Merge pull request 'Emit the implied ACCEPT for DNAT and REDIRECT rules' (#29) from benvin/dnat-implied-accept into main

Reviewed-on: #29

.woodpecker/build.yaml

@@ -3,9 +3,21 @@ when:
 
 steps:
   - name: build
-    image: golang:1.23
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.2-alma9
     commands:
       - go build ./...
+    environment:
+      GOCACHE_S3_BUCKET: gocache
+      GOCACHE_S3_REGION: us-east-1
+      GOCACHE_S3_ENDPOINT_URL: https://s3.ceph.unkin.net
+      GOCACHE_S3_PATH_STYLE: "true"
+      GOCACHE_KEY_PREFIX: ci-tomswall
+      GOCACHE_METRICS: "true"
+      GOCACHEPROG: go-cache-plugin --cache-dir=/tmp/gocache
+      AWS_ACCESS_KEY_ID:
+        from_secret: GOCACHE_AWS_ACCESS_KEY_ID
+      AWS_SECRET_ACCESS_KEY:
+        from_secret: GOCACHE_AWS_SECRET_ACCESS_KEY
     backend_options:
       kubernetes:
         serviceAccountName: default

.woodpecker/pre-commit.yaml

@@ -3,9 +3,21 @@ when:
 
 steps:
   - name: pre-commit
-    image: git.unkin.net/unkin/almalinux9-gobuilder:20260606
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.2-alma9
     commands:
       - uvx pre-commit run --all-files
+    environment:
+      GOCACHE_S3_BUCKET: gocache
+      GOCACHE_S3_REGION: us-east-1
+      GOCACHE_S3_ENDPOINT_URL: https://s3.ceph.unkin.net
+      GOCACHE_S3_PATH_STYLE: "true"
+      GOCACHE_KEY_PREFIX: ci-tomswall
+      GOCACHE_METRICS: "true"
+      GOCACHEPROG: go-cache-plugin --cache-dir=/tmp/gocache
+      AWS_ACCESS_KEY_ID:
+        from_secret: GOCACHE_AWS_ACCESS_KEY_ID
+      AWS_SECRET_ACCESS_KEY:
+        from_secret: GOCACHE_AWS_SECRET_ACCESS_KEY
     backend_options:
       kubernetes:
         serviceAccountName: default

.woodpecker/release.yaml

@@ -0,0 +1,148 @@
+when:
+  - event: tag
+    ref: refs/tags/v*
+
+steps:
+  - name: test
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.2-alma9
+    commands:
+      - go test ./...
+    environment:
+      GOCACHE_S3_BUCKET: gocache
+      GOCACHE_S3_REGION: us-east-1
+      GOCACHE_S3_ENDPOINT_URL: https://s3.ceph.unkin.net
+      GOCACHE_S3_PATH_STYLE: "true"
+      GOCACHE_KEY_PREFIX: ci-tomswall
+      GOCACHE_METRICS: "true"
+      GOCACHEPROG: go-cache-plugin --cache-dir=/tmp/gocache
+      AWS_ACCESS_KEY_ID:
+        from_secret: GOCACHE_AWS_ACCESS_KEY_ID
+      AWS_SECRET_ACCESS_KEY:
+        from_secret: GOCACHE_AWS_SECRET_ACCESS_KEY
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2
+
+  - name: build
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.2-alma9
+    commands:
+      - make dist-build VERSION=${CI_COMMIT_TAG}
+    depends_on: [test]
+    environment:
+      GOCACHE_S3_BUCKET: gocache
+      GOCACHE_S3_REGION: us-east-1
+      GOCACHE_S3_ENDPOINT_URL: https://s3.ceph.unkin.net
+      GOCACHE_S3_PATH_STYLE: "true"
+      GOCACHE_KEY_PREFIX: ci-tomswall
+      GOCACHE_METRICS: "true"
+      GOCACHEPROG: go-cache-plugin --cache-dir=/tmp/gocache
+      AWS_ACCESS_KEY_ID:
+        from_secret: GOCACHE_AWS_ACCESS_KEY_ID
+      AWS_SECRET_ACCESS_KEY:
+        from_secret: GOCACHE_AWS_SECRET_ACCESS_KEY
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2
+
+  - name: package
+    image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+    commands:
+      - ./scripts/build-rpm.sh ${CI_COMMIT_TAG}
+    depends_on: [build]
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2
+
+  - name: upload-rpm
+    image: git.unkin.net/unkin/almalinux9-base:20260606
+    commands:
+      - |
+        HOST="https://artifactapi.k8s.syd1.au.unkin.net"
+        REPO="rpm-internal"
+        for rpm in dist/*.rpm; do
+          FILE=$$(basename "$$rpm")
+          code=$$(curl -s -o /dev/null -w '%{http_code}' "$$HOST/api/v2/remotes/$$REPO/files/Packages/$$FILE" || true)
+          if [ "$$code" = "200" ]; then
+            echo "$$FILE already exists in $$REPO (HTTP $$code); skipping upload"
+            continue
+          fi
+          echo "Uploading $$FILE to $$REPO (existence probe returned $$code)"
+          curl -f -X PUT \
+            "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" \
+            -H "Content-Type: application/x-rpm" \
+            --data-binary @"$$rpm"
+        done
+    depends_on: [package]
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 128Mi
+            cpu: 100m
+          limits:
+            memory: 512Mi
+            cpu: 500m
+
+  - name: release
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/tea:0.1.0
+    environment:
+      RELEASER_TOKEN:
+        from_secret: RELEASER_TOKEN
+    commands:
+      - |
+        tea logins add --name gitea --url https://git.unkin.net --token "$${RELEASER_TOKEN}" --no-version-check
+        CUR_SHA=$$(git rev-list -n1 "${CI_COMMIT_TAG}")
+        PREV_TAG=""
+        for t in $$(git tag --sort=-v:refname); do
+          [ "$$t" = "${CI_COMMIT_TAG}" ] && continue
+          [ "$$(git rev-list -n1 "$$t")" = "$$CUR_SHA" ] && continue
+          if git merge-base --is-ancestor "$$t" "${CI_COMMIT_TAG}" 2>/dev/null; then
+            PREV_TAG="$$t"; break
+          fi
+        done
+        if [ -n "$$PREV_TAG" ]; then
+          NOTES=$$(git log "$${PREV_TAG}..${CI_COMMIT_TAG}" --pretty=format:"- %s")
+        else
+          NOTES=$$(git log --pretty=format:"- %s")
+        fi
+        tea releases create --tag "${CI_COMMIT_TAG}" --title "${CI_COMMIT_TAG}" --note "$${NOTES}" --login gitea --repo "${CI_REPO}"
+        cp dist/tomswall tomswall-linux-amd64
+        ASSETS="tomswall-linux-amd64"
+        RPM=$$(ls dist/*.rpm 2>/dev/null | head -1)
+        [ -n "$$RPM" ] && ASSETS="$$ASSETS $$RPM"
+        sha256sum $$ASSETS > sha256sums.txt
+        tea releases assets create "${CI_COMMIT_TAG}" $$ASSETS sha256sums.txt \
+          --login gitea --repo "${CI_REPO}"
+    depends_on: [upload-rpm]
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 128Mi
+            cpu: 100m
+          limits:
+            memory: 512Mi
+            cpu: 500m

.woodpecker/test.yaml

@@ -3,10 +3,22 @@ when:
 
 steps:
   - name: test
-    image: golang:1.23
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.2-alma9
     commands:
       - go vet ./...
       - go test ./...
+    environment:
+      GOCACHE_S3_BUCKET: gocache
+      GOCACHE_S3_REGION: us-east-1
+      GOCACHE_S3_ENDPOINT_URL: https://s3.ceph.unkin.net
+      GOCACHE_S3_PATH_STYLE: "true"
+      GOCACHE_KEY_PREFIX: ci-tomswall
+      GOCACHE_METRICS: "true"
+      GOCACHEPROG: go-cache-plugin --cache-dir=/tmp/gocache
+      AWS_ACCESS_KEY_ID:
+        from_secret: GOCACHE_AWS_ACCESS_KEY_ID
+      AWS_SECRET_ACCESS_KEY:
+        from_secret: GOCACHE_AWS_SECRET_ACCESS_KEY
     backend_options:
       kubernetes:
         serviceAccountName: default

Makefile

@@ -1,12 +1,17 @@
-BINARY := tomswall
-MODULE := git.unkin.net/unkin/tomswall
-PREFIX := /usr/local
+BINARY  := tomswall
+MODULE  := git.unkin.net/unkin/tomswall
+PREFIX  := /usr/local
 CONFDIR := /etc/tomswall
+DIST    := dist
+VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
+GOFLAGS := -ldflags="-s -w -X main.version=$(VERSION)"
+OS      ?= $(shell go env GOOS)
+ARCH    ?= $(shell go env GOARCH)
 
-.PHONY: build install clean check test
+.PHONY: build install clean check test fmt dist-build completions rpm rpm-package patch minor major _tag
 
 build:
-	go build -o $(BINARY) ./cmd/tomswall
+	go build $(GOFLAGS) -o $(BINARY) ./cmd/tomswall
 
 install: build
 	install -Dm755 $(BINARY) $(DESTDIR)$(PREFIX)/sbin/$(BINARY)
@@ -17,9 +22,54 @@ install: build
 
 clean:
 	rm -f $(BINARY)
+	rm -rf $(DIST)
 
 check:
 	go vet ./...
 
 test:
 	go test ./...
+
+fmt:
+	gofmt -w .
+
+# Build the binary into dist/ for the RPM packaging step.
+dist-build:
+	@mkdir -p $(DIST)
+	CGO_ENABLED=0 GOOS=$(OS) GOARCH=$(ARCH) go build $(GOFLAGS) -o $(DIST)/$(BINARY) ./cmd/tomswall
+
+# Generate bash/zsh completions into dist/completions.
+completions: dist-build
+	@mkdir -p $(DIST)/completions
+	$(DIST)/$(BINARY) completion bash > $(DIST)/completions/$(BINARY).bash
+	$(DIST)/$(BINARY) completion zsh  > $(DIST)/completions/_$(BINARY)
+
+# Build the binary then package it (with completions) into an RPM via nfpm.
+rpm: dist-build rpm-package
+
+# Package an already-built dist/ binary into an RPM (used by CI after build).
+rpm-package:
+	./scripts/build-rpm.sh $(VERSION)
+
+# Bump helpers — read the latest semver tag and create+push the next one, which
+# triggers the release-on-tag pipeline. Starts from v0.0.0 when no tag exists.
+_LATEST := $(shell git tag --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$$' | head -1)
+_BASE   := $(if $(_LATEST),$(_LATEST),v0.0.0)
+_MAJ    := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f1)
+_MIN    := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f2)
+_PAT    := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f3)
+
+patch:
+	@NEW=v$(_MAJ).$(_MIN).$(shell expr $(_PAT) + 1); \
+	git tag $$NEW && echo "Tagged $$NEW" && $(MAKE) _tag TAG=$$NEW
+
+minor:
+	@NEW=v$(_MAJ).$(shell expr $(_MIN) + 1).0; \
+	git tag $$NEW && echo "Tagged $$NEW" && $(MAKE) _tag TAG=$$NEW
+
+major:
+	@NEW=v$(shell expr $(_MAJ) + 1).0.0; \
+	git tag $$NEW && echo "Tagged $$NEW" && $(MAKE) _tag TAG=$$NEW
+
+_tag:
+	git push origin $(TAG)

cmd/tomswall/guard_test.go

@@ -0,0 +1,30 @@
+package main
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/spf13/cobra"
+
+	"git.unkin.net/unkin/tomswall/internal/tryapply"
+)
+
+func TestMutatingCommandsRefuseWhileTryPending(t *testing.T) {
+	orig := tryapply.Dir
+	tryapply.Dir = t.TempDir()
+	t.Cleanup(func() { tryapply.Dir = orig })
+	if err := os.WriteFile(filepath.Join(tryapply.Dir, "try-snapshot.json"), []byte("{}"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	configPath = "../../tomswall.example.yaml"
+
+	for _, cmd := range []*cobra.Command{applyCmd(), flushCmd(), purgeCmd()} {
+		t.Run(cmd.Use, func(t *testing.T) {
+			if err := cmd.RunE(cmd, nil); !errors.Is(err, tryapply.ErrPending) {
+				t.Errorf("got %v, want ErrPending", err)
+			}
+		})
+	}
+}

cmd/tomswall/main.go

@@ -12,6 +12,7 @@ import (
 	"git.unkin.net/unkin/tomswall/internal/config"
 	"git.unkin.net/unkin/tomswall/internal/nftables"
 	"git.unkin.net/unkin/tomswall/internal/shorewall"
+	"git.unkin.net/unkin/tomswall/internal/tryapply"
 )
 
 var configPath string
@@ -33,6 +34,9 @@ Use 'tomswall migrate' to convert a shorewall config to YAML.`,
 
 	root.AddCommand(
 		applyCmd(),
+		tryCmd(),
+		confirmCmd(),
+		revertCmd(),
 		planCmd(),
 		validateCmd(),
 		statusCmd(),
@@ -86,6 +90,12 @@ The firewall is never torn down — existing connections are preserved.`,
 				return err
 			}
 
+			unlock, err := tryapply.Acquire()
+			if err != nil {
+				return err
+			}
+			defer unlock()
+
 			engine, err := nftables.NewEngine(cfg)
 			if err != nil {
 				return fmt.Errorf("initializing nftables: %w", err)
@@ -227,6 +237,14 @@ func purgeCmd() *cobra.Command {
 				return err
 			}
 
+			if !dryRun {
+				unlock, err := tryapply.Acquire()
+				if err != nil {
+					return err
+				}
+				defer unlock()
+			}
+
 			engine, err := nftables.NewEngine(cfg)
 			if err != nil {
 				return fmt.Errorf("initializing nftables: %w", err)
@@ -272,6 +290,12 @@ func flushCmd() *cobra.Command {
 				return err
 			}
 
+			unlock, err := tryapply.Acquire()
+			if err != nil {
+				return err
+			}
+			defer unlock()
+
 			engine, err := nftables.NewEngine(cfg)
 			if err != nil {
 				return fmt.Errorf("initializing nftables: %w", err)

cmd/tomswall/try.go

@@ -0,0 +1,168 @@
+package main
+
+import (
+	"fmt"
+	"os"
+	"os/signal"
+	"strings"
+	"syscall"
+	"time"
+
+	"github.com/spf13/cobra"
+
+	"git.unkin.net/unkin/tomswall/internal/config"
+	"git.unkin.net/unkin/tomswall/internal/nftables"
+	"git.unkin.net/unkin/tomswall/internal/tryapply"
+)
+
+// revertGrace lets the in-process revert win before the systemd fallback fires.
+const revertGrace = 30 * time.Second
+
+func tryCmd() *cobra.Command {
+	var timeout time.Duration
+	cmd := &cobra.Command{
+		Use:   "try",
+		Short: "Apply configuration and revert unless confirmed within a timeout",
+		Long: `Try snapshots the live tomswall table to disk, applies the configuration, then
+waits for 'tomswall confirm'. On timeout, interrupt or hangup the snapshot is
+restored atomically. A transient systemd timer restores it too if this process
+dies. Confirm from a new session to prove new connections still work.`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			cfg, err := loadConfig()
+			if err != nil {
+				return err
+			}
+
+			// Registered before apply so a confirm or hangup cannot be missed.
+			signal.Ignore(syscall.SIGPIPE)
+			confirm := make(chan os.Signal, 1)
+			signal.Notify(confirm, syscall.SIGUSR1)
+			abort := make(chan os.Signal, 1)
+			signal.Notify(abort, syscall.SIGHUP, syscall.SIGINT, syscall.SIGTERM)
+
+			id, err := tryApply(cfg, timeout+revertGrace)
+			if err != nil || id == "" {
+				return err
+			}
+			fmt.Printf("Applied. Run 'tomswall confirm' within %s or the previous ruleset is restored.\n", timeout)
+			msg, err := confirmOrRevert(confirm, abort, timeout, func() (bool, error) { return tryapply.Revert(id) })
+			if err != nil {
+				return err
+			}
+			fmt.Println(msg)
+			return nil
+		},
+	}
+	cmd.Flags().DurationVar(&timeout, "timeout", 60*time.Second, "time to wait for confirmation before reverting")
+	return cmd
+}
+
+// tryApply applies cfg under a pending try and returns its ID, or "" when
+// there was nothing to change.
+func tryApply(cfg *config.Config, fallback time.Duration) (string, error) {
+	unlock, err := tryapply.Acquire()
+	if err != nil {
+		return "", err
+	}
+	defer unlock()
+
+	engine, err := nftables.NewEngine(cfg)
+	if err != nil {
+		return "", fmt.Errorf("initializing nftables: %w", err)
+	}
+	changes, err := engine.Plan()
+	if err != nil {
+		return "", fmt.Errorf("computing changes: %w", err)
+	}
+	if changes.Empty() {
+		fmt.Println("No changes needed — firewall is up to date.")
+		return "", nil
+	}
+	fmt.Println(changes.Summary())
+
+	snap, err := engine.Snapshot()
+	if err != nil {
+		return "", fmt.Errorf("snapshotting ruleset: %w", err)
+	}
+	id, err := tryapply.Arm(snap, os.Getpid(), fallback)
+	if err != nil {
+		return "", err
+	}
+	if err := engine.Apply(changes); err != nil {
+		if derr := tryapply.Discard(); derr != nil {
+			err = fmt.Errorf("%w (discarding snapshot: %v)", err, derr)
+		}
+		return "", fmt.Errorf("applying changes: %w", err)
+	}
+	return id, nil
+}
+
+// confirmOrRevert waits for confirm; on abort or timeout it runs revert.
+// A confirm already delivered wins over a simultaneous abort or timeout.
+func confirmOrRevert(confirm, abort <-chan os.Signal, timeout time.Duration, revert func() (bool, error)) (string, error) {
+	reason := "not confirmed within " + timeout.String()
+	select {
+	case <-confirm:
+		return "Confirmed.", nil
+	case s := <-abort:
+		reason = "interrupted by " + s.String()
+	case <-time.After(timeout):
+	}
+	select {
+	case <-confirm:
+		return "Confirmed.", nil
+	default:
+	}
+	reverted, err := revert()
+	if err != nil {
+		return "", fmt.Errorf("%s; revert failed: %w", reason, err)
+	}
+	if !reverted {
+		return "Already resolved by 'tomswall confirm' or 'tomswall revert'.", nil
+	}
+	return "", fmt.Errorf("%s: previous ruleset restored", reason)
+}
+
+func confirmCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "confirm",
+		Short: "Keep the configuration applied by a pending 'tomswall try'",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			pid, ok, err := tryapply.Confirm()
+			if err != nil {
+				return err
+			}
+			if !ok {
+				return fmt.Errorf("no pending 'tomswall try': it was already reverted or confirmed")
+			}
+			// A recycled PID must not be signalled.
+			if comm, err := os.ReadFile(fmt.Sprintf("/proc/%d/comm", pid)); err == nil && strings.TrimSpace(string(comm)) == "tomswall" {
+				_ = syscall.Kill(pid, syscall.SIGUSR1)
+			}
+			fmt.Println("Confirmed.")
+			return nil
+		},
+	}
+}
+
+func revertCmd() *cobra.Command {
+	var id string
+	cmd := &cobra.Command{
+		Use:   "revert",
+		Short: "Restore the ruleset saved by a pending 'tomswall try'",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			reverted, err := tryapply.Revert(id)
+			if err != nil {
+				return err
+			}
+			if !reverted {
+				fmt.Println("No pending 'tomswall try'.")
+				return nil
+			}
+			fmt.Println("Previous ruleset restored.")
+			return nil
+		},
+	}
+	cmd.Flags().StringVar(&id, "id", "", "only revert the try with this ID (used by the revert timer)")
+	return cmd
+}

cmd/tomswall/try_test.go

@@ -0,0 +1,63 @@
+package main
+
+import (
+	"errors"
+	"os"
+	"syscall"
+	"testing"
+	"time"
+)
+
+func TestConfirmOrRevert(t *testing.T) {
+	tests := []struct {
+		name         string
+		confirm      bool
+		abort        bool
+		resolved     bool
+		revertErr    error
+		wantRevert   bool
+		wantErr      bool
+		wantResolved bool
+	}{
+		{name: "confirmed keeps ruleset", confirm: true},
+		{name: "confirm wins over simultaneous abort", confirm: true, abort: true},
+		{name: "timeout reverts", wantRevert: true, wantErr: true},
+		{name: "hangup reverts", abort: true, wantRevert: true, wantErr: true},
+		{name: "revert failure surfaces", revertErr: errors.New("boom"), wantRevert: true, wantErr: true},
+		{name: "resolved elsewhere", resolved: true, wantRevert: true, wantResolved: true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			for i := 0; i < 20; i++ { // select between ready channels is random
+				confirm := make(chan os.Signal, 1)
+				abort := make(chan os.Signal, 1)
+				if tt.confirm {
+					confirm <- syscall.SIGUSR1
+				}
+				if tt.abort {
+					abort <- syscall.SIGHUP
+				}
+				called := false
+				msg, err := confirmOrRevert(confirm, abort, 10*time.Millisecond, func() (bool, error) {
+					called = true
+					return !tt.resolved, tt.revertErr
+				})
+				if called != tt.wantRevert {
+					t.Fatalf("revert called = %v, want %v", called, tt.wantRevert)
+				}
+				if (err != nil) != tt.wantErr {
+					t.Fatalf("err = %v, wantErr %v", err, tt.wantErr)
+				}
+				if tt.revertErr != nil && !errors.Is(err, tt.revertErr) {
+					t.Fatalf("revert error not wrapped: %v", err)
+				}
+				if tt.wantResolved && msg == "" {
+					t.Fatal("expected already-resolved message")
+				}
+				if !(tt.confirm && tt.abort) {
+					break
+				}
+			}
+		})
+	}
+}

go.mod

@@ -3,19 +3,18 @@ module git.unkin.net/unkin/tomswall
 go 1.23
 
 require (
-	github.com/google/nftables v0.2.0
+	github.com/google/nftables v0.3.0
+	github.com/mdlayher/netlink v1.7.3-0.20250113171957-fbb4dce95f42
 	github.com/spf13/cobra v1.8.1
-	golang.org/x/sys v0.18.0
+	golang.org/x/sys v0.28.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
 require (
 	github.com/google/go-cmp v0.6.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/josharian/native v1.1.0 // indirect
-	github.com/mdlayher/netlink v1.7.2 // indirect
 	github.com/mdlayher/socket v0.5.1 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
-	golang.org/x/net v0.23.0 // indirect
+	golang.org/x/net v0.33.0 // indirect
 	golang.org/x/sync v0.6.0 // indirect
 )

go.sum

@@ -1,14 +1,12 @@
 github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/nftables v0.2.0 h1:PbJwaBmbVLzpeldoeUKGkE2RjstrjPKMl6oLrfEJ6/8=
-github.com/google/nftables v0.2.0/go.mod h1:Beg6V6zZ3oEn0JuiUQ4wqwuyqqzasOltcoXPtgLbFp4=
+github.com/google/nftables v0.3.0 h1:bkyZ0cbpVeMHXOrtlFc8ISmfVqq5gPJukoYieyVmITg=
+github.com/google/nftables v0.3.0/go.mod h1:BCp9FsrbF1Fn/Yu6CLUc9GGZFw/+hsxfluNXXmxBfRM=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/josharian/native v1.1.0 h1:uuaP0hAbW7Y4l0ZRQ6C9zfb7Mg1mbFKry/xzDAfmtLA=
-github.com/josharian/native v1.1.0/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
-github.com/mdlayher/netlink v1.7.2 h1:/UtM3ofJap7Vl4QWCPDGXY8d3GIY2UGSDbK+QWmY8/g=
-github.com/mdlayher/netlink v1.7.2/go.mod h1:xraEF7uJbxLhc5fpHL4cPe221LI2bdttWlU+ZGLfQSw=
+github.com/mdlayher/netlink v1.7.3-0.20250113171957-fbb4dce95f42 h1:A1Cq6Ysb0GM0tpKMbdCXCIfBclan4oHk1Jb+Hrejirg=
+github.com/mdlayher/netlink v1.7.3-0.20250113171957-fbb4dce95f42/go.mod h1:BB4YCPDOzfy7FniQ/lxuYQ3dgmM2cZumHbK8RpTjN2o=
 github.com/mdlayher/socket v0.5.1 h1:VZaqt6RkGkt2OE9l3GcC6nZkqD3xKeQLyfleW/uBcos=
 github.com/mdlayher/socket v0.5.1/go.mod h1:TjPLHI1UgwEv5J1B5q0zTZq12A/6H7nKmtTanQE37IQ=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
@@ -16,14 +14,14 @@ github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM=
 github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/vishvananda/netns v0.0.0-20180720170159-13995c7128cc h1:R83G5ikgLMxrBvLh22JhdfI8K6YXEPHx5P03Uu3DRs4=
-github.com/vishvananda/netns v0.0.0-20180720170159-13995c7128cc/go.mod h1:ZjcWmFBXmLKZu9Nxj3WKYEafiSqer2rnvPr0en9UNpI=
-golang.org/x/net v0.23.0 h1:7EYJ93RZ9vYSZAIb2x3lnuvqO5zneoD6IvWjuhfxjTs=
-golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
+github.com/vishvananda/netns v0.0.4 h1:Oeaw1EM2JMxD51g9uhtC0D7erkIjgmj8+JZc26m1YX8=
+github.com/vishvananda/netns v0.0.4/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
+golang.org/x/net v0.33.0 h1:74SYHlV8BIgHIFC/LrYkOGIwL19eTYXQ5wc6TBuO36I=
+golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
 golang.org/x/sync v0.6.0 h1:5BMeUDZ7vkXGfEr1x9B4bRcTH4lpkTkpdh0T/J+qjbQ=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
-golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
+golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=

internal/agent/agent.go

@@ -8,6 +8,7 @@ import (
 
 	"git.unkin.net/unkin/tomswall/internal/config"
 	"git.unkin.net/unkin/tomswall/internal/nftables"
+	"git.unkin.net/unkin/tomswall/internal/tryapply"
 )
 
 // Applier applies a translated config to the firewall. Abstracted so the run
@@ -90,6 +91,12 @@ func (a *Agent) applyConfig(ctx context.Context, rc *RenderedConfig, report bool
 		if err := a.Client.ReportStatus(ctx, rc.Generation); err != nil {
 			slog.Warn("agent: reporting status failed", "err", err)
 		}
+		// Report the FIB so the control plane can scope router enforcement.
+		if fib := CollectFIB(ctx); len(fib) > 0 {
+			if err := a.Client.ReportRoutes(ctx, fib); err != nil {
+				slog.Warn("agent: reporting routes failed", "err", err)
+			}
+		}
 	}
 	return nil
 }
@@ -97,8 +104,14 @@ func (a *Agent) applyConfig(ctx context.Context, rc *RenderedConfig, report bool
 // EngineApplier applies via the real nftables differential engine.
 type EngineApplier struct{}
 
-// Apply computes and applies the differential change set for cfg.
+// Apply computes and applies the differential change set for cfg. It refuses
+// while a 'tomswall try' awaits confirmation.
 func (EngineApplier) Apply(_ context.Context, cfg *config.Config) error {
+	unlock, err := tryapply.Acquire()
+	if err != nil {
+		return err
+	}
+	defer unlock()
 	engine, err := nftables.NewEngine(cfg)
 	if err != nil {
 		return fmt.Errorf("initializing nftables: %w", err)

internal/agent/agent_test.go

@@ -84,6 +84,41 @@ func TestTranslateBareZone(t *testing.T) {
 	}
 }
 
+func TestTranslateNATTier(t *testing.T) {
+	prob := 0.5
+	rc := &RenderedConfig{
+		Enforcing: true,
+		SNAT: []RenderedSNAT{
+			{Action: "masquerade", Source: []string{"10.1.0.0/24"}, Egress: []string{"eth0", "eth3"}},
+			{Action: "snat", Source: []string{"10.2.0.0/24"}, Egress: []string{"eth0"}, Address: "203.0.113.1", Probability: &prob},
+		},
+		Netmap: []RenderedNetmap{{Type: "dnat", FromNet: "10.0.0.0/24", ToNet: "192.168.1.0/24", Interface: "eth0"}},
+		NAT:    []RenderedNAT{{External: "203.0.113.10", Internal: "10.1.0.10", Interface: "eth0"}},
+	}
+	cfg, err := Translate(rc)
+	if err != nil {
+		t.Fatalf("Translate: %v", err)
+	}
+
+	// masquerade with two egress interfaces expands to two rules; snat adds one.
+	if len(cfg.SNAT) != 3 {
+		t.Fatalf("expected 3 SNAT rules, got %d: %+v", len(cfg.SNAT), cfg.SNAT)
+	}
+	if cfg.SNAT[0].Action != config.SNATMasquerade || cfg.SNAT[0].Source != "10.1.0.0/24" || cfg.SNAT[0].Dest != "eth0" {
+		t.Errorf("unexpected masquerade rule: %+v", cfg.SNAT[0])
+	}
+	if cfg.SNAT[2].Address != "203.0.113.1" || cfg.SNAT[2].Probability != 0.5 {
+		t.Errorf("snat address/probability not carried: %+v", cfg.SNAT[2])
+	}
+
+	if len(cfg.Netmap) != 1 || cfg.Netmap[0].Net1 != "10.0.0.0/24" || cfg.Netmap[0].Net2 != "192.168.1.0/24" || cfg.Netmap[0].Interface != "eth0" {
+		t.Errorf("netmap not translated: %+v", cfg.Netmap)
+	}
+	if len(cfg.StaticNAT) != 1 || cfg.StaticNAT[0].External != "203.0.113.10" || cfg.StaticNAT[0].Internal != "10.1.0.10" {
+		t.Errorf("static nat not translated: %+v", cfg.StaticNAT)
+	}
+}
+
 func TestTranslateRejectsUnknownAction(t *testing.T) {
 	rc := &RenderedConfig{Enforcing: true, Rules: []RenderedRule{{Action: "bogus"}}}
 	if _, err := Translate(rc); err == nil {

internal/agent/client.go

@@ -70,6 +70,30 @@ func ParseRendered(body []byte) (*RenderedConfig, error) {
 	return &cfg, nil
 }
 
+// ReportRoutes reports the device's reachable prefixes (FIB) so the control
+// plane can scope which routers enforce a rule.
+func (c *Client) ReportRoutes(ctx context.Context, prefixes []string) error {
+	url := fmt.Sprintf("%s/api/v1/devices/%s/routes", c.BaseURL, c.Device)
+	payload, _ := json.Marshal(map[string][]string{"prefixes": prefixes})
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, bytes.NewReader(payload))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Authorization", "Bearer "+c.Token)
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := c.HTTP.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	io.Copy(io.Discard, io.LimitReader(resp.Body, 1<<16))
+	if resp.StatusCode >= 400 {
+		return fmt.Errorf("report routes: %d", resp.StatusCode)
+	}
+	return nil
+}
+
 // ReportStatus tells the control plane which generation this device has applied.
 func (c *Client) ReportStatus(ctx context.Context, generation int64) error {
 	url := fmt.Sprintf("%s/api/v1/devices/%s/status", c.BaseURL, c.Device)

internal/agent/fib.go

@@ -0,0 +1,76 @@
+package agent
+
+import (
+	"context"
+	"os/exec"
+	"strings"
+)
+
+// CollectFIB returns the device's reachable prefixes from the kernel FIB — which
+// includes FRR-installed routes — by shelling out to `ip route`. The control
+// plane uses these to scope which routers enforce a rule. On a host without
+// iproute2 it returns nil, and the control plane falls back to over-approximation.
+func CollectFIB(ctx context.Context) []string {
+	var prefixes []string
+	for _, spec := range []struct {
+		args []string
+		def  string
+	}{
+		{[]string{"route", "show"}, "0.0.0.0/0"},
+		{[]string{"-6", "route", "show"}, "::/0"},
+	} {
+		out, err := exec.CommandContext(ctx, "ip", spec.args...).Output()
+		if err != nil {
+			continue
+		}
+		prefixes = append(prefixes, parseRoutes(string(out), spec.def)...)
+	}
+	return dedup(prefixes)
+}
+
+// routeTypeKeywords are leading tokens in `ip route` output that precede the
+// actual destination (e.g. "unreachable 10.0.0.0/8").
+var routeTypeKeywords = map[string]bool{
+	"unreachable": true, "blackhole": true, "prohibit": true, "throw": true,
+	"local": true, "broadcast": true, "multicast": true, "anycast": true, "nat": true,
+}
+
+// parseRoutes extracts destination prefixes from `ip route show` output.
+// defaultPrefix is substituted for a "default" route (family-specific).
+func parseRoutes(output, defaultPrefix string) []string {
+	var out []string
+	for _, line := range strings.Split(output, "\n") {
+		fields := strings.Fields(line)
+		if len(fields) == 0 {
+			continue
+		}
+		dst := fields[0]
+		// ECMP routes emit continuation "nexthop ..." lines with no destination.
+		if dst == "nexthop" {
+			continue
+		}
+		if routeTypeKeywords[dst] {
+			if len(fields) < 2 {
+				continue
+			}
+			dst = fields[1]
+		}
+		if dst == "default" {
+			out = append(out, defaultPrefix)
+			continue
+		}
+		out = append(out, normalizePrefix(dst))
+	}
+	return out
+}
+
+// normalizePrefix turns a bare host address into a host prefix (/32 or /128).
+func normalizePrefix(dst string) string {
+	if strings.Contains(dst, "/") {
+		return dst
+	}
+	if strings.Contains(dst, ":") {
+		return dst + "/128"
+	}
+	return dst + "/32"
+}

internal/agent/fib_test.go

@@ -0,0 +1,55 @@
+package agent
+
+import (
+	"reflect"
+	"sort"
+	"testing"
+)
+
+func TestParseRoutesV4(t *testing.T) {
+	// Representative `ip route show` output, including a default route, an ECMP
+	// route with nexthop continuation lines, a connected route, and a host route.
+	out := `default via 10.0.0.1 dev eth0 proto dhcp
+10.1.0.0/24 dev eth1 proto kernel scope link src 10.1.0.5
+10.4.0.0/24 proto bgp metric 20
+	nexthop via 10.0.0.2 dev eth0 weight 1
+	nexthop via 10.0.0.3 dev eth0 weight 1
+192.0.2.7 dev eth2 scope link
+blackhole 172.16.0.0/12
+`
+	got := parseRoutes(out, "0.0.0.0/0")
+	sort.Strings(got)
+	want := []string{"0.0.0.0/0", "10.1.0.0/24", "10.4.0.0/24", "172.16.0.0/12", "192.0.2.7/32"}
+	sort.Strings(want)
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("parseRoutes v4 = %v, want %v", got, want)
+	}
+}
+
+func TestParseRoutesV6(t *testing.T) {
+	out := `default via fe80::1 dev eth0 metric 1024
+2001:db8:1::/64 dev eth1 proto kernel metric 256
+2001:db8:4::5 dev eth2
+`
+	got := parseRoutes(out, "::/0")
+	sort.Strings(got)
+	want := []string{"2001:db8:1::/64", "2001:db8:4::5/128", "::/0"}
+	sort.Strings(want)
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("parseRoutes v6 = %v, want %v", got, want)
+	}
+}
+
+func TestNormalizePrefix(t *testing.T) {
+	cases := map[string]string{
+		"10.1.0.0/24":   "10.1.0.0/24",
+		"10.1.0.5":      "10.1.0.5/32",
+		"2001:db8::1":   "2001:db8::1/128",
+		"2001:db8::/32": "2001:db8::/32",
+	}
+	for in, want := range cases {
+		if got := normalizePrefix(in); got != want {
+			t.Errorf("normalizePrefix(%q) = %q, want %q", in, got, want)
+		}
+	}
+}

internal/agent/rendered.go

@@ -8,16 +8,266 @@ package agent
 // GET /api/v1/devices/{name}/config. It mirrors the control plane's compiler
 // output: interface-agnostic, address-matched rules plus named sets.
 type RenderedConfig struct {
-	Generation int64               `yaml:"generation" json:"generation"`
-	Device     string              `yaml:"device" json:"device"`
-	Class      string              `yaml:"class" json:"class"`
-	Enforcing  bool                `yaml:"enforcing" json:"enforcing"`
-	Settings   RenderedSettings    `yaml:"settings" json:"settings"`
-	Resolver   []string            `yaml:"resolver,omitempty" json:"resolver,omitempty"`
-	Bindings   map[string][]string `yaml:"bindings,omitempty" json:"bindings,omitempty"` // zone -> interfaces
-	Sets       []RenderedSet       `yaml:"sets,omitempty" json:"sets,omitempty"`
-	Rules      []RenderedRule      `yaml:"rules,omitempty" json:"rules,omitempty"`
-	Policies   []RenderedPolicy    `yaml:"policies,omitempty" json:"policies,omitempty"`
+	Generation   int64                 `yaml:"generation" json:"generation"`
+	Device       string                `yaml:"device" json:"device"`
+	Class        string                `yaml:"class" json:"class"`
+	Enforcing    bool                  `yaml:"enforcing" json:"enforcing"`
+	Settings     RenderedSettings      `yaml:"settings" json:"settings"`
+	Resolver     []string              `yaml:"resolver,omitempty" json:"resolver,omitempty"`
+	Bindings     map[string][]string   `yaml:"bindings,omitempty" json:"bindings,omitempty"` // zone -> interfaces
+	Sets         []RenderedSet         `yaml:"sets,omitempty" json:"sets,omitempty"`
+	Rules        []RenderedRule        `yaml:"rules,omitempty" json:"rules,omitempty"`
+	Policies     []RenderedPolicy      `yaml:"policies,omitempty" json:"policies,omitempty"`
+	SNAT         []RenderedSNAT        `yaml:"snat,omitempty" json:"snat,omitempty"`
+	Netmap       []RenderedNetmap      `yaml:"netmap,omitempty" json:"netmap,omitempty"`
+	NAT          []RenderedNAT         `yaml:"nat,omitempty" json:"nat,omitempty"`
+	Hosts        []RenderedHost        `yaml:"hosts,omitempty" json:"hosts,omitempty"`
+	Providers    []RenderedProvider    `yaml:"providers,omitempty" json:"providers,omitempty"`
+	Routes       []RenderedRoute       `yaml:"routes,omitempty" json:"routes,omitempty"`
+	RoutingRules []RenderedRoutingRule `yaml:"routing_rules,omitempty" json:"routing_rules,omitempty"`
+	Tunnels      []RenderedTunnel      `yaml:"tunnels,omitempty" json:"tunnels,omitempty"`
+	StoppedRules []RenderedStoppedRule `yaml:"stopped_rules,omitempty" json:"stopped_rules,omitempty"`
+	ProxyARP     []RenderedProxy       `yaml:"proxy_arp,omitempty" json:"proxy_arp,omitempty"`
+	ProxyNDP     []RenderedProxy       `yaml:"proxy_ndp,omitempty" json:"proxy_ndp,omitempty"`
+	ArpRules     []RenderedArpRule     `yaml:"arp_rules,omitempty" json:"arp_rules,omitempty"`
+	Maclist      []RenderedMaclist     `yaml:"maclist,omitempty" json:"maclist,omitempty"`
+	Mangle       []RenderedMangle      `yaml:"mangle,omitempty" json:"mangle,omitempty"`
+	Accounting   []RenderedAccounting  `yaml:"accounting,omitempty" json:"accounting,omitempty"`
+	TCDevices    []RenderedTCDevice    `yaml:"tc_devices,omitempty" json:"tc_devices,omitempty"`
+	TCClasses    []RenderedTCClass     `yaml:"tc_classes,omitempty" json:"tc_classes,omitempty"`
+	TCFilters    []RenderedTCFilter    `yaml:"tc_filters,omitempty" json:"tc_filters,omitempty"`
+	TCInterfaces []RenderedTCInterface `yaml:"tc_interfaces,omitempty" json:"tc_interfaces,omitempty"`
+	TCPriorities []RenderedTCPriority  `yaml:"tc_priorities,omitempty" json:"tc_priorities,omitempty"`
+	Blrules      []RenderedBlrule      `yaml:"blrules,omitempty" json:"blrules,omitempty"`
+	Conntrack    []RenderedConntrack   `yaml:"conntrack,omitempty" json:"conntrack,omitempty"`
+	Secmarks     []RenderedSecmark     `yaml:"secmarks,omitempty" json:"secmarks,omitempty"`
+	Vars         map[string]string     `yaml:"vars,omitempty" json:"vars,omitempty"`
+}
+
+type RenderedBlrule struct {
+	Priority int      `yaml:"priority,omitempty" json:"priority,omitempty"`
+	Action   string   `yaml:"action" json:"action"`
+	Source   string   `yaml:"source,omitempty" json:"source,omitempty"`
+	Dest     string   `yaml:"dest,omitempty" json:"dest,omitempty"`
+	Proto    string   `yaml:"proto,omitempty" json:"proto,omitempty"`
+	DPort    []string `yaml:"dport,omitempty" json:"dport,omitempty"`
+	SPort    []string `yaml:"sport,omitempty" json:"sport,omitempty"`
+	Log      string   `yaml:"log,omitempty" json:"log,omitempty"`
+	Comment  string   `yaml:"comment,omitempty" json:"comment,omitempty"`
+}
+
+type RenderedConntrack struct {
+	Action  string   `yaml:"action" json:"action"`
+	Source  string   `yaml:"source,omitempty" json:"source,omitempty"`
+	Dest    string   `yaml:"dest,omitempty" json:"dest,omitempty"`
+	Proto   string   `yaml:"proto,omitempty" json:"proto,omitempty"`
+	DPort   []string `yaml:"dport,omitempty" json:"dport,omitempty"`
+	SPort   []string `yaml:"sport,omitempty" json:"sport,omitempty"`
+	Chain   string   `yaml:"chain,omitempty" json:"chain,omitempty"`
+	Helper  string   `yaml:"helper,omitempty" json:"helper,omitempty"`
+	User    string   `yaml:"user,omitempty" json:"user,omitempty"`
+	Comment string   `yaml:"comment,omitempty" json:"comment,omitempty"`
+}
+
+type RenderedSecmark struct {
+	Secmark string   `yaml:"secmark" json:"secmark"`
+	Chain   string   `yaml:"chain" json:"chain"`
+	Source  string   `yaml:"source,omitempty" json:"source,omitempty"`
+	Dest    string   `yaml:"dest,omitempty" json:"dest,omitempty"`
+	Proto   string   `yaml:"proto,omitempty" json:"proto,omitempty"`
+	DPort   []string `yaml:"dport,omitempty" json:"dport,omitempty"`
+	SPort   []string `yaml:"sport,omitempty" json:"sport,omitempty"`
+	Comment string   `yaml:"comment,omitempty" json:"comment,omitempty"`
+}
+
+type RenderedMangle struct {
+	Action      string   `yaml:"action" json:"action"`
+	Chain       string   `yaml:"chain,omitempty" json:"chain,omitempty"`
+	MarkValue   string   `yaml:"mark_value,omitempty" json:"mark_value,omitempty"`
+	Source      string   `yaml:"source,omitempty" json:"source,omitempty"`
+	Dest        string   `yaml:"dest,omitempty" json:"dest,omitempty"`
+	Proto       string   `yaml:"proto,omitempty" json:"proto,omitempty"`
+	DPort       []string `yaml:"dport,omitempty" json:"dport,omitempty"`
+	SPort       []string `yaml:"sport,omitempty" json:"sport,omitempty"`
+	User        string   `yaml:"user,omitempty" json:"user,omitempty"`
+	Mark        string   `yaml:"mark,omitempty" json:"mark,omitempty"`
+	Length      string   `yaml:"length,omitempty" json:"length,omitempty"`
+	TOS         string   `yaml:"tos,omitempty" json:"tos,omitempty"`
+	Helper      string   `yaml:"helper,omitempty" json:"helper,omitempty"`
+	Probability *float64 `yaml:"probability,omitempty" json:"probability,omitempty"`
+	Comment     string   `yaml:"comment,omitempty" json:"comment,omitempty"`
+}
+
+type RenderedAccounting struct {
+	Action  string   `yaml:"action" json:"action"`
+	Section string   `yaml:"section,omitempty" json:"section,omitempty"`
+	Chain   string   `yaml:"chain,omitempty" json:"chain,omitempty"`
+	Source  string   `yaml:"source,omitempty" json:"source,omitempty"`
+	Dest    string   `yaml:"dest,omitempty" json:"dest,omitempty"`
+	Proto   string   `yaml:"proto,omitempty" json:"proto,omitempty"`
+	DPort   []string `yaml:"dport,omitempty" json:"dport,omitempty"`
+	SPort   []string `yaml:"sport,omitempty" json:"sport,omitempty"`
+	Mark    string   `yaml:"mark,omitempty" json:"mark,omitempty"`
+	Comment string   `yaml:"comment,omitempty" json:"comment,omitempty"`
+}
+
+type RenderedTCDevice struct {
+	Interface    string `yaml:"interface" json:"interface"`
+	InBandwidth  string `yaml:"in_bandwidth,omitempty" json:"in_bandwidth,omitempty"`
+	OutBandwidth string `yaml:"out_bandwidth,omitempty" json:"out_bandwidth,omitempty"`
+	Comment      string `yaml:"comment,omitempty" json:"comment,omitempty"`
+}
+
+type RenderedTCClass struct {
+	Interface string `yaml:"interface" json:"interface"`
+	Mark      int    `yaml:"mark,omitempty" json:"mark,omitempty"`
+	Rate      string `yaml:"rate,omitempty" json:"rate,omitempty"`
+	Ceil      string `yaml:"ceil,omitempty" json:"ceil,omitempty"`
+	Priority  int    `yaml:"priority,omitempty" json:"priority,omitempty"`
+	Comment   string `yaml:"comment,omitempty" json:"comment,omitempty"`
+}
+
+type RenderedTCFilter struct {
+	Class    string   `yaml:"class" json:"class"`
+	Source   string   `yaml:"source,omitempty" json:"source,omitempty"`
+	Dest     string   `yaml:"dest,omitempty" json:"dest,omitempty"`
+	Proto    string   `yaml:"proto,omitempty" json:"proto,omitempty"`
+	DPort    []string `yaml:"dport,omitempty" json:"dport,omitempty"`
+	SPort    []string `yaml:"sport,omitempty" json:"sport,omitempty"`
+	TOS      string   `yaml:"tos,omitempty" json:"tos,omitempty"`
+	Length   int      `yaml:"length,omitempty" json:"length,omitempty"`
+	Priority int      `yaml:"priority,omitempty" json:"priority,omitempty"`
+	Comment  string   `yaml:"comment,omitempty" json:"comment,omitempty"`
+}
+
+type RenderedTCInterface struct {
+	Interface    string `yaml:"interface" json:"interface"`
+	Type         string `yaml:"type,omitempty" json:"type,omitempty"`
+	InBandwidth  string `yaml:"in_bandwidth,omitempty" json:"in_bandwidth,omitempty"`
+	OutBandwidth string `yaml:"out_bandwidth,omitempty" json:"out_bandwidth,omitempty"`
+	Comment      string `yaml:"comment,omitempty" json:"comment,omitempty"`
+}
+
+type RenderedTCPriority struct {
+	Band      int      `yaml:"band" json:"band"`
+	Proto     string   `yaml:"proto,omitempty" json:"proto,omitempty"`
+	DPort     []string `yaml:"dport,omitempty" json:"dport,omitempty"`
+	SPort     []string `yaml:"sport,omitempty" json:"sport,omitempty"`
+	Address   string   `yaml:"address,omitempty" json:"address,omitempty"`
+	Interface string   `yaml:"interface,omitempty" json:"interface,omitempty"`
+	Helper    string   `yaml:"helper,omitempty" json:"helper,omitempty"`
+	Comment   string   `yaml:"comment,omitempty" json:"comment,omitempty"`
+}
+
+type RenderedTunnel struct {
+	Type         string   `yaml:"type" json:"type"`
+	Zone         string   `yaml:"zone" json:"zone"`
+	Gateways     []string `yaml:"gateways,omitempty" json:"gateways,omitempty"`
+	GatewayZones []string `yaml:"gateway_zones,omitempty" json:"gateway_zones,omitempty"`
+	Port         int      `yaml:"port,omitempty" json:"port,omitempty"`
+	Comment      string   `yaml:"comment,omitempty" json:"comment,omitempty"`
+}
+
+type RenderedStoppedRule struct {
+	Action  string   `yaml:"action" json:"action"`
+	Source  string   `yaml:"source,omitempty" json:"source,omitempty"`
+	Dest    string   `yaml:"dest,omitempty" json:"dest,omitempty"`
+	Proto   string   `yaml:"proto,omitempty" json:"proto,omitempty"`
+	DPort   []string `yaml:"dport,omitempty" json:"dport,omitempty"`
+	SPort   []string `yaml:"sport,omitempty" json:"sport,omitempty"`
+	Comment string   `yaml:"comment,omitempty" json:"comment,omitempty"`
+}
+
+type RenderedProxy struct {
+	Address    string `yaml:"address" json:"address"`
+	Interface  string `yaml:"interface,omitempty" json:"interface,omitempty"`
+	External   string `yaml:"external" json:"external"`
+	HaveRoute  bool   `yaml:"haveroute,omitempty" json:"haveroute,omitempty"`
+	Persistent bool   `yaml:"persistent,omitempty" json:"persistent,omitempty"`
+	Comment    string `yaml:"comment,omitempty" json:"comment,omitempty"`
+}
+
+type RenderedArpRule struct {
+	Action        string `yaml:"action" json:"action"`
+	ActionAddress string `yaml:"action_address,omitempty" json:"action_address,omitempty"`
+	ActionMAC     string `yaml:"action_mac,omitempty" json:"action_mac,omitempty"`
+	Source        string `yaml:"source,omitempty" json:"source,omitempty"`
+	Dest          string `yaml:"dest,omitempty" json:"dest,omitempty"`
+	Opcode        int    `yaml:"opcode,omitempty" json:"opcode,omitempty"`
+	Comment       string `yaml:"comment,omitempty" json:"comment,omitempty"`
+}
+
+type RenderedMaclist struct {
+	Action    string   `yaml:"action" json:"action"`
+	Interface string   `yaml:"interface" json:"interface"`
+	MAC       string   `yaml:"mac,omitempty" json:"mac,omitempty"`
+	Addresses []string `yaml:"addresses,omitempty" json:"addresses,omitempty"`
+	Log       string   `yaml:"log,omitempty" json:"log,omitempty"`
+	Comment   string   `yaml:"comment,omitempty" json:"comment,omitempty"`
+}
+
+type RenderedHost struct {
+	Zone       string   `yaml:"zone" json:"zone"`
+	Interface  string   `yaml:"interface" json:"interface"`
+	Addresses  []string `yaml:"addresses,omitempty" json:"addresses,omitempty"`
+	Exclusions []string `yaml:"exclusions,omitempty" json:"exclusions,omitempty"`
+	Dynamic    bool     `yaml:"dynamic,omitempty" json:"dynamic,omitempty"`
+}
+
+type RenderedProvider struct {
+	Name      string   `yaml:"name" json:"name"`
+	Number    int      `yaml:"number" json:"number"`
+	Mark      int      `yaml:"mark,omitempty" json:"mark,omitempty"`
+	Duplicate string   `yaml:"duplicate,omitempty" json:"duplicate,omitempty"`
+	Interface string   `yaml:"interface" json:"interface"`
+	Gateway   string   `yaml:"gateway,omitempty" json:"gateway,omitempty"`
+	Copy      []string `yaml:"copy,omitempty" json:"copy,omitempty"`
+}
+
+type RenderedRoute struct {
+	Provider   string `yaml:"provider,omitempty" json:"provider,omitempty"`
+	Dest       string `yaml:"dest" json:"dest"`
+	Gateway    string `yaml:"gateway,omitempty" json:"gateway,omitempty"`
+	Oif        string `yaml:"oif,omitempty" json:"oif,omitempty"`
+	Persistent bool   `yaml:"persistent,omitempty" json:"persistent,omitempty"`
+	Comment    string `yaml:"comment,omitempty" json:"comment,omitempty"`
+}
+
+type RenderedRoutingRule struct {
+	Source     string `yaml:"source,omitempty" json:"source,omitempty"`
+	Dest       string `yaml:"dest,omitempty" json:"dest,omitempty"`
+	Provider   string `yaml:"provider" json:"provider"`
+	Priority   int    `yaml:"priority,omitempty" json:"priority,omitempty"`
+	Persistent bool   `yaml:"persistent,omitempty" json:"persistent,omitempty"`
+	Mark       string `yaml:"mark,omitempty" json:"mark,omitempty"`
+	Comment    string `yaml:"comment,omitempty" json:"comment,omitempty"`
+}
+
+// RenderedSNAT is a resolved SNAT/masquerade rule (egress carries interface names).
+type RenderedSNAT struct {
+	Action      string   `yaml:"action" json:"action"`
+	Source      []string `yaml:"source,omitempty" json:"source,omitempty"`
+	Egress      []string `yaml:"egress" json:"egress"`
+	Address     string   `yaml:"address,omitempty" json:"address,omitempty"`
+	Probability *float64 `yaml:"probability,omitempty" json:"probability,omitempty"`
+	Comment     string   `yaml:"comment,omitempty" json:"comment,omitempty"`
+}
+
+// RenderedNetmap is a resolved network-to-network mapping on one interface.
+type RenderedNetmap struct {
+	Type      string `yaml:"type" json:"type"`
+	FromNet   string `yaml:"from_net" json:"from_net"`
+	ToNet     string `yaml:"to_net" json:"to_net"`
+	Interface string `yaml:"interface,omitempty" json:"interface,omitempty"`
+	Comment   string `yaml:"comment,omitempty" json:"comment,omitempty"`
+}
+
+// RenderedNAT is a resolved one-to-one static NAT on one interface.
+type RenderedNAT struct {
+	External  string `yaml:"external" json:"external"`
+	Internal  string `yaml:"internal" json:"internal"`
+	Interface string `yaml:"interface,omitempty" json:"interface,omitempty"`
+	Comment   string `yaml:"comment,omitempty" json:"comment,omitempty"`
 }
 
 type RenderedSettings struct {

internal/agent/translate.go

@@ -60,9 +60,192 @@ func Translate(rc *RenderedConfig) (*config.Config, error) {
 		})
 	}
 
+	for _, s := range rc.SNAT {
+		cfg.SNAT = append(cfg.SNAT, translateSNAT(s)...)
+	}
+	for _, n := range rc.Netmap {
+		cfg.Netmap = append(cfg.Netmap, config.Netmap{
+			Type:      config.NetmapType(n.Type),
+			Net1:      n.FromNet,
+			Net2:      n.ToNet,
+			Interface: n.Interface,
+			Comment:   n.Comment,
+		})
+	}
+	for _, n := range rc.NAT {
+		cfg.StaticNAT = append(cfg.StaticNAT, config.StaticNAT{
+			External:  n.External,
+			Internal:  n.Internal,
+			Interface: n.Interface,
+			Comment:   n.Comment,
+		})
+	}
+
+	for _, h := range rc.Hosts {
+		cfg.Hosts = append(cfg.Hosts, config.Host{
+			Zone: h.Zone, Interface: h.Interface, Addresses: h.Addresses,
+			Exclusions: h.Exclusions, Dynamic: h.Dynamic,
+		})
+	}
+	for _, p := range rc.Providers {
+		cfg.Providers = append(cfg.Providers, config.Provider{
+			Name: p.Name, Number: p.Number, Mark: p.Mark, Duplicate: p.Duplicate,
+			Interface: p.Interface, Gateway: p.Gateway, Copy: p.Copy,
+		})
+	}
+	for _, r := range rc.Routes {
+		cfg.Routes = append(cfg.Routes, config.StaticRoute{
+			Provider: r.Provider, Dest: r.Dest, Gateway: r.Gateway,
+			Device: r.Oif, Persistent: r.Persistent, Comment: r.Comment,
+		})
+	}
+	for _, r := range rc.RoutingRules {
+		cfg.RoutingRules = append(cfg.RoutingRules, config.RoutingRule{
+			Source: r.Source, Dest: r.Dest, Provider: r.Provider, Priority: r.Priority,
+			Persistent: r.Persistent, Mark: r.Mark, Comment: r.Comment,
+		})
+	}
+
+	for _, t := range rc.Tunnels {
+		cfg.Tunnels = append(cfg.Tunnels, config.Tunnel{
+			Type: t.Type, Zone: t.Zone, Gateways: t.Gateways,
+			GatewayZones: t.GatewayZones, Port: t.Port, Comment: t.Comment,
+		})
+	}
+	for _, r := range rc.StoppedRules {
+		cfg.StoppedRules = append(cfg.StoppedRules, config.StoppedRule{
+			Action: config.StoppedAction(r.Action), Source: r.Source, Dest: r.Dest,
+			Proto: r.Proto, DPort: config.PortSpec(r.DPort), SPort: config.PortSpec(r.SPort), Comment: r.Comment,
+		})
+	}
+	for _, p := range rc.ProxyARP {
+		cfg.ProxyARP = append(cfg.ProxyARP, config.ProxyARP{
+			Address: p.Address, Interface: p.Interface, External: p.External,
+			HaveRoute: p.HaveRoute, Persistent: p.Persistent, Comment: p.Comment,
+		})
+	}
+	for _, p := range rc.ProxyNDP {
+		cfg.ProxyNDP = append(cfg.ProxyNDP, config.ProxyNDP{
+			Address: p.Address, Interface: p.Interface, External: p.External,
+			HaveRoute: p.HaveRoute, Persistent: p.Persistent, Comment: p.Comment,
+		})
+	}
+	for _, a := range rc.ArpRules {
+		cfg.ArpRules = append(cfg.ArpRules, config.ArpRule{
+			Action: config.ArpAction(a.Action), ActionAddress: a.ActionAddress, ActionMAC: a.ActionMAC,
+			Source: a.Source, Dest: a.Dest, Opcode: a.Opcode, Comment: a.Comment,
+		})
+	}
+	for _, m := range rc.Maclist {
+		cfg.Maclist = append(cfg.Maclist, config.MaclistEntry{
+			Action: config.MaclistAction(m.Action), Interface: m.Interface, MAC: m.MAC,
+			Addresses: m.Addresses, Log: m.Log, Comment: m.Comment,
+		})
+	}
+
+	for _, m := range rc.Mangle {
+		mr := config.MangleRule{
+			Action: config.MangleAction(m.Action), Chain: config.MangleChain(m.Chain), MarkValue: m.MarkValue,
+			Source: m.Source, Dest: m.Dest, Proto: m.Proto, DPort: config.PortSpec(m.DPort), SPort: config.PortSpec(m.SPort),
+			User: m.User, Mark: m.Mark, Length: m.Length, TOS: m.TOS, Helper: m.Helper, Comment: m.Comment,
+		}
+		if m.Probability != nil {
+			mr.Probability = *m.Probability
+		}
+		cfg.Mangle = append(cfg.Mangle, mr)
+	}
+	for _, a := range rc.Accounting {
+		cfg.Accounting = append(cfg.Accounting, config.AccountingRule{
+			Action: config.AccountingAction(a.Action), Section: config.AccountingSection(a.Section), Chain: a.Chain,
+			Source: a.Source, Dest: a.Dest, Proto: a.Proto, DPort: config.PortSpec(a.DPort), SPort: config.PortSpec(a.SPort),
+			Mark: a.Mark, Comment: a.Comment,
+		})
+	}
+	for _, t := range rc.TCDevices {
+		cfg.TCDevices = append(cfg.TCDevices, config.TCDevice{
+			Interface: t.Interface, InBandwidth: t.InBandwidth, OutBandwidth: t.OutBandwidth, Comment: t.Comment,
+		})
+	}
+	for _, t := range rc.TCClasses {
+		cfg.TCClasses = append(cfg.TCClasses, config.TCClass{
+			Interface: t.Interface, Mark: t.Mark, Rate: t.Rate, Ceil: t.Ceil, Priority: t.Priority, Comment: t.Comment,
+		})
+	}
+	for _, t := range rc.TCFilters {
+		cfg.TCFilters = append(cfg.TCFilters, config.TCFilter{
+			Class: t.Class, Source: t.Source, Dest: t.Dest, Proto: t.Proto,
+			DPort: config.PortSpec(t.DPort), SPort: config.PortSpec(t.SPort),
+			TOS: t.TOS, Length: t.Length, Priority: t.Priority, Comment: t.Comment,
+		})
+	}
+	for _, t := range rc.TCInterfaces {
+		cfg.TCInterfaces = append(cfg.TCInterfaces, config.TCInterface{
+			Interface: t.Interface, Type: t.Type, InBandwidth: t.InBandwidth, OutBandwidth: t.OutBandwidth, Comment: t.Comment,
+		})
+	}
+	for _, t := range rc.TCPriorities {
+		cfg.TCPriorities = append(cfg.TCPriorities, config.TCPriority{
+			Band: t.Band, Proto: t.Proto, DPort: config.PortSpec(t.DPort), SPort: config.PortSpec(t.SPort),
+			Address: t.Address, Interface: t.Interface, Helper: t.Helper, Comment: t.Comment,
+		})
+	}
+
+	for _, b := range rc.Blrules {
+		cfg.Blrules = append(cfg.Blrules, config.BlruleRule{
+			Action: config.BlruleAction(b.Action), Source: b.Source, Dest: b.Dest, Proto: b.Proto,
+			DPort: config.PortSpec(b.DPort), SPort: config.PortSpec(b.SPort), Log: b.Log, Comment: b.Comment,
+		})
+	}
+	for _, c := range rc.Conntrack {
+		cfg.Conntrack = append(cfg.Conntrack, config.ConntrackRule{
+			Action: config.ConntrackAction(c.Action), Source: c.Source, Dest: c.Dest, Proto: c.Proto,
+			DPort: config.PortSpec(c.DPort), SPort: config.PortSpec(c.SPort),
+			Chain: config.ConntrackChain(c.Chain), Helper: c.Helper, User: c.User, Comment: c.Comment,
+		})
+	}
+	for _, sm := range rc.Secmarks {
+		cfg.Secmarks = append(cfg.Secmarks, config.SecmarkRule{
+			Secmark: sm.Secmark, Chain: sm.Chain, Source: sm.Source, Dest: sm.Dest, Proto: sm.Proto,
+			DPort: config.PortSpec(sm.DPort), SPort: config.PortSpec(sm.SPort), Comment: sm.Comment,
+		})
+	}
+	if len(rc.Vars) > 0 {
+		cfg.Vars = make(map[string]string, len(rc.Vars))
+		for k, v := range rc.Vars {
+			cfg.Vars[k] = v
+		}
+	}
+
 	return cfg, nil
 }
 
+// translateSNAT expands a rendered SNAT (which carries a list of egress
+// interfaces and source CIDRs) into native tomswall SNAT rules — one per
+// (egress interface, source) pair, since a native rule takes a single Dest.
+func translateSNAT(s RenderedSNAT) []config.SNATRule {
+	sources := s.Source
+	if len(sources) == 0 {
+		sources = []string{""}
+	}
+	var out []config.SNATRule
+	for _, egress := range s.Egress {
+		for _, src := range sources {
+			r := config.SNATRule{
+				Action:  config.SNATAction(s.Action),
+				Source:  src,
+				Dest:    egress,
+				Address: s.Address,
+				Comment: s.Comment,
+			}
+			if s.Probability != nil {
+				r.Probability = *s.Probability
+			}
+			out = append(out, r)
+		}
+	}
+	return out
+}
+
 // indexSets maps set name -> concrete member CIDRs (invalid members skipped).
 func indexSets(sets []RenderedSet) map[string][]string {
 	m := make(map[string][]string, len(sets))

internal/config/blrules.go

@@ -55,20 +55,11 @@ func (c *Config) validateBlrules() error {
 			return fmt.Errorf("blrules[%d]: dest required", i)
 		}
 
-		if r.Source != "all" && r.Source != "any" && r.Source != "none" &&
-			!hasPrefix(r.Source, "all!") && !hasPrefix(r.Source, "any!") {
-			srcZone := zoneFromSpec(r.Source)
-			if _, ok := c.Zones[srcZone]; !ok {
-				return fmt.Errorf("blrules[%d]: source zone %q not defined", i, srcZone)
-			}
+		if err := c.validateZoneRef(r.Source); err != nil {
+			return fmt.Errorf("blrules[%d]: source %w", i, err)
 		}
-
-		if r.Dest != "all" && r.Dest != "any" && r.Dest != "none" &&
-			!hasPrefix(r.Dest, "all!") && !hasPrefix(r.Dest, "any!") {
-			dstZone := zoneFromSpec(r.Dest)
-			if _, ok := c.Zones[dstZone]; !ok {
-				return fmt.Errorf("blrules[%d]: dest zone %q not defined", i, dstZone)
-			}
+		if err := c.validateZoneRef(r.Dest); err != nil {
+			return fmt.Errorf("blrules[%d]: dest %w", i, err)
 		}
 	}
 	return nil

internal/config/config_test.go

@@ -3,6 +3,7 @@ package config
 import (
 	"os"
 	"path/filepath"
+	"reflect"
 	"strings"
 	"testing"
 )
@@ -854,6 +855,32 @@ func TestValidateRules(t *testing.T) {
 			},
 			wantErr: "source zone \"missing\" not defined",
 		},
+		{
+			name: "comma zone lists are valid",
+			rules: []Rule{
+				{Action: RuleAccept, Source: "fw,loc", Dest: "loc,net:192.0.2.1,198.51.100.1"},
+			},
+		},
+		{
+			name: "undefined zone in dest list",
+			rules: []Rule{
+				{Action: RuleAccept, Source: "loc", Dest: "net,missing"},
+			},
+			wantErr: "dest zone \"missing\" not defined",
+		},
+		{
+			name: "negation prefixing the whole address list is valid",
+			rules: []Rule{
+				{Action: RuleAccept, Source: "net:!192.0.2.1,198.51.100.1", Dest: "fw"},
+			},
+		},
+		{
+			name: "negation inside an address list",
+			rules: []Rule{
+				{Action: RuleAccept, Source: "net", Dest: "loc:192.0.2.1,!198.51.100.1"},
+			},
+			wantErr: "'!' may only prefix the whole address list",
+		},
 		{
 			name: "all keyword is valid source",
 			rules: []Rule{
@@ -1006,3 +1033,22 @@ func TestValidateSNAT(t *testing.T) {
 		})
 	}
 }
+
+func TestSplitZoneList(t *testing.T) {
+	tests := []struct {
+		in   string
+		want []ZoneSpec
+	}{
+		{"net", []ZoneSpec{{Zone: "net"}}},
+		{"fw,lan,svr", []ZoneSpec{{Zone: "fw"}, {Zone: "lan"}, {Zone: "svr"}}},
+		{"svr:192.0.2.17", []ZoneSpec{{Zone: "svr", Addr: "192.0.2.17"}}},
+		{"net:192.0.2.1,198.51.100.1", []ZoneSpec{{Zone: "net", Addr: "192.0.2.1,198.51.100.1"}}},
+		{"lan,svr:192.0.2.17", []ZoneSpec{{Zone: "lan"}, {Zone: "svr", Addr: "192.0.2.17"}}},
+		{"net:2001:db8::1", []ZoneSpec{{Zone: "net", Addr: "2001:db8::1"}}},
+	}
+	for _, tt := range tests {
+		if got := SplitZoneList(tt.in); !reflect.DeepEqual(got, tt.want) {
+			t.Errorf("SplitZoneList(%q) = %+v, want %+v", tt.in, got, tt.want)
+		}
+	}
+}

internal/config/conntrack.go

@@ -1,6 +1,9 @@
 package config
 
-import "fmt"
+import (
+	"fmt"
+	"strings"
+)
 
 type ConntrackAction string
 
@@ -68,8 +71,14 @@ func (c *Config) validateConntrack() error {
 			return fmt.Errorf("conntrack[%d]: helper name required for helper action", i)
 		}
 
-		if ct.Source == "" && ct.Dest == "" && ct.Action != ConntrackHelper {
-			return fmt.Errorf("conntrack[%d]: source or dest required", i)
+		if HasZoneExclusion(ct.Source) || HasZoneExclusion(ct.Dest) {
+			return fmt.Errorf("conntrack[%d]: zone exclusions are not supported in conntrack entries", i)
+		}
+		if err := c.validateZoneRef(ct.Source); err != nil {
+			return fmt.Errorf("conntrack[%d]: source %w", i, err)
+		}
+		if err := c.validateZoneRef(ct.Dest); err != nil {
+			return fmt.Errorf("conntrack[%d]: dest %w", i, err)
 		}
 
 		if ct.User != "" {
@@ -84,3 +93,9 @@ func (c *Config) validateConntrack() error {
 	}
 	return nil
 }
+
+// HasZoneExclusion reports an all/any zone ref with a "+" or "!" modifier (all+, all!x, any+!x, ...).
+func HasZoneExclusion(spec string) bool {
+	zones, _, _ := strings.Cut(spec, ":")
+	return (strings.HasPrefix(zones, "all") || strings.HasPrefix(zones, "any")) && strings.ContainsAny(zones[3:], "+!")
+}

internal/config/extras_test.go

@@ -53,11 +53,52 @@ func TestValidateConntrack(t *testing.T) {
 			},
 		},
 		{
-			name: "source or dest required for non-helper",
-			rules: []ConntrackRule{
-				{Action: ConntrackDrop},
-			},
-			wantErr: "source or dest required",
+			name:  "omitted source and dest is valid",
+			rules: []ConntrackRule{{Action: ConntrackNoTrack, Proto: "udp", DPort: PortSpec{"53"}}},
+		},
+		{
+			name:    "unknown source zone",
+			rules:   []ConntrackRule{{Action: ConntrackNoTrack, Source: "nte"}},
+			wantErr: `source zone "nte" not defined`,
+		},
+		{
+			name:    "unknown dest zone",
+			rules:   []ConntrackRule{{Action: ConntrackDrop, Source: "net", Dest: "nte:192.0.2.1"}},
+			wantErr: `dest zone "nte" not defined`,
+		},
+		{
+			name:  "all and plain zone forms are valid",
+			rules: []ConntrackRule{{Action: ConntrackNoTrack, Source: "net,fw", Dest: "all:192.0.2.1"}},
+		},
+		{
+			name:    "Source all!net rejected",
+			rules:   []ConntrackRule{{Action: ConntrackNoTrack, Source: "all!net"}},
+			wantErr: "zone exclusions are not supported in conntrack entries",
+		},
+		{
+			name:    "Dest all!net:192.0.2.1 rejected",
+			rules:   []ConntrackRule{{Action: ConntrackNoTrack, Dest: "all!net:192.0.2.1"}},
+			wantErr: "zone exclusions are not supported in conntrack entries",
+		},
+		{
+			name:    "Source all+ rejected",
+			rules:   []ConntrackRule{{Action: ConntrackNoTrack, Source: "all+"}},
+			wantErr: "zone exclusions are not supported in conntrack entries",
+		},
+		{
+			name:    "Dest all+!net rejected",
+			rules:   []ConntrackRule{{Action: ConntrackNoTrack, Dest: "all+!net"}},
+			wantErr: "zone exclusions are not supported in conntrack entries",
+		},
+		{
+			name:    "Source any!net rejected",
+			rules:   []ConntrackRule{{Action: ConntrackNoTrack, Source: "any!net"}},
+			wantErr: "zone exclusions are not supported in conntrack entries",
+		},
+		{
+			name:    "Dest any+ rejected",
+			rules:   []ConntrackRule{{Action: ConntrackNoTrack, Dest: "any+"}},
+			wantErr: "zone exclusions are not supported in conntrack entries",
 		},
 		{
 			name: "helper without source/dest is valid",

internal/config/rules.go

@@ -1,6 +1,9 @@
 package config
 
-import "fmt"
+import (
+	"fmt"
+	"strings"
+)
 
 type RuleAction string
 
@@ -170,25 +173,13 @@ func (c *Config) validateRules() error {
 			return fmt.Errorf("rule[%d]: dest required", i)
 		}
 
-		if r.Source != "all" && r.Source != "any" && r.Source != "none" &&
-			!hasPrefix(r.Source, "all+") && !hasPrefix(r.Source, "all!") && !hasPrefix(r.Source, "any!") {
-			for _, srcPart := range splitZones(r.Source) {
-				srcZone := zoneFromSpec(srcPart)
-				if _, ok := c.Zones[srcZone]; !ok {
-					return fmt.Errorf("rule[%d]: source zone %q not defined", i, srcZone)
-				}
-			}
+		if err := c.validateZoneRef(r.Source); err != nil {
+			return fmt.Errorf("rule[%d]: source %w", i, err)
 		}
 
 		if r.Action != RuleDNAT && r.Action != RuleRedirect && r.Action != RuleNoNAT {
-			if r.Dest != "all" && r.Dest != "any" && r.Dest != "none" &&
-				!hasPrefix(r.Dest, "all+") && !hasPrefix(r.Dest, "all!") && !hasPrefix(r.Dest, "any!") {
-				for _, dstPart := range splitZones(r.Dest) {
-					dstZone := zoneFromSpec(dstPart)
-					if _, ok := c.Zones[dstZone]; !ok {
-						return fmt.Errorf("rule[%d]: dest zone %q not defined", i, dstZone)
-					}
-				}
+			if err := c.validateZoneRef(r.Dest); err != nil {
+				return fmt.Errorf("rule[%d]: dest %w", i, err)
 			}
 		}
 
@@ -223,6 +214,30 @@ func (c *Config) validateRules() error {
 	return nil
 }
 
+// ZoneSpec is one zone of a SOURCE/DEST list; Addr is its comma-separated address list, if any.
+type ZoneSpec struct{ Zone, Addr string }
+
+// SplitZoneList parses "lan,svr:a,b": commas before the first colon separate zones,
+// commas after it separate addresses of the last zone (shorewall semantics).
+func SplitZoneList(spec string) []ZoneSpec {
+	zones, addr, _ := strings.Cut(spec, ":")
+	var out []ZoneSpec
+	for _, z := range strings.Split(zones, ",") {
+		if z = strings.TrimSpace(z); z != "" {
+			out = append(out, ZoneSpec{Zone: z})
+		}
+	}
+	if len(out) > 0 {
+		out[len(out)-1].Addr = addr
+	}
+	return out
+}
+
+// validAddrList reports whether '!' appears only at the start, negating the whole list.
+func validAddrList(addr string) bool {
+	return !strings.Contains(strings.TrimPrefix(addr, "!"), "!")
+}
+
 // zoneFromSpec extracts the zone name from a zone spec like "net" or "net:192.168.1.0/24".
 func zoneFromSpec(spec string) string {
 	for i, c := range spec {
@@ -233,6 +248,32 @@ func zoneFromSpec(spec string) string {
 	return spec
 }
 
-func hasPrefix(s, prefix string) bool {
-	return len(s) >= len(prefix) && s[:len(prefix)] == prefix
+// validateZoneRef checks a SOURCE/DEST spec: all/any[+][!excluded,...][:addr], none, or a declared zone list.
+func (c *Config) validateZoneRef(spec string) error {
+	zones, addr, _ := strings.Cut(spec, ":")
+	base, excl, isExcl := strings.Cut(zones, "!")
+	switch base {
+	case "", "none", "all", "all+", "any", "any+":
+		if base == "" && isExcl {
+			return fmt.Errorf("%q: exclusion needs all or any", spec)
+		}
+		for _, z := range strings.Split(excl, ",") {
+			if _, ok := c.Zones[strings.TrimSpace(z)]; isExcl && !ok {
+				return fmt.Errorf("excluded zone %q not defined", z)
+			}
+		}
+		if !validAddrList(addr) {
+			return fmt.Errorf("%q: '!' may only prefix the whole address list", addr)
+		}
+		return nil
+	}
+	for _, zs := range SplitZoneList(spec) {
+		if _, ok := c.Zones[zs.Zone]; !ok {
+			return fmt.Errorf("zone %q not defined", zs.Zone)
+		}
+		if !validAddrList(zs.Addr) {
+			return fmt.Errorf("%q: '!' may only prefix the whole address list", zs.Addr)
+		}
+	}
+	return nil
 }

internal/nftables/diff.go

@@ -2,6 +2,8 @@ package nftables
 
 import (
 	"fmt"
+	"reflect"
+	"sort"
 	"strings"
 
 	"github.com/google/nftables/expr"
@@ -12,19 +14,31 @@ type ManagedRule struct {
 	Handle uint64
 	Exprs  []expr.Any
 	Tag    string
+	// Before is the handle of the existing rule an added rule is inserted ahead of; 0 appends.
+	Before uint64
 }
 
 type FirewallState struct {
 	Rules map[string][]ManagedRule
+	// Helpers are the ct helper objects in kernel (insertion) order.
+	Helpers []Helper
+}
+
+// Helper is a named ct helper object.
+type Helper struct {
+	Name   string        `json:"name"`
+	Helper expr.CtHelper `json:"helper"`
 }
 
 type ChangeSet struct {
-	Add    []ManagedRule
-	Remove []ManagedRule
+	Add           []ManagedRule
+	Remove        []ManagedRule
+	AddHelpers    []Helper
+	RemoveHelpers []string
 }
 
 func (cs *ChangeSet) Empty() bool {
-	return len(cs.Add) == 0 && len(cs.Remove) == 0
+	return len(cs.Add) == 0 && len(cs.Remove) == 0 && len(cs.AddHelpers) == 0 && len(cs.RemoveHelpers) == 0
 }
 
 func (cs *ChangeSet) Summary() string {
@@ -32,7 +46,11 @@ func (cs *ChangeSet) Summary() string {
 	if len(cs.Add) > 0 {
 		fmt.Fprintf(&b, "  + %d rule(s) to add\n", len(cs.Add))
 		for _, r := range cs.Add {
-			fmt.Fprintf(&b, "    + [%s] %s\n", r.Chain, r.Tag)
+			if r.Before != 0 {
+				fmt.Fprintf(&b, "    + [%s] %s (before handle %d)\n", r.Chain, r.Tag, r.Before)
+			} else {
+				fmt.Fprintf(&b, "    + [%s] %s\n", r.Chain, r.Tag)
+			}
 		}
 	}
 	if len(cs.Remove) > 0 {
@@ -41,69 +59,120 @@ func (cs *ChangeSet) Summary() string {
 			fmt.Fprintf(&b, "    - [%s] %s (handle %d)\n", r.Chain, r.Tag, r.Handle)
 		}
 	}
+	for _, h := range cs.AddHelpers {
+		fmt.Fprintf(&b, "  + ct helper %q\n", h.Name)
+	}
+	for _, n := range cs.RemoveHelpers {
+		fmt.Fprintf(&b, "  - ct helper %q\n", n)
+	}
 	return b.String()
 }
 
+// Rules are first-match, so order matters: keep the common prefix and suffix of
+// each chain, replace the middle, and insert the new rules before the first kept
+// suffix rule (or append when there is none).
 func computeDiff(current, desired *FirewallState) *ChangeSet {
-	cs := &ChangeSet{}
+	cs := diffHelpers(current, desired)
 
-	currentByTag := make(map[string][]ManagedRule)
-	for _, rules := range current.Rules {
-		for _, r := range rules {
+	chains := make([]string, 0, len(current.Rules)+len(desired.Rules))
+	for c := range current.Rules {
+		chains = append(chains, c)
+	}
+	for c := range desired.Rules {
+		if _, ok := current.Rules[c]; !ok {
+			chains = append(chains, c)
+		}
+	}
+	sort.Strings(chains)
+
+	for _, chain := range chains {
+		var cur []ManagedRule
+		for _, r := range current.Rules[chain] {
 			if r.Tag != "" {
-				currentByTag[r.Tag] = append(currentByTag[r.Tag], r)
+				cur = append(cur, r)
 			}
 		}
-	}
+		want := desired.Rules[chain]
 
-	desiredByTag := make(map[string][]ManagedRule)
-	for _, rules := range desired.Rules {
-		for _, r := range rules {
-			desiredByTag[r.Tag] = append(desiredByTag[r.Tag], r)
+		pre := 0
+		for pre < len(cur) && pre < len(want) && ruleEqual(cur[pre], want[pre]) {
+			pre++
+		}
+		suf := 0
+		for suf < len(cur)-pre && suf < len(want)-pre &&
+			ruleEqual(cur[len(cur)-1-suf], want[len(want)-1-suf]) {
+			suf++
 		}
-	}
 
-	for tag, desiredRules := range desiredByTag {
-		currentRules, exists := currentByTag[tag]
-		if !exists {
-			cs.Add = append(cs.Add, desiredRules...)
-			continue
+		var before uint64
+		if suf > 0 {
+			before = cur[len(cur)-suf].Handle
 		}
-		if !rulesMatch(currentRules, desiredRules) {
-			cs.Remove = append(cs.Remove, currentRules...)
-			cs.Add = append(cs.Add, desiredRules...)
-		}
-	}
-
-	for tag, currentRules := range currentByTag {
-		if _, exists := desiredByTag[tag]; !exists {
-			cs.Remove = append(cs.Remove, currentRules...)
+		cs.Remove = append(cs.Remove, cur[pre:len(cur)-suf]...)
+		for _, r := range want[pre : len(want)-suf] {
+			r.Before = before
+			cs.Add = append(cs.Add, r)
 		}
 	}
 
 	return cs
 }
 
-func rulesMatch(a, b []ManagedRule) bool {
-	if len(a) != len(b) {
-		return false
-	}
-	for i := range a {
-		if a[i].Chain != b[i].Chain {
-			return false
-		}
-		if !exprsEqual(a[i].Exprs, b[i].Exprs) {
-			return false
-		}
-	}
-	return true
+func ruleEqual(a, b ManagedRule) bool {
+	return a.Chain == b.Chain && a.Tag == b.Tag && reflect.DeepEqual(a.Exprs, b.Exprs)
 }
 
-func exprsEqual(a, b []expr.Any) bool {
-	if len(a) != len(b) {
-		return false
+// restoreChangeSet replaces every managed rule in current with the snapshot's,
+// in snapshot order, so a restore cannot reorder rules.
+func restoreChangeSet(current, snap *FirewallState) *ChangeSet {
+	cs := &ChangeSet{AddHelpers: snap.Helpers}
+	for _, h := range current.Helpers {
+		cs.RemoveHelpers = append(cs.RemoveHelpers, h.Name)
 	}
-	as := fmt.Sprintf("%v", a)
-	bs := fmt.Sprintf("%v", b)
-	return as == bs
+	for _, rules := range current.Rules {
+		for _, r := range rules {
+			if r.Tag != "" {
+				cs.Remove = append(cs.Remove, r)
+			}
+		}
+	}
+	chains := make([]string, 0, len(snap.Rules))
+	for c := range snap.Rules {
+		chains = append(chains, c)
+	}
+	sort.Strings(chains)
+	for _, c := range chains {
+		for _, r := range snap.Rules[c] {
+			if r.Tag != "" {
+				cs.Add = append(cs.Add, r)
+			}
+		}
+	}
+	return cs
+}
+
+// diffHelpers replaces any ct helper object that is missing or differs.
+// L3Proto is ignored: the kernel narrows inet to ip/ip6 for single-family helpers such as pptp.
+func diffHelpers(current, desired *FirewallState) *ChangeSet {
+	cs := &ChangeSet{}
+	same := func(a, b expr.CtHelper) bool { return a.Name == b.Name && a.L4Proto == b.L4Proto }
+	find := func(hs []Helper, name string) (expr.CtHelper, bool) {
+		for _, h := range hs {
+			if h.Name == name {
+				return h.Helper, true
+			}
+		}
+		return expr.CtHelper{}, false
+	}
+	for _, h := range current.Helpers {
+		if want, ok := find(desired.Helpers, h.Name); !ok || !same(want, h.Helper) {
+			cs.RemoveHelpers = append(cs.RemoveHelpers, h.Name)
+		}
+	}
+	for _, h := range desired.Helpers {
+		if have, ok := find(current.Helpers, h.Name); !ok || !same(have, h.Helper) {
+			cs.AddHelpers = append(cs.AddHelpers, h)
+		}
+	}
+	return cs
 }

internal/nftables/diff_test.go

@@ -0,0 +1,106 @@
+package nftables
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/google/nftables/expr"
+	"golang.org/x/sys/unix"
+)
+
+func TestRestoreChangeSet(t *testing.T) {
+	accept := []expr.Any{&expr.Verdict{Kind: expr.VerdictAccept}}
+	drop := []expr.Any{&expr.Verdict{Kind: expr.VerdictDrop}}
+
+	snap := &FirewallState{Rules: map[string][]ManagedRule{
+		"input": {
+			{Chain: "input", Tag: "ssh", Exprs: accept, Handle: 4},
+			{Chain: "input", Tag: "web", Exprs: accept, Handle: 5},
+			{Chain: "input", Tag: "", Exprs: drop, Handle: 6},
+		},
+		"forward": {{Chain: "forward", Tag: "fwd", Exprs: accept, Handle: 7}},
+	}}
+	current := &FirewallState{Rules: map[string][]ManagedRule{
+		"input": {
+			{Chain: "input", Tag: "web", Exprs: accept, Handle: 10},
+			{Chain: "input", Tag: "ssh", Exprs: drop, Handle: 11},
+			{Chain: "input", Tag: "", Exprs: drop, Handle: 12},
+		},
+	}}
+
+	cs := restoreChangeSet(current, snap)
+
+	var removed []uint64
+	for _, r := range cs.Remove {
+		removed = append(removed, r.Handle)
+	}
+	if len(removed) != 2 || removed[0] != 10 || removed[1] != 11 {
+		t.Errorf("expected managed handles [10 11] removed, untagged kept; got %v", removed)
+	}
+
+	var added []string
+	for _, r := range cs.Add {
+		added = append(added, r.Tag)
+	}
+	want := []string{"fwd", "ssh", "web"}
+	if len(added) != len(want) {
+		t.Fatalf("added %v, want %v", added, want)
+	}
+	for i := range want {
+		if added[i] != want[i] {
+			t.Fatalf("added %v, want %v (snapshot order per chain)", added, want)
+		}
+	}
+	if !reflect.DeepEqual(cs.Add[1].Exprs, accept) {
+		t.Error("ssh not restored to its snapshot exprs")
+	}
+}
+
+func TestRestoreChangeSetEmptySnapshotRemovesAll(t *testing.T) {
+	current := &FirewallState{Rules: map[string][]ManagedRule{
+		"input": {{Chain: "input", Tag: "x", Handle: 1}},
+	}}
+	cs := restoreChangeSet(current, &FirewallState{Rules: map[string][]ManagedRule{}})
+	if len(cs.Remove) != 1 || len(cs.Add) != 0 {
+		t.Errorf("expected 1 remove 0 add, got %d/%d", len(cs.Remove), len(cs.Add))
+	}
+}
+
+func TestDiffHelpers(t *testing.T) {
+	h := func(name, typ string, l3 uint16, l4 uint8) Helper {
+		return Helper{Name: name, Helper: expr.CtHelper{Name: typ, L3Proto: l3, L4Proto: l4}}
+	}
+	ftp := h("ftp", "ftp", unix.NFPROTO_INET, unix.IPPROTO_TCP)
+	tftp := h("tftp", "tftp", unix.NFPROTO_INET, unix.IPPROTO_UDP)
+	sipUDP := h("sip", "sip", unix.NFPROTO_INET, unix.IPPROTO_UDP)
+	sipTCP := h("sip", "sip", unix.NFPROTO_INET, unix.IPPROTO_TCP)
+
+	current := &FirewallState{Helpers: []Helper{tftp, ftp, sipUDP}}
+	desired := &FirewallState{Helpers: []Helper{ftp, sipTCP}}
+
+	cs := computeDiff(current, desired)
+	if !reflect.DeepEqual(cs.RemoveHelpers, []string{"tftp", "sip"}) {
+		t.Errorf("remove = %v", cs.RemoveHelpers)
+	}
+	if !reflect.DeepEqual(cs.AddHelpers, []Helper{sipTCP}) {
+		t.Errorf("add = %v", cs.AddHelpers)
+	}
+
+	// Restore recreates every helper so kernel listing order matches the snapshot.
+	cs = restoreChangeSet(desired, current)
+	if !reflect.DeepEqual(cs.RemoveHelpers, []string{"ftp", "sip"}) || !reflect.DeepEqual(cs.AddHelpers, current.Helpers) {
+		t.Errorf("restore = -%v +%v", cs.RemoveHelpers, cs.AddHelpers)
+	}
+
+	live := &FirewallState{Helpers: []Helper{h("pptp", "pptp", unix.NFPROTO_IPV4, unix.IPPROTO_TCP)}}
+	want := &FirewallState{Helpers: []Helper{h("pptp", "pptp", unix.NFPROTO_INET, unix.IPPROTO_TCP)}}
+	if cs := computeDiff(live, want); !cs.Empty() {
+		t.Errorf("kernel-narrowed l3proto should not diff: %+v", cs)
+	}
+	if cs := computeDiff(desired, desired); !cs.Empty() {
+		t.Errorf("identical helpers should be empty: %+v", cs)
+	}
+	if cs := computeDiff(&FirewallState{}, desired); cs.Empty() {
+		t.Error("missing helpers should not be empty")
+	}
+}

internal/nftables/engine.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 
 	"github.com/google/nftables"
+	"github.com/google/nftables/expr"
 
 	"git.unkin.net/unkin/tomswall/internal/config"
 )
@@ -28,7 +29,8 @@ func (e *Engine) ensureTable() *nftables.Table {
 	})
 }
 
-func (e *Engine) ensureChains(table *nftables.Table) map[string]*nftables.Chain {
+// ensureChains declares the base chains; policies overrides their default policy.
+func (e *Engine) ensureChains(table *nftables.Table, policies map[string]nftables.ChainPolicy) map[string]*nftables.Chain {
 	chains := map[string]*nftables.Chain{
 		"input": {
 			Name:     "input",
@@ -68,9 +70,42 @@ func (e *Engine) ensureChains(table *nftables.Table) map[string]*nftables.Chain
 			Hooknum:  nftables.ChainHookPrerouting,
 			Priority: nftables.ChainPriorityNATDest,
 		},
+		"helper_prerouting": {
+			Name:     "helper_prerouting",
+			Table:    table,
+			Type:     nftables.ChainTypeFilter,
+			Hooknum:  nftables.ChainHookPrerouting,
+			Priority: nftables.ChainPriorityMangle,
+		},
+		"helper_output": {
+			Name:     "helper_output",
+			Table:    table,
+			Type:     nftables.ChainTypeFilter,
+			Hooknum:  nftables.ChainHookOutput,
+			Priority: nftables.ChainPriorityMangle,
+		},
+		"raw_prerouting": {
+			Name:     "raw_prerouting",
+			Table:    table,
+			Type:     nftables.ChainTypeFilter,
+			Hooknum:  nftables.ChainHookPrerouting,
+			Priority: nftables.ChainPriorityRaw,
+			Policy:   policyPtr(nftables.ChainPolicyAccept),
+		},
+		"raw_output": {
+			Name:     "raw_output",
+			Table:    table,
+			Type:     nftables.ChainTypeFilter,
+			Hooknum:  nftables.ChainHookOutput,
+			Priority: nftables.ChainPriorityRaw,
+			Policy:   policyPtr(nftables.ChainPolicyAccept),
+		},
 	}
 
 	for name, chain := range chains {
+		if p, ok := policies[name]; ok {
+			chain.Policy = policyPtr(p)
+		}
 		chains[name] = e.conn.AddChain(chain)
 	}
 	return chains
@@ -93,8 +128,12 @@ func (e *Engine) Plan() (*ChangeSet, error) {
 }
 
 func (e *Engine) Apply(changes *ChangeSet) error {
+	return e.apply(changes, nil)
+}
+
+func (e *Engine) apply(changes *ChangeSet, policies map[string]nftables.ChainPolicy) error {
 	table := e.ensureTable()
-	chains := e.ensureChains(table)
+	chains := e.ensureChains(table, policies)
 
 	for _, r := range changes.Remove {
 		e.conn.DelRule(&nftables.Rule{
@@ -104,17 +143,30 @@ func (e *Engine) Apply(changes *ChangeSet) error {
 		})
 	}
 
+	for _, n := range changes.RemoveHelpers {
+		e.conn.DeleteObject(helperObj(table, n, expr.CtHelper{}))
+	}
+	for _, h := range changes.AddHelpers {
+		e.conn.AddObj(helperObj(table, h.Name, h.Helper))
+	}
+
 	for _, r := range changes.Add {
 		chain, ok := chains[r.Chain]
 		if !ok {
 			return fmt.Errorf("unknown chain %q", r.Chain)
 		}
-		e.conn.AddRule(&nftables.Rule{
+		rule := &nftables.Rule{
 			Table:    table,
 			Chain:    chain,
 			Exprs:    r.Exprs,
 			UserData: []byte(r.Tag),
-		})
+		}
+		if r.Before != 0 {
+			rule.Position = r.Before
+			e.conn.InsertRule(rule)
+		} else {
+			e.conn.AddRule(rule)
+		}
 	}
 
 	return e.conn.Flush()
@@ -135,31 +187,44 @@ func (e *Engine) Flush() error {
 	return nil
 }
 
+func (e *Engine) findTable() (*nftables.Table, error) {
+	tables, err := e.conn.ListTables()
+	if err != nil {
+		return nil, fmt.Errorf("listing tables: %w", err)
+	}
+	for _, t := range tables {
+		if t.Name == e.cfg.Settings.TableName && t.Family == nftables.TableFamilyINet {
+			return t, nil
+		}
+	}
+	return nil, nil
+}
+
 func (e *Engine) readCurrentState() (*FirewallState, error) {
 	state := &FirewallState{
 		Rules: make(map[string][]ManagedRule),
 	}
 
-	tables, err := e.conn.ListTables()
+	ourTable, err := e.findTable()
+	if err != nil || ourTable == nil {
+		return state, err
+	}
+
+	objs, err := e.conn.GetNamedObjects(ourTable)
 	if err != nil {
-		return state, nil
+		return nil, fmt.Errorf("listing objects: %w", err)
 	}
-
-	var ourTable *nftables.Table
-	for _, t := range tables {
-		if t.Name == e.cfg.Settings.TableName && t.Family == nftables.TableFamilyINet {
-			ourTable = t
-			break
+	for _, o := range objs {
+		if no, ok := o.(*nftables.NamedObj); ok && no.Type == nftables.ObjTypeCtHelper {
+			if h, ok := no.Obj.(*expr.CtHelper); ok {
+				state.Helpers = append(state.Helpers, Helper{Name: no.Name, Helper: *h})
+			}
 		}
 	}
 
-	if ourTable == nil {
-		return state, nil
-	}
-
 	chains, err := e.conn.ListChainsOfTableFamily(nftables.TableFamilyINet)
 	if err != nil {
-		return state, nil
+		return nil, fmt.Errorf("listing chains: %w", err)
 	}
 
 	for _, chain := range chains {
@@ -168,7 +233,7 @@ func (e *Engine) readCurrentState() (*FirewallState, error) {
 		}
 		rules, err := e.conn.GetRules(ourTable, chain)
 		if err != nil {
-			continue
+			return nil, fmt.Errorf("listing rules of %s: %w", chain.Name, err)
 		}
 		for _, rule := range rules {
 			state.Rules[chain.Name] = append(state.Rules[chain.Name], ManagedRule{
@@ -183,6 +248,79 @@ func (e *Engine) readCurrentState() (*FirewallState, error) {
 	return state, nil
 }
 
+// Snapshot is the tomswall table as captured live, serialisable so a revert
+// survives the process that took it.
+type Snapshot struct {
+	Table    string                          `json:"table"`
+	Present  bool                            `json:"present"`
+	Policies map[string]nftables.ChainPolicy `json:"policies,omitempty"`
+	Rules    map[string][]SnapshotRule       `json:"rules,omitempty"`
+	Helpers  []Helper                        `json:"helpers,omitempty"`
+}
+
+// SnapshotRule is a managed rule with its expressions in netlink wire format.
+type SnapshotRule struct {
+	Tag   string   `json:"tag"`
+	Exprs [][]byte `json:"exprs"`
+}
+
+// Snapshot captures the live tomswall table so Restore can roll back to it.
+func (e *Engine) Snapshot() (*Snapshot, error) {
+	snap := &Snapshot{Table: e.cfg.Settings.TableName}
+	t, err := e.findTable()
+	if err != nil || t == nil {
+		return snap, err
+	}
+	snap.Present = true
+
+	chains, err := e.conn.ListChainsOfTableFamily(nftables.TableFamilyINet)
+	if err != nil {
+		return nil, fmt.Errorf("listing chains: %w", err)
+	}
+	snap.Policies = make(map[string]nftables.ChainPolicy)
+	for _, c := range chains {
+		if c.Table.Name == snap.Table && c.Policy != nil {
+			snap.Policies[c.Name] = *c.Policy
+		}
+	}
+
+	state, err := e.readCurrentState()
+	if err != nil {
+		return nil, err
+	}
+	snap.Rules, err = encodeState(state)
+	if err != nil {
+		return nil, err
+	}
+	snap.Helpers = state.Helpers
+	return snap, nil
+}
+
+// Restore atomically returns the tomswall table to the snapshot: rule order
+// and chain policies included, or removed if it was absent.
+func (e *Engine) Restore(s *Snapshot) error {
+	if s.Table != e.cfg.Settings.TableName {
+		return fmt.Errorf("snapshot is of table %q, engine manages %q", s.Table, e.cfg.Settings.TableName)
+	}
+	if !s.Present {
+		return e.Flush()
+	}
+	want, err := decodeState(s.Rules)
+	if err != nil {
+		return err
+	}
+	want.Helpers = s.Helpers
+	current, err := e.readCurrentState()
+	if err != nil {
+		return err
+	}
+	return e.apply(restoreChangeSet(current, want), s.Policies)
+}
+
+func helperObj(table *nftables.Table, name string, h expr.CtHelper) *nftables.NamedObj {
+	return &nftables.NamedObj{Table: table, Name: name, Type: nftables.ObjTypeCtHelper, Obj: &h}
+}
+
 func policyPtr(p nftables.ChainPolicy) *nftables.ChainPolicy {
 	return &p
 }

internal/nftables/snapshot.go

@@ -0,0 +1,119 @@
+package nftables
+
+import (
+	"encoding/binary"
+	"fmt"
+
+	"github.com/google/nftables"
+	"github.com/google/nftables/expr"
+	"github.com/mdlayher/netlink"
+	"golang.org/x/sys/unix"
+)
+
+const inet = byte(nftables.TableFamilyINet)
+
+// exprByName mirrors the expression types google/nftables can parse back from the kernel.
+var exprByName = map[string]func() expr.Any{
+	"ct":           func() expr.Any { return &expr.Ct{} },
+	"range":        func() expr.Any { return &expr.Range{} },
+	"meta":         func() expr.Any { return &expr.Meta{} },
+	"cmp":          func() expr.Any { return &expr.Cmp{} },
+	"counter":      func() expr.Any { return &expr.Counter{} },
+	"objref":       func() expr.Any { return &expr.Objref{} },
+	"payload":      func() expr.Any { return &expr.Payload{} },
+	"lookup":       func() expr.Any { return &expr.Lookup{} },
+	"immediate":    func() expr.Any { return &expr.Immediate{} },
+	"bitwise":      func() expr.Any { return &expr.Bitwise{} },
+	"redir":        func() expr.Any { return &expr.Redir{} },
+	"nat":          func() expr.Any { return &expr.NAT{} },
+	"limit":        func() expr.Any { return &expr.Limit{} },
+	"quota":        func() expr.Any { return &expr.Quota{} },
+	"dynset":       func() expr.Any { return &expr.Dynset{} },
+	"log":          func() expr.Any { return &expr.Log{} },
+	"exthdr":       func() expr.Any { return &expr.Exthdr{} },
+	"connlimit":    func() expr.Any { return &expr.Connlimit{} },
+	"queue":        func() expr.Any { return &expr.Queue{} },
+	"flow_offload": func() expr.Any { return &expr.FlowOffload{} },
+	"reject":       func() expr.Any { return &expr.Reject{} },
+	"masq":         func() expr.Any { return &expr.Masq{} },
+	"hash":         func() expr.Any { return &expr.Hash{} },
+	"notrack":      func() expr.Any { return &expr.Notrack{} },
+}
+
+func encodeState(state *FirewallState) (map[string][]SnapshotRule, error) {
+	out := make(map[string][]SnapshotRule, len(state.Rules))
+	for chain, rules := range state.Rules {
+		for _, r := range rules {
+			sr := SnapshotRule{Tag: r.Tag}
+			for _, e := range r.Exprs {
+				b, err := expr.Marshal(inet, e)
+				if err != nil {
+					return nil, fmt.Errorf("encoding %s rule %q: %w", chain, r.Tag, err)
+				}
+				sr.Exprs = append(sr.Exprs, b)
+			}
+			out[chain] = append(out[chain], sr)
+		}
+	}
+	return out, nil
+}
+
+func decodeState(rules map[string][]SnapshotRule) (*FirewallState, error) {
+	state := &FirewallState{Rules: make(map[string][]ManagedRule, len(rules))}
+	for chain, rs := range rules {
+		for _, sr := range rs {
+			r := ManagedRule{Chain: chain, Tag: sr.Tag}
+			for _, b := range sr.Exprs {
+				e, err := decodeExpr(b)
+				if err != nil {
+					return nil, fmt.Errorf("decoding %s rule %q: %w", chain, sr.Tag, err)
+				}
+				r.Exprs = append(r.Exprs, e)
+			}
+			state.Rules[chain] = append(state.Rules[chain], r)
+		}
+	}
+	return state, nil
+}
+
+// decodeExpr reverses expr.Marshal, as google/nftables does when reading rules.
+func decodeExpr(b []byte) (expr.Any, error) {
+	ad, err := netlink.NewAttributeDecoder(b)
+	if err != nil {
+		return nil, err
+	}
+	ad.ByteOrder = binary.BigEndian
+	var name string
+	var data []byte
+	for ad.Next() {
+		switch ad.Type() {
+		case unix.NFTA_EXPR_NAME:
+			name = ad.String()
+		case unix.NFTA_EXPR_DATA:
+			data = ad.Bytes()
+		}
+	}
+	if err := ad.Err(); err != nil {
+		return nil, err
+	}
+	newExpr, ok := exprByName[name]
+	if !ok {
+		return nil, fmt.Errorf("unsupported expression %q", name)
+	}
+	e := newExpr()
+	if name == "notrack" {
+		return e, nil
+	}
+	if err := expr.Unmarshal(inet, data, e); err != nil {
+		return nil, err
+	}
+	// A verdict is an immediate into the verdict register with no data.
+	if imm, ok := e.(*expr.Immediate); ok && imm.Register == unix.NFT_REG_VERDICT && len(imm.Data) == 0 {
+		v := &expr.Verdict{}
+		if err := expr.Unmarshal(inet, data, v); err != nil {
+			return nil, err
+		}
+		return v, nil
+	}
+	return e, nil
+}

internal/nftables/snapshot_test.go

@@ -0,0 +1,259 @@
+package nftables
+
+import (
+	"bytes"
+	"encoding/binary"
+	"encoding/json"
+	"reflect"
+	"testing"
+
+	"github.com/google/nftables"
+	"github.com/google/nftables/expr"
+	"github.com/mdlayher/netlink"
+	"golang.org/x/sys/unix"
+
+	"git.unkin.net/unkin/tomswall/internal/config"
+)
+
+func TestSnapshotRulesRoundTrip(t *testing.T) {
+	exprs := []expr.Any{
+		&expr.Meta{Key: expr.MetaKeyL4PROTO, Register: 1},
+		&expr.Cmp{Op: expr.CmpOpEq, Register: 1, Data: []byte{unix.IPPROTO_TCP}},
+		&expr.Payload{DestRegister: 1, Base: expr.PayloadBaseTransportHeader, Offset: 2, Len: 2},
+		&expr.Cmp{Op: expr.CmpOpEq, Register: 1, Data: []byte{0, 22}},
+		&expr.Ct{Register: 1, Key: expr.CtKeySTATE},
+		&expr.Notrack{},
+		&expr.Verdict{Kind: expr.VerdictAccept},
+	}
+	state := &FirewallState{Rules: map[string][]ManagedRule{
+		"input": {{Chain: "input", Tag: "ssh", Exprs: exprs}, {Chain: "input", Tag: "drop", Exprs: []expr.Any{&expr.Verdict{Kind: expr.VerdictDrop}}}},
+	}}
+
+	rules, err := encodeState(state)
+	if err != nil {
+		t.Fatal(err)
+	}
+	b, err := json.Marshal(&Snapshot{Table: "tomswall", Present: true, Rules: rules,
+		Policies: map[string]nftables.ChainPolicy{"input": nftables.ChainPolicyAccept}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var snap Snapshot
+	if err := json.Unmarshal(b, &snap); err != nil {
+		t.Fatal(err)
+	}
+	if snap.Policies["input"] != nftables.ChainPolicyAccept {
+		t.Errorf("policy lost: %v", snap.Policies)
+	}
+	got, err := decodeState(snap.Rules)
+	if err != nil {
+		t.Fatal(err)
+	}
+	in := got.Rules["input"]
+	if len(in) != 2 || in[0].Tag != "ssh" || in[1].Tag != "drop" {
+		t.Fatalf("rules/order lost: %+v", in)
+	}
+	if !reflect.DeepEqual(in[0].Exprs, exprs) {
+		t.Errorf("exprs changed:\n got %#v\nwant %#v", in[0].Exprs, exprs)
+	}
+	if _, ok := in[1].Exprs[0].(*expr.Verdict); !ok {
+		t.Errorf("verdict decoded as %T", in[1].Exprs[0])
+	}
+}
+
+func TestEnsureChainsPolicyOverride(t *testing.T) {
+	e := testEngine(t, nil)
+	chains := e.ensureChains(e.ensureTable(), map[string]nftables.ChainPolicy{"input": nftables.ChainPolicyAccept})
+	if *chains["input"].Policy != nftables.ChainPolicyAccept {
+		t.Error("input policy not overridden")
+	}
+	if *chains["forward"].Policy != nftables.ChainPolicyDrop {
+		t.Error("forward policy should keep its default")
+	}
+}
+
+func TestSnapshotAndRestoreAbsentTable(t *testing.T) {
+	tablePresent := false
+	var sent []netlink.HeaderType
+	e := testEngine(t, func(req []netlink.Message) ([]netlink.Message, error) {
+		for _, m := range req {
+			sent = append(sent, m.Header.Type)
+			if m.Header.Type == nftType(unix.NFT_MSG_GETTABLE) && tablePresent {
+				data := []byte{inet, 0, 0, 0}
+				attrs, _ := netlink.MarshalAttributes([]netlink.Attribute{{Type: unix.NFTA_TABLE_NAME, Data: []byte("tomswall\x00")}})
+				return []netlink.Message{{Header: netlink.Header{Type: nftType(unix.NFT_MSG_NEWTABLE), Sequence: m.Header.Sequence}, Data: append(data, attrs...)}}, nil
+			}
+		}
+		return nil, nil
+	})
+
+	snap, err := e.Snapshot()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if snap.Present || snap.Table != "tomswall" {
+		t.Fatalf("want absent tomswall snapshot, got %+v", snap)
+	}
+
+	// The try created the table; restoring the absent snapshot deletes it.
+	tablePresent = true
+	sent = nil
+	if err := e.Restore(snap); err != nil {
+		t.Fatal(err)
+	}
+	deleted := false
+	for _, ht := range sent {
+		deleted = deleted || ht == nftType(unix.NFT_MSG_DELTABLE)
+	}
+	if !deleted {
+		t.Errorf("table not deleted; sent %v", sent)
+	}
+}
+
+func TestRestorePresentTable(t *testing.T) {
+	want := []SnapshotRule{}
+	for _, r := range []ManagedRule{
+		{Tag: "ssh", Exprs: []expr.Any{&expr.Ct{Register: 1, Key: expr.CtKeySTATE}, &expr.Verdict{Kind: expr.VerdictAccept}}},
+		{Tag: "drop", Exprs: []expr.Any{&expr.Verdict{Kind: expr.VerdictDrop}}},
+	} {
+		enc, err := encodeState(&FirewallState{Rules: map[string][]ManagedRule{"input": {r}}})
+		if err != nil {
+			t.Fatal(err)
+		}
+		want = append(want, enc["input"]...)
+	}
+	snap := &Snapshot{Table: "tomswall", Present: true,
+		Policies: map[string]nftables.ChainPolicy{"input": nftables.ChainPolicyAccept},
+		Rules:    map[string][]SnapshotRule{"input": want}}
+
+	// Live state: the tried ruleset left one managed rule (handle 7) in input.
+	attrs := func(a ...netlink.Attribute) []byte {
+		b, err := netlink.MarshalAttributes(a)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return append([]byte{inet, 0, 0, 0}, b...)
+	}
+	handle := make([]byte, 8)
+	binary.BigEndian.PutUint64(handle, 7)
+	var batch []netlink.Message
+	e := testEngine(t, func(req []netlink.Message) ([]netlink.Message, error) {
+		if len(req) == 0 {
+			return nil, nil
+		}
+		reply := func(msg int, data []byte) ([]netlink.Message, error) {
+			return []netlink.Message{{Header: netlink.Header{Type: nftType(msg), Sequence: req[0].Header.Sequence}, Data: data}}, nil
+		}
+		switch req[0].Header.Type {
+		case nftType(unix.NFT_MSG_GETTABLE):
+			return reply(unix.NFT_MSG_NEWTABLE, attrs(netlink.Attribute{Type: unix.NFTA_TABLE_NAME, Data: []byte("tomswall\x00")}))
+		case nftType(unix.NFT_MSG_GETCHAIN):
+			return reply(unix.NFT_MSG_NEWCHAIN, attrs(
+				netlink.Attribute{Type: unix.NFTA_CHAIN_TABLE, Data: []byte("tomswall\x00")},
+				netlink.Attribute{Type: unix.NFTA_CHAIN_NAME, Data: []byte("input\x00")}))
+		case nftType(unix.NFT_MSG_GETRULE):
+			return reply(unix.NFT_MSG_NEWRULE, attrs(
+				netlink.Attribute{Type: unix.NFTA_RULE_TABLE, Data: []byte("tomswall\x00")},
+				netlink.Attribute{Type: unix.NFTA_RULE_CHAIN, Data: []byte("input\x00")},
+				netlink.Attribute{Type: unix.NFTA_RULE_HANDLE, Data: handle},
+				netlink.Attribute{Type: unix.NFTA_RULE_USERDATA, Data: []byte("tried")}))
+		}
+		batch = append(batch, req...)
+		return nil, nil
+	})
+
+	if err := e.Restore(snap); err != nil {
+		t.Fatal(err)
+	}
+
+	var deleted []uint64
+	var added []SnapshotRule
+	policy := map[string]uint32{}
+	for _, m := range batch {
+		ad, err := netlink.NewAttributeDecoder(m.Data[4:])
+		if err != nil {
+			t.Fatal(err)
+		}
+		ad.ByteOrder = binary.BigEndian
+		var name string
+		var r SnapshotRule
+		var h uint64
+		var pol *uint32
+		for ad.Next() {
+			switch {
+			case m.Header.Type == nftType(unix.NFT_MSG_NEWCHAIN) && ad.Type() == unix.NFTA_CHAIN_NAME:
+				name = ad.String()
+			case m.Header.Type == nftType(unix.NFT_MSG_NEWCHAIN) && ad.Type() == unix.NFTA_CHAIN_POLICY:
+				v := ad.Uint32()
+				pol = &v
+			case m.Header.Type == nftType(unix.NFT_MSG_DELRULE) && ad.Type() == unix.NFTA_RULE_HANDLE:
+				h = ad.Uint64()
+			case m.Header.Type == nftType(unix.NFT_MSG_NEWRULE) && ad.Type() == unix.NFTA_RULE_USERDATA:
+				r.Tag = string(ad.Bytes())
+			case m.Header.Type == nftType(unix.NFT_MSG_NEWRULE) && ad.Type() == unix.NFTA_RULE_EXPRESSIONS:
+				ad.Nested(func(nad *netlink.AttributeDecoder) error {
+					for nad.Next() {
+						r.Exprs = append(r.Exprs, bytes.Clone(nad.Bytes()))
+					}
+					return nil
+				})
+			}
+		}
+		switch m.Header.Type {
+		case nftType(unix.NFT_MSG_NEWCHAIN):
+			if pol != nil {
+				policy[name] = *pol
+			}
+		case nftType(unix.NFT_MSG_DELRULE):
+			deleted = append(deleted, h)
+		case nftType(unix.NFT_MSG_NEWRULE):
+			added = append(added, r)
+		}
+	}
+
+	if !reflect.DeepEqual(deleted, []uint64{7}) {
+		t.Errorf("deleted handles %v, want [7]", deleted)
+	}
+	if !reflect.DeepEqual(added, want) {
+		t.Errorf("restored rules differ from snapshot:\n got %+v\nwant %+v", added, want)
+	}
+	if policy["input"] != uint32(nftables.ChainPolicyAccept) || policy["forward"] != uint32(nftables.ChainPolicyDrop) {
+		t.Errorf("chain policies %v: input must be restored to accept, forward keep drop", policy)
+	}
+}
+
+func TestRestoreRejectsOtherTable(t *testing.T) {
+	e := testEngine(t, nil)
+	if err := e.Restore(&Snapshot{Table: "other"}); err == nil {
+		t.Error("expected table mismatch error")
+	}
+}
+
+func nftType(msg int) netlink.HeaderType {
+	return netlink.HeaderType(unix.NFNL_SUBSYS_NFTABLES<<8 | msg)
+}
+
+func testEngine(t *testing.T, dial func([]netlink.Message) ([]netlink.Message, error)) *Engine {
+	if dial == nil {
+		dial = func([]netlink.Message) ([]netlink.Message, error) { return nil, nil }
+	}
+	conn, err := nftables.New(nftables.WithTestDial(dial))
+	if err != nil {
+		t.Fatal(err)
+	}
+	return &Engine{cfg: &config.Config{Settings: config.Settings{TableName: "tomswall"}}, conn: conn}
+}
+
+func TestEnsureChainsRawPriority(t *testing.T) {
+	e := testEngine(t, nil)
+	chains := e.ensureChains(e.ensureTable(), nil)
+	for name, hook := range map[string]*nftables.ChainHook{"raw_prerouting": nftables.ChainHookPrerouting, "raw_output": nftables.ChainHookOutput} {
+		c, ok := chains[name]
+		if !ok {
+			t.Fatalf("%s chain not declared", name)
+		}
+		if *c.Priority != *nftables.ChainPriorityRaw || *c.Hooknum != *hook || c.Type != nftables.ChainTypeFilter || *c.Policy != nftables.ChainPolicyAccept {
+			t.Errorf("%s: got type %s hook %d prio %d", name, c.Type, *c.Hooknum, *c.Priority)
+		}
+	}
+}

internal/tryapply/tryapply.go

@@ -0,0 +1,200 @@
+// Package tryapply keeps the state of a pending 'tomswall try' on disk so the
+// revert survives the try process, backed by a transient systemd timer.
+package tryapply
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"syscall"
+	"time"
+
+	"git.unkin.net/unkin/tomswall/internal/config"
+	"git.unkin.net/unkin/tomswall/internal/nftables"
+)
+
+// Unit is the transient systemd unit that reverts an unconfirmed try.
+const Unit = "tomswall-try-revert"
+
+var (
+	// Dir holds the lock and the pending snapshot.
+	Dir = "/var/lib/tomswall"
+	// run executes a systemd command; replaced in tests.
+	run = func(name string, args ...string) error {
+		if out, err := exec.Command(name, args...).CombinedOutput(); err != nil {
+			return fmt.Errorf("%s %s: %w: %s", name, strings.Join(args, " "), err, strings.TrimSpace(string(out)))
+		}
+		return nil
+	}
+	// restore rolls the live table back to a snapshot; replaced in tests.
+	restore = func(s *nftables.Snapshot) error {
+		engine, err := nftables.NewEngine(&config.Config{Settings: config.Settings{TableName: s.Table}})
+		if err != nil {
+			return err
+		}
+		return engine.Restore(s)
+	}
+)
+
+// ErrPending means a try awaits confirmation; nothing else may apply meanwhile.
+var ErrPending = errors.New("a 'tomswall try' is pending; run 'tomswall confirm' to keep it or 'tomswall revert' to restore the previous ruleset (also the recovery if an automatic revert failed)")
+
+type pending struct {
+	ID       string             `json:"id"`
+	PID      int                `json:"pid"`
+	Snapshot *nftables.Snapshot `json:"snapshot"`
+}
+
+func snapshotPath() string { return filepath.Join(Dir, "try-snapshot.json") }
+
+// Acquire takes the exclusive try lock, failing with ErrPending while a try is unconfirmed.
+func Acquire() (unlock func(), err error) {
+	unlock, err = lock()
+	if err != nil {
+		return nil, err
+	}
+	if _, err := os.Stat(snapshotPath()); err == nil {
+		unlock()
+		return nil, ErrPending
+	}
+	return unlock, nil
+}
+
+func lock() (func(), error) {
+	if err := os.MkdirAll(Dir, 0o755); err != nil {
+		return nil, err
+	}
+	f, err := os.OpenFile(filepath.Join(Dir, "try.lock"), os.O_CREATE|os.O_RDWR, 0o600)
+	if err != nil {
+		return nil, err
+	}
+	if err := syscall.Flock(int(f.Fd()), syscall.LOCK_EX); err != nil {
+		f.Close()
+		return nil, fmt.Errorf("locking %s: %w", f.Name(), err)
+	}
+	return func() { f.Close() }, nil
+}
+
+// Arm persists snap and schedules an out-of-process revert after delay,
+// returning the try ID that scopes later reverts to this try.
+// The caller must hold the lock from Acquire.
+func Arm(snap *nftables.Snapshot, pid int, delay time.Duration) (string, error) {
+	raw := make([]byte, 8)
+	if _, err := rand.Read(raw); err != nil {
+		return "", err
+	}
+	id := hex.EncodeToString(raw)
+	b, err := json.Marshal(pending{ID: id, PID: pid, Snapshot: snap})
+	if err != nil {
+		return "", err
+	}
+	f, err := os.CreateTemp(Dir, ".try-snapshot-*")
+	if err != nil {
+		return "", err
+	}
+	defer os.Remove(f.Name())
+	if _, err := f.Write(b); err != nil {
+		f.Close()
+		return "", err
+	}
+	if err := f.Sync(); err != nil {
+		f.Close()
+		return "", err
+	}
+	if err := f.Close(); err != nil {
+		return "", err
+	}
+	if err := os.Rename(f.Name(), snapshotPath()); err != nil {
+		return "", err
+	}
+
+	exe, err := os.Executable()
+	if err != nil {
+		return "", discardWith(err)
+	}
+	_ = disarm() // a leftover timer from an earlier try would block the unit name
+	if err := run("systemd-run", "--quiet", "--collect", "--unit", Unit,
+		fmt.Sprintf("--on-active=%ds", int(delay.Round(time.Second).Seconds())), exe, "revert", "--id", id); err != nil {
+		return "", discardWith(fmt.Errorf("arming revert timer: %w", err))
+	}
+	return id, nil
+}
+
+// Discard drops the pending snapshot and timer without restoring. The caller must hold the lock.
+func Discard() error {
+	_ = disarm()
+	if err := os.Remove(snapshotPath()); err != nil && !os.IsNotExist(err) {
+		return err
+	}
+	return nil
+}
+
+func discardWith(err error) error {
+	if derr := Discard(); derr != nil {
+		return fmt.Errorf("%w (discarding snapshot: %v)", err, derr)
+	}
+	return err
+}
+
+func disarm() error {
+	return run("systemctl", "stop", Unit+".timer")
+}
+
+// Confirm keeps the tried ruleset. ok is false when no try was pending, i.e.
+// it was already reverted; pid is the waiting try process, if any.
+func Confirm() (pid int, ok bool, err error) {
+	unlock, err := lock()
+	if err != nil {
+		return 0, false, err
+	}
+	defer unlock()
+	p, err := load()
+	if err != nil || p == nil {
+		return 0, false, err
+	}
+	return p.PID, true, Discard()
+}
+
+// Revert restores the pending snapshot. A non-empty id only reverts that try,
+// so a stale timer cannot undo a newer one. reverted is false when nothing
+// matching was pending (already confirmed or reverted). A failed restore keeps
+// the snapshot so 'tomswall revert' can retry.
+func Revert(id string) (reverted bool, err error) {
+	unlock, err := lock()
+	if err != nil {
+		return false, err
+	}
+	defer unlock()
+	p, err := load()
+	if err != nil || p == nil || (id != "" && p.ID != id) {
+		return false, err
+	}
+	if err := restore(p.Snapshot); err != nil {
+		return false, fmt.Errorf("restoring snapshot: %w", err)
+	}
+	return true, Discard()
+}
+
+func load() (*pending, error) {
+	b, err := os.ReadFile(snapshotPath())
+	if os.IsNotExist(err) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	var p pending
+	if err := json.Unmarshal(b, &p); err != nil {
+		return nil, fmt.Errorf("parsing %s: %w", snapshotPath(), err)
+	}
+	if p.Snapshot == nil {
+		return nil, fmt.Errorf("%s has no snapshot", snapshotPath())
+	}
+	return &p, nil
+}

internal/tryapply/tryapply_test.go

@@ -0,0 +1,211 @@
+package tryapply
+
+import (
+	"errors"
+	"os"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	"git.unkin.net/unkin/tomswall/internal/nftables"
+)
+
+func setup(t *testing.T) *[]string {
+	t.Helper()
+	Dir = t.TempDir()
+	var cmds []string
+	orig := run
+	run = func(name string, args ...string) error {
+		cmds = append(cmds, name+" "+strings.Join(args, " "))
+		return nil
+	}
+	t.Cleanup(func() { run = orig })
+	return &cmds
+}
+
+func arm(t *testing.T, snap *nftables.Snapshot) string {
+	t.Helper()
+	unlock, err := Acquire()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer unlock()
+	id, err := Arm(snap, 4242, 90*time.Second)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return id
+}
+
+func TestArmPersistsSnapshotAndTimer(t *testing.T) {
+	cmds := setup(t)
+	snap := &nftables.Snapshot{Table: "tomswall", Present: true,
+		Rules: map[string][]nftables.SnapshotRule{"input": {{Tag: "ssh", Exprs: [][]byte{{1, 2, 3}}}}}}
+	id := arm(t, snap)
+
+	info, err := os.Stat(snapshotPath())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if info.Mode().Perm() != 0o600 {
+		t.Errorf("snapshot mode %v, want 0600", info.Mode().Perm())
+	}
+	p, err := load()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if p.ID != id || id == "" || p.PID != 4242 || !reflect.DeepEqual(p.Snapshot, snap) {
+		t.Errorf("round trip mismatch: %+v", p)
+	}
+	last := (*cmds)[len(*cmds)-1]
+	if !strings.HasPrefix(last, "systemd-run ") || !strings.Contains(last, "--unit "+Unit) ||
+		!strings.Contains(last, "--on-active=90s") || !strings.HasSuffix(last, " revert --id "+id) {
+		t.Errorf("unexpected arm command %q", last)
+	}
+}
+
+func TestAbsentTableSnapshotRoundTrip(t *testing.T) {
+	setup(t)
+	arm(t, &nftables.Snapshot{Table: "tomswall"})
+	p, err := load()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if p.Snapshot.Present || p.Snapshot.Table != "tomswall" {
+		t.Errorf("absent table not preserved: %+v", p.Snapshot)
+	}
+}
+
+func TestAcquireRefusesWhilePending(t *testing.T) {
+	setup(t)
+	arm(t, &nftables.Snapshot{Table: "tomswall"})
+	_, err := Acquire()
+	if !errors.Is(err, ErrPending) {
+		t.Fatalf("second try: got %v, want ErrPending", err)
+	}
+	if !strings.Contains(err.Error(), "tomswall revert") {
+		t.Errorf("ErrPending does not name the recovery: %v", err)
+	}
+}
+
+func TestArmFailureDiscardsSnapshot(t *testing.T) {
+	setup(t)
+	run = func(name string, args ...string) error {
+		if name == "systemd-run" {
+			return errors.New("no systemd")
+		}
+		return nil
+	}
+	unlock, err := Acquire()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer unlock()
+	if _, err := Arm(&nftables.Snapshot{Table: "tomswall"}, 1, time.Minute); err == nil {
+		t.Fatal("expected arm error")
+	}
+	if _, err := os.Stat(snapshotPath()); !os.IsNotExist(err) {
+		t.Error("snapshot left behind without a revert timer")
+	}
+}
+
+func TestConfirmPendingDisarms(t *testing.T) {
+	cmds := setup(t)
+	arm(t, &nftables.Snapshot{Table: "tomswall"})
+	pid, ok, err := Confirm()
+	if err != nil || !ok || pid != 4242 {
+		t.Fatalf("Confirm = %d, %v, %v", pid, ok, err)
+	}
+	if _, err := os.Stat(snapshotPath()); !os.IsNotExist(err) {
+		t.Error("snapshot not removed")
+	}
+	if last := (*cmds)[len(*cmds)-1]; last != "systemctl stop "+Unit+".timer" {
+		t.Errorf("timer not stopped, last command %q", last)
+	}
+	unlock, err := Acquire()
+	if err != nil {
+		t.Fatalf("new try refused after confirm: %v", err)
+	}
+	unlock()
+}
+
+func TestConfirmAfterRevertFails(t *testing.T) {
+	setup(t)
+	_, ok, err := Confirm()
+	if err != nil || ok {
+		t.Fatalf("Confirm with nothing pending = %v, %v; want not ok", ok, err)
+	}
+	reverted, err := Revert("")
+	if err != nil || reverted {
+		t.Fatalf("Revert with nothing pending = %v, %v", reverted, err)
+	}
+}
+
+func stubRestore(t *testing.T, err error) *[]*nftables.Snapshot {
+	t.Helper()
+	var got []*nftables.Snapshot
+	orig := restore
+	restore = func(s *nftables.Snapshot) error {
+		got = append(got, s)
+		return err
+	}
+	t.Cleanup(func() { restore = orig })
+	return &got
+}
+
+func TestRevertPendingRestoresAndDisarms(t *testing.T) {
+	cmds := setup(t)
+	restored := stubRestore(t, nil)
+	snap := &nftables.Snapshot{Table: "tomswall", Present: true,
+		Rules: map[string][]nftables.SnapshotRule{"input": {{Tag: "ssh", Exprs: [][]byte{{1}}}}}}
+	id := arm(t, snap)
+
+	reverted, err := Revert(id)
+	if err != nil || !reverted {
+		t.Fatalf("Revert = %v, %v", reverted, err)
+	}
+	if len(*restored) != 1 || !reflect.DeepEqual((*restored)[0], snap) {
+		t.Errorf("restored %+v, want the armed snapshot", *restored)
+	}
+	if _, err := os.Stat(snapshotPath()); !os.IsNotExist(err) {
+		t.Error("snapshot not removed")
+	}
+	if last := (*cmds)[len(*cmds)-1]; last != "systemctl stop "+Unit+".timer" {
+		t.Errorf("timer not stopped, last command %q", last)
+	}
+}
+
+func TestRevertFailureKeepsSnapshot(t *testing.T) {
+	setup(t)
+	boom := errors.New("netlink down")
+	stubRestore(t, boom)
+	id := arm(t, &nftables.Snapshot{Table: "tomswall"})
+
+	if _, err := Revert(id); !errors.Is(err, boom) {
+		t.Fatalf("Revert error = %v, want %v", err, boom)
+	}
+	if _, err := os.Stat(snapshotPath()); err != nil {
+		t.Fatalf("snapshot gone after failed revert: %v", err)
+	}
+	if _, err := Acquire(); !errors.Is(err, ErrPending) {
+		t.Errorf("failed revert must keep the try pending, got %v", err)
+	}
+}
+
+func TestRevertStaleIDIgnored(t *testing.T) {
+	setup(t)
+	restored := stubRestore(t, nil)
+	arm(t, &nftables.Snapshot{Table: "tomswall"})
+
+	reverted, err := Revert("stale-try")
+	if err != nil || reverted {
+		t.Fatalf("stale Revert = %v, %v; want no-op", reverted, err)
+	}
+	if len(*restored) != 0 {
+		t.Error("stale timer restored a newer try's snapshot")
+	}
+	if _, err := os.Stat(snapshotPath()); err != nil {
+		t.Errorf("newer try's snapshot removed: %v", err)
+	}
+}

packaging/nfpm.yaml

@@ -0,0 +1,58 @@
+---
+# nfpm config for building the tomswall RPM.
+# Rendered through envsubst (see scripts/build-rpm.sh) then fed to `nfpm pkg`.
+
+name: ${PACKAGE_NAME}
+version: ${PACKAGE_VERSION}
+release: ${PACKAGE_RELEASE}
+arch: ${PACKAGE_ARCH}
+platform: ${PACKAGE_PLATFORM}
+section: default
+priority: extra
+description: "${PACKAGE_DESCRIPTION}"
+
+maintainer: ${PACKAGE_MAINTAINER}
+homepage: ${PACKAGE_HOMEPAGE}
+license: ${PACKAGE_LICENSE}
+
+disable_globbing: false
+
+replaces:
+  - tomswall
+provides:
+  - tomswall
+
+contents:
+  - src: dist/tomswall
+    dst: /usr/sbin/tomswall
+    file_info:
+      mode: 0755
+      owner: root
+      group: root
+
+  # Example configuration (never overwrites an existing tomswall.yaml).
+  - src: tomswall.example.yaml
+    dst: /etc/tomswall/tomswall.example.yaml
+    file_info:
+      mode: 0644
+
+  # systemd unit + environment file for the control-plane agent.
+  - src: packaging/tomswall-agent.service
+    dst: /usr/lib/systemd/system/tomswall-agent.service
+    file_info:
+      mode: 0644
+  - src: packaging/tomswall-agent.env
+    dst: /etc/tomswall/agent.env
+    type: config|noreplace
+    file_info:
+      mode: 0640
+
+  # Shell completions (generated by scripts/build-rpm.sh before packaging).
+  - src: dist/completions/tomswall.bash
+    dst: /usr/share/bash-completion/completions/tomswall
+    file_info:
+      mode: 0644
+  - src: dist/completions/_tomswall
+    dst: /usr/share/zsh/site-functions/_tomswall
+    file_info:
+      mode: 0644

packaging/tomswall-agent.env

@@ -0,0 +1,12 @@
+# Environment for the tomswall control-plane agent (tomswall-agent.service).
+# The agent reads these; flags may also be passed via ExecStart.
+
+# Base URL of the tomswallapi control plane.
+TOMSWALL_API_URL=https://tomswallapi.k8s.syd1.au.unkin.net
+
+# Agent bearer token (issued by the control plane / Vault). Keep this file 0640.
+TOMSWALL_AGENT_TOKEN=
+
+# The device name defaults to the system hostname. To override it, add
+# `--device <name>` to ExecStart in the unit (drop-in), e.g.:
+#   ExecStart=/usr/sbin/tomswall agent --device fw-a

packaging/tomswall-agent.service

@@ -0,0 +1,18 @@
+[Unit]
+Description=tomswall control-plane agent (pull and apply firewall config)
+Documentation=https://git.unkin.net/unkin/tomswall
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+EnvironmentFile=/etc/tomswall/agent.env
+ExecStart=/usr/sbin/tomswall agent
+Restart=on-failure
+RestartSec=10
+# The agent programs nftables and needs the requisite capabilities.
+AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW
+CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW
+
+[Install]
+WantedBy=multi-user.target

scripts/build-rpm.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+#
+# Package the (already built) tomswall binary into an RPM with nfpm, bundling
+# generated bash/zsh shell completions and the systemd agent unit.
+# Usage: scripts/build-rpm.sh [version]   (version defaults to $CI_COMMIT_TAG)
+#
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "${ROOT_DIR}"
+
+VERSION="${1:-${CI_COMMIT_TAG:-0.0.0-dev}}"
+VERSION="${VERSION#v}" # strip a leading v
+BINARY="tomswall"
+DIST="dist"
+
+if [ ! -f "${DIST}/${BINARY}" ]; then
+  echo "ERROR: ${DIST}/${BINARY} not found; run 'make dist-build' first" >&2
+  exit 1
+fi
+
+# Generate shell completions from the freshly built binary so they always match
+# the shipped flags/subcommands.
+COMP_DIR="${DIST}/completions"
+mkdir -p "${COMP_DIR}"
+"./${DIST}/${BINARY}" completion bash >"${COMP_DIR}/${BINARY}.bash"
+"./${DIST}/${BINARY}" completion zsh >"${COMP_DIR}/_${BINARY}"
+
+export PACKAGE_NAME="${BINARY}"
+export PACKAGE_VERSION="${VERSION}"
+export PACKAGE_RELEASE="1"
+export PACKAGE_ARCH="amd64"
+export PACKAGE_PLATFORM="linux"
+export PACKAGE_DESCRIPTION="Spiritual successor to shorewall — nftables firewall manager, with a control-plane agent that pulls compiled config from tomswallapi"
+export PACKAGE_MAINTAINER="Ben Vincent <ben@unkin.net>"
+export PACKAGE_HOMEPAGE="https://git.unkin.net/unkin/tomswall"
+export PACKAGE_LICENSE="MIT"
+
+envsubst <packaging/nfpm.yaml >"${DIST}/nfpm.yaml"
+nfpm pkg --config "${DIST}/nfpm.yaml" --target "${DIST}" --packager rpm
+
+echo "Built:"
+ls -1 "${DIST}"/*.rpm

tomswall.example.yaml

@@ -191,13 +191,12 @@ snat:
 # conntrack:
 #   - action: notrack
 #     source: net
-#     dest: fw
+#     dest: fw:203.0.113.1
 #     proto: udp
 #     dport: [53]
 #     comment: "Skip conntrack for DNS"
 #   - action: helper
 #     source: loc
-#     dest: net
 #     proto: tcp
 #     dport: [21]
 #     helper: ftp