQVEsRUFBRSxJQUFJO1lBQ2QsUUFBUTtTQUNULENBQUMsQ0FBQztRQUNILFFBQVEsQ0FBQyxJQUFJLENBQUMsR0FBRyxRQUFRLENBQUMsQ0FBQztRQUUzQixNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsY0FBYyxDQUFDLGdCQUFnQixPQUFPLEVBQUUsRUFBRSxRQUFRLENBQUMsQ0FBQztJQUN4RSxDQUFDO0lBRUQ7OztPQUdHO0lBQ0ksS0FBSyxDQUFDLHNCQUFzQixDQUFDLEtBQXNDO1FBQ3hFLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxrQkFBa0IsRUFBRSxDQUFDO1FBQ3ZDLE1BQU0sU0FBUyxHQUFHLEtBQUssSUFBSSxPQUFPLENBQUM7UUFDbkMsTUFBTSxRQUFRLEdBQWEsRUFBRSxDQUFDO1FBRTlCLDRDQUE0QztRQUM1QyxNQUFNLFNBQVMsR0FBRyxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRTtZQUM3RSxTQUFTO1lBQ1QsTUFBTSxFQUFFLFFBQVE7WUFDaEIsUUFBUSxFQUFFLENBQUMsYUFBYSxFQUFFLFNBQVMsQ0FBQztTQUNyQyxDQUFDLENBQUM7UUFDSCxRQUFRLENBQUMsSUFBSSxDQUFDLEdBQUcsU0FBUyxDQUFDLENBQUM7UUFFNUIsMkJBQTJCO1FBQzNCLE1BQU0sUUFBUSxHQUFHLGlCQUFpQixDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFO1lBQzVFLFNBQVM7WUFDVCxNQUFNLEVBQUUsTUFBTTtZQUNkLFFBQVEsRUFBRSxDQUFDLFNBQVMsQ0FBQztTQUN0QixDQUFDLENBQUM7UUFDSCxRQUFRLENBQUMsSUFBSSxDQUFDLEdBQUcsUUFBUSxDQUFDLENBQUM7UUFFM0IsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLGNBQWMsQ0FBQyxlQUFlLFNBQVMsRUFBRSxFQUFFLFFBQVEsQ0FBQyxDQUFDO0lBQ3pFLENBQUM7Q0FDRiJ9

package/dist_ts/nft.manager.js

@@ -0,0 +1,132 @@
+import { NftExecutor } from './nft.executor.js';
+import { buildTableSetup, buildFilterChains, buildTableCleanup } from './nft.rulebuilder.table.js';
+import { NatManager } from './nft.manager.nat.js';
+import { FirewallManager } from './nft.manager.firewall.js';
+import { RateLimitManager } from './nft.manager.ratelimit.js';
+/**
+ * SmartNftables — high-level facade for managing nftables rules.
+ *
+ * Provides sub-managers for NAT, firewall, and rate limiting.
+ * All rules are tracked in logical groups and can be removed individually or cleaned up entirely.
+ */
+export class SmartNftables {
+    constructor(options) {
+        this.initialized = false;
+        this.hasFilterChains = false;
+        this.warnedNonRoot = false;
+        this.ruleGroups = new Map();
+        this.tableName = options?.tableName ?? 'smartnftables';
+        this.family = options?.family ?? 'ip';
+        this.executor = new NftExecutor({ dryRun: options?.dryRun });
+        this.nat = new NatManager(this);
+        this.firewall = new FirewallManager(this);
+        this.rateLimit = new RateLimitManager(this);
+    }
+    /**
+     * Initialize the nftables table and NAT chains. Idempotent.
+     */
+    async initialize() {
+        if (this.initialized)
+            return;
+        if (!this.executor.isRoot()) {
+            if (!this.warnedNonRoot) {
+                console.warn('smartnftables: not running as root. Rules are tracked but not applied to kernel.');
+                this.warnedNonRoot = true;
+            }
+            this.initialized = true;
+            return;
+        }
+        const commands = buildTableSetup(this.tableName, this.family);
+        await this.executor.execBatch(commands);
+        this.initialized = true;
+    }
+    /**
+     * Ensure filter chains (input/forward/output) are created.
+     * Called automatically when firewall or rate-limit rules are added.
+     */
+    async ensureFilterChains() {
+        if (this.hasFilterChains)
+            return;
+        await this.ensureInitialized();
+        if (this.executor.isRoot()) {
+            const commands = buildFilterChains(this.tableName, this.family);
+            await this.executor.execBatch(commands);
+        }
+        this.hasFilterChains = true;
+    }
+    /**
+     * Ensure the table is initialized before applying rules.
+     */
+    async ensureInitialized() {
+        if (!this.initialized) {
+            await this.initialize();
+        }
+    }
+    /**
+     * Apply a group of nft commands and track them under the given ID.
+     */
+    async applyRuleGroup(groupId, commands) {
+        // Always track the group locally
+        this.ruleGroups.set(groupId, {
+            id: groupId,
+            commands,
+            createdAt: Date.now(),
+        });
+        if (!this.executor.isRoot()) {
+            if (!this.warnedNonRoot) {
+                console.warn('smartnftables: not running as root. Rules are tracked but not applied to kernel.');
+                this.warnedNonRoot = true;
+            }
+            return;
+        }
+        await this.ensureInitialized();
+        await this.executor.execBatch(commands);
+    }
+    /**
+     * Remove a tracked rule group. Removes from tracking.
+     * Note: full kernel cleanup requires cleanup() — individual rule removal
+     * would require handle-based tracking.
+     */
+    async removeRuleGroup(groupId) {
+        this.ruleGroups.delete(groupId);
+    }
+    /**
+     * Get a tracked rule group by ID.
+     */
+    getRuleGroup(groupId) {
+        return this.ruleGroups.get(groupId);
+    }
+    /**
+     * Delete the entire nftables table and clear all tracking.
+     */
+    async cleanup() {
+        if (this.executor.isRoot() && this.initialized) {
+            const commands = buildTableCleanup(this.tableName, this.family);
+            await this.executor.execBatch(commands, { continueOnError: true });
+        }
+        this.ruleGroups.clear();
+        this.initialized = false;
+        this.hasFilterChains = false;
+    }
+    /**
+     * Get status report of the managed nftables state.
+     */
+    status() {
+        const groups = {};
+        for (const [id, group] of this.ruleGroups) {
+            groups[id] = {
+                ruleCount: group.commands.length,
+                createdAt: group.createdAt,
+            };
+        }
+        return {
+            initialized: this.initialized,
+            tableName: this.tableName,
+            family: this.family,
+            isRoot: this.executor.isRoot(),
+            activeGroups: this.ruleGroups.size,
+            groups,
+        };
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmZ0Lm1hbmFnZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9uZnQubWFuYWdlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsV0FBVyxFQUFFLE1BQU0sbUJBQW1CLENBQUM7QUFDaEQsT0FBTyxFQUFFLGVBQWUsRUFBRSxpQkFBaUIsRUFBRSxpQkFBaUIsRUFBRSxNQUFNLDRCQUE0QixDQUFDO0FBQ25HLE9BQU8sRUFBRSxVQUFVLEVBQUUsTUFBTSxzQkFBc0IsQ0FBQztBQUNsRCxPQUFPLEVBQUUsZUFBZSxFQUFFLE1BQU0sMkJBQTJCLENBQUM7QUFDNUQsT0FBTyxFQUFFLGdCQUFnQixFQUFFLE1BQU0sNEJBQTRCLENBQUM7QUFHOUQ7Ozs7O0dBS0c7QUFDSCxNQUFNLE9BQU8sYUFBYTtJQWN4QixZQUFZLE9BQStCO1FBTG5DLGdCQUFXLEdBQUcsS0FBSyxDQUFDO1FBQ3BCLG9CQUFlLEdBQUcsS0FBSyxDQUFDO1FBQ3hCLGtCQUFhLEdBQUcsS0FBSyxDQUFDO1FBQ3RCLGVBQVUsR0FBK0IsSUFBSSxHQUFHLEVBQUUsQ0FBQztRQUd6RCxJQUFJLENBQUMsU0FBUyxHQUFHLE9BQU8sRUFBRSxTQUFTLElBQUksZUFBZSxDQUFDO1FBQ3ZELElBQUksQ0FBQyxNQUFNLEdBQUcsT0FBTyxFQUFFLE1BQU0sSUFBSSxJQUFJLENBQUM7UUFDdEMsSUFBSSxDQUFDLFFBQVEsR0FBRyxJQUFJLFdBQVcsQ0FBQyxFQUFFLE1BQU0sRUFBRSxPQUFPLEVBQUUsTUFBTSxFQUFFLENBQUMsQ0FBQztRQUU3RCxJQUFJLENBQUMsR0FBRyxHQUFHLElBQUksVUFBVSxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQ2hDLElBQUksQ0FBQyxRQUFRLEdBQUcsSUFBSSxlQUFlLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDMUMsSUFBSSxDQUFDLFNBQVMsR0FBRyxJQUFJLGdCQUFnQixDQUFDLElBQUksQ0FBQyxDQUFDO0lBQzlDLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxVQUFVO1FBQ3JCLElBQUksSUFBSSxDQUFDLFdBQVc7WUFBRSxPQUFPO1FBRTdCLElBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUM7WUFDNUIsSUFBSSxDQUFDLElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztnQkFDeEIsT0FBTyxDQUFDLElBQUksQ0FBQyxrRkFBa0YsQ0FBQyxDQUFDO2dCQUNqRyxJQUFJLENBQUMsYUFBYSxHQUFHLElBQUksQ0FBQztZQUM1QixDQUFDO1lBQ0QsSUFBSSxDQUFDLFdBQVcsR0FBRyxJQUFJLENBQUM7WUFDeEIsT0FBTztRQUNULENBQUM7UUFFRCxNQUFNLFFBQVEsR0FBRyxlQUFlLENBQUMsSUFBSSxDQUFDLFNBQVMsRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDOUQsTUFBTSxJQUFJLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUN4QyxJQUFJLENBQUMsV0FBVyxHQUFHLElBQUksQ0FBQztJQUMxQixDQUFDO0lBRUQ7OztPQUdHO0lBQ0ksS0FBSyxDQUFDLGtCQUFrQjtRQUM3QixJQUFJLElBQUksQ0FBQyxlQUFlO1lBQUUsT0FBTztRQUNqQyxNQUFNLElBQUksQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO1FBRS9CLElBQUksSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDO1lBQzNCLE1BQU0sUUFBUSxHQUFHLGlCQUFpQixDQUFDLElBQUksQ0FBQyxTQUFTLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1lBQ2hFLE1BQU0sSUFBSSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDMUMsQ0FBQztRQUVELElBQUksQ0FBQyxlQUFlLEdBQUcsSUFBSSxDQUFDO0lBQzlCLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxpQkFBaUI7UUFDNUIsSUFBSSxDQUFDLElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQztZQUN0QixNQUFNLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQztRQUMxQixDQUFDO0lBQ0gsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLGNBQWMsQ0FBQyxPQUFlLEVBQUUsUUFBa0I7UUFDN0QsaUNBQWlDO1FBQ2pDLElBQUksQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLE9BQU8sRUFBRTtZQUMzQixFQUFFLEVBQUUsT0FBTztZQUNYLFFBQVE7WUFDUixTQUFTLEVBQUUsSUFBSSxDQUFDLEdBQUcsRUFBRTtTQUN0QixDQUFDLENBQUM7UUFFSCxJQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDO1lBQzVCLElBQUksQ0FBQyxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7Z0JBQ3hCLE9BQU8sQ0FBQyxJQUFJLENBQUMsa0ZBQWtGLENBQUMsQ0FBQztnQkFDakcsSUFBSSxDQUFDLGFBQWEsR0FBRyxJQUFJLENBQUM7WUFDNUIsQ0FBQztZQUNELE9BQU87UUFDVCxDQUFDO1FBRUQsTUFBTSxJQUFJLENBQUMsaUJBQWlCLEVBQUUsQ0FBQztRQUMvQixNQUFNLElBQUksQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQzFDLENBQUM7SUFFRDs7OztPQUlHO0lBQ0ksS0FBSyxDQUFDLGVBQWUsQ0FBQyxPQUFlO1FBQzFDLElBQUksQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ2xDLENBQUM7SUFFRDs7T0FFRztJQUNJLFlBQVksQ0FBQyxPQUFlO1FBQ2pDLE9BQU8sSUFBSSxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLENBQUM7SUFDdEMsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLE9BQU87UUFDbEIsSUFBSSxJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sRUFBRSxJQUFJLElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQztZQUMvQyxNQUFNLFFBQVEsR0FBRyxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztZQUNoRSxNQUFNLElBQUksQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLFFBQVEsRUFBRSxFQUFFLGVBQWUsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQ3JFLENBQUM7UUFFRCxJQUFJLENBQUMsVUFBVSxDQUFDLEtBQUssRUFBRSxDQUFDO1FBQ3hCLElBQUksQ0FBQyxXQUFXLEdBQUcsS0FBSyxDQUFDO1FBQ3pCLElBQUksQ0FBQyxlQUFlLEdBQUcsS0FBSyxDQUFDO0lBQy9CLENBQUM7SUFFRDs7T0FFRztJQUNJLE1BQU07UUFDWCxNQUFNLE1BQU0sR0FBNkQsRUFBRSxDQUFDO1FBQzVFLEtBQUssTUFBTSxDQUFDLEVBQUUsRUFBRSxLQUFLLENBQUMsSUFBSSxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUM7WUFDMUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxHQUFHO2dCQUNYLFNBQVMsRUFBRSxLQUFLLENBQUMsUUFBUSxDQUFDLE1BQU07Z0JBQ2hDLFNBQVMsRUFBRSxLQUFLLENBQUMsU0FBUzthQUMzQixDQUFDO1FBQ0osQ0FBQztRQUVELE9BQU87WUFDTCxXQUFXLEVBQUUsSUFBSSxDQUFDLFdBQVc7WUFDN0IsU0FBUyxFQUFFLElBQUksQ0FBQyxTQUFTO1lBQ3pCLE1BQU0sRUFBRSxJQUFJLENBQUMsTUFBTTtZQUNuQixNQUFNLEVBQUUsSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLEVBQUU7WUFDOUIsWUFBWSxFQUFFLElBQUksQ0FBQyxVQUFVLENBQUMsSUFBSTtZQUNsQyxNQUFNO1NBQ1AsQ0FBQztJQUNKLENBQUM7Q0FDRiJ9

package/dist_ts/nft.manager.nat.d.ts

@@ -0,0 +1,34 @@
+import type { SmartNftables } from './nft.manager.js';
+import type { INftDnatRule, INftSnatRule, INftMasqueradeRule, TNftProtocol } from './nft.types.js';
+/**
+ * Manages NAT (DNAT/SNAT/masquerade) rules.
+ */
+export declare class NatManager {
+    private parent;
+    constructor(parent: SmartNftables);
+    /**
+     * Add a port forwarding rule (DNAT + optional masquerade).
+     */
+    addPortForwarding(groupId: string, rule: INftDnatRule): Promise<void>;
+    /**
+     * Remove a previously added port forwarding group.
+     */
+    removePortForwarding(groupId: string): Promise<void>;
+    /**
+     * Add SNAT (source NAT) rule.
+     */
+    addSnat(groupId: string, rule: INftSnatRule): Promise<void>;
+    /**
+     * Add masquerade rule for outgoing traffic.
+     */
+    addMasquerade(groupId: string, rule: INftMasqueradeRule): Promise<void>;
+    /**
+     * Add port forwarding for a range of ports.
+     * Maps sourceStart..sourceStart+count to targetStart..targetStart+count.
+     */
+    addPortRange(groupId: string, sourceStart: number, sourceEnd: number, targetHost: string, targetStart: number, protocol?: TNftProtocol): Promise<void>;
+    /**
+     * Remove a port range forwarding group.
+     */
+    removePortRange(groupId: string): Promise<void>;
+}

package/dist_ts/nft.manager.nat.js

@@ -0,0 +1,61 @@
+import { buildDnatRules, buildSnatRule, buildMasqueradeRule } from './nft.rulebuilder.nat.js';
+/**
+ * Manages NAT (DNAT/SNAT/masquerade) rules.
+ */
+export class NatManager {
+    constructor(parent) {
+        this.parent = parent;
+    }
+    /**
+     * Add a port forwarding rule (DNAT + optional masquerade).
+     */
+    async addPortForwarding(groupId, rule) {
+        const commands = buildDnatRules(this.parent.tableName, this.parent.family, rule);
+        await this.parent.applyRuleGroup(`nat:${groupId}`, commands);
+    }
+    /**
+     * Remove a previously added port forwarding group.
+     */
+    async removePortForwarding(groupId) {
+        await this.parent.removeRuleGroup(`nat:${groupId}`);
+    }
+    /**
+     * Add SNAT (source NAT) rule.
+     */
+    async addSnat(groupId, rule) {
+        const commands = buildSnatRule(this.parent.tableName, this.parent.family, rule);
+        await this.parent.applyRuleGroup(`nat:snat:${groupId}`, commands);
+    }
+    /**
+     * Add masquerade rule for outgoing traffic.
+     */
+    async addMasquerade(groupId, rule) {
+        const commands = buildMasqueradeRule(this.parent.tableName, this.parent.family, rule);
+        await this.parent.applyRuleGroup(`nat:masq:${groupId}`, commands);
+    }
+    /**
+     * Add port forwarding for a range of ports.
+     * Maps sourceStart..sourceStart+count to targetStart..targetStart+count.
+     */
+    async addPortRange(groupId, sourceStart, sourceEnd, targetHost, targetStart, protocol) {
+        const allCommands = [];
+        const count = sourceEnd - sourceStart;
+        for (let i = 0; i <= count; i++) {
+            const commands = buildDnatRules(this.parent.tableName, this.parent.family, {
+                sourcePort: sourceStart + i,
+                targetHost,
+                targetPort: targetStart + i,
+                protocol,
+            });
+            allCommands.push(...commands);
+        }
+        await this.parent.applyRuleGroup(`nat:range:${groupId}`, allCommands);
+    }
+    /**
+     * Remove a port range forwarding group.
+     */
+    async removePortRange(groupId) {
+        await this.parent.removeRuleGroup(`nat:range:${groupId}`);
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmZ0Lm1hbmFnZXIubmF0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvbmZ0Lm1hbmFnZXIubmF0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUVBLE9BQU8sRUFBRSxjQUFjLEVBQUUsYUFBYSxFQUFFLG1CQUFtQixFQUFFLE1BQU0sMEJBQTBCLENBQUM7QUFFOUY7O0dBRUc7QUFDSCxNQUFNLE9BQU8sVUFBVTtJQUNyQixZQUFvQixNQUFxQjtRQUFyQixXQUFNLEdBQU4sTUFBTSxDQUFlO0lBQUcsQ0FBQztJQUU3Qzs7T0FFRztJQUNJLEtBQUssQ0FBQyxpQkFBaUIsQ0FBQyxPQUFlLEVBQUUsSUFBa0I7UUFDaEUsTUFBTSxRQUFRLEdBQUcsY0FBYyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQ2pGLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxjQUFjLENBQUMsT0FBTyxPQUFPLEVBQUUsRUFBRSxRQUFRLENBQUMsQ0FBQztJQUMvRCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsb0JBQW9CLENBQUMsT0FBZTtRQUMvQyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsZUFBZSxDQUFDLE9BQU8sT0FBTyxFQUFFLENBQUMsQ0FBQztJQUN0RCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsT0FBTyxDQUFDLE9BQWUsRUFBRSxJQUFrQjtRQUN0RCxNQUFNLFFBQVEsR0FBRyxhQUFhLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDaEYsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLGNBQWMsQ0FBQyxZQUFZLE9BQU8sRUFBRSxFQUFFLFFBQVEsQ0FBQyxDQUFDO0lBQ3BFLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxhQUFhLENBQUMsT0FBZSxFQUFFLElBQXdCO1FBQ2xFLE1BQU0sUUFBUSxHQUFHLG1CQUFtQixDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQ3RGLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxjQUFjLENBQUMsWUFBWSxPQUFPLEVBQUUsRUFBRSxRQUFRLENBQUMsQ0FBQztJQUNwRSxDQUFDO0lBRUQ7OztPQUdHO0lBQ0ksS0FBSyxDQUFDLFlBQVksQ0FDdkIsT0FBZSxFQUNmLFdBQW1CLEVBQ25CLFNBQWlCLEVBQ2pCLFVBQWtCLEVBQ2xCLFdBQW1CLEVBQ25CLFFBQXVCO1FBRXZCLE1BQU0sV0FBVyxHQUFhLEVBQUUsQ0FBQztRQUNqQyxNQUFNLEtBQUssR0FBRyxTQUFTLEdBQUcsV0FBVyxDQUFDO1FBRXRDLEtBQUssSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsSUFBSSxLQUFLLEVBQUUsQ0FBQyxFQUFFLEVBQUUsQ0FBQztZQUNoQyxNQUFNLFFBQVEsR0FBRyxjQUFjLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUU7Z0JBQ3pFLFVBQVUsRUFBRSxXQUFXLEdBQUcsQ0FBQztnQkFDM0IsVUFBVTtnQkFDVixVQUFVLEVBQUUsV0FBVyxHQUFHLENBQUM7Z0JBQzNCLFFBQVE7YUFDVCxDQUFDLENBQUM7WUFDSCxXQUFXLENBQUMsSUFBSSxDQUFDLEdBQUcsUUFBUSxDQUFDLENBQUM7UUFDaEMsQ0FBQztRQUVELE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxjQUFjLENBQUMsYUFBYSxPQUFPLEVBQUUsRUFBRSxXQUFXLENBQUMsQ0FBQztJQUN4RSxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsZUFBZSxDQUFDLE9BQWU7UUFDMUMsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLGVBQWUsQ0FBQyxhQUFhLE9BQU8sRUFBRSxDQUFDLENBQUM7SUFDNUQsQ0FBQztDQUNGIn0=

package/dist_ts/nft.manager.ratelimit.d.ts

@@ -0,0 +1,26 @@
+import type { SmartNftables } from './nft.manager.js';
+import type { INftRateLimitRule, INftConnectionRateRule } from './nft.types.js';
+/**
+ * Manages rate limiting rules using nft meters and limit expressions.
+ */
+export declare class RateLimitManager {
+    private parent;
+    constructor(parent: SmartNftables);
+    /**
+     * Add a rate limit rule (global or per-IP).
+     */
+    addRateLimit(groupId: string, rule: INftRateLimitRule): Promise<void>;
+    /**
+     * Remove a rate limit rule group.
+     */
+    removeRateLimit(groupId: string): Promise<void>;
+    /**
+     * Add a new-connection rate limit rule.
+     * Limits the rate of new TCP/UDP connections (ct state new).
+     */
+    addConnectionRateLimit(groupId: string, rule: INftConnectionRateRule): Promise<void>;
+    /**
+     * Remove a connection rate limit rule group.
+     */
+    removeConnectionRateLimit(groupId: string): Promise<void>;
+}