@push.rocks/smartnftables 4.3.1 → 4.5.0

package/rust/src/owner_listing_tests.rs

@@ -0,0 +1,634 @@
+//! Typed sets. nft must decode every set the compiler declares, and the graph
+//! of a release before typed sets (LEGACY <=4.4.x) must stay adoptable and be
+//! replaced by typed sets in one batch.
+//!
+//! The ignored cases run in the isolated qualification guest of
+//! `test/native/qualify.py`, which carries the host's nft 1.0.9. They compare
+//! every declared set with the set nft creates from the same `typeof`
+//! declaration, list every set, chain and the ruleset, and pin nft's own
+//! defect: it crashes listing a rule that looks up a concatenation of seven or
+//! more fields, whatever the set's types (nftables `expr_postprocess_concat`).
+use super::*;
+use crate::egress::{self, hostgrant_tests, tests, workloadgrant_tests};
+use serde_json::{json, Value};
+use std::collections::{BTreeMap, BTreeSet};
+use std::os::unix::process::ExitStatusExt;
+
+const TABLE: &str = "snft_listing";
+/// The longest concatenation whose lookups nft 1.0.9 lists.
+const LISTED_FIELDS: usize = 6;
+/// The longest key nft 1.0.9 describes by `typeof`.
+const TYPEOF_FIELDS: usize = 4;
+
+/// Policies that between them declare every kind of set the compiler emits.
+fn fixtures() -> Vec<(&'static str, Value)> {
+    let host_grant = json!([hostgrant_tests::host_grant(
+        "tcp",
+        "10.240.0.1",
+        "10.241.0.2",
+        8080
+    )]);
+    let mut router = workloadgrant_tests::granted(
+        workloadgrant_tests::two_workloads(),
+        json!([workloadgrant_tests::workload_grant(
+            "tcp",
+            "10.241.0.2",
+            "10.241.1.2",
+            8080
+        )]),
+    );
+    router = hostgrant_tests::granted(router, host_grant.clone());
+    // A leased grant naming its source port adds the sourced maps.
+    router["scope"]["generations"][0]["grants"]
+        .as_array_mut()
+        .unwrap()
+        .push(
+            json!({"sourceEndpoint":"work","sourcePrefix":"10.241.0.2/32",
+            "destination":{"kind":"public","prefix":"0.0.0.0/0"},"protocol":"udp","sourcePort":5000,
+            "destinationPort":443,"sourcePortRange":{"first":10000,"last":10999}}),
+        );
+    let mut range = tests::router_published_port("udp", 20000, 20000);
+    range["transitPortEnd"] = json!(20200);
+    range["symmetric"] = json!(true);
+    router["scope"]["publishedPorts"] =
+        json!([tests::router_published_port("tcp", 443, 8443), range]);
+    let mut host = hostgrant_tests::granted(tests::host(), host_grant.clone());
+    let mut host_range = tests::published_port("udp", 20000, 20000);
+    host_range["hostPortEnd"] = json!(20200);
+    host_range["symmetric"] = json!(true);
+    host["scope"]["publishedPorts"] = json!([tests::published_port("tcp", 443, 8443), host_range]);
+    vec![
+        ("router", router),
+        ("combined", tests::combined_router_capacity()),
+        ("host", host),
+        ("pool", pool(1)),
+    ]
+}
+/// An allocation-pool guard with a host grant and a publication: it binds no
+/// interface, so any namespace can apply it.
+fn pool(revision: u64) -> Value {
+    let mut value = hostgrant_tests::granted(
+        tests::pool_guard(),
+        json!([hostgrant_tests::host_grant(
+            "tcp",
+            "10.240.0.1",
+            "10.241.0.2",
+            8080
+        )]),
+    );
+    value["scope"]["publishedPorts"] =
+        json!([{"protocol":"tcp","hostPort":443,"targetPort":8443,"targetAddress":"10.240.0.1"}]);
+    value["revision"] = json!(revision);
+    value
+}
+fn policy(value: Value) -> egress::Prepared {
+    serde_json::from_value::<egress::Policy>(value)
+        .unwrap()
+        .prepare()
+        .unwrap()
+}
+fn options(table: &str) -> Options {
+    Options {
+        owner_id: "fixture".into(),
+        instance_id: "listing_qualification_20261006".into(),
+        table_name: table.into(),
+    }
+}
+/// The compiled graph as the owner reads it back, each set declaration passed
+/// through `set`.
+fn graph_of(program: &[(u16, Vec<Attr>)], set: impl Fn(&str, &[Attr]) -> Vec<Attr>) -> Graph {
+    let (mut chains, mut rules) = (Vec::new(), Vec::new());
+    let mut sets: Vec<(Vec<Attr>, Vec<Vec<u8>>)> = Vec::new();
+    for (kind, attributes) in program {
+        match kind {
+            3 => chains.push(attributes.clone()),
+            6 => rules.push(attributes.clone()),
+            9 => sets.push((
+                set(&wire::text(attributes, 2).unwrap(), attributes),
+                Vec::new(),
+            )),
+            12 => {
+                let name = wire::text(attributes, 2).unwrap();
+                let list = wire::attrs(&wire::one(attributes, 3).unwrap().value).unwrap();
+                sets.iter_mut()
+                    .find(|(set, _)| wire::text(set, 2).unwrap() == name)
+                    .unwrap()
+                    .1
+                    .extend(element_keys(&list).unwrap());
+            }
+            other => panic!("operation {other}"),
+        }
+    }
+    Graph {
+        generation: 1,
+        table: Vec::new(),
+        chains,
+        rules,
+        sets,
+    }
+}
+fn retyped(attributes: &[Attr], key_type: u32) -> Vec<Attr> {
+    attributes
+        .iter()
+        .map(|attribute| match attribute.id() {
+            4 => Attr::u32(4, key_type),
+            _ => attribute.clone(),
+        })
+        .collect()
+}
+
+#[test]
+fn the_fixtures_declare_every_kind_of_set() {
+    let mut declared = BTreeSet::new();
+    for (_, value) in fixtures() {
+        declared.extend(policy(value).declared(TABLE).unwrap().into_keys());
+    }
+    for name in [
+        "host_grant",
+        "host_grant_arrival",
+        "workload_grant",
+        "workload_link",
+        "private_link",
+        "private_index",
+        "private_name",
+        "private_source",
+        "private_any",
+        "private_port",
+        "leased_label",
+        "leased_generation",
+        "leased_platform_zone",
+        "leased_platform_flow",
+        "leased_platform_return",
+        "leased_public_zone",
+        "leased_public_flow",
+        "leased_public_sourced_zone",
+        "leased_public_sourced_flow",
+        "leased_public_return",
+        "published_arrival",
+        "published_endpoint",
+        "published_port",
+        "published_address",
+        "published_forward",
+        "published_symmetric",
+        "pool_published",
+    ] {
+        assert!(declared.contains(name), "{name} in {declared:?}");
+    }
+}
+
+/// A typed graph agrees exactly. LEGACY(<=4.4.x): the same graph with every set
+/// untyped agrees as untyped; anything between or beside them is different.
+#[test]
+fn typed_graphs_agree_exactly_and_legacy_untyped_graphs_as_untyped() {
+    let owner = Owner::new(options(TABLE)).unwrap();
+    for (name, value) in fixtures() {
+        let prepared: Prepared = policy(value).into();
+        let program = prepared.program(TABLE).unwrap();
+        let first = program
+            .iter()
+            .find(|(kind, _)| *kind == 9)
+            .map(|(_, attributes)| wire::text(attributes, 2).unwrap())
+            .unwrap();
+        let typed = graph_of(&program, |_, set| set.to_vec());
+        assert_eq!(
+            owner.agreement(&typed, &prepared).unwrap(),
+            Agreement::Exact,
+            "{name}"
+        );
+        let untyped = graph_of(&program, |_, set| untyped_set(set));
+        assert_eq!(
+            owner.agreement(&untyped, &prepared).unwrap(),
+            Agreement::Untyped,
+            "{name}"
+        );
+        assert!(owner.matches(&untyped, &prepared).unwrap());
+        // A graph is typed or untyped as a whole.
+        let mixed = graph_of(&program, |set, attributes| {
+            if set == first {
+                untyped_set(attributes)
+            } else {
+                attributes.to_vec()
+            }
+        });
+        assert_eq!(
+            owner.agreement(&mixed, &prepared).unwrap(),
+            Agreement::Different,
+            "{name}"
+        );
+        // Untyped is exactly the legacy declaration: any other type differs,
+        // with or without userdata.
+        for keep_userdata in [false, true] {
+            let other = graph_of(&program, |set, attributes| {
+                let declared = if keep_userdata {
+                    attributes.to_vec()
+                } else {
+                    untyped_set(attributes)
+                };
+                if set == first {
+                    retyped(&declared, 7)
+                } else {
+                    declared
+                }
+            });
+            assert_eq!(
+                owner.agreement(&other, &prepared).unwrap(),
+                Agreement::Different,
+                "{name}"
+            );
+        }
+        // Elements stay identity in a legacy graph.
+        let mut changed = graph_of(&program, |_, set| untyped_set(set));
+        let (_, keys) = changed
+            .sets
+            .iter_mut()
+            .find(|(_, keys)| !keys.is_empty())
+            .unwrap();
+        keys.pop();
+        assert_eq!(
+            owner.agreement(&changed, &prepared).unwrap(),
+            Agreement::Different,
+            "{name}"
+        );
+    }
+}
+
+/// Userdata is identity: a set whose types or `typeof` descriptions changed
+/// is a different set, and a legacy untyped set differs from its typed one.
+#[test]
+fn set_identity_includes_types_and_userdata() {
+    let prepared: Prepared = policy(pool(1)).into();
+    for (kind, attributes) in prepared.program(TABLE).unwrap() {
+        if kind != 9 {
+            continue;
+        }
+        let identity = set_identity(&attributes).unwrap();
+        assert_ne!(set_identity(&untyped_set(&attributes)).unwrap(), identity);
+        let mut userdata = wire::one(&attributes, 13).unwrap().value.clone();
+        let last = userdata.len() - 1;
+        userdata[last] ^= 1;
+        let changed: Vec<Attr> = attributes
+            .iter()
+            .map(|attribute| match attribute.id() {
+                13 => Attr::bytes(13, userdata.clone()),
+                _ => attribute.clone(),
+            })
+            .collect();
+        assert_ne!(set_identity(&changed).unwrap(), identity);
+        assert_ne!(set_identity(&retyped(&attributes, 7)).unwrap(), identity);
+    }
+}
+
+/// A fresh guest network namespace and the guest's nft, the host's 1.0.9.
+fn listing_guest() {
+    isolated();
+    let version = nft(&["--version"]);
+    assert!(version.status.success());
+    assert!(String::from_utf8_lossy(&version.stdout).starts_with("nftables v1.0.9 "));
+}
+fn nft(arguments: &[&str]) -> std::process::Output {
+    std::process::Command::new("/bin/nft")
+        .args(arguments)
+        .output()
+        .unwrap()
+}
+/// Applies a compiled program into a plain table of its own.
+fn apply(program: Vec<(u16, Vec<Attr>)>) {
+    let mut socket = Socket::open().unwrap();
+    let generation = socket.generation().unwrap();
+    let mut operations = vec![(0, 0x600, vec![Attr::string(1, TABLE)])];
+    for (operation, attributes) in program {
+        operations.push((
+            operation,
+            if operation == 6 { 0xc00 } else { 0x600 },
+            attributes,
+        ));
+    }
+    socket.batch(generation, operations).unwrap();
+}
+/// Every set of `table` as Linux dumps it, by name.
+fn dumped(table: &str) -> BTreeMap<String, Vec<Attr>> {
+    let mut socket = Socket::open().unwrap();
+    socket
+        .query(10, vec![Attr::string(1, table)], true)
+        .unwrap()
+        .into_iter()
+        .map(|set| (wire::text(&set, 2).unwrap(), set))
+        .collect()
+}
+/// Userdata attributes without one type.
+fn without(userdata: &[u8], kind: u8) -> Vec<u8> {
+    let mut result = Vec::new();
+    let mut rest = userdata;
+    while let [entry, length, ..] = rest {
+        let end = 2 + usize::from(*length);
+        if *entry != kind {
+            result.extend(&rest[..end]);
+        }
+        rest = &rest[end..];
+    }
+    result
+}
+/// The declaration lines of an nft listing: its `type`/`typeof` and flags.
+fn header(output: &std::process::Output) -> Vec<String> {
+    String::from_utf8_lossy(&output.stdout)
+        .lines()
+        .map(str::trim)
+        .filter(|line| line.starts_with("type") || line.starts_with("flags"))
+        .map(String::from)
+        .collect()
+}
+/// The sets each rule of a chain looks up, by chain, and whether the lookup is a
+/// membership test (no data register), the expression nft crashes listing for a
+/// long concatenation.
+fn lookups(program: &[(u16, Vec<Attr>)]) -> BTreeMap<String, BTreeSet<(String, bool)>> {
+    let mut result: BTreeMap<String, BTreeSet<(String, bool)>> = BTreeMap::new();
+    for (kind, attributes) in program {
+        match kind {
+            3 => {
+                result
+                    .entry(wire::text(attributes, 3).unwrap())
+                    .or_default();
+            }
+            6 => {
+                let chain = wire::text(attributes, 2).unwrap();
+                for expression in wire::attrs(&wire::one(attributes, 4).unwrap().value).unwrap() {
+                    let parts = wire::attrs(&expression.value).unwrap();
+                    if wire::text(&parts, 1).unwrap() == "lookup" {
+                        let data = wire::attrs(&wire::one(&parts, 2).unwrap().value).unwrap();
+                        let membership = data.iter().all(|attribute| attribute.id() != 3);
+                        result
+                            .entry(chain.clone())
+                            .or_default()
+                            .insert((wire::text(&data, 1).unwrap(), membership));
+                    }
+                }
+            }
+            _ => {}
+        }
+    }
+    result
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn nft_decodes_every_typed_set_and_lists_lookups_up_to_six_fields() {
+    listing_guest();
+    for (fixture, value) in fixtures() {
+        let prepared = policy(value);
+        let declared = prepared.declared(TABLE).unwrap();
+        let program = prepared.program(TABLE).unwrap();
+        apply(program.clone());
+        assert!(nft(&["add", "table", "inet", "reference"]).status.success());
+        for (name, set) in &declared {
+            let mut specification = format!("{{ typeof {}", set.key.join(" . "));
+            if let Some(data) = &set.data {
+                specification.push_str(&format!(" : {}", data.join(" . ")));
+            }
+            specification.push_str(if set.interval {
+                "; flags constant,interval; }"
+            } else {
+                "; flags constant; }"
+            });
+            let kind = if set.data.is_some() { "map" } else { "set" };
+            let created = nft(&["add", kind, "inet", "reference", name, &specification]);
+            assert!(created.status.success(), "{fixture} {name}: {created:?}");
+        }
+        // Every declaration is nft's own for the same `typeof`.
+        let (ours, theirs) = (dumped(TABLE), dumped("reference"));
+        assert_eq!(
+            ours.keys().collect::<Vec<_>>(),
+            theirs.keys().collect::<Vec<_>>()
+        );
+        for (name, set) in &declared {
+            let (ours, theirs) = (&ours[name], &theirs[name]);
+            for id in [3, 4, 6, 7, 9] {
+                assert_eq!(
+                    ours.iter().find(|attribute| attribute.id() == id),
+                    theirs.iter().find(|attribute| attribute.id() == id),
+                    "{fixture} {name} attribute {id}"
+                );
+            }
+            // The generation map keeps the zone padded to its register; nft
+            // declares the zone alone by its two bytes.
+            let padded_zone = set.key == ["ct zone"];
+            assert_eq!(
+                (wire::number(ours, 5).unwrap(), padded_zone),
+                (
+                    wire::number(theirs, 5).unwrap() + if padded_zone { 2 } else { 0 },
+                    padded_zone
+                ),
+                "{fixture} {name} key length"
+            );
+            let mut expected = wire::one(theirs, 13).unwrap().value.clone();
+            if set.key.len() > TYPEOF_FIELDS {
+                // nft writes the first four fields of a longer `typeof` and
+                // discards them on reading; the declaration carries none.
+                expected = without(&expected, 3);
+            }
+            assert_eq!(
+                wire::one(ours, 13).unwrap().value,
+                expected,
+                "{fixture} {name} userdata"
+            );
+        }
+        // Every set lists, declared as nft declares the same set.
+        let (mut described, mut typed) = (0, 0);
+        for (name, set) in &declared {
+            let kind = if set.data.is_some() { "map" } else { "set" };
+            let ours = nft(&["list", kind, "inet", TABLE, name]);
+            assert!(ours.status.success(), "{fixture} {name}: {ours:?}");
+            let theirs = nft(&["list", kind, "inet", "reference", name]);
+            assert!(theirs.status.success(), "{fixture} {name}: {theirs:?}");
+            let declaration = header(&ours);
+            if set.key == ["ct zone"] {
+                // nft cannot name a zone padded to its register: it lists the
+                // key's type as a bare integer of no size.
+                assert_eq!(declaration, ["type 0 : ct_label", "flags constant"]);
+                typed += 1;
+            } else {
+                assert_eq!(declaration, header(&theirs), "{fixture} {name}");
+                if set.key.len() <= TYPEOF_FIELDS {
+                    assert!(
+                        declaration[0].starts_with("typeof "),
+                        "{fixture} {name}: {declaration:?}"
+                    );
+                    described += 1;
+                } else {
+                    assert!(
+                        declaration[0].starts_with("type "),
+                        "{fixture} {name}: {declaration:?}"
+                    );
+                    typed += 1;
+                }
+            }
+        }
+        // Chains list unless a rule tests membership of a concatenation of
+        // seven or more fields: nft 1.0.9 then crashes, for its own sets as
+        // for these. Map lookups of the same keys list.
+        let (mut listed, mut crashed) = (0, 0);
+        for (chain, sets) in lookups(&program) {
+            let longest = sets
+                .iter()
+                .filter(|(_, membership)| *membership)
+                .map(|(set, _)| declared[set].key.len())
+                .max()
+                .unwrap_or(0);
+            let listing = nft(&["list", "chain", "inet", TABLE, &chain]);
+            if longest <= LISTED_FIELDS {
+                assert!(listing.status.success(), "{fixture} {chain}: {listing:?}");
+                let text = String::from_utf8_lossy(&listing.stdout);
+                // A map lookup of a longer key lists, but nft 1.0.9 renders it
+                // wrongly: its data garbled, or the statement dropped.
+                for (set, membership) in &sets {
+                    if *membership || declared[set].key.len() <= TYPEOF_FIELDS {
+                        assert!(
+                            text.contains(&format!("@{set}")),
+                            "{fixture} {chain} @{set}: {text}"
+                        );
+                    }
+                }
+                listed += 1;
+            } else {
+                assert_eq!(
+                    listing.status.signal(),
+                    Some(libc::SIGSEGV),
+                    "{fixture} {chain}: {listing:?}"
+                );
+                crashed += 1;
+            }
+        }
+        let ruleset = nft(&["list", "ruleset"]);
+        if crashed == 0 {
+            assert!(ruleset.status.success(), "{fixture}: {ruleset:?}");
+        } else {
+            assert_eq!(
+                ruleset.status.signal(),
+                Some(libc::SIGSEGV),
+                "{fixture}: {ruleset:?}"
+            );
+        }
+        println!(
+            "SMARTNFTABLES_LISTING fixture={fixture} sets={} typeof={described} type={typed} \
+             chains_listed={listed} chains_nft_crash={crashed} ruleset={}",
+            declared.len(),
+            if crashed == 0 { "listed" } else { "nft_crash" }
+        );
+        for table in [TABLE, "reference"] {
+            assert!(nft(&["delete", "table", "inet", table]).status.success());
+        }
+        // The control: the same graph with the untyped sets of 4.4.x does not
+        // list. nft aborts on the first rule that tests membership of one
+        // (`netlink_delinearize.c`: `dtype != &invalid_type`).
+        apply(
+            program
+                .iter()
+                .map(|(kind, attributes)| match kind {
+                    9 => (*kind, untyped_set(attributes)),
+                    _ => (*kind, attributes.clone()),
+                })
+                .collect(),
+        );
+        let mut aborted = 0;
+        for (chain, sets) in lookups(&program) {
+            if sets.iter().any(|(_, membership)| *membership) {
+                let listing = nft(&["list", "chain", "inet", TABLE, &chain]);
+                assert!(
+                    listing.status.signal().is_some(),
+                    "{fixture} untyped {chain}: {listing:?}"
+                );
+                aborted += usize::from(listing.status.signal() == Some(libc::SIGABRT));
+            }
+        }
+        assert!(aborted > 0, "{fixture}");
+        assert!(nft(&["delete", "table", "inet", TABLE]).status.success());
+        println!("SMARTNFTABLES_LISTING_UNTYPED fixture={fixture} chains_nft_abort={aborted}");
+    }
+}
+
+/// LEGACY(<=4.4.x): applies `prepared` as a release before typed sets did, as
+/// owner of `table`, and leaves the table ownerless as a stopped engine does.
+fn apply_legacy(table: &str, prepared: &Prepared, receipt: &Prepared) -> Applied {
+    let mut owner = Owner::new(options(table)).unwrap();
+    let mut operations = vec![(
+        0,
+        0x600,
+        vec![
+            Attr::string(1, table),
+            Attr::u32(2, 6),
+            Attr::bytes(6, owner.userdata()),
+        ],
+    )];
+    for (operation, attributes) in prepared.program(table).unwrap() {
+        let attributes = if operation == 9 {
+            untyped_set(&attributes)
+        } else {
+            attributes
+        };
+        operations.push((
+            operation,
+            if operation == 6 { 0xc00 } else { 0x600 },
+            attributes,
+        ));
+    }
+    let socket = owner.socket().unwrap();
+    let generation = socket.generation().unwrap();
+    socket.batch(generation, operations).unwrap();
+    let graph = owner.graph().unwrap().unwrap();
+    assert_eq!(
+        owner.agreement(&graph, prepared).unwrap(),
+        Agreement::Untyped
+    );
+    owner.applied(&graph, receipt.clone()).unwrap()
+}
+fn generation() -> u32 {
+    Socket::open().unwrap().generation().unwrap()
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn legacy_untyped_graphs_are_adopted_and_replaced_by_typed_sets_in_one_batch() {
+    listing_guest();
+    let first: Prepared = policy(pool(1)).into();
+    let second: Prepared = policy(pool(2)).into();
+
+    // A new generation after the upgrade: adopt the previous untyped graph,
+    // replace it with the typed target in one batch after the ownership claim.
+    let previous = apply_legacy("snft_legacy_next", &first, &first);
+    let mut owner = Owner::new(options("snft_legacy_next")).unwrap();
+    let before = generation();
+    let applied = owner
+        .reconcile(Transition {
+            previous: Some(previous.clone()),
+            target: second.clone(),
+        })
+        .unwrap();
+    assert_eq!(generation(), before + 2);
+    assert_eq!(applied.receipt.table_handle, previous.receipt.table_handle);
+    let graph = owner.graph().unwrap().unwrap();
+    assert_eq!(owner.agreement(&graph, &second).unwrap(), Agreement::Exact);
+    assert!(owner.inspect().enforced);
+    owner.release(applied).unwrap();
+
+    // The same transition again after the upgrade, its target applied untyped:
+    // never already applied, replaced like a previous graph.
+    let previous = apply_legacy("snft_legacy_same", &second, &first);
+    let mut owner = Owner::new(options("snft_legacy_same")).unwrap();
+    let before = generation();
+    let applied = owner
+        .reconcile(Transition {
+            previous: Some(previous),
+            target: second.clone(),
+        })
+        .unwrap();
+    assert_eq!(generation(), before + 2);
+    let graph = owner.graph().unwrap().unwrap();
+    assert_eq!(owner.agreement(&graph, &second).unwrap(), Agreement::Exact);
+    owner.release(applied).unwrap();
+
+    // An untyped graph verifies externally and releases as itself.
+    let previous = apply_legacy("snft_legacy_release", &first, &first);
+    Owner::verify_external(&previous).unwrap();
+    let mut owner = Owner::new(options("snft_legacy_release")).unwrap();
+    owner.release(previous).unwrap();
+    assert!(owner.graph().unwrap().is_none());
+}

package/rust/src/owner_tests.rs

@@ -57,6 +57,9 @@ mod transitionrelease_tests;
 #[path = "owner_coexistence_tests.rs"]
 mod coexistence_tests;
 
+#[path = "owner_listing_tests.rs"]
+mod listing_tests;
+
 fn guest_guard() {
     assert_eq!(
         std::env::var("SMARTNFTABLES_ISOLATED_NATIVE").as_deref(),

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartnftables',
-  version: '4.3.1',
+  version: '4.5.0',
   description: 'A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.'
 }