@push.rocks/smartnftables 1.2.0 → 1.3.1

package/ts/managed.types.ts

@@ -0,0 +1,87 @@
+/** The caller owns these workload links and keeps them disabled until apply is confirmed. */
+export interface IManagedNftEndpoint {
+  id: string;
+  interfaceIndex: number;
+  interfaceName: string;
+  /** Routed, unbridged veth or L3 TUN; TAP/bridge/uplink interfaces reject. */
+  interfaceKind: 'veth' | 'tun';
+  sourcePrefixes: string[];
+}
+
+/** Null selects the actual local host (input/output only), never an unbound forwarding side. */
+export interface IManagedNftRule {
+  sourceEndpoint: string | null;
+  destinationEndpoint: string | null;
+  sourcePrefix: string;
+  destinationPrefix: string;
+  protocol: 'any' | 'tcp' | 'udp';
+  sourcePort: number | null;
+  destinationPort: number | null;
+}
+
+export interface IManagedNftPolicy {
+  schemaVersion: 1;
+  revision: number;
+  endpoints: IManagedNftEndpoint[];
+  rules: IManagedNftRule[];
+}
+
+export interface IPreparedManagedNftPolicy {
+  policy: IManagedNftPolicy;
+  digest: string;
+}
+
+export interface IManagedNftIdentity {
+  ownerId: string;
+  instanceId: string;
+  tableName: string;
+  bootId: string;
+  namespaceDevice: string;
+  namespaceInode: string;
+}
+
+export interface IManagedNftReceipt {
+  identity: IManagedNftIdentity;
+  tableHandle: string;
+  revision: number;
+  digest: string;
+}
+
+export interface IAppliedManagedNftPolicy {
+  receipt: IManagedNftReceipt;
+  prepared: IPreparedManagedNftPolicy;
+}
+
+/** Persist this complete command before reconcile, then retain its complete result. */
+export interface IManagedNftTransition {
+  previous: IAppliedManagedNftPolicy | null;
+  target: IPreparedManagedNftPolicy;
+}
+
+export interface IManagedNftStatus {
+  identity: IManagedNftIdentity;
+  state: 'idle' | 'applied' | 'failed-owned' | 'released';
+  enforced: boolean;
+  applied: IAppliedManagedNftPolicy | null;
+  pending: IManagedNftTransition | null;
+  error: string | null;
+}
+
+export interface IManagedNftOptions {
+  ownerId: string;
+  /** Caller-retained unique operation identity, at least 16 identifier characters. */
+  instanceId: string;
+  /** Dedicated name beginning snft_; existing foreign tables always reject. */
+  tableName: string;
+  /** Explicit executable selection for qualified distributions and isolated tests. */
+  binaryPath?: string;
+}
+
+export type TManagedNftCommands = {
+  preparePolicy: { params: IManagedNftPolicy; result: IPreparedManagedNftPolicy };
+  openOwner: { params: Omit<IManagedNftOptions, 'binaryPath'>; result: IManagedNftStatus };
+  reconcilePolicy: { params: IManagedNftTransition; result: IAppliedManagedNftPolicy };
+  inspectPolicy: { params: Record<string, never>; result: IManagedNftStatus };
+  releasePolicy: { params: IAppliedManagedNftPolicy; result: { released: true } };
+  closeOwner: { params: Record<string, never>; result: { released: true } };
+};

package/ts/nft.executor.ts

@@ -2,6 +2,75 @@ import * as plugins from './plugins.js';
 
 const execFile = plugins.util.promisify(plugins.childProcess.execFile);
 
+export function normalizeNftCommand(command: string): string {
+  let input = command.trim();
+  if (!input) {
+    throw new Error('Invalid nft command: command is empty');
+  }
+  if (input === 'nft') {
+    throw new Error('Invalid nft command: command is empty');
+  }
+  if (/^nft\s/.test(input)) {
+    input = input.slice(3).trimStart();
+  }
+
+  let normalized = '';
+  let quote: 'single' | 'double' | undefined;
+
+  for (let index = 0; index < input.length; index++) {
+    const character = input[index];
+
+    if (quote === 'single') {
+      normalized += character;
+      if (character === "'") {
+        quote = undefined;
+      }
+      continue;
+    }
+
+    if (quote === 'double') {
+      normalized += character;
+      if (character === '"') {
+        quote = undefined;
+        continue;
+      }
+      if (character === '\\') {
+        const nextCharacter = input[index + 1];
+        if (nextCharacter === undefined) {
+          throw new Error('Invalid nft command: trailing escape in double-quoted string');
+        }
+        normalized += nextCharacter;
+        index++;
+        continue;
+      }
+      continue;
+    }
+
+    if (character === "'") {
+      quote = 'single';
+    } else if (character === '"') {
+      quote = 'double';
+    } else if (character === '\\') {
+      const nextCharacter = input[index + 1];
+      if (nextCharacter === undefined) {
+        throw new Error('Invalid nft command: trailing escape');
+      }
+      if (nextCharacter === ';') {
+        normalized += ';';
+        index++;
+        continue;
+      }
+    }
+
+    normalized += character;
+  }
+
+  if (quote) {
+    throw new Error(`Invalid nft command: unterminated ${quote}-quoted string`);
+  }
+  return normalized;
+}
+
 export class NftNotRootError extends Error {
   constructor() {
     super('Not running as root — nftables commands require root privileges');
@@ -42,14 +111,12 @@ export class NftExecutor {
    * Returns stdout on success.
    */
   public async exec(command: string): Promise<string> {
+    const normalizedCommand = normalizeNftCommand(command);
     if (this.dryRun) {
       return '';
     }
 
-    // Strip "nft " prefix if present
-    const args = command.startsWith('nft ') ? command.slice(4) : command;
-
-    const { stdout } = await execFile('nft', args.split(/\s+/));
+    const { stdout } = await execFile('nft', [normalizedCommand]);
     return stdout;
   }
 

package/ts/nft.rulebuilder.firewall.ts

@@ -1,5 +1,9 @@
 import type { TNftFamily, INftFirewallRule, INftIPSetConfig } from './nft.types.js';
 
+function escapeNftString(value: string): string {
+  return value.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+}
+
 /**
  * Build an nft firewall rule for input/output/forward chains.
  */
@@ -17,14 +21,17 @@ export function buildFirewallRule(
   }
 
   // Protocol and port matching
-  const protocols = expandProtocols(rule.protocol);
+  const hasPort = rule.sourcePort != null || rule.destPort != null;
+  const protocols = expandProtocols(rule.protocol ?? (hasPort ? 'tcp' : undefined));
+  const protocolVariants = protocols.length > 0 ? protocols : [undefined];
   const commands: string[] = [];
 
-  for (const proto of protocols) {
+  for (const proto of protocolVariants) {
     const ruleParts = [...parts];
+    const portProtocol = proto ?? 'tcp';
 
-    if (rule.protocol) {
-      ruleParts.push(proto);
+    if (proto && !hasPort) {
+      ruleParts.push(`meta l4proto ${proto}`);
     }
 
     if (rule.sourceIP) {
@@ -36,39 +43,17 @@ export function buildFirewallRule(
     }
 
     if (rule.sourcePort != null) {
-      ruleParts.push(`${proto} sport ${rule.sourcePort}`);
+      ruleParts.push(`${portProtocol} sport ${rule.sourcePort}`);
     }
 
     if (rule.destPort != null) {
-      // If protocol wasn't explicitly set but we have a port, we need the protocol
-      if (!rule.protocol) {
-        ruleParts.push(`tcp dport ${rule.destPort}`);
-      } else {
-        ruleParts.push(`${proto} dport ${rule.destPort}`);
-      }
-    }
-
-    if (rule.comment) {
-      ruleParts.push(`comment "${rule.comment}"`);
+      ruleParts.push(`${portProtocol} dport ${rule.destPort}`);
     }
 
     ruleParts.push(rule.action);
-    commands.push(ruleParts.join(' '));
-  }
-
-  // If no protocol expansion needed (no protocol-specific fields)
-  if (commands.length === 0) {
-    const ruleParts = [...parts];
-    if (rule.sourceIP) {
-      ruleParts.push(`ip saddr ${rule.sourceIP}`);
-    }
-    if (rule.destIP) {
-      ruleParts.push(`ip daddr ${rule.destIP}`);
-    }
     if (rule.comment) {
-      ruleParts.push(`comment "${rule.comment}"`);
+      ruleParts.push(`comment "${escapeNftString(rule.comment)}"`);
     }
-    ruleParts.push(rule.action);
     commands.push(ruleParts.join(' '));
   }
 
@@ -158,9 +143,9 @@ export function buildIPSetMatchRule(
     comment?: string;
   },
 ): string[] {
-  const comment = options.comment ? ` comment "${options.comment}"` : '';
+  const comment = options.comment ? ` comment "${escapeNftString(options.comment)}"` : '';
   return [
-    `nft add rule ${family} ${tableName} ${options.direction} ip ${options.matchField} @${options.setName}${comment} ${options.action}`
+    `nft add rule ${family} ${tableName} ${options.direction} ip ${options.matchField} @${options.setName} ${options.action}${comment}`
   ];
 }
 

package/ts/plugins.ts

@@ -1,16 +1,22 @@
 // node native scope
 import * as childProcess from 'node:child_process';
 import * as util from 'node:util';
+import * as path from 'node:path';
+import * as url from 'node:url';
 
 export {
   childProcess,
   util,
+  path,
+  url,
 };
 
 // @push.rocks scope
 import * as smartlog from '@push.rocks/smartlog';
 import * as smartpromise from '@push.rocks/smartpromise';
+import * as smartrust from '@push.rocks/smartrust';
 export {
   smartlog,
   smartpromise,
+  smartrust,
 };