@push.rocks/smartnftables 4.3.1 → 4.5.0

package/ts/managed.egress.types.ts

@@ -216,17 +216,39 @@ export interface IManagedNftLocalTcpPortOwner {
   uid: number;
 }
 
+/** One publication an allocation-pool guard admits into a pool: a flow whose original destination lies
+ * outside every listed pool, on `hostPort` (or the range `hostPort..hostPortEnd`), translated to exactly
+ * `targetAddress` and `targetPort`, and its replies, in the default conntrack zone. The guard checks
+ * no link and no uplink address: the scope that translates the flow (`hostTransit.publishedPorts`)
+ * binds those. Compile the same publication into the guard and the host-transit scope it crosses. */
+export interface IManagedNftPoolGuardPublishedPort {
+  protocol: 'tcp' | 'udp';
+  /** Published port, 1–65535; each protocol and port is published at most once per guard. */
+  hostPort: number;
+  /** Optional last port of a published range, greater than `hostPort`; a range keeps every port,
+   * so `targetPort` must equal `hostPort`. Absent for one port, its only canonical form. */
+  hostPortEnd?: number;
+  targetPort: number;
+  /** Exact unicast address inside a listed pool that the publication is translated to. */
+  targetAddress: string;
+}
+
 /** Host-wide IPv4 destination denial for caller-authenticated private allocation pools.
- * It has no link dependency; exact host grants are its only exceptions. It is not allocation-release or boot-order proof. */
+ * It has no link dependency; exact host grants and publications are its only exceptions. It is not
+ * allocation-release or boot-order proof. */
 export interface IManagedNftAllocationPoolGuardScopeV2 {
   kind: 'allocationPoolGuard';
   authorityDigest: string;
   /** Complete current pool list: 1–64 canonical, disjoint RFC1918 prefixes. */
   prefixes: string[];
-  /** The only exceptions to the guard: exact host-origin flows whose `destinationAddress` lies in a
-   * listed pool, and their replies. Absent and empty are the same canonical policy; at most 1024,
-   * held in a named set behind a constant number of rules. */
+  /** Exceptions to the guard: exact host-origin flows whose `destinationAddress` lies in a listed
+   * pool, and their replies. Absent and empty are the same canonical policy; at most 1024, held in a
+   * named set behind a constant number of rules. */
   hostGrants?: IManagedNftHostGrant[];
+  /** Exceptions to the guard: publications translated from outside every listed pool into one, and
+   * their replies. Absent and empty are the same canonical policy, digest and compiled graph; at most
+   * 1024, held in a named set behind a constant number of rules. */
+  publishedPorts?: IManagedNftPoolGuardPublishedPort[];
   /** Optional host-wide loopback port ownership, compiled ahead of the guard in the same table.
    * Absent and empty are the same canonical policy, digest and compiled graph; at most 8, one per
    * exact address and port. */