@push.rocks/smartnftables 1.2.1 → 1.4.0

package/native-notices/rust-standard-library/musl-1.2.5-copyright.txt

@@ -0,0 +1,193 @@
+musl as a whole is licensed under the following standard MIT license:
+
+----------------------------------------------------------------------
+Copyright © 2005-2020 Rich Felker, et al.
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+----------------------------------------------------------------------
+
+Authors/contributors include:
+
+A. Wilcox
+Ada Worcester
+Alex Dowad
+Alex Suykov
+Alexander Monakov
+Andre McCurdy
+Andrew Kelley
+Anthony G. Basile
+Aric Belsito
+Arvid Picciani
+Bartosz Brachaczek
+Benjamin Peterson
+Bobby Bingham
+Boris Brezillon
+Brent Cook
+Chris Spiegel
+Clément Vasseur
+Daniel Micay
+Daniel Sabogal
+Daurnimator
+David Carlier
+David Edelsohn
+Denys Vlasenko
+Dmitry Ivanov
+Dmitry V. Levin
+Drew DeVault
+Emil Renner Berthing
+Fangrui Song
+Felix Fietkau
+Felix Janda
+Gianluca Anzolin
+Hauke Mehrtens
+He X
+Hiltjo Posthuma
+Isaac Dunham
+Jaydeep Patil
+Jens Gustedt
+Jeremy Huntwork
+Jo-Philipp Wich
+Joakim Sindholt
+John Spencer
+Julien Ramseier
+Justin Cormack
+Kaarle Ritvanen
+Khem Raj
+Kylie McClain
+Leah Neukirchen
+Luca Barbato
+Luka Perkov
+M Farkas-Dyck (Strake)
+Mahesh Bodapati
+Markus Wichmann
+Masanori Ogino
+Michael Clark
+Michael Forney
+Mikhail Kremnyov
+Natanael Copa
+Nicholas J. Kain
+orc
+Pascal Cuoq
+Patrick Oppenlander
+Petr Hosek
+Petr Skocik
+Pierre Carrier
+Reini Urban
+Rich Felker
+Richard Pennington
+Ryan Fairfax
+Samuel Holland
+Segev Finer
+Shiz
+sin
+Solar Designer
+Stefan Kristiansson
+Stefan O'Rear
+Szabolcs Nagy
+Timo Teräs
+Trutz Behn
+Valentin Ochs
+Will Dietz
+William Haddon
+William Pitcock
+
+Portions of this software are derived from third-party works licensed
+under terms compatible with the above MIT license:
+
+The TRE regular expression implementation (src/regex/reg* and
+src/regex/tre*) is Copyright © 2001-2008 Ville Laurikari and licensed
+under a 2-clause BSD license (license text in the source files). The
+included version has been heavily modified by Rich Felker in 2012, in
+the interests of size, simplicity, and namespace cleanliness.
+
+Much of the math library code (src/math/* and src/complex/*) is
+Copyright © 1993,2004 Sun Microsystems or
+Copyright © 2003-2011 David Schultz or
+Copyright © 2003-2009 Steven G. Kargl or
+Copyright © 2003-2009 Bruce D. Evans or
+Copyright © 2008 Stephen L. Moshier or
+Copyright © 2017-2018 Arm Limited
+and labelled as such in comments in the individual source files. All
+have been licensed under extremely permissive terms.
+
+The ARM memcpy code (src/string/arm/memcpy.S) is Copyright © 2008
+The Android Open Source Project and is licensed under a two-clause BSD
+license. It was taken from Bionic libc, used on Android.
+
+The AArch64 memcpy and memset code (src/string/aarch64/*) are
+Copyright © 1999-2019, Arm Limited.
+
+The implementation of DES for crypt (src/crypt/crypt_des.c) is
+Copyright © 1994 David Burren. It is licensed under a BSD license.
+
+The implementation of blowfish crypt (src/crypt/crypt_blowfish.c) was
+originally written by Solar Designer and placed into the public
+domain. The code also comes with a fallback permissive license for use
+in jurisdictions that may not recognize the public domain.
+
+The smoothsort implementation (src/stdlib/qsort.c) is Copyright © 2011
+Valentin Ochs and is licensed under an MIT-style license.
+
+The x86_64 port was written by Nicholas J. Kain and is licensed under
+the standard MIT terms.
+
+The mips and microblaze ports were originally written by Richard
+Pennington for use in the ellcc project. The original code was adapted
+by Rich Felker for build system and code conventions during upstream
+integration. It is licensed under the standard MIT terms.
+
+The mips64 port was contributed by Imagination Technologies and is
+licensed under the standard MIT terms.
+
+The powerpc port was also originally written by Richard Pennington,
+and later supplemented and integrated by John Spencer. It is licensed
+under the standard MIT terms.
+
+All other files which have no copyright comments are original works
+produced specifically for use as part of this library, written either
+by Rich Felker, the main author of the library, or by one or more
+contibutors listed above. Details on authorship of individual files
+can be found in the git version control history of the project. The
+omission of copyright and license comments in each file is in the
+interest of source tree size.
+
+In addition, permission is hereby granted for all public header files
+(include/* and arch/*/bits/*) and crt files intended to be linked into
+applications (crt/*, ldso/dlstart.c, and arch/*/crt_arch.h) to omit
+the copyright notice and permission notice otherwise required by the
+license, and to use these files without any requirement of
+attribution. These files include substantial contributions from:
+
+Bobby Bingham
+John Spencer
+Nicholas J. Kain
+Rich Felker
+Richard Pennington
+Stefan Kristiansson
+Szabolcs Nagy
+
+all of whom have explicitly granted such permission.
+
+This file previously contained text expressing a belief that most of
+the files covered by the above exception were sufficiently trivial not
+to be subject to copyright, resulting in confusion over whether it
+negated the permissions granted in the license. In the spirit of
+permissive licensing, and of not having licensing issues being an
+obstacle to adoption, that text has been removed.

package/native-notices/rust-standard-library/unicode-license.txt

@@ -0,0 +1,39 @@
+UNICODE LICENSE V3
+
+COPYRIGHT AND PERMISSION NOTICE
+
+Copyright © 1991-2026 Unicode, Inc.
+
+NOTICE TO USER: Carefully read the following legal agreement. BY
+DOWNLOADING, INSTALLING, COPYING OR OTHERWISE USING DATA FILES, AND/OR
+SOFTWARE, YOU UNEQUIVOCALLY ACCEPT, AND AGREE TO BE BOUND BY, ALL OF THE
+TERMS AND CONDITIONS OF THIS AGREEMENT. IF YOU DO NOT AGREE, DO NOT
+DOWNLOAD, INSTALL, COPY, DISTRIBUTE OR USE THE DATA FILES OR SOFTWARE.
+
+Permission is hereby granted, free of charge, to any person obtaining a
+copy of data files and any associated documentation (the "Data Files") or
+software and any associated documentation (the "Software") to deal in the
+Data Files or Software without restriction, including without limitation
+the rights to use, copy, modify, merge, publish, distribute, and/or sell
+copies of the Data Files or Software, and to permit persons to whom the
+Data Files or Software are furnished to do so, provided that either (a)
+this copyright and permission notice appear with all copies of the Data
+Files or Software, or (b) this copyright and permission notice appear in
+associated Documentation.
+
+THE DATA FILES AND SOFTWARE ARE PROVIDED "AS IS", WITHOUT WARRANTY OF ANY
+KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF
+THIRD PARTY RIGHTS.
+
+IN NO EVENT SHALL THE COPYRIGHT HOLDER OR HOLDERS INCLUDED IN THIS NOTICE
+BE LIABLE FOR ANY CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES,
+OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
+WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
+ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THE DATA
+FILES OR SOFTWARE.
+
+Except as contained in this notice, the name of a copyright holder shall
+not be used in advertising or otherwise to promote the sale, use or other
+dealings in these Data Files or Software without prior written
+authorization of the copyright holder.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartnftables",
-  "version": "1.2.1",
+  "version": "1.4.0",
   "private": false,
   "description": "A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.",
   "main": "dist_ts/index.js",
@@ -9,16 +9,18 @@
   "author": "Lossless GmbH",
   "license": "MIT",
   "devDependencies": {
-    "@git.zone/cli": "^3.0.1",
-    "@git.zone/tsbuild": "^4.4.2",
+    "@git.zone/cli": "6.13.2",
+    "@git.zone/tsbuild": "^4.4.3",
     "@git.zone/tsrun": "^2.0.6",
-    "@git.zone/tstest": "^3.6.7",
-    "@types/node": "26.1.1",
+    "@git.zone/tsrust": "1.13.0",
+    "@git.zone/tstest": "6.0.0",
+    "@types/node": "26.4.1",
     "typescript": "^7.0.2"
   },
   "dependencies": {
     "@push.rocks/smartlog": "^3.2.2",
-    "@push.rocks/smartpromise": "^4.2.5"
+    "@push.rocks/smartpromise": "^4.2.5",
+    "@push.rocks/smartrust": "2.0.0"
   },
   "files": [
     "ts/**/*",
@@ -27,8 +29,21 @@
     "dist_ts/**/*",
     "assets/**/*",
     "readme.md",
-    "changelog.md"
+    "license.md",
+    "changelog.md",
+    "rust/Cargo.toml",
+    "rust/Cargo.lock",
+    "rust/.cargo/config.toml",
+    "rust/src/**/*",
+    "native-notices/**/*",
+    "scripts/check-native-notices.mjs"
   ],
+  "publishConfig": {
+    "executableFiles": [
+      "./dist_rust/smartnftables_linux_amd64_musl",
+      "./dist_rust/smartnftables_linux_arm64_musl"
+    ]
+  },
   "keywords": [
     "nftables",
     "firewall",
@@ -51,7 +66,7 @@
   },
   "scripts": {
     "test": "(tstest test/**/test*.ts --verbose --timeout 60)",
-    "build": "(tsbuild tsfolders)",
+    "build": "(node scripts/check-native-notices.mjs) && (tsbuild tsfolders) && (tsrust)",
     "format": "(gitzone format)",
     "buildDocs": "tsdoc"
   }

package/readme.md

@@ -14,7 +14,165 @@ pnpm install @push.rocks/smartnftables
 npm install @push.rocks/smartnftables
 ```
 
-> ⚠️ **Requires root privileges** to actually apply nftables rules to the kernel. Without root, rules are tracked in memory but not applied (a warning is logged). Great for development/testing!
+The legacy `SmartNftables` helper tracks rules without applying them when it lacks
+root privileges. `ManagedNftables` always rejects unsupported enforcement; it has
+no dry-run or memory-only enforcement mode.
+
+## Managed workload policy
+
+`ManagedNftables` provides a separate native owner for complete, interface-bound
+IPv4 policy. It requires Linux **6.9 or newer**, `CAP_NET_ADMIN` in its network
+namespace, and working nftables OWNER/PERSIST support. The published native matrix
+is Linux x86_64 and arm64, statically linked with musl. Actual kernel support is
+checked when applying policy; starting the compiler does not establish enforcement.
+
+An optional caller-owned `networkNamespaceFd` selects an already-created Linux
+network namespace. Keep that descriptor valid through `start()`. The native
+process validates and enters its inherited copy before readiness, owner identity
+capture or netlink activity, then closes the copy. Invalid descriptors and denied
+entry fail before readiness. The option is process configuration and never enters
+`openOwner`, policy commands or durable receipts. Native callers use
+`--management --network-namespace-fd 3` with an inherited descriptor at FD 3.
+
+The caller owns the namespace lifetime, links and routes. Retain a namespace
+owner across process loss and recovery: PERSIST retains policy only while its
+namespace exists. An entered process keeps its namespace membership if the source
+descriptor is closed, but a replacement process requires a valid descriptor.
+Receipts bind the actual target namespace device and inode; recovery in another
+namespace rejects. Await complete policy and process cleanup before releasing
+the caller's final namespace owner. Namespace entry does not create uplink
+authority, drain conntrack flows or authorize address and port reuse.
+
+The Linux x86_64 musl candidate passed nine isolated Linux 6.18.35 kernel tests,
+including inherited namespace entry, retained policy after process loss, recovery
+in the original namespace, rejection in another namespace, and denied entry
+before readiness. ARM binaries are built; privileged ARM and complete Pallet
+workload integration remain separate qualification requirements.
+
+The caller owns workload links and durable state. Keep links disabled until their
+policy is confirmed, serialize link changes with policy operations, and disable
+them before cleanup. Persist the full prepared transition before calling
+`reconcile()`, then retain the full returned receipt in the caller's SmartData
+store. This library does not persist runtime state in files.
+
+```typescript
+import { ManagedNftables } from '@push.rocks/smartnftables';
+
+const owner = new ManagedNftables({
+  ownerId: 'node-policy',
+  instanceId: 'caller_retained_unique_instance',
+  tableName: 'snft_workloads',
+});
+await owner.start(); // Compiler/IPC readiness only; no kernel policy yet.
+
+const target = await owner.prepare({
+  schemaVersion: 1,
+  revision: 1,
+  endpoints: [
+    { id: 'workload-a', interfaceIndex: 12, interfaceName: 'worka', interfaceKind: 'veth', sourcePrefixes: ['10.81.1.2/32'] },
+    { id: 'workload-b', interfaceIndex: 13, interfaceName: 'workb', interfaceKind: 'veth', sourcePrefixes: ['10.81.2.2/32'] },
+  ],
+  rules: [
+    {
+      sourceEndpoint: 'workload-a', destinationEndpoint: 'workload-b',
+      sourcePrefix: '10.81.1.2/32', destinationPrefix: '10.81.2.2/32',
+      protocol: 'tcp', sourcePort: null, destinationPort: 443,
+    },
+    {
+      sourceEndpoint: 'workload-b', destinationEndpoint: 'workload-a',
+      sourcePrefix: '10.81.2.2/32', destinationPrefix: '10.81.1.2/32',
+      protocol: 'tcp', sourcePort: 443, destinationPort: null,
+    },
+  ],
+});
+const transition = { previous: null, target };
+// Persist this complete transition before the next operation.
+const applied = await owner.reconcile(transition);
+// Persist the complete applied result before enabling the caller-owned links.
+const status = await owner.inspect();
+if (!status.enforced) throw new Error('Workload policy is not confirmed.');
+
+// After disabling/quiescing these workload links:
+await owner.release(applied);
+await owner.close();
+```
+
+Interface numbers and names in this example must be replaced with the caller's
+actual, already-created links. Native RTM_GETLINK checks the name/index pair,
+the declared `veth` or L3 `tun` kind and absence of a bridge/master attachment.
+The caller must prove and own each veth peer and workload network namespace.
+Both selectors must match for a grant. A stale
+name/index pair rejects application; renaming either selector retains denial.
+Do not reuse interface identities or workload addresses while their previous
+grants remain outstanding.
+
+| Method | Behavior |
+| --- | --- |
+| `start()` | Starts one private native process and returns idle status. |
+| `prepare(policy)` | Validates, canonicalizes and hashes an inert complete policy without kernel writes. |
+| `reconcile({ previous, target })` | Creates or replaces the entire policy in one kernel transaction. `previous` is null initially, otherwise the full prior applied result. |
+| `inspect()` | Reads the current owned graph and reports `enforced`, pending intent and a bounded error code. |
+| `release(applied)` | Verifies the exact retained graph and confirms deletion; repeats are idempotent. |
+| `close()` | Stops command admission, joins admitted policy operations, confirms owned-table deletion, then joins the native process. Failure retains the owner for explicit recovery. |
+
+Policies are directed. Return traffic requires its own grant; there is no broad
+connection-tracking bypass. A null endpoint denotes the actual local host, with an
+explicit prefix that cannot overlap any endpoint. Such a grant applies only to
+input/output. Forwarding requires two explicit endpoint references; a relay TUN
+is an endpoint with `interfaceKind: 'tun'` and its authenticated remote source
+prefixes. The relay owner must authenticate that remote source authority.
+Managed interfaces reject other IPv4 traffic and IPv6 traffic. Ethernet/ARP
+is outside these inet hooks; workload links must use the qualified routed layout.
+Unmatched interfaces retain their existing behavior. The compiler creates
+only inet input, forward and output filter chains; it does not configure links,
+routes, NAT, DNS, host defaults, forwarding sysctls, or relay sessions. An ungranted
+destination is denied independently of DNS answers.
+
+The schema permits at most 32 interfaces, 16 source prefixes per interface and
+128 directed rules, additionally bounded to 768 compiled operations and 100,000
+encoded bytes. IPv4 prefixes must be canonical, non-overlapping local allocations;
+loopback, unspecified and multicast allocations reject. Ports require explicit
+TCP/UDP and all nullable fields must be present. The facade rejects getters,
+proxies, live objects and concurrent commands rather than queuing unbounded work.
+
+One NETLINK_NETFILTER socket exclusively owns the table with OWNER/PERSIST flags.
+An acknowledged batch commits the complete graph atomically. Lost acknowledgements
+retain the exact pending transition; retry only that same body. Reconnect/restart
+uses the same caller-retained owner, instance, table and boot/namespace receipt.
+Recovery checks the complete graph before and after orphan adoption. The kernel's
+wrapping generation counter only fences concurrent transactions; it is never a
+durable revision or sufficient ownership proof. Foreign owners, unexpected tables,
+chains, rules, sets or objects reject without deletion.
+
+PERSIST deliberately retains accepted static grants if the native process crashes.
+It supplies no wall-clock lease or timed revocation. The caller must keep revocation
+pending until policy replacement or workload fencing is confirmed. Host reboot
+invalidates the old boot receipt; the caller must fence its old link/workload
+lifecycle before starting a new owner instance. Cleanup failures and uncertain
+operations must not be reported as successful release or used to transfer authority.
+
+Apply and release receipts describe this owner's table and policy operations.
+They do not certify that packets admitted under an earlier graph have drained:
+foreign NFQUEUE or other deferred packet owners may still hold such packets.
+The caller must qualify the complete packet path or independently fence the
+workload before treating revocation as complete or reusing its addresses and
+interfaces. Table deletion does not release IP allocation authority or clean up
+conntrack/NAT state. This restriction also applies to private veth/TUN forwarding.
+
+### Native qualification
+
+`cargo test --manifest-path rust/Cargo.toml --locked` runs only unprivileged pure
+tests. The ignored native cases require the explicitly marked disposable guest
+from `test/native/qualify.py`; requesting them on an ordinary host fails its scope
+check. Qualification uses an offline Linux 6.18.35 x86_64 guest with no host disks,
+mounts or network devices, and guest-owned network namespaces/veth pairs. It covers
+UDP/TCP grants, direct-IP denial, source spoofing, IPv6 denial, renamed interfaces,
+foreign ownership, atomic rollback, generation conflicts and lost-ACK recovery.
+The arm64 binary is cross-built; native packet qualification is currently x86_64.
+Kernel 6.8 is unsupported. No production activation is implied by these tests.
+
+Native dependency and standard-library attribution is included in
+`native-notices/`. Distribution must retain these notices alongside the binaries.
 
 ## Quick Start
 
@@ -339,7 +497,7 @@ All interfaces and types are fully exported for use in your own code:
 
 ## License and Legal Information
 
-This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the [repository license file](./license).
+This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the [repository license file](./license.md).
 
 **Please note:** The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.
 

package/rust/.cargo/config.toml

@@ -0,0 +1,2 @@
+[target.aarch64-unknown-linux-musl]
+linker = "aarch64-linux-gnu-gcc"

package/rust/Cargo.lock

@@ -0,0 +1,192 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "crypto-common",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "libc"
+version = "0.2.189"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
+
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.151"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "smartnftables"
+version = "0.1.0"
+dependencies = [
+ "libc",
+ "serde",
+ "serde_json",
+ "sha2",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12df2e0110f65b775f769bb17ef989067a1d931b2eb822bd4346631eeada89f9"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "typenum"
+version = "1.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "zmij"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"

package/rust/Cargo.toml

@@ -0,0 +1,13 @@
+[package]
+name = "smartnftables"
+version = "0.1.0"
+edition = "2021"
+publish = false
+license = "MIT"
+description = "Owned, atomic Linux nftables managed policy engine"
+
+[dependencies]
+libc = "=0.2.189"
+serde = { version = "=1.0.229", features = ["derive"] }
+serde_json = { version = "=1.0.151", features = ["raw_value"] }
+sha2 = "=0.10.9"