Release 0.5.0: iptables backend; tui-kit v0.4.0 (#25)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MbCfX3T8khyd9hsrN5kMo3

Author: edimarlnx

README.md

@@ -3,9 +3,11 @@
 [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/tui-tools/tui-firewall/badge)](https://scorecard.dev/viewer/?uri=github.com/tui-tools/tui-firewall)
 [![OpenSSF Best Practices](https://www.bestpractices.dev/projects/14368/badge)](https://www.bestpractices.dev/projects/14368)
 
+<!-- stability:start -->
 > **Beta.** The family is days old and still changing. Package names, flags
 > and keys may move without notice until 1.0. Pin versions, and report what
 > breaks.
+<!-- stability:end -->
 
 A terminal UI for the Linux firewall — **ufw**, **firewalld**, **iptables** and **nftables** —
 that shows the rules you actually have and **previews the exact command line of
@@ -133,7 +135,7 @@ Upgrades then arrive with the rest of your system updates.
 ### Any distribution, static binary
 
 ```sh
-curl -fsSL https://github.com/tui-tools/tui-firewall/releases/download/v0.4.1/tui-firewall_0.4.1_linux_amd64.tar.gz | tar -xz tui-firewall
+curl -fsSL https://github.com/tui-tools/tui-firewall/releases/download/v0.5.0/tui-firewall_0.5.0_linux_amd64.tar.gz | tar -xz tui-firewall
 sudo install -m0755 tui-firewall /usr/local/bin/tui-firewall
 ```
 
@@ -456,7 +458,9 @@ rules in the preview:
 ![Persisting with a diff preview](docs/screenshots/tui-firewall-iptables-persist.png)
 
 The command is the persistence layer's own: `netfilter-persistent save` on
-Debian and Ubuntu, `service iptables save` and `service ip6tables save` on RHEL.
+Debian and Ubuntu, `/usr/libexec/iptables/iptables.init save` and
+`ip6tables.init save` on Fedora and RHEL (what `service iptables save` runs,
+without needing the `service` wrapper installed).
 The comparison covers the filter table and leaves out the chains other daemons
 rebuild, so a host where tailscaled added `ts-input` after the last save still
 reads as in sync.
@@ -693,7 +697,7 @@ are capped, so a firewall under a scan cannot grow it without bound.
 - Insert a rule right before the chain's catch-all REJECT or DROP, with the
   position and the reason in the preview; refuse a position after it. Delete by
   specification.
-- Persist with `netfilter-persistent save` or `service iptables save`, previewed
+- Persist with `netfilter-persistent save` or iptables-services' `iptables.init save`, previewed
   with the diff against the saved files; report runtime-vs-saved drift in the
   header, the status line and `--check`.
 - Stage changes and apply them through `iptables-restore --noflush`, with the
@@ -808,7 +812,7 @@ hidden; one below the minimum is marked as such and the tool still runs.
 | Binary | `iptables` |
 | Version read with | `iptables --version` |
 | Minimum | 1.6 |
-| Tested | `1.8.10` |
+| Tested | `1.8.10`, `1.8.11` |
 
 | Versions | What changes |
 | --- | --- |

compat/results.jsonl

@@ -2,3 +2,4 @@
 {"backend": "ufw", "date": "2026-08-30", "distro": "ubuntu-24.04", "result": "pass", "suite": "smoke", "tool": "tui-firewall", "version": "0.36.2"}
 {"backend": "firewalld", "date": "2026-08-30", "distro": "fedora-44", "result": "pass", "suite": "smoke", "tool": "tui-firewall", "version": "2.4.4"}
 {"backend": "iptables", "date": "2026-09-25", "distro": "ubuntu-24.04", "result": "pass", "suite": "smoke", "tool": "tui-firewall", "version": "1.8.10"}
+{"backend": "iptables", "date": "2026-09-25", "distro": "fedora-44", "result": "pass", "suite": "smoke", "tool": "tui-firewall", "version": "1.8.11"}

go.mod

@@ -6,7 +6,7 @@ require (
 	github.com/charmbracelet/bubbles v1.0.0
 	github.com/charmbracelet/bubbletea v1.3.10
 	github.com/charmbracelet/lipgloss v1.1.0
-	github.com/tui-tools/tui-kit v0.3.1
+	github.com/tui-tools/tui-kit v0.4.0
 )
 
 require (
@@ -22,12 +22,12 @@ require (
 	github.com/lucasb-eyer/go-colorful v1.4.1 // indirect
 	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/mattn/go-localereader v0.0.1 // indirect
-	github.com/mattn/go-runewidth v0.0.29 // indirect
+	github.com/mattn/go-runewidth v0.0.30 // indirect
 	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/muesli/termenv v0.16.0 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
-	github.com/xo/terminfo v1.0.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
-	golang.org/x/text v0.41.0 // indirect
+	github.com/xo/terminfo v1.2.0 // indirect
+	golang.org/x/sys v0.48.0 // indirect
+	golang.org/x/text v0.42.0 // indirect
 )

go.sum

@@ -28,8 +28,8 @@ github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsRe
 github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/mattn/go-localereader v0.0.1 h1:ygSAOl7ZXTx4RdPYinUpg6W99U8jWvWi9Ye2JC/oIi4=
 github.com/mattn/go-localereader v0.0.1/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+EiG4R1k4Cjx5p88=
-github.com/mattn/go-runewidth v0.0.29 h1:3oGF3R/S2N9DQ3ptftzVIvg2eicmojCzlwBEmqEPDfQ=
-github.com/mattn/go-runewidth v0.0.29/go.mod h1:3qAiGCV4Koz/yuveO58qUefmUTRm8r0IGEXZ9jeHp/8=
+github.com/mattn/go-runewidth v0.0.30 h1:+KUuiDA4fF0R1p5FeueHefjDm+GIM+kWfFnDjybOPgk=
+github.com/mattn/go-runewidth v0.0.30/go.mod h1:3qAiGCV4Koz/yuveO58qUefmUTRm8r0IGEXZ9jeHp/8=
 github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 h1:ZK8zHtRHOkbHy6Mmr5D264iyp3TiX5OmNcI5cIARiQI=
 github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6/go.mod h1:CJlz5H+gyd6CUWT45Oy4q24RdLyn7Md9Vj2/ldJBSIo=
 github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA=
@@ -38,14 +38,12 @@ github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc
 github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
-github.com/tui-tools/tui-kit v0.3.1 h1:0dxrN6+nEvzyWwSHxYxYjn/wGPygHneqG0GMBiuqoFs=
-github.com/tui-tools/tui-kit v0.3.1/go.mod h1:Vpg1NcQ5ktylMvXTzsixdHjLUNxhntR3ZYSOYaQ7/FQ=
-github.com/xo/terminfo v1.0.0 h1:2ZpYzqWzyyytjk3TP6aJVDhkMAkc99/1xKQdA3TDTBY=
-github.com/xo/terminfo v1.0.0/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
-golang.org/x/exp v0.0.0-20231006140011-7918f672742d h1:jtJma62tbqLibJ5sFQz8bKtEM8rJBtfilJ2qTU199MI=
-golang.org/x/exp v0.0.0-20231006140011-7918f672742d/go.mod h1:ldy0pHrwJyGW56pPQzzkH36rKxoZW1tw7ZJpeKx+hdo=
+github.com/tui-tools/tui-kit v0.4.0 h1:dSbT796aca6wOIZdO7XV1EA2rraT/J7iYHGF9IWRyy4=
+github.com/tui-tools/tui-kit v0.4.0/go.mod h1:Vpg1NcQ5ktylMvXTzsixdHjLUNxhntR3ZYSOYaQ7/FQ=
+github.com/xo/terminfo v1.2.0 h1:d0ZTOCpuGE0lwSAOs0zcJjwz3jWQyqcRt9XbGJpCOl4=
+github.com/xo/terminfo v1.2.0/go.mod h1:lGzkSo8Fe7IRh/w+Gqz7n5mDog4FVXCj3gy/DYTBqio=
 golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
+golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=

internal/backends/select.go

@@ -346,10 +346,17 @@ func activeDetail(name string, sudoPrefix []string) string {
 		return "the " + name + " service is running on this machine"
 	}
 	layout := iptablesLayout()
-	detail := layout.Unit() + " is enabled and restores " + layout.V4Path +
+	// The unit is named after its package on Debian (netfilter-persistent),
+	// but on RHEL the iptables unit comes from iptables-services: name the
+	// package too, since "iptables is enabled" alone reads like a tautology.
+	loader := layout.Unit()
+	if loader != layout.Kind {
+		loader = "the " + loader + " unit (" + layout.Kind + ")"
+	}
+	detail := loader + " is enabled and restores " + layout.V4Path +
 		" at boot, so iptables is the firewall in charge of this machine"
 	if !layout.Enabled {
-		detail = layout.Unit() + " restored " + layout.V4Path +
+		detail = loader + " restored " + layout.V4Path +
 			" on this boot, so iptables is the firewall in charge of this machine"
 	}
 	return detail + nativeTablesNote(sudoPrefix)

internal/backends/select_test.go

@@ -379,6 +379,29 @@ func TestResolveAutoPicksIptablesWhenItsLoaderRan(t *testing.T) {
 	}
 }
 
+func TestResolveAutoIptablesNamesIptablesServices(t *testing.T) {
+	// On RHEL the loader is the iptables unit of iptables-services: the
+	// sentence names the package, not only a unit called iptables.
+	stubAllProbes(t, probeState{}, probeState{installed: true}, probeState{installed: true})
+	stubIptables(t, probeState{installed: true, active: true, enabled: true},
+		iptables.Layout{Kind: iptables.LayoutIptablesServices,
+			V4Path: "/etc/sysconfig/iptables", V6Path: "/etc/sysconfig/ip6tables",
+			Enabled: true})
+
+	selection, err := Resolve(autoConfig())
+	if err != nil {
+		t.Fatalf("Resolve: %v", err)
+	}
+	if selection.Name != BackendIptables {
+		t.Fatalf("Resolve = %q, want iptables", selection.Name)
+	}
+	for _, want := range []string{"the iptables unit (iptables-services)", "/etc/sysconfig/iptables"} {
+		if !strings.Contains(selection.Detail, want) {
+			t.Errorf("detail %q should mention %q", selection.Detail, want)
+		}
+	}
+}
+
 func TestResolveAutoIptablesSaysWhenNativeTablesExistToo(t *testing.T) {
 	// A host with both: the iptables backend is chosen, and the sentence says
 	// there is a native nft table it will not show.

internal/iptables/backend.go

@@ -68,8 +68,13 @@ func (r *Real) runnerFor(bin string) (*runner.Runner, error) {
 		return nil, err
 	}
 	search := sbinPaths(bin)
-	if bin == "cat" {
+	switch {
+	case bin == "cat":
 		search = []string{"/usr/bin/cat", "/bin/cat"}
+	case strings.HasPrefix(bin, "/"):
+		// An absolute path, like the iptables-services init scripts, is its
+		// own location: there is nothing to search for.
+		search = nil
 	}
 	run, err := runner.New(runner.Options{
 		Bin:         bin,

internal/iptables/detect.go

@@ -68,7 +68,7 @@ func DetectLayout() Layout {
 		layout.Enabled = unitEnabled("netfilter-persistent")
 		return layout
 	}
-	if fileExists("/usr/libexec/iptables/iptables.init") {
+	if fileExists(iptablesInit) {
 		layout := iptablesServicesLayout
 		layout.Enabled = unitEnabled("iptables")
 		return layout

internal/iptables/fake.go

@@ -195,9 +195,9 @@ func (f *Fake) apply(cmd firewall.Command) (string, error) {
 			return "run-parts: executing /usr/share/netfilter-persistent/plugins.d/15-ip4tables save\n" +
 				"run-parts: executing /usr/share/netfilter-persistent/plugins.d/25-ip6tables save", nil
 		}
-	case "service":
+	case iptablesInit, ip6tablesInit:
 		f.saveLocked()
-		return "iptables: Saving firewall rules: [  OK  ]", nil
+		return "iptables: Saving firewall rules to /etc/sysconfig/iptables: [  OK  ]", nil
 	}
 	return "", errorf("%s is not something the demo applies", cmd.String())
 }

internal/iptables/persist.go

@@ -17,10 +17,19 @@ const (
 	LayoutNetfilterPersistent = "netfilter-persistent"
 	// LayoutIptablesServices is Fedora and RHEL's iptables-services: the
 	// iptables and ip6tables units restore /etc/sysconfig/iptables and
-	// ip6tables, and `service iptables save` writes them.
+	// ip6tables, and the package's init scripts write them on `save`.
 	LayoutIptablesServices = "iptables-services"
 )
 
+// The init scripts iptables-services ships. `service iptables save` is only a
+// wrapper around them (initscripts' legacy action runs `iptables.init save`),
+// and `service` comes from initscripts-service, which iptables-services does
+// not require: calling the scripts directly works on a minimal install too.
+const (
+	iptablesInit  = "/usr/libexec/iptables/iptables.init"
+	ip6tablesInit = "/usr/libexec/iptables/ip6tables.init"
+)
+
 // Layout is one persistence layer: its name, the files it restores, and
 // whether systemd starts it at boot.
 type Layout struct {
@@ -309,12 +318,12 @@ func BuildPersist(state State) (firewall.Change, error) {
 		}
 		note += daemonNote(state)
 		commands := []firewall.Command{{
-			Argv:        []string{"service", "iptables", "save"},
+			Argv:        []string{iptablesInit, "save"},
 			Description: "Save the running iptables rules",
 		}}
 		if state.HasV6 {
 			commands = append(commands, firewall.Command{
-				Argv:        []string{"service", "ip6tables", "save"},
+				Argv:        []string{ip6tablesInit, "save"},
 				Description: "Save the running ip6tables rules",
 			})
 		}