@push.rocks/smartnftables 4.0.0 → 4.0.1

package/changelog.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 2026-09-28 - 4.0.1
+
+### Fixes
+
+- Accept a `hostTransit` scope whose uplink addresses lie outside `protection.prefixes`. Every local address had to be inside the protected union, including the uplink lease and `snatAddress`, but the protected authority is cluster-wide and covers pools, resolvers, platform endpoints and the VPN, not a node's uplink lease, which is usually public; so every node with an uplink outside the plan was refused `INVALID` on each preparation. The host barrier now protects the uplink addresses itself: each one no protected prefix covers joins `protected_out` and `protected_back` as a `/32`, after the authority's prefixes, so a forwarded flow whose live or originally tracked destination is the host's uplink lease, or one sourced from it toward a handoff, is still denied, and the scope compiles exactly as if the authority had named that `/32`. Handoff addresses must still be protected, and a platform endpoint on an uplink address must still be protected and declared in `localPlatformEndpoints`. A scope whose uplink is covered keeps its exact digest and compiled bytes.
+
 ## 2026-09-28 - 4.0.0
 
 ### Breaking Changes

package/dist_rust/smartnftables_linux_amd64_musl.tsrust-build.json

@@ -1,12 +1,12 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "e879efc88997e38bb45c045fae690c3a07a3ff515c2a2581689466e3088ca236",
+  "binarySha256": "e57ca68c62eeca26010cf3acf5159dd360205566ca1e96189faebffc2d49b0d7",
   "buildInfo": {
     "projectName": "@push.rocks/smartnftables",
-    "projectVersion": "4.0.0",
-    "gitCommit": "7c66795f5e0edea87f2c9f7f1f70455cdf7e6bab",
+    "projectVersion": "4.0.1",
+    "gitCommit": "16dff8eb2060592212ea695074d7b53f39be8192",
     "gitDirty": false,
-    "builtAt": "2026-09-28T03:45:45.694Z",
+    "builtAt": "2026-09-28T17:43:55.875Z",
     "tsrustVersion": "1.15.1",
     "binary": "smartnftables",
     "target": "linux_amd64_musl"

package/dist_rust/smartnftables_linux_arm64_musl.tsrust-build.json

@@ -1,12 +1,12 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "268d3371a7986e7f1efcd6fb7fdd02b04635060a3e845c0ef45baec75e16a32a",
+  "binarySha256": "35d2fab639a6bc81cbe8395dc8d2dded56ce16712995007b127018fe0ed5ad20",
   "buildInfo": {
     "projectName": "@push.rocks/smartnftables",
-    "projectVersion": "4.0.0",
-    "gitCommit": "7c66795f5e0edea87f2c9f7f1f70455cdf7e6bab",
+    "projectVersion": "4.0.1",
+    "gitCommit": "16dff8eb2060592212ea695074d7b53f39be8192",
     "gitDirty": false,
-    "builtAt": "2026-09-28T03:45:55.540Z",
+    "builtAt": "2026-09-28T17:44:06.408Z",
     "tsrustVersion": "1.15.1",
     "binary": "smartnftables",
     "target": "linux_arm64_musl"

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@push.rocks/smartnftables',
-    version: '4.0.0',
+    version: '4.0.1',
     description: 'A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSwyQkFBMkI7SUFDakMsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLG1IQUFtSDtDQUNqSSxDQUFBIn0=

package/dist_ts/managed.egress.types.d.ts

@@ -175,6 +175,8 @@ export interface IManagedNftHostTransitScopeV2 {
         link: IManagedNftLocalLinkV2;
         allocations: IManagedNftHandoffAllocationV2[];
     }>;
+    /** Its addresses need not lie in `protection.prefixes`; the host barrier protects each
+     * uncovered one as a `/32` destination. Handoff addresses must be protected. */
     uplink: IManagedNftLocalLinkV2;
     /** Exact current address present on uplink. No masquerade or default-route inference. */
     snatAddress: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartnftables",
-  "version": "4.0.0",
+  "version": "4.0.1",
   "private": false,
   "description": "A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.",
   "main": "dist_ts/index.js",

package/readme.md

@@ -369,6 +369,15 @@ so foreign DNAT cannot turn a protected destination into a public exception or
 redirect public traffic into protected space. INPUT diversion, local OUTPUT into
 handoffs, unmatched handoff traffic and IPv6 forwarding are denied.
 
+Every handoff address and platform endpoint lies in the protected prefixes. The
+`hostTransit` uplink addresses need not: the authority is the platform's address
+space, and a node's uplink lease and `snatAddress` is usually a public address
+outside it. The host barrier protects the uplink addresses itself, adding each one
+no protected prefix covers as a `/32` after the authority's prefixes, so a
+forwarded flow whose current or original destination is the host's uplink address,
+or one sourced from it toward a handoff, is denied like any protected destination.
+A scope whose uplink the prefixes already cover compiles exactly as before.
+
 #### Published host ports
 
 `hostTransit.publishedPorts` is optional. Absent and empty are the same canonical
@@ -494,7 +503,8 @@ the ESTABLISHED original direction, a NEW opening per protocol with opening TCP
 restricted to SYN with FIN/RST/ACK clear, and the ESTABLISHED reply. The handoff
 ingress classification precedes the
 barrier's protected-source denial, because the uplink or management network that
-reaches a published port is itself protected space. The endpoint ingress
+reaches a published port can itself be protected space (an uplink address outside
+the protected prefixes is still guarded as a /32). The endpoint ingress
 classification matches the exact workload link, address and published endpoint
 port, and precedes every leased classifier of every generation: raw runs before
 conntrack, so a client whose source port equals a leased grant's destination port

package/rust/src/egress.host.rs

@@ -1,5 +1,22 @@
 use super::*;
 
+/// The host's own uplink addresses are protected destinations of this scope. A
+/// forwarded packet never reaches them, so a live or originally tracked tuple
+/// holding one is a translation into the host, and a forwarded one sourced from
+/// one is a spoof. The protected authority is cluster-wide and need not cover a
+/// node's uplink lease, which is usually public, so every uplink address outside
+/// it joins the barrier as a /32, in the uplink's canonical address order. An address the authority
+/// covers meets its prefix already, so a covered uplink compiles exactly as
+/// before.
+fn uplink_barrier(scope: &HostScope) -> Result<Vec<String>> {
+    let mut barrier = Vec::new();
+    for ip in &scope.uplink.required_ipv4_addresses {
+        if !covers_address(&scope.protection.prefixes, ip)? {
+            barrier.push(format!("{ip}/32"));
+        }
+    }
+    Ok(barrier)
+}
 fn protection(program: &mut Program<'_>, scope: &HostScope, reply: bool) -> Result<()> {
     let chain = if reply {
         "protected_back"
@@ -17,7 +34,8 @@ fn protection(program: &mut Program<'_>, scope: &HostScope, reply: bool) -> Resu
         expressions.extend(original_port(endpoint.port, false));
         program.end(chain, expressions, -5)?;
     }
-    for prefix in &scope.protection.prefixes {
+    let barrier = uplink_barrier(scope)?;
+    for prefix in scope.protection.prefixes.iter().chain(&barrier) {
         for original in [false, true] {
             let mut expressions = ipv4();
             expressions.extend(if original {

package/rust/src/egress.rs

@@ -1102,13 +1102,14 @@ fn normalize_host(value: &mut HostScope) -> Result<()> {
             .ok_or(Error::Invalid)?;
         require(local_addresses.contains(&endpoint.address))?;
     }
+    // Handoff addresses lie in protected space, checked per handoff below. An
+    // uplink address need not: the uplink lease and SNAT address is the host's
+    // public side, usually outside the protected authority, and the compiler
+    // adds each uncovered one to the host barrier as a protected destination.
     for ip in &local_addresses {
-        require(
-            covers_address(&value.protection.prefixes, ip)?
-                && value.protection.platform_endpoints.iter().all(|endpoint| {
-                    endpoint.address != *ip || value.local_platform_endpoints.contains(&endpoint.id)
-                }),
-        )?;
+        require(value.protection.platform_endpoints.iter().all(|endpoint| {
+            endpoint.address != *ip || value.local_platform_endpoints.contains(&endpoint.id)
+        }))?;
     }
     for handoff in &mut value.handoffs {
         normalize_link(&mut handoff.link)?;
@@ -1186,6 +1187,9 @@ mod routerequivalence_tests;
 #[path = "egress_tests.rs"]
 pub(crate) mod tests;
 #[cfg(test)]
+#[path = "egress_uplink_tests.rs"]
+mod uplink_tests;
+#[cfg(test)]
 #[path = "egress_workloadgrant_tests.rs"]
 pub(crate) mod workloadgrant_tests;
 impl Policy {

package/rust/src/egress_uplink_tests.rs

@@ -0,0 +1,159 @@
+//! Host transit on an uplink whose own addresses lie outside the protected
+//! authority: the cluster-wide authority covers pools, resolvers, platform
+//! endpoints and the VPN, not a node's uplink lease, which is usually public.
+//! The scope prepares, and the host barrier protects the uplink addresses itself.
+use super::hostgrant_tests::{
+    chains, decide, normalized, opening, prepared, Flow, ACK, ESTABLISHED,
+};
+use super::tests::host;
+use serde_json::{json, Value};
+
+const TRANSIT: [u8; 4] = [10, 240, 0, 2];
+const UPLINK: [u8; 4] = [198, 51, 100, 7];
+const PUBLIC: [u8; 4] = [198, 51, 100, 200];
+const HANDOFF_LINK: Option<(u32, &str)> = Some((4, "handoff"));
+const UPLINK_LINK: Option<(u32, &str)> = Some((2, "ens18"));
+
+/// The `preparePolicy` request Pallet 35.1.0 sent pallet-guard on a lab node,
+/// captured on the native IPC (lab-only private addresses). Its uplink lease and
+/// SNAT address 10.92.26.30 lies outside the protected prefix 10.240.0.0/12; the
+/// two other uplink addresses hold host-local platform endpoints inside it.
+fn captured() -> Value {
+    json!({"schemaVersion":2,"revision":1,"scope":{"kind":"hostTransit",
+        "protection":{
+            "authorityDigest":"sha256:f436a15c8c8f4d4f0f23bc9fc69f45a8c9137a9586db1d2c2be8c09dac3467c9",
+            "prefixes":["10.240.0.0/12"],
+            "platformEndpoints":[
+                {"id":"5aaa706266a3c4e9b0cc99eb354496a732f88cdf3d36fd5911ab6fbb98ef7489","address":"10.244.0.30","port":8443,"protocol":"udp"},
+                {"id":"0298aa0b89b4248e058b7a279abc9d9c1793d2d012752432e95881367b43d6ac","address":"10.245.0.30","port":27017,"protocol":"tcp"},
+                {"id":"f0808a59e876a51c1a8a5b8cf38e0fc323dd5309dec3a8890468a1afc69dc9ff","address":"10.245.0.30","port":9000,"protocol":"tcp"},
+                {"id":"f4744ddb8e7d63883a7fbd4635f3ee4a031650effaaf5c13a1c664182b2b0501","address":"10.245.0.30","port":8443,"protocol":"tcp"},
+                {"id":"8933bdd0997dc2b230b0be7960c1708a57d72a0fa9481ec4aa56b9311ae68751","address":"10.243.0.1","port":53,"protocol":"tcp"},
+                {"id":"6e88da7a803f69d77d8d8fd86c5952ae87c26c3172b2f9a751662793e0ee8a7e","address":"10.243.0.1","port":53,"protocol":"udp"}]},
+        "handoffs":[{
+            "link":{"interfaceIndex":11,"interfaceName":"phc05f15afde9d","interfaceKind":"veth",
+                "macAddress":"4a:d5:5b:95:91:fa","interfaceLinkIndex":2,"requiredIpv4Addresses":["10.240.0.0"]},
+            "allocations":[{
+                "lease":{"id":"049eda6820b222e7e371bb4d1e24a325ac92422cff1900443c1e74a9efbb5d5e","generation":1,
+                    "digest":"sha256:9a5635b213263796ac3b883cce942a0ca45161d9412ec6c6c9a5d748c22a3a7c"},
+                "transitSourceAddress":"10.240.0.1",
+                "sourcePortRanges":[{"protocol":"tcp","first":1024,"last":65535},{"protocol":"udp","first":1024,"last":65535}]}]}],
+        "uplink":{"interfaceIndex":2,"interfaceName":"enp1s0","interfaceKind":"ethernet",
+            "macAddress":"52:54:00:92:26:30","interfaceLinkIndex":2,
+            "requiredIpv4Addresses":["10.244.0.30","10.245.0.30","10.92.26.30"]},
+        "snatAddress":"10.92.26.30",
+        "localPlatformEndpoints":[
+            "0298aa0b89b4248e058b7a279abc9d9c1793d2d012752432e95881367b43d6ac",
+            "5aaa706266a3c4e9b0cc99eb354496a732f88cdf3d36fd5911ab6fbb98ef7489",
+            "f0808a59e876a51c1a8a5b8cf38e0fc323dd5309dec3a8890468a1afc69dc9ff",
+            "f4744ddb8e7d63883a7fbd4635f3ee4a031650effaaf5c13a1c664182b2b0501"]}})
+}
+/// The host fixture on a public uplink lease outside every protected prefix.
+fn public() -> Value {
+    let mut value = host();
+    value["scope"]["uplink"]["requiredIpv4Addresses"] = json!(["198.51.100.7"]);
+    value["scope"]["snatAddress"] = json!("198.51.100.7");
+    value
+}
+/// A leased opening from the handoff out through the uplink, to `destination`
+/// in the live tuple and `original` in the originally tracked one.
+fn egress(destination: [u8; 4], original: [u8; 4]) -> Flow {
+    Flow {
+        source: TRANSIT,
+        destination,
+        source_port: 10500,
+        destination_port: 443,
+        original: (TRANSIT, original, 10500, 443),
+        ..opening(HANDOFF_LINK, UPLINK_LINK)
+    }
+}
+
+#[test]
+fn host_transit_prepares_the_captured_lab_request_with_an_unprotected_uplink_lease() {
+    // Refused INVALID by 4.0.0: the uplink lease was required to be protected.
+    let lab = prepared(captured());
+    // The lease joins the barrier as a /32, exactly as if the authority had
+    // named it; the covered uplink addresses meet their prefix already.
+    let mut value = captured();
+    value["scope"]["protection"]["prefixes"] = json!(["10.240.0.0/12", "10.92.26.30/32"]);
+    assert_eq!(chains(&lab), chains(&prepared(value)));
+}
+
+#[test]
+fn host_transit_uplink_addresses_need_no_protected_prefix_but_handoff_addresses_do() {
+    assert!(normalized(public()).is_ok());
+    // A handoff address outside the authority still refuses; the control
+    // covering it prepares.
+    let handoff = |prefix: &str| {
+        let mut value = public();
+        value["scope"]["protection"]["prefixes"] =
+            json!([prefix, "192.0.2.0/24", "203.0.113.10/32"]);
+        normalized(value)
+    };
+    assert!(handoff("10.240.0.2/32").is_err());
+    assert!(handoff("10.240.0.0/30").is_ok());
+    // A platform endpoint on the uplink lease lies in protected space, and it
+    // still refuses unless declared host-local.
+    let mut value = public();
+    value["scope"]["protection"]["prefixes"] =
+        json!(["10.0.0.0/8", "192.0.2.0/24", "198.51.100.7/32"]);
+    value["scope"]["protection"]["platformEndpoints"] = json!([
+        {"id":"hub","address":"198.51.100.7","protocol":"tcp","port":8443}]);
+    assert!(normalized(value.clone()).is_err());
+    value["scope"]["localPlatformEndpoints"] = json!(["hub"]);
+    assert!(normalized(value).is_ok());
+}
+
+#[test]
+fn host_transit_barrier_protects_an_unprotected_uplink_lease_as_a_destination() {
+    let with = prepared(public());
+    // Positive control: leased egress to public space passes, including a flow
+    // another owner translated between two public destinations.
+    for flow in [egress(PUBLIC, PUBLIC), egress(PUBLIC, [198, 51, 100, 201])] {
+        assert_eq!(decide(&with, "forward", &flow).verdict, 1);
+    }
+    // A flow whose live or originally tracked destination is the host's own
+    // uplink lease is a translation into the host: the barrier refuses it.
+    for flow in [egress(PUBLIC, UPLINK), egress(UPLINK, PUBLIC)] {
+        let decision = decide(&with, "forward", &flow);
+        assert_eq!(
+            (decision.verdict, decision.chain.as_str()),
+            (0, "protected_out")
+        );
+    }
+    // A packet forwarded toward the handoff from the uplink lease is a spoof.
+    let reply = Flow {
+        input: UPLINK_LINK,
+        output: HANDOFF_LINK,
+        source: UPLINK,
+        destination: TRANSIT,
+        source_port: 443,
+        destination_port: 10500,
+        tcp_flags: ACK,
+        state: ESTABLISHED,
+        reply: true,
+        ..egress(PUBLIC, PUBLIC)
+    };
+    let decision = decide(&with, "forward", &reply);
+    assert_eq!(
+        (decision.verdict, decision.chain.as_str()),
+        (0, "protected_back")
+    );
+    let reply = Flow {
+        source: PUBLIC,
+        ..reply
+    };
+    assert_eq!(decide(&with, "forward", &reply).verdict, 1);
+}
+
+#[test]
+fn host_transit_covered_uplink_compiles_exactly_the_authority_barrier() {
+    // The fixture's uplink lies inside the authority: no address joins the
+    // barrier, and its compiled bytes stay frozen by the golden host test.
+    let covered = chains(&prepared(host()));
+    let public = chains(&prepared(public()));
+    for name in ["protected_out", "protected_back"] {
+        // One /32 adds a live and an originally tracked destination check.
+        assert_eq!(public[name].len(), covered[name].len() + 2, "{name}");
+    }
+}

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartnftables',
-  version: '4.0.0',
+  version: '4.0.1',
   description: 'A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.'
 }

package/ts/managed.egress.types.ts

@@ -172,6 +172,8 @@ export interface IManagedNftHostTransitScopeV2 {
   kind: 'hostTransit';
   protection: IManagedNftProtectionV2;
   handoffs: Array<{ link: IManagedNftLocalLinkV2; allocations: IManagedNftHandoffAllocationV2[] }>;
+  /** Its addresses need not lie in `protection.prefixes`; the host barrier protects each
+   * uncovered one as a `/32` destination. Handoff addresses must be protected. */
   uplink: IManagedNftLocalLinkV2;
   /** Exact current address present on uplink. No masquerade or default-route inference. */
   snatAddress: string;