@push.rocks/smartnftables 2.5.2 → 3.0.0

package/rust/src/policy.rs

@@ -90,12 +90,37 @@ fn covers(parent: &str, child: &str) -> Result<bool> {
 }
 
 impl Policy {
-    pub fn prepare(mut self) -> Result<Prepared> {
+    pub fn prepare(self) -> Result<Prepared> {
+        let policy = self.normalize(32, 128)?;
+        let digest = format!(
+            "sha256:{:x}",
+            Sha256::digest(serde_json::to_vec(&policy).map_err(|_| Error::Invalid)?)
+        );
+        let prepared = Prepared { policy, digest };
+        // Compile during preparation; an oversized native batch never reaches the kernel.
+        let program = prepared.program(&format!("snft_{}", "x".repeat(59)))?;
+        // Reserve enough of the batch for deleting a previous maximum
+        // graph, then installing this complete graph in the same transaction.
+        if program.len() > 768
+            || program
+                .iter()
+                .map(|(_, attrs)| wire::encode_attrs(attrs).len() + 20)
+                .sum::<usize>()
+                > 100_000
+        {
+            return Err(Error::Invalid);
+        }
+        Ok(prepared)
+    }
+    /// Validates and orders the endpoints and rules. Schema v1 compiles one rule
+    /// per endpoint and grant, so it admits 32 endpoints and 128 rules; the
+    /// set-backed router scope of schema v2 admits more.
+    pub(crate) fn normalize(mut self, endpoints: usize, rules: usize) -> Result<Self> {
         if self.schema_version != 1
             || self.revision == 0
             || self.revision > 9_007_199_254_740_991
-            || self.endpoints.len() > 32
-            || self.rules.len() > 128
+            || self.endpoints.len() > endpoints
+            || self.rules.len() > rules
         {
             return Err(Error::Invalid);
         }
@@ -185,28 +210,7 @@ impl Policy {
                 }
             }
         }
-        let digest = format!(
-            "sha256:{:x}",
-            Sha256::digest(serde_json::to_vec(&self).map_err(|_| Error::Invalid)?)
-        );
-        let prepared = Prepared {
-            policy: self,
-            digest,
-        };
-        // Compile during preparation; an oversized native batch never reaches the kernel.
-        let program = prepared.program(&format!("snft_{}", "x".repeat(59)))?;
-        // Reserve enough of the batch for deleting a previous maximum
-        // graph, then installing this complete graph in the same transaction.
-        if program.len() > 768
-            || program
-                .iter()
-                .map(|(_, attrs)| wire::encode_attrs(attrs).len() + 20)
-                .sum::<usize>()
-                > 100_000
-        {
-            return Err(Error::Invalid);
-        }
-        Ok(prepared)
+        Ok(self)
     }
 }
 

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartnftables',
-  version: '2.5.2',
+  version: '3.0.0',
   description: 'A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.'
 }

package/ts/managed.egress.types.ts

@@ -60,9 +60,14 @@ export interface IManagedNftEgressGenerationV2 extends IManagedNftHandoffAllocat
  * `transitSourceAddress:transitPort`, this translates on to the workload. */
 export interface IManagedNftRouterPublishedPortV2 {
   protocol: 'tcp' | 'udp';
-  /** Published handoff port, 1–65535 and unique per protocol across the scope.
-   * It is the `targetPort` of the matching host-transit publication. */
+  /** Published handoff port, 1–65535; published ports never overlap per protocol across the
+   * scope. It is the `targetPort` of the matching host-transit publication. */
   transitPort: number;
+  /** Optional last port of a published range `transitPort..transitPortEnd`, greater than
+   * `transitPort`. A range keeps every port, so `endpointPort` must equal `transitPort`; like one
+   * port it is one interval set element per set, and its translation keeps the port. Absent for
+   * one port, which is its only canonical form. */
+  transitPortEnd?: number;
   endpointPort: number;
   /** Exact current workload endpoint address behind one veth endpoint of this
    * scope. Never a router-local address, a gateway or a platform endpoint. */
@@ -70,6 +75,12 @@ export interface IManagedNftRouterPublishedPortV2 {
   /** Exact leased transit source address of one current generation, present on
    * `handoff`. No wildcard, secondary-address or route inference. */
   transitSourceAddress: string;
+  /** Optional: the workload may open flows from `endpointAddress` and its published endpoint
+   * port(s) toward unprotected space, source-translated to `transitSourceAddress` and the
+   * published transit port (a range keeps the port). The protected union stays denied, and its
+   * endpoint ports may not overlap another publication's on the same address. Absent and
+   * `false` are the same canonical policy. */
+  symmetric?: boolean;
 }
 
 /** One exact host-origin flow: the node's own host network namespace dials one port of one local
@@ -88,6 +99,22 @@ export interface IManagedNftHostGrant {
   destinationPort: number;
 }
 
+/** One stateful one-way flow between two workloads behind the same router: the source workload opens
+ * connections to one exact port of the destination workload, which may only answer. Both addresses are
+ * exact current addresses of two different veth workload endpoints of the scope. It admits the tuple
+ * (a TCP opening only with SYN) and its ESTABLISHED replies in the default conntrack zone and nothing
+ * else: no reverse opening, no translation and no source-port selection. Grant the reverse direction as
+ * a second grant. */
+export interface IManagedNftWorkloadGrant {
+  protocol: 'tcp' | 'udp';
+  /** Exact unicast address of the dialling workload endpoint, never a prefix. */
+  sourceAddress: string;
+  /** Exact unicast address of the dialled workload endpoint, never a prefix. */
+  destinationAddress: string;
+  /** The destination workload's exact listening port, 1–65535; never a range. */
+  destinationPort: number;
+}
+
 /** One combined private/TUN/local/egress table; never compose a second ACCEPT over v1 terminal drops. */
 export interface IManagedNftRouterEgressScopeV2 {
   kind: 'routerEgress';
@@ -111,18 +138,33 @@ export interface IManagedNftRouterEgressScopeV2 {
    * workload. Absent and empty are the same canonical policy, digest and compiled graph; at most 1024,
    * held in a named set behind a constant number of rules. */
   hostGrants?: IManagedNftHostGrant[];
+  /** Optional stateful one-way workload-to-workload grants. Absent and empty are the same canonical
+   * policy, digest and compiled graph; at most 1024, held in two named sets behind four rules. They
+   * share the scope's set element budget with `hostGrants`. */
+  workloadGrants?: IManagedNftWorkloadGrant[];
 }
 
 /** One inbound uplink publication, compiled inside the same host-transit generation. */
 export interface IManagedNftPublishedPortV2 {
   protocol: 'tcp' | 'udp';
-  /** Published uplink port, 1–65535 and unique per protocol across the scope. */
+  /** Published uplink port, 1–65535; published ports never overlap per protocol across the scope. */
   hostPort: number;
+  /** Optional last port of a published range `hostPort..hostPortEnd`, greater than `hostPort`.
+   * A range keeps every port, so `targetPort` must equal `hostPort`; like one port it is one
+   * interval set element per set, and its translation keeps the port. Absent for one port, which
+   * is its only canonical form. */
+  hostPortEnd?: number;
   targetPort: number;
   /** Exact leased transit source address of one current allocation; it selects the handoff. */
   targetAddress: string;
   /** Exact current uplink address that publishes this port. No wildcard or route inference. */
   hostIp: string;
+  /** Optional: flows from `targetAddress` and the published target port(s) may leave through the
+   * uplink toward unprotected space, source-translated to `hostIp` and the published uplink port
+   * (a range keeps the port). The protected union stays denied, its target ports may not fall in
+   * a leased range of `targetAddress` or overlap another publication's. Absent and `false` are
+   * the same canonical policy. */
+  symmetric?: boolean;
 }
 
 /** Shared-host capture barrier and explicit outer SNAT; Docker forwarding remains a separate owner. */
@@ -143,6 +185,28 @@ export interface IManagedNftHostTransitScopeV2 {
    * host-local, a platform endpoint nor a leased transit source address. Absent and empty are the
    * same canonical policy; at most 1024, held in a named set behind a constant number of rules. */
   hostGrants?: IManagedNftHostGrant[];
+  /** Optional ids of `protection.platformEndpoints` this host serves itself, on an exact current address
+   * of the uplink or of a handoff link (rtnetlink verifies it at apply, recovery and inspection). Only a
+   * declared endpoint may hold a host address. Leased flows reach it from their exact handoff with the
+   * leased source address and a source port of the allocation's range for the endpoint's protocol; its
+   * ESTABLISHED replies return. Absent and empty are the same canonical policy, digest and compiled graph. */
+  localPlatformEndpoints?: string[];
+}
+
+/** One loopback TCP service that only one local user may dial. Every packet the host sends to the
+ * exact address and port from a socket of any other user is rejected with a TCP reset, after ordinary
+ * output destination NAT; the address and port arriving on any interface but loopback are dropped.
+ * The service must bind exactly this address: a wildcard listener stays reachable through others. */
+export interface IManagedNftLocalTcpPortOwner {
+  /** Exact IPv4 loopback host address in 127.0.0.0/8, e.g. `127.0.0.1`. Never a prefix or wildcard. */
+  address: string;
+  /** The service's exact listening port, 1–65535; never a range. */
+  port: number;
+  /** The only user id whose sockets may send to the port: the socket file's file-system uid as
+   * the user namespace owning the network namespace sees it, 0–4294967294. Packets without a socket file carry no uid and
+   * are not matched: kernel replies, the teardown of an orphaned socket, and in-kernel sockets such as NFS or CIFS clients,
+   * which only privileged mounts create. */
+  uid: number;
 }
 
 /** Host-wide IPv4 destination denial for caller-authenticated private allocation pools.
@@ -156,6 +220,10 @@ export interface IManagedNftAllocationPoolGuardScopeV2 {
    * listed pool, and their replies. Absent and empty are the same canonical policy; at most 1024,
    * held in a named set behind a constant number of rules. */
   hostGrants?: IManagedNftHostGrant[];
+  /** Optional host-wide loopback port ownership, compiled ahead of the guard in the same table.
+   * Absent and empty are the same canonical policy, digest and compiled graph; at most 8, one per
+   * exact address and port. */
+  localTcpPortOwners?: IManagedNftLocalTcpPortOwner[];
 }
 
 export interface IManagedNftPolicyV2 {