@push.rocks/smartnftables 1.4.0 → 1.6.0

package/ts/managed.egress.types.ts

@@ -0,0 +1,85 @@
+import type { IManagedNftEndpoint, IManagedNftRule } from './managed.types.js';
+
+/** Namespace-local facts, checked through rtnetlink. The caller retains actual link-generation ownership. */
+export interface IManagedNftLocalLinkV2 {
+  interfaceIndex: number;
+  interfaceName: string;
+  interfaceKind: 'veth' | 'tun' | 'ethernet';
+  /** Canonical unicast Ethernet address, or null for an L3 TUN. */
+  macAddress: string | null;
+  interfaceLinkIndex: number;
+  requiredIpv4Addresses: string[];
+}
+
+export interface IManagedNftPlatformEndpointV2 {
+  id: string;
+  address: string;
+  protocol: 'tcp' | 'udp';
+  port: number;
+}
+
+/** Caller-authenticated complete protected authority; hashing does not attest completeness. */
+export interface IManagedNftProtectionV2 {
+  authorityDigest: string;
+  prefixes: string[];
+  platformEndpoints: IManagedNftPlatformEndpointV2[];
+}
+
+export interface IManagedNftHandoffPortRangeV2 {
+  protocol: 'tcp' | 'udp';
+  first: number;
+  last: number;
+}
+
+export interface IManagedNftHandoffAllocationV2 {
+  lease: { id: string; generation: number; digest: string };
+  transitSourceAddress: string;
+  sourcePortRanges: IManagedNftHandoffPortRangeV2[];
+}
+
+export interface IManagedNftEgressGrantV2 {
+  /** A workload veth endpoint, or the actual router-local host for DNS/relay sockets. */
+  sourceEndpoint: string | null;
+  sourcePrefix: string;
+  destination: { kind: 'public'; prefix: string } | { kind: 'platform'; endpointId: string };
+  protocol: 'tcp' | 'udp';
+  sourcePort: number | null;
+  destinationPort: number | null;
+  /** One exact range from this generation's lease; selects the SNAT range for this grant. */
+  sourcePortRange: { first: number; last: number };
+}
+
+export interface IManagedNftEgressGenerationV2 extends IManagedNftHandoffAllocationV2 {
+  conntrackZone: number;
+  conntrackLabel: string;
+  grants: IManagedNftEgressGrantV2[];
+}
+
+/** One combined private/TUN/local/egress table; never compose a second ACCEPT over v1 terminal drops. */
+export interface IManagedNftRouterEgressScopeV2 {
+  kind: 'routerEgress';
+  endpoints: IManagedNftEndpoint[];
+  rules: IManagedNftRule[];
+  /** One exact local binding for every private endpoint. */
+  links: IManagedNftLocalLinkV2[];
+  handoff: IManagedNftLocalLinkV2;
+  protection: IManagedNftProtectionV2;
+  /** Empty retains private/local enforcement while denying external egress. */
+  generations: IManagedNftEgressGenerationV2[];
+}
+
+/** Shared-host capture barrier and explicit outer SNAT; Docker forwarding remains a separate owner. */
+export interface IManagedNftHostTransitScopeV2 {
+  kind: 'hostTransit';
+  protection: IManagedNftProtectionV2;
+  handoffs: Array<{ link: IManagedNftLocalLinkV2; allocations: IManagedNftHandoffAllocationV2[] }>;
+  uplink: IManagedNftLocalLinkV2;
+  /** Exact current address present on uplink. No masquerade or default-route inference. */
+  snatAddress: string;
+}
+
+export interface IManagedNftPolicyV2 {
+  schemaVersion: 2;
+  revision: number;
+  scope: IManagedNftRouterEgressScopeV2 | IManagedNftHostTransitScopeV2;
+}

package/ts/managed.types.ts

@@ -1,3 +1,5 @@
+import type { IManagedNftPolicyV2 } from './managed.egress.types.js';
+
 /** The caller owns these workload links and keeps them disabled until apply is confirmed. */
 export interface IManagedNftEndpoint {
   id: string;
@@ -26,8 +28,8 @@ export interface IManagedNftPolicy {
   rules: IManagedNftRule[];
 }
 
-export interface IPreparedManagedNftPolicy {
-  policy: IManagedNftPolicy;
+export interface IPreparedManagedNftPolicy<TPolicy extends TManagedNftPolicy = IManagedNftPolicy> {
+  policy: TPolicy;
   digest: string;
 }
 
@@ -47,23 +49,23 @@ export interface IManagedNftReceipt {
   digest: string;
 }
 
-export interface IAppliedManagedNftPolicy {
+export interface IAppliedManagedNftPolicy<TPolicy extends TManagedNftPolicy = IManagedNftPolicy> {
   receipt: IManagedNftReceipt;
-  prepared: IPreparedManagedNftPolicy;
+  prepared: IPreparedManagedNftPolicy<TPolicy>;
 }
 
 /** Persist this complete command before reconcile, then retain its complete result. */
-export interface IManagedNftTransition {
-  previous: IAppliedManagedNftPolicy | null;
-  target: IPreparedManagedNftPolicy;
+export interface IManagedNftTransition<TPolicy extends TManagedNftPolicy = IManagedNftPolicy> {
+  previous: IAppliedManagedNftPolicy<TPolicy> | null;
+  target: IPreparedManagedNftPolicy<TPolicy>;
 }
 
-export interface IManagedNftStatus {
+export interface IManagedNftStatus<TPolicy extends TManagedNftPolicy = IManagedNftPolicy> {
   identity: IManagedNftIdentity;
   state: 'idle' | 'applied' | 'failed-owned' | 'released';
   enforced: boolean;
-  applied: IAppliedManagedNftPolicy | null;
-  pending: IManagedNftTransition | null;
+  applied: IAppliedManagedNftPolicy<TPolicy> | null;
+  pending: IManagedNftTransition<TPolicy> | null;
   error: string | null;
 }
 
@@ -81,11 +83,13 @@ export interface IManagedNftOptions {
   networkNamespaceFd?: number;
 }
 
-export type TManagedNftCommands = {
-  preparePolicy: { params: IManagedNftPolicy; result: IPreparedManagedNftPolicy };
-  openOwner: { params: Pick<IManagedNftOptions, 'ownerId' | 'instanceId' | 'tableName'>; result: IManagedNftStatus };
-  reconcilePolicy: { params: IManagedNftTransition; result: IAppliedManagedNftPolicy };
-  inspectPolicy: { params: Record<string, never>; result: IManagedNftStatus };
-  releasePolicy: { params: IAppliedManagedNftPolicy; result: { released: true } };
+export type TManagedNftPolicy = IManagedNftPolicy | IManagedNftPolicyV2;
+
+export type TManagedNftCommands<TPolicy extends TManagedNftPolicy = IManagedNftPolicy> = {
+  preparePolicy: { params: TPolicy; result: IPreparedManagedNftPolicy<TPolicy> };
+  openOwner: { params: Pick<IManagedNftOptions, 'ownerId' | 'instanceId' | 'tableName'>; result: IManagedNftStatus<TPolicy> };
+  reconcilePolicy: { params: IManagedNftTransition<TPolicy>; result: IAppliedManagedNftPolicy<TPolicy> };
+  inspectPolicy: { params: Record<string, never>; result: IManagedNftStatus<TPolicy> };
+  releasePolicy: { params: IAppliedManagedNftPolicy<TPolicy>; result: { released: true } };
   closeOwner: { params: Record<string, never>; result: { released: true } };
 };