feat(nftables): move NFTables forwarding management from the Rust engine to @push.rocks/smartnftables

rust/crates/rustproxy/Cargo.toml

@@ -20,7 +20,6 @@ rustproxy-routing = { workspace = true }
 rustproxy-tls = { workspace = true }
 rustproxy-passthrough = { workspace = true }
 rustproxy-http = { workspace = true }
-rustproxy-nftables = { workspace = true }
 rustproxy-metrics = { workspace = true }
 rustproxy-security = { workspace = true }
 tokio = { workspace = true }

rust/crates/rustproxy/src/lib.rs

@@ -41,16 +41,14 @@ pub use rustproxy_routing;
 pub use rustproxy_passthrough;
 pub use rustproxy_tls;
 pub use rustproxy_http;
-pub use rustproxy_nftables;
 pub use rustproxy_metrics;
 pub use rustproxy_security;
 
-use rustproxy_config::{RouteConfig, RustProxyOptions, TlsMode, CertificateSpec, ForwardingEngine};
+use rustproxy_config::{RouteConfig, RustProxyOptions, TlsMode, CertificateSpec};
 use rustproxy_routing::RouteManager;
 use rustproxy_passthrough::{TcpListenerManager, UdpListenerManager, TlsCertConfig, ConnectionConfig};
 use rustproxy_metrics::{MetricsCollector, Metrics, Statistics};
 use rustproxy_tls::{CertManager, CertStore, CertBundle, CertMetadata, CertSource};
-use rustproxy_nftables::{NftManager, rule_builder};
 use tokio_util::sync::CancellationToken;
 
 /// Certificate status.
@@ -74,7 +72,6 @@ pub struct RustProxy {
     challenge_server: Option<challenge_server::ChallengeServer>,
     renewal_handle: Option<tokio::task::JoinHandle<()>>,
     sampling_handle: Option<tokio::task::JoinHandle<()>>,
-    nft_manager: Option<NftManager>,
     started: bool,
     started_at: Option<Instant>,
     /// Shared path to a Unix domain socket for relaying socket-handler connections back to TypeScript.
@@ -121,7 +118,6 @@ impl RustProxy {
             challenge_server: None,
             renewal_handle: None,
             sampling_handle: None,
-            nft_manager: None,
             started: false,
             started_at: None,
             socket_handler_relay: Arc::new(std::sync::RwLock::new(None)),
@@ -387,9 +383,6 @@ impl RustProxy {
             }
         }));
 
-        // Apply NFTables rules for routes using nftables forwarding engine
-        self.apply_nftables_rules(&self.options.routes.clone()).await;
-
         // Start renewal timer if ACME is enabled
         self.start_renewal_timer();
 
@@ -616,14 +609,6 @@ impl RustProxy {
         }
         self.challenge_server = None;
 
-        // Clean up NFTables rules
-        if let Some(ref mut nft) = self.nft_manager {
-            if let Err(e) = nft.cleanup().await {
-                warn!("NFTables cleanup failed: {}", e);
-            }
-        }
-        self.nft_manager = None;
-
         if let Some(ref mut listener) = self.listener_manager {
             listener.graceful_stop().await;
         }
@@ -825,9 +810,6 @@ impl RustProxy {
             }
         }
 
-        // Update NFTables rules: remove old, apply new
-        self.update_nftables_rules(&routes).await;
-
         self.options.routes = routes;
         Ok(())
     }
@@ -1149,99 +1131,6 @@ impl RustProxy {
         Ok(())
     }
 
-    /// Get NFTables status.
-    pub async fn get_nftables_status(&self) -> Result<HashMap<String, serde_json::Value>> {
-        match &self.nft_manager {
-            Some(nft) => Ok(nft.status()),
-            None => Ok(HashMap::new()),
-        }
-    }
-
-    /// Apply NFTables rules for routes using the nftables forwarding engine.
-    async fn apply_nftables_rules(&mut self, routes: &[RouteConfig]) {
-        let nft_routes: Vec<&RouteConfig> = routes.iter()
-            .filter(|r| r.action.forwarding_engine.as_ref() == Some(&ForwardingEngine::Nftables))
-            .collect();
-
-        if nft_routes.is_empty() {
-            return;
-        }
-
-        info!("Applying NFTables rules for {} routes", nft_routes.len());
-
-        let table_name = nft_routes.iter()
-            .find_map(|r| r.action.nftables.as_ref()?.table_name.clone())
-            .unwrap_or_else(|| "rustproxy".to_string());
-
-        let mut nft = NftManager::new(Some(table_name));
-
-        for route in &nft_routes {
-            let route_id = route.id.as_deref()
-                .or(route.name.as_deref())
-                .unwrap_or("unnamed");
-
-            let nft_options = match &route.action.nftables {
-                Some(opts) => opts.clone(),
-                None => rustproxy_config::NfTablesOptions {
-                    preserve_source_ip: None,
-                    protocol: None,
-                    max_rate: None,
-                    priority: None,
-                    table_name: None,
-                    use_ip_sets: None,
-                    use_advanced_nat: None,
-                },
-            };
-
-            let targets = match &route.action.targets {
-                Some(targets) => targets,
-                None => {
-                    warn!("NFTables route '{}' has no targets, skipping", route_id);
-                    continue;
-                }
-            };
-
-            let source_ports = route.route_match.ports.to_ports();
-            for target in targets {
-                let target_host = target.host.first().to_string();
-                let target_port_spec = &target.port;
-
-                for &source_port in &source_ports {
-                    let resolved_port = target_port_spec.resolve(source_port);
-                    let rules = rule_builder::build_dnat_rule(
-                        nft.table_name(),
-                        "prerouting",
-                        source_port,
-                        &target_host,
-                        resolved_port,
-                        &nft_options,
-                    );
-
-                    let rule_id = format!("{}-{}-{}", route_id, source_port, resolved_port);
-                    if let Err(e) = nft.apply_rules(&rule_id, rules).await {
-                        error!("Failed to apply NFTables rules for route '{}': {}", route_id, e);
-                    }
-                }
-            }
-        }
-
-        self.nft_manager = Some(nft);
-    }
-
-    /// Update NFTables rules when routes change.
-    async fn update_nftables_rules(&mut self, new_routes: &[RouteConfig]) {
-        // Clean up old rules
-        if let Some(ref mut nft) = self.nft_manager {
-            if let Err(e) = nft.cleanup().await {
-                warn!("NFTables cleanup during update failed: {}", e);
-            }
-        }
-        self.nft_manager = None;
-
-        // Apply new rules
-        self.apply_nftables_rules(new_routes).await;
-    }
-
     /// Extract TLS configurations from route configs.
     fn extract_tls_configs(routes: &[RouteConfig]) -> HashMap<String, TlsCertConfig> {
         let mut configs = HashMap::new();

rust/crates/rustproxy/src/management.rs

@@ -147,7 +147,6 @@ async fn handle_request(
         "renewCertificate" => handle_renew_certificate(&id, &request.params, proxy).await,
         "getCertificateStatus" => handle_get_certificate_status(&id, &request.params, proxy).await,
         "getListeningPorts" => handle_get_listening_ports(&id, proxy),
-        "getNftablesStatus" => handle_get_nftables_status(&id, proxy).await,
         "setSocketHandlerRelay" => handle_set_socket_handler_relay(&id, &request.params, proxy).await,
         "setDatagramHandlerRelay" => handle_set_datagram_handler_relay(&id, &request.params, proxy).await,
         "addListeningPort" => handle_add_listening_port(&id, &request.params, proxy).await,
@@ -352,26 +351,6 @@ fn handle_get_listening_ports(
     }
 }
 
-async fn handle_get_nftables_status(
-    id: &str,
-    proxy: &Option<RustProxy>,
-) -> ManagementResponse {
-    match proxy.as_ref() {
-        Some(p) => {
-            match p.get_nftables_status().await {
-                Ok(status) => {
-                    match serde_json::to_value(&status) {
-                        Ok(v) => ManagementResponse::ok(id.to_string(), v),
-                        Err(e) => ManagementResponse::err(id.to_string(), format!("Failed to serialize: {}", e)),
-                    }
-                }
-                Err(e) => ManagementResponse::err(id.to_string(), format!("Failed to get status: {}", e)),
-            }
-        }
-        None => ManagementResponse::ok(id.to_string(), serde_json::json!({})),
-    }
-}
-
 async fn handle_set_socket_handler_relay(
     id: &str,
     params: &serde_json::Value,

rust/crates/rustproxy/tests/common/mod.rs

@@ -297,8 +297,6 @@ pub fn make_test_route(
             load_balancing: None,
             advanced: None,
             options: None,
-            forwarding_engine: None,
-            nftables: None,
             send_proxy_protocol: None,
             udp: None,
         },