@push.rocks/smartnftables 4.3.1 → 4.4.0

package/changelog.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 2026-10-06 - 4.4.0
+
+### Features
+
+- `allocationPoolGuard.publishedPorts`: publications are exceptions of the allocation-pool guard. A `hostTransit` publication translates an inbound uplink flow to the router's transit address, which lies in a guarded pool, so the guard dropped every published flow in FORWARD by its current destination (and every reply by its current source) on any host that runs both tables: Pallet's docker-shared lab node delivered nothing on its published ports (serve.zone lab 2026-10-06, D12). Each entry `{ protocol, hostPort, hostPortEnd?, targetPort, targetAddress }` admits the flow translated from outside every pool to that exact pool address and port, and its replies, in the default conntrack zone: two or three rules in the guard chain after the original-destination denial, around the CONSTANT interval set `pool_published`. Absent and empty keep every guard's digest and compiled bytes. Readme: "Publications through the allocation-pool guard". Tests: `egress_poolguardpublished_tests` (exact admission, and the guard's own refusal for 18 foreign flows (other address, port, protocol, zone and untranslated flows), unchanged local and reply chains, canonical form, refusals, the largest guard's atomic budget).
+
+### Maintenance
+
+- Release tooling: pnpm 12.8.1, `@git.zone/cli` ^8.8.2, `@git.zone/tstest` ^7.1.0 and `@git.zone/tsrust` 4.0.0. tsrust 4 always remaps local paths and fails a build whose binary still records one, so the obsolete `remapLocalPaths` setting leaves `.smartconfig.json`.
+
 ## 2026-10-02 - 4.3.1
 
 ### Fixes

package/dist_rust/smartnftables_linux_amd64_musl.tsrust-build.json

@@ -1,13 +1,13 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "cf73bfcf658ee25f8a084e50cefb3f43d2f949b0cdcc46a57b4e91a9c0497a20",
+  "binarySha256": "92ddb3d386ae7d83ce27c0df8b54bb08ce3bb54cba71e80df8e0c3e808e4da7b",
   "buildInfo": {
     "projectName": "@push.rocks/smartnftables",
-    "projectVersion": "4.3.1",
-    "gitCommit": "134a7f1fd3986cc97c9450108f7a79c7b5b395ec",
+    "projectVersion": "4.4.0",
+    "gitCommit": "77c4a57ed74dce10ee91ef180972ebd9cc821211",
     "gitDirty": false,
-    "builtAt": "2026-10-02T22:57:27.524Z",
-    "tsrustVersion": "3.0.0",
+    "builtAt": "2026-10-06T03:48:00.001Z",
+    "tsrustVersion": "4.0.0",
     "binary": "smartnftables",
     "target": "linux_amd64_musl"
   }

package/dist_rust/smartnftables_linux_arm64_musl.tsrust-build.json

@@ -1,13 +1,13 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "ae5bf59b529f990c5f0a5ff8c8898cb42d3dcb5ce724c3786f64c69eb5f03bdd",
+  "binarySha256": "889d263bb28613ed54717f261f3fb75f5e394e88d9cf9632d611a7fbe621c582",
   "buildInfo": {
     "projectName": "@push.rocks/smartnftables",
-    "projectVersion": "4.3.1",
-    "gitCommit": "134a7f1fd3986cc97c9450108f7a79c7b5b395ec",
+    "projectVersion": "4.4.0",
+    "gitCommit": "77c4a57ed74dce10ee91ef180972ebd9cc821211",
     "gitDirty": false,
-    "builtAt": "2026-10-02T22:57:37.239Z",
-    "tsrustVersion": "3.0.0",
+    "builtAt": "2026-10-06T03:48:09.553Z",
+    "tsrustVersion": "4.0.0",
     "binary": "smartnftables",
     "target": "linux_arm64_musl"
   }

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@push.rocks/smartnftables',
-    version: '4.3.1',
+    version: '4.4.0',
     description: 'A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSwyQkFBMkI7SUFDakMsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLG1IQUFtSDtDQUNqSSxDQUFBIn0=

package/dist_ts/managed.egress.types.d.ts

@@ -217,17 +217,38 @@ export interface IManagedNftLocalTcpPortOwner {
      * which only privileged mounts create. */
     uid: number;
 }
+/** One publication an allocation-pool guard admits into a pool: a flow whose original destination lies
+ * outside every listed pool, on `hostPort` (or the range `hostPort..hostPortEnd`), translated to exactly
+ * `targetAddress` and `targetPort`, and its replies, in the default conntrack zone. The guard checks
+ * no link and no uplink address: the scope that translates the flow (`hostTransit.publishedPorts`)
+ * binds those. Compile the same publication into the guard and the host-transit scope it crosses. */
+export interface IManagedNftPoolGuardPublishedPort {
+    protocol: 'tcp' | 'udp';
+    /** Published port, 1–65535; each protocol and port is published at most once per guard. */
+    hostPort: number;
+    /** Optional last port of a published range, greater than `hostPort`; a range keeps every port,
+     * so `targetPort` must equal `hostPort`. Absent for one port, its only canonical form. */
+    hostPortEnd?: number;
+    targetPort: number;
+    /** Exact unicast address inside a listed pool that the publication is translated to. */
+    targetAddress: string;
+}
 /** Host-wide IPv4 destination denial for caller-authenticated private allocation pools.
- * It has no link dependency; exact host grants are its only exceptions. It is not allocation-release or boot-order proof. */
+ * It has no link dependency; exact host grants and publications are its only exceptions. It is not
+ * allocation-release or boot-order proof. */
 export interface IManagedNftAllocationPoolGuardScopeV2 {
     kind: 'allocationPoolGuard';
     authorityDigest: string;
     /** Complete current pool list: 1–64 canonical, disjoint RFC1918 prefixes. */
     prefixes: string[];
-    /** The only exceptions to the guard: exact host-origin flows whose `destinationAddress` lies in a
-     * listed pool, and their replies. Absent and empty are the same canonical policy; at most 1024,
-     * held in a named set behind a constant number of rules. */
+    /** Exceptions to the guard: exact host-origin flows whose `destinationAddress` lies in a listed
+     * pool, and their replies. Absent and empty are the same canonical policy; at most 1024, held in a
+     * named set behind a constant number of rules. */
     hostGrants?: IManagedNftHostGrant[];
+    /** Exceptions to the guard: publications translated from outside every listed pool into one, and
+     * their replies. Absent and empty are the same canonical policy, digest and compiled graph; at most
+     * 1024, held in a named set behind a constant number of rules. */
+    publishedPorts?: IManagedNftPoolGuardPublishedPort[];
     /** Optional host-wide loopback port ownership, compiled ahead of the guard in the same table.
      * Absent and empty are the same canonical policy, digest and compiled graph; at most 8, one per
      * exact address and port. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartnftables",
-  "version": "4.3.1",
+  "version": "4.4.0",
   "private": false,
   "description": "A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.",
   "main": "dist_ts/index.js",
@@ -9,11 +9,11 @@
   "author": "Task Venture Capital GmbH",
   "license": "MIT",
   "devDependencies": {
-    "@git.zone/cli": "^8.4.0",
+    "@git.zone/cli": "^8.8.2",
     "@git.zone/tsbuild": "^5.1.2",
     "@git.zone/tsrun": "^3.0.2",
-    "@git.zone/tsrust": "3.0.0",
-    "@git.zone/tstest": "^7.0.0",
+    "@git.zone/tsrust": "4.0.0",
+    "@git.zone/tstest": "^7.1.0",
     "@types/node": "^26.6.3",
     "typescript": "^7.0.2"
   },

package/readme.md

@@ -324,7 +324,7 @@ allocation-pool guard policy kinds.
 | --- | --- |
 | `routerEgress` | Private `endpoints` and `rules`, one exact `links` binding per endpoint, a separate veth `handoff`, `protection`, and active `generations`. Private veth/TUN/local DNS and egress share one table so terminal private denial cannot override a separate egress table. Optional `publishedPorts` add the inbound second hop from the handoff to a workload endpoint, one port or a port range; both directions are classified into the default conntrack zone ahead of every leased classifier, so a published endpoint port is dedicated to its publication and never becomes leased egress. A `symmetric` publication also lets the workload open flows from its published ports. Optional `hostGrants` forward exact host-origin flows from the handoff to a workload endpoint. Optional `workloadGrants` let one workload open one exact port of another, one way. |
 | `hostTransit` | Exact handoff `link`/`allocations` pairs, complete `protection`, an explicit veth or Ethernet `uplink`, and its current `snatAddress`. It checks each handoff's leased source address and protocol/port range, default conntrack zone, direction, uplink, and protected destinations before outer SNAT. Optional `publishedPorts` add inbound uplink destination NAT inside the same generation, one port or a port range, and a `symmetric` publication also carries the workload's own flows from its published ports out through the uplink. Optional `hostGrants` let the host's own address on a handoff dial exact workload ports. Optional `localPlatformEndpoints` serve platform endpoints on the host's own addresses to leased flows. Optional `exclusiveForwarding` makes the table the host's only forwarding owner: every other forwarded packet drops. |
-| `allocationPoolGuard` | An authenticated `authorityDigest` and complete current allocation-pool `prefixes`. Installs host-wide IPv4 destination denial before any handoff exists, without link, uplink or SNAT dependencies. Optional `hostGrants` are its only exceptions. Optional `localTcpPortOwners` restrict loopback TCP ports to one local user each. |
+| `allocationPoolGuard` | An authenticated `authorityDigest` and complete current allocation-pool `prefixes`. Installs host-wide IPv4 destination denial before any handoff exists, without link, uplink or SNAT dependencies. Optional `hostGrants` and `publishedPorts` are its only exceptions. Optional `localTcpPortOwners` restrict loopback TCP ports to one local user each. |
 
 `allocationPoolGuard` accepts 1–64 canonical, disjoint RFC1918 prefixes. Supply
 the actual allocation pools, not the broader protected union containing management
@@ -742,6 +742,42 @@ These flows need no private `rules`. A private rule is stateless: answering thro
 private rules needs a reverse rule, which would also let the destination open toward
 the source.
 
+#### Publications through the allocation-pool guard
+
+A `hostTransit` publication translates an inbound flow from the uplink into the
+router's transit address, which lies in a guarded pool, so the guard denies it by
+its current destination and its replies by their current source.
+`allocationPoolGuard.publishedPorts` is optional and lists the publications the
+guard admits: each `{ protocol, hostPort, hostPortEnd?, targetPort, targetAddress }`
+names the published port or range, and the exact pool address and port it is
+translated to (a range keeps every port, so `targetPort` equals `hostPort`). The
+target must be a unicast address inside a listed pool; each protocol and port is
+published at most once; up to 1024 fit. Compile the same publications into the
+guard and into the host-transit scope that translates them, which binds the uplink
+address and the handoff link the guard does not check.
+
+```typescript
+const guard: IManagedNftPolicyV2 = { schemaVersion: 2, revision: 1, scope: {
+  kind: 'allocationPoolGuard', authorityDigest, prefixes: ['10.240.0.0/16', '10.241.0.0/16'],
+  publishedPorts: [{ protocol: 'tcp', hostPort: 443, targetPort: 443, targetAddress: '10.240.0.1' },
+    { protocol: 'udp', hostPort: 20000, hostPortEnd: 20200, targetPort: 20000, targetAddress: '10.240.0.1' }] } };
+```
+
+The admissions sit in the guard chain right after its denial of every pool as an
+original destination, so only a flow translated from outside every pool can match,
+and ahead of every current-address denial: an ESTABLISHED packet of either
+direction and a NEW opening per protocol (TCP only with SYN and FIN/RST/ACK clear),
+in the default conntrack zone, each one lookup of the protocol, the reply tuple's
+source address and port (where the flow was translated to, in both directions) and
+the originally tracked destination port in the CONSTANT interval set
+`pool_published`. Another target, target port, published port, protocol or zone, a
+non-SYN opening and an original destination inside a pool meet the guard unchanged.
+A publication is the exception of every hook it crosses; a forwarded publication
+crosses FORWARD alone. Absent and empty are the same canonical policy, digest and
+compiled bytes. The largest guard (64 pools, 1024 host grants, 8 loopback port
+owners and 1024 publications) compiles to 99,688 rule bytes and 74,640 element
+bytes at revision 1.
+
 #### Loopback TCP port owners
 
 `allocationPoolGuard.localTcpPortOwners` is optional and restricts a loopback TCP

package/rust/src/egress.hostgrant.rs

@@ -45,6 +45,14 @@ pub(super) fn ct_to(key: u32, original: bool, index: u32) -> Attr {
     }
     store("ct", data, index)
 }
+/// A conntrack key of the reply direction's tuple.
+pub(super) fn ct_reply_to(key: u32, index: u32) -> Attr {
+    store(
+        "ct",
+        vec![Attr::u32(2, key), Attr::bytes(3, vec![1])],
+        index,
+    )
+}
 pub(super) fn lookup(set: &str) -> Attr {
     expr(
         "lookup",

package/rust/src/egress.keys.rs

@@ -2,7 +2,7 @@
 //! the loads that build a key in consecutive 32-bit registers, element bounds
 //! built field by field, the disjoint union the kernel's interval backend needs,
 //! and set declarations that are never created empty.
-use super::hostgrant::{ct_to, lookup, meta_to, payload_to, register};
+use super::hostgrant::{ct_reply_to, ct_to, lookup, meta_to, payload_to, register};
 use super::*;
 
 /// Field byte lengths. Each field occupies whole 32-bit registers of the key.
@@ -65,6 +65,12 @@ impl Loads {
     pub(super) fn original_port(&mut self, source: bool) -> &mut Self {
         self.push(|at| ct_to(if source { 11 } else { 12 }, true, at), PORT)
     }
+    /// The reply tuple's source address and port: where a translated flow was
+    /// translated to, whichever direction the packet travels.
+    pub(super) fn translated(&mut self) -> &mut Self {
+        self.push(|at| ct_reply_to(19, at), ADDRESS)
+            .push(|at| ct_reply_to(11, at), PORT)
+    }
     pub(super) fn zone(&mut self) -> &mut Self {
         self.push(|at| ct_to(17, false, at), ZONE)
     }

package/rust/src/egress.poolguard.rs

@@ -1,5 +1,11 @@
+use super::keys::{self, Key, Loads, ADDRESS, PORT, PROTOCOL};
 use super::*;
 
+/// Publications translated into a pool: the protocol, the address and port the
+/// flow was translated to, and its originally tracked destination port. Port fields are inclusive intervals, so one element holds
+/// one port or a whole range.
+const PUBLISHED: &str = "pool_published";
+
 pub(super) fn compile(program: &mut Program<'_>, scope: &AllocationPoolGuardScope) -> Result<()> {
     for (name, hook) in [("input", 1), ("forward", 2), ("output", 3)] {
         program.chain(name, Some((hook, 0, "filter")))?;
@@ -18,6 +24,9 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &AllocationPoolGuardScop
         hostgrant::tuple_set(program, &scope.host_grants, |_| Ok(None))?;
         hostgrant::admissions(program, ["output", "input"], false, |_| vec![])?;
     }
+    if !scope.published_ports.is_empty() {
+        published_set(program, scope)?;
+    }
     for name in ["input", "forward", "output"] {
         program.jump(name, ipv4(), "pool_guard")?;
     }
@@ -25,6 +34,11 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &AllocationPoolGuardScop
     for prefix in &scope.prefixes {
         program.end("pool_guard", original_address(prefix, false)?, 0)?;
     }
+    // Publications follow that denial, so only a flow translated from outside
+    // every pool can match one, and precede every current-address denial.
+    if !scope.published_ports.is_empty() {
+        published(program, scope)?;
+    }
     // GOTO, not JUMP: RETURN from pool_reply must return to the base chain,
     // skipping current-destination denial for legitimate reverse-SNAT replies.
     let mut reply = ct(1, None, vec![1]);
@@ -40,6 +54,69 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &AllocationPoolGuardScop
     program.end("pool_reply", vec![], -5)
 }
 
+/// The publications of the scope as one interval set.
+fn published_set(program: &mut Program<'_>, scope: &AllocationPoolGuardScope) -> Result<()> {
+    let mut elements = Vec::new();
+    for port in &scope.published_ports {
+        elements.push(
+            Key::default()
+                .protocol(&port.protocol)
+                .address(&port.target_address)?
+                .span(port.target_port, port.target_last())
+                .span(port.host_port, port.host_last())
+                .element(None),
+        );
+    }
+    keys::interval(
+        program,
+        PUBLISHED,
+        2,
+        &[PROTOCOL, ADDRESS, PORT, PORT],
+        None,
+        elements,
+    )
+    .map(|_| ())
+}
+/// The admissions of every publication, whatever their number: behind the
+/// default conntrack zone, an ESTABLISHED packet of either direction, and a NEW
+/// opening per protocol (TCP only with SYN and FIN/RST/ACK clear). Each looks its
+/// flow up once by the reply tuple's source, which is the address and port the
+/// flow was translated to in both directions, and the originally tracked
+/// destination port. They run in the guard chain after the original-destination
+/// denial, so a flow whose original destination lies in a pool never reaches
+/// them. A publication is the exception of every hook it crosses: on a host that
+/// forwards it, that is FORWARD alone.
+fn published(program: &mut Program<'_>, scope: &AllocationPoolGuardScope) -> Result<()> {
+    let lookup = || {
+        let mut loads = Loads::new();
+        loads.protocol().translated().original_port(false);
+        loads.lookup(PUBLISHED)
+    };
+    let envelope = |connection_state: u32| {
+        let mut result = ct(17, None, 0_u16.to_ne_bytes().to_vec());
+        result.extend(state(connection_state));
+        result
+    };
+    let mut established = envelope(2);
+    established.extend(lookup());
+    program.end("pool_guard", established, 1)?;
+    let transports: std::collections::BTreeSet<&str> = scope
+        .published_ports
+        .iter()
+        .map(|port| port.protocol.as_str())
+        .collect();
+    for transport in transports {
+        let mut opening = envelope(8);
+        opening.extend(meta(16, vec![protocol(transport)]));
+        if transport == "tcp" {
+            opening.extend(opening_tcp());
+        }
+        opening.extend(lookup());
+        program.end("pool_guard", opening, 1)?;
+    }
+    Ok(())
+}
+
 /// The exact loopback TCP destination: IPv4, TCP, address and port.
 fn local_tcp_port(owner: &LocalTcpPortOwner) -> Result<Vec<Attr>> {
     let mut result = ipv4();

package/rust/src/egress.rs

@@ -282,15 +282,43 @@ pub struct LocalTcpPortOwner {
     pub port: u16,
     pub uid: u32,
 }
+/// One publication a guard admits into a pool: a forwarded flow whose original
+/// destination lies outside every guarded pool, on the published port or range,
+/// translated to exactly `target_address` and the target port(s), and its replies.
+/// A range keeps every port: `target_port` equals `host_port`. Absent for one port.
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq, PartialOrd, Ord)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct PoolGuardPublishedPort {
+    pub protocol: String,
+    pub host_port: u16,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub host_port_end: Option<u16>,
+    pub target_port: u16,
+    pub target_address: String,
+}
+impl PoolGuardPublishedPort {
+    /// Last published port; equal to `host_port` for one port.
+    pub fn host_last(&self) -> u16 {
+        self.host_port_end.unwrap_or(self.host_port)
+    }
+    /// Last target port the publication translates to.
+    pub fn target_last(&self) -> u16 {
+        self.target_port + (self.host_last() - self.host_port)
+    }
+}
 #[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct AllocationPoolGuardScope {
     pub authority_digest: String,
     pub prefixes: Vec<String>,
-    /// The only exceptions to the guard: exact host-origin flows into a pool.
+    /// Exceptions to the guard: exact host-origin flows into a pool.
     /// Absent and empty are the same canonical policy.
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub host_grants: Vec<HostGrant>,
+    /// Exceptions to the guard: forwarded publications translated into a pool,
+    /// and their replies. Absent and empty are the same canonical policy.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub published_ports: Vec<PoolGuardPublishedPort>,
     /// Host-wide loopback port ownership. Absent and empty are the same
     /// canonical policy.
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
@@ -974,8 +1002,33 @@ fn normalize_pool_guard(value: &mut AllocationPoolGuardScope) -> Result<()> {
         require(covers_address(&value.prefixes, &grant.destination_address)?)
     })?;
     value.host_grants = grants;
+    normalize_pool_guard_published(value)?;
     normalize_local_tcp_port_owners(&mut value.local_tcp_port_owners)
 }
+/// A guard publication translates into exactly one address of a guarded pool,
+/// keeping a range's ports, and publishes each protocol and port at most once,
+/// as a host-transit scope does: sorted by protocol and first port, disjoint
+/// neighbours are disjoint spans.
+fn normalize_pool_guard_published(value: &mut AllocationPoolGuardScope) -> Result<()> {
+    let mut ports = std::mem::take(&mut value.published_ports);
+    crate::capacity("publishedPorts", PUBLISHED_PORTS, ports.len())?;
+    ports.sort();
+    for (index, port) in ports.iter().enumerate() {
+        require(
+            protocol(&port.protocol)
+                && port.host_port > 0
+                && port.target_port > 0
+                && published_span(port.host_port, port.host_port_end, port.target_port)
+                && (index == 0
+                    || ports[index - 1].protocol != port.protocol
+                    || ports[index - 1].host_last() < port.host_port),
+        )?;
+        unicast(&port.target_address)?;
+        require(covers_address(&value.prefixes, &port.target_address)?)?;
+    }
+    value.published_ports = ports;
+    Ok(())
+}
 /// One exact IPv4 loopback host address and port per entry, never a prefix,
 /// wildcard or range, each with exactly one owning uid. `(uid_t)-1` is not a
 /// user; it is the kernel's "unchanged" sentinel.
@@ -1242,6 +1295,9 @@ pub(crate) mod localplatform_tests;
 #[path = "egress_localport_tests.rs"]
 pub(crate) mod localport_tests;
 #[cfg(test)]
+#[path = "egress_poolguardpublished_tests.rs"]
+mod poolguardpublished_tests;
+#[cfg(test)]
 #[path = "egress_publishedrange_tests.rs"]
 mod publishedrange_tests;
 #[cfg(test)]

package/rust/src/egress_hostgrant_tests.rs

@@ -357,6 +357,18 @@ fn load(flow: &Flow, name: &str, fields: &[Attr]) -> Option<Vec<u8>> {
             assert_eq!(loaded.len() as u32, wire::number(fields, 4).unwrap());
             loaded
         }
+        "ct" if wire::one(fields, 3).is_ok_and(|direction| direction.value == vec![1]) => {
+            // The reply tuple's source is where the flow was translated to: the
+            // live destination of the original direction, the live source of the
+            // reply, as a filter hook after destination NAT sees them.
+            match wire::number(fields, 2).unwrap() {
+                19 if flow.reply => flow.source.to_vec(),
+                19 => flow.destination.to_vec(),
+                11 if flow.reply => flow.source_port.to_be_bytes().to_vec(),
+                11 => flow.destination_port.to_be_bytes().to_vec(),
+                key => panic!("ct reply {key}"),
+            }
+        }
         "ct" => {
             if let Ok(direction) = wire::one(fields, 3) {
                 assert_eq!(direction.value, vec![0]);

package/rust/src/egress_poolguardpublished_tests.rs

@@ -0,0 +1,418 @@
+//! Publications through the allocation-pool guard: a publication translates an
+//! inbound flow from the uplink into a pool (the router's transit address), which
+//! the guard denies by its current destination and, on the reply, by its current
+//! source. A guard publication admits exactly that forwarded flow and its replies;
+//! every other tuple meets the decision of the guard without it.
+use super::hostgrant_tests::{
+    bytes, chains, decide, granted, host_grant, normalized, prepared, Flow, ACK, ESTABLISHED,
+};
+use super::tests::pool_guard;
+use super::Prepared;
+use serde_json::{json, Value};
+
+const NEW: u32 = 8;
+const SYN: u8 = 0x02;
+const CLIENT: [u8; 4] = [198, 51, 100, 7];
+const UPLINK: [u8; 4] = [192, 0, 2, 2];
+const TRANSIT: [u8; 4] = [10, 240, 0, 1];
+const ENS18: Option<(u32, &str)> = Some((2, "ens18"));
+const HANDOFF: Option<(u32, &str)> = Some((4, "handoff"));
+
+fn port(protocol: &str, first: u16, end: Option<u16>, target: u16, address: &str) -> Value {
+    let mut value =
+        json!({"protocol":protocol,"hostPort":first,"targetPort":target,"targetAddress":address});
+    if let Some(end) = end {
+        value["hostPortEnd"] = json!(end);
+    }
+    value
+}
+fn published(mut value: Value, ports: Value) -> Value {
+    value["scope"]["publishedPorts"] = ports;
+    value
+}
+/// One port translated to another, and a range that keeps every port.
+fn fixture() -> Value {
+    published(
+        pool_guard(),
+        json!([
+            port("tcp", 443, None, 8443, "10.240.0.1"),
+            port("udp", 20000, Some(20200), 20000, "10.240.0.1")
+        ]),
+    )
+}
+/// The opening of an inbound publication as the forward hook sees it: after the
+/// destination NAT to the transit address, the original destination still the uplink.
+fn inbound(protocol: u8, outside: u16, inside: u16) -> Flow {
+    Flow {
+        input: ENS18,
+        output: HANDOFF,
+        protocol,
+        source: CLIENT,
+        destination: TRANSIT,
+        source_port: 40000,
+        destination_port: inside,
+        tcp_flags: if protocol == 6 { SYN } else { 0 },
+        state: NEW,
+        reply: false,
+        zone: 0,
+        original: (CLIENT, UPLINK, 40000, outside),
+        uid: None,
+        label: [0; 16],
+    }
+}
+/// The workload's reply as the forward hook sees it, before the reverse NAT.
+fn reply(flow: Flow) -> Flow {
+    Flow {
+        input: flow.output,
+        output: flow.input,
+        source: flow.destination,
+        destination: flow.source,
+        source_port: flow.destination_port,
+        destination_port: flow.source_port,
+        tcp_flags: if flow.protocol == 6 { ACK } else { 0 },
+        state: ESTABLISHED,
+        reply: true,
+        ..flow
+    }
+}
+/// Every admitted variant: the opening, the established original direction and
+/// the reply, for the one-port and every boundary of the range.
+fn admitted() -> Vec<Flow> {
+    let mut flows = Vec::new();
+    for opening in [
+        inbound(6, 443, 8443),
+        inbound(17, 20000, 20000),
+        inbound(17, 20100, 20100),
+        inbound(17, 20200, 20200),
+    ] {
+        flows.push(opening);
+        flows.push(Flow {
+            state: ESTABLISHED,
+            tcp_flags: if opening.protocol == 6 { ACK } else { 0 },
+            ..opening
+        });
+        flows.push(reply(opening));
+    }
+    flows
+}
+/// Tuples the publications do not name, each of which the guard alone denies.
+fn foreign() -> Vec<Flow> {
+    let tcp = inbound(6, 443, 8443);
+    let udp = inbound(17, 20000, 20000);
+    vec![
+        // An original destination in a pool: no translation from outside every pool.
+        Flow {
+            original: (CLIENT, [10, 240, 0, 9], 40000, 443),
+            ..tcp
+        },
+        Flow {
+            original: (CLIENT, TRANSIT, 40000, 8443),
+            ..tcp
+        },
+        reply(Flow {
+            original: (CLIENT, [10, 241, 0, 9], 40000, 20000),
+            ..udp
+        }),
+        // Another target address, target port, published port or protocol.
+        Flow {
+            destination: [10, 240, 0, 3],
+            ..tcp
+        },
+        Flow {
+            destination_port: 8444,
+            ..tcp
+        },
+        Flow {
+            original: (CLIENT, UPLINK, 40000, 444),
+            ..tcp
+        },
+        Flow {
+            original: (CLIENT, UPLINK, 40000, 8443),
+            ..tcp
+        },
+        Flow {
+            protocol: 17,
+            tcp_flags: 0,
+            ..tcp
+        },
+        Flow {
+            protocol: 6,
+            tcp_flags: SYN,
+            ..udp
+        },
+        inbound(17, 19999, 19999),
+        inbound(17, 20201, 20201),
+        reply(inbound(17, 20201, 20201)),
+        // Another conntrack zone, a non-SYN opening, a reply that is not ESTABLISHED
+        // and the reply direction carrying the original direction's tuple.
+        Flow { zone: 7, ..tcp },
+        reply(Flow { zone: 7, ..udp }),
+        Flow {
+            tcp_flags: ACK,
+            ..tcp
+        },
+        Flow {
+            state: NEW,
+            ..reply(tcp)
+        },
+    ]
+}
+
+#[test]
+fn pool_guard_publications_admit_exactly_the_forwarded_flow_and_its_reply() {
+    let baseline = prepared(pool_guard());
+    let with = prepared(fixture());
+    for flow in admitted() {
+        assert_eq!(
+            decide(&baseline, "forward", &flow).verdict,
+            0,
+            "{:?} baseline",
+            flow.destination_port
+        );
+        let decision = decide(&with, "forward", &flow);
+        assert_eq!(
+            (decision.verdict, decision.chain.as_str()),
+            (1, "pool_guard"),
+            "{:?}",
+            flow.destination_port
+        );
+    }
+    for (index, flow) in foreign().iter().enumerate() {
+        assert_eq!(
+            decide(&baseline, "forward", flow).verdict,
+            0,
+            "variant {index} baseline"
+        );
+        assert_eq!(
+            decide(&with, "forward", flow),
+            decide(&baseline, "forward", flow),
+            "variant {index}"
+        );
+    }
+    // The reply direction carrying the original direction's tuple is not from a
+    // pool, so the guard passes it with or without publications.
+    let turned = Flow {
+        reply: true,
+        state: ESTABLISHED,
+        ..inbound(6, 443, 8443)
+    };
+    assert_eq!(
+        decide(&with, "forward", &turned),
+        decide(&baseline, "forward", &turned)
+    );
+}
+
+#[test]
+fn pool_guard_publications_add_only_their_admissions_to_the_guard_chain() {
+    let baseline = prepared(pool_guard());
+    let with = prepared(fixture());
+    let graph = chains(&with);
+    let reference = chains(&baseline);
+    assert_eq!(
+        graph.keys().collect::<Vec<_>>(),
+        reference.keys().collect::<Vec<_>>()
+    );
+    for name in ["input", "forward", "output", "pool_reply"] {
+        assert_eq!(graph[name], reference[name], "{name}");
+    }
+    // Whatever the number of publications: the ESTABLISHED admission and one
+    // opening per protocol, right after the original-destination denial of every pool.
+    let pools = 2;
+    assert_eq!(
+        graph["pool_guard"].len(),
+        reference["pool_guard"].len() + 1 + 2
+    );
+    assert_eq!(
+        graph["pool_guard"][..pools],
+        reference["pool_guard"][..pools]
+    );
+    assert_eq!(
+        graph["pool_guard"][pools + 3..],
+        reference["pool_guard"][pools..]
+    );
+    // A host-local flow with a publication's tuples, translated from outside every
+    // pool, is the same publication on the local hooks.
+    for flow in admitted() {
+        for (chain, local) in [
+            (
+                "input",
+                Flow {
+                    output: None,
+                    ..flow
+                },
+            ),
+            (
+                "output",
+                Flow {
+                    input: None,
+                    ..flow
+                },
+            ),
+        ] {
+            assert_eq!(
+                decide(&baseline, chain, &local).verdict,
+                0,
+                "{chain} baseline"
+            );
+            assert_eq!(decide(&with, chain, &local).verdict, 1, "{chain}");
+        }
+    }
+}
+
+#[test]
+fn pool_guard_publications_absent_and_empty_keep_the_digest_and_compiled_bytes() {
+    let baseline = prepared(pool_guard());
+    assert!(!serde_json::to_string(&baseline.policy)
+        .unwrap()
+        .contains("publishedPorts"));
+    let empty = prepared(published(pool_guard(), json!([])));
+    assert_eq!(empty, baseline);
+    assert_eq!(bytes(&empty), bytes(&baseline));
+    let with = prepared(fixture());
+    assert_ne!(with.digest, baseline.digest);
+    // Canonical order: a reordered list is the same policy.
+    let reordered = prepared(published(
+        pool_guard(),
+        json!([
+            port("udp", 20000, Some(20200), 20000, "10.240.0.1"),
+            port("tcp", 443, None, 8443, "10.240.0.1")
+        ]),
+    ));
+    assert_eq!(reordered, with);
+    // Host grants and publications are independent exceptions of one guard.
+    let both = prepared(granted(
+        fixture(),
+        json!([host_grant("tcp", "10.240.0.1", "10.241.0.2", 8080)]),
+    ));
+    for flow in admitted() {
+        assert_eq!(decide(&both, "forward", &flow).verdict, 1);
+    }
+}
+
+#[test]
+fn pool_guard_publications_refuse_every_entry_outside_the_contract() {
+    let refused = |ports: Value| normalized(published(pool_guard(), ports)).is_err();
+    // A target outside every pool needs no exception and is no publication into one.
+    assert!(refused(json!([port("tcp", 443, None, 8443, "10.250.0.1")])));
+    assert!(refused(json!([port(
+        "tcp",
+        443,
+        None,
+        8443,
+        "10.240.0.0/16"
+    )])));
+    assert!(refused(json!([port("tcp", 443, None, 8443, "127.0.0.1")])));
+    assert!(refused(json!([port(
+        "sctp",
+        443,
+        None,
+        8443,
+        "10.240.0.1"
+    )])));
+    assert!(refused(json!([port("tcp", 0, None, 8443, "10.240.0.1")])));
+    assert!(refused(json!([port("tcp", 443, None, 0, "10.240.0.1")])));
+    // A range keeps every port and runs upward; one port has no end.
+    assert!(refused(json!([port(
+        "udp",
+        20000,
+        Some(20200),
+        30000,
+        "10.240.0.1"
+    )])));
+    assert!(refused(json!([port(
+        "udp",
+        20000,
+        Some(20000),
+        20000,
+        "10.240.0.1"
+    )])));
+    assert!(refused(json!([port(
+        "udp",
+        20000,
+        Some(19999),
+        20000,
+        "10.240.0.1"
+    )])));
+    // One protocol and port is published once.
+    assert!(refused(json!([
+        port("tcp", 443, None, 8443, "10.240.0.1"),
+        port("tcp", 443, None, 8444, "10.240.0.1")
+    ])));
+    assert!(refused(json!([
+        port("udp", 20000, Some(20200), 20000, "10.240.0.1"),
+        port("udp", 20200, None, 5060, "10.240.0.1")
+    ])));
+    assert!(!refused(json!([
+        port("tcp", 443, None, 8443, "10.240.0.1"),
+        port("udp", 443, None, 8443, "10.240.0.1")
+    ])));
+    let mut unknown = port("tcp", 443, None, 8443, "10.240.0.1");
+    unknown["hostIp"] = json!("192.0.2.2");
+    assert!(refused(json!([unknown])));
+}
+
+#[test]
+fn pool_guard_publications_are_bounded_and_fit_the_largest_guard() {
+    let many = |count: u16| -> Value {
+        json!((0..count)
+            .map(|index| port("tcp", 1000 + index, None, 1000 + index, "10.240.0.1"))
+            .collect::<Vec<_>>())
+    };
+    match normalized(published(pool_guard(), many(1025))) {
+        Err(crate::Error::Exhausted(bound)) => assert_eq!(bound.name, "publishedPorts"),
+        other => panic!("{other:?}"),
+    }
+    // The largest guard: 64 pools, 1024 host grants, 1024 publications and every
+    // loopback port owner compile inside the atomic budget.
+    let mut guard = pool_guard();
+    guard["scope"]["prefixes"] = json!((0..64)
+        .map(|part| format!("10.{part}.0.0/16"))
+        .collect::<Vec<_>>());
+    let grants: Vec<_> = (0..1024_u16)
+        .map(|index| {
+            host_grant(
+                if index % 2 == 0 { "tcp" } else { "udp" },
+                "10.40.0.1",
+                "10.41.0.2",
+                20000 + index / 2,
+            )
+        })
+        .collect();
+    guard["scope"]["hostGrants"] = json!(grants);
+    guard["scope"]["localTcpPortOwners"] = json!((0..8)
+        .map(|index| json!({"address":"127.0.0.1","port":10010 + index,"uid":0}))
+        .collect::<Vec<_>>());
+    let ports: Vec<_> = (0..1024_u16)
+        .map(|index| {
+            port(
+                if index % 2 == 0 { "tcp" } else { "udp" },
+                1000 + index / 2,
+                None,
+                1000 + index / 2,
+                "10.40.0.1",
+            )
+        })
+        .collect();
+    let largest: Prepared = prepared(published(guard, json!(ports)));
+    let program = largest
+        .program(&format!("snft_{}", "x".repeat(59)))
+        .unwrap();
+    let size = |kinds: &[u16]| -> usize {
+        program
+            .iter()
+            .filter(|(kind, _)| kinds.contains(kind))
+            .map(|(_, attributes)| crate::wire::encode_attrs(attributes).len() + 20)
+            .sum()
+    };
+    let (graph, elements) = (size(&[3, 6, 9]), size(&[12]));
+    assert!(
+        program.len() < 768
+            && graph <= super::compile::RULE_BYTES
+            && graph + elements <= super::compile::TARGET_BYTES
+    );
+    assert!(768 * (20 + 72 + 36 + 12) + graph + elements + 64 <= crate::wire::BATCH_BYTES);
+    println!(
+        "POOL_GUARD_PUBLISHED_MAX prefixes=64 grants=1024 owners=8 published=1024 operations={} rule_bytes={graph} element_bytes={elements}",
+        program.len()
+    );
+}

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartnftables',
-  version: '4.3.1',
+  version: '4.4.0',
   description: 'A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.'
 }

package/ts/managed.egress.types.ts

@@ -216,17 +216,39 @@ export interface IManagedNftLocalTcpPortOwner {
   uid: number;
 }
 
+/** One publication an allocation-pool guard admits into a pool: a flow whose original destination lies
+ * outside every listed pool, on `hostPort` (or the range `hostPort..hostPortEnd`), translated to exactly
+ * `targetAddress` and `targetPort`, and its replies, in the default conntrack zone. The guard checks
+ * no link and no uplink address: the scope that translates the flow (`hostTransit.publishedPorts`)
+ * binds those. Compile the same publication into the guard and the host-transit scope it crosses. */
+export interface IManagedNftPoolGuardPublishedPort {
+  protocol: 'tcp' | 'udp';
+  /** Published port, 1–65535; each protocol and port is published at most once per guard. */
+  hostPort: number;
+  /** Optional last port of a published range, greater than `hostPort`; a range keeps every port,
+   * so `targetPort` must equal `hostPort`. Absent for one port, its only canonical form. */
+  hostPortEnd?: number;
+  targetPort: number;
+  /** Exact unicast address inside a listed pool that the publication is translated to. */
+  targetAddress: string;
+}
+
 /** Host-wide IPv4 destination denial for caller-authenticated private allocation pools.
- * It has no link dependency; exact host grants are its only exceptions. It is not allocation-release or boot-order proof. */
+ * It has no link dependency; exact host grants and publications are its only exceptions. It is not
+ * allocation-release or boot-order proof. */
 export interface IManagedNftAllocationPoolGuardScopeV2 {
   kind: 'allocationPoolGuard';
   authorityDigest: string;
   /** Complete current pool list: 1–64 canonical, disjoint RFC1918 prefixes. */
   prefixes: string[];
-  /** The only exceptions to the guard: exact host-origin flows whose `destinationAddress` lies in a
-   * listed pool, and their replies. Absent and empty are the same canonical policy; at most 1024,
-   * held in a named set behind a constant number of rules. */
+  /** Exceptions to the guard: exact host-origin flows whose `destinationAddress` lies in a listed
+   * pool, and their replies. Absent and empty are the same canonical policy; at most 1024, held in a
+   * named set behind a constant number of rules. */
   hostGrants?: IManagedNftHostGrant[];
+  /** Exceptions to the guard: publications translated from outside every listed pool into one, and
+   * their replies. Absent and empty are the same canonical policy, digest and compiled graph; at most
+   * 1024, held in a named set behind a constant number of rules. */
+  publishedPorts?: IManagedNftPoolGuardPublishedPort[];
   /** Optional host-wide loopback port ownership, compiled ahead of the guard in the same table.
    * Absent and empty are the same canonical policy, digest and compiled graph; at most 8, one per
    * exact address and port. */