@push.rocks/smartnftables 2.2.0 → 2.3.0

package/changelog.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 2026-09-16 - 2.3.0
+
+### Features
+
+- Add optional managed published host ports to the schema-v2 `hostTransit` scope: inbound uplink destination NAT plus its exact forward and reply admissions are compiled, applied, replaced and released with the generation. Absent and empty publications keep the previous canonical policy, digest and compiled bytes.
+
 ## 2026-09-15 - 2.2.0
 
 ### Features

package/dist_rust/smartnftables_linux_amd64_musl.tsrust-build.json

@@ -1,12 +1,12 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "d997150e9cde38e1ba2c93c5b894c367f9b562a31291ee568ccd1e4a54034b61",
+  "binarySha256": "a05a20217727664aff94f0dfeeba5215ba8cfdfc3958f962da8384e229b11df3",
   "buildInfo": {
     "projectName": "@push.rocks/smartnftables",
-    "projectVersion": "2.2.0",
-    "gitCommit": "32e9f40066053a15f32031e796e3151140e98eca",
+    "projectVersion": "2.3.0",
+    "gitCommit": "47dfc97a139c73ecbcb17b86382878153a58189f",
     "gitDirty": false,
-    "builtAt": "2026-09-15T06:33:44.972Z",
+    "builtAt": "2026-09-16T07:45:32.264Z",
     "tsrustVersion": "1.13.0",
     "binary": "smartnftables",
     "target": "linux_amd64_musl"

package/dist_rust/smartnftables_linux_arm64_musl.tsrust-build.json

@@ -1,12 +1,12 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "14a625bdb893667872dad6b339aa77f64c6d7e538158bff3e4b92e5684d70e61",
+  "binarySha256": "c322c2f4444cd6c980453ff7ddab76dfb39f1c0b149ff7401f4d184f491c3d01",
   "buildInfo": {
     "projectName": "@push.rocks/smartnftables",
-    "projectVersion": "2.2.0",
-    "gitCommit": "32e9f40066053a15f32031e796e3151140e98eca",
+    "projectVersion": "2.3.0",
+    "gitCommit": "47dfc97a139c73ecbcb17b86382878153a58189f",
     "gitDirty": false,
-    "builtAt": "2026-09-15T06:33:49.548Z",
+    "builtAt": "2026-09-16T07:45:32.403Z",
     "tsrustVersion": "1.13.0",
     "binary": "smartnftables",
     "target": "linux_arm64_musl"

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@push.rocks/smartnftables',
-    version: '2.2.0',
+    version: '2.3.0',
     description: 'A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSwyQkFBMkI7SUFDakMsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLG1IQUFtSDtDQUNqSSxDQUFBIn0=

package/dist_ts/managed.egress.types.d.ts

@@ -72,6 +72,17 @@ export interface IManagedNftRouterEgressScopeV2 {
     /** Empty retains private/local enforcement while denying external egress. */
     generations: IManagedNftEgressGenerationV2[];
 }
+/** One inbound uplink publication, compiled inside the same host-transit generation. */
+export interface IManagedNftPublishedPortV2 {
+    protocol: 'tcp' | 'udp';
+    /** Published uplink port, 1–65535 and unique per protocol across the scope. */
+    hostPort: number;
+    targetPort: number;
+    /** Exact leased transit source address of one current allocation; it selects the handoff. */
+    targetAddress: string;
+    /** Exact current uplink address that publishes this port. No wildcard or route inference. */
+    hostIp: string;
+}
 /** Shared-host capture barrier and explicit outer SNAT; Docker forwarding remains a separate owner. */
 export interface IManagedNftHostTransitScopeV2 {
     kind: 'hostTransit';
@@ -83,6 +94,11 @@ export interface IManagedNftHostTransitScopeV2 {
     uplink: IManagedNftLocalLinkV2;
     /** Exact current address present on uplink. No masquerade or default-route inference. */
     snatAddress: string;
+    /** Optional inbound destination NAT. Absent and empty are the same canonical policy and
+     * keep the compiled graph unchanged. Every entry compiles its own uplink DNAT plus the
+     * exact forward and reply admission in this generation, so a failed apply, a target
+     * without it, or release removes it with the generation. */
+    publishedPorts?: IManagedNftPublishedPortV2[];
 }
 /** Host-wide IPv4 destination denial for caller-authenticated private allocation pools.
  * This has no link dependency or allow grants. It is not allocation-release or boot-order proof. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartnftables",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "private": false,
   "description": "A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.",
   "main": "dist_ts/index.js",
@@ -9,11 +9,11 @@
   "author": "Task Venture Capital GmbH",
   "license": "MIT",
   "devDependencies": {
-    "@git.zone/cli": "6.13.2",
+    "@git.zone/cli": "6.14.0",
     "@git.zone/tsbuild": "^4.4.3",
     "@git.zone/tsrun": "^2.0.6",
     "@git.zone/tsrust": "1.13.0",
-    "@git.zone/tstest": "6.0.0",
+    "@git.zone/tstest": "6.1.0",
     "@types/node": "26.5.0",
     "typescript": "^7.0.2"
   },

package/readme.md

@@ -265,7 +265,7 @@ allocation-pool guard policy kinds.
 | V2 scope | Required authority and behavior |
 | --- | --- |
 | `routerEgress` | Private `endpoints` and `rules`, one exact `links` binding per endpoint, a separate veth `handoff`, `protection`, and active `generations`. Private veth/TUN/local DNS and egress share one table so terminal private denial cannot override a separate egress table. |
-| `hostTransit` | Exact handoff `link`/`allocations` pairs, complete `protection`, an explicit veth or Ethernet `uplink`, and its current `snatAddress`. It checks each handoff's leased source address and protocol/port range, default conntrack zone, direction, uplink, and protected destinations before outer SNAT. |
+| `hostTransit` | Exact handoff `link`/`allocations` pairs, complete `protection`, an explicit veth or Ethernet `uplink`, and its current `snatAddress`. It checks each handoff's leased source address and protocol/port range, default conntrack zone, direction, uplink, and protected destinations before outer SNAT. Optional `publishedPorts` add inbound uplink destination NAT inside the same generation. |
 | `allocationPoolGuard` | An authenticated `authorityDigest` and complete current allocation-pool `prefixes`. Installs host-wide IPv4 destination denial before any handoff exists, without link, uplink or SNAT dependencies. |
 
 `allocationPoolGuard` accepts 1–64 canonical, disjoint RFC1918 prefixes. Supply
@@ -313,6 +313,42 @@ so foreign DNAT cannot turn a protected destination into a public exception or
 redirect public traffic into protected space. INPUT diversion, local OUTPUT into
 handoffs, unmatched handoff traffic and IPv6 forwarding are denied.
 
+#### Published host ports
+
+`hostTransit.publishedPorts` is optional. Absent and empty are the same canonical
+policy, so an unpublished scope keeps its exact previous digest and compiled bytes.
+Each entry is `{ protocol, hostPort, targetPort, targetAddress, hostIp }`. `hostIp`
+must be an exact current uplink address, which rtnetlink verifies at apply, recovery
+and inspection; there is no wildcard, secondary-link or default-route inference.
+`targetAddress` must be a current leased `transitSourceAddress` of one allocation,
+and that binding is what selects the handoff link of the admission; an address that
+no active lease holds, a local host address or a bare workload prefix rejects. Ports
+are 1–65535, one `protocol`/`hostPort` is published exactly once across the scope
+including across uplink addresses, and a port published on the `snatAddress` may not
+fall inside any leased outbound source-port range of the same protocol, because outer
+SNAT translates to that same address.
+
+A publication compiles inside the generation: one destination NAT rule in this
+table's own prerouting `nat` chain at priority -100, plus three forward admissions
+placed ahead of the capture barrier — original direction NEW and ESTABLISHED, with
+opening TCP restricted to SYN with FIN/RST/ACK clear, and the ESTABLISHED reply.
+Every admission checks both links, the conntrack protocol, the default zone, the
+direction, the translated current address/port and the original conntrack
+destination, so foreign NAT cannot borrow the exception for another flow. Published
+traffic is not source-translated, so the workload observes the actual client address.
+The chain, its translation and its admissions are created, replaced and deleted with
+the generation: a target without the entry, a failed batch, or release removes them,
+and a caller never needs a separate teardown.
+
+Input bounds are 64 entries, but the atomic graph reserve binds first. A publication
+costs four operations and about 6,000 bytes, so roughly a dozen fit beside a small
+host-transit graph and `prepare()` rejects an excessive set before any kernel work.
+The caller still owns the route to `targetAddress` through that handoff, the
+workload listener, and every other packet owner on the host. As with leased egress,
+an ACCEPT here cannot override Docker's independent FORWARD DROP; the
+`ManagedDockerForwarding` contribution below derives only leased handoff egress from
+the barrier and currently carries no inbound publication.
+
 Each router generation binds an immutable lease reference, transit source address,
 leased TCP/UDP source-port ranges, a nonzero conntrack zone and a 16-byte label.
 Each directed grant selects one exact leased protocol range for SNAT. A grant's
@@ -442,6 +478,11 @@ local TCP, TUN isolation, observed UDP/TCP handoff ranges, range exhaustion,
 fragment reassembly, ECN SYN and invalid opening flags, protected current/original
 DNAT barriers, nonzero foreign zones, local diversion, IPv6 denial, revocation
 and restoration with disjoint generation ranges while old flows remain retained.
+Published host ports are qualified end to end: translated TCP and UDP delivery to the
+leased transit address with the actual client address preserved, reverse translation
+back to the published address, SYN-only opening, denial of non-SYN openings, denial of
+unpublished workload and uplink ports against a pre-policy positive control, and the
+port going dark with the withdrawn and released generation.
 The arm64 binary is cross-built; native packet qualification is currently x86_64.
 Kernel 6.8 is unsupported. No production activation is implied by these tests.
 

package/rust/src/egress.compile.rs

@@ -248,6 +248,26 @@ fn snat(address: &str, range: Option<(u16, u16)>) -> Result<Vec<Attr>> {
     result.push(expr("nat", data));
     Ok(result)
 }
+/// Published inbound translation. Address and port are always both specified, so
+/// the kernel never picks a port and the graph identity carries explicit registers.
+fn dnat(address: &str, port: u16) -> Result<Vec<Attr>> {
+    Ok(vec![
+        immediate(1, super::address(address)?.to_be_bytes().to_vec()),
+        immediate(2, port.to_be_bytes().to_vec()),
+        expr(
+            "nat",
+            vec![
+                Attr::u32(1, 1),
+                Attr::u32(2, 2),
+                Attr::u32(3, 1),
+                Attr::u32(4, 1),
+                Attr::u32(5, 2),
+                Attr::u32(6, 2),
+                Attr::u32(7, 3),
+            ],
+        ),
+    ])
+}
 fn tuple(grant: &Grant, protection: &Protection, reply: bool, original: bool) -> Result<Vec<Attr>> {
     let destination = super::destination(grant, protection)?;
     let mut result = ipv4();

package/rust/src/egress.host.rs

@@ -51,6 +51,69 @@ fn envelope(
     expressions.extend(original_range(range.first, range.last));
     Ok(expressions)
 }
+/// Inbound publication envelope. Both directions check the exact links, the
+/// translated current tuple and the original conntrack destination, so foreign
+/// NAT cannot borrow this admission for another flow.
+fn published_envelope(
+    scope: &HostScope,
+    handoff: &HostHandoff,
+    port: &PublishedPort,
+    reply: bool,
+) -> Result<Vec<Attr>> {
+    let mut expressions = ipv4();
+    expressions.extend(link(&scope.uplink, !reply));
+    expressions.extend(link(&handoff.link, reply));
+    expressions.extend(meta(16, vec![protocol(&port.protocol)]));
+    expressions.extend(ct(10, None, vec![protocol(&port.protocol)]));
+    expressions.extend(ct(17, None, 0_u16.to_ne_bytes().to_vec()));
+    expressions.extend(ct(1, None, vec![u8::from(reply)]));
+    let target = format!("{}/32", port.target_address);
+    expressions.extend(current_address(&target, reply)?);
+    expressions.extend(current_port(port.target_port, reply));
+    let published = format!("{}/32", port.host_ip);
+    expressions.extend(original_address(&published, false)?);
+    expressions.extend(original_port(port.host_port, false));
+    Ok(expressions)
+}
+fn published(program: &mut Program<'_>, scope: &HostScope) -> Result<()> {
+    for port in &scope.published_ports {
+        // Validation admits only leased transit source addresses, and one address
+        // never spans two active handoff links.
+        let handoff = scope
+            .handoffs
+            .iter()
+            .find(|handoff| {
+                handoff
+                    .allocations
+                    .iter()
+                    .any(|allocation| allocation.transit_source_address == port.target_address)
+            })
+            .ok_or(crate::Error::Invalid)?;
+        let original = published_envelope(scope, handoff, port, false)?;
+        for connection_state in [2, 8] {
+            let mut expressions = original.clone();
+            expressions.extend(state(connection_state));
+            if connection_state == 8 && port.protocol == "tcp" {
+                expressions.extend(opening_tcp());
+            }
+            program.end("forward", expressions, 1)?;
+        }
+        let mut reply = published_envelope(scope, handoff, port, true)?;
+        reply.extend(state(2));
+        program.end("forward", reply, 1)?;
+        let mut translation = ipv4();
+        translation.extend(link(&scope.uplink, true));
+        translation.extend(meta(16, vec![protocol(&port.protocol)]));
+        translation.extend(ct(10, None, vec![protocol(&port.protocol)]));
+        translation.extend(ct(17, None, 0_u16.to_ne_bytes().to_vec()));
+        translation.extend(ct(1, None, vec![0]));
+        translation.extend(current_address(&format!("{}/32", port.host_ip), false)?);
+        translation.extend(current_port(port.host_port, false));
+        translation.extend(dnat(&port.target_address, port.target_port)?);
+        program.rule("pre", translation)?;
+    }
+    Ok(())
+}
 pub(super) fn compile(program: &mut Program<'_>, scope: &HostScope) -> Result<()> {
     // Filtering runs after destination NAT. Docker has independent filter hooks.
     // This table cannot override another owner's DROP; Docker contribution and
@@ -63,11 +126,21 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &HostScope) -> Result<()
     ] {
         program.chain(name, Some((hook, priority, kind)))?;
     }
+    if !scope.published_ports.is_empty() {
+        // Published destination NAT lives in this table's own prerouting chain, so
+        // it is created, replaced and deleted with the exact generation. An empty
+        // publication list keeps the previous chain set and compiled bytes.
+        program.chain("pre", Some((0, -100, "nat")))?;
+    }
     for name in ["protected_out", "protected_back"] {
         program.chain(name, None)?;
     }
     protection(program, scope, false)?;
     protection(program, scope, true)?;
+    // Published admission precedes the capture barrier: the barrier denies every
+    // protected original destination, which includes this uplink address, and an
+    // exact inbound publication is the explicit authority for that exception.
+    published(program, scope)?;
     for handoff in &scope.handoffs {
         program.jump("forward", link(&handoff.link, true), "protected_out")?;
         program.jump("forward", link(&handoff.link, false), "protected_back")?;

package/rust/src/egress.rs

@@ -110,6 +110,15 @@ pub struct HostHandoff {
     pub link: LocalLink,
     pub allocations: Vec<Allocation>,
 }
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq, PartialOrd, Ord)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct PublishedPort {
+    pub protocol: String,
+    pub host_port: u16,
+    pub target_port: u16,
+    pub target_address: String,
+    pub host_ip: String,
+}
 #[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct HostScope {
@@ -117,6 +126,10 @@ pub struct HostScope {
     pub handoffs: Vec<HostHandoff>,
     pub uplink: LocalLink,
     pub snat_address: String,
+    /// Absent and empty are the same canonical policy, so an unpublished scope
+    /// keeps its exact previous digest and compiled graph.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub published_ports: Vec<PublishedPort>,
 }
 #[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
@@ -556,6 +569,53 @@ fn normalize_pool_guard(value: &mut AllocationPoolGuardScope) -> Result<()> {
     }
     Ok(())
 }
+/// Inbound publication is bounded by the same authority the scope already proves:
+/// an exact current uplink address, an exact leased transit source address, and no
+/// overlap with the leased outbound source ports translated to that same address.
+fn normalize_published(value: &mut HostScope) -> Result<()> {
+    let mut ports = std::mem::take(&mut value.published_ports);
+    require(ports.len() <= 64)?;
+    ports.sort();
+    for (index, port) in ports.iter().enumerate() {
+        require(
+            protocol(&port.protocol)
+                && port.host_port > 0
+                && port.target_port > 0
+                && (index == 0
+                    || ports[index - 1].protocol != port.protocol
+                    || ports[index - 1].host_port != port.host_port),
+        )?;
+        // rtnetlink verifies this exact uplink address at apply, recovery and
+        // inspection. No wildcard, secondary-link or default-route inference.
+        require(value.uplink.required_ipv4_addresses.contains(&port.host_ip))?;
+        // Only a current leased transit source address can be published; that
+        // binding is what proves the exact handoff link of the forward admission.
+        require(
+            value
+                .handoffs
+                .iter()
+                .flat_map(|handoff| handoff.allocations.iter())
+                .any(|allocation| allocation.transit_source_address == port.target_address),
+        )?;
+        if port.host_ip == value.snat_address {
+            for handoff in &value.handoffs {
+                for allocation in &handoff.allocations {
+                    for range in &allocation.source_port_ranges {
+                        // Outer SNAT translates to this same address, so a published
+                        // port inside a leased outbound range is a translation conflict.
+                        require(
+                            range.protocol != port.protocol
+                                || port.host_port < range.first
+                                || port.host_port > range.last,
+                        )?;
+                    }
+                }
+            }
+        }
+    }
+    value.published_ports = ports;
+    Ok(())
+}
 fn normalize_host(value: &mut HostScope) -> Result<()> {
     normalize_protection(&mut value.protection)?;
     normalize_link(&mut value.uplink)?;
@@ -622,6 +682,7 @@ fn normalize_host(value: &mut HostScope) -> Result<()> {
             }
         }
     }
+    normalize_published(value)?;
     unique_links(
         value
             .handoffs

package/rust/src/egress_tests.rs

@@ -1,4 +1,4 @@
-use super::{Policy, Scope};
+use super::{Policy, Prepared, Scope};
 use serde_json::{json, Value};
 
 fn link(index: u32, name: &str, kind: &str, address: &str) -> Value {
@@ -483,3 +483,196 @@ fn allocation_pool_guard_maximum_fits_the_atomic_graph_without_link_bindings() {
     let excessive: Vec<_> = (0..65).map(|part| format!("10.{part}.0.0/16")).collect();
     assert!(normalized(changed(pool_guard(), "/scope/prefixes", json!(excessive))).is_err());
 }
+
+pub(crate) fn published_port(protocol: &str, host_port: u16, target_port: u16) -> Value {
+    json!({"protocol":protocol,"hostPort":host_port,"targetPort":target_port,
+        "targetAddress":"10.240.0.2","hostIp":"192.0.2.2"})
+}
+pub(crate) fn published_host(ports: Value) -> Value {
+    let mut value = host();
+    value["scope"]["publishedPorts"] = ports;
+    value
+}
+fn prepared(value: Value) -> Prepared {
+    normalized(value).unwrap().prepare().unwrap()
+}
+fn program_bytes(prepared: &Prepared, table: &str) -> Vec<u8> {
+    let mut bytes = Vec::new();
+    for (kind, attributes) in prepared.program(table).unwrap() {
+        let encoded = crate::wire::encode_attrs(&attributes);
+        bytes.extend(kind.to_be_bytes());
+        bytes.extend((encoded.len() as u32).to_be_bytes());
+        bytes.extend(encoded);
+    }
+    bytes
+}
+/// Chain names in creation order, then every rule as (chain, expression names).
+fn graph(prepared: &Prepared, table: &str) -> (Vec<String>, Vec<(String, Vec<String>)>) {
+    let mut chains = Vec::new();
+    let mut rules = Vec::new();
+    for (kind, attributes) in prepared.program(table).unwrap() {
+        assert_eq!(crate::wire::text(&attributes, 1).unwrap(), table);
+        if kind == 3 {
+            chains.push(crate::wire::text(&attributes, 3).unwrap());
+            continue;
+        }
+        let expressions = crate::wire::attrs(&crate::wire::one(&attributes, 4).unwrap().value).unwrap();
+        rules.push((
+            crate::wire::text(&attributes, 2).unwrap(),
+            expressions
+                .iter()
+                .map(|expression| {
+                    let fields = crate::wire::attrs(&expression.value).unwrap();
+                    crate::wire::text(&fields, 1).unwrap()
+                })
+                .collect(),
+        ));
+    }
+    (chains, rules)
+}
+
+#[test]
+fn host_v2_without_published_ports_keeps_its_exact_digest_and_compiled_bytes() {
+    use sha2::{Digest, Sha256};
+    let baseline = prepared(host());
+    // Frozen before the optional publication field existed.
+    assert_eq!(
+        baseline.digest,
+        "sha256:b24cd2bc4e812014cabd71a77f57a2fe085c4b83d4e7b7939ccfca28949c6848"
+    );
+    let bytes = program_bytes(&baseline, "snft_v2_host_golden");
+    assert_eq!(bytes.len(), 24932);
+    assert_eq!(
+        format!("{:x}", Sha256::digest(&bytes)),
+        "91735de50a831184648bf79cd7a840f7af5264f3c6ec461f5412b3fc1d1ef6ec"
+    );
+    let serialized = serde_json::to_string(&baseline.policy).unwrap();
+    assert!(!serialized.contains("publishedPorts"));
+    // An explicit empty publication is the same canonical policy, digest and graph.
+    assert_eq!(prepared(published_host(json!([]))), baseline);
+    let (chains, rules) = graph(&baseline, "snft_v2_host_golden");
+    assert!(!chains.contains(&"pre".to_string()));
+    assert!(rules.iter().all(|(chain, _)| chain != "pre"));
+}
+
+#[test]
+fn host_v2_published_ports_compile_uplink_dnat_and_exact_forward_admission() {
+    use sha2::{Digest, Sha256};
+    let baseline = graph(&prepared(host()), "snft_v2_host_golden");
+    let value = published_host(json!([
+        published_port("tcp", 443, 8443),
+        published_port("udp", 8125, 8125)
+    ]));
+    let published = prepared(value.clone());
+    assert_ne!(published.digest, prepared(host()).digest);
+    // Publication order is canonical, so a reordered list is the same policy.
+    let mut reordered = value;
+    reordered["scope"]["publishedPorts"]
+        .as_array_mut()
+        .unwrap()
+        .reverse();
+    assert_eq!(prepared(reordered), published);
+    let (chains, rules) = graph(&published, "snft_v2_host_golden");
+    assert_eq!(chains.len(), baseline.0.len() + 1);
+    assert_eq!(chains.iter().filter(|name| *name == "pre").count(), 1);
+    assert_eq!(rules.len(), baseline.1.len() + 8);
+    let translations: Vec<_> = rules.iter().filter(|(chain, _)| chain == "pre").collect();
+    assert_eq!(translations.len(), 2);
+    for (_, expressions) in &translations {
+        assert_eq!(expressions.last().unwrap(), "nat");
+        assert_eq!(expressions.iter().filter(|name| *name == "immediate").count(), 2);
+    }
+    // The three admissions precede the capture barrier jumps of their handoff.
+    let forward: Vec<_> = rules
+        .iter()
+        .filter(|(chain, _)| chain == "forward")
+        .map(|(_, expressions)| expressions.len())
+        .collect();
+    assert_eq!(forward.len(), baseline.1.iter().filter(|(chain, _)| chain == "forward").count() + 6);
+    let (_, first) = rules.iter().find(|(chain, _)| chain == "forward").unwrap();
+    assert!(first.contains(&"ct".to_string()) && first.len() > 4);
+    let bytes = program_bytes(&published, "snft_v2_host_golden");
+    assert_eq!(bytes.len(), 36322);
+    assert_eq!(
+        format!("{:x}", Sha256::digest(&bytes)),
+        "1d3485bb739ac3601642610eba465b80c9b5ac34df22a5374cfbc8773623710b"
+    );
+}
+
+#[test]
+fn host_v2_published_ports_are_owned_by_their_generation_and_leave_with_it() {
+    let published = prepared(published_host(json!([published_port("tcp", 443, 8443)])));
+    let rollback = prepared(host());
+    let (chains, rules) = graph(&published, "snft_v2_host_rollback");
+    assert!(chains.contains(&"pre".to_string()));
+    assert_eq!(rules.iter().filter(|(chain, _)| chain == "pre").count(), 1);
+    // Every operation names the owned table, and the rollback target compiles the
+    // same graph as before publication; reconcile deletes the complete previous
+    // graph and re-adds the target in one batch, so the publication cannot survive.
+    let (rollback_chains, rollback_rules) = graph(&rollback, "snft_v2_host_rollback");
+    assert!(!rollback_chains.contains(&"pre".to_string()));
+    assert!(rollback_rules.iter().all(|(chain, _)| chain != "pre"));
+    assert_eq!(rollback_chains.len() + 1, chains.len());
+    assert_eq!(rollback_rules.len() + 4, rules.len());
+    assert_ne!(published.digest, rollback.digest);
+}
+
+#[test]
+fn host_v2_published_ports_reject_unbound_targets_conflicts_and_out_of_range_ports() {
+    assert!(normalized(published_host(json!([published_port("tcp", 443, 8443)]))).is_ok());
+    let mut unknown = published_port("tcp", 443, 8443);
+    unknown["hostInterface"] = json!("ens18");
+    let mut second_address = published_host(json!([
+        changed(published_port("tcp", 443, 8443), "/hostIp", json!("192.0.2.5"))
+    ]));
+    second_address["scope"]["uplink"]["requiredIpv4Addresses"] = json!(["192.0.2.2", "192.0.2.5"]);
+    let mut duplicate_across_addresses = second_address.clone();
+    duplicate_across_addresses["scope"]["publishedPorts"]
+        .as_array_mut()
+        .unwrap()
+        .push(published_port("tcp", 443, 9443));
+    assert!(normalized(second_address).is_ok());
+    for invalid in [
+        published_host(json!([unknown])),
+        published_host(json!([published_port("sctp", 443, 8443)])),
+        published_host(json!([published_port("tcp", 0, 8443)])),
+        published_host(json!([published_port("tcp", 443, 0)])),
+        published_host(json!([changed(published_port("tcp", 443, 8443), "/hostPort", json!(65536))])),
+        published_host(json!([changed(published_port("tcp", 443, 8443), "/targetPort", json!(65536))])),
+        published_host(json!([changed(published_port("tcp", 443, 8443), "/hostPort", json!(-1))])),
+        // The published address must be an exact current uplink address.
+        published_host(json!([changed(published_port("tcp", 443, 8443), "/hostIp", json!("192.0.2.5"))])),
+        published_host(json!([changed(published_port("tcp", 443, 8443), "/hostIp", json!("10.240.0.1"))])),
+        // The target must be a current leased transit source address.
+        published_host(json!([changed(published_port("tcp", 443, 8443), "/targetAddress", json!("10.240.0.3"))])),
+        published_host(json!([changed(published_port("tcp", 443, 8443), "/targetAddress", json!("10.240.0.1"))])),
+        published_host(json!([changed(published_port("tcp", 443, 8443), "/targetAddress", json!("192.0.2.2"))])),
+        // A published port cannot collide with the leased outbound SNAT ranges.
+        published_host(json!([published_port("tcp", 10500, 8443)])),
+        published_host(json!([published_port("udp", 10000, 8443)])),
+        // One protocol/port is published exactly once, including across addresses.
+        published_host(json!([published_port("tcp", 443, 8443), published_port("tcp", 443, 9443)])),
+        duplicate_across_addresses,
+        published_host(json!((0..65).map(|index| published_port("tcp", 20000 + index, 8443)).collect::<Vec<_>>())),
+    ] {
+        assert!(normalized(invalid).is_err());
+    }
+    // Bounded input still meets the atomic reserve first: every publication costs
+    // one translation and three admissions, so prepare rejects before any kernel work.
+    let ports = |count: u16| -> Value {
+        json!((0..count)
+            .map(|index| published_port("tcp", 20000 + index, 8443))
+            .collect::<Vec<_>>())
+    };
+    let prepared = prepared(published_host(ports(12)));
+    let program = prepared
+        .program(&format!("snft_{}", "x".repeat(59)))
+        .unwrap();
+    let bytes: usize = program
+        .iter()
+        .map(|(_, attributes)| crate::wire::encode_attrs(attributes).len() + 20)
+        .sum();
+    assert!(program.len() <= 768 && bytes <= 100_000);
+    assert!(normalized(published_host(ports(13))).unwrap().prepare().is_err());
+    println!("PUBLISHED_MAX ports=12 operations={} bytes={bytes}", program.len());
+}

package/rust/src/owner_host_traffic_tests.rs

@@ -1,7 +1,10 @@
 use super::egress_traffic_tests::{connect, denied, host_policy, ns_ip, roundtrip, socket};
 use super::*;
+use crate::egress;
 use crate::policy::{compare, expr, meta};
-use std::net::UdpSocket;
+use std::io::{Read, Write};
+use std::net::{TcpListener, TcpStream, UdpSocket};
+use std::time::Duration;
 
 const SOURCE: &str = "hs_source";
 const HOST: &str = "hs_host";
@@ -297,3 +300,223 @@ fn v2_host_rejects_foreign_dnat_zone_local_diversion_and_ipv6() {
     });
     println!("V2_HOST_PROOF original_protected_dnat_denied=true current_protected_dnat_denied=true nonzero_zone_denied=true input_diversion_denied=true output_spoof_denied=true ipv6_forward_denied=true unleased_port_denied=true exact_platform_allowed=true positive_controls=true");
 }
+
+const PUBLISH_SOURCE: &str = "hp_source";
+const PUBLISH_HOST: &str = "hp_host";
+const PUBLISH_PEER: &str = "hp_peer";
+
+fn chain_names(owner: &mut Owner) -> Vec<String> {
+    owner
+        .graph()
+        .unwrap()
+        .expect("owned table present")
+        .chains
+        .iter()
+        .map(|chain| wire::text(chain, 3).unwrap())
+        .collect()
+}
+/// Inbound publication through the uplink: the workload must observe the actual
+/// client address, and the client must observe the published address back.
+fn published_udp(client: &UdpSocket, workload: &UdpSocket, published: &str, client_address: &str) {
+    let mut bytes = [0; 64];
+    assert_eq!(client.send_to(b"query", published).unwrap(), 5);
+    let (size, observed) = workload.recv_from(&mut bytes).expect("published delivery");
+    assert_eq!(&bytes[..size], b"query");
+    assert_eq!(observed.to_string(), client_address);
+    assert_eq!(workload.send_to(b"reply", observed).unwrap(), 5);
+    let (size, from) = client.recv_from(&mut bytes).expect("published reply");
+    assert_eq!(&bytes[..size], b"reply");
+    assert_eq!(from.to_string(), published);
+}
+fn dark_udp(client: &UdpSocket, workload: &UdpSocket, published: &str) {
+    assert_eq!(client.send_to(b"query", published).unwrap(), 5);
+    assert!(workload.recv(&mut [0; 64]).is_err());
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn v2_host_publishes_exact_uplink_ports_and_removes_them_with_the_generation() {
+    isolated();
+    for name in [PUBLISH_SOURCE, PUBLISH_HOST, PUBLISH_PEER] {
+        ip(&["netns", "add", name]);
+        ns_ip(name, &["link", "set", "lo", "up"]);
+        in_namespace(name, || {
+            std::fs::write("/proc/sys/net/ipv4/ip_forward", "1").unwrap()
+        });
+    }
+    connect(
+        PUBLISH_SOURCE,
+        "source",
+        "10.240.0.2/30",
+        PUBLISH_HOST,
+        "router",
+        "10.240.0.1/30",
+    );
+    connect(
+        PUBLISH_HOST,
+        "uplink",
+        "192.0.2.2/24",
+        PUBLISH_PEER,
+        "underlay",
+        "192.0.2.3/24",
+    );
+    ns_ip(PUBLISH_SOURCE, &["route", "add", "default", "via", "10.240.0.1"]);
+    ns_ip(PUBLISH_PEER, &["route", "add", "default", "via", "192.0.2.2"]);
+    let workload_udp = socket(PUBLISH_SOURCE, "10.240.0.2:8125");
+    let workload_direct = socket(PUBLISH_SOURCE, "10.240.0.2:8444");
+    let workload_unpublished = socket(PUBLISH_SOURCE, "10.240.0.2:9999");
+    // Every probe uses its own client port: an unreplied conntrack entry would
+    // otherwise carry its null translation across the policy change.
+    let control_client = socket(PUBLISH_PEER, "192.0.2.3:40010");
+    let client_udp = socket(PUBLISH_PEER, "192.0.2.3:40000");
+    // Positive controls: without policy the workload is reachable directly, and
+    // the published address is not, so every later result is caused by the policy.
+    control(&control_client, "10.240.0.2:8444", &workload_direct, true);
+    dark_udp(
+        &socket(PUBLISH_PEER, "192.0.2.3:40011"),
+        &workload_udp,
+        "192.0.2.2:8125",
+    );
+    let (owner, applied, published_policy, names) = in_namespace(PUBLISH_HOST, || {
+        let mut policy = host_policy();
+        let egress::Scope::HostTransit(scope) = &mut policy.scope else {
+            panic!()
+        };
+        scope.published_ports = vec![
+            egress::PublishedPort {
+                protocol: "tcp".into(),
+                host_port: 443,
+                target_port: 8443,
+                target_address: "10.240.0.2".into(),
+                host_ip: "192.0.2.2".into(),
+            },
+            egress::PublishedPort {
+                protocol: "udp".into(),
+                host_port: 8125,
+                target_port: 8125,
+                target_address: "10.240.0.2".into(),
+                host_ip: "192.0.2.2".into(),
+            },
+        ];
+        let mut owner = Owner::new(options("host_published")).unwrap();
+        let target: Prepared = policy.clone().prepare().unwrap().into();
+        target
+            .validate_interfaces()
+            .expect("published host fixture binding");
+        let applied = owner
+            .reconcile(Transition {
+                previous: None,
+                target,
+            })
+            .unwrap();
+        assert!(owner.inspect().enforced);
+        let names = chain_names(&mut owner);
+        (owner, applied, policy, names)
+    });
+    assert!(names.contains(&"pre".to_string()));
+    // The fixture observes ingress only, so the translated opening is read where
+    // it arrives: the workload side of the handoff.
+    let observer = in_namespace(PUBLISH_SOURCE, || packet_fixture::PacketSocket::open("source"));
+    published_udp(&client_udp, &workload_udp, "192.0.2.2:8125", "192.0.2.3:40000");
+    let listener = in_namespace(PUBLISH_SOURCE, || {
+        TcpListener::bind("10.240.0.2:8443").unwrap()
+    });
+    let mut client = in_namespace(PUBLISH_PEER, || {
+        TcpStream::connect_timeout(&"192.0.2.2:443".parse().unwrap(), Duration::from_secs(1))
+            .expect("published tcp opening")
+    });
+    let (mut server, peer) = listener.accept().unwrap();
+    assert_eq!(peer.ip().to_string(), "192.0.2.3");
+    assert_eq!(client.peer_addr().unwrap().to_string(), "192.0.2.2:443");
+    for stream in [&client, &server] {
+        stream.set_read_timeout(Some(Duration::from_secs(1))).unwrap();
+    }
+    client.write_all(b"ping").unwrap();
+    server.read_exact(&mut [0; 4]).unwrap();
+    server.write_all(b"pong").unwrap();
+    client.read_exact(&mut [0; 4]).unwrap();
+    // The translated opening is observable on the handoff, with the actual client
+    // address preserved and SYN only.
+    let syn = observer
+        .matching(|packet| {
+            packet.len() >= 40
+                && packet[9] == 6
+                && packet[16..20] == [10, 240, 0, 2]
+                && packet[22..24] == 8443_u16.to_be_bytes()
+                && packet[33] & 0x17 == 0x02
+        })
+        .expect("translated opening on the handoff");
+    assert_eq!(syn[12..16], [192, 0, 2, 3]);
+    // An opening that is not SYN cannot acquire the publication.
+    let injector = in_namespace(PUBLISH_PEER, || {
+        packet_fixture::PacketSocket::open("underlay")
+    });
+    let uplink_mac = in_namespace(PUBLISH_HOST, || packet_fixture::mac("uplink"));
+    for (port, flags) in [(40050_u16, 0x10_u8), (40051, 0x04), (40052, 0x12)] {
+        injector.send(
+            uplink_mac,
+            &packet_fixture::tcp([192, 0, 2, 3], [192, 0, 2, 2], port, 443, flags),
+        );
+        // The exact injected flow, never the live connection's own acknowledgements.
+        assert!(
+            observer
+                .matching(|packet| packet.len() >= 40
+                    && packet[9] == 6
+                    && packet[16..20] == [10, 240, 0, 2]
+                    && packet[20..22] == port.to_be_bytes()
+                    && packet[22..24] == 8443_u16.to_be_bytes()
+                    && packet[24..28] == 100_u32.to_be_bytes()
+                    && packet[33] == flags)
+                .is_none(),
+            "{flags:#04x}"
+        );
+    }
+    // The capture barrier still denies every unpublished path to the workload.
+    control(&control_client, "10.240.0.2:8444", &workload_direct, false);
+    let unpublished_client = socket(PUBLISH_PEER, "192.0.2.3:40002");
+    dark_udp(&unpublished_client, &workload_unpublished, "192.0.2.2:9999");
+    assert!(in_namespace(PUBLISH_PEER, || TcpStream::connect_timeout(
+        &"192.0.2.2:444".parse().unwrap(),
+        Duration::from_secs(1)
+    ))
+    .is_err());
+    drop(client);
+    drop(server);
+    // Withdrawing the publication is an ordinary generation replacement.
+    let (mut owner, rolled_back, names) = in_namespace(PUBLISH_HOST, {
+        let mut owner = owner;
+        move || {
+            let mut withdrawn = published_policy;
+            withdrawn.revision = 2;
+            let egress::Scope::HostTransit(scope) = &mut withdrawn.scope else {
+                panic!()
+            };
+            scope.published_ports.clear();
+            let applied = owner
+                .reconcile(Transition {
+                    previous: Some(applied),
+                    target: withdrawn.prepare().unwrap().into(),
+                })
+                .unwrap();
+            assert!(owner.inspect().enforced);
+            let names = chain_names(&mut owner);
+            (owner, applied, names)
+        }
+    });
+    assert!(!names.contains(&"pre".to_string()));
+    let dark_client = socket(PUBLISH_PEER, "192.0.2.3:40003");
+    dark_udp(&dark_client, &workload_udp, "192.0.2.2:8125");
+    assert!(in_namespace(PUBLISH_PEER, || TcpStream::connect_timeout(
+        &"192.0.2.2:443".parse().unwrap(),
+        Duration::from_secs(1)
+    ))
+    .is_err());
+    control(&control_client, "10.240.0.2:8444", &workload_direct, false);
+    in_namespace(PUBLISH_HOST, move || {
+        assert!(owner.inspect().enforced);
+        owner.release(rolled_back).unwrap();
+    });
+    let released_client = socket(PUBLISH_PEER, "192.0.2.3:40004");
+    dark_udp(&released_client, &workload_udp, "192.0.2.2:8125");
+    println!("V2_HOST_PUBLISHED_PROOF udp_published_delivered=true tcp_published_delivered=true client_address_preserved=true reverse_translation=true syn_only_opening=true nonsyn_opening_denied=true unpublished_workload_port_denied=true unpublished_uplink_port_denied=true barrier_positive_control=true withdrawn_chain_absent=true withdrawn_port_dark=true released_port_dark=true");
+}

package/rust/src/owner_identity_tests.rs

@@ -167,3 +167,40 @@ fn egress_identity_rejects_unknown_duplicate_or_incomplete_operands() {
         assert!(rule_identity(&rule(vec![expression(name, extra)])).is_err());
     }
 }
+
+/// A published host-transit generation must survive the same apply-time graph
+/// identity as the rest of the table: the kernel dump is compared operand by
+/// operand, so destination NAT and its admissions cannot be silently rewritten.
+#[test]
+fn published_host_graph_identity_preserves_destination_nat_and_admission_operands() {
+    let compiled = |target_port: u16| {
+        let value = crate::egress::tests::published_host(serde_json::json!([
+            crate::egress::tests::published_port("tcp", 443, target_port)
+        ]));
+        let prepared = serde_json::from_value::<crate::egress::Policy>(value)
+            .unwrap()
+            .prepare()
+            .unwrap();
+        let mut chains = Vec::new();
+        let mut rules = Vec::new();
+        for (kind, attributes) in prepared.program("snft_identity").unwrap() {
+            if kind == 3 {
+                chains.push(super::chain_identity(&attributes).unwrap());
+            } else {
+                rules.push(rule_identity(&attributes).unwrap());
+            }
+        }
+        (chains, rules)
+    };
+    let (chains, rules) = compiled(8443);
+    assert_eq!(rules.iter().filter(|(chain, _)| chain == "pre").count(), 1);
+    assert_eq!(chains.len(), 7);
+    let translation = rules.iter().find(|(chain, _)| chain == "pre").unwrap();
+    let (_, changed) = compiled(9443);
+    let other = changed.iter().find(|(chain, _)| chain == "pre").unwrap();
+    assert_ne!(translation.1, other.1);
+    assert_eq!(
+        rules.iter().filter(|(chain, _)| chain == "forward").count(),
+        changed.iter().filter(|(chain, _)| chain == "forward").count()
+    );
+}

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartnftables',
-  version: '2.2.0',
+  version: '2.3.0',
   description: 'A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.'
 }

package/ts/managed.egress.types.ts

@@ -68,6 +68,18 @@ export interface IManagedNftRouterEgressScopeV2 {
   generations: IManagedNftEgressGenerationV2[];
 }
 
+/** One inbound uplink publication, compiled inside the same host-transit generation. */
+export interface IManagedNftPublishedPortV2 {
+  protocol: 'tcp' | 'udp';
+  /** Published uplink port, 1–65535 and unique per protocol across the scope. */
+  hostPort: number;
+  targetPort: number;
+  /** Exact leased transit source address of one current allocation; it selects the handoff. */
+  targetAddress: string;
+  /** Exact current uplink address that publishes this port. No wildcard or route inference. */
+  hostIp: string;
+}
+
 /** Shared-host capture barrier and explicit outer SNAT; Docker forwarding remains a separate owner. */
 export interface IManagedNftHostTransitScopeV2 {
   kind: 'hostTransit';
@@ -76,6 +88,11 @@ export interface IManagedNftHostTransitScopeV2 {
   uplink: IManagedNftLocalLinkV2;
   /** Exact current address present on uplink. No masquerade or default-route inference. */
   snatAddress: string;
+  /** Optional inbound destination NAT. Absent and empty are the same canonical policy and
+   * keep the compiled graph unchanged. Every entry compiles its own uplink DNAT plus the
+   * exact forward and reply admission in this generation, so a failed apply, a target
+   * without it, or release removes it with the generation. */
+  publishedPorts?: IManagedNftPublishedPortV2[];
 }
 
 /** Host-wide IPv4 destination denial for caller-authenticated private allocation pools.