@push.rocks/smartnftables 2.5.2 → 2.6.0

package/changelog.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 2026-09-25 - 2.6.0
+
+### Features
+
+- Add optional loopback TCP port owners to the schema-v2 `allocationPoolGuard` scope: `localTcpPortOwners` entries `{ address, port, uid }` (an exact IPv4 loopback host address, one port and one owning uid, at most 8) compile, ahead of the guard, an OUTPUT rule that rejects with a TCP reset every packet to that address and port from a socket whose uid differs (`meta skuid != uid`, after ordinary output destination NAT) and an INPUT rule that drops the address and port arriving on any interface but loopback. Owner verification now admits the TCP-reset `reject` expression and reads it back like every other operand, so the entries are verified on apply, retained, adopted, recovered and released with the table. Absent and empty keep the previous canonical policy, digest and compiled bytes. The native qualification guest loads the `nf_reject_ipv4`, `nf_reject_ipv6`, `nft_reject` and `nft_reject_inet` modules.
+- Add optional host-local platform endpoints to the schema-v2 `hostTransit` scope: `localPlatformEndpoints` lists ids of `protection.platformEndpoints` the host serves on an exact address of its uplink or a handoff link (verified through rtnetlink at apply, recovery and inspection). INPUT admits leased flows from their exact handoff with the lease's transit source address and a source port in its range for the endpoint's protocol, to the exact endpoint tuple in the live and originally tracked tuple (NEW with a SYN-only TCP opening, or ESTABLISHED), and OUTPUT admits only the ESTABLISHED reply; translated flows and host-origin openings stay denied. The refusal of a platform endpoint on a host address is lifted only for declared ids. Absent and empty keep the previous canonical policy, digest and compiled bytes.
+- Add optional stateful one-way workload grants to the schema-v2 `routerEgress` scope: `workloadGrants` entries `{ protocol, sourceAddress, destinationAddress, destinationPort }` let one veth workload endpoint open one exact port of another. Four constant FORWARD admissions look up the incoming and outgoing link with their addresses in a CONSTANT `workload_link` set and the protocols with the live and originally tracked tuple in a CONSTANT `workload_grant` set, in the default conntrack zone; the destination only answers (ESTABLISHED replies) and can never open toward the source. Up to 1024 grants, sharing the scope's set element budget with host grants. Absent and empty keep the previous canonical policy, digest and compiled bytes.
+
+### Maintenance
+
+- Bring the release-time tooling current: `@git.zone/tsrust` 1.14.0 → 1.15.0. `@types/node` stays 26.6.1 and pnpm 12.4.2, because their newer releases are younger than the seven-day rule; `@git.zone/cli` 7.2.2, tsbuild 5.0.0, tsrun 3.0.0 and tstest 6.2.0 are already current. The native notices verify unchanged.
+
 ## 2026-09-24 - 2.5.2
 
 ### Maintenance

package/dist_rust/smartnftables_linux_amd64_musl.tsrust-build.json

@@ -1,13 +1,13 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "8171a73d23d26828e29fc1a403ec08a4a24664d7b0f625d90217f59cb760638e",
+  "binarySha256": "8b0883d60ba14c1971ce50bd7ec45ea4cbb8a79c292e9063166fed168779dd52",
   "buildInfo": {
     "projectName": "@push.rocks/smartnftables",
-    "projectVersion": "2.5.2",
-    "gitCommit": "af81d179977c8903fc265a0b66a0b6c52c2b7e04",
+    "projectVersion": "2.6.0",
+    "gitCommit": "8032aac9d7b1b78650f0947574e5aab783b2d5db",
     "gitDirty": false,
-    "builtAt": "2026-09-24T23:25:26.155Z",
-    "tsrustVersion": "1.14.0",
+    "builtAt": "2026-09-25T13:42:00.180Z",
+    "tsrustVersion": "1.15.0",
     "binary": "smartnftables",
     "target": "linux_amd64_musl"
   }

package/dist_rust/smartnftables_linux_arm64_musl.tsrust-build.json

@@ -1,13 +1,13 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "05b1bfa1d470edec18ced9a47b2426fad72801b81ac8e29f3a8c3dc9cb1787f7",
+  "binarySha256": "86d2a679f4f1968b9ae9e0a3681572f5c4a6dc913993747abf5422f3adf4916b",
   "buildInfo": {
     "projectName": "@push.rocks/smartnftables",
-    "projectVersion": "2.5.2",
-    "gitCommit": "af81d179977c8903fc265a0b66a0b6c52c2b7e04",
+    "projectVersion": "2.6.0",
+    "gitCommit": "8032aac9d7b1b78650f0947574e5aab783b2d5db",
     "gitDirty": false,
-    "builtAt": "2026-09-24T23:25:35.983Z",
-    "tsrustVersion": "1.14.0",
+    "builtAt": "2026-09-25T13:42:10.633Z",
+    "tsrustVersion": "1.15.0",
     "binary": "smartnftables",
     "target": "linux_arm64_musl"
   }

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@push.rocks/smartnftables',
-    version: '2.5.2',
+    version: '2.6.0',
     description: 'A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSwyQkFBMkI7SUFDakMsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLG1IQUFtSDtDQUNqSSxDQUFBIn0=

package/dist_ts/managed.egress.types.d.ts

@@ -91,6 +91,21 @@ export interface IManagedNftHostGrant {
     /** The workload's exact listening port, 1–65535; never a range. */
     destinationPort: number;
 }
+/** One stateful one-way flow between two workloads behind the same router: the source workload opens
+ * connections to one exact port of the destination workload, which may only answer. Both addresses are
+ * exact current addresses of two different veth workload endpoints of the scope. It admits the tuple
+ * (a TCP opening only with SYN) and its ESTABLISHED replies in the default conntrack zone and nothing
+ * else: no reverse opening, no translation and no source-port selection. Grant the reverse direction as
+ * a second grant. */
+export interface IManagedNftWorkloadGrant {
+    protocol: 'tcp' | 'udp';
+    /** Exact unicast address of the dialling workload endpoint, never a prefix. */
+    sourceAddress: string;
+    /** Exact unicast address of the dialled workload endpoint, never a prefix. */
+    destinationAddress: string;
+    /** The destination workload's exact listening port, 1–65535; never a range. */
+    destinationPort: number;
+}
 /** One combined private/TUN/local/egress table; never compose a second ACCEPT over v1 terminal drops. */
 export interface IManagedNftRouterEgressScopeV2 {
     kind: 'routerEgress';
@@ -114,6 +129,10 @@ export interface IManagedNftRouterEgressScopeV2 {
      * workload. Absent and empty are the same canonical policy, digest and compiled graph; at most 1024,
      * held in a named set behind a constant number of rules. */
     hostGrants?: IManagedNftHostGrant[];
+    /** Optional stateful one-way workload-to-workload grants. Absent and empty are the same canonical
+     * policy, digest and compiled graph; at most 1024, held in two named sets behind four rules. They
+     * share the scope's set element budget with `hostGrants`. */
+    workloadGrants?: IManagedNftWorkloadGrant[];
 }
 /** One inbound uplink publication, compiled inside the same host-transit generation. */
 export interface IManagedNftPublishedPortV2 {
@@ -147,6 +166,27 @@ export interface IManagedNftHostTransitScopeV2 {
      * host-local, a platform endpoint nor a leased transit source address. Absent and empty are the
      * same canonical policy; at most 1024, held in a named set behind a constant number of rules. */
     hostGrants?: IManagedNftHostGrant[];
+    /** Optional ids of `protection.platformEndpoints` this host serves itself, on an exact current address
+     * of the uplink or of a handoff link (rtnetlink verifies it at apply, recovery and inspection). Only a
+     * declared endpoint may hold a host address. Leased flows reach it from their exact handoff with the
+     * leased source address and a source port of the allocation's range for the endpoint's protocol; its
+     * ESTABLISHED replies return. Absent and empty are the same canonical policy, digest and compiled graph. */
+    localPlatformEndpoints?: string[];
+}
+/** One loopback TCP service that only one local user may dial. Every packet the host sends to the
+ * exact address and port from a socket of any other user is rejected with a TCP reset, after ordinary
+ * output destination NAT; the address and port arriving on any interface but loopback are dropped.
+ * The service must bind exactly this address: a wildcard listener stays reachable through others. */
+export interface IManagedNftLocalTcpPortOwner {
+    /** Exact IPv4 loopback host address in 127.0.0.0/8, e.g. `127.0.0.1`. Never a prefix or wildcard. */
+    address: string;
+    /** The service's exact listening port, 1–65535; never a range. */
+    port: number;
+    /** The only user id whose sockets may send to the port: the socket file's file-system uid as
+     * the user namespace owning the network namespace sees it, 0–4294967294. Packets without a socket file carry no uid and
+     * are not matched: kernel replies, the teardown of an orphaned socket, and in-kernel sockets such as NFS or CIFS clients,
+     * which only privileged mounts create. */
+    uid: number;
 }
 /** Host-wide IPv4 destination denial for caller-authenticated private allocation pools.
  * It has no link dependency; exact host grants are its only exceptions. It is not allocation-release or boot-order proof. */
@@ -159,6 +199,10 @@ export interface IManagedNftAllocationPoolGuardScopeV2 {
      * listed pool, and their replies. Absent and empty are the same canonical policy; at most 1024,
      * held in a named set behind a constant number of rules. */
     hostGrants?: IManagedNftHostGrant[];
+    /** Optional host-wide loopback port ownership, compiled ahead of the guard in the same table.
+     * Absent and empty are the same canonical policy, digest and compiled graph; at most 8, one per
+     * exact address and port. */
+    localTcpPortOwners?: IManagedNftLocalTcpPortOwner[];
 }
 export interface IManagedNftPolicyV2 {
     schemaVersion: 2;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartnftables",
-  "version": "2.5.2",
+  "version": "2.6.0",
   "private": false,
   "description": "A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.",
   "main": "dist_ts/index.js",
@@ -12,7 +12,7 @@
     "@git.zone/cli": "7.2.2",
     "@git.zone/tsbuild": "^5.0.0",
     "@git.zone/tsrun": "^3.0.0",
-    "@git.zone/tsrust": "1.14.0",
+    "@git.zone/tsrust": "1.15.0",
     "@git.zone/tstest": "6.2.0",
     "@types/node": "26.6.1",
     "typescript": "^7.0.2"

package/readme.md

@@ -264,9 +264,9 @@ allocation-pool guard policy kinds.
 
 | V2 scope | Required authority and behavior |
 | --- | --- |
-| `routerEgress` | Private `endpoints` and `rules`, one exact `links` binding per endpoint, a separate veth `handoff`, `protection`, and active `generations`. Private veth/TUN/local DNS and egress share one table so terminal private denial cannot override a separate egress table. Optional `publishedPorts` add the inbound second hop from the handoff to a workload endpoint; both directions are classified into the default conntrack zone ahead of every leased classifier, so a published endpoint port is dedicated to its publication and never becomes leased egress. Optional `hostGrants` forward exact host-origin flows from the handoff to a workload endpoint. |
-| `hostTransit` | Exact handoff `link`/`allocations` pairs, complete `protection`, an explicit veth or Ethernet `uplink`, and its current `snatAddress`. It checks each handoff's leased source address and protocol/port range, default conntrack zone, direction, uplink, and protected destinations before outer SNAT. Optional `publishedPorts` add inbound uplink destination NAT inside the same generation. Optional `hostGrants` let the host's own address on a handoff dial exact workload ports. |
-| `allocationPoolGuard` | An authenticated `authorityDigest` and complete current allocation-pool `prefixes`. Installs host-wide IPv4 destination denial before any handoff exists, without link, uplink or SNAT dependencies. Optional `hostGrants` are its only exceptions. |
+| `routerEgress` | Private `endpoints` and `rules`, one exact `links` binding per endpoint, a separate veth `handoff`, `protection`, and active `generations`. Private veth/TUN/local DNS and egress share one table so terminal private denial cannot override a separate egress table. Optional `publishedPorts` add the inbound second hop from the handoff to a workload endpoint; both directions are classified into the default conntrack zone ahead of every leased classifier, so a published endpoint port is dedicated to its publication and never becomes leased egress. Optional `hostGrants` forward exact host-origin flows from the handoff to a workload endpoint. Optional `workloadGrants` let one workload open one exact port of another, one way. |
+| `hostTransit` | Exact handoff `link`/`allocations` pairs, complete `protection`, an explicit veth or Ethernet `uplink`, and its current `snatAddress`. It checks each handoff's leased source address and protocol/port range, default conntrack zone, direction, uplink, and protected destinations before outer SNAT. Optional `publishedPorts` add inbound uplink destination NAT inside the same generation. Optional `hostGrants` let the host's own address on a handoff dial exact workload ports. Optional `localPlatformEndpoints` serve platform endpoints on the host's own addresses to leased flows. |
+| `allocationPoolGuard` | An authenticated `authorityDigest` and complete current allocation-pool `prefixes`. Installs host-wide IPv4 destination denial before any handoff exists, without link, uplink or SNAT dependencies. Optional `hostGrants` are its only exceptions. Optional `localTcpPortOwners` restrict loopback TCP ports to one local user each. |
 
 `allocationPoolGuard` accepts 1–64 canonical, disjoint RFC1918 prefixes. Supply
 the actual allocation pools, not the broader protected union containing management
@@ -474,6 +474,119 @@ hop by hop from the workload side (router, host transit, guard) and withdraw the
 in the reverse order; each table is atomic on its own, and a partially applied
 grant only stays dark.
 
+#### Host-local platform endpoints
+
+A platform endpoint normally lives elsewhere and host transit forwards leased
+flows to it. When the host serves an endpoint itself — a relay listener, a data
+port or a VPN hub on an address the host holds — the leased flow ends in the
+host's INPUT instead, where every handoff arrival is denied. The optional
+`hostTransit.localPlatformEndpoints` lists the ids of `protection.platformEndpoints`
+the host serves:
+
+```typescript
+protection: { authorityDigest, prefixes: ['10.0.0.0/8', '192.0.2.0/24'], platformEndpoints: [
+  { id: 'relay', address: '192.0.2.2', protocol: 'tcp', port: 8443 }] },
+localPlatformEndpoints: ['relay'],
+```
+
+Each id names an existing endpoint whose address is an exact `requiredIpv4Addresses`
+entry of the uplink or of a handoff link, so rtnetlink verifies that the host holds it
+at apply, recovery and inspection. The refusal of a platform endpoint on a host
+address is lifted only for declared ids; unknown, duplicate or unheld ids reject.
+The router scope grants its workloads the endpoint like any platform endpoint
+(`destination: { kind: 'platform', endpointId }`).
+
+INPUT admits the original direction only from the exact handoff that carries a lease,
+with the lease's transit source address and a source port in one of its ranges for
+the endpoint's protocol, in the default conntrack zone, to the exact endpoint address
+and port in both the live and the originally tracked tuple, NEW (a TCP opening only
+with SYN) or ESTABLISHED. OUTPUT admits only the ESTABLISHED reply back through that
+handoff. A flow translated in transit, another source address or port, another
+endpoint port or protocol and any host-origin opening toward the transit address keep
+meeting the handoff denials. The source port is checked against the leased range in
+both tuples, not for equality between them. Each leased range adds one INPUT and one
+OUTPUT jump when an endpoint of its protocol is declared, and each endpoint adds three
+rules. Absent and empty are the same canonical policy, digest and compiled bytes. The
+caller keeps a declared endpoint's address outside every guarded allocation pool and
+owns the listener.
+
+#### Workload grants
+
+`routerEgress.workloadGrants` is optional: a stateful one-way flow between two
+workloads behind the same router, such as an ingress workload reaching a target
+workload's service port across organizations. Each entry is `{ protocol,
+sourceAddress, destinationAddress, destinationPort }`: `tcp` or `udp`, the exact
+current addresses of two different veth workload endpoints of the scope and one port
+1–65535. Prefixes, wildcards, ranges, router-local and platform-endpoint addresses,
+TUN endpoints, both ends on one endpoint and duplicates reject. The source opens and
+the destination only answers; the reverse direction is a second grant.
+
+Four FORWARD admissions follow the private anti-spoof guards whatever the number of
+grants: ESTABLISHED original direction, a NEW UDP opening, a NEW TCP opening
+restricted to SYN with FIN/RST/ACK clear, and the ESTABLISHED reply, each in the
+default conntrack zone. Every admission looks up the incoming link with the source
+address and the outgoing link with the destination address (index and name) in the
+CONSTANT set `workload_link`, and the protocols with the live and originally tracked
+tuple in the CONSTANT set `workload_grant`, so a spoofed, renamed or translated flow
+never matches and the destination can never open toward the source. Endpoint prefixes
+are protected, so both directions stay in the default zone ahead of every leased
+classifier. Owner verification reads both sets back element by element. Up to 1024
+grants fit; the sets share the scope's 100,000-byte element budget with `hostGrants`,
+so 1024 of each do not fit together and preparation refuses that before any kernel
+work. Absent and empty are the same canonical policy, digest and compiled bytes, and
+withdrawal is an ordinary atomic replacement that also stops established flows.
+
+These flows need no private `rules`. A private rule is stateless: answering through
+private rules needs a reverse rule, which would also let the destination open toward
+the source.
+
+#### Loopback TCP port owners
+
+`allocationPoolGuard.localTcpPortOwners` is optional and restricts a loopback TCP
+service to one local user, such as a container runtime's CRI stream server on
+`127.0.0.1:10010` that only root may reach. Each entry is `{ address, port, uid }`:
+one exact IPv4 loopback host address in `127.0.0.0/8` (not the network or broadcast
+address), one port 1–65535 and one uid 0–4294967294. Prefixes, wildcards, IPv6,
+ranges, uid lists and a second entry for the same address and port reject; the
+limit is 8 entries. Absent and empty are the same canonical policy, so a guard
+without owners keeps its exact previous digest and compiled bytes.
+
+```typescript
+const guard: IManagedNftPolicyV2 = { schemaVersion: 2, revision: 1, scope: {
+  kind: 'allocationPoolGuard', authorityDigest, prefixes: ['10.240.0.0/16'],
+  localTcpPortOwners: [{ address: '127.0.0.1', port: 10010, uid: 0 }] } };
+```
+
+Each entry compiles two rules at the head of the guard's base chains, ahead of the
+host grant admissions and the pool guard, so nothing earlier in the table accepts
+past them:
+
+- OUTPUT (filter priority 0, after ordinary output destination NAT): IPv4 TCP to the
+  exact address and port with `meta skuid != uid` is rejected with a TCP reset, so
+  another user's `connect()` fails at once with `ECONNREFUSED`. This covers every
+  packet, not only the opening, and a flow a foreign output DNAT redirects to the
+  port. `meta skuid` is the socket file's file-system uid as the user namespace owning the
+  network namespace sees it, the initial one on a host: a process in a user namespace
+  that shares the host network namespace is matched by its host uid, and a user
+  namespace's root is not uid 0. A packet without a socket
+  file carries no uid and does not match: a kernel reply, the teardown of an orphaned
+  socket, or an in-kernel socket such as an NFS or CIFS client, which only a privileged
+  mount creates.
+- INPUT: the exact address and port arriving on any interface but loopback (ifindex
+  1 in every network namespace) are dropped, so `route_localnet` or a prerouting DNAT
+  cannot expose the service to another host.
+
+The rules match the exact destination address. The service must bind exactly that
+address; a wildcard listener stays reachable through the host's other addresses.
+IPv6 is not covered, so the service must not listen on `::1` or `::`. A socket keeps
+the uid it was created with, so a root process that hands its connected socket to
+another user delegates that connection. The reject expression needs the kernel's
+`nft_reject_inet` module (autoloaded on stock kernels). Owner verification reads
+back every rule, including the comparison operator, the uid and the reject type, so
+apply, inspection, adoption and recovery reject a changed rule. The entries are
+applied, retained, recovered and released with the rest of the guard's table; after
+a reboot the caller applies its retained intent again, like every other member.
+
 Input bounds are 1024 grants per scope, the maximum a network projection carries.
 Elements have their own 100,000-byte budget beside the 100,000-byte rule graph, and
 are sent 256 to a message. At 1024 grants the reference router needs about 94 KB
@@ -632,6 +745,32 @@ withdrawal in every scope stops new flows and the established one. A full guard
 set persists across owner loss, is re-verified element by element before adoption,
 survives lost-ACK replay and is replaced and released like the rest of the graph,
 and another socket cannot add or delete one of its elements.
+Host-local platform endpoints are qualified from a router namespace against
+pre-policy positive controls: without the member the handoff denials keep both a TCP
+endpoint on the uplink address and a UDP endpoint on the handoff address dark; with
+it the exact leased flows reach them with the transit source preserved, while a
+source port outside the lease or in the other protocol's range, an unleased source
+address, another endpoint port, a flow a foreign prerouting DNAT translated onto the
+endpoint and the host's own opening toward the transit address stay dark; withdrawal
+stops new flows and the established one, and release reopens the path. A graph with
+served endpoints persists across owner loss and survives lost-ACK replay.
+Workload grants are qualified between three workload namespaces behind the router,
+each with leased public egress on every port of both protocols: against pre-policy
+positive controls, the grant opens exactly the source workload's TCP and UDP flows to
+the granted ports with the source preserved; another port, another source workload,
+another destination workload, the destination's TCP and UDP openings toward the
+source stay dark; withdrawal stops new flows and the established one; release reopens
+the path. A set of 1024 grants persists across owner loss, is re-verified element by
+element and survives lost-ACK replay.
+Loopback TCP port owners are qualified against pre-policy positive controls on the
+same listeners: the owning uid (root, and uid 1000 for a second port) connects, every
+other uid is reset with `ECONNREFUSED`, an unowned port and another loopback address
+stay open to every user, a foreign output DNAT to the owned port stays closed to
+another user, and an uplink arrival translated to loopback with `route_localnet`
+enabled is dropped. The policy keeps enforcing after the owner detaches and its
+process is gone, a fresh owner verifies and adopts the exact graph, and release
+reopens every probe. The maximum of eight owners beside the guard persists across
+owner loss and survives lost-ACK replay.
 The arm64 binary is cross-built; native packet qualification is currently x86_64.
 Kernel 6.8 is unsupported. No production activation is implied by these tests.
 

package/rust/src/egress.compile.rs

@@ -10,6 +10,8 @@ mod hostgrant;
 mod poolguard;
 #[path = "egress.router.rs"]
 mod router;
+#[path = "egress.workloadgrant.rs"]
+mod workloadgrant;
 
 /// Set elements of one target. Together with the 100,000-byte rule graph and the
 /// handle-only deletion of a previous maximum graph this bounds one replacement

package/rust/src/egress.host.rs

@@ -36,10 +36,25 @@ fn envelope(
     allocation: &Allocation,
     range: &PortRange,
     reply: bool,
+) -> Result<Vec<Attr>> {
+    leased(handoff, Some(&scope.uplink), allocation, range, reply)
+}
+/// One leased range of one allocation on its exact handoff: the default zone, the
+/// direction, the protocols, and the transit source address and port range in
+/// both the live and the originally tracked tuple. A forwarded envelope adds the
+/// uplink; a host-local one has none.
+fn leased(
+    handoff: &HostHandoff,
+    uplink: Option<&LocalLink>,
+    allocation: &Allocation,
+    range: &PortRange,
+    reply: bool,
 ) -> Result<Vec<Attr>> {
     let mut expressions = ipv4();
     expressions.extend(link(&handoff.link, !reply));
-    expressions.extend(link(&scope.uplink, reply));
+    if let Some(uplink) = uplink {
+        expressions.extend(link(uplink, reply));
+    }
     expressions.extend(meta(16, vec![protocol(&range.protocol)]));
     expressions.extend(ct(10, None, vec![protocol(&range.protocol)]));
     expressions.extend(ct(17, None, 0_u16.to_ne_bytes().to_vec()));
@@ -114,6 +129,70 @@ fn published(program: &mut Program<'_>, scope: &HostScope) -> Result<()> {
     }
     Ok(())
 }
+/// The exact platform endpoints served on host addresses. Every packet is
+/// checked against the live and the originally tracked destination tuple, so a
+/// flow rewritten in transit never matches.
+fn local_endpoints(scope: &HostScope) -> Vec<&PlatformEndpoint> {
+    scope
+        .protection
+        .platform_endpoints
+        .iter()
+        .filter(|endpoint| scope.local_platform_endpoints.contains(&endpoint.id))
+        .collect()
+}
+fn local_endpoint(endpoint: &PlatformEndpoint, reply: bool) -> Result<Vec<Attr>> {
+    let mut expressions = meta(16, vec![protocol(&endpoint.protocol)]);
+    expressions.extend(ct(10, None, vec![protocol(&endpoint.protocol)]));
+    let address = format!("{}/32", endpoint.address);
+    expressions.extend(current_address(&address, reply)?);
+    expressions.extend(current_port(endpoint.port, reply));
+    expressions.extend(original_address(&address, false)?);
+    expressions.extend(original_port(endpoint.port, false));
+    Ok(expressions)
+}
+/// Leased flows into host-local platform endpoints, the reverse of a host grant:
+/// INPUT admits the original direction only from an exact handoff with a leased
+/// source address and port range of that handoff, NEW (a TCP opening only with
+/// SYN) or ESTABLISHED; OUTPUT admits only the ESTABLISHED reply back to it. Each
+/// leased range jumps once per direction, and the endpoint chains hold one tuple
+/// check per endpoint, so the graph grows with ranges plus endpoints.
+fn local_platform(program: &mut Program<'_>, scope: &HostScope) -> Result<()> {
+    let endpoints = local_endpoints(scope);
+    for endpoint in &endpoints {
+        let original = local_endpoint(endpoint, false)?;
+        for connection_state in [2, 8] {
+            let mut expressions = original.clone();
+            expressions.extend(state(connection_state));
+            if connection_state == 8 && endpoint.protocol == "tcp" {
+                expressions.extend(opening_tcp());
+            }
+            program.end("local_platform_in", expressions, 1)?;
+        }
+        let mut reply = local_endpoint(endpoint, true)?;
+        reply.extend(state(2));
+        program.end("local_platform_back", reply, 1)?;
+    }
+    for handoff in &scope.handoffs {
+        for allocation in &handoff.allocations {
+            for range in &allocation.source_port_ranges {
+                if endpoints
+                    .iter()
+                    .all(|endpoint| endpoint.protocol != range.protocol)
+                {
+                    continue;
+                }
+                for (chain, target, reply) in [
+                    ("input", "local_platform_in", false),
+                    ("output", "local_platform_back", true),
+                ] {
+                    let expressions = leased(handoff, None, allocation, range, reply)?;
+                    program.jump(chain, expressions, target)?;
+                }
+            }
+        }
+    }
+    Ok(())
+}
 pub(super) fn compile(program: &mut Program<'_>, scope: &HostScope) -> Result<()> {
     // Filtering runs after destination NAT. Docker has independent filter hooks.
     // This table cannot override another owner's DROP; Docker contribution and
@@ -135,6 +214,11 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &HostScope) -> Result<()
     for name in ["protected_out", "protected_back"] {
         program.chain(name, None)?;
     }
+    if !scope.local_platform_endpoints.is_empty() {
+        for name in ["local_platform_in", "local_platform_back"] {
+            program.chain(name, None)?;
+        }
+    }
     if !scope.host_grants.is_empty() {
         // Validation admits only an address of exactly one handoff link.
         hostgrant::tuple_set(program, &scope.host_grants, |grant| {
@@ -163,6 +247,9 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &HostScope) -> Result<()
     if !scope.host_grants.is_empty() {
         hostgrant::admissions(program, ["output", "input"], true, |_| vec![])?;
     }
+    // Leased flows into host-local platform endpoints precede the same terminal
+    // handoff denials, which remain for everything else.
+    local_platform(program, scope)?;
     for handoff in &scope.handoffs {
         program.jump("forward", link(&handoff.link, true), "protected_out")?;
         program.jump("forward", link(&handoff.link, false), "protected_back")?;

package/rust/src/egress.hostgrant.rs

@@ -13,7 +13,7 @@ pub(super) const ARRIVAL_SET: &str = "host_grant_arrival";
 
 /// Register numbers as Linux dumps them: 16-byte aligned registers use the
 /// legacy NFT_REG_1..4 names, every other 4-byte register NFT_REG32_xx.
-fn register(index: u32) -> u32 {
+pub(super) fn register(index: u32) -> u32 {
     if index % 4 == 0 {
         index / 4
     } else {
@@ -24,10 +24,10 @@ fn store(name: &str, mut data: Vec<Attr>, index: u32) -> Attr {
     data.insert(0, Attr::u32(1, register(index)));
     expr(name, data)
 }
-fn meta_to(key: u32, index: u32) -> Attr {
+pub(super) fn meta_to(key: u32, index: u32) -> Attr {
     store("meta", vec![Attr::u32(2, key)], index)
 }
-fn payload_to(base: u32, offset: u32, length: u32, index: u32) -> Attr {
+pub(super) fn payload_to(base: u32, offset: u32, length: u32, index: u32) -> Attr {
     store(
         "payload",
         vec![
@@ -45,7 +45,7 @@ fn ct_to(key: u32, original: bool, index: u32) -> Attr {
     }
     store("ct", data, index)
 }
-fn lookup(set: &str) -> Attr {
+pub(super) fn lookup(set: &str) -> Attr {
     expr(
         "lookup",
         vec![
@@ -61,10 +61,10 @@ fn word(bytes: &[u8]) -> Vec<u8> {
     result
 }
 
-/// Key loads for one direction, then the lookup. `linked` adds the variable
-/// interface: the outgoing interface of the original direction, the incoming
-/// interface of the reply.
-fn tuple_lookup(linked: bool, reply: bool) -> Vec<Attr> {
+/// Key loads for one direction, then the lookup in `set`. `linked` adds the
+/// variable interface: the outgoing interface of the original direction, the
+/// incoming interface of the reply.
+pub(super) fn tuple_lookup(set: &str, linked: bool, reply: bool) -> Vec<Attr> {
     let mut result = Vec::new();
     let mut index = 4;
     if linked {
@@ -82,10 +82,10 @@ fn tuple_lookup(linked: bool, reply: bool) -> Vec<Attr> {
     result.push(ct_to(19, true, index + 5));
     result.push(ct_to(20, true, index + 6));
     result.push(ct_to(12, true, index + 7));
-    result.push(lookup(TUPLE_SET));
+    result.push(lookup(set));
     result
 }
-fn tuple_key(grant: &HostGrant, link: Option<&LocalLink>) -> Result<Vec<u8>> {
+pub(super) fn tuple_key(grant: &HostGrant, link: Option<&LocalLink>) -> Result<Vec<u8>> {
     let protocol = word(&[protocol(&grant.protocol)]);
     let source = address(&grant.source_address)?.to_be_bytes();
     let destination = address(&grant.destination_address)?.to_be_bytes();
@@ -170,7 +170,7 @@ pub(super) fn admissions(
         result
     };
     let mut established = envelope(false, 2);
-    established.extend(tuple_lookup(linked, false));
+    established.extend(tuple_lookup(TUPLE_SET, linked, false));
     program.end(chains[0], established, 1)?;
     for transport in ["udp", "tcp"] {
         let mut opening = envelope(false, 8);
@@ -178,10 +178,10 @@ pub(super) fn admissions(
         if transport == "tcp" {
             opening.extend(opening_tcp());
         }
-        opening.extend(tuple_lookup(linked, false));
+        opening.extend(tuple_lookup(TUPLE_SET, linked, false));
         program.end(chains[0], opening, 1)?;
     }
     let mut reply = envelope(true, 2);
-    reply.extend(tuple_lookup(linked, true));
+    reply.extend(tuple_lookup(TUPLE_SET, linked, true));
     program.end(chains[1], reply, 1)
 }

package/rust/src/egress.poolguard.rs

@@ -7,6 +7,10 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &AllocationPoolGuardScop
     for name in ["pool_guard", "pool_reply"] {
         program.chain(name, None)?;
     }
+    // First in the base chains, so nothing earlier in this table accepts past them.
+    for owner in &scope.local_tcp_port_owners {
+        local_tcp_port_owner(program, owner)?;
+    }
     // The only exceptions: an exact host-origin flow into a pool and its reply,
     // ahead of the guard. Everything else, including a translated flow that merely
     // arrives at a granted tuple, still meets the unconditional guard below.
@@ -35,3 +39,44 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &AllocationPoolGuardScop
     program.end("pool_guard", vec![], -5)?;
     program.end("pool_reply", vec![], -5)
 }
+
+/// The exact loopback TCP destination: IPv4, TCP, address and port.
+fn local_tcp_port(owner: &LocalTcpPortOwner) -> Result<Vec<Attr>> {
+    let mut result = ipv4();
+    result.extend(meta(16, vec![protocol("tcp")]));
+    result.push(load_payload(1, 16, 4));
+    result.push(compare(address(&owner.address)?.to_be_bytes().to_vec()));
+    result.extend(current_port(owner.port, false));
+    Ok(result)
+}
+/// `meta <key> != value`. A key the packet does not carry breaks the rule.
+fn meta_differs(key: u32, value: Vec<u8>) -> Vec<Attr> {
+    vec![
+        expr("meta", vec![Attr::u32(1, 1), Attr::u32(2, key)]),
+        expr(
+            "cmp",
+            vec![
+                Attr::u32(1, 1),
+                Attr::u32(2, 1),
+                Attr::nested(3, vec![Attr::bytes(1, value)]),
+            ],
+        ),
+    ]
+}
+/// OUTPUT at filter priority 0 sees the destination after ordinary destination
+/// NAT and rejects, with a TCP reset, every packet from a socket whose file
+/// system uid (as the user namespace owning the network namespace sees it) is
+/// not the owner. A packet without a user socket (a kernel reply, an orphaned
+/// socket's teardown) carries no uid and breaks the rule; it cannot open a
+/// connection. INPUT drops the destination arriving on any interface but
+/// loopback (ifindex 1 in every namespace), which `route_localnet` or
+/// prerouting DNAT could otherwise admit.
+fn local_tcp_port_owner(program: &mut Program<'_>, owner: &LocalTcpPortOwner) -> Result<()> {
+    let mut output = local_tcp_port(owner)?;
+    output.extend(meta_differs(10, owner.uid.to_ne_bytes().to_vec()));
+    output.push(expr("reject", vec![Attr::u32(1, 1)]));
+    program.rule("output", output)?;
+    let mut input = local_tcp_port(owner)?;
+    input.extend(meta_differs(4, 1_u32.to_ne_bytes().to_vec()));
+    program.end("input", input, 0)
+}

package/rust/src/egress.router.rs

@@ -50,7 +50,7 @@ fn raw_return(scope: &RouterScope, grant: &Grant, generation: &Generation) -> Re
 /// The exact veth link of the workload endpoint that holds an endpoint address.
 /// Validation admits only a current endpoint address, and endpoint prefixes are
 /// pairwise disjoint, so one publication or host grant never spans two links.
-fn endpoint_link<'a>(scope: &'a RouterScope, address: &str) -> Result<&'a LocalLink> {
+pub(super) fn endpoint_link<'a>(scope: &'a RouterScope, address: &str) -> Result<&'a LocalLink> {
     let target = format!("{address}/32");
     let endpoint = scope
         .endpoints
@@ -365,6 +365,7 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &RouterScope, revision:
         program.chain(name, None)?;
     }
     host_grant_sets(program, scope)?;
+    workloadgrant::sets(program, scope)?;
     let private = policy::Policy {
         schema_version: 1,
         revision,
@@ -397,6 +398,7 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &RouterScope, revision:
         if chain == "forward" {
             published_admissions(program, scope)?;
             host_grant_admissions(program, scope)?;
+            workloadgrant::admissions(program, scope)?;
         }
         for expressions in parts.grants {
             program.rule(chain, expressions)?;