@push.rocks/smartnftables 2.3.0 → 2.5.0

package/rust/src/owner_router_traffic_tests.rs

@@ -0,0 +1,393 @@
+use super::egress_traffic_tests::{allocation, binding, connect, host_policy, ns_ip, protection};
+use super::egress_traffic_tests::{roundtrip, socket};
+use super::host_traffic_tests::{chain_names, control, dark_udp, published_udp};
+use super::*;
+use crate::egress;
+use serde_json::json;
+use std::io::{Read, Write};
+use std::net::{TcpListener, TcpStream};
+use std::os::fd::FromRawFd;
+use std::time::Duration;
+
+const WORK: &str = "rp_work";
+const ROUTER: &str = "rp_router";
+const HOST: &str = "rp_host";
+const PEER: &str = "rp_peer";
+
+/// One workload veth behind the router, one leased generation, and the inbound
+/// publications of the second hop. The first hop is the host-transit publication.
+fn router_policy(published: bool) -> egress::Policy {
+    let link = binding("work", "10.241.0.1", "veth");
+    let mut generation = allocation();
+    generation["conntrackZone"] = json!(17);
+    generation["conntrackLabel"] = json!("a".repeat(32));
+    // Both leased grants claim the same public address and a destination port a
+    // published client may legitimately use as its source port, so the generation
+    // and the publications compete for the workload's outgoing packets.
+    generation["grants"] = json!([
+        {"sourceEndpoint":"work","sourcePrefix":"10.241.0.2/32","destination":{"kind":"public","prefix":"203.0.113.2/32"},
+            "protocol":"udp","sourcePort":null,"destinationPort":42000,"sourcePortRange":{"first":10000,"last":10015}},
+        {"sourceEndpoint":"work","sourcePrefix":"10.241.0.2/32","destination":{"kind":"public","prefix":"203.0.113.2/32"},
+            "protocol":"tcp","sourcePort":null,"destinationPort":443,"sourcePortRange":{"first":10016,"last":10031}}
+    ]);
+    let ports = if published {
+        json!([
+            {"protocol":"tcp","transitPort":8443,"endpointPort":9443,
+                "endpointAddress":"10.241.0.2","transitSourceAddress":"10.240.0.2"},
+            {"protocol":"udp","transitPort":8125,"endpointPort":9125,
+                "endpointAddress":"10.241.0.2","transitSourceAddress":"10.240.0.2"}
+        ])
+    } else {
+        json!([])
+    };
+    serde_json::from_value(json!({"schemaVersion":2,"revision":1,"scope":{"kind":"routerEgress",
+        "endpoints":[{"id":"work","interfaceIndex":link["interfaceIndex"],"interfaceName":"work",
+            "interfaceKind":"veth","sourcePrefixes":["10.241.0.2/32"]}],
+        "rules":[],"links":[link],"handoff":binding("handoff","10.240.0.2","veth"),
+        "protection":protection(),"generations":[generation],"publishedPorts":ports}}))
+    .unwrap()
+}
+fn sockaddr(value: &str) -> libc::sockaddr_in {
+    let parsed: std::net::SocketAddrV4 = value.parse().unwrap();
+    let mut raw: libc::sockaddr_in = unsafe { std::mem::zeroed() };
+    raw.sin_family = libc::AF_INET as u16;
+    raw.sin_port = parsed.port().to_be();
+    raw.sin_addr.s_addr = u32::from(*parsed.ip()).to_be();
+    raw
+}
+/// A TCP client with an exact source address and port, which std cannot express.
+/// The collision this qualifies is the client's source port, so it must be chosen
+/// and not left to the ephemeral range.
+pub(super) fn connect_from(source: &str, destination: &str) -> std::io::Result<TcpStream> {
+    let raw = unsafe { libc::socket(libc::AF_INET, libc::SOCK_STREAM | libc::SOCK_CLOEXEC, 0) };
+    assert!(raw >= 0, "socket: {}", std::io::Error::last_os_error());
+    let stream = unsafe { TcpStream::from_raw_fd(raw) };
+    let bound = sockaddr(source);
+    assert_eq!(
+        unsafe {
+            libc::bind(
+                raw,
+                (&bound as *const libc::sockaddr_in).cast(),
+                std::mem::size_of_val(&bound) as _,
+            )
+        },
+        0,
+        "bind: {}",
+        std::io::Error::last_os_error()
+    );
+    stream.set_nonblocking(true)?;
+    let target = sockaddr(destination);
+    if unsafe {
+        libc::connect(
+            raw,
+            (&target as *const libc::sockaddr_in).cast(),
+            std::mem::size_of_val(&target) as _,
+        )
+    } != 0
+    {
+        let error = std::io::Error::last_os_error();
+        if error.raw_os_error() != Some(libc::EINPROGRESS) {
+            return Err(error);
+        }
+        let mut waiting = libc::pollfd {
+            fd: raw,
+            events: libc::POLLOUT,
+            revents: 0,
+        };
+        assert!(unsafe { libc::poll(&mut waiting, 1, 1000) } >= 0);
+        let mut code: libc::c_int = 0;
+        let mut size = std::mem::size_of_val(&code) as libc::socklen_t;
+        assert_eq!(
+            unsafe {
+                libc::getsockopt(
+                    raw,
+                    libc::SOL_SOCKET,
+                    libc::SO_ERROR,
+                    (&mut code as *mut libc::c_int).cast(),
+                    &mut size,
+                )
+            },
+            0
+        );
+        if code != 0 || waiting.revents & libc::POLLOUT == 0 {
+            return Err(std::io::Error::from_raw_os_error(if code != 0 {
+                code
+            } else {
+                libc::ETIMEDOUT
+            }));
+        }
+    }
+    stream.set_nonblocking(false)?;
+    Ok(stream)
+}
+/// The host publications of the first hop: two with a router counterpart, and one
+/// whose transit port the router never publishes.
+fn published_host_policy() -> egress::Policy {
+    let mut policy = host_policy();
+    let egress::Scope::HostTransit(scope) = &mut policy.scope else {
+        panic!()
+    };
+    scope.published_ports = [("tcp", 443, 8443), ("udp", 8125, 8125), ("udp", 8126, 8126)]
+        .into_iter()
+        .map(|(protocol, host_port, target_port)| egress::PublishedPort {
+            protocol: protocol.into(),
+            host_port,
+            target_port,
+            target_address: "10.240.0.2".into(),
+            host_ip: "192.0.2.2".into(),
+        })
+        .collect();
+    policy
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn v2_router_publishes_transit_ports_to_the_workload_and_removes_them_with_the_generation() {
+    isolated();
+    for name in [WORK, ROUTER, HOST, PEER] {
+        ip(&["netns", "add", name]);
+        ns_ip(name, &["link", "set", "lo", "up"]);
+        in_namespace(name, || {
+            std::fs::write("/proc/sys/net/ipv4/ip_forward", "1").unwrap()
+        });
+    }
+    connect(
+        WORK,
+        "client",
+        "10.241.0.2/24",
+        ROUTER,
+        "work",
+        "10.241.0.1/24",
+    );
+    connect(
+        ROUTER,
+        "handoff",
+        "10.240.0.2/30",
+        HOST,
+        "router",
+        "10.240.0.1/30",
+    );
+    connect(
+        HOST,
+        "uplink",
+        "192.0.2.2/24",
+        PEER,
+        "underlay",
+        "192.0.2.3/24",
+    );
+    ns_ip(WORK, &["route", "add", "default", "via", "10.241.0.1"]);
+    ns_ip(ROUTER, &["route", "add", "default", "via", "10.240.0.1"]);
+    // The unpublished workload route exists throughout, so every later denial is
+    // caused by policy and not by a missing route.
+    ns_ip(HOST, &["route", "add", "10.241.0.0/24", "via", "10.240.0.2"]);
+    ns_ip(
+        HOST,
+        &["route", "add", "203.0.113.2/32", "via", "192.0.2.3"],
+    );
+    ns_ip(PEER, &["address", "add", "203.0.113.2/32", "dev", "lo"]);
+    ns_ip(PEER, &["route", "add", "default", "via", "192.0.2.2"]);
+    let workload_udp = socket(WORK, "10.241.0.2:9125");
+    let workload_direct = socket(WORK, "10.241.0.2:8444");
+    let workload_unpublished = socket(WORK, "10.241.0.2:9126");
+    let work_egress = socket(WORK, "10.241.0.2:40001");
+    let public = socket(PEER, "203.0.113.2:42000");
+    // Every probe uses its own client port: an unreplied conntrack entry would
+    // otherwise carry its null translation across the policy change.
+    let control_client = socket(PEER, "192.0.2.3:40010");
+    let client_udp = socket(PEER, "192.0.2.3:40000");
+    // Positive controls: without policy both hops forward to the workload, and the
+    // published address is not reachable, so every later result is caused by policy.
+    control(&control_client, "10.241.0.2:8444", &workload_direct, true);
+    dark_udp(
+        &socket(PEER, "192.0.2.3:40011"),
+        &workload_udp,
+        "192.0.2.2:8125",
+    );
+    let (host_owner, host_applied) = in_namespace(HOST, || {
+        let mut owner = Owner::new(options("router_published_host")).unwrap();
+        let target: Prepared = published_host_policy().prepare().unwrap().into();
+        target
+            .validate_interfaces()
+            .expect("published host fixture binding");
+        let applied = owner
+            .reconcile(Transition {
+                previous: None,
+                target,
+            })
+            .unwrap();
+        assert!(owner.inspect().enforced);
+        (owner, applied)
+    });
+    let (router_owner, router_applied, names) = in_namespace(ROUTER, || {
+        let mut owner = Owner::new(options("router_published")).unwrap();
+        let target: Prepared = router_policy(true).prepare().unwrap().into();
+        target
+            .validate_interfaces()
+            .expect("published router fixture binding");
+        let applied = owner
+            .reconcile(Transition {
+                previous: None,
+                target,
+            })
+            .unwrap();
+        assert!(owner.inspect().enforced);
+        let names = chain_names(&mut owner);
+        (owner, applied, names)
+    });
+    assert!(names.contains(&"pre".to_string()));
+    // Two hops of destination NAT deliver UDP to the workload; the workload sees the
+    // actual client and the client sees the published uplink address back.
+    published_udp(
+        &client_udp,
+        &workload_udp,
+        "192.0.2.2:8125",
+        "192.0.2.3:40000",
+    );
+    // The fixture observes ingress only, so the translated opening is read where it
+    // arrives: the workload side of the last veth.
+    let observer = in_namespace(WORK, || packet_fixture::PacketSocket::open("client"));
+    let listener = in_namespace(WORK, || TcpListener::bind("10.241.0.2:9443").unwrap());
+    let mut client = in_namespace(PEER, || {
+        TcpStream::connect_timeout(&"192.0.2.2:443".parse().unwrap(), Duration::from_secs(1))
+            .expect("published tcp opening")
+    });
+    let (mut server, peer) = listener.accept().unwrap();
+    assert_eq!(peer.ip().to_string(), "192.0.2.3");
+    assert_eq!(client.peer_addr().unwrap().to_string(), "192.0.2.2:443");
+    for stream in [&client, &server] {
+        stream.set_read_timeout(Some(Duration::from_secs(1))).unwrap();
+    }
+    client.write_all(b"ping").unwrap();
+    server.read_exact(&mut [0; 4]).unwrap();
+    server.write_all(b"pong").unwrap();
+    client.read_exact(&mut [0; 4]).unwrap();
+    let syn = observer
+        .matching(|packet| {
+            packet.len() >= 40
+                && packet[9] == 6
+                && packet[16..20] == [10, 241, 0, 2]
+                && packet[22..24] == 9443_u16.to_be_bytes()
+                && packet[33] & 0x17 == 0x02
+        })
+        .expect("translated opening at the workload");
+    assert_eq!(syn[12..16], [192, 0, 2, 3]);
+    // Leased egress is unaffected by the publication in the same generation.
+    let outer = roundtrip(&work_egress, &public);
+    assert_eq!(outer.ip().to_string(), "192.0.2.2");
+    assert!((10000..=10015).contains(&outer.port()));
+    // A client whose source port equals a leased grant's destination port on that
+    // grant's public address is the exact collision raw classification must
+    // survive: the workload's published packets carry the same tuple, and raw runs
+    // before conntrack can separate the two flows. The publication must keep its
+    // own translation, so the reply arrives from the published address and port.
+    published_udp(&public, &workload_udp, "192.0.2.2:8125", "203.0.113.2:42000");
+    let mut colliding = in_namespace(PEER, || connect_from("203.0.113.2:443", "192.0.2.2:443"))
+        .expect("published tcp opening from a leased destination port");
+    let (mut served, observed) = listener.accept().unwrap();
+    assert_eq!(observed.to_string(), "203.0.113.2:443");
+    assert_eq!(colliding.peer_addr().unwrap().to_string(), "192.0.2.2:443");
+    for stream in [&colliding, &served] {
+        stream.set_read_timeout(Some(Duration::from_secs(1))).unwrap();
+    }
+    colliding.write_all(b"ping").unwrap();
+    served.read_exact(&mut [0; 4]).unwrap();
+    served.write_all(b"pong").unwrap();
+    colliding.read_exact(&mut [0; 4]).unwrap();
+    drop(colliding);
+    drop(served);
+    // Inject the second hop directly: only SYN with FIN/RST/ACK clear may open the
+    // publication, and an unpublished transit port stays behind the router barrier.
+    let injector = in_namespace(HOST, || packet_fixture::PacketSocket::open("router"));
+    let handoff_mac = in_namespace(ROUTER, || packet_fixture::mac("handoff"));
+    let arrived = |port: u16, flags: u8| {
+        observer
+            .matching(|packet| {
+                packet.len() >= 40
+                    && packet[9] == 6
+                    && packet[16..20] == [10, 241, 0, 2]
+                    && packet[20..22] == port.to_be_bytes()
+                    && packet[22..24] == 9443_u16.to_be_bytes()
+                    && packet[24..28] == 100_u32.to_be_bytes()
+                    && packet[33] == flags
+            })
+            .is_some()
+    };
+    for (port, flags) in [(40050_u16, 0x10_u8), (40051, 0x04), (40052, 0x12)] {
+        injector.send(
+            handoff_mac,
+            &packet_fixture::tcp([192, 0, 2, 3], [10, 240, 0, 2], port, 8443, flags),
+        );
+        assert!(!arrived(port, flags), "{flags:#04x}");
+    }
+    // The same injector opens the publication with an exact SYN, so the denials
+    // above are caused by the opening flags and not by the fixture.
+    injector.send(
+        handoff_mac,
+        &packet_fixture::tcp([192, 0, 2, 3], [10, 240, 0, 2], 40053, 8443, 0x02),
+    );
+    assert!(arrived(40053, 0x02));
+    injector.send(
+        handoff_mac,
+        &packet_fixture::tcp([192, 0, 2, 3], [10, 240, 0, 2], 40054, 9999, 0x02),
+    );
+    assert!(observer
+        .matching(|packet| packet.len() >= 40
+            && packet[9] == 6
+            && packet[20..22] == 40054_u16.to_be_bytes()
+            && packet[24..28] == 100_u32.to_be_bytes())
+        .is_none());
+    // A host publication whose transit port the router never published cannot pass
+    // the router barrier, while the published port beside it keeps working.
+    dark_udp(
+        &socket(PEER, "192.0.2.3:40012"),
+        &workload_unpublished,
+        "192.0.2.2:8126",
+    );
+    control(&control_client, "10.241.0.2:8444", &workload_direct, false);
+    drop(client);
+    drop(server);
+    // Withdrawing the router publication is an ordinary generation replacement. The
+    // host publication stays installed, so this isolates the second hop exactly.
+    let (mut router_owner, rolled_back, names) = in_namespace(ROUTER, {
+        let mut owner = router_owner;
+        move || {
+            let mut withdrawn = router_policy(false);
+            withdrawn.revision = 2;
+            let applied = owner
+                .reconcile(Transition {
+                    previous: Some(router_applied),
+                    target: withdrawn.prepare().unwrap().into(),
+                })
+                .unwrap();
+            assert!(owner.inspect().enforced);
+            let names = chain_names(&mut owner);
+            (owner, applied, names)
+        }
+    });
+    assert!(!names.contains(&"pre".to_string()));
+    dark_udp(
+        &socket(PEER, "192.0.2.3:40003"),
+        &workload_udp,
+        "192.0.2.2:8125",
+    );
+    assert!(in_namespace(PEER, || TcpStream::connect_timeout(
+        &"192.0.2.2:443".parse().unwrap(),
+        Duration::from_secs(1)
+    ))
+    .is_err());
+    in_namespace(ROUTER, move || {
+        assert!(router_owner.inspect().enforced);
+        router_owner.release(rolled_back).unwrap();
+    });
+    dark_udp(
+        &socket(PEER, "192.0.2.3:40004"),
+        &workload_udp,
+        "192.0.2.2:8125",
+    );
+    in_namespace(HOST, move || {
+        let mut owner = host_owner;
+        assert!(owner.inspect().enforced);
+        owner.release(host_applied).unwrap();
+    });
+    println!("V2_ROUTER_PUBLISHED_PROOF two_hop_udp_delivered=true two_hop_tcp_delivered=true client_address_preserved=true reverse_translation_both_hops=true syn_only_opening=true nonsyn_opening_denied=true injector_positive_control=true unpublished_transit_port_denied=true unpublished_workload_port_denied=true leased_egress_unaffected=true leased_destination_port_client_tcp=true leased_destination_port_client_udp=true barrier_positive_control=true withdrawn_chain_absent=true withdrawn_port_dark=true released_port_dark=true");
+}

package/rust/src/owner_tests.rs

@@ -21,9 +21,15 @@ mod packet_fixture;
 #[path = "owner_host_traffic_tests.rs"]
 mod host_traffic_tests;
 
+#[path = "owner_router_traffic_tests.rs"]
+mod router_traffic_tests;
+
 #[path = "owner_poolguard_tests.rs"]
 mod poolguard_tests;
 
+#[path = "owner_hostgrant_traffic_tests.rs"]
+mod hostgrant_traffic_tests;
+
 #[path = "owner_detach_tests.rs"]
 mod detach_tests;
 

package/rust/src/policy.rs

@@ -195,7 +195,7 @@ impl Policy {
         };
         // Compile during preparation; an oversized native batch never reaches the kernel.
         let program = prepared.program(&format!("snft_{}", "x".repeat(59)))?;
-        // Reserve enough of the 240 KiB batch for deleting a previous maximum
+        // Reserve enough of the batch for deleting a previous maximum
         // graph, then installing this complete graph in the same transaction.
         if program.len() > 768
             || program

package/rust/src/wire.rs

@@ -24,6 +24,10 @@ impl Attr {
     pub fn nested(kind: u16, value: Vec<Attr>) -> Self {
         Self::bytes(kind | 0x8000, encode_attrs(&value))
     }
+    /// Netlink attribute lengths are 16 bits; a longer value cannot be encoded.
+    pub fn encodable(&self) -> bool {
+        self.value.len() <= usize::from(u16::MAX) - 4
+    }
     pub fn id(&self) -> u16 {
         self.kind & 0x3fff
     }
@@ -31,6 +35,9 @@ impl Attr {
 pub fn encode_attrs(attrs: &[Attr]) -> Vec<u8> {
     let mut result = Vec::new();
     for attr in attrs {
+        // Every caller bounds its attributes far below this; a truncated length
+        // would make the kernel parse a different message.
+        assert!(attr.encodable(), "netlink attribute exceeds 65,531 bytes");
         let len = 4 + attr.value.len();
         result.extend((len as u16).to_ne_bytes());
         result.extend(attr.kind.to_ne_bytes());
@@ -117,6 +124,13 @@ struct Message {
     sequence: u32,
     payload: Vec<u8>,
 }
+/// One replacement batch: handle-only deletion of a previous maximum graph
+/// (768 operations, about 96 KB), a 100,000-byte target rule graph and 100,000
+/// bytes of target set elements, with framing. Netlink refuses a message larger
+/// than the socket send buffer; Linux's default `net.core.wmem_max` of 212,992
+/// gives a 425,984-byte buffer, and this limit needs at least 160,016.
+pub const BATCH_BYTES: usize = 320_000;
+
 pub struct Socket {
     fd: OwnedFd,
     pub port: u32,
@@ -213,7 +227,7 @@ impl Socket {
         Ok((sequence, bytes))
     }
     fn send(&self, bytes: &[u8]) -> Result<()> {
-        if bytes.len() > 240_000 {
+        if bytes.len() > BATCH_BYTES {
             return Err(Error::Invalid);
         }
         let mut address: libc::sockaddr_nl = unsafe { std::mem::zeroed() };

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartnftables',
-  version: '2.3.0',
+  version: '2.5.0',
   description: 'A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.'
 }

package/ts/classes.manageddockerforwarding.ts

@@ -1,5 +1,5 @@
 import * as plugins from './plugins.js';
-import { snapshot, ManagedNftablesError } from './classes.managednftables.js';
+import { snapshot, managedIpcBytes, ManagedNftablesError } from './classes.managednftables.js';
 import type { IManagedDockerForwardingOptions, IManagedDockerForwardingStatus, IManagedDockerForwardingPolicy, IPreparedManagedDockerForwardingPolicy, IManagedDockerForwardingTransition, IAppliedManagedDockerForwardingPolicy, TManagedDockerForwardingCommands } from './managed.docker.types.js';
 
 /** One node-level Docker DOCKER-USER contribution. Caller owns durable intents and handoff lifetimes. */
@@ -39,7 +39,7 @@ export class ManagedDockerForwarding {
         localPaths: [], searchSystemPath: false,
         cliArgs: ['--docker-forwarding', ...(this.#options.networkNamespaceFd === undefined ? [] : ['--network-namespace-fd', '3'])],
         inheritedFileDescriptors: this.#options.networkNamespaceFd === undefined ? undefined : [this.#options.networkNamespaceFd],
-        readyTimeoutMs: 3000, requestTimeoutMs: 30_000, maxPayloadSize: 262_144,
+        readyTimeoutMs: 3000, requestTimeoutMs: 30_000, maxPayloadSize: managedIpcBytes,
         maxPendingRequestsByMethod: { prepareDockerForwarding: 1, openDockerForwarding: 1, reconcileDockerForwarding: 1, inspectDockerForwarding: 1, releaseDockerForwarding: 1, closeDockerForwarding: 1 },
       });
       this.#bridge.on('exit', () => {

package/ts/classes.managednftables.ts

@@ -6,16 +6,24 @@ export class ManagedNftablesError extends Error {
   constructor(public readonly code: string) { super(`Managed nftables ${code}.`); }
 }
 
+/** Bounds of the private native IPC. A status carries up to three complete policies (applied,
+ * pending previous and pending target); a policy with the maximum 1024 host grants serializes to
+ * about 111 KB and 5,300 values, so these bounds hold three of them with room for the rest of a
+ * large scope. */
+export const managedIpcBytes = 1_048_576;
+const snapshotBytes = 1_000_000;
+const snapshotValues = 65_536;
+
 /** Capture inert input without evaluating getters, proxies, coercions or toJSON. */
 export function snapshot<T>(input: T): T {
   let count = 0;
   let stringBytes = 0;
   const string = (value: string): string => {
-    if (value.length > 240_000 || (stringBytes += Buffer.byteLength(value)) > 240_000) throw new ManagedNftablesError('INVALID');
+    if (value.length > snapshotBytes || (stringBytes += Buffer.byteLength(value)) > snapshotBytes) throw new ManagedNftablesError('INVALID');
     return value;
   };
   const copy = (value: unknown, depth: number): unknown => {
-    if (++count > 16_384 || depth > 20) throw new ManagedNftablesError('INVALID');
+    if (++count > snapshotValues || depth > 20) throw new ManagedNftablesError('INVALID');
     if (typeof value === 'string') return string(value);
     if (value === null || typeof value === 'boolean') return value;
     if (typeof value === 'number' && Number.isSafeInteger(value)) return value;
@@ -23,7 +31,7 @@ export function snapshot<T>(input: T): T {
     const array = Array.isArray(value);
     if (Object.getPrototypeOf(value) !== (array ? Array.prototype : Object.prototype)) throw new ManagedNftablesError('INVALID');
     const keys = Reflect.ownKeys(value);
-    if (keys.length > 16_384 - count) throw new ManagedNftablesError('INVALID');
+    if (keys.length > snapshotValues - count) throw new ManagedNftablesError('INVALID');
     for (const key of keys) if (typeof key === 'string') string(key);
     const descriptors = Object.getOwnPropertyDescriptors(value);
     const result: Record<string, unknown> | unknown[] = array ? [] : {};
@@ -38,7 +46,7 @@ export function snapshot<T>(input: T): T {
     return result;
   };
   const result = copy(input, 0) as T;
-  if (Buffer.byteLength(JSON.stringify(result)) > 240_000) throw new ManagedNftablesError('INVALID');
+  if (Buffer.byteLength(JSON.stringify(result)) > snapshotBytes) throw new ManagedNftablesError('INVALID');
   return result;
 }
 
@@ -97,7 +105,7 @@ export class ManagedNftables<TPolicy extends TManagedNftPolicy = IManagedNftPoli
         localPaths: [], searchSystemPath: false,
         cliArgs: ['--management', ...(this.#options.networkNamespaceFd === undefined ? [] : ['--network-namespace-fd', '3'])],
         inheritedFileDescriptors: this.#options.networkNamespaceFd === undefined ? undefined : [this.#options.networkNamespaceFd],
-        readyTimeoutMs: 3000, requestTimeoutMs: 30_000, maxPayloadSize: 262_144,
+        readyTimeoutMs: 3000, requestTimeoutMs: 30_000, maxPayloadSize: managedIpcBytes,
         maxPendingRequestsByMethod: { preparePolicy: 1, openOwner: 1, reconcilePolicy: 1, inspectPolicy: 1, releasePolicy: 1, releasePolicyTransition: 1, detachPolicy: 1, closeOwner: 1 },
       });
       this.#bridge.on('exit', () => {

package/ts/managed.egress.types.ts

@@ -55,6 +55,39 @@ export interface IManagedNftEgressGenerationV2 extends IManagedNftHandoffAllocat
   grants: IManagedNftEgressGrantV2[];
 }
 
+/** One inbound handoff publication, compiled inside the same router generation.
+ * It is the second hop of a published host port: the host translates to
+ * `transitSourceAddress:transitPort`, this translates on to the workload. */
+export interface IManagedNftRouterPublishedPortV2 {
+  protocol: 'tcp' | 'udp';
+  /** Published handoff port, 1–65535 and unique per protocol across the scope.
+   * It is the `targetPort` of the matching host-transit publication. */
+  transitPort: number;
+  endpointPort: number;
+  /** Exact current workload endpoint address behind one veth endpoint of this
+   * scope. Never a router-local address, a gateway or a platform endpoint. */
+  endpointAddress: string;
+  /** Exact leased transit source address of one current generation, present on
+   * `handoff`. No wildcard, secondary-address or route inference. */
+  transitSourceAddress: string;
+}
+
+/** One exact host-origin flow: the node's own host network namespace dials one port of one local
+ * workload at its lease address, from the transit host address of the current handoff. Compile the
+ * same grant into every scope the flow crosses (`allocationPoolGuard` and `hostTransit` on the host,
+ * `routerEgress` in the router namespace); each scope binds it to the authority it proves. It admits
+ * that tuple and its replies in the default conntrack zone and nothing else: no loopback, no
+ * translation, no source-port selection and no workload-origin flow. */
+export interface IManagedNftHostGrant {
+  protocol: 'tcp' | 'udp';
+  /** Exact unicast address, never a prefix: the host's own address on the handoff. */
+  sourceAddress: string;
+  /** Exact unicast workload lease address, never a prefix. */
+  destinationAddress: string;
+  /** The workload's exact listening port, 1–65535; never a range. */
+  destinationPort: number;
+}
+
 /** One combined private/TUN/local/egress table; never compose a second ACCEPT over v1 terminal drops. */
 export interface IManagedNftRouterEgressScopeV2 {
   kind: 'routerEgress';
@@ -66,6 +99,18 @@ export interface IManagedNftRouterEgressScopeV2 {
   protection: IManagedNftProtectionV2;
   /** Empty retains private/local enforcement while denying external egress. */
   generations: IManagedNftEgressGenerationV2[];
+  /** Optional inbound destination NAT toward a workload endpoint. Absent and empty
+   * are the same canonical policy and keep the compiled graph unchanged. Every entry
+   * compiles its own handoff DNAT, the handoff ingress classification and the exact
+   * forward and reply admission in this generation, so a failed apply, a target
+   * without it, or release removes it with the generation. */
+  publishedPorts?: IManagedNftRouterPublishedPortV2[];
+  /** Optional host-origin grants forwarded from the handoff to a workload endpoint. Each
+   * `destinationAddress` is an exact current veth endpoint address of this scope; each
+   * `sourceAddress` is protected space that is neither router-local, a platform endpoint nor a
+   * workload. Absent and empty are the same canonical policy, digest and compiled graph; at most 1024,
+   * held in a named set behind a constant number of rules. */
+  hostGrants?: IManagedNftHostGrant[];
 }
 
 /** One inbound uplink publication, compiled inside the same host-transit generation. */
@@ -93,15 +138,24 @@ export interface IManagedNftHostTransitScopeV2 {
    * exact forward and reply admission in this generation, so a failed apply, a target
    * without it, or release removes it with the generation. */
   publishedPorts?: IManagedNftPublishedPortV2[];
+  /** Optional host-origin grants leaving through a handoff. Each `sourceAddress` is an exact current
+   * address of exactly one handoff link; each `destinationAddress` is protected space that is neither
+   * host-local, a platform endpoint nor a leased transit source address. Absent and empty are the
+   * same canonical policy; at most 1024, held in a named set behind a constant number of rules. */
+  hostGrants?: IManagedNftHostGrant[];
 }
 
 /** Host-wide IPv4 destination denial for caller-authenticated private allocation pools.
- * This has no link dependency or allow grants. It is not allocation-release or boot-order proof. */
+ * It has no link dependency; exact host grants are its only exceptions. It is not allocation-release or boot-order proof. */
 export interface IManagedNftAllocationPoolGuardScopeV2 {
   kind: 'allocationPoolGuard';
   authorityDigest: string;
   /** Complete current pool list: 1–64 canonical, disjoint RFC1918 prefixes. */
   prefixes: string[];
+  /** The only exceptions to the guard: exact host-origin flows whose `destinationAddress` lies in a
+   * listed pool, and their replies. Absent and empty are the same canonical policy; at most 1024,
+   * held in a named set behind a constant number of rules. */
+  hostGrants?: IManagedNftHostGrant[];
 }
 
 export interface IManagedNftPolicyV2 {