Refuse mutating commands during a try and scope reverts to the try ID

apply, flush and purge take the try lock and fail with ErrPending, which now
names 'tomswall revert' as the recovery after a failed automatic revert. Each
try gets an ID passed to the timer's 'revert --id', so a stale timer cannot
revert a newer try. Adds tests for Revert success/failure/stale ID and for
restoring a present table at the engine level.

cmd/tomswall/guard_test.go

@@ -0,0 +1,30 @@
+package main
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/spf13/cobra"
+
+	"git.unkin.net/unkin/tomswall/internal/tryapply"
+)
+
+func TestMutatingCommandsRefuseWhileTryPending(t *testing.T) {
+	orig := tryapply.Dir
+	tryapply.Dir = t.TempDir()
+	t.Cleanup(func() { tryapply.Dir = orig })
+	if err := os.WriteFile(filepath.Join(tryapply.Dir, "try-snapshot.json"), []byte("{}"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	configPath = "../../tomswall.example.yaml"
+
+	for _, cmd := range []*cobra.Command{applyCmd(), flushCmd(), purgeCmd()} {
+		t.Run(cmd.Use, func(t *testing.T) {
+			if err := cmd.RunE(cmd, nil); !errors.Is(err, tryapply.ErrPending) {
+				t.Errorf("got %v, want ErrPending", err)
+			}
+		})
+	}
+}

cmd/tomswall/main.go

@@ -12,6 +12,7 @@ import (
 	"git.unkin.net/unkin/tomswall/internal/config"
 	"git.unkin.net/unkin/tomswall/internal/nftables"
 	"git.unkin.net/unkin/tomswall/internal/shorewall"
+	"git.unkin.net/unkin/tomswall/internal/tryapply"
 )
 
 var configPath string
@@ -89,6 +90,12 @@ The firewall is never torn down — existing connections are preserved.`,
 				return err
 			}
 
+			unlock, err := tryapply.Acquire()
+			if err != nil {
+				return err
+			}
+			defer unlock()
+
 			engine, err := nftables.NewEngine(cfg)
 			if err != nil {
 				return fmt.Errorf("initializing nftables: %w", err)
@@ -230,6 +237,14 @@ func purgeCmd() *cobra.Command {
 				return err
 			}
 
+			if !dryRun {
+				unlock, err := tryapply.Acquire()
+				if err != nil {
+					return err
+				}
+				defer unlock()
+			}
+
 			engine, err := nftables.NewEngine(cfg)
 			if err != nil {
 				return fmt.Errorf("initializing nftables: %w", err)
@@ -275,6 +290,12 @@ func flushCmd() *cobra.Command {
 				return err
 			}
 
+			unlock, err := tryapply.Acquire()
+			if err != nil {
+				return err
+			}
+			defer unlock()
+
 			engine, err := nftables.NewEngine(cfg)
 			if err != nil {
 				return fmt.Errorf("initializing nftables: %w", err)

cmd/tomswall/try.go

@@ -40,12 +40,12 @@ dies. Confirm from a new session to prove new connections still work.`,
 			abort := make(chan os.Signal, 1)
 			signal.Notify(abort, syscall.SIGHUP, syscall.SIGINT, syscall.SIGTERM)
 
-			applied, err := tryApply(cfg, timeout+revertGrace)
-			if err != nil || !applied {
+			id, err := tryApply(cfg, timeout+revertGrace)
+			if err != nil || id == "" {
 				return err
 			}
 			fmt.Printf("Applied. Run 'tomswall confirm' within %s or the previous ruleset is restored.\n", timeout)
-			msg, err := confirmOrRevert(confirm, abort, timeout, tryapply.Revert)
+			msg, err := confirmOrRevert(confirm, abort, timeout, func() (bool, error) { return tryapply.Revert(id) })
 			if err != nil {
 				return err
 			}
@@ -57,41 +57,44 @@ dies. Confirm from a new session to prove new connections still work.`,
 	return cmd
 }
 
-func tryApply(cfg *config.Config, fallback time.Duration) (bool, error) {
+// tryApply applies cfg under a pending try and returns its ID, or "" when
+// there was nothing to change.
+func tryApply(cfg *config.Config, fallback time.Duration) (string, error) {
 	unlock, err := tryapply.Acquire()
 	if err != nil {
-		return false, err
+		return "", err
 	}
 	defer unlock()
 
 	engine, err := nftables.NewEngine(cfg)
 	if err != nil {
-		return false, fmt.Errorf("initializing nftables: %w", err)
+		return "", fmt.Errorf("initializing nftables: %w", err)
 	}
 	changes, err := engine.Plan()
 	if err != nil {
-		return false, fmt.Errorf("computing changes: %w", err)
+		return "", fmt.Errorf("computing changes: %w", err)
 	}
 	if changes.Empty() {
 		fmt.Println("No changes needed — firewall is up to date.")
-		return false, nil
+		return "", nil
 	}
 	fmt.Println(changes.Summary())
 
 	snap, err := engine.Snapshot()
 	if err != nil {
-		return false, fmt.Errorf("snapshotting ruleset: %w", err)
+		return "", fmt.Errorf("snapshotting ruleset: %w", err)
 	}
-	if err := tryapply.Arm(snap, os.Getpid(), fallback); err != nil {
-		return false, err
+	id, err := tryapply.Arm(snap, os.Getpid(), fallback)
+	if err != nil {
+		return "", err
 	}
 	if err := engine.Apply(changes); err != nil {
 		if derr := tryapply.Discard(); derr != nil {
 			err = fmt.Errorf("%w (discarding snapshot: %v)", err, derr)
 		}
-		return false, fmt.Errorf("applying changes: %w", err)
+		return "", fmt.Errorf("applying changes: %w", err)
 	}
-	return true, nil
+	return id, nil
 }
 
 // confirmOrRevert waits for confirm; on abort or timeout it runs revert.
@@ -143,11 +146,12 @@ func confirmCmd() *cobra.Command {
 }
 
 func revertCmd() *cobra.Command {
-	return &cobra.Command{
+	var id string
+	cmd := &cobra.Command{
 		Use:   "revert",
 		Short: "Restore the ruleset saved by a pending 'tomswall try'",
 		RunE: func(cmd *cobra.Command, args []string) error {
-			reverted, err := tryapply.Revert()
+			reverted, err := tryapply.Revert(id)
 			if err != nil {
 				return err
 			}
@@ -159,4 +163,6 @@ func revertCmd() *cobra.Command {
 			return nil
 		},
 	}
+	cmd.Flags().StringVar(&id, "id", "", "only revert the try with this ID (used by the revert timer)")
+	return cmd
 }