Merge remote-tracking branch 'origin/main' into benvin/diff-expr-equality

# Conflicts:
#	internal/nftables/diff.go

internal/nftables/diff.go

@@ -105,3 +105,29 @@ func computeDiff(current, desired *FirewallState) *ChangeSet {
 func ruleEqual(a, b ManagedRule) bool {
 	return a.Chain == b.Chain && a.Tag == b.Tag && reflect.DeepEqual(a.Exprs, b.Exprs)
 }
+
+// restoreChangeSet replaces every managed rule in current with the snapshot's,
+// in snapshot order, so a restore cannot reorder rules.
+func restoreChangeSet(current, snap *FirewallState) *ChangeSet {
+	cs := &ChangeSet{}
+	for _, rules := range current.Rules {
+		for _, r := range rules {
+			if r.Tag != "" {
+				cs.Remove = append(cs.Remove, r)
+			}
+		}
+	}
+	chains := make([]string, 0, len(snap.Rules))
+	for c := range snap.Rules {
+		chains = append(chains, c)
+	}
+	sort.Strings(chains)
+	for _, c := range chains {
+		for _, r := range snap.Rules[c] {
+			if r.Tag != "" {
+				cs.Add = append(cs.Add, r)
+			}
+		}
+	}
+	return cs
+}