@push.rocks/smartnftables 2.5.2 → 3.0.0

package/changelog.md

@@ -1,5 +1,36 @@
 # Changelog
 
+## 2026-09-28 - 3.0.0
+
+### Breaking Changes
+
+- The schema-v2 `routerEgress` compiler now keeps private endpoints, directed rules and leased egress grants in named sets and maps behind a fixed set of rules, and every scope keeps its `publishedPorts` the same way (see Features). The policy API is additive and policy digests are unchanged, but the compiled graph of every `routerEgress` table and of every scope with publications changes: reconcile, inspection or release against such a table applied by 2.x returns `Conflict`, because the new engine does not adopt the old graph. Recover and release each such table with the exact previous engine and its retained intent and receipt, under a traffic fence, before upgrading. Tables of other scopes and without publications are unchanged.
+- Rebalance the atomic replacement budget inside the unchanged 320,000-byte batch: the complete target (rules, chains and sets at most 100,000 bytes, plus set elements) may take 212,000 bytes beside a 107,520-byte handle-only deletion of the previous graph, instead of two fixed 100,000-byte halves for rules and elements. The hard ceiling is Linux's `sendmsg` limit, the socket send buffer (`net.core.wmem_max` doubled, 425,984 bytes by default); 320,000 bytes fits any `wmem_max` of at least 160,016.
+- Raise the router's input bounds to 128 private endpoints and links, 1024 private rules and 1024 egress grants, and the publication bound of both scopes to 1024. Schema-v1 policies keep their bounds, digests and compiled bytes.
+
+### Features
+
+- Router: a node of 64 workloads, each with local DNS, public TCP and UDP egress, four platform endpoints and one to three publications, compiles about 66,000 rule bytes and 105,000 element bytes (89 such workloads fit), where 2.x held three. Private links, indices, names and source prefixes, directed rules, and per-kind and per-shape leased zone, return and flow maps, with the generation labels in two exact sets, replace the per-endpoint guard chains, per-rule grants, per-grant classifiers and admissions and the per-generation state chains; every lookup keeps the operands the rules compared, a key's link index is proven with the interface name through `private_link`, and a decision corpus of about 133,000 packets frozen from the 2.6.0 compiler is reproduced exactly. Owner verification admits absence (inverted) lookups and exact maps, and interval elements without a distinct last key.
+- Add published port ranges to both hops of a schema-v2 publication: an optional `hostPortEnd` on `hostTransit.publishedPorts` and `transitPortEnd` on `routerEgress.publishedPorts` publish `port..end` with every port kept (the inside port must equal the first port). A range compiles to one interval match per classification, translation and admission and to address-only destination NAT, so it costs the same operations as one port. Inverted and one-port ranges, a range with a differing inside port, overlaps between publications of one protocol and overlaps with a leased source-port range on the translated address are refused.
+- Add `symmetric` publications on both hops: the workload may open flows from its published address and port(s) toward unprotected space, NEW (a SYN-only TCP opening) or ESTABLISHED with ESTABLISHED replies, source-translated to the transit address and published transit port in the router and to `hostIp` and the published uplink port on the host, so outbound flows leave from the port clients reach. The admissions follow the capture barrier, so the protected union stays denied; a symmetric publication's inside ports may not overlap another publication's on the same address or, on the host, a leased range of its target address.
+- Compile every publication, of both hops, as elements of CONSTANT concatenated interval sets and maps (the kernel's pipapo backend) behind a constant number of rules: at most eleven rules and four sets on the host and thirteen rules and six sets in the router, whatever the number of publications, instead of four and six rules per publication. Destination NAT is a map lookup (to address and port for one port, to the address alone for a range) and symmetric source NAT a map lookup to the outside address and port span. Owner verification now admits interval and map sets, reads back their concatenation, every element's bounds and data, and map lookups with their data register, so apply, inspection, adoption and recovery reject a changed element like a changed rule. Absent and empty publications, `hostPortEnd`, `transitPortEnd` and `symmetric` (and `symmetric: false`) keep the previous canonical policy and digest, and a scope without publications keeps its compiled bytes; a scope with publications compiles a different graph for the same digest.
+
+### Maintenance
+
+- Release tooling: pnpm 12.5.1, `@git.zone/cli` 7.3.0, `@git.zone/tsrust` 1.15.1, `@git.zone/tstest` 6.3.2, `@git.zone/tsrun` 3.0.1, `@types/node` 26.6.2 (pnpm 12.6.0 and `@types/node` 26.6.3 stay out until they clear the seven-day rule).
+
+## 2026-09-25 - 2.6.0
+
+### Features
+
+- Add optional loopback TCP port owners to the schema-v2 `allocationPoolGuard` scope: `localTcpPortOwners` entries `{ address, port, uid }` (an exact IPv4 loopback host address, one port and one owning uid, at most 8) compile, ahead of the guard, an OUTPUT rule that rejects with a TCP reset every packet to that address and port from a socket whose uid differs (`meta skuid != uid`, after ordinary output destination NAT) and an INPUT rule that drops the address and port arriving on any interface but loopback. Owner verification now admits the TCP-reset `reject` expression and reads it back like every other operand, so the entries are verified on apply, retained, adopted, recovered and released with the table. Absent and empty keep the previous canonical policy, digest and compiled bytes. The native qualification guest loads the `nf_reject_ipv4`, `nf_reject_ipv6`, `nft_reject` and `nft_reject_inet` modules.
+- Add optional host-local platform endpoints to the schema-v2 `hostTransit` scope: `localPlatformEndpoints` lists ids of `protection.platformEndpoints` the host serves on an exact address of its uplink or a handoff link (verified through rtnetlink at apply, recovery and inspection). INPUT admits leased flows from their exact handoff with the lease's transit source address and a source port in its range for the endpoint's protocol, to the exact endpoint tuple in the live and originally tracked tuple (NEW with a SYN-only TCP opening, or ESTABLISHED), and OUTPUT admits only the ESTABLISHED reply; translated flows and host-origin openings stay denied. The refusal of a platform endpoint on a host address is lifted only for declared ids. Absent and empty keep the previous canonical policy, digest and compiled bytes.
+- Add optional stateful one-way workload grants to the schema-v2 `routerEgress` scope: `workloadGrants` entries `{ protocol, sourceAddress, destinationAddress, destinationPort }` let one veth workload endpoint open one exact port of another. Four constant FORWARD admissions look up the incoming and outgoing link with their addresses in a CONSTANT `workload_link` set and the protocols with the live and originally tracked tuple in a CONSTANT `workload_grant` set, in the default conntrack zone; the destination only answers (ESTABLISHED replies) and can never open toward the source. Up to 1024 grants, sharing the scope's set element budget with host grants. Absent and empty keep the previous canonical policy, digest and compiled bytes.
+
+### Maintenance
+
+- Bring the release-time tooling current: `@git.zone/tsrust` 1.14.0 → 1.15.0. `@types/node` stays 26.6.1 and pnpm 12.4.2, because their newer releases are younger than the seven-day rule; `@git.zone/cli` 7.2.2, tsbuild 5.0.0, tsrun 3.0.0 and tstest 6.2.0 are already current. The native notices verify unchanged.
+
 ## 2026-09-24 - 2.5.2
 
 ### Maintenance

package/dist_rust/smartnftables_linux_amd64_musl.tsrust-build.json

@@ -1,13 +1,13 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "8171a73d23d26828e29fc1a403ec08a4a24664d7b0f625d90217f59cb760638e",
+  "binarySha256": "17c4308039280f584cd51d6cf9030e3c4512746d316561925b6da95bb3c67ff8",
   "buildInfo": {
     "projectName": "@push.rocks/smartnftables",
-    "projectVersion": "2.5.2",
-    "gitCommit": "af81d179977c8903fc265a0b66a0b6c52c2b7e04",
+    "projectVersion": "3.0.0",
+    "gitCommit": "61c5a8be9c99a83cecde6509fb31c47f43e15bff",
     "gitDirty": false,
-    "builtAt": "2026-09-24T23:25:26.155Z",
-    "tsrustVersion": "1.14.0",
+    "builtAt": "2026-09-28T00:27:05.031Z",
+    "tsrustVersion": "1.15.1",
     "binary": "smartnftables",
     "target": "linux_amd64_musl"
   }

package/dist_rust/smartnftables_linux_arm64_musl.tsrust-build.json

@@ -1,13 +1,13 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "05b1bfa1d470edec18ced9a47b2426fad72801b81ac8e29f3a8c3dc9cb1787f7",
+  "binarySha256": "3756fe460edc3bdea00c7f598a683081d8238f5172dad9776304a030508d4276",
   "buildInfo": {
     "projectName": "@push.rocks/smartnftables",
-    "projectVersion": "2.5.2",
-    "gitCommit": "af81d179977c8903fc265a0b66a0b6c52c2b7e04",
+    "projectVersion": "3.0.0",
+    "gitCommit": "61c5a8be9c99a83cecde6509fb31c47f43e15bff",
     "gitDirty": false,
-    "builtAt": "2026-09-24T23:25:35.983Z",
-    "tsrustVersion": "1.14.0",
+    "builtAt": "2026-09-28T00:27:15.164Z",
+    "tsrustVersion": "1.15.1",
     "binary": "smartnftables",
     "target": "linux_arm64_musl"
   }

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@push.rocks/smartnftables',
-    version: '2.5.2',
+    version: '3.0.0',
     description: 'A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSwyQkFBMkI7SUFDakMsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLG1IQUFtSDtDQUNqSSxDQUFBIn0=

package/dist_ts/managed.egress.types.d.ts

@@ -65,9 +65,14 @@ export interface IManagedNftEgressGenerationV2 extends IManagedNftHandoffAllocat
  * `transitSourceAddress:transitPort`, this translates on to the workload. */
 export interface IManagedNftRouterPublishedPortV2 {
     protocol: 'tcp' | 'udp';
-    /** Published handoff port, 1–65535 and unique per protocol across the scope.
-     * It is the `targetPort` of the matching host-transit publication. */
+    /** Published handoff port, 1–65535; published ports never overlap per protocol across the
+     * scope. It is the `targetPort` of the matching host-transit publication. */
     transitPort: number;
+    /** Optional last port of a published range `transitPort..transitPortEnd`, greater than
+     * `transitPort`. A range keeps every port, so `endpointPort` must equal `transitPort`; like one
+     * port it is one interval set element per set, and its translation keeps the port. Absent for
+     * one port, which is its only canonical form. */
+    transitPortEnd?: number;
     endpointPort: number;
     /** Exact current workload endpoint address behind one veth endpoint of this
      * scope. Never a router-local address, a gateway or a platform endpoint. */
@@ -75,6 +80,12 @@ export interface IManagedNftRouterPublishedPortV2 {
     /** Exact leased transit source address of one current generation, present on
      * `handoff`. No wildcard, secondary-address or route inference. */
     transitSourceAddress: string;
+    /** Optional: the workload may open flows from `endpointAddress` and its published endpoint
+     * port(s) toward unprotected space, source-translated to `transitSourceAddress` and the
+     * published transit port (a range keeps the port). The protected union stays denied, and its
+     * endpoint ports may not overlap another publication's on the same address. Absent and
+     * `false` are the same canonical policy. */
+    symmetric?: boolean;
 }
 /** One exact host-origin flow: the node's own host network namespace dials one port of one local
  * workload at its lease address, from the transit host address of the current handoff. Compile the
@@ -91,6 +102,21 @@ export interface IManagedNftHostGrant {
     /** The workload's exact listening port, 1–65535; never a range. */
     destinationPort: number;
 }
+/** One stateful one-way flow between two workloads behind the same router: the source workload opens
+ * connections to one exact port of the destination workload, which may only answer. Both addresses are
+ * exact current addresses of two different veth workload endpoints of the scope. It admits the tuple
+ * (a TCP opening only with SYN) and its ESTABLISHED replies in the default conntrack zone and nothing
+ * else: no reverse opening, no translation and no source-port selection. Grant the reverse direction as
+ * a second grant. */
+export interface IManagedNftWorkloadGrant {
+    protocol: 'tcp' | 'udp';
+    /** Exact unicast address of the dialling workload endpoint, never a prefix. */
+    sourceAddress: string;
+    /** Exact unicast address of the dialled workload endpoint, never a prefix. */
+    destinationAddress: string;
+    /** The destination workload's exact listening port, 1–65535; never a range. */
+    destinationPort: number;
+}
 /** One combined private/TUN/local/egress table; never compose a second ACCEPT over v1 terminal drops. */
 export interface IManagedNftRouterEgressScopeV2 {
     kind: 'routerEgress';
@@ -114,17 +140,32 @@ export interface IManagedNftRouterEgressScopeV2 {
      * workload. Absent and empty are the same canonical policy, digest and compiled graph; at most 1024,
      * held in a named set behind a constant number of rules. */
     hostGrants?: IManagedNftHostGrant[];
+    /** Optional stateful one-way workload-to-workload grants. Absent and empty are the same canonical
+     * policy, digest and compiled graph; at most 1024, held in two named sets behind four rules. They
+     * share the scope's set element budget with `hostGrants`. */
+    workloadGrants?: IManagedNftWorkloadGrant[];
 }
 /** One inbound uplink publication, compiled inside the same host-transit generation. */
 export interface IManagedNftPublishedPortV2 {
     protocol: 'tcp' | 'udp';
-    /** Published uplink port, 1–65535 and unique per protocol across the scope. */
+    /** Published uplink port, 1–65535; published ports never overlap per protocol across the scope. */
     hostPort: number;
+    /** Optional last port of a published range `hostPort..hostPortEnd`, greater than `hostPort`.
+     * A range keeps every port, so `targetPort` must equal `hostPort`; like one port it is one
+     * interval set element per set, and its translation keeps the port. Absent for one port, which
+     * is its only canonical form. */
+    hostPortEnd?: number;
     targetPort: number;
     /** Exact leased transit source address of one current allocation; it selects the handoff. */
     targetAddress: string;
     /** Exact current uplink address that publishes this port. No wildcard or route inference. */
     hostIp: string;
+    /** Optional: flows from `targetAddress` and the published target port(s) may leave through the
+     * uplink toward unprotected space, source-translated to `hostIp` and the published uplink port
+     * (a range keeps the port). The protected union stays denied, its target ports may not fall in
+     * a leased range of `targetAddress` or overlap another publication's. Absent and `false` are
+     * the same canonical policy. */
+    symmetric?: boolean;
 }
 /** Shared-host capture barrier and explicit outer SNAT; Docker forwarding remains a separate owner. */
 export interface IManagedNftHostTransitScopeV2 {
@@ -147,6 +188,27 @@ export interface IManagedNftHostTransitScopeV2 {
      * host-local, a platform endpoint nor a leased transit source address. Absent and empty are the
      * same canonical policy; at most 1024, held in a named set behind a constant number of rules. */
     hostGrants?: IManagedNftHostGrant[];
+    /** Optional ids of `protection.platformEndpoints` this host serves itself, on an exact current address
+     * of the uplink or of a handoff link (rtnetlink verifies it at apply, recovery and inspection). Only a
+     * declared endpoint may hold a host address. Leased flows reach it from their exact handoff with the
+     * leased source address and a source port of the allocation's range for the endpoint's protocol; its
+     * ESTABLISHED replies return. Absent and empty are the same canonical policy, digest and compiled graph. */
+    localPlatformEndpoints?: string[];
+}
+/** One loopback TCP service that only one local user may dial. Every packet the host sends to the
+ * exact address and port from a socket of any other user is rejected with a TCP reset, after ordinary
+ * output destination NAT; the address and port arriving on any interface but loopback are dropped.
+ * The service must bind exactly this address: a wildcard listener stays reachable through others. */
+export interface IManagedNftLocalTcpPortOwner {
+    /** Exact IPv4 loopback host address in 127.0.0.0/8, e.g. `127.0.0.1`. Never a prefix or wildcard. */
+    address: string;
+    /** The service's exact listening port, 1–65535; never a range. */
+    port: number;
+    /** The only user id whose sockets may send to the port: the socket file's file-system uid as
+     * the user namespace owning the network namespace sees it, 0–4294967294. Packets without a socket file carry no uid and
+     * are not matched: kernel replies, the teardown of an orphaned socket, and in-kernel sockets such as NFS or CIFS clients,
+     * which only privileged mounts create. */
+    uid: number;
 }
 /** Host-wide IPv4 destination denial for caller-authenticated private allocation pools.
  * It has no link dependency; exact host grants are its only exceptions. It is not allocation-release or boot-order proof. */
@@ -159,6 +221,10 @@ export interface IManagedNftAllocationPoolGuardScopeV2 {
      * listed pool, and their replies. Absent and empty are the same canonical policy; at most 1024,
      * held in a named set behind a constant number of rules. */
     hostGrants?: IManagedNftHostGrant[];
+    /** Optional host-wide loopback port ownership, compiled ahead of the guard in the same table.
+     * Absent and empty are the same canonical policy, digest and compiled graph; at most 8, one per
+     * exact address and port. */
+    localTcpPortOwners?: IManagedNftLocalTcpPortOwner[];
 }
 export interface IManagedNftPolicyV2 {
     schemaVersion: 2;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartnftables",
-  "version": "2.5.2",
+  "version": "3.0.0",
   "private": false,
   "description": "A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.",
   "main": "dist_ts/index.js",
@@ -9,12 +9,12 @@
   "author": "Task Venture Capital GmbH",
   "license": "MIT",
   "devDependencies": {
-    "@git.zone/cli": "7.2.2",
+    "@git.zone/cli": "7.3.0",
     "@git.zone/tsbuild": "^5.0.0",
-    "@git.zone/tsrun": "^3.0.0",
-    "@git.zone/tsrust": "1.14.0",
-    "@git.zone/tstest": "6.2.0",
-    "@types/node": "26.6.1",
+    "@git.zone/tsrun": "^3.0.1",
+    "@git.zone/tsrust": "1.15.1",
+    "@git.zone/tstest": "6.3.2",
+    "@types/node": "26.6.2",
     "typescript": "^7.0.2"
   },
   "dependencies": {