@push.rocks/smartnftables 2.4.0 → 2.5.0

package/rust/src/owner_tests.rs

@@ -27,6 +27,9 @@ mod router_traffic_tests;
 #[path = "owner_poolguard_tests.rs"]
 mod poolguard_tests;
 
+#[path = "owner_hostgrant_traffic_tests.rs"]
+mod hostgrant_traffic_tests;
+
 #[path = "owner_detach_tests.rs"]
 mod detach_tests;
 

package/rust/src/policy.rs

@@ -195,7 +195,7 @@ impl Policy {
         };
         // Compile during preparation; an oversized native batch never reaches the kernel.
         let program = prepared.program(&format!("snft_{}", "x".repeat(59)))?;
-        // Reserve enough of the 240 KiB batch for deleting a previous maximum
+        // Reserve enough of the batch for deleting a previous maximum
         // graph, then installing this complete graph in the same transaction.
         if program.len() > 768
             || program

package/rust/src/wire.rs

@@ -24,6 +24,10 @@ impl Attr {
     pub fn nested(kind: u16, value: Vec<Attr>) -> Self {
         Self::bytes(kind | 0x8000, encode_attrs(&value))
     }
+    /// Netlink attribute lengths are 16 bits; a longer value cannot be encoded.
+    pub fn encodable(&self) -> bool {
+        self.value.len() <= usize::from(u16::MAX) - 4
+    }
     pub fn id(&self) -> u16 {
         self.kind & 0x3fff
     }
@@ -31,6 +35,9 @@ impl Attr {
 pub fn encode_attrs(attrs: &[Attr]) -> Vec<u8> {
     let mut result = Vec::new();
     for attr in attrs {
+        // Every caller bounds its attributes far below this; a truncated length
+        // would make the kernel parse a different message.
+        assert!(attr.encodable(), "netlink attribute exceeds 65,531 bytes");
         let len = 4 + attr.value.len();
         result.extend((len as u16).to_ne_bytes());
         result.extend(attr.kind.to_ne_bytes());
@@ -117,6 +124,13 @@ struct Message {
     sequence: u32,
     payload: Vec<u8>,
 }
+/// One replacement batch: handle-only deletion of a previous maximum graph
+/// (768 operations, about 96 KB), a 100,000-byte target rule graph and 100,000
+/// bytes of target set elements, with framing. Netlink refuses a message larger
+/// than the socket send buffer; Linux's default `net.core.wmem_max` of 212,992
+/// gives a 425,984-byte buffer, and this limit needs at least 160,016.
+pub const BATCH_BYTES: usize = 320_000;
+
 pub struct Socket {
     fd: OwnedFd,
     pub port: u32,
@@ -213,7 +227,7 @@ impl Socket {
         Ok((sequence, bytes))
     }
     fn send(&self, bytes: &[u8]) -> Result<()> {
-        if bytes.len() > 240_000 {
+        if bytes.len() > BATCH_BYTES {
             return Err(Error::Invalid);
         }
         let mut address: libc::sockaddr_nl = unsafe { std::mem::zeroed() };

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartnftables',
-  version: '2.4.0',
+  version: '2.5.0',
   description: 'A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.'
 }

package/ts/classes.manageddockerforwarding.ts

@@ -1,5 +1,5 @@
 import * as plugins from './plugins.js';
-import { snapshot, ManagedNftablesError } from './classes.managednftables.js';
+import { snapshot, managedIpcBytes, ManagedNftablesError } from './classes.managednftables.js';
 import type { IManagedDockerForwardingOptions, IManagedDockerForwardingStatus, IManagedDockerForwardingPolicy, IPreparedManagedDockerForwardingPolicy, IManagedDockerForwardingTransition, IAppliedManagedDockerForwardingPolicy, TManagedDockerForwardingCommands } from './managed.docker.types.js';
 
 /** One node-level Docker DOCKER-USER contribution. Caller owns durable intents and handoff lifetimes. */
@@ -39,7 +39,7 @@ export class ManagedDockerForwarding {
         localPaths: [], searchSystemPath: false,
         cliArgs: ['--docker-forwarding', ...(this.#options.networkNamespaceFd === undefined ? [] : ['--network-namespace-fd', '3'])],
         inheritedFileDescriptors: this.#options.networkNamespaceFd === undefined ? undefined : [this.#options.networkNamespaceFd],
-        readyTimeoutMs: 3000, requestTimeoutMs: 30_000, maxPayloadSize: 262_144,
+        readyTimeoutMs: 3000, requestTimeoutMs: 30_000, maxPayloadSize: managedIpcBytes,
         maxPendingRequestsByMethod: { prepareDockerForwarding: 1, openDockerForwarding: 1, reconcileDockerForwarding: 1, inspectDockerForwarding: 1, releaseDockerForwarding: 1, closeDockerForwarding: 1 },
       });
       this.#bridge.on('exit', () => {

package/ts/classes.managednftables.ts

@@ -6,16 +6,24 @@ export class ManagedNftablesError extends Error {
   constructor(public readonly code: string) { super(`Managed nftables ${code}.`); }
 }
 
+/** Bounds of the private native IPC. A status carries up to three complete policies (applied,
+ * pending previous and pending target); a policy with the maximum 1024 host grants serializes to
+ * about 111 KB and 5,300 values, so these bounds hold three of them with room for the rest of a
+ * large scope. */
+export const managedIpcBytes = 1_048_576;
+const snapshotBytes = 1_000_000;
+const snapshotValues = 65_536;
+
 /** Capture inert input without evaluating getters, proxies, coercions or toJSON. */
 export function snapshot<T>(input: T): T {
   let count = 0;
   let stringBytes = 0;
   const string = (value: string): string => {
-    if (value.length > 240_000 || (stringBytes += Buffer.byteLength(value)) > 240_000) throw new ManagedNftablesError('INVALID');
+    if (value.length > snapshotBytes || (stringBytes += Buffer.byteLength(value)) > snapshotBytes) throw new ManagedNftablesError('INVALID');
     return value;
   };
   const copy = (value: unknown, depth: number): unknown => {
-    if (++count > 16_384 || depth > 20) throw new ManagedNftablesError('INVALID');
+    if (++count > snapshotValues || depth > 20) throw new ManagedNftablesError('INVALID');
     if (typeof value === 'string') return string(value);
     if (value === null || typeof value === 'boolean') return value;
     if (typeof value === 'number' && Number.isSafeInteger(value)) return value;
@@ -23,7 +31,7 @@ export function snapshot<T>(input: T): T {
     const array = Array.isArray(value);
     if (Object.getPrototypeOf(value) !== (array ? Array.prototype : Object.prototype)) throw new ManagedNftablesError('INVALID');
     const keys = Reflect.ownKeys(value);
-    if (keys.length > 16_384 - count) throw new ManagedNftablesError('INVALID');
+    if (keys.length > snapshotValues - count) throw new ManagedNftablesError('INVALID');
     for (const key of keys) if (typeof key === 'string') string(key);
     const descriptors = Object.getOwnPropertyDescriptors(value);
     const result: Record<string, unknown> | unknown[] = array ? [] : {};
@@ -38,7 +46,7 @@ export function snapshot<T>(input: T): T {
     return result;
   };
   const result = copy(input, 0) as T;
-  if (Buffer.byteLength(JSON.stringify(result)) > 240_000) throw new ManagedNftablesError('INVALID');
+  if (Buffer.byteLength(JSON.stringify(result)) > snapshotBytes) throw new ManagedNftablesError('INVALID');
   return result;
 }
 
@@ -97,7 +105,7 @@ export class ManagedNftables<TPolicy extends TManagedNftPolicy = IManagedNftPoli
         localPaths: [], searchSystemPath: false,
         cliArgs: ['--management', ...(this.#options.networkNamespaceFd === undefined ? [] : ['--network-namespace-fd', '3'])],
         inheritedFileDescriptors: this.#options.networkNamespaceFd === undefined ? undefined : [this.#options.networkNamespaceFd],
-        readyTimeoutMs: 3000, requestTimeoutMs: 30_000, maxPayloadSize: 262_144,
+        readyTimeoutMs: 3000, requestTimeoutMs: 30_000, maxPayloadSize: managedIpcBytes,
         maxPendingRequestsByMethod: { preparePolicy: 1, openOwner: 1, reconcilePolicy: 1, inspectPolicy: 1, releasePolicy: 1, releasePolicyTransition: 1, detachPolicy: 1, closeOwner: 1 },
       });
       this.#bridge.on('exit', () => {

package/ts/managed.egress.types.ts

@@ -72,6 +72,22 @@ export interface IManagedNftRouterPublishedPortV2 {
   transitSourceAddress: string;
 }
 
+/** One exact host-origin flow: the node's own host network namespace dials one port of one local
+ * workload at its lease address, from the transit host address of the current handoff. Compile the
+ * same grant into every scope the flow crosses (`allocationPoolGuard` and `hostTransit` on the host,
+ * `routerEgress` in the router namespace); each scope binds it to the authority it proves. It admits
+ * that tuple and its replies in the default conntrack zone and nothing else: no loopback, no
+ * translation, no source-port selection and no workload-origin flow. */
+export interface IManagedNftHostGrant {
+  protocol: 'tcp' | 'udp';
+  /** Exact unicast address, never a prefix: the host's own address on the handoff. */
+  sourceAddress: string;
+  /** Exact unicast workload lease address, never a prefix. */
+  destinationAddress: string;
+  /** The workload's exact listening port, 1–65535; never a range. */
+  destinationPort: number;
+}
+
 /** One combined private/TUN/local/egress table; never compose a second ACCEPT over v1 terminal drops. */
 export interface IManagedNftRouterEgressScopeV2 {
   kind: 'routerEgress';
@@ -89,6 +105,12 @@ export interface IManagedNftRouterEgressScopeV2 {
    * forward and reply admission in this generation, so a failed apply, a target
    * without it, or release removes it with the generation. */
   publishedPorts?: IManagedNftRouterPublishedPortV2[];
+  /** Optional host-origin grants forwarded from the handoff to a workload endpoint. Each
+   * `destinationAddress` is an exact current veth endpoint address of this scope; each
+   * `sourceAddress` is protected space that is neither router-local, a platform endpoint nor a
+   * workload. Absent and empty are the same canonical policy, digest and compiled graph; at most 1024,
+   * held in a named set behind a constant number of rules. */
+  hostGrants?: IManagedNftHostGrant[];
 }
 
 /** One inbound uplink publication, compiled inside the same host-transit generation. */
@@ -116,15 +138,24 @@ export interface IManagedNftHostTransitScopeV2 {
    * exact forward and reply admission in this generation, so a failed apply, a target
    * without it, or release removes it with the generation. */
   publishedPorts?: IManagedNftPublishedPortV2[];
+  /** Optional host-origin grants leaving through a handoff. Each `sourceAddress` is an exact current
+   * address of exactly one handoff link; each `destinationAddress` is protected space that is neither
+   * host-local, a platform endpoint nor a leased transit source address. Absent and empty are the
+   * same canonical policy; at most 1024, held in a named set behind a constant number of rules. */
+  hostGrants?: IManagedNftHostGrant[];
 }
 
 /** Host-wide IPv4 destination denial for caller-authenticated private allocation pools.
- * This has no link dependency or allow grants. It is not allocation-release or boot-order proof. */
+ * It has no link dependency; exact host grants are its only exceptions. It is not allocation-release or boot-order proof. */
 export interface IManagedNftAllocationPoolGuardScopeV2 {
   kind: 'allocationPoolGuard';
   authorityDigest: string;
   /** Complete current pool list: 1–64 canonical, disjoint RFC1918 prefixes. */
   prefixes: string[];
+  /** The only exceptions to the guard: exact host-origin flows whose `destinationAddress` lies in a
+   * listed pool, and their replies. Absent and empty are the same canonical policy; at most 1024,
+   * held in a named set behind a constant number of rules. */
+  hostGrants?: IManagedNftHostGrant[];
 }
 
 export interface IManagedNftPolicyV2 {