@push.rocks/smartnftables 1.9.0 → 2.0.0

package/changelog.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 2026-09-14 - 2.0.0
+
+### Breaking Changes
+
+- Share original-direction connection-state checks while preserving exact grant, tuple, link and generation validation. Router tables compiled by 1.x require fenced recovery and release with the old engine before preparing and applying with version 2; other policy compiler identities are unchanged.
+
+### Maintenance
+
+- Update Node typings to the current release-age eligible version.
+
 ## 2026-09-14 - 1.9.0
 
 ### Features

package/dist_rust/smartnftables_linux_amd64_musl.tsrust-build.json

@@ -1,12 +1,12 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "e7f3f755b5f9579969e94d70442710a8b2ebde0aa8dda4c0b312094b8771caf6",
+  "binarySha256": "f87173a416bf8ff6aad2d59dcb8534bbc720325b51a78134ed84c758f1944881",
   "buildInfo": {
     "projectName": "@push.rocks/smartnftables",
-    "projectVersion": "1.9.0",
-    "gitCommit": "fb3d6ad37496d2010fa77e8e6619565898519748",
+    "projectVersion": "2.0.0",
+    "gitCommit": "baace9c25621df66a88552dcd1d2f5e63c3e477f",
     "gitDirty": false,
-    "builtAt": "2026-09-14T04:36:00.044Z",
+    "builtAt": "2026-09-14T22:07:32.392Z",
     "tsrustVersion": "1.13.0",
     "binary": "smartnftables",
     "target": "linux_amd64_musl"

package/dist_rust/smartnftables_linux_arm64_musl.tsrust-build.json

@@ -1,12 +1,12 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "f80787be41352d19daf0b3916cb285fe29aa3e88f637180109a07ab8ec609b14",
+  "binarySha256": "206ed227d6c78079f1240f3a70fd2cf305258e84682b2affd97b92fcf3509b5a",
   "buildInfo": {
     "projectName": "@push.rocks/smartnftables",
-    "projectVersion": "1.9.0",
-    "gitCommit": "fb3d6ad37496d2010fa77e8e6619565898519748",
+    "projectVersion": "2.0.0",
+    "gitCommit": "baace9c25621df66a88552dcd1d2f5e63c3e477f",
     "gitDirty": false,
-    "builtAt": "2026-09-14T04:36:00.187Z",
+    "builtAt": "2026-09-14T22:07:32.519Z",
     "tsrustVersion": "1.13.0",
     "binary": "smartnftables",
     "target": "linux_arm64_musl"

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@push.rocks/smartnftables',
-    version: '1.9.0',
+    version: '2.0.0',
     description: 'A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSwyQkFBMkI7SUFDakMsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLG1IQUFtSDtDQUNqSSxDQUFBIn0=

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartnftables",
-  "version": "1.9.0",
+  "version": "2.0.0",
   "private": false,
   "description": "A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.",
   "main": "dist_ts/index.js",
@@ -14,7 +14,7 @@
     "@git.zone/tsrun": "^2.0.6",
     "@git.zone/tsrust": "1.13.0",
     "@git.zone/tstest": "6.0.0",
-    "@types/node": "26.4.1",
+    "@types/node": "26.5.0",
     "typescript": "^7.0.2"
   },
   "dependencies": {

package/readme.md

@@ -287,6 +287,23 @@ compiled graph still must fit 768 operations and 100,000 bytes; cross-products c
 reach that limit before individual input limits. Exhausted source-port ranges
 drop new flows rather than allocate outside the lease.
 
+The router compiler shares original-direction connection-state and label checks
+per generation and protocol. Each jump still checks the complete current/original
+tuple, links, zone and direction; replies and source NAT keep their exact checks.
+A combined two-endpoint policy with six private rules, five protected prefixes and
+six workload/router grants fits the existing atomic graph limit.
+
+**Upgrading from 1.x:** version 2 changes the compiled identity of schema-v2
+`routerEgress` tables. Retained router tables and their receipts cannot be adopted
+by the new engine, even when the policy digest is unchanged. Fence workload and
+router-local traffic, then use the exact previous engine and retained intent/receipt
+to recover and release each router table. Join that owner before upgrading.
+Prepare and apply the policy with the new engine and persist its complete receipt
+before lifting the traffic fence. Keep lease quarantine and host/pool protection
+throughout; this migration provides no proof of conntrack drainage or safe allocation reuse.
+Do not discard an unresolved retained table or its old engine/receipt. Schema-v1,
+host-transit and allocation-pool-guard compiled identities are unchanged.
+
 The caller must coordinate router and host apply order, retain complete intents
 and receipts, authenticate protected authority, prevent reuse of quarantined
 leases, and qualify other packet owners. An ACCEPT in this table cannot override

package/rust/src/egress.router.rs

@@ -108,13 +108,48 @@ fn raw(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
     }
     program.end("raw_return", vec![], 0)
 }
+fn original_states(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
+    for (index, allocation) in scope.generations.iter().enumerate() {
+        for protocol in ["tcp", "udp"] {
+            if !allocation
+                .grants
+                .iter()
+                .any(|grant| grant.protocol == protocol)
+            {
+                continue;
+            }
+            let chain = format!("original_{index}_{protocol}");
+            program.chain(&chain, None)?;
+            // Only exact tuple/link/zone/direction classifiers jump here. Share
+            // state checks instead of repeating those classifiers three times.
+            for connection_state in [2, 8] {
+                let mut labelled = ct(13, None, label(allocation));
+                labelled.extend(state(connection_state));
+                if connection_state == 8 && protocol == "tcp" {
+                    labelled.extend(opening_tcp());
+                }
+                program.end(&chain, labelled, 1)?;
+            }
+            let mut fresh = state(8);
+            fresh.extend(ct(13, None, vec![0; 16]));
+            if protocol == "tcp" {
+                fresh.extend(opening_tcp());
+            }
+            fresh.extend(set_ct(13, label(allocation)));
+            program.end(&chain, fresh, 1)?;
+            // A failed state/label match returns to the caller's remaining
+            // classifiers and terminal denials, exactly as the inlined rules.
+        }
+    }
+    Ok(())
+}
 fn grants(
     program: &mut Program<'_>,
     scope: &RouterScope,
     chain: &str,
     platform: bool,
 ) -> Result<()> {
-    for allocation in &scope.generations {
+    for (index, allocation) in scope.generations.iter().enumerate() {
         for grant in &allocation.grants {
             if matches!(grant.destination, Destination::Platform { .. }) != platform {
                 continue;
@@ -126,24 +161,13 @@ fn grants(
             if chain != "input" {
                 let mut original = filter(scope, grant, false)?;
                 original.extend(generation(allocation, 0, false));
-                // Both original directions are checked for every packet; a
-                // label alone never authorizes a changed grant or endpoint.
-                for connection_state in [2, 8] {
-                    let mut labelled = original.clone();
-                    labelled.extend(ct(13, None, label(allocation)));
-                    labelled.extend(state(connection_state));
-                    if connection_state == 8 && grant.protocol == "tcp" {
-                        labelled.extend(opening_tcp());
-                    }
-                    program.end(chain, labelled, 1)?;
-                }
-                original.extend(state(8));
-                original.extend(ct(13, None, vec![0; 16]));
-                if grant.protocol == "tcp" {
-                    original.extend(opening_tcp());
-                }
-                original.extend(set_ct(13, label(allocation)));
-                program.end(chain, original, 1)?;
+                // Current and original tuples remain checked on every packet;
+                // a label alone never authorizes a changed grant or endpoint.
+                program.jump(
+                    chain,
+                    original,
+                    &format!("original_{index}_{}", grant.protocol),
+                )?;
             }
             if chain != "output" {
                 let mut reply = filter(scope, grant, true)?;
@@ -182,6 +206,7 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &RouterScope, revision:
             program.rule(&name, expressions)?;
         }
     }
+    original_states(program, scope)?;
     raw(program, scope)?;
     protected(program, "protected_out", scope, false)?;
     protected(program, "protected_back", scope, true)?;

package/rust/src/egress_tests.rs

@@ -297,6 +297,74 @@ fn prepared_v2_compiles_both_scopes_with_bounded_and_identifiable_graphs() {
     }
 }
 
+/// A combined workload/router policy must fit without discarding private DNS,
+/// either public transport, explicit platform grants, or the protected union.
+pub(crate) fn combined_router_capacity() -> Value {
+    let mut value = router();
+    value["scope"]["protection"]["prefixes"] = json!([
+        "10.0.0.0/8",
+        "127.0.0.0/8",
+        "169.254.0.0/16",
+        "172.16.0.0/12",
+        "192.0.2.0/24"
+    ]);
+    value["scope"]["protection"]["platformEndpoints"] = json!([
+        {"id":"dns-udp","address":"192.0.2.1","protocol":"udp","port":53},
+        {"id":"dns-tcp","address":"192.0.2.1","protocol":"tcp","port":53},
+        {"id":"relay","address":"192.0.2.3","protocol":"tcp","port":3000}
+    ]);
+    let rules = value["scope"]["rules"].as_array_mut().unwrap();
+    rules[0]["protocol"] = json!("any");
+    rules[0]["destinationPort"] = Value::Null;
+    let mut reverse = rules[0].clone();
+    reverse["sourceEndpoint"] = json!("vpn");
+    reverse["destinationEndpoint"] = json!("work");
+    reverse["sourcePrefix"] = json!("10.242.0.2/32");
+    reverse["destinationPrefix"] = json!("10.241.0.2/32");
+    for index in [1, 2] {
+        let mut dns = rules[index].clone();
+        dns["protocol"] = json!("tcp");
+        rules.push(dns);
+    }
+    rules.push(reverse);
+    value["scope"]["generations"][0]["grants"] = json!([
+        {"sourceEndpoint":"work","sourcePrefix":"10.241.0.2/32","destination":{"kind":"public","prefix":"0.0.0.0/0"},
+            "protocol":"tcp","sourcePort":null,"destinationPort":null,"sourcePortRange":{"first":10000,"last":10999}},
+        {"sourceEndpoint":"work","sourcePrefix":"10.241.0.2/32","destination":{"kind":"public","prefix":"0.0.0.0/0"},
+            "protocol":"udp","sourcePort":null,"destinationPort":null,"sourcePortRange":{"first":10000,"last":10999}},
+        {"sourceEndpoint":"work","sourcePrefix":"10.241.0.2/32","destination":{"kind":"platform","endpointId":"relay"},
+            "protocol":"tcp","sourcePort":null,"destinationPort":3000,"sourcePortRange":{"first":10000,"last":10999}},
+        {"sourceEndpoint":null,"sourcePrefix":"10.240.0.2/32","destination":{"kind":"platform","endpointId":"dns-tcp"},
+            "protocol":"tcp","sourcePort":null,"destinationPort":53,"sourcePortRange":{"first":10000,"last":10999}},
+        {"sourceEndpoint":null,"sourcePrefix":"10.240.0.2/32","destination":{"kind":"platform","endpointId":"dns-udp"},
+            "protocol":"udp","sourcePort":null,"destinationPort":53,"sourcePortRange":{"first":10000,"last":10999}},
+        {"sourceEndpoint":null,"sourcePrefix":"10.240.0.2/32","destination":{"kind":"platform","endpointId":"relay"},
+            "protocol":"tcp","sourcePort":null,"destinationPort":3000,"sourcePortRange":{"first":10000,"last":10999}}
+    ]);
+    value
+}
+
+#[test]
+fn combined_router_full_transports_and_protection_fit_atomic_reserve() {
+    let mut value = combined_router_capacity();
+    value["revision"] = json!(9007199254740991_u64);
+    let policy = normalized(value).unwrap();
+    let prepared = policy.prepare().unwrap();
+    let program = prepared
+        .program(&format!("snft_{}", "x".repeat(59)))
+        .unwrap();
+    let bytes: usize = program
+        .iter()
+        .map(|(_, attributes)| crate::wire::encode_attrs(attributes).len() + 20)
+        .sum();
+    assert!(program.len() <= 768);
+    assert!(bytes <= 100_000);
+    println!(
+        "COMBINED_ROUTER_GRAPH operations={} bytes={bytes}",
+        program.len()
+    );
+}
+
 #[test]
 fn v2_compiled_graph_limit_rejects_bounded_but_excessive_cross_products() {
     let mut value = router();

package/rust/src/owner_egress_tests.rs

@@ -42,7 +42,7 @@ fn router() -> egress::Policy {
     veth("handoff", "10.240.0.2/30");
     ip(&["tuntap", "add", "dev", "vpn", "mode", "tun"]);
     ip(&["address", "add", "10.242.0.1/24", "dev", "vpn"]);
-    let mut value = egress::tests::router();
+    let mut value = egress::tests::combined_router_capacity();
     value["scope"]["links"] = json!([
         binding("work", "10.241.0.1", "veth"),
         binding("vpn", "10.242.0.1", "tun")

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartnftables',
-  version: '1.9.0',
+  version: '2.0.0',
   description: 'A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.'
 }