firewall: use uci_get_state() wrapper