firewall4/root/sbin, branch master

init: remove unnecessary stop logic

2025-03-17T15:44:40Z

Always remove table and service state to have consistent cleaned up system state on exit even if user intentionally dropped our table. Removes dependency on grep as a consequence. Ref: https://wiki.nftables.org/wiki-nftables/index.php/Configuring_tables Supersedes: https://github.com/openwrt/firewall4/pull/33 Signed-off-by: Andris PE

cli: introduce test mode and refuse firewall restart on errors

2022-09-01T10:19:14Z

- Introduce a new `fw4 [-q] check` command which tests the rendered ruleset using nftables' --check mode. This is useful to assert complex rulesets using external includes for correctness. - Extend the `fw4 restart` command to check the rendered ruleset before flushing the existing ruleset. Signed-off-by: Jo-Philipp Wich

fw4: add support for configurable includes

2022-06-15T11:32:17Z

Signed-off-by: Jo-Philipp Wich

fw4: prefer /dev/stdin if available

2022-05-31T18:55:36Z

The nftables executable treats `-` and `/dev/stdin` specially when processing nft scripts from stdin; it will buffer the contents in order to be able to print detailled error diagnostics. The `/proc/self/fd/0` path used by `fw4` does not get this special treatment which will lead to nftables error messages without any reported context. Make the `fw4` executable prefer `/dev/stdin` in case it exists and fall back to using `/proc/self/fd/0` as before. Ref: https://github.com/openwrt/openwrt/issues/9927 Ref: https://git.openwrt.org/50bc06e774f89517f98c89c76a7626f35c3ff659 Ref: https://git.netfilter.org/nftables/tree/src/libnftables.c?h=v1.0.3#n733 Signed-off-by: Jo-Philipp Wich

fw4: make `fw4 restart` behavior more robust

2022-05-31T07:36:20Z

Start the firewall on `fw4 restart` even if it was not previously started. Ref: #9935 Signed-off-by: Jo-Philipp Wich

treewide: forward compatibility changes

2022-03-22T20:05:17Z

Adapt testsuite code and fw4 wrapper to current ucode HEAD semantics, in particular ensure that main.uc is invoked as template since ucode now defaults to raw mode for cli invocations. Signed-off-by: Jo-Philipp Wich

treewide: move executables to /sbin

2022-01-06T12:46:35Z

In firewall3, the fw3 executable is installed in /sbin. As luci-app-firewall looks for the fw3 executable in /sbin, the firewall menu is hidden when firewall4 is installed. Move both executables to /sbin so the firewall app will show when firewall4 is installed. Signed-off-by: Stijn Tintel Reviewed-by: Jo-Philipp Wich