nftables-napi 0.0.2 → 0.1.1

package/README.md

@@ -1,6 +1,6 @@
 # nftables-napi
 
-Native Node.js binding for nftables via libnftnl + libmnl. Manages IPv4/IPv6 blacklist tables with timeout support through direct netlink communication — no shell commands, no `nft` CLI.
+Native Node.js binding for nftables via libnftnl + libmnl. Manages IPv4/IPv6 tables with dynamic sets and timeout support through direct netlink communication — no shell commands, no `nft` CLI.
 
 Requires Linux with `CAP_NET_ADMIN` or root.
 
@@ -35,8 +35,7 @@ const { NftManager } = require("nftables-napi");
 
 const nft = new NftManager({
   tableName: "tablename",
-  blacklistSetName: "blacklist",
-  droplistSetName: "droplist",
+  sets: ["blacklist", "droplist"],
 });
 
 await nft.createTable();
@@ -62,13 +61,10 @@ await nft.deleteTable();
 
 ### `new NftManager(options)`
 
-| Option             | Type     | Required | Description                                  |
-| ------------------ | -------- | -------- | -------------------------------------------- |
-| `tableName`        | `string` | Yes      | Base table name (IPv6 auto-appends `'6'`)    |
-| `blacklistSetName` | `string` | Yes      | Blacklist set name (IPv6 auto-appends `'6'`) |
-| `droplistSetName`  | `string` | Yes      | Droplist set name (IPv6 auto-appends `'6'`)  |
-
-Log prefixes are auto-generated: `'{setName}: '` for each set.
+| Option      | Type       | Required | Description                                                                                      |
+| ----------- | ---------- | -------- | ------------------------------------------------------------------------------------------------ |
+| `tableName` | `string`   | Yes      | Base table name (IPv6 table auto-appends `'6'`)                                                  |
+| `sets`      | `string[]` | Yes      | Set names (1+, unique, non-empty). IPv6 sets auto-append `'6'`. Log prefix: `'{name}: '` |
 
 ### Methods
 
@@ -76,8 +72,8 @@ All methods return `Promise<void>`.
 
 | Method                                 | Description                                                           |
 | -------------------------------------- | --------------------------------------------------------------------- |
-| `createTable()`                        | Create IPv4/IPv6 tables with blacklist and droplist sets. Idempotent. |
-| `deleteTable()`                        | Delete both tables. Idempotent.                                       |
+| `createTable()`                        | Create IPv4/IPv6 tables with all configured sets and filter chains. Idempotent. |
+| `deleteTable()`                        | Delete both tables. Idempotent.                                                 |
 | `addAddress({ ip, set, timeout? })`    | Add IP to set. `timeout` in seconds, omit for permanent.              |
 | `removeAddress({ ip, set })`           | Remove IP from set. Idempotent.                                       |
 | `addAddresses({ ips, set, timeout? })` | Bulk add to set. Chunked for efficient netlink communication.         |

package/binding.gyp

@@ -28,7 +28,9 @@
         "-Wall",
         "-Wextra",
         "-Wpedantic",
-        "-Wno-unused-parameter"
+        "-Wno-unused-parameter",
+        "-D_FORTIFY_SOURCE=2",
+        "-fstack-protector-strong"
       ],
       "ldflags": [
         "-Wl,-z,relro",

package/lib/index.d.ts

@@ -1,29 +1,41 @@
 /**
  * Native nftables manager for Linux firewall.
- * Manages IPv4/IPv6 blacklist/droplist tables via libnftnl + libmnl (direct netlink, no nft CLI).
+ * Manages IPv4/IPv6 tables with dynamic sets via libnftnl + libmnl (direct netlink, no nft CLI).
  * Requires CAP_NET_ADMIN or root privileges.
  */
 
-/** Target set for address operations. */
-export type TargetSet = 'blacklist' | 'droplist';
-
-/** Constructor options. All fields are required — no defaults. */
+/** Constructor options. */
 export interface NftManagerOptions {
     /** Base table name. IPv6 table auto-appends '6'. */
     tableName: string;
-    /** Blacklist set name. IPv6 set auto-appends '6'. */
-    blacklistSetName: string;
-    /** Droplist set name. IPv6 set auto-appends '6'. */
-    droplistSetName: string;
+    /**
+     * Input/forward IP set names (≥1 required). Block by source address.
+     * Rules: log prefix "<setName>: " + named counter + drop on input and forward chains.
+     * IPv6 sets auto-append '6'.
+     */
+    sets: string[];
+    /**
+     * Output IP set names (optional). Block by destination address.
+     * Rules: named counter + drop on output chain (no log).
+     * IPv6 sets auto-append '6'.
+     */
+    outSets?: string[];
+    /**
+     * Output port set names (optional). Block by tcp/udp destination port.
+     * Rules: single concatenated (proto . port) lookup + named counter + drop on output chain (no log).
+     * Port is added to BOTH IPv4 and IPv6 tables (ports are family-independent).
+     * IPv6 sets auto-append '6'.
+     */
+    outPortSets?: string[];
 }
 
 /** Options for adding a single address. */
 export interface AddAddressOptions {
     /** IPv4 or IPv6 address (e.g., "1.2.3.4" or "2001:db8::1"). */
     ip: string;
-    /** Target set: 'blacklist' or 'droplist'. */
-    set: TargetSet;
-    /** Timeout in seconds. Omit for permanent ban. */
+    /** Target set name (must match one from constructor's sets or outSets). */
+    set: string;
+    /** Timeout in seconds. Omit for permanent. */
     timeout?: number;
 }
 
@@ -31,17 +43,17 @@ export interface AddAddressOptions {
 export interface RemoveAddressOptions {
     /** IPv4 or IPv6 address to remove. */
     ip: string;
-    /** Target set: 'blacklist' or 'droplist'. */
-    set: TargetSet;
+    /** Target set name (must match one from constructor's sets or outSets). */
+    set: string;
 }
 
 /** Options for bulk adding addresses. */
 export interface AddAddressesOptions {
     /** Array of IPv4/IPv6 addresses. */
     ips: string[];
-    /** Target set: 'blacklist' or 'droplist'. */
-    set: TargetSet;
-    /** Timeout in seconds. Omit for permanent ban. */
+    /** Target set name (must match one from constructor's sets or outSets). */
+    set: string;
+    /** Timeout in seconds. Omit for permanent. */
     timeout?: number;
 }
 
@@ -49,8 +61,52 @@ export interface AddAddressesOptions {
 export interface RemoveAddressesOptions {
     /** Array of IPv4/IPv6 addresses to remove. */
     ips: string[];
-    /** Target set: 'blacklist' or 'droplist'. */
-    set: TargetSet;
+    /** Target set name (must match one from constructor's sets or outSets). */
+    set: string;
+}
+
+/** Options for adding a single port. */
+export interface AddPortOptions {
+    /** Port number (0-65535). */
+    port: number;
+    /** Target port set name (must match one from constructor's outPortSets). */
+    set: string;
+    /** Protocol: 'tcp', 'udp', or omit for both. Default: both. */
+    protocol?: 'tcp' | 'udp';
+    /** Timeout in seconds. Omit for permanent. */
+    timeout?: number;
+}
+
+/** Options for removing a single port. */
+export interface RemovePortOptions {
+    /** Port number (0-65535). */
+    port: number;
+    /** Target port set name (must match one from constructor's outPortSets). */
+    set: string;
+    /** Protocol: 'tcp', 'udp', or omit for both. Default: both. */
+    protocol?: 'tcp' | 'udp';
+}
+
+/** Options for bulk adding ports. */
+export interface AddPortsOptions {
+    /** Array of port numbers (0-65535). */
+    ports: number[];
+    /** Target port set name (must match one from constructor's outPortSets). */
+    set: string;
+    /** Protocol: 'tcp', 'udp', or omit for both. Default: both. */
+    protocol?: 'tcp' | 'udp';
+    /** Timeout in seconds. Omit for permanent. */
+    timeout?: number;
+}
+
+/** Options for bulk removing ports. */
+export interface RemovePortsOptions {
+    /** Array of port numbers (0-65535). */
+    ports: number[];
+    /** Target port set name (must match one from constructor's outPortSets). */
+    set: string;
+    /** Protocol: 'tcp', 'udp', or omit for both. Default: both. */
+    protocol?: 'tcp' | 'udp';
 }
 
 export class NftManager {
@@ -58,52 +114,65 @@ export class NftManager {
      * Creates a new NftManager instance.
      * Opens a netlink socket and validates configuration.
      *
-     * @param options - Required configuration with table and set names.
+     * @param options - Required configuration with table name and set names.
      * @throws {TypeError} if options are missing or have wrong types
      * @throws {Error} if netlink socket cannot be opened (missing CAP_NET_ADMIN)
      */
     constructor(options: NftManagerOptions);
 
     /**
-     * Creates IPv4 and IPv6 tables with blacklist/droplist sets and filter chains.
+     * Creates IPv4 and IPv6 tables with all configured sets, chains, named counters, and filter rules.
      * Idempotent — destroys existing tables first, then recreates.
+     *
+     * Creates:
+     * - Named counter "processed" (global traffic counter per chain)
+     * - Named counter per set (blocked traffic counter)
+     * - Input chain with log + counter + drop rules (for sets)
+     * - Forward chain with log + counter + drop rules (for sets)
+     * - Output chain with counter + drop rules (for outSets and outPortSets, no log)
+     * - Per-element counters on all sets
+     *
+     * @throws {Error} if nftables operation fails
      */
     createTable(): Promise<void>;
 
     /**
      * Deletes both IPv4 and IPv6 tables.
      * Idempotent — no error if tables don't exist.
+     *
+     * @throws {Error} if nftables operation fails
      */
     deleteTable(): Promise<void>;
 
     /**
      * Adds an IP address to a set.
      * Auto-detects IPv4 vs IPv6 and routes to the correct table/set.
+     * Works with both input sets (sets) and output sets (outSets).
      *
-     * @param options - Address, target set, and optional timeout
-     * @throws {TypeError} if options are invalid
-     * @throws {Error} if IP is invalid or nftables operation fails
+     * @param options - Address, target set name, and optional timeout.
+     * @throws {TypeError} if options or fields have wrong types
+     * @throws {Error} if IP is invalid, set name is unknown, or nftables operation fails
      */
     addAddress(options: AddAddressOptions): Promise<void>;
 
     /**
      * Removes an IP address from a set.
      * Idempotent — no error if IP is not in the set.
+     * Works with both input sets (sets) and output sets (outSets).
      *
-     * @param options - Address and target set
-     * @throws {TypeError} if options are invalid
-     * @throws {Error} if IP is invalid or nftables operation fails
+     * @param options - Address and target set name.
+     * @throws {TypeError} if options or fields have wrong types
+     * @throws {Error} if IP is invalid, set name is unknown, or nftables operation fails
      */
     removeAddress(options: RemoveAddressOptions): Promise<void>;
 
     /**
      * Adds multiple IP addresses to a set in bulk.
-     * Addresses are chunked for efficient netlink communication.
      * Empty arrays are a no-op.
      *
-     * @param options - Addresses, target set, and optional timeout
-     * @throws {TypeError} if options are invalid
-     * @throws {Error} if any IP is invalid or nftables operation fails
+     * @param options - Array of addresses, target set name, and optional timeout.
+     * @throws {TypeError} if options or fields have wrong types
+     * @throws {Error} if any IP is invalid, set name is unknown, or nftables operation fails
      */
     addAddresses(options: AddAddressesOptions): Promise<void>;
 
@@ -112,9 +181,55 @@ export class NftManager {
      * Idempotent — no error if IPs are not in the set.
      * Empty arrays are a no-op.
      *
-     * @param options - Addresses and target set
-     * @throws {TypeError} if options are invalid
-     * @throws {Error} if any IP is invalid or nftables operation fails
+     * @param options - Array of addresses and target set name.
+     * @throws {TypeError} if options or fields have wrong types
+     * @throws {Error} if any IP is invalid, set name is unknown, or nftables operation fails
      */
     removeAddresses(options: RemoveAddressesOptions): Promise<void>;
+
+    /**
+     * Adds a port to an output port set.
+     * Port is added to BOTH IPv4 and IPv6 tables (ports are family-independent).
+     * When protocol is omitted, two elements are added: tcp + udp.
+     * When protocol is 'tcp' or 'udp', one element with that protocol is added.
+     *
+     * @param options - Port number, target set name, and optional timeout.
+     * @throws {TypeError} if options or fields have wrong types
+     * @throws {Error} if port is invalid, set name is unknown, or nftables operation fails
+     */
+    addPort(options: AddPortOptions): Promise<void>;
+
+    /**
+     * Removes a port from an output port set.
+     * Idempotent — no error if port is not in the set.
+     * Port is removed from BOTH IPv4 and IPv6 tables.
+     *
+     * @param options - Port number and target set name.
+     * @throws {TypeError} if options or fields have wrong types
+     * @throws {Error} if port is invalid, set name is unknown, or nftables operation fails
+     */
+    removePort(options: RemovePortOptions): Promise<void>;
+
+    /**
+     * Adds multiple ports to an output port set in bulk.
+     * Ports are added to BOTH IPv4 and IPv6 tables.
+     * Empty arrays are a no-op.
+     *
+     * @param options - Array of port numbers, target set name, and optional timeout.
+     * @throws {TypeError} if options or fields have wrong types
+     * @throws {Error} if any port is invalid, set name is unknown, or nftables operation fails
+     */
+    addPorts(options: AddPortsOptions): Promise<void>;
+
+    /**
+     * Removes multiple ports from an output port set in bulk.
+     * Idempotent — no error if ports are not in the set.
+     * Ports are removed from BOTH IPv4 and IPv6 tables.
+     * Empty arrays are a no-op.
+     *
+     * @param options - Array of port numbers and target set name.
+     * @throws {TypeError} if options or fields have wrong types
+     * @throws {Error} if any port is invalid, set name is unknown, or nftables operation fails
+     */
+    removePorts(options: RemovePortsOptions): Promise<void>;
 }

package/lib/index.js

@@ -6,7 +6,7 @@ let binding;
 try {
   binding = require('node-gyp-build')(path.join(__dirname, '..'));
 } catch (e) {
-  // On non-Linux platforms, the native addon may fail to load
+  if (process.platform === 'linux') throw e;
   binding = null;
 }
 
@@ -16,7 +16,7 @@ if (binding) {
   class NftManager {
     constructor() {
       throw new Error(
-        'remnawave-nft only works on Linux with CAP_NET_ADMIN. Native binding failed to load.'
+        'nftables-napi only works on Linux with CAP_NET_ADMIN. Native binding failed to load.'
       );
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nftables-napi",
-  "version": "0.0.2",
+  "version": "0.1.1",
   "description": "Native Node.js binding for nftables via libnftnl+libmnl — nftables firewall management",
   "author": {
     "name": "kastov",
@@ -46,8 +46,7 @@
   ],
   "gypfile": true,
   "engines": {
-    "node": ">=24.0.0",
-    "os": "linux"
+    "node": ">=24.0.0"
   },
   "scripts": {
     "install": "node-gyp-build || true",
@@ -57,10 +56,10 @@
     "prebuild:all": "./prebuild-all.sh"
   },
   "dependencies": {
-    "node-gyp-build": "^4.8.4",
-    "node-addon-api": "^8.5.0"
+    "node-gyp-build": "^4.8.4"
   },
   "devDependencies": {
+    "node-addon-api": "^8.5.0",
     "node-gyp": "^12.2.0",
     "prebuildify": "^6.0.1",
     "@types/node": ">= 24 < 25"

package/src/netlink/constants.h

@@ -23,6 +23,10 @@ inline constexpr uint32_t IPV6_SRC_OFFSET = 8;
 inline constexpr uint32_t IPV4_ADDR_LEN = 4;
 inline constexpr uint32_t IPV6_ADDR_LEN = 16;
 
+// Destination address offsets
+inline constexpr uint32_t IPV4_DST_OFFSET = 16;
+inline constexpr uint32_t IPV6_DST_OFFSET = 24;
+
 // Chain priority
 inline constexpr int32_t CHAIN_PRIORITY = -10;
 
@@ -36,4 +40,25 @@ inline constexpr uint32_t SEQ_BLOCK_SIZE = 256;
 // Number of pages for default batch buffer (pagesize * 32 ≈ 128KB)
 inline constexpr uint32_t DEFAULT_BUF_PAGES = 32;
 
+// Output chain
+inline constexpr const char* CHAIN_OUTPUT = "output";
+
+// Transport header dport offset (bytes from transport header base)
+inline constexpr uint32_t TRANSPORT_DPORT_OFFSET = 2;
+inline constexpr uint32_t TRANSPORT_DPORT_LEN = 2;
+
+// Concatenated type: concat_subtype_add(inet_proto, inet_service)
+// nft CLI builds concat types with LAST subtype in low bits:
+// concat_subtype_add(type, subtype) = type << TYPE_BITS | subtype
+// For (inet_proto=12 . inet_service=13): 12 << 6 | 13 = 781
+inline constexpr uint32_t DATATYPE_PROTO_SERVICE = (12 << 6 | 13);
+inline constexpr uint32_t PROTO_SERVICE_KEY_LEN = 8;
+
+// L4 protocol numbers
+inline constexpr uint8_t PROTO_TCP = 6;
+inline constexpr uint8_t PROTO_UDP = 17;
+
+// Named counter
+inline constexpr const char* COUNTER_NAME = "processed";
+
 } // namespace nft

package/src/netlink/nft_config.h

@@ -1,42 +1,42 @@
 #pragma once
 
 #include <string>
+#include <vector>
 
 namespace nft {
 
-enum class TargetSet {
-    Blacklist,
-    Droplist
+enum class SetKind { InIP, OutIP, OutPort };
+
+struct SetDef {
+    std::string name;
+    std::string name_v6;
+    std::string log_prefix;  // non-empty for InIP only
+    SetKind kind;
 };
 
 struct NftConfig {
     std::string table_v4;
     std::string table_v6;
-    std::string set_v4;
-    std::string set_v6;
-    std::string drop_set_v4;
-    std::string drop_set_v6;
-    std::string blacklist_log_prefix;
-    std::string droplist_log_prefix;
+    std::vector<SetDef> sets;  // all sets: InIP + OutIP + OutPort
 
     static NftConfig from_names(const std::string& table_name,
-                                const std::string& blacklist_set_name,
-                                const std::string& droplist_set_name) {
-        return {table_name, table_name + "6",
-                blacklist_set_name, blacklist_set_name + "6",
-                droplist_set_name, droplist_set_name + "6",
-                blacklist_set_name + ": ",
-                droplist_set_name + ": "};
-    }
-
-    const std::string& resolve_set_v4(TargetSet ts) const {
-        return (ts == TargetSet::Blacklist) ? set_v4 : drop_set_v4;
-    }
-    const std::string& resolve_set_v6(TargetSet ts) const {
-        return (ts == TargetSet::Blacklist) ? set_v6 : drop_set_v6;
-    }
-    const std::string& resolve_log_prefix(TargetSet ts) const {
-        return (ts == TargetSet::Blacklist) ? blacklist_log_prefix : droplist_log_prefix;
+                                const std::vector<std::string>& in_sets,
+                                const std::vector<std::string>& out_sets,
+                                const std::vector<std::string>& out_port_sets) {
+        NftConfig cfg;
+        cfg.table_v4 = table_name;
+        cfg.table_v6 = table_name + "6";
+        cfg.sets.reserve(in_sets.size() + out_sets.size() + out_port_sets.size());
+        for (const auto& n : in_sets) {
+            cfg.sets.push_back({n, n + "6", n + ": ", SetKind::InIP});
+        }
+        for (const auto& n : out_sets) {
+            cfg.sets.push_back({n, n + "6", "", SetKind::OutIP});
+        }
+        for (const auto& n : out_port_sets) {
+            cfg.sets.push_back({n, n + "6", "", SetKind::OutPort});
+        }
+        return cfg;
     }
 };
 

package/src/netlink/nftnl_raii.h

@@ -24,6 +24,7 @@ extern "C" {
 #include <libnftnl/chain.h>
 #include <libnftnl/set.h>
 #include <libnftnl/rule.h>
+#include <libnftnl/object.h>
 }
 
 #include <memory>
@@ -37,7 +38,7 @@ struct NftnlTableDeleter {
 };
 using UniqueTable = std::unique_ptr<struct nftnl_table, NftnlTableDeleter>;
 
-inline UniqueTable make_table() { return UniqueTable(nftnl_table_alloc()); }
+[[nodiscard]] inline UniqueTable make_table() { return UniqueTable(nftnl_table_alloc()); }
 
 // --- Chain -------------------------------------------------------------------
 
@@ -46,7 +47,7 @@ struct NftnlChainDeleter {
 };
 using UniqueChain = std::unique_ptr<struct nftnl_chain, NftnlChainDeleter>;
 
-inline UniqueChain make_chain() { return UniqueChain(nftnl_chain_alloc()); }
+[[nodiscard]] inline UniqueChain make_chain() { return UniqueChain(nftnl_chain_alloc()); }
 
 // --- Set ---------------------------------------------------------------------
 
@@ -55,7 +56,7 @@ struct NftnlSetDeleter {
 };
 using UniqueSet = std::unique_ptr<struct nftnl_set, NftnlSetDeleter>;
 
-inline UniqueSet make_set() { return UniqueSet(nftnl_set_alloc()); }
+[[nodiscard]] inline UniqueSet make_set() { return UniqueSet(nftnl_set_alloc()); }
 
 // --- Rule --------------------------------------------------------------------
 
@@ -64,6 +65,15 @@ struct NftnlRuleDeleter {
 };
 using UniqueRule = std::unique_ptr<struct nftnl_rule, NftnlRuleDeleter>;
 
-inline UniqueRule make_rule() { return UniqueRule(nftnl_rule_alloc()); }
+[[nodiscard]] inline UniqueRule make_rule() { return UniqueRule(nftnl_rule_alloc()); }
+
+// --- Object (stateful counter/quota) ----------------------------------------
+
+struct NftnlObjDeleter {
+    void operator()(struct nftnl_obj* o) const noexcept { nftnl_obj_free(o); }
+};
+using UniqueObj = std::unique_ptr<struct nftnl_obj, NftnlObjDeleter>;
+
+[[nodiscard]] inline UniqueObj make_obj() { return UniqueObj(nftnl_obj_alloc()); }
 
 } // namespace nft

package/src/netlink/nl_batch.h

@@ -24,10 +24,10 @@ public:
     NlBatch(NlBatch&&) = delete;
     NlBatch& operator=(NlBatch&&) = delete;
 
-    bool is_valid() const;
-    struct nlmsghdr* add_msg(uint16_t type, uint16_t family, uint16_t flags);
-    bool advance();
-    NlResult execute(NlSocket& sock, bool ignore_enoent = false);
+    [[nodiscard]] bool is_valid() const;
+    [[nodiscard]] struct nlmsghdr* add_msg(uint16_t type, uint16_t family, uint16_t flags);
+    [[nodiscard]] bool advance();
+    [[nodiscard]] NlResult execute(NlSocket& sock, bool ignore_enoent = false);
 
 private:
     std::unique_ptr<char[]> buf_;

package/src/netlink/nl_result.h

@@ -2,7 +2,7 @@
 
 #include <string>
 
-struct NlResult {
+struct [[nodiscard]] NlResult {
     bool success;
     std::string error;
 };

package/src/netlink/nl_socket.cpp

@@ -6,6 +6,7 @@ extern "C" {
 
 #include <cerrno>
 #include <cstring>
+#include <sys/select.h>
 #include <sys/socket.h>
 
 static constexpr size_t RECV_BUF_SIZE = 16384;
@@ -84,31 +85,34 @@ NlResult NlSocket::send_batch(struct mnl_nlmsg_batch* batch, bool ignore_enoent)
 
     BatchRecvCtx ctx{ignore_enoent, false, 0};
 
-    // Custom control callback array: override only NLMSG_ERROR (index 2).
-    // Array size = NLMSG_ERROR + 1 = 3, so NLMSG_DONE (3) and others
-    // fall through to default mnl handling.
     mnl_cb_t cb_ctl[NLMSG_ERROR + 1] = {};
     cb_ctl[NLMSG_ERROR] = batch_error_cb;
 
     int fd = mnl_socket_get_fd(nl_);
     char recv_buf[RECV_BUF_SIZE];
 
-    // First read: blocking (kernel response should arrive promptly)
-    ssize_t ret = mnl_socket_recvfrom(nl_, recv_buf, sizeof(recv_buf));
-    if (ret < 0)
-        return {false, std::string("mnl_socket_recvfrom: ") + strerror(errno)};
-    while (ret > 0) {
-        int cb_ret = mnl_cb_run2(recv_buf, static_cast<size_t>(ret), 0, portid_,
-                                  nullptr, &ctx, cb_ctl, NLMSG_ERROR + 1);
-        if (cb_ret <= 0)
+    // Match nft CLI pattern: select() with zero timeout to check for data,
+    // then recv+process in a loop. Continue on errors to collect all ACKs.
+    fd_set readfds;
+    struct timeval tv;
+
+    for (;;) {
+        FD_ZERO(&readfds);
+        FD_SET(fd, &readfds);
+        tv = {0, 0};
+
+        int sel = select(fd + 1, &readfds, nullptr, nullptr, &tv);
+        if (sel <= 0)
             break;
 
-        // Non-blocking read for remaining kernel responses
-        ret = recv(fd, recv_buf, sizeof(recv_buf), MSG_DONTWAIT);
-    }
+        ssize_t ret = mnl_socket_recvfrom(nl_, recv_buf, sizeof(recv_buf));
+        if (ret < 0)
+            return {false, std::string("mnl_socket_recvfrom: ") + strerror(errno)};
 
-    // Drain any leftover messages to keep socket clean for next operation
-    while (recv(fd, recv_buf, sizeof(recv_buf), MSG_DONTWAIT) > 0) {}
+        mnl_cb_run2(recv_buf, static_cast<size_t>(ret), 0, portid_,
+                     nullptr, &ctx, cb_ctl, NLMSG_ERROR + 1);
+        // Continue on error — collect all acknowledgments
+    }
 
     if (ctx.has_error)
         return {false, std::string("batch error: ") + strerror(ctx.error_code)};

package/src/netlink/nl_socket.h

@@ -18,9 +18,9 @@ public:
     NlSocket(NlSocket&&) = delete;
     NlSocket& operator=(NlSocket&&) = delete;
 
-    bool is_valid() const;
+    [[nodiscard]] bool is_valid() const;
 
-    NlResult send_batch(struct mnl_nlmsg_batch* batch, bool ignore_enoent = false);
+    [[nodiscard]] NlResult send_batch(struct mnl_nlmsg_batch* batch, bool ignore_enoent = false);
 
 private:
     struct mnl_socket* nl_;

package/src/netlink/operation.h

@@ -7,5 +7,5 @@ class NlSocket;
 class NlOperation {
 public:
     virtual ~NlOperation() = default;
-    virtual NlResult execute(NlSocket& sock) = 0;
+    [[nodiscard]] virtual NlResult execute(NlSocket& sock) = 0;
 };