nftables-napi 0.4.3 → 0.4.4

package/lib/index.d.ts

@@ -31,7 +31,11 @@ export interface NftManagerOptions {
 
 /** Options for adding a single address. */
 export interface AddAddressOptions {
-    /** IPv4/IPv6 address or CIDR (e.g., "1.2.3.4", "10.0.0.0/8", "2001:db8::/32"). */
+    /**
+     * IPv4/IPv6 address or CIDR (e.g., "1.2.3.4", "10.0.0.0/8", "2001:db8::/32").
+     * Misaligned CIDR (host bits set) is auto-normalized to the network address,
+     * e.g. "10.0.0.5/24" becomes "10.0.0.0/24".
+     */
     ip: string;
     /** Target set name (must match one from constructor's ingressAddrSets or egressAddrSets). */
     set: string;
@@ -41,7 +45,11 @@ export interface AddAddressOptions {
 
 /** Options for removing a single address. */
 export interface RemoveAddressOptions {
-    /** IPv4/IPv6 address or CIDR to remove (must match exactly as added). */
+    /**
+     * IPv4/IPv6 address or CIDR to remove (must match exactly as added).
+     * Misaligned CIDR (host bits set) is auto-normalized to the network address,
+     * e.g. "10.0.0.5/24" becomes "10.0.0.0/24".
+     */
     ip: string;
     /** Target set name (must match one from constructor's ingressAddrSets or egressAddrSets). */
     set: string;
@@ -49,7 +57,7 @@ export interface RemoveAddressOptions {
 
 /** Options for bulk adding addresses. */
 export interface AddAddressesOptions {
-    /** Array of IPv4/IPv6 addresses or CIDRs. */
+    /** Array of IPv4/IPv6 addresses or CIDRs. Misaligned CIDR is auto-normalized. */
     ips: string[];
     /** Target set name (must match one from constructor's ingressAddrSets or egressAddrSets). */
     set: string;
@@ -59,7 +67,7 @@ export interface AddAddressesOptions {
 
 /** Options for bulk removing addresses. */
 export interface RemoveAddressesOptions {
-    /** Array of IPv4/IPv6 addresses or CIDRs to remove. */
+    /** Array of IPv4/IPv6 addresses or CIDRs to remove. Misaligned CIDR is auto-normalized. */
     ips: string[];
     /** Target set name (must match one from constructor's ingressAddrSets or egressAddrSets). */
     set: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nftables-napi",
-  "version": "0.4.3",
+  "version": "0.4.4",
   "description": "Native Node.js binding for nftables via libnftnl+libmnl — nftables firewall management",
   "author": {
     "name": "kastov",

package/src/validation.cpp

@@ -155,24 +155,19 @@ CidrAddr parse_ip_or_cidr(const std::string& input) {
 
     auto prefix_len = static_cast<uint8_t>(prefix);
 
-    // Verify host bits are zero
+    // Mask off host bits silently — input like "10.0.0.5/24" becomes
+    // "10.0.0.0/24", matching `ip route` and Python ipaddress(strict=False).
     uint32_t full_bytes = prefix_len / 8;
     uint32_t remainder_bits = prefix_len % 8;
 
-    // Check boundary byte: host bits must be zero
     if (remainder_bits > 0 && full_bytes < ip.len) {
-        uint8_t mask = static_cast<uint8_t>(0xFF >> remainder_bits);
-        if ((ip.bytes[full_bytes] & mask) != 0) {
-            return result; // host bits set in boundary byte
-        }
+        uint8_t mask = static_cast<uint8_t>(0xFF << (8 - remainder_bits));
+        ip.bytes[full_bytes] &= mask;
     }
 
-    // Check all bytes after the prefix boundary must be zero
-    uint32_t start_check = full_bytes + (remainder_bits > 0 ? 1 : 0);
-    for (uint32_t i = start_check; i < ip.len; ++i) {
-        if (ip.bytes[i] != 0) {
-            return result; // host bits set
-        }
+    uint32_t start_zero = full_bytes + (remainder_bits > 0 ? 1 : 0);
+    for (uint32_t i = start_zero; i < ip.len; ++i) {
+        ip.bytes[i] = 0;
     }
 
     result.network = ip;

package/src/validation.h

@@ -22,11 +22,17 @@ struct CidrAddr {
 };
 
 // Parse IP string or CIDR notation. Accepts:
-//   "1.2.3.4"       -> CidrAddr{network=1.2.3.4, end=1.2.3.5}
-//   "10.0.0.0/8"    -> CidrAddr{network=10.0.0.0, end=11.0.0.0}
-//   "2001:db8::/32" -> CidrAddr{network=2001:db8::, end=2001:db9::}
+//   "1.2.3.4"          -> CidrAddr{network=1.2.3.4, end=1.2.3.5}
+//   "10.0.0.0/8"       -> CidrAddr{network=10.0.0.0, end=11.0.0.0}
+//   "2001:db8::/32"    -> CidrAddr{network=2001:db8::, end=2001:db9::}
+//   "198.19.0.0/15"    -> CidrAddr{network=198.18.0.0, end=198.20.0.0}
+//                         (host bits silently masked off — see below)
+//
+// Misaligned CIDR (host bits set) is auto-normalized: host bits are
+// masked off to obtain the network address. Matches `ip route` and
+// Python ipaddress.ip_network(strict=False). Rejects only:
+// /0 (too dangerous), prefix > family bits, malformed input.
 // Returns CidrAddr with network.family=Invalid on failure.
-// Rejects: host bits set (192.168.1.1/24), prefix > 32/128, /0 (too dangerous).
 [[nodiscard]] CidrAddr parse_ip_or_cidr(const std::string& input);
 
 struct PortVal {