nftables-napi 0.2.0 → 0.3.0

package/README.md

@@ -35,9 +35,9 @@ const { NftManager } = require("nftables-napi");
 
 const nft = new NftManager({
   tableName: "myfw",
-  sets: ["blacklist"],
-  outSets: ["blocklist"],
-  outPortSets: ["blocked_ports"],
+  ingressAddrSets: ["blacklist"],
+  egressAddrSets: ["blocklist"],
+  egressPortSets: ["blocked_ports"],
 });
 
 await nft.createTable();
@@ -82,9 +82,9 @@ await nft.deleteTable();
 | Option | Type | Required | Description |
 | --- | --- | --- | --- |
 | `tableName` | `string` | Yes | Base table name. IPv6 table auto-appends `'6'`. |
-| `sets` | `string[]` | Yes | Input/forward IP set names (≥1). Block by **source** address on input and forward chains. Rules: log + named counter + drop. IPv6 sets auto-append `'6'`. |
-| `outSets` | `string[]` | No | Output IP set names. Block by **destination** address on output chain. Rules: named counter + drop (no log). IPv6 sets auto-append `'6'`. |
-| `outPortSets` | `string[]` | No | Output port set names. Block by **destination port** (TCP/UDP) on output chain using concatenated `inet_proto . inet_service` sets. Ports are added to both IPv4 and IPv6 tables. IPv6 sets auto-append `'6'`. |
+| `ingressAddrSets` | `string[]` | Yes | Input/forward IP set names (≥1). Block by **source** address on input and forward chains. Rules: log + named counter + drop. IPv6 sets auto-append `'6'`. |
+| `egressAddrSets` | `string[]` | No | Output IP set names. Block by **destination** address on output chain. Rules: named counter + drop (no log). IPv6 sets auto-append `'6'`. |
+| `egressPortSets` | `string[]` | No | Output port set names. Block by **destination port** (TCP/UDP) on output chain using concatenated `inet_proto . inet_service` sets. Ports are added to both IPv4 and IPv6 tables. IPv6 sets auto-append `'6'`. |
 
 ### Methods
 
@@ -99,7 +99,7 @@ All methods return `Promise<void>` and throw on error.
 
 #### IP address operations
 
-Work with both `sets` (input/forward) and `outSets` (output).
+Work with both `ingressAddrSets` (input/forward) and `egressAddrSets` (output).
 
 | Method | Description |
 | --- | --- |
@@ -110,7 +110,7 @@ Work with both `sets` (input/forward) and `outSets` (output).
 
 #### Port operations
 
-Work with `outPortSets` only. Ports are added to both IPv4 and IPv6 tables.
+Work with `egressPortSets` only. Ports are added to both IPv4 and IPv6 tables.
 
 | Method | Description |
 | --- | --- |
@@ -121,7 +121,7 @@ Work with `outPortSets` only. Ports are added to both IPv4 and IPv6 tables.
 
 ### What `createTable()` builds
 
-For a config with `sets: ["bl"]`, `outSets: ["out"]`, `outPortSets: ["ports"]`:
+For a config with `ingressAddrSets: ["bl"]`, `egressAddrSets: ["out"]`, `egressPortSets: ["ports"]`:
 
 ```
 table ip myfw {

package/lib/index.d.ts

@@ -9,31 +9,31 @@ export interface NftManagerOptions {
     /** Base table name. IPv6 table auto-appends '6'. */
     tableName: string;
     /**
-     * Input/forward IP set names (≥1 required). Block by source address.
+     * Ingress IP set names (≥1 required). Block by source address.
      * Rules: log prefix "<setName>: " + named counter + drop on input and forward chains.
      * IPv6 sets auto-append '6'.
      */
-    sets: string[];
+    ingressAddrSets: string[];
     /**
-     * Output IP set names (optional). Block by destination address.
+     * Egress IP set names (optional). Block by destination address.
      * Rules: named counter + drop on output chain (no log).
      * IPv6 sets auto-append '6'.
      */
-    outSets?: string[];
+    egressAddrSets?: string[];
     /**
-     * Output port set names (optional). Block by tcp/udp destination port.
+     * Egress port set names (optional). Block by tcp/udp destination port.
      * Rules: single concatenated (proto . port) lookup + named counter + drop on output chain (no log).
      * Port is added to BOTH IPv4 and IPv6 tables (ports are family-independent).
      * IPv6 sets auto-append '6'.
      */
-    outPortSets?: string[];
+    egressPortSets?: string[];
 }
 
 /** Options for adding a single address. */
 export interface AddAddressOptions {
     /** IPv4 or IPv6 address (e.g., "1.2.3.4" or "2001:db8::1"). */
     ip: string;
-    /** Target set name (must match one from constructor's sets or outSets). */
+    /** Target set name (must match one from constructor's ingressAddrSets or egressAddrSets). */
     set: string;
     /** Timeout in seconds. Omit for permanent. */
     timeout?: number;
@@ -43,7 +43,7 @@ export interface AddAddressOptions {
 export interface RemoveAddressOptions {
     /** IPv4 or IPv6 address to remove. */
     ip: string;
-    /** Target set name (must match one from constructor's sets or outSets). */
+    /** Target set name (must match one from constructor's ingressAddrSets or egressAddrSets). */
     set: string;
 }
 
@@ -51,7 +51,7 @@ export interface RemoveAddressOptions {
 export interface AddAddressesOptions {
     /** Array of IPv4/IPv6 addresses. */
     ips: string[];
-    /** Target set name (must match one from constructor's sets or outSets). */
+    /** Target set name (must match one from constructor's ingressAddrSets or egressAddrSets). */
     set: string;
     /** Timeout in seconds. Omit for permanent. */
     timeout?: number;
@@ -61,7 +61,7 @@ export interface AddAddressesOptions {
 export interface RemoveAddressesOptions {
     /** Array of IPv4/IPv6 addresses to remove. */
     ips: string[];
-    /** Target set name (must match one from constructor's sets or outSets). */
+    /** Target set name (must match one from constructor's ingressAddrSets or egressAddrSets). */
     set: string;
 }
 
@@ -69,7 +69,7 @@ export interface RemoveAddressesOptions {
 export interface AddPortOptions {
     /** Port number (0-65535). */
     port: number;
-    /** Target port set name (must match one from constructor's outPortSets). */
+    /** Target port set name (must match one from constructor's egressPortSets). */
     set: string;
     /** Protocol: 'tcp', 'udp', or omit for both. Default: both. */
     protocol?: 'tcp' | 'udp';
@@ -81,7 +81,7 @@ export interface AddPortOptions {
 export interface RemovePortOptions {
     /** Port number (0-65535). */
     port: number;
-    /** Target port set name (must match one from constructor's outPortSets). */
+    /** Target port set name (must match one from constructor's egressPortSets). */
     set: string;
     /** Protocol: 'tcp', 'udp', or omit for both. Default: both. */
     protocol?: 'tcp' | 'udp';
@@ -91,7 +91,7 @@ export interface RemovePortOptions {
 export interface AddPortsOptions {
     /** Array of port numbers (0-65535). */
     ports: number[];
-    /** Target port set name (must match one from constructor's outPortSets). */
+    /** Target port set name (must match one from constructor's egressPortSets). */
     set: string;
     /** Protocol: 'tcp', 'udp', or omit for both. Default: both. */
     protocol?: 'tcp' | 'udp';
@@ -103,7 +103,7 @@ export interface AddPortsOptions {
 export interface RemovePortsOptions {
     /** Array of port numbers (0-65535). */
     ports: number[];
-    /** Target port set name (must match one from constructor's outPortSets). */
+    /** Target port set name (must match one from constructor's egressPortSets). */
     set: string;
     /** Protocol: 'tcp', 'udp', or omit for both. Default: both. */
     protocol?: 'tcp' | 'udp';
@@ -127,9 +127,9 @@ export class NftManager {
      * Creates:
      * - Named counter "processed" (global traffic counter per chain)
      * - Named counter per set (blocked traffic counter)
-     * - Input chain with log + counter + drop rules (for sets)
-     * - Forward chain with log + counter + drop rules (for sets)
-     * - Output chain with counter + drop rules (for outSets and outPortSets, no log)
+     * - Input chain with log + counter + drop rules (for ingressAddrSets)
+     * - Forward chain with log + counter + drop rules (for ingressAddrSets)
+     * - Output chain with counter + drop rules (for egressAddrSets and egressPortSets, no log)
      * - Per-element counters on all sets
      *
      * @throws {Error} if nftables operation fails
@@ -147,7 +147,7 @@ export class NftManager {
     /**
      * Adds an IP address to a set.
      * Auto-detects IPv4 vs IPv6 and routes to the correct table/set.
-     * Works with both input sets (sets) and output sets (outSets).
+     * Works with both input sets (ingressAddrSets) and output sets (egressAddrSets).
      *
      * @param options - Address, target set name, and optional timeout.
      * @throws {TypeError} if options or fields have wrong types
@@ -158,7 +158,7 @@ export class NftManager {
     /**
      * Removes an IP address from a set.
      * Idempotent — no error if IP is not in the set.
-     * Works with both input sets (sets) and output sets (outSets).
+     * Works with both input sets (ingressAddrSets) and output sets (egressAddrSets).
      *
      * @param options - Address and target set name.
      * @throws {TypeError} if options or fields have wrong types

package/lib/index.js

@@ -6,7 +6,6 @@ let binding;
 try {
   binding = require('node-gyp-build')(path.join(__dirname, '..'));
 } catch (e) {
-  if (process.platform === 'linux') throw e;
   binding = null;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nftables-napi",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Native Node.js binding for nftables via libnftnl+libmnl — nftables firewall management",
   "author": {
     "name": "kastov",

package/src/nft_manager.cpp

@@ -250,7 +250,7 @@ NftManager::NftManager(const Napi::CallbackInfo& info)
 
     if (info.Length() < 1 || !info[0].IsObject()) {
         Napi::TypeError::New(env,
-            "NftManager requires options object with tableName and sets")
+            "NftManager requires options object with tableName and ingressAddrSets")
             .ThrowAsJavaScriptException();
         return;
     }
@@ -264,18 +264,18 @@ NftManager::NftManager(const Napi::CallbackInfo& info)
         return;
     }
 
-    // sets — required non-empty array
-    if (!opts.Has("sets") || !opts.Get("sets").IsArray()) {
-        Napi::TypeError::New(env, "NftManager: 'sets' is required and must be an array of strings")
+    // ingressAddrSets — required non-empty array
+    if (!opts.Has("ingressAddrSets") || !opts.Get("ingressAddrSets").IsArray()) {
+        Napi::TypeError::New(env, "NftManager: 'ingressAddrSets' is required and must be an array of strings")
             .ThrowAsJavaScriptException();
         return;
     }
 
-    Napi::Array sets_arr = opts.Get("sets").As<Napi::Array>();
+    Napi::Array sets_arr = opts.Get("ingressAddrSets").As<Napi::Array>();
     uint32_t len = sets_arr.Length();
 
     if (len == 0) {
-        Napi::Error::New(env, "NftManager: 'sets' must contain at least one set name")
+        Napi::Error::New(env, "NftManager: 'ingressAddrSets' must contain at least one set name")
             .ThrowAsJavaScriptException();
         return;
     }
@@ -286,25 +286,25 @@ NftManager::NftManager(const Napi::CallbackInfo& info)
     for (uint32_t i = 0; i < len; ++i) {
         Napi::Value val = sets_arr[i];
         if (!val.IsString()) {
-            Napi::TypeError::New(env, "NftManager: 'sets[" + std::to_string(i) + "]' must be a string")
+            Napi::TypeError::New(env, "NftManager: 'ingressAddrSets[" + std::to_string(i) + "]' must be a string")
                 .ThrowAsJavaScriptException();
             return;
         }
         std::string name = val.As<Napi::String>().Utf8Value();
         if (name.empty()) {
-            Napi::Error::New(env, "NftManager: 'sets[" + std::to_string(i) + "]' must not be empty")
+            Napi::Error::New(env, "NftManager: 'ingressAddrSets[" + std::to_string(i) + "]' must not be empty")
                 .ThrowAsJavaScriptException();
             return;
         }
         in_sets.push_back(std::move(name));
     }
 
-    // Parse optional outSets (OutIP)
-    std::vector<std::string> out_sets = parse_optional_string_array(env, opts, "outSets", "NftManager");
+    // Parse optional egressAddrSets (OutIP)
+    std::vector<std::string> out_sets = parse_optional_string_array(env, opts, "egressAddrSets", "NftManager");
     if (env.IsExceptionPending()) return;
 
-    // Parse optional outPortSets (OutPort)
-    std::vector<std::string> out_port_sets = parse_optional_string_array(env, opts, "outPortSets", "NftManager");
+    // Parse optional egressPortSets (OutPort)
+    std::vector<std::string> out_port_sets = parse_optional_string_array(env, opts, "egressPortSets", "NftManager");
     if (env.IsExceptionPending()) return;
 
     // Cross-array duplicate check: all names must be unique across all arrays