Conversation
DNS-based nftables blocklist daemon for OpenWrt (IPv4+IPv6, firewall4, procd/UCI). Upstream v1.0.2 tarball with ash-clean scripts, nft ruleset, uci-defaults and functional test scripts. Signed-off-by: Calin Vlad <calin@edgebites.com>
Formality Check: FailedWe checked this pull request against the contribution guidelines. Here is what needs your attention: 🛑 CRITICAL ERRORS
Tip Do not close this pull request to make corrections. Instead, modify your existing commits (e.g. Something broken? Consider reporting an issue. |
| define Build/Prepare | ||
| endef |
There was a problem hiding this comment.
PKG_SOURCE is set here, so an empty Build/Prepare suppresses $(PKG_UNPACK) and $(PKG_BUILD_DIR) stays empty — every $(PKG_BUILD_DIR)/files/... path in Package/fwblack/install (and PKG_LICENSE_FILES) then has nothing to copy. The empty-Build/Prepare idiom is only for source-less packages that install from ./files/ (e.g. net/adblock). Remove this block and keep only the empty Build/Configure/Build/Compile.
Generated by Claude Code
| PKG_VERSION:=1.0.2 | ||
| PKG_RELEASE:=1 | ||
|
|
||
| PKG_SOURCE:=fw-black-luci-$(PKG_VERSION).tar.gz |
There was a problem hiding this comment.
The codeload tarball's top-level directory is fw-black-luci-1.0.2, but PKG_UNPACK extracts into $(PKG_BUILD_DIR)/.. while PKG_BUILD_DIR defaults to $(BUILD_DIR)/fwblack-$(PKG_VERSION) — so the tree lands beside the build dir, not in it. An override is needed (must be before include $(INCLUDE_DIR)/package.mk).
| PKG_SOURCE:=fw-black-luci-$(PKG_VERSION).tar.gz | |
| PKG_SOURCE:=fw-black-luci-$(PKG_VERSION).tar.gz | |
| PKG_BUILD_DIR:=$(BUILD_DIR)/fw-black-luci-$(PKG_VERSION) |
Generated by Claude Code
| if [ -f /etc/nftables.d/ruleset-post/fwblack.nft ]; then | ||
| rm -f /etc/nftables.d/ruleset-post/fwblack.nft | ||
| fi | ||
| /etc/init.d/fwblack enable 2>/dev/null || true |
There was a problem hiding this comment.
default_postinst already enables and starts every /etc/init.d/ file the package ships, and deliberately skips enable when PKG_UPGRADE=1; default_prerm does the mirror image for disable. The unconditional enable here plus the unconditional disable on line 104 bypass that guard, so every package upgrade re-enables the service for a user who had disabled it. Drop this line and the stop/disable pair on lines 103-104.
Generated by Claude Code
| if [ -f /etc/nftables.d/ruleset-post/fwblack.nft ]; then | ||
| rm -f /etc/nftables.d/ruleset-post/fwblack.nft | ||
| fi |
There was a problem hiding this comment.
/etc/nftables.d/ is firewall4's user conffile directory, and this package never installs there — it installs to /usr/share/nftables.d/ruleset-post/. This runs outside the .migrated guard, so it silently deletes a hand-written user include on every install and upgrade; gate it behind the one-shot marker or drop it.
Generated by Claude Code
| cp /etc/fwblack/blocklist.cfg /etc/fwblack/blocklist.cfg.ppkg-default | ||
| cp /etc/fw.black/blocklist.cfg /etc/fwblack/blocklist.cfg |
There was a problem hiding this comment.
/etc/fwblack/blocklist.cfgis declared inPackage/fwblack/conffiles, so the package manager already preserves whatever the user has there. Overwriting it with the legacy/etc/fw.blackcopy discards the file the daemon is actually running with; the safer direction is to leave the existing conffile alone and stash the legacy one for the user to merge.- nit:
.ppkg-defaultlooks like a typo for.opkg-default.
Generated by Claude Code
| # (PKG_NAME/PKG_VERSION are also provided as environment variables). | ||
| # NOTE: plain grep without -q here - matches stay visible in CI logs. | ||
| name="${1:-$PKG_NAME}" | ||
| version="${2:-$PKG_VERSION}" |
There was a problem hiding this comment.
Without set -e the cmd && echo ... lines below swallow their own failures: a broken ash -n or nft -c just skips the echo, and the script still exits with the status of the final grep, so CI reports a pass. Only the last command in the branch can actually fail the test.
| version="${2:-$PKG_VERSION}" | |
| version="${2:-$PKG_VERSION}" | |
| set -e |
Generated by Claude Code
2 participants
DNS-based nftables blocklist daemon for OpenWrt (IPv4+IPv6, firewall4/nftables, procd/UCI).
Upstream: https://github.com/EdgeBites/fw-black-luci, v1.0.2 tarball (codeload) with PKG_HASH verified. Daemon-only; LuCI app (luci-app-fwblack) to follow separately in openwrt/luci.
Tests:
Maintainer: Calin Vlad calin@edgebites.com, MIT.