@push.rocks/smartnftables 1.6.0 → 1.7.0

package/changelog.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 2026-09-14 - 1.7.0
+
+### Features
+
+- Add a host-wide allocation-pool guard with direction-aware IPv4 denial, bounded atomic updates, and native packet and recovery qualification.
+
 ## 2026-09-13 - 1.6.0
 
 ### Features

package/dist_rust/smartnftables_linux_amd64_musl.tsrust-build.json

@@ -1,12 +1,12 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "3dd9944031490243ac7c5452afde0681acc1672c975fd9c15d6956f7e8408604",
+  "binarySha256": "d220f9e5399c394467c212c9c29a01d56395bde551a7a1af7bd233ae313bbf21",
   "buildInfo": {
     "projectName": "@push.rocks/smartnftables",
-    "projectVersion": "1.6.0",
-    "gitCommit": "4962c8d3ebc469287abf0c2acf5e3b413fa23e64",
+    "projectVersion": "1.7.0",
+    "gitCommit": "9f206a95e42e76d6a4a61ecce11cf5d02927fb41",
     "gitDirty": false,
-    "builtAt": "2026-09-13T17:03:57.902Z",
+    "builtAt": "2026-09-14T02:54:17.256Z",
     "tsrustVersion": "1.13.0",
     "binary": "smartnftables",
     "target": "linux_amd64_musl"

package/dist_rust/smartnftables_linux_arm64_musl.tsrust-build.json

@@ -1,12 +1,12 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "0fbd6afc372d977bb68c9816e3fcb042d2202a433344a4c8ffc44b6e6d66e3c8",
+  "binarySha256": "a282a800a9782297af8e7862ef2b8abbbc1aefcc79d50b5d0f453feecc874e36",
   "buildInfo": {
     "projectName": "@push.rocks/smartnftables",
-    "projectVersion": "1.6.0",
-    "gitCommit": "4962c8d3ebc469287abf0c2acf5e3b413fa23e64",
+    "projectVersion": "1.7.0",
+    "gitCommit": "9f206a95e42e76d6a4a61ecce11cf5d02927fb41",
     "gitDirty": false,
-    "builtAt": "2026-09-13T17:03:58.037Z",
+    "builtAt": "2026-09-14T02:54:17.376Z",
     "tsrustVersion": "1.13.0",
     "binary": "smartnftables",
     "target": "linux_arm64_musl"

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@push.rocks/smartnftables',
-    version: '1.6.0',
+    version: '1.7.0',
     description: 'A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSwyQkFBMkI7SUFDakMsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLG1IQUFtSDtDQUNqSSxDQUFBIn0=

package/dist_ts/managed.egress.types.d.ts

@@ -84,8 +84,16 @@ export interface IManagedNftHostTransitScopeV2 {
     /** Exact current address present on uplink. No masquerade or default-route inference. */
     snatAddress: string;
 }
+/** Host-wide IPv4 destination denial for caller-authenticated private allocation pools.
+ * This has no link dependency or allow grants. It is not allocation-release or boot-order proof. */
+export interface IManagedNftAllocationPoolGuardScopeV2 {
+    kind: 'allocationPoolGuard';
+    authorityDigest: string;
+    /** Complete current pool list: 1–64 canonical, disjoint RFC1918 prefixes. */
+    prefixes: string[];
+}
 export interface IManagedNftPolicyV2 {
     schemaVersion: 2;
     revision: number;
-    scope: IManagedNftRouterEgressScopeV2 | IManagedNftHostTransitScopeV2;
+    scope: IManagedNftRouterEgressScopeV2 | IManagedNftHostTransitScopeV2 | IManagedNftAllocationPoolGuardScopeV2;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartnftables",
-  "version": "1.6.0",
+  "version": "1.7.0",
   "private": false,
   "description": "A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.",
   "main": "dist_ts/index.js",

package/readme.md

@@ -168,12 +168,40 @@ conntrack/NAT state. This restriction also applies to private veth/TUN forwardin
 The prepared/applied/transition/status interfaces accept the same policy type
 parameter; existing callers default to the unchanged schema-v1 contract. V1
 canonical digests and compiled bytes are preserved. V2 uses its own hash domain.
-An owner cannot transition between v1 private, v2 router, and v2 host policy kinds.
+An owner cannot transition between v1 private, v2 router, v2 host transit, and v2
+allocation-pool guard policy kinds.
 
 | V2 scope | Required authority and behavior |
 | --- | --- |
 | `routerEgress` | Private `endpoints` and `rules`, one exact `links` binding per endpoint, a separate veth `handoff`, `protection`, and active `generations`. Private veth/TUN/local DNS and egress share one table so terminal private denial cannot override a separate egress table. |
 | `hostTransit` | Exact handoff `link`/`allocations` pairs, complete `protection`, an explicit veth or Ethernet `uplink`, and its current `snatAddress`. It checks each handoff's leased source address and protocol/port range, default conntrack zone, direction, uplink, and protected destinations before outer SNAT. |
+| `allocationPoolGuard` | An authenticated `authorityDigest` and complete current allocation-pool `prefixes`. Installs host-wide IPv4 destination denial before any handoff exists, without link, uplink or SNAT dependencies. |
+
+`allocationPoolGuard` accepts 1–64 canonical, disjoint RFC1918 prefixes. Supply
+the actual allocation pools, not the broader protected union containing management
+LANs, resolvers and platform endpoints. It applies to IPv4 INPUT, FORWARD and OUTPUT
+at filter priority 0, after normal destination NAT. It drops an original conntrack
+destination in a pool. Reply-direction packets additionally check their current
+source, then return; all remaining packets check their current destination. This
+denies DNAT into or away from a pool and untracked current-destination traffic,
+while permitting reverse-SNAT replies to authorized transit sources. It grants no
+egress permissions; exact `hostTransit` and router policies remain separate owners.
+Unrelated host traffic and IPv6 retain their existing behavior.
+
+For example, a guard policy is `{ schemaVersion: 2, revision: 1, scope: {
+kind: 'allocationPoolGuard', authorityDigest, prefixes: ['10.240.0.0/16',
+'10.241.0.0/16'] } }`. Hashing binds the supplied body, but does not authenticate
+the authority or prove its completeness. An empty `hostTransit.handoffs` array
+provides no host-wide denial and is not a substitute for this scope.
+
+The caller must retain the authenticated authority, complete transition and applied
+receipt, verify `inspect().enforced`, and qualify the complete packet path. This
+guard alone proves neither early-boot/late-shutdown ordering nor protection after
+kernel reboot. It does not fence foreign packet queues, later packet rewrites,
+offloads or proxies, and supplies no quarantine release, conntrack drainage or
+allocation-reuse evidence. Historical leases remain the caller's durable ownership
+responsibility. PERSIST retains this table only while its network namespace exists;
+`close()` still deletes it, so revoke any external protection claim before release.
 
 Local bindings include name, index, kind, MAC (null for L3 TUN), interface-link
 index, and required IPv4 addresses. RTM_GETLINK/RTM_GETADDR verify those local

package/rust/src/egress.compile.rs

@@ -4,6 +4,8 @@ use crate::wire::{self, Attr};
 
 #[path = "egress.host.rs"]
 mod host;
+#[path = "egress.poolguard.rs"]
+mod poolguard;
 #[path = "egress.router.rs"]
 mod router;
 
@@ -283,6 +285,7 @@ pub(super) fn compile(prepared: &Prepared, table: &str) -> Result<Vec<(u16, Vec<
             router::compile(&mut program, scope, prepared.policy.revision)?
         }
         Scope::HostTransit(scope) => host::compile(&mut program, scope)?,
+        Scope::AllocationPoolGuard(scope) => poolguard::compile(&mut program, scope)?,
     }
     Ok(program.operations)
 }

package/rust/src/egress.poolguard.rs

@@ -0,0 +1,30 @@
+use super::*;
+
+pub(super) fn compile(program: &mut Program<'_>, scope: &AllocationPoolGuardScope) -> Result<()> {
+    for (name, hook) in [("input", 1), ("forward", 2), ("output", 3)] {
+        program.chain(name, Some((hook, 0, "filter")))?;
+    }
+    for name in ["pool_guard", "pool_reply"] {
+        program.chain(name, None)?;
+    }
+    for name in ["input", "forward", "output"] {
+        program.jump(name, ipv4(), "pool_guard")?;
+    }
+    // An earlier owner's DNAT must not conceal the original protected target.
+    for prefix in &scope.prefixes {
+        program.end("pool_guard", original_address(prefix, false)?, 0)?;
+    }
+    // GOTO, not JUMP: RETURN from pool_reply must return to the base chain,
+    // skipping current-destination denial for legitimate reverse-SNAT replies.
+    let mut reply = ct(1, None, vec![1]);
+    reply.push(verdict(-4, Some("pool_reply")));
+    program.rule("pool_guard", reply)?;
+    // A missing conntrack tuple/direction breaks only its rule. Untracked or
+    // invalid packets still reach this unconditional current-destination guard.
+    for prefix in &scope.prefixes {
+        program.end("pool_guard", current_address(prefix, false)?, 0)?;
+        program.end("pool_reply", current_address(prefix, true)?, 0)?;
+    }
+    program.end("pool_guard", vec![], -5)?;
+    program.end("pool_reply", vec![], -5)
+}

package/rust/src/egress.rs

@@ -119,10 +119,17 @@ pub struct HostScope {
     pub snat_address: String,
 }
 #[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct AllocationPoolGuardScope {
+    pub authority_digest: String,
+    pub prefixes: Vec<String>,
+}
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
 #[serde(tag = "kind", rename_all = "camelCase", deny_unknown_fields)]
 pub enum Scope {
     RouterEgress(RouterScope),
     HostTransit(HostScope),
+    AllocationPoolGuard(AllocationPoolGuardScope),
 }
 #[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
@@ -532,6 +539,23 @@ fn normalize_router(value: &mut RouterScope, revision: u64) -> Result<()> {
         )
     }))
 }
+fn normalize_pool_guard(value: &mut AllocationPoolGuardScope) -> Result<()> {
+    require(
+        digest(&value.authority_digest) && !value.prefixes.is_empty() && value.prefixes.len() <= 64,
+    )?;
+    value.prefixes.sort();
+    for (index, item) in value.prefixes.iter().enumerate() {
+        require(
+            covers("10.0.0.0/8", item)?
+                || covers("172.16.0.0/12", item)?
+                || covers("192.168.0.0/16", item)?,
+        )?;
+        for previous in &value.prefixes[..index] {
+            require(!overlaps(item, previous)?)?;
+        }
+    }
+    Ok(())
+}
 fn normalize_host(value: &mut HostScope) -> Result<()> {
     normalize_protection(&mut value.protection)?;
     normalize_link(&mut value.uplink)?;
@@ -642,6 +666,7 @@ impl Policy {
         match &mut self.scope {
             Scope::RouterEgress(scope) => normalize_router(scope, self.revision)?,
             Scope::HostTransit(scope) => normalize_host(scope)?,
+            Scope::AllocationPoolGuard(scope) => normalize_pool_guard(scope)?,
         }
         Ok(self)
     }
@@ -667,6 +692,8 @@ impl Prepared {
                 .map(|item| &item.link)
                 .chain(std::iter::once(&scope.uplink))
                 .collect(),
+            // No link/route dependency: this policy must apply before allocation.
+            Scope::AllocationPoolGuard(_) => return Ok(()),
         };
         crate::wire::verify_bound_interfaces(links.into_iter().map(|link| {
             crate::wire::BoundInterface {

package/rust/src/egress_tests.rs

@@ -45,6 +45,11 @@ pub(crate) fn host() -> Value {
         "handoffs":[{"link":link(4,"handoff","veth","10.240.0.1"),"allocations":[allocation()]}],
         "uplink":link(2,"ens18","ethernet","192.0.2.2"),"snatAddress":"192.0.2.2"}})
 }
+pub(crate) fn pool_guard() -> Value {
+    json!({"schemaVersion":2,"revision":1,"scope":{"kind":"allocationPoolGuard",
+        "authorityDigest":format!("sha256:{}", "b".repeat(64)),
+        "prefixes":["10.241.0.0/16", "10.240.0.0/16"]}})
+}
 fn normalized(value: Value) -> super::Result<Policy> {
     serde_json::from_value::<Policy>(value)
         .map_err(|_| crate::Error::Invalid)?
@@ -330,3 +335,83 @@ fn managed_union_keeps_strict_duplicate_and_unknown_field_rejection() {
     )
     .is_err());
 }
+
+#[test]
+fn allocation_pool_guard_is_canonical_authority_bound_and_private_only() {
+    let prepared = normalized(pool_guard()).unwrap().prepare().unwrap();
+    let mut reordered = pool_guard();
+    reordered["scope"]["prefixes"]
+        .as_array_mut()
+        .unwrap()
+        .reverse();
+    assert_eq!(normalized(reordered).unwrap().prepare().unwrap(), prepared);
+    let mut changed_authority = pool_guard();
+    changed_authority["scope"]["authorityDigest"] = json!(format!("sha256:{}", "c".repeat(64)));
+    assert_ne!(
+        normalized(changed_authority)
+            .unwrap()
+            .prepare()
+            .unwrap()
+            .digest,
+        prepared.digest
+    );
+    for prefixes in [
+        json!([]),
+        json!(["10.0.0.1/8"]),
+        json!(["10.0.0.0/8", "10.1.0.0/16"]),
+        json!(["10.0.0.0/8", "10.0.0.0/8"]),
+        json!(["0.0.0.0/0"]),
+        json!(["192.0.2.0/24"]),
+        json!(["127.0.0.0/8"]),
+        json!(["172.0.0.0/8"]),
+        json!(["192.168.0.0/15"]),
+        json!(["10.0.0.0/08"]),
+        json!(["::/0"]),
+    ] {
+        assert!(normalized(changed(pool_guard(), "/scope/prefixes", prefixes)).is_err());
+    }
+    let mut extra = pool_guard();
+    extra["scope"]["handoffs"] = json!([]);
+    assert!(normalized(extra).is_err());
+    assert!(normalized(changed(
+        pool_guard(),
+        "/scope/authorityDigest",
+        json!("sha256:bad")
+    ))
+    .is_err());
+    assert!(normalized(changed(
+        pool_guard(),
+        "/scope/prefixes",
+        json!(["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"])
+    ))
+    .is_ok());
+    let duplicate = serde_json::to_string(&pool_guard())
+        .unwrap()
+        .replace("\"prefixes\":", "\"prefixes\":[],\"prefixes\":");
+    assert!(serde_json::from_str::<crate::managed::Policy>(&duplicate).is_err());
+}
+
+#[test]
+fn allocation_pool_guard_maximum_fits_the_atomic_graph_without_link_bindings() {
+    let prefixes: Vec<_> = (0..64).map(|part| format!("10.{part}.0.0/16")).collect();
+    let prepared = normalized(changed(pool_guard(), "/scope/prefixes", json!(prefixes)))
+        .unwrap()
+        .prepare()
+        .unwrap();
+    prepared.validate().unwrap();
+    prepared.validate_interfaces().unwrap();
+    let program = prepared
+        .program(&format!("snft_{}", "x".repeat(59)))
+        .unwrap();
+    let bytes: usize = program
+        .iter()
+        .map(|(_, attrs)| crate::wire::encode_attrs(attrs).len() + 20)
+        .sum();
+    assert!(program.len() <= 768 && bytes <= 100_000);
+    println!(
+        "POOL_GUARD_MAX prefixes=64 operations={} bytes={bytes}",
+        program.len()
+    );
+    let excessive: Vec<_> = (0..65).map(|part| format!("10.{part}.0.0/16")).collect();
+    assert!(normalized(changed(pool_guard(), "/scope/prefixes", json!(excessive))).is_err());
+}

package/rust/src/managed.rs

@@ -34,6 +34,10 @@ impl Policy {
                 scope: egress::Scope::HostTransit(_),
                 ..
             }) => "hostTransitV2",
+            Self::Egress(egress::Policy {
+                scope: egress::Scope::AllocationPoolGuard(_),
+                ..
+            }) => "allocationPoolGuardV2",
         }
     }
     pub fn prepare(self) -> Result<Prepared> {

package/rust/src/owner_egress_tests.rs

@@ -62,7 +62,7 @@ fn host() -> egress::Policy {
     value["scope"]["uplink"] = binding("uplink", "192.0.2.2", "veth");
     serde_json::from_value(value).unwrap()
 }
-fn recover(name: &str, policy: egress::Policy) {
+pub(super) fn recover(name: &str, policy: egress::Policy) {
     let prepared: Prepared = policy.clone().prepare().unwrap().into();
     prepared.validate_interfaces().expect("fixture bindings");
     let mut owner = Owner::new(options(name)).unwrap();

package/rust/src/owner_egress_traffic_tests.rs

@@ -205,6 +205,18 @@ fn v2_four_namespace_private_tun_local_dns_egress_and_revocation() {
     ns_ip(ROUTER, &["address", "add", "10.242.0.1/24", "dev", "vpn"]);
     ns_ip(ROUTER, &["link", "set", "vpn", "up"]);
     let mut device = in_namespace(ROUTER, tun);
+    let (pool_owner, pool_applied) = in_namespace(HOST, || {
+        let mut owner = Owner::new(options("pool_coexistence")).unwrap();
+        let policy: egress::Policy = serde_json::from_value(egress::tests::pool_guard()).unwrap();
+        let applied = owner
+            .reconcile(Transition {
+                previous: None,
+                target: policy.prepare().unwrap().into(),
+            })
+            .unwrap();
+        assert!(owner.inspect().enforced);
+        (owner, applied)
+    });
     let (host_owner, host_applied) = in_namespace(HOST, || {
         let mut owner = Owner::new(options("host_packets")).unwrap();
         let applied = owner
@@ -260,11 +272,8 @@ fn v2_four_namespace_private_tun_local_dns_egress_and_revocation() {
     });
     let listener = in_namespace(PEER, || TcpListener::bind("192.0.2.3:3000").unwrap());
     let mut client = in_namespace(WORK, || {
-        TcpStream::connect_timeout(
-            &"192.0.2.3:3000".parse().unwrap(),
-            Duration::from_secs(1),
-        )
-        .unwrap()
+        TcpStream::connect_timeout(&"192.0.2.3:3000".parse().unwrap(), Duration::from_secs(1))
+            .unwrap()
     });
     let (mut server, peer) = listener.accept().unwrap();
     assert_eq!(peer.ip().to_string(), "192.0.2.2");
@@ -290,11 +299,8 @@ fn v2_four_namespace_private_tun_local_dns_egress_and_revocation() {
     assert_eq!(syn[33] & 0xc0, 0xc0);
     assert!((10016..=10031).contains(&u16::from_be_bytes(syn[20..22].try_into().unwrap())));
     let mut local_tcp = in_namespace(ROUTER, || {
-        TcpStream::connect_timeout(
-            &"192.0.2.3:3000".parse().unwrap(),
-            Duration::from_secs(1),
-        )
-        .unwrap()
+        TcpStream::connect_timeout(&"192.0.2.3:3000".parse().unwrap(), Duration::from_secs(1))
+            .unwrap()
     });
     let (mut local_peer, local_outer) = listener.accept().unwrap();
     assert!((10016..=10031).contains(&local_outer.port()));
@@ -466,5 +472,10 @@ fn v2_four_namespace_private_tun_local_dns_egress_and_revocation() {
         let mut owner = host_owner;
         owner.release(host_applied).unwrap();
     });
+    in_namespace(HOST, move || {
+        let mut owner = pool_owner;
+        assert!(owner.inspect().enforced);
+        owner.release(pool_applied).unwrap();
+    });
     println!("V2_PACKET_PROOF private_dns=true tun_private=true tun_public_denied=true workload_public=true local_dns_and_tcp=true handoff_udp_tcp_ranges=true ecn_syn=true opening_ack_rst_denied=true fragments_checked=true range_exhaustion_denied=true protected_grant_denied=true ungranted_local_denied=true retired_replies_denied=true revoked_egress_denied=true disjoint_generation_restored=true flows_drained=false reusable=false");
 }

package/rust/src/owner_host_traffic_tests.rs

@@ -7,7 +7,7 @@ const SOURCE: &str = "hs_source";
 const HOST: &str = "hs_host";
 const PEER: &str = "hs_peer";
 
-fn payload(offset: u32, bytes: Vec<u8>, transport: bool) -> Vec<Attr> {
+pub(super) fn payload(offset: u32, bytes: Vec<u8>, transport: bool) -> Vec<Attr> {
     vec![
         expr(
             "payload",
@@ -21,7 +21,7 @@ fn payload(offset: u32, bytes: Vec<u8>, transport: bool) -> Vec<Attr> {
         compare(bytes),
     ]
 }
-fn immediate(value: Vec<u8>) -> Attr {
+pub(super) fn immediate(value: Vec<u8>) -> Attr {
     expr(
         "immediate",
         vec![
@@ -196,10 +196,7 @@ fn v2_host_rejects_foreign_dnat_zone_local_diversion_and_ipv6() {
         HOST,
         &["route", "add", "203.0.113.2/32", "via", "192.0.2.3"],
     );
-    ns_ip(
-        HOST,
-        &["route", "add", "10.250.0.2/32", "via", "192.0.2.3"],
-    );
+    ns_ip(HOST, &["route", "add", "10.250.0.2/32", "via", "192.0.2.3"]);
     for address in ["203.0.113.2/32", "10.250.0.2/32"] {
         ns_ip(PEER, &["address", "add", address, "dev", "lo"]);
     }
@@ -285,10 +282,7 @@ fn v2_host_rejects_foreign_dnat_zone_local_diversion_and_ipv6() {
         control(source, destination, target, false);
     }
     let allowed = socket(SOURCE, "10.240.0.2:10000");
-    assert_eq!(
-        roundtrip(&allowed, &public).ip().to_string(),
-        "192.0.2.2"
-    );
+    assert_eq!(roundtrip(&allowed, &public).ip().to_string(), "192.0.2.2");
     let platform = socket(PEER, "192.0.2.3:5300");
     roundtrip(&allowed, &platform);
     let unleased = socket(SOURCE, "10.240.0.2:9999");

package/rust/src/owner_poolguard_tests.rs

@@ -0,0 +1,265 @@
+use super::egress_traffic_tests::{connect, ns_ip, roundtrip, socket};
+use super::host_traffic_tests::{immediate, payload};
+use super::*;
+use crate::{
+    egress,
+    policy::{expr, meta},
+};
+use serde_json::json;
+use std::net::{SocketAddr, UdpSocket};
+use std::time::Duration;
+
+const SOURCE: &str = "pg_source";
+const HOST: &str = "pg_host";
+const PEER: &str = "pg_peer";
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn allocation_pool_guard_maximum_graph_persist_and_lost_ack_recovery() {
+    isolated();
+    let mut policy = egress::tests::pool_guard();
+    policy["scope"]["prefixes"] = json!((0..64)
+        .map(|part| format!("10.{part}.0.0/16"))
+        .collect::<Vec<_>>());
+    super::egress_tests::recover("pools_v2", serde_json::from_value(policy).unwrap());
+}
+
+// Foreign capture controls exist only in this offline guest. They are never
+// composed into or removed with the managed policy under test.
+fn foreign_captures() {
+    let table = "snft_foreign_pool_capture";
+    let mut operations = vec![(0, 0x600, vec![Attr::string(1, table), Attr::u32(2, 6)])];
+    for (chain, hook, priority, kind) in [
+        ("raw_pre", 0, -300_i32, "filter"),
+        ("raw_out", 3, -300, "filter"),
+        ("pre", 0, -100, "nat"),
+        ("out", 3, -100, "nat"),
+    ] {
+        operations.push((
+            3,
+            0x600,
+            vec![
+                Attr::string(1, table),
+                Attr::string(3, chain),
+                Attr::nested(4, vec![Attr::u32(1, hook), Attr::u32(2, priority as u32)]),
+                Attr::u32(5, 1),
+                Attr::string(7, kind),
+                Attr::u32(10, 1),
+            ],
+        ));
+    }
+    let mut rule = |chain: &str, expressions| {
+        operations.push((
+            6,
+            0xc00,
+            vec![
+                Attr::string(1, table),
+                Attr::string(2, chain),
+                Attr::nested(4, expressions),
+            ],
+        ))
+    };
+    for chain in ["raw_pre", "raw_out"] {
+        let mut expressions = meta(16, vec![17]);
+        expressions.extend(payload(2, 44003_u16.to_be_bytes().to_vec(), true));
+        expressions.push(expr("notrack", vec![]));
+        rule(chain, expressions);
+    }
+    for chain in ["pre", "out"] {
+        for (port, destination, target) in [
+            (44001_u16, [10, 250, 0, 2], [203, 0, 113, 2]),
+            (44002, [203, 0, 113, 2], [10, 250, 0, 2]),
+            (44004, [10, 250, 0, 2], [192, 0, 2, 2]),
+            (44005, [203, 0, 113, 2], [10, 241, 0, 1]),
+        ] {
+            let mut expressions = meta(16, vec![17]);
+            expressions.extend(payload(16, destination.to_vec(), false));
+            expressions.extend(payload(2, port.to_be_bytes().to_vec(), true));
+            expressions.push(immediate(target.to_vec()));
+            expressions.push(expr(
+                "nat",
+                vec![
+                    Attr::u32(1, 1),
+                    Attr::u32(2, 2),
+                    Attr::u32(3, 1),
+                    Attr::u32(4, 1),
+                    Attr::u32(7, 1),
+                ],
+            ));
+            rule(chain, expressions);
+        }
+    }
+    let mut socket = wire::Socket::open().unwrap();
+    let generation = socket.generation().unwrap();
+    socket.batch(generation, operations).unwrap();
+}
+
+fn bound(namespace: &str, address: &str) -> UdpSocket {
+    let address = address.to_owned();
+    let socket = in_namespace(namespace, move || UdpSocket::bind(address).unwrap());
+    socket
+        .set_read_timeout(Some(Duration::from_millis(250)))
+        .unwrap();
+    socket
+}
+fn probe(
+    source: &UdpSocket,
+    destination: &str,
+    target: &UdpSocket,
+    allowed: bool,
+    local: bool,
+) -> Option<SocketAddr> {
+    let result = source.send_to(b"probe", destination);
+    if !allowed && local {
+        assert_eq!(
+            result.unwrap_err().raw_os_error(),
+            Some(libc::EPERM),
+            "{destination}"
+        );
+    } else {
+        assert_eq!(result.unwrap(), 5, "{destination}");
+    }
+    match target.recv_from(&mut [0; 64]) {
+        Ok((size, sender)) => {
+            assert!(allowed, "unexpected packet to {destination}");
+            assert_eq!(size, 5);
+            Some(sender)
+        }
+        Err(error) => {
+            assert!(!allowed, "missing packet to {destination}: {error}");
+            assert!(matches!(
+                error.kind(),
+                std::io::ErrorKind::WouldBlock | std::io::ErrorKind::TimedOut
+            ));
+            None
+        }
+    }
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn allocation_pool_guard_covers_all_host_hooks_dnat_untracked_and_reply_direction() {
+    isolated();
+    for name in [SOURCE, HOST, PEER] {
+        ip(&["netns", "add", name]);
+        ns_ip(name, &["link", "set", "lo", "up"]);
+        in_namespace(name, || {
+            std::fs::write("/proc/sys/net/ipv4/ip_forward", "1").unwrap()
+        });
+    }
+    connect(
+        SOURCE,
+        "source",
+        "10.240.0.2/30",
+        HOST,
+        "router",
+        "10.240.0.1/30",
+    );
+    connect(
+        HOST,
+        "uplink",
+        "192.0.2.2/24",
+        PEER,
+        "underlay",
+        "192.0.2.3/24",
+    );
+    ns_ip(SOURCE, &["route", "add", "default", "via", "10.240.0.1"]);
+    ns_ip(PEER, &["route", "add", "default", "via", "192.0.2.2"]);
+    ns_ip(HOST, &["address", "add", "10.241.0.1/32", "dev", "lo"]);
+    for address in ["203.0.113.2", "10.250.0.2"] {
+        ns_ip(
+            PEER,
+            &["address", "add", &format!("{address}/32"), "dev", "lo"],
+        );
+        ns_ip(
+            HOST,
+            &["route", "add", &format!("{address}/32"), "via", "192.0.2.3"],
+        );
+    }
+    in_namespace(HOST, foreign_captures);
+    let source = socket(SOURCE, "10.240.0.2:10000");
+    let host = socket(HOST, "192.0.2.2:10000");
+    let host_pool = socket(HOST, "10.241.0.1:10000");
+    let public = socket(PEER, "203.0.113.2:42000");
+    let lan = socket(PEER, "192.0.2.3:42000");
+    // Controls exercise established flows before apply, plus fresh ones below.
+    roundtrip(&source, &public);
+    roundtrip(&source, &host);
+    roundtrip(&host_pool, &public);
+    roundtrip(&host, &lan);
+    let cases = [
+        ("10.250.0.2:42001", PEER, "10.250.0.2:42001"),
+        ("10.241.0.1:42002", HOST, "10.241.0.1:42002"),
+        ("10.250.0.2:44001", PEER, "203.0.113.2:44001"),
+        ("203.0.113.2:44002", PEER, "10.250.0.2:44002"),
+        ("10.250.0.2:44003", PEER, "10.250.0.2:44003"),
+        ("10.250.0.2:44004", HOST, "192.0.2.2:44004"),
+        ("203.0.113.2:44005", HOST, "10.241.0.1:44005"),
+    ];
+    let targets: Vec<_> = cases
+        .iter()
+        .map(|(_, ns, address)| bound(ns, address))
+        .collect();
+    let mut replies = Vec::new();
+    for ((destination, _, _), target) in cases.iter().zip(&targets) {
+        for sender in [&source, &host] {
+            replies.push(probe(sender, destination, target, true, false).unwrap());
+        }
+    }
+    // INPUT with NOTRACK is independent of OUTPUT/FORWARD controls.
+    let untracked_input = socket(HOST, "10.241.0.1:44003");
+    probe(&lan, "10.241.0.1:44003", &untracked_input, true, false);
+    // A reply to a public original destination can have a pool source before
+    // reverse DNAT in POSTROUTING. Both INPUT and FORWARD must deny that reply.
+    for (sender, receiver) in [(&source, replies[6]), (&host, replies[7])] {
+        targets[3].send_to(b"before", receiver).unwrap();
+        assert_eq!(sender.recv(&mut [0; 64]).unwrap(), 6);
+    }
+    let (owner, applied) = in_namespace(HOST, || {
+        let mut owner = Owner::new(options("pool_traffic")).unwrap();
+        let mut policy = egress::tests::pool_guard();
+        policy["scope"]["prefixes"]
+            .as_array_mut()
+            .unwrap()
+            .push(json!("10.250.0.0/16"));
+        let target = serde_json::from_value::<egress::Policy>(policy)
+            .unwrap()
+            .prepare()
+            .unwrap()
+            .into();
+        let applied = owner
+            .reconcile(Transition {
+                previous: None,
+                target,
+            })
+            .unwrap();
+        assert!(owner.inspect().enforced);
+        (owner, applied)
+    });
+    for ((destination, _, _), target) in cases.iter().zip(&targets) {
+        probe(&source, destination, target, false, false);
+        probe(&host, destination, target, false, true);
+    }
+    probe(&lan, "10.241.0.1:44003", &untracked_input, false, false);
+    for (sender, receiver) in [(&source, replies[6]), (&host, replies[7])] {
+        targets[3].send_to(b"after", receiver).unwrap();
+        assert!(sender.recv(&mut [0; 64]).is_err());
+    }
+    roundtrip(&source, &public);
+    roundtrip(&source, &host);
+    roundtrip(&host_pool, &public);
+    roundtrip(&host, &lan);
+    let fresh = socket(SOURCE, "10.240.0.2:10001");
+    roundtrip(&fresh, &public);
+    in_namespace(HOST, move || {
+        let mut owner = owner;
+        assert!(owner.inspect().enforced);
+        owner.release(applied).unwrap();
+    });
+    // Positive control after release proves the denials were this guard.
+    for ((destination, _, _), target) in cases.iter().zip(&targets) {
+        probe(&source, destination, target, true, false);
+        probe(&host, destination, target, true, false);
+    }
+    println!("POOL_GUARD_PACKET_PROOF input=true forward=true output=true current_dnat=true original_dnat=true untracked=true reply_current_source=true established_and_fresh_public=true management_lan=true release_control=true allocation_reusable=false");
+}

package/rust/src/owner_tests.rs

@@ -21,6 +21,9 @@ mod packet_fixture;
 #[path = "owner_host_traffic_tests.rs"]
 mod host_traffic_tests;
 
+#[path = "owner_poolguard_tests.rs"]
+mod poolguard_tests;
+
 #[path = "owner_coexistence_tests.rs"]
 mod coexistence_tests;
 

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartnftables',
-  version: '1.6.0',
+  version: '1.7.0',
   description: 'A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.'
 }

package/ts/managed.egress.types.ts

@@ -78,8 +78,17 @@ export interface IManagedNftHostTransitScopeV2 {
   snatAddress: string;
 }
 
+/** Host-wide IPv4 destination denial for caller-authenticated private allocation pools.
+ * This has no link dependency or allow grants. It is not allocation-release or boot-order proof. */
+export interface IManagedNftAllocationPoolGuardScopeV2 {
+  kind: 'allocationPoolGuard';
+  authorityDigest: string;
+  /** Complete current pool list: 1–64 canonical, disjoint RFC1918 prefixes. */
+  prefixes: string[];
+}
+
 export interface IManagedNftPolicyV2 {
   schemaVersion: 2;
   revision: number;
-  scope: IManagedNftRouterEgressScopeV2 | IManagedNftHostTransitScopeV2;
+  scope: IManagedNftRouterEgressScopeV2 | IManagedNftHostTransitScopeV2 | IManagedNftAllocationPoolGuardScopeV2;
 }