Attach conntrack helpers via ct helper objects

internal/config/blrules.go

@@ -55,11 +55,28 @@ func (c *Config) validateBlrules() error {
 			return fmt.Errorf("blrules[%d]: dest required", i)
 		}
 
-		if err := c.validateZoneRef(r.Source); err != nil {
-			return fmt.Errorf("blrules[%d]: source %w", i, err)
+		if r.Source != "all" && r.Source != "any" && r.Source != "none" &&
+			!hasPrefix(r.Source, "all!") && !hasPrefix(r.Source, "any!") {
+			for _, zs := range SplitZoneList(r.Source) {
+				if _, ok := c.Zones[zs.Zone]; !ok {
+					return fmt.Errorf("blrules[%d]: source zone %q not defined", i, zs.Zone)
+				}
+				if !validAddrList(zs.Addr) {
+					return fmt.Errorf("blrules[%d]: source %q: '!' may only prefix the whole address list", i, zs.Addr)
+				}
+			}
 		}
-		if err := c.validateZoneRef(r.Dest); err != nil {
-			return fmt.Errorf("blrules[%d]: dest %w", i, err)
+
+		if r.Dest != "all" && r.Dest != "any" && r.Dest != "none" &&
+			!hasPrefix(r.Dest, "all!") && !hasPrefix(r.Dest, "any!") {
+			for _, zs := range SplitZoneList(r.Dest) {
+				if _, ok := c.Zones[zs.Zone]; !ok {
+					return fmt.Errorf("blrules[%d]: dest zone %q not defined", i, zs.Zone)
+				}
+				if !validAddrList(zs.Addr) {
+					return fmt.Errorf("blrules[%d]: dest %q: '!' may only prefix the whole address list", i, zs.Addr)
+				}
+			}
 		}
 	}
 	return nil

internal/config/conntrack.go

@@ -1,9 +1,6 @@
 package config
 
-import (
-	"fmt"
-	"strings"
-)
+import "fmt"
 
 type ConntrackAction string
 
@@ -71,14 +68,8 @@ func (c *Config) validateConntrack() error {
 			return fmt.Errorf("conntrack[%d]: helper name required for helper action", i)
 		}
 
-		if HasZoneExclusion(ct.Source) || HasZoneExclusion(ct.Dest) {
-			return fmt.Errorf("conntrack[%d]: zone exclusions are not supported in conntrack entries", i)
-		}
-		if err := c.validateZoneRef(ct.Source); err != nil {
-			return fmt.Errorf("conntrack[%d]: source %w", i, err)
-		}
-		if err := c.validateZoneRef(ct.Dest); err != nil {
-			return fmt.Errorf("conntrack[%d]: dest %w", i, err)
+		if ct.Source == "" && ct.Dest == "" && ct.Action != ConntrackHelper {
+			return fmt.Errorf("conntrack[%d]: source or dest required", i)
 		}
 
 		if ct.User != "" {
@@ -93,9 +84,3 @@ func (c *Config) validateConntrack() error {
 	}
 	return nil
 }
-
-// HasZoneExclusion reports an all/any zone ref with a "+" or "!" modifier (all+, all!x, any+!x, ...).
-func HasZoneExclusion(spec string) bool {
-	zones, _, _ := strings.Cut(spec, ":")
-	return (strings.HasPrefix(zones, "all") || strings.HasPrefix(zones, "any")) && strings.ContainsAny(zones[3:], "+!")
-}

internal/config/extras_test.go

@@ -53,52 +53,11 @@ func TestValidateConntrack(t *testing.T) {
 			},
 		},
 		{
-			name:  "omitted source and dest is valid",
-			rules: []ConntrackRule{{Action: ConntrackNoTrack, Proto: "udp", DPort: PortSpec{"53"}}},
-		},
-		{
-			name:    "unknown source zone",
-			rules:   []ConntrackRule{{Action: ConntrackNoTrack, Source: "nte"}},
-			wantErr: `source zone "nte" not defined`,
-		},
-		{
-			name:    "unknown dest zone",
-			rules:   []ConntrackRule{{Action: ConntrackDrop, Source: "net", Dest: "nte:192.0.2.1"}},
-			wantErr: `dest zone "nte" not defined`,
-		},
-		{
-			name:  "all and plain zone forms are valid",
-			rules: []ConntrackRule{{Action: ConntrackNoTrack, Source: "net,fw", Dest: "all:192.0.2.1"}},
-		},
-		{
-			name:    "Source all!net rejected",
-			rules:   []ConntrackRule{{Action: ConntrackNoTrack, Source: "all!net"}},
-			wantErr: "zone exclusions are not supported in conntrack entries",
-		},
-		{
-			name:    "Dest all!net:192.0.2.1 rejected",
-			rules:   []ConntrackRule{{Action: ConntrackNoTrack, Dest: "all!net:192.0.2.1"}},
-			wantErr: "zone exclusions are not supported in conntrack entries",
-		},
-		{
-			name:    "Source all+ rejected",
-			rules:   []ConntrackRule{{Action: ConntrackNoTrack, Source: "all+"}},
-			wantErr: "zone exclusions are not supported in conntrack entries",
-		},
-		{
-			name:    "Dest all+!net rejected",
-			rules:   []ConntrackRule{{Action: ConntrackNoTrack, Dest: "all+!net"}},
-			wantErr: "zone exclusions are not supported in conntrack entries",
-		},
-		{
-			name:    "Source any!net rejected",
-			rules:   []ConntrackRule{{Action: ConntrackNoTrack, Source: "any!net"}},
-			wantErr: "zone exclusions are not supported in conntrack entries",
-		},
-		{
-			name:    "Dest any+ rejected",
-			rules:   []ConntrackRule{{Action: ConntrackNoTrack, Dest: "any+"}},
-			wantErr: "zone exclusions are not supported in conntrack entries",
+			name: "source or dest required for non-helper",
+			rules: []ConntrackRule{
+				{Action: ConntrackDrop},
+			},
+			wantErr: "source or dest required",
 		},
 		{
 			name: "helper without source/dest is valid",

internal/config/rules.go

@@ -173,13 +173,29 @@ func (c *Config) validateRules() error {
 			return fmt.Errorf("rule[%d]: dest required", i)
 		}
 
-		if err := c.validateZoneRef(r.Source); err != nil {
-			return fmt.Errorf("rule[%d]: source %w", i, err)
+		if r.Source != "all" && r.Source != "any" && r.Source != "none" &&
+			!hasPrefix(r.Source, "all+") && !hasPrefix(r.Source, "all!") && !hasPrefix(r.Source, "any!") {
+			for _, zs := range SplitZoneList(r.Source) {
+				if _, ok := c.Zones[zs.Zone]; !ok {
+					return fmt.Errorf("rule[%d]: source zone %q not defined", i, zs.Zone)
+				}
+				if !validAddrList(zs.Addr) {
+					return fmt.Errorf("rule[%d]: source %q: '!' may only prefix the whole address list", i, zs.Addr)
+				}
+			}
 		}
 
 		if r.Action != RuleDNAT && r.Action != RuleRedirect && r.Action != RuleNoNAT {
-			if err := c.validateZoneRef(r.Dest); err != nil {
-				return fmt.Errorf("rule[%d]: dest %w", i, err)
+			if r.Dest != "all" && r.Dest != "any" && r.Dest != "none" &&
+				!hasPrefix(r.Dest, "all+") && !hasPrefix(r.Dest, "all!") && !hasPrefix(r.Dest, "any!") {
+				for _, zs := range SplitZoneList(r.Dest) {
+					if _, ok := c.Zones[zs.Zone]; !ok {
+						return fmt.Errorf("rule[%d]: dest zone %q not defined", i, zs.Zone)
+					}
+					if !validAddrList(zs.Addr) {
+						return fmt.Errorf("rule[%d]: dest %q: '!' may only prefix the whole address list", i, zs.Addr)
+					}
+				}
 			}
 		}
 
@@ -248,32 +264,6 @@ func zoneFromSpec(spec string) string {
 	return spec
 }
 
-// validateZoneRef checks a SOURCE/DEST spec: all/any[+][!excluded,...][:addr], none, or a declared zone list.
-func (c *Config) validateZoneRef(spec string) error {
-	zones, addr, _ := strings.Cut(spec, ":")
-	base, excl, isExcl := strings.Cut(zones, "!")
-	switch base {
-	case "", "none", "all", "all+", "any", "any+":
-		if base == "" && isExcl {
-			return fmt.Errorf("%q: exclusion needs all or any", spec)
-		}
-		for _, z := range strings.Split(excl, ",") {
-			if _, ok := c.Zones[strings.TrimSpace(z)]; isExcl && !ok {
-				return fmt.Errorf("excluded zone %q not defined", z)
-			}
-		}
-		if !validAddrList(addr) {
-			return fmt.Errorf("%q: '!' may only prefix the whole address list", addr)
-		}
-		return nil
-	}
-	for _, zs := range SplitZoneList(spec) {
-		if _, ok := c.Zones[zs.Zone]; !ok {
-			return fmt.Errorf("zone %q not defined", zs.Zone)
-		}
-		if !validAddrList(zs.Addr) {
-			return fmt.Errorf("%q: '!' may only prefix the whole address list", zs.Addr)
-		}
-	}
-	return nil
+func hasPrefix(s, prefix string) bool {
+	return len(s) >= len(prefix) && s[:len(prefix)] == prefix
 }

internal/nftables/compiler.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"log/slog"
 	"net"
+	"slices"
 	"sort"
 	"strconv"
 	"strings"
@@ -212,83 +213,99 @@ func (c *Compiler) compileBlrules(state *FirewallState) error {
 	return nil
 }
 
-func (c *Compiler) compileConntrack(state *FirewallState) error {
-	fwZone := c.cfg.FirewallZone()
-	for i, ct := range c.cfg.Conntrack {
-		tag := fmt.Sprintf("conntrack:%d", i)
-		if config.HasZoneExclusion(ct.Source) || config.HasZoneExclusion(ct.Dest) {
-			return fmt.Errorf("conntrack[%d]: zone exclusions are not supported in conntrack entries", i)
+// helperProtos is each kernel helper's default transport, used when an entry gives no proto.
+var helperProtos = map[string]string{
+	"amanda": "udp", "ftp": "tcp", "irc": "tcp", "netbios-ns": "udp", "pptp": "tcp",
+	"Q.931": "tcp", "RAS": "udp", "sane": "tcp", "sip": "udp", "snmp": "udp", "tftp": "udp",
+}
+
+// compileHelper declares a ct helper object per (helper, proto) and assigns it
+// after conntrack (-200) has created the entry; a raw-priority assignment is a no-op.
+func (c *Compiler) compileHelper(state *FirewallState, tag string, ct config.ConntrackRule) error {
+	if ct.Source != "" || ct.Dest != "" {
+		slog.Warn("conntrack helper source/dest not supported, assigning globally", "rule", tag, "helper", ct.Helper)
+	}
+	chains := []string{"helper_prerouting", "helper_output"}
+	switch ct.Chain {
+	case config.ConntrackPrerouting:
+		chains = chains[:1]
+	case config.ConntrackOutput:
+		chains = chains[1:]
+	}
+
+	proto := ct.Proto
+	if proto == "" {
+		if proto = helperProtos[ct.Helper]; proto == "" {
+			return fmt.Errorf("proto required for helper %q", ct.Helper)
 		}
-		srcs, dsts := c.zoneSpecs(ct.Source), c.zoneSpecs(ct.Dest)
-		if len(srcs) == 0 {
-			srcs = []config.ZoneSpec{{}}
+	}
+	for _, p := range strings.Split(proto, ",") {
+		p = strings.TrimSpace(p)
+		n, err := protoNumber(p)
+		if err != nil {
+			return err
 		}
-		if len(dsts) == 0 {
-			dsts = []config.ZoneSpec{{}}
+		name := ct.Helper
+		if p != helperProtos[ct.Helper] {
+			name += "-" + p
+		}
+		if !slices.ContainsFunc(state.Helpers, func(h Helper) bool { return h.Name == name }) {
+			state.Helpers = append(state.Helpers, Helper{Name: name,
+				Helper: expr.CtHelper{Name: ct.Helper, L3Proto: unix.NFPROTO_INET, L4Proto: n}})
 		}
 
-		for _, src := range srcs {
-			if src.Zone == "all" || src.Zone == "any" {
-				src.Zone = ""
-			}
-			chains := []string{"raw_prerouting"}
-			switch {
-			case ct.Chain == config.ConntrackOutput && src.Zone != fwZone && src.Zone != "":
-				return fmt.Errorf("conntrack[%d]: chain output needs SOURCE %s, got %q", i, fwZone, src.Zone)
-			case ct.Chain == config.ConntrackPrerouting && src.Zone == fwZone:
-				return fmt.Errorf("conntrack[%d]: SOURCE %s cannot use chain prerouting", i, fwZone)
-			case ct.Chain != config.ConntrackPrerouting && src.Zone == fwZone, ct.Chain == config.ConntrackOutput:
-				chains = []string{"raw_output"}
-			case ct.Chain == config.ConntrackBoth && src.Zone == "":
-				chains = []string{"raw_prerouting", "raw_output"}
-			}
-			for _, srcAddr := range splitAddrs(src.Addr) {
-				for _, dst := range dsts {
-					for _, dstAddr := range splitAddrs(dst.Addr) {
-						for _, chain := range chains {
-							if err := c.compileConntrackPair(state, tag, chain, ct, src.Zone, srcAddr, dst.Zone, dstAddr); err != nil {
-								return fmt.Errorf("conntrack[%d]: %w", i, err)
-							}
-						}
-					}
-				}
+		matches, err := l4Matches(p, ct.DPort, ct.SPort)
+		if err != nil {
+			return err
+		}
+		for _, chain := range chains {
+			for _, m := range matches {
+				state.Rules[chain] = append(state.Rules[chain], ManagedRule{
+					Chain: chain,
+					Exprs: append(append([]expr.Any{}, m.exprs...),
+						&expr.Objref{Type: unix.NFT_OBJECT_CT_HELPER, Name: name}),
+					Tag: tag + ":" + chain,
+				})
 			}
 		}
 	}
 	return nil
 }
 
-// compileConntrackPair matches iif of the source zone in raw_prerouting and oif of the dest zone in raw_output.
-func (c *Compiler) compileConntrackPair(state *FirewallState, tag, chain string, ct config.ConntrackRule,
-	srcZone, srcAddr, dstZone, dstAddr string) error {
-	if ct.Action == config.ConntrackHelper {
-		return nil
-	}
-	if _, ok := c.cfg.Zones[dstZone]; ok && chain == "raw_prerouting" &&
-		(dstAddr == "" || strings.HasPrefix(dstAddr, "!")) {
-		return fmt.Errorf("conntrack DEST zone %q needs an address in prerouting", dstZone)
-	}
-	srcIfaces, dstIfaces := c.resolveZoneInterfaces(srcZone, srcAddr), []string{""}
-	if chain == "raw_prerouting" && c.resolveZoneInterfaces(dstZone, dstAddr) == nil {
-		return nil
-	}
-	if chain == "raw_output" {
-		srcIfaces, dstIfaces = []string{""}, c.resolveZoneInterfaces(dstZone, dstAddr)
-	}
-	for _, srcIface := range srcIfaces {
-		for _, dstIface := range dstIfaces {
-			matches, err := c.buildMatchExprs(srcIface, dstIface, chain, ct.Proto, ct.DPort, ct.SPort, srcAddr, dstAddr)
-			if err != nil {
-				return err
+func (c *Compiler) compileConntrack(state *FirewallState) error {
+	for i, ct := range c.cfg.Conntrack {
+		tag := fmt.Sprintf("conntrack:%d", i)
+		if ct.Action == config.ConntrackHelper {
+			if err := c.compileHelper(state, tag, ct); err != nil {
+				return fmt.Errorf("conntrack[%d]: %w", i, err)
 			}
+			continue
+		}
+
+		chains := []string{"prerouting"}
+		switch ct.Chain {
+		case config.ConntrackOutput:
+			chains = []string{"output"}
+		case config.ConntrackBoth:
+			chains = []string{"prerouting", "output"}
+		}
+
+		matches, err := l4Matches(ct.Proto, ct.DPort, nil)
+		if err != nil {
+			return fmt.Errorf("conntrack[%d]: %w", i, err)
+		}
+
+		for _, chain := range chains {
 			for _, m := range matches {
-				exprs := m.exprs
+				exprs := append([]expr.Any{}, m.exprs...)
+
 				switch ct.Action {
 				case config.ConntrackNoTrack:
 					exprs = append(exprs, &expr.Notrack{})
 				case config.ConntrackDrop:
 					exprs = append(exprs, &expr.Verdict{Kind: expr.VerdictDrop})
 				}
+
 				state.Rules[chain] = append(state.Rules[chain], ManagedRule{
 					Chain: chain,
 					Exprs: exprs,
@@ -323,7 +340,7 @@ func (c *Compiler) compileRules(state *FirewallState) error {
 			if err != nil {
 				return fmt.Errorf("rule[%d]: %w", i, err)
 			}
-			if len(matches)*c.specCount(rule.Source, rule.Dest, rule.OrigDest, rule.Action) > 1 {
+			if len(matches)*specCount(rule.Source, rule.Dest, rule.OrigDest, rule.Action) > 1 {
 				return fmt.Errorf("rule[%d]: ratelimit/connlimit cannot be combined with proto, port, zone or address lists (each expanded rule would get its own limiter)", i)
 			}
 		}
@@ -409,7 +426,7 @@ func (c *Compiler) compileOneRule(state *FirewallState, tag, srcSpec, dstSpec, p
 	dports, sports config.PortSpec, action config.RuleAction, logLevel string,
 	dnatDest, origDest string, fwZone string, section config.RuleSection) error {
 
-	for _, src := range c.zoneSpecs(srcSpec) {
+	for _, src := range zoneSpecs(srcSpec) {
 		for _, srcAddr := range splitAddrs(src.Addr) {
 			for _, od := range splitAddrs(origDest) {
 				if action == config.RuleDNAT || action == config.RuleRedirect {
@@ -418,12 +435,7 @@ func (c *Compiler) compileOneRule(state *FirewallState, tag, srcSpec, dstSpec, p
 					}
 					continue
 				}
-				for _, dst := range c.zoneSpecs(dstSpec) {
-					// Exclusion expansion never pairs fw with itself, and pairs a zone with itself only for "all+".
-					if src.Zone == dst.Zone && (isZoneExclusion(srcSpec) || isZoneExclusion(dstSpec)) &&
-						(src.Zone == fwZone || !strings.Contains(srcSpec, "+!") && !strings.Contains(dstSpec, "+!")) {
-						continue
-					}
+				for _, dst := range zoneSpecs(dstSpec) {
 					for _, dstAddr := range splitAddrs(dst.Addr) {
 						if err := c.compileZonePair(state, tag, src.Zone, srcAddr, dst.Zone, dstAddr, od, proto,
 							dports, sports, action, logLevel, fwZone, section); err != nil {
@@ -438,9 +450,9 @@ func (c *Compiler) compileOneRule(state *FirewallState, tag, srcSpec, dstSpec, p
 }
 
 // specCount is how many zone/address combinations compileOneRule expands src and dst into.
-func (c *Compiler) specCount(srcSpec, dstSpec, origDest string, action config.RuleAction) int {
+func specCount(srcSpec, dstSpec, origDest string, action config.RuleAction) int {
 	count := func(spec string) (n int) {
-		for _, z := range c.zoneSpecs(spec) {
+		for _, z := range zoneSpecs(spec) {
 			n += len(splitAddrs(z.Addr))
 		}
 		return n
@@ -452,26 +464,13 @@ func (c *Compiler) specCount(srcSpec, dstSpec, origDest string, action config.Ru
 	return n * count(dstSpec)
 }
 
-// zoneSpecs expands a comma zone list; "all"/"any" stay global and "all!x,y" becomes every zone but x and y.
-func (c *Compiler) zoneSpecs(spec string) []config.ZoneSpec {
+// zoneSpecs expands a comma zone list; "all"/"any" forms keep their own comma (exclusion) syntax.
+func zoneSpecs(spec string) []config.ZoneSpec {
 	zone, addr := splitZoneSpec(spec)
-	if !isZoneExclusion(zone) {
-		if base := strings.TrimSuffix(zone, "+"); base == "all" || base == "any" {
-			return []config.ZoneSpec{{Zone: zone, Addr: addr}}
-		}
-		return config.SplitZoneList(spec)
+	if base, _, _ := strings.Cut(strings.TrimSuffix(zone, "+"), "!"); base == "all" || base == "any" {
+		return []config.ZoneSpec{{Zone: zone, Addr: addr}}
 	}
-	var out []config.ZoneSpec
-	for _, z := range c.expandZoneRef(zone) {
-		out = append(out, config.ZoneSpec{Zone: z, Addr: addr})
-	}
-	return out
-}
-
-func isZoneExclusion(spec string) bool {
-	base, _, ok := strings.Cut(spec, "!")
-	base = strings.TrimSuffix(base, "+")
-	return ok && (base == "all" || base == "any")
+	return config.SplitZoneList(spec)
 }
 
 // splitAddrs yields one alternative per listed address; a negated list stays one AND-ed match.
@@ -1024,18 +1023,9 @@ func (c *Compiler) selectChain(srcZone, dstZone, fwZone string) string {
 	return "forward"
 }
 
-// resolveZoneInterfaces returns nil (fail closed) for an unknown zone, or one with no interfaces unless a non-negated address match narrows the rule.
+// resolveZoneInterfaces returns nil (fail closed) for a zone with no interfaces unless a non-negated address match narrows the rule.
 func (c *Compiler) resolveZoneInterfaces(zone, addr string) []string {
-	switch zone {
-	case "", "all", "all+", "any", "any+":
-		return []string{""}
-	}
-	z, ok := c.cfg.Zones[zone]
-	if !ok {
-		slog.Warn("compiler: unknown zone, skipping its rules", "zone", zone)
-		return nil
-	}
-	if z.Type == config.ZoneFirewall {
+	if z, ok := c.cfg.Zones[zone]; !ok || z.Type == config.ZoneFirewall {
 		return []string{""}
 	}
 	if ifaces := c.cfg.ZoneInterfaces(zone); len(ifaces) > 0 {
@@ -1069,7 +1059,7 @@ func (c *Compiler) expandZoneRef(ref string) []string {
 		}
 	}
 
-	if base == "all" || base == "all+" || base == "any" || base == "any+" {
+	if base == "all" || base == "all+" {
 		var zones []string
 		for name := range c.cfg.Zones {
 			if excluded != nil && excluded[name] {

internal/nftables/compiler_test.go

@@ -583,7 +583,7 @@ func TestCompile_ConntrackNoTrack(t *testing.T) {
 			{
 				Action: config.ConntrackNoTrack,
 				Source: "net",
-				Dest:   "fw:192.0.2.1",
+				Dest:   "fw",
 				Proto:  "udp",
 				DPort:  config.PortSpec{"53"},
 			},
@@ -597,17 +597,14 @@ func TestCompile_ConntrackNoTrack(t *testing.T) {
 	}
 
 	found := false
-	for _, r := range state.Rules["raw_prerouting"] {
-		if r.Tag == "conntrack:0:raw_prerouting" {
+	for _, r := range state.Rules["prerouting"] {
+		if r.Tag == "conntrack:0:prerouting" {
 			found = true
 			break
 		}
 	}
 	if !found {
-		t.Error("no notrack rule found in raw_prerouting chain")
-	}
-	if len(state.Rules["prerouting"]) != 0 {
-		t.Error("conntrack rule leaked into the nat prerouting chain")
+		t.Error("no notrack rule found in prerouting chain")
 	}
 }
 
@@ -1875,9 +1872,6 @@ func describeRule(r ManagedRule) string {
 				}
 				parts = append(parts, name+"="+net.IP(cmp.Data).String())
 			}
-			if m.Base == expr.PayloadBaseTransportHeader && m.Offset == 0 && m.Len == 2 && cmp.Op == expr.CmpOpEq {
-				parts = append(parts, fmt.Sprintf("sport=%d", binary.BigEndian.Uint16(cmp.Data)))
-			}
 		}
 	}
 	return strings.Join(parts, " ")
@@ -2187,7 +2181,7 @@ func TestCompile_ListExpansionCounts(t *testing.T) {
 		}, "postrouting", "snat:0", 4},
 		{"conntrack dport list", func(c *config.Config) {
 			c.Conntrack = []config.ConntrackRule{{Action: config.ConntrackNoTrack, Proto: "udp", DPort: config.PortSpec{"53", "123"}}}
-		}, "raw_prerouting", "conntrack:0:raw_prerouting", 2},
+		}, "prerouting", "conntrack:0:prerouting", 2},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -2363,7 +2357,7 @@ func TestCompile_ColonRanges(t *testing.T) {
 		}, "postrouting", "snat:0", 2},
 		{"conntrack dport", func(c *config.Config) {
 			c.Conntrack = []config.ConntrackRule{{Action: config.ConntrackNoTrack, Proto: "udp", DPort: config.PortSpec{"1024:2048"}}}
-		}, "raw_prerouting", "conntrack:0:raw_prerouting", 2},
+		}, "prerouting", "conntrack:0:prerouting", 2},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -2424,236 +2418,62 @@ func TestCompile_OrigDestForwardRejected(t *testing.T) {
 	}
 }
 
-func TestCompile_ConntrackZones(t *testing.T) {
-	tests := []struct {
-		name    string
-		ct      config.ConntrackRule
-		want    map[string][]string
-		wantErr string
-	}{
-		{
-			name: "source zone matches iif",
-			ct:   config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "net", Proto: "udp", DPort: config.PortSpec{"53"}},
-			want: map[string][]string{"raw_prerouting": {"iif=eth0"}},
-		},
-		{
-			name: "source and dest addresses",
-			ct:   config.ConntrackRule{Action: config.ConntrackDrop, Source: "net:192.0.2.1,198.51.100.1", Dest: "fw:203.0.113.1"},
-			want: map[string][]string{"raw_prerouting": {"iif=eth0 saddr=192.0.2.1 daddr=203.0.113.1", "iif=eth0 saddr=198.51.100.1 daddr=203.0.113.1"}},
-		},
-		{
-			name: "fw source goes to raw_output with dest oif",
-			ct:   config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "fw", Dest: "net,lan"},
-			want: map[string][]string{"raw_output": {"oif=eth0", "oif=eth1"}},
-		},
-		{
-			name: "all matches no interface",
-			ct:   config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "all", Dest: "fw:192.0.2.53"},
-			want: map[string][]string{"raw_prerouting": {"daddr=192.0.2.53"}},
-		},
-		{
-			name: "interface-less zone fails closed",
-			ct:   config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "dmz"},
-			want: map[string][]string{},
-		},
-		{
-			name: "chain output with fw source matches dest oif",
-			ct:   config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "fw", Dest: "net", Chain: config.ConntrackOutput},
-			want: map[string][]string{"raw_output": {"oif=eth0"}},
-		},
-		{
-			name:    "chain output with non-fw source is rejected",
-			ct:      config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "net", Dest: "fw", Chain: config.ConntrackOutput},
-			wantErr: "chain output needs SOURCE fw",
-		},
-		{
-			name:    "chain prerouting with fw source is rejected",
-			ct:      config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "fw", Dest: "net", Chain: config.ConntrackPrerouting},
-			wantErr: "SOURCE fw cannot use chain prerouting",
-		},
-		{
-			name: "omitted source and dest is global in both chains",
-			ct:   config.ConntrackRule{Action: config.ConntrackNoTrack, Proto: "udp", DPort: config.PortSpec{"53"}, Chain: config.ConntrackBoth},
-			want: map[string][]string{"raw_prerouting": {""}, "raw_output": {""}},
-		},
-		{
-			name: "all source with chain both is global in both chains",
-			ct:   config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "all", Proto: "udp", DPort: config.PortSpec{"53"}, Chain: config.ConntrackBoth},
-			want: map[string][]string{"raw_prerouting": {""}, "raw_output": {""}},
-		},
-		{
-			name: "all source with chain output is global in raw_output",
-			ct:   config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "all", Proto: "udp", DPort: config.PortSpec{"53"}, Chain: config.ConntrackOutput},
-			want: map[string][]string{"raw_output": {""}},
-		},
-		{
-			name: "any source with chain both is global in both chains",
-			ct:   config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "any", Proto: "udp", DPort: config.PortSpec{"53"}, Chain: config.ConntrackBoth},
-			want: map[string][]string{"raw_prerouting": {""}, "raw_output": {""}},
-		},
-		{
-			name: "any source with chain output is global in raw_output",
-			ct:   config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "any", Proto: "udp", DPort: config.PortSpec{"53"}, Chain: config.ConntrackOutput},
-			want: map[string][]string{"raw_output": {""}},
-		},
-		{
-			name: "chain both with non-fw source emits prerouting only",
-			ct:   config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "net", Proto: "udp", DPort: config.PortSpec{"53"}, Chain: config.ConntrackBoth},
-			want: map[string][]string{"raw_prerouting": {"iif=eth0"}},
-		},
-		{
-			name: "chain both with fw source emits output only",
-			ct:   config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "fw", Dest: "lan", Chain: config.ConntrackBoth},
-			want: map[string][]string{"raw_output": {"oif=eth1"}},
-		},
-		{
-			name: "negated addresses stay one AND-ed match",
-			ct:   config.ConntrackRule{Action: config.ConntrackDrop, Source: "net:!192.0.2.1,198.51.100.1"},
-			want: map[string][]string{"raw_prerouting": {"iif=eth0 !saddr=192.0.2.1 !saddr=198.51.100.1"}},
-		},
-		{
-			name: "sport",
-			ct:   config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "net", Proto: "udp", SPort: config.PortSpec{"123"}},
-			want: map[string][]string{"raw_prerouting": {"iif=eth0 sport=123"}},
-		},
-		{
-			name:    "dest zone without address is rejected in prerouting",
-			ct:      config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "net", Dest: "lan"},
-			wantErr: `conntrack DEST zone "lan" needs an address in prerouting`,
-		},
-		{
-			name:    "fw dest zone without address is rejected in prerouting",
-			ct:      config.ConntrackRule{Action: config.ConntrackDrop, Source: "net", Dest: "fw"},
-			wantErr: `conntrack DEST zone "fw" needs an address in prerouting`,
-		},
-		{
-			name: "fw dest zone with address matches daddr",
-			ct:   config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "net", Dest: "fw:192.0.2.1"},
-			want: map[string][]string{"raw_prerouting": {"iif=eth0 daddr=192.0.2.1"}},
-		},
-		{
-			name: "unknown zone fails closed",
-			ct:   config.ConntrackRule{Action: config.ConntrackDrop, Source: "nte"},
-			want: map[string][]string{},
-		},
-		{
-			name: "unknown dest zone fails closed in prerouting",
-			ct:   config.ConntrackRule{Action: config.ConntrackDrop, Source: "net", Dest: "typo"},
-			want: map[string][]string{},
-		},
-		{
-			name: "none dest zone yields no rule",
-			ct:   config.ConntrackRule{Action: config.ConntrackDrop, Source: "net", Dest: "none"},
-			want: map[string][]string{},
-		},
-		{
-			name:    "all!net rejected",
-			ct:      config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "all!net"},
-			wantErr: "zone exclusions are not supported in conntrack entries",
-		},
-		{
-			name:    "all!net rejected",
-			ct:      config.ConntrackRule{Action: config.ConntrackNoTrack, Dest: "all!net"},
-			wantErr: "zone exclusions are not supported in conntrack entries",
-		},
-		{
-			name:    "all+ rejected",
-			ct:      config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "all+"},
-			wantErr: "zone exclusions are not supported in conntrack entries",
-		},
-		{
-			name:    "all+!net rejected",
-			ct:      config.ConntrackRule{Action: config.ConntrackNoTrack, Dest: "all+!net"},
-			wantErr: "zone exclusions are not supported in conntrack entries",
-		},
-		{
-			name:    "any!net rejected",
-			ct:      config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "any!net"},
-			wantErr: "zone exclusions are not supported in conntrack entries",
-		},
-		{
-			name:    "any+ rejected",
-			ct:      config.ConntrackRule{Action: config.ConntrackNoTrack, Dest: "any+"},
-			wantErr: "zone exclusions are not supported in conntrack entries",
-		},
-		{
-			name: "omitted source and dest is global",
-			ct:   config.ConntrackRule{Action: config.ConntrackNoTrack, Proto: "udp", DPort: config.PortSpec{"53"}},
-			want: map[string][]string{"raw_prerouting": {""}},
-		},
-		{
-			name: "dest zone with address matches daddr",
-			ct:   config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "net", Dest: "lan:203.0.113.10"},
-			want: map[string][]string{"raw_prerouting": {"iif=eth0 daddr=203.0.113.10"}},
-		},
+func TestCompile_ConntrackHelper(t *testing.T) {
+	compile := func(rules ...config.ConntrackRule) (*FirewallState, error) {
+		cfg := &config.Config{
+			Settings:   config.Settings{TableName: "test", AddressFamily: config.FamilyINET},
+			Zones:      map[string]config.Zone{"fw": {Type: config.ZoneFirewall}},
+			Conntrack:  rules,
+			PortGroups: map[string]config.PortGroup{},
+		}
+		return NewCompiler(cfg).Compile()
 	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			cfg := listCfg(func(cfg *config.Config) {
-				cfg.Zones["lan"] = config.Zone{Type: config.ZoneIP}
-				cfg.Zones["dmz"] = config.Zone{Type: config.ZoneIP}
-				cfg.Interfaces = append(cfg.Interfaces, config.Interface{Zone: "lan", Interface: "eth1"})
-				cfg.Conntrack = []config.ConntrackRule{tt.ct}
-			})
-			if tt.wantErr != "" {
-				if _, err := NewCompiler(cfg).Compile(); err == nil || !strings.Contains(err.Error(), tt.wantErr) {
-					t.Fatalf("Compile() error = %v, want %q", err, tt.wantErr)
-				}
-				return
-			}
-			state := mustCompile(t, cfg)
-			got := map[string][]string{}
-			for _, chain := range []string{"raw_prerouting", "raw_output"} {
-				for _, r := range taggedRules(state, chain, "conntrack:0:"+chain) {
-					got[chain] = append(got[chain], describeRule(r))
-				}
-			}
-			if !reflect.DeepEqual(got, tt.want) {
-				t.Errorf("rules = %v, want %v", got, tt.want)
-			}
-		})
-	}
-}
 
-func TestCompile_RuleZoneExclusionExpands(t *testing.T) {
-	cfg := listCfg(func(cfg *config.Config) {
-		cfg.Zones["lan"] = config.Zone{Type: config.ZoneIP}
-		cfg.Interfaces = append(cfg.Interfaces, config.Interface{Zone: "lan", Interface: "eth1"})
-		cfg.Rules = []config.Rule{
-			{Source: "all!net", Dest: "fw", Action: config.RuleAccept, Proto: "tcp", DPort: config.PortSpec{"22"}},
-			{Source: "nte", Dest: "fw", Action: config.RuleAccept},
-		}
-	})
-	state := mustCompile(t, cfg)
-	var got []string
-	for _, r := range taggedRules(state, "input", "rule:0") {
-		got = append(got, describeRule(r))
+	state, err := compile(
+		config.ConntrackRule{Action: config.ConntrackHelper, Helper: "ftp", Proto: "tcp", DPort: config.PortSpec{"21"}},
+		config.ConntrackRule{Action: config.ConntrackHelper, Helper: "sip", Proto: "tcp", DPort: config.PortSpec{"5060"}, Chain: config.ConntrackPrerouting},
+		config.ConntrackRule{Action: config.ConntrackHelper, Helper: "tftp", Chain: config.ConntrackOutput},
+	)
+	if err != nil {
+		t.Fatal(err)
 	}
-	if want := []string{"iif=eth1"}; !reflect.DeepEqual(got, want) {
-		t.Errorf("all!net -> fw input rules = %v, want %v", got, want)
-	}
-	if r := taggedRules(state, "input", "rule:1"); len(r) != 0 {
-		t.Errorf("unknown zone compiled %d rules, want 0", len(r))
-	}
-}
 
-func TestCompile_RuleZoneExclusionIntraZoneSymmetric(t *testing.T) {
-	cfg := listCfg(func(cfg *config.Config) {
-		cfg.Zones["lan"] = config.Zone{Type: config.ZoneIP}
-		cfg.Interfaces = append(cfg.Interfaces, config.Interface{Zone: "lan", Interface: "eth1"})
-		cfg.Rules = []config.Rule{
-			{Source: "lan", Dest: "all+!net", Action: config.RuleAccept},
-			{Source: "lan", Dest: "all!net", Action: config.RuleAccept},
-		}
-	})
-	state := mustCompile(t, cfg)
-	for i, want := range []bool{true, false} {
-		got := false
-		for _, r := range taggedRules(state, "forward", fmt.Sprintf("rule:%d", i)) {
-			got = got || describeRule(r) == "iif=eth1 oif=eth1"
-		}
-		if got != want {
-			t.Errorf("rule:%d lan->lan forward = %v, want %v", i, got, want)
+	want := []Helper{
+		{"ftp", expr.CtHelper{Name: "ftp", L3Proto: unix.NFPROTO_INET, L4Proto: unix.IPPROTO_TCP}},
+		{"sip-tcp", expr.CtHelper{Name: "sip", L3Proto: unix.NFPROTO_INET, L4Proto: unix.IPPROTO_TCP}},
+		{"tftp", expr.CtHelper{Name: "tftp", L3Proto: unix.NFPROTO_INET, L4Proto: unix.IPPROTO_UDP}},
+	}
+	if !reflect.DeepEqual(state.Helpers, want) {
+		t.Errorf("helpers = %+v, want %+v", state.Helpers, want)
+	}
+
+	refs := func(chain string) []string {
+		var out []string
+		for _, r := range state.Rules[chain] {
+			ref, ok := r.Exprs[len(r.Exprs)-1].(*expr.Objref)
+			if !ok || ref.Type != unix.NFT_OBJECT_CT_HELPER {
+				t.Fatalf("%s: rule %s does not end in a ct helper objref", chain, r.Tag)
+			}
+			out = append(out, r.Tag+"="+ref.Name)
 		}
+		return out
+	}
+	if got := refs("helper_prerouting"); !reflect.DeepEqual(got, []string{
+		"conntrack:0:helper_prerouting=ftp", "conntrack:1:helper_prerouting=sip-tcp"}) {
+		t.Errorf("helper_prerouting = %v", got)
+	}
+	if got := refs("helper_output"); !reflect.DeepEqual(got, []string{
+		"conntrack:0:helper_output=ftp", "conntrack:2:helper_output=tftp"}) {
+		t.Errorf("helper_output = %v", got)
+	}
+
+	ftp := state.Rules["helper_prerouting"][0].Exprs
+	l4, _ := l4Matches("tcp", config.PortSpec{"21"}, nil)
+	if !reflect.DeepEqual(ftp[:len(ftp)-1], l4[0].exprs) {
+		t.Errorf("ftp rule does not match tcp dport 21: %#v", ftp)
+	}
+
+	if _, err := compile(config.ConntrackRule{Action: config.ConntrackHelper, Helper: "nope"}); err == nil {
+		t.Error("expected error for unknown helper without proto")
 	}
 }

internal/nftables/diff.go

@@ -20,15 +20,25 @@ type ManagedRule struct {
 
 type FirewallState struct {
 	Rules map[string][]ManagedRule
+	// Helpers are the ct helper objects in kernel (insertion) order.
+	Helpers []Helper
+}
+
+// Helper is a named ct helper object.
+type Helper struct {
+	Name   string        `json:"name"`
+	Helper expr.CtHelper `json:"helper"`
 }
 
 type ChangeSet struct {
-	Add    []ManagedRule
-	Remove []ManagedRule
+	Add           []ManagedRule
+	Remove        []ManagedRule
+	AddHelpers    []Helper
+	RemoveHelpers []string
 }
 
 func (cs *ChangeSet) Empty() bool {
-	return len(cs.Add) == 0 && len(cs.Remove) == 0
+	return len(cs.Add) == 0 && len(cs.Remove) == 0 && len(cs.AddHelpers) == 0 && len(cs.RemoveHelpers) == 0
 }
 
 func (cs *ChangeSet) Summary() string {
@@ -49,6 +59,12 @@ func (cs *ChangeSet) Summary() string {
 			fmt.Fprintf(&b, "    - [%s] %s (handle %d)\n", r.Chain, r.Tag, r.Handle)
 		}
 	}
+	for _, h := range cs.AddHelpers {
+		fmt.Fprintf(&b, "  + ct helper %q\n", h.Name)
+	}
+	for _, n := range cs.RemoveHelpers {
+		fmt.Fprintf(&b, "  - ct helper %q\n", n)
+	}
 	return b.String()
 }
 
@@ -56,7 +72,7 @@ func (cs *ChangeSet) Summary() string {
 // each chain, replace the middle, and insert the new rules before the first kept
 // suffix rule (or append when there is none).
 func computeDiff(current, desired *FirewallState) *ChangeSet {
-	cs := &ChangeSet{}
+	cs := diffHelpers(current, desired)
 
 	chains := make([]string, 0, len(current.Rules)+len(desired.Rules))
 	for c := range current.Rules {
@@ -109,7 +125,10 @@ func ruleEqual(a, b ManagedRule) bool {
 // restoreChangeSet replaces every managed rule in current with the snapshot's,
 // in snapshot order, so a restore cannot reorder rules.
 func restoreChangeSet(current, snap *FirewallState) *ChangeSet {
-	cs := &ChangeSet{}
+	cs := &ChangeSet{AddHelpers: snap.Helpers}
+	for _, h := range current.Helpers {
+		cs.RemoveHelpers = append(cs.RemoveHelpers, h.Name)
+	}
 	for _, rules := range current.Rules {
 		for _, r := range rules {
 			if r.Tag != "" {
@@ -131,3 +150,29 @@ func restoreChangeSet(current, snap *FirewallState) *ChangeSet {
 	}
 	return cs
 }
+
+// diffHelpers replaces any ct helper object that is missing or differs.
+// L3Proto is ignored: the kernel narrows inet to ip/ip6 for single-family helpers such as pptp.
+func diffHelpers(current, desired *FirewallState) *ChangeSet {
+	cs := &ChangeSet{}
+	same := func(a, b expr.CtHelper) bool { return a.Name == b.Name && a.L4Proto == b.L4Proto }
+	find := func(hs []Helper, name string) (expr.CtHelper, bool) {
+		for _, h := range hs {
+			if h.Name == name {
+				return h.Helper, true
+			}
+		}
+		return expr.CtHelper{}, false
+	}
+	for _, h := range current.Helpers {
+		if want, ok := find(desired.Helpers, h.Name); !ok || !same(want, h.Helper) {
+			cs.RemoveHelpers = append(cs.RemoveHelpers, h.Name)
+		}
+	}
+	for _, h := range desired.Helpers {
+		if have, ok := find(current.Helpers, h.Name); !ok || !same(have, h.Helper) {
+			cs.AddHelpers = append(cs.AddHelpers, h)
+		}
+	}
+	return cs
+}

internal/nftables/diff_test.go

@@ -5,6 +5,7 @@ import (
 	"testing"
 
 	"github.com/google/nftables/expr"
+	"golang.org/x/sys/unix"
 )
 
 func TestRestoreChangeSet(t *testing.T) {
@@ -64,3 +65,42 @@ func TestRestoreChangeSetEmptySnapshotRemovesAll(t *testing.T) {
 		t.Errorf("expected 1 remove 0 add, got %d/%d", len(cs.Remove), len(cs.Add))
 	}
 }
+
+func TestDiffHelpers(t *testing.T) {
+	h := func(name, typ string, l3 uint16, l4 uint8) Helper {
+		return Helper{Name: name, Helper: expr.CtHelper{Name: typ, L3Proto: l3, L4Proto: l4}}
+	}
+	ftp := h("ftp", "ftp", unix.NFPROTO_INET, unix.IPPROTO_TCP)
+	tftp := h("tftp", "tftp", unix.NFPROTO_INET, unix.IPPROTO_UDP)
+	sipUDP := h("sip", "sip", unix.NFPROTO_INET, unix.IPPROTO_UDP)
+	sipTCP := h("sip", "sip", unix.NFPROTO_INET, unix.IPPROTO_TCP)
+
+	current := &FirewallState{Helpers: []Helper{tftp, ftp, sipUDP}}
+	desired := &FirewallState{Helpers: []Helper{ftp, sipTCP}}
+
+	cs := computeDiff(current, desired)
+	if !reflect.DeepEqual(cs.RemoveHelpers, []string{"tftp", "sip"}) {
+		t.Errorf("remove = %v", cs.RemoveHelpers)
+	}
+	if !reflect.DeepEqual(cs.AddHelpers, []Helper{sipTCP}) {
+		t.Errorf("add = %v", cs.AddHelpers)
+	}
+
+	// Restore recreates every helper so kernel listing order matches the snapshot.
+	cs = restoreChangeSet(desired, current)
+	if !reflect.DeepEqual(cs.RemoveHelpers, []string{"ftp", "sip"}) || !reflect.DeepEqual(cs.AddHelpers, current.Helpers) {
+		t.Errorf("restore = -%v +%v", cs.RemoveHelpers, cs.AddHelpers)
+	}
+
+	live := &FirewallState{Helpers: []Helper{h("pptp", "pptp", unix.NFPROTO_IPV4, unix.IPPROTO_TCP)}}
+	want := &FirewallState{Helpers: []Helper{h("pptp", "pptp", unix.NFPROTO_INET, unix.IPPROTO_TCP)}}
+	if cs := computeDiff(live, want); !cs.Empty() {
+		t.Errorf("kernel-narrowed l3proto should not diff: %+v", cs)
+	}
+	if cs := computeDiff(desired, desired); !cs.Empty() {
+		t.Errorf("identical helpers should be empty: %+v", cs)
+	}
+	if cs := computeDiff(&FirewallState{}, desired); cs.Empty() {
+		t.Error("missing helpers should not be empty")
+	}
+}

internal/nftables/engine.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 
 	"github.com/google/nftables"
+	"github.com/google/nftables/expr"
 
 	"git.unkin.net/unkin/tomswall/internal/config"
 )
@@ -69,21 +70,19 @@ func (e *Engine) ensureChains(table *nftables.Table, policies map[string]nftable
 			Hooknum:  nftables.ChainHookPrerouting,
 			Priority: nftables.ChainPriorityNATDest,
 		},
-		"raw_prerouting": {
-			Name:     "raw_prerouting",
+		"helper_prerouting": {
+			Name:     "helper_prerouting",
 			Table:    table,
 			Type:     nftables.ChainTypeFilter,
 			Hooknum:  nftables.ChainHookPrerouting,
-			Priority: nftables.ChainPriorityRaw,
-			Policy:   policyPtr(nftables.ChainPolicyAccept),
+			Priority: nftables.ChainPriorityMangle,
 		},
-		"raw_output": {
-			Name:     "raw_output",
+		"helper_output": {
+			Name:     "helper_output",
 			Table:    table,
 			Type:     nftables.ChainTypeFilter,
 			Hooknum:  nftables.ChainHookOutput,
-			Priority: nftables.ChainPriorityRaw,
-			Policy:   policyPtr(nftables.ChainPolicyAccept),
+			Priority: nftables.ChainPriorityMangle,
 		},
 	}
 
@@ -128,6 +127,13 @@ func (e *Engine) apply(changes *ChangeSet, policies map[string]nftables.ChainPol
 		})
 	}
 
+	for _, n := range changes.RemoveHelpers {
+		e.conn.DeleteObject(helperObj(table, n, expr.CtHelper{}))
+	}
+	for _, h := range changes.AddHelpers {
+		e.conn.AddObj(helperObj(table, h.Name, h.Helper))
+	}
+
 	for _, r := range changes.Add {
 		chain, ok := chains[r.Chain]
 		if !ok {
@@ -188,6 +194,18 @@ func (e *Engine) readCurrentState() (*FirewallState, error) {
 		return state, err
 	}
 
+	objs, err := e.conn.GetNamedObjects(ourTable)
+	if err != nil {
+		return nil, fmt.Errorf("listing objects: %w", err)
+	}
+	for _, o := range objs {
+		if no, ok := o.(*nftables.NamedObj); ok && no.Type == nftables.ObjTypeCtHelper {
+			if h, ok := no.Obj.(*expr.CtHelper); ok {
+				state.Helpers = append(state.Helpers, Helper{Name: no.Name, Helper: *h})
+			}
+		}
+	}
+
 	chains, err := e.conn.ListChainsOfTableFamily(nftables.TableFamilyINet)
 	if err != nil {
 		return nil, fmt.Errorf("listing chains: %w", err)
@@ -221,6 +239,7 @@ type Snapshot struct {
 	Present  bool                            `json:"present"`
 	Policies map[string]nftables.ChainPolicy `json:"policies,omitempty"`
 	Rules    map[string][]SnapshotRule       `json:"rules,omitempty"`
+	Helpers  []Helper                        `json:"helpers,omitempty"`
 }
 
 // SnapshotRule is a managed rule with its expressions in netlink wire format.
@@ -257,6 +276,7 @@ func (e *Engine) Snapshot() (*Snapshot, error) {
 	if err != nil {
 		return nil, err
 	}
+	snap.Helpers = state.Helpers
 	return snap, nil
 }
 
@@ -273,6 +293,7 @@ func (e *Engine) Restore(s *Snapshot) error {
 	if err != nil {
 		return err
 	}
+	want.Helpers = s.Helpers
 	current, err := e.readCurrentState()
 	if err != nil {
 		return err
@@ -280,6 +301,10 @@ func (e *Engine) Restore(s *Snapshot) error {
 	return e.apply(restoreChangeSet(current, want), s.Policies)
 }
 
+func helperObj(table *nftables.Table, name string, h expr.CtHelper) *nftables.NamedObj {
+	return &nftables.NamedObj{Table: table, Name: name, Type: nftables.ObjTypeCtHelper, Obj: &h}
+}
+
 func policyPtr(p nftables.ChainPolicy) *nftables.ChainPolicy {
 	return &p
 }

internal/nftables/snapshot_test.go

@@ -243,17 +243,3 @@ func testEngine(t *testing.T, dial func([]netlink.Message) ([]netlink.Message, e
 	}
 	return &Engine{cfg: &config.Config{Settings: config.Settings{TableName: "tomswall"}}, conn: conn}
 }
-
-func TestEnsureChainsRawPriority(t *testing.T) {
-	e := testEngine(t, nil)
-	chains := e.ensureChains(e.ensureTable(), nil)
-	for name, hook := range map[string]*nftables.ChainHook{"raw_prerouting": nftables.ChainHookPrerouting, "raw_output": nftables.ChainHookOutput} {
-		c, ok := chains[name]
-		if !ok {
-			t.Fatalf("%s chain not declared", name)
-		}
-		if *c.Priority != *nftables.ChainPriorityRaw || *c.Hooknum != *hook || c.Type != nftables.ChainTypeFilter || *c.Policy != nftables.ChainPolicyAccept {
-			t.Errorf("%s: got type %s hook %d prio %d", name, c.Type, *c.Hooknum, *c.Priority)
-		}
-	}
-}

tomswall.example.yaml

@@ -191,7 +191,7 @@ snat:
 # conntrack:
 #   - action: notrack
 #     source: net
-#     dest: fw:203.0.113.1
+#     dest: fw
 #     proto: udp
 #     dport: [53]
 #     comment: "Skip conntrack for DNS"