cli: introduce test mode and refuse firewall restart on errors

[project/firewall4.git] / root / sbin / fw4

diff --git a/root/sbin/fw4 b/root/sbin/fw4
index b089ac3b3544fa2e48dc4856bdf7a19cd888cc2b..c3e95c2cc1a42caa6f9b7e71fb0b6d3fa72b8778 100755 (executable)
--- a/root/sbin/fw4
+++ b/root/sbin/fw4
@@ -34,6 +34,9 @@ start() {
 
                ACTION=start \
                        utpl -S $MAIN | nft $VERBOSE -f $STDIN
+
+               ACTION=includes \
+                       utpl -S $MAIN
        } 1000>$LOCK
 }
 
@@ -105,9 +108,18 @@ case "$1" in
                flush
        ;;
        restart)
+               QUIET=1 print | nft ${VERBOSE} -c -f $STDIN || die "The rendered ruleset contains errors, not doing firewall restart."
                stop || rm -f $STATE
                start
        ;;
+       check)
+               if [ -n "$QUIET" ]; then
+                       exec 1>/dev/null
+                       exec 2>/dev/null
+               fi
+
+               print | nft ${VERBOSE} -c -f $STDIN && echo "Ruleset passes nftables check."
+       ;;
        print)
                print
        ;;
@@ -137,6 +149,12 @@ Usage:
     Print the rendered ruleset.
 
 
+  $0 [-q] check
+
+    Test the rendered ruleset using nftables' check mode without
+    applying it to the running system.
+
+
   $0 [-q] network {net}
 
     Print the name of the firewall zone covering the given network.