@push.rocks/smartnftables 2.5.1 → 2.6.0

package/changelog.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 2026-09-25 - 2.6.0
+
+### Features
+
+- Add optional loopback TCP port owners to the schema-v2 `allocationPoolGuard` scope: `localTcpPortOwners` entries `{ address, port, uid }` (an exact IPv4 loopback host address, one port and one owning uid, at most 8) compile, ahead of the guard, an OUTPUT rule that rejects with a TCP reset every packet to that address and port from a socket whose uid differs (`meta skuid != uid`, after ordinary output destination NAT) and an INPUT rule that drops the address and port arriving on any interface but loopback. Owner verification now admits the TCP-reset `reject` expression and reads it back like every other operand, so the entries are verified on apply, retained, adopted, recovered and released with the table. Absent and empty keep the previous canonical policy, digest and compiled bytes. The native qualification guest loads the `nf_reject_ipv4`, `nf_reject_ipv6`, `nft_reject` and `nft_reject_inet` modules.
+- Add optional host-local platform endpoints to the schema-v2 `hostTransit` scope: `localPlatformEndpoints` lists ids of `protection.platformEndpoints` the host serves on an exact address of its uplink or a handoff link (verified through rtnetlink at apply, recovery and inspection). INPUT admits leased flows from their exact handoff with the lease's transit source address and a source port in its range for the endpoint's protocol, to the exact endpoint tuple in the live and originally tracked tuple (NEW with a SYN-only TCP opening, or ESTABLISHED), and OUTPUT admits only the ESTABLISHED reply; translated flows and host-origin openings stay denied. The refusal of a platform endpoint on a host address is lifted only for declared ids. Absent and empty keep the previous canonical policy, digest and compiled bytes.
+- Add optional stateful one-way workload grants to the schema-v2 `routerEgress` scope: `workloadGrants` entries `{ protocol, sourceAddress, destinationAddress, destinationPort }` let one veth workload endpoint open one exact port of another. Four constant FORWARD admissions look up the incoming and outgoing link with their addresses in a CONSTANT `workload_link` set and the protocols with the live and originally tracked tuple in a CONSTANT `workload_grant` set, in the default conntrack zone; the destination only answers (ESTABLISHED replies) and can never open toward the source. Up to 1024 grants, sharing the scope's set element budget with host grants. Absent and empty keep the previous canonical policy, digest and compiled bytes.
+
+### Maintenance
+
+- Bring the release-time tooling current: `@git.zone/tsrust` 1.14.0 → 1.15.0. `@types/node` stays 26.6.1 and pnpm 12.4.2, because their newer releases are younger than the seven-day rule; `@git.zone/cli` 7.2.2, tsbuild 5.0.0, tsrun 3.0.0 and tstest 6.2.0 are already current. The native notices verify unchanged.
+
+## 2026-09-24 - 2.5.2
+
+### Maintenance
+
+- Generate `native-notices/` with `tsrust notices` (configured under `@git.zone/tsrust` `notices` in `.smartconfig.json`) and let the tsrust build verify it before compiling, replacing the hand-maintained `scripts/check-native-notices.mjs`, which is removed from the build script and the published files. The regenerated bundle keeps the 21 crate notice directories byte-for-byte, adds memchr 2.8.3's `unlicense` (the crate is `Unlicense OR MIT`), and moves the standard-library and C runtime texts from `rust-standard-library/` into `rust/` and `runtime/`, adding the GCC runtime library exception texts and the license files of the standard-library dependencies the toolchain inventory omits.
+- Pin the Rust toolchain the notices record, 1.95.0 with the `x86_64-unknown-linux-musl` and `aarch64-unknown-linux-musl` targets and the `rust-src` component, in `rust-toolchain.toml`.
+
 ## 2026-09-24 - 2.5.1
 
 ### Maintenance

package/dist_rust/smartnftables_linux_amd64_musl.tsrust-build.json

@@ -1,13 +1,13 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "65bf4c0e1cd00c97f8d6bb6b62a01ca17e53427cf9eed5a5a9dc9ebfa30a6dce",
+  "binarySha256": "8b0883d60ba14c1971ce50bd7ec45ea4cbb8a79c292e9063166fed168779dd52",
   "buildInfo": {
     "projectName": "@push.rocks/smartnftables",
-    "projectVersion": "2.5.1",
-    "gitCommit": "208ed8fa30ead1d8fa21e68762d46f2cb0880ce5",
+    "projectVersion": "2.6.0",
+    "gitCommit": "8032aac9d7b1b78650f0947574e5aab783b2d5db",
     "gitDirty": false,
-    "builtAt": "2026-09-24T22:46:20.095Z",
-    "tsrustVersion": "1.14.0",
+    "builtAt": "2026-09-25T13:42:00.180Z",
+    "tsrustVersion": "1.15.0",
     "binary": "smartnftables",
     "target": "linux_amd64_musl"
   }

package/dist_rust/smartnftables_linux_arm64_musl.tsrust-build.json

@@ -1,13 +1,13 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "7ab374c54305be2c86e19ae67e1a0ce172ae2a61ae6dc020b7de8a8561abd1a0",
+  "binarySha256": "86d2a679f4f1968b9ae9e0a3681572f5c4a6dc913993747abf5422f3adf4916b",
   "buildInfo": {
     "projectName": "@push.rocks/smartnftables",
-    "projectVersion": "2.5.1",
-    "gitCommit": "208ed8fa30ead1d8fa21e68762d46f2cb0880ce5",
+    "projectVersion": "2.6.0",
+    "gitCommit": "8032aac9d7b1b78650f0947574e5aab783b2d5db",
     "gitDirty": false,
-    "builtAt": "2026-09-24T22:46:29.605Z",
-    "tsrustVersion": "1.14.0",
+    "builtAt": "2026-09-25T13:42:10.633Z",
+    "tsrustVersion": "1.15.0",
     "binary": "smartnftables",
     "target": "linux_arm64_musl"
   }

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@push.rocks/smartnftables',
-    version: '2.5.1',
+    version: '2.6.0',
     description: 'A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSwyQkFBMkI7SUFDakMsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLG1IQUFtSDtDQUNqSSxDQUFBIn0=

package/dist_ts/managed.egress.types.d.ts

@@ -91,6 +91,21 @@ export interface IManagedNftHostGrant {
     /** The workload's exact listening port, 1–65535; never a range. */
     destinationPort: number;
 }
+/** One stateful one-way flow between two workloads behind the same router: the source workload opens
+ * connections to one exact port of the destination workload, which may only answer. Both addresses are
+ * exact current addresses of two different veth workload endpoints of the scope. It admits the tuple
+ * (a TCP opening only with SYN) and its ESTABLISHED replies in the default conntrack zone and nothing
+ * else: no reverse opening, no translation and no source-port selection. Grant the reverse direction as
+ * a second grant. */
+export interface IManagedNftWorkloadGrant {
+    protocol: 'tcp' | 'udp';
+    /** Exact unicast address of the dialling workload endpoint, never a prefix. */
+    sourceAddress: string;
+    /** Exact unicast address of the dialled workload endpoint, never a prefix. */
+    destinationAddress: string;
+    /** The destination workload's exact listening port, 1–65535; never a range. */
+    destinationPort: number;
+}
 /** One combined private/TUN/local/egress table; never compose a second ACCEPT over v1 terminal drops. */
 export interface IManagedNftRouterEgressScopeV2 {
     kind: 'routerEgress';
@@ -114,6 +129,10 @@ export interface IManagedNftRouterEgressScopeV2 {
      * workload. Absent and empty are the same canonical policy, digest and compiled graph; at most 1024,
      * held in a named set behind a constant number of rules. */
     hostGrants?: IManagedNftHostGrant[];
+    /** Optional stateful one-way workload-to-workload grants. Absent and empty are the same canonical
+     * policy, digest and compiled graph; at most 1024, held in two named sets behind four rules. They
+     * share the scope's set element budget with `hostGrants`. */
+    workloadGrants?: IManagedNftWorkloadGrant[];
 }
 /** One inbound uplink publication, compiled inside the same host-transit generation. */
 export interface IManagedNftPublishedPortV2 {
@@ -147,6 +166,27 @@ export interface IManagedNftHostTransitScopeV2 {
      * host-local, a platform endpoint nor a leased transit source address. Absent and empty are the
      * same canonical policy; at most 1024, held in a named set behind a constant number of rules. */
     hostGrants?: IManagedNftHostGrant[];
+    /** Optional ids of `protection.platformEndpoints` this host serves itself, on an exact current address
+     * of the uplink or of a handoff link (rtnetlink verifies it at apply, recovery and inspection). Only a
+     * declared endpoint may hold a host address. Leased flows reach it from their exact handoff with the
+     * leased source address and a source port of the allocation's range for the endpoint's protocol; its
+     * ESTABLISHED replies return. Absent and empty are the same canonical policy, digest and compiled graph. */
+    localPlatformEndpoints?: string[];
+}
+/** One loopback TCP service that only one local user may dial. Every packet the host sends to the
+ * exact address and port from a socket of any other user is rejected with a TCP reset, after ordinary
+ * output destination NAT; the address and port arriving on any interface but loopback are dropped.
+ * The service must bind exactly this address: a wildcard listener stays reachable through others. */
+export interface IManagedNftLocalTcpPortOwner {
+    /** Exact IPv4 loopback host address in 127.0.0.0/8, e.g. `127.0.0.1`. Never a prefix or wildcard. */
+    address: string;
+    /** The service's exact listening port, 1–65535; never a range. */
+    port: number;
+    /** The only user id whose sockets may send to the port: the socket file's file-system uid as
+     * the user namespace owning the network namespace sees it, 0–4294967294. Packets without a socket file carry no uid and
+     * are not matched: kernel replies, the teardown of an orphaned socket, and in-kernel sockets such as NFS or CIFS clients,
+     * which only privileged mounts create. */
+    uid: number;
 }
 /** Host-wide IPv4 destination denial for caller-authenticated private allocation pools.
  * It has no link dependency; exact host grants are its only exceptions. It is not allocation-release or boot-order proof. */
@@ -159,6 +199,10 @@ export interface IManagedNftAllocationPoolGuardScopeV2 {
      * listed pool, and their replies. Absent and empty are the same canonical policy; at most 1024,
      * held in a named set behind a constant number of rules. */
     hostGrants?: IManagedNftHostGrant[];
+    /** Optional host-wide loopback port ownership, compiled ahead of the guard in the same table.
+     * Absent and empty are the same canonical policy, digest and compiled graph; at most 8, one per
+     * exact address and port. */
+    localTcpPortOwners?: IManagedNftLocalTcpPortOwner[];
 }
 export interface IManagedNftPolicyV2 {
     schemaVersion: 2;

package/native-notices/crates/memchr-2.8.3/unlicense

@@ -0,0 +1,24 @@
+This is free and unencumbered software released into the public domain.
+
+Anyone is free to copy, modify, publish, use, compile, sell, or
+distribute this software, either in source code form or as a compiled
+binary, for any purpose, commercial or non-commercial, and by any
+means.
+
+In jurisdictions that recognize copyright laws, the author or authors
+of this software dedicate any and all copyright interest in the
+software to the public domain. We make this dedication for the benefit
+of the public at large and to the detriment of our heirs and
+successors. We intend this dedication to be an overt act of
+relinquishment in perpetuity of all present and future rights to this
+software under copyright law.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.
+
+For more information, please refer to <http://unlicense.org/>