mwan3: fix shellcheck warning SC2086

Add double quote to prevent globbing and word splitting where there is
no regression.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>

diff --git a/net/mwan3/files/lib/mwan3/mwan3.sh b/net/mwan3/files/lib/mwan3/mwan3.sh
index 6c8e5008005bad1e57e0b92d0b3bbdc4a2b6069e..fd9f9fc417fa940f6b14ac3622de7afb14df711c 100644 (file)
--- a/net/mwan3/files/lib/mwan3/mwan3.sh
+++ b/net/mwan3/files/lib/mwan3/mwan3.sh
@@ -204,7 +204,7 @@ mwan3_set_custom_ipset_v4()
 
        for custom_network_v4 in $($IP4 route list table "$1" | awk '{print $1}' | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
                $LOG notice "Adding network $custom_network_v4 from table $1 to mwan3_custom_v4 ipset"
-               $IPS -! add mwan3_custom_v4_temp $custom_network_v4
+               $IPS -! add mwan3_custom_v4_temp "$custom_network_v4"
        done
 }
 
@@ -214,7 +214,7 @@ mwan3_set_custom_ipset_v6()
 
        for custom_network_v6 in $($IP6 route list table "$1" | awk '{print $1}' | egrep "$IPv6_REGEX"); do
                $LOG notice "Adding network $custom_network_v6 from table $1 to mwan3_custom_v6 ipset"
-               $IPS -! add mwan3_custom_v6_temp $custom_network_v6
+               $IPS -! add mwan3_custom_v6_temp "$custom_network_v6"
        done
 }
 
@@ -246,11 +246,11 @@ mwan3_set_connected_iptables()
        $IPS create mwan3_connected_v4_temp hash:net
 
        for connected_network_v4 in $($IP4 route | awk '{print $1}' | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
-               $IPS -! add mwan3_connected_v4_temp $connected_network_v4
+               $IPS -! add mwan3_connected_v4_temp "$connected_network_v4"
        done
 
        for connected_network_v4 in $($IP4 route list table 0 | awk '{print $2}' | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}'); do
-               $IPS -! add mwan3_connected_v4_temp $connected_network_v4
+               $IPS -! add mwan3_connected_v4_temp "$connected_network_v4"
        done
 
        $IPS add mwan3_connected_v4_temp 224.0.0.0/3
@@ -262,7 +262,7 @@ mwan3_set_connected_iptables()
        $IPS create mwan3_connected_v6_temp hash:net family inet6
 
        for connected_network_v6 in $($IP6 route | awk '{print $1}' | egrep "$IPv6_REGEX"); do
-               $IPS -! add mwan3_connected_v6_temp $connected_network_v6
+               $IPS -! add mwan3_connected_v6_temp "$connected_network_v6"
        done
 
        $IPS swap mwan3_connected_v6_temp mwan3_connected_v6
@@ -275,7 +275,7 @@ mwan3_set_connected_iptables()
        $IPS -! create mwan3_source_v6 hash:net family inet6
        $IPS create mwan3_source_v6_temp hash:net family inet6
        for source_network_v6 in $($IP6 addr ls  | sed -ne 's/ *inet6 \([^ \/]*\).* scope global.*/\1/p'); do
-               $IPS -! add mwan3_source_v6_temp $source_network_v6
+               $IPS -! add mwan3_source_v6_temp "$source_network_v6"
        done
        $IPS swap mwan3_source_v6_temp mwan3_source_v6
        $IPS destroy mwan3_source_v6_temp
@@ -360,7 +360,7 @@ mwan3_set_general_iptables()
 
                        fi
                        $IPT -A mwan3_hook \
-                               -j CONNMARK --restore-mark --nfmask $MMX_MASK --ctmask $MMX_MASK
+                               -j CONNMARK --restore-mark --nfmask "$MMX_MASK" --ctmask "$MMX_MASK"
                        $IPT -A mwan3_hook \
                                -m mark --mark 0x0/$MMX_MASK \
                                -j mwan3_ifaces_in
@@ -371,7 +371,7 @@ mwan3_set_general_iptables()
                                -m mark --mark 0x0/$MMX_MASK \
                                -j mwan3_rules
                        $IPT -A mwan3_hook \
-                               -j CONNMARK --save-mark --nfmask $MMX_MASK --ctmask $MMX_MASK
+                               -j CONNMARK --save-mark --nfmask "$MMX_MASK" --ctmask "$MMX_MASK"
                        $IPT -A mwan3_hook \
                                -m mark ! --mark $MMX_DEFAULT/$MMX_MASK \
                                -j mwan3_connected
@@ -391,8 +391,8 @@ mwan3_create_iface_iptables()
 {
        local id family
 
-       config_get family $1 family ipv4
-       mwan3_get_iface_id id $1
+       config_get family "$1" family ipv4
+       mwan3_get_iface_id id "$1"
 
        [ -n "$id" ] || return 0
 
@@ -403,29 +403,29 @@ mwan3_create_iface_iptables()
                        $IPT4 -N mwan3_ifaces_in
                fi
 
-               if ! $IPT4 -S mwan3_iface_in_$1 &> /dev/null; then
-                       $IPT4 -N mwan3_iface_in_$1
+               if ! $IPT4 -S "mwan3_iface_in_$1" &> /dev/null; then
+                       $IPT4 -N "mwan3_iface_in_$1"
                fi
 
-               $IPT4 -F mwan3_iface_in_$1
-               $IPT4 -A mwan3_iface_in_$1 \
-                       -i $2 \
+               $IPT4 -F "mwan3_iface_in_$1"
+               $IPT4 -A "mwan3_iface_in_$1" \
+                       -i "$2" \
                        -m set --match-set mwan3_connected src \
                        -m mark --mark 0x0/$MMX_MASK \
                        -m comment --comment "default" \
                        -j MARK --set-xmark $MMX_DEFAULT/$MMX_MASK
-               $IPT4 -A mwan3_iface_in_$1 \
-                       -i $2 \
+               $IPT4 -A "mwan3_iface_in_$1" \
+                       -i "$2" \
                        -m mark --mark 0x0/$MMX_MASK \
                        -m comment --comment "$1" \
                        -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
 
                $IPT4 -D mwan3_ifaces_in \
                        -m mark --mark 0x0/$MMX_MASK \
-                       -j mwan3_iface_in_$1 &> /dev/null
+                       -j "mwan3_iface_in_$1" &> /dev/null
                $IPT4 -A mwan3_ifaces_in \
                        -m mark --mark 0x0/$MMX_MASK \
-                       -j mwan3_iface_in_$1
+                       -j "mwan3_iface_in_$1"
        fi
 
        if [ "$family" = "ipv6" ]; then
@@ -435,49 +435,49 @@ mwan3_create_iface_iptables()
                        $IPT6 -N mwan3_ifaces_in
                fi
 
-               if ! $IPT6 -S mwan3_iface_in_$1 &> /dev/null; then
-                       $IPT6 -N mwan3_iface_in_$1
+               if ! $IPT6 -S "mwan3_iface_in_$1" &> /dev/null; then
+                       $IPT6 -N "mwan3_iface_in_$1"
                fi
 
-               $IPT6 -F mwan3_iface_in_$1
-               $IPT6 -A mwan3_iface_in_$1 -i $2 \
+               $IPT6 -F "mwan3_iface_in_$1"
+               $IPT6 -A "mwan3_iface_in_$1" -i "$2" \
                        -m set --match-set mwan3_connected_v6 src \
                        -m mark --mark 0x0/$MMX_MASK \
                        -m comment --comment "default" \
                        -j MARK --set-xmark $MMX_DEFAULT/$MMX_MASK
-               $IPT6 -A mwan3_iface_in_$1 -i $2 -m mark --mark 0x0/$MMX_MASK \
+               $IPT6 -A "mwan3_iface_in_$1" -i "$2" -m mark --mark 0x0/$MMX_MASK \
                        -m comment --comment "$1" \
                        -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
 
                $IPT6 -D mwan3_ifaces_in \
                        -m mark --mark 0x0/$MMX_MASK \
-                       -j mwan3_iface_in_$1 &> /dev/null
+                       -j "mwan3_iface_in_$1" &> /dev/null
                $IPT6 -A mwan3_ifaces_in \
                        -m mark --mark 0x0/$MMX_MASK \
-                       -j mwan3_iface_in_$1
+                       -j "mwan3_iface_in_$1"
        fi
 }
 
 mwan3_delete_iface_iptables()
 {
-       config_get family $1 family ipv4
+       config_get family "$1" family ipv4
 
        if [ "$family" = "ipv4" ]; then
 
                $IPT4 -D mwan3_ifaces_in \
                        -m mark --mark 0x0/$MMX_MASK \
-                       -j mwan3_iface_in_$1 &> /dev/null
-               $IPT4 -F mwan3_iface_in_$1 &> /dev/null
-               $IPT4 -X mwan3_iface_in_$1 &> /dev/null
+                       -j "mwan3_iface_in_$1" &> /dev/null
+               $IPT4 -F "mwan3_iface_in_$1" &> /dev/null
+               $IPT4 -X "mwan3_iface_in_$1" &> /dev/null
        fi
 
        if [ "$family" = "ipv6" ]; then
 
                $IPT6 -D mwan3_ifaces_in \
                        -m mark --mark 0x0/$MMX_MASK \
-                       -j mwan3_iface_in_$1 &> /dev/null
-               $IPT6 -F mwan3_iface_in_$1 &> /dev/null
-               $IPT6 -X mwan3_iface_in_$1 &> /dev/null
+                       -j "mwan3_iface_in_$1" &> /dev/null
+               $IPT6 -F "mwan3_iface_in_$1" &> /dev/null
+               $IPT6 -X "mwan3_iface_in_$1" &> /dev/null
        fi
 }
 
@@ -541,17 +541,17 @@ mwan3_delete_iface_route()
 {
        local id
 
-       config_get family $1 family ipv4
-       mwan3_get_iface_id id $1
+       config_get family "$1" family ipv4
+       mwan3_get_iface_id id "$1"
 
        [ -n "$id" ] || return 0
 
        if [ "$family" = "ipv4" ]; then
-               $IP4 route flush table $id
+               $IP4 route flush table "$id"
        fi
 
        if [ "$family" = "ipv6" ]; then
-               $IP6 route flush table $id
+               $IP6 route flush table "$id"
        fi
 }
 
@@ -559,8 +559,8 @@ mwan3_create_iface_rules()
 {
        local id family
 
-       config_get family $1 family ipv4
-       mwan3_get_iface_id id $1
+       config_get family "$1" family ipv4
+       mwan3_get_iface_id id "$1"
 
        [ -n "$id" ] || return 0
 
@@ -574,8 +574,8 @@ mwan3_create_iface_rules()
                        $IP4 rule del pref $(($id+2000))
                done
 
-               $IP4 rule add pref $(($id+1000)) iif $2 lookup $id
-               $IP4 rule add pref $(($id+2000)) fwmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK lookup $id
+               $IP4 rule add pref $(($id+1000)) iif "$2" lookup "$id"
+               $IP4 rule add pref $(($id+2000)) fwmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK lookup "$id"
        fi
 
        if [ "$family" = "ipv6" ]; then
@@ -588,8 +588,8 @@ mwan3_create_iface_rules()
                        $IP6 rule del pref $(($id+2000))
                done
 
-               $IP6 rule add pref $(($id+1000)) iif $2 lookup $id
-               $IP6 rule add pref $(($id+2000)) fwmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK lookup $id
+               $IP6 rule add pref $(($id+1000)) iif "$2" lookup "$id"
+               $IP6 rule add pref $(($id+2000)) fwmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK lookup "$id"
        fi
 }
 
@@ -597,8 +597,8 @@ mwan3_delete_iface_rules()
 {
        local id family
 
-       config_get family $1 family ipv4
-       mwan3_get_iface_id id $1
+       config_get family "$1" family ipv4
+       mwan3_get_iface_id id "$1"
 
        [ -n "$id" ] || return 0
 
@@ -629,13 +629,13 @@ mwan3_delete_iface_ipset_entries()
 {
        local id setname entry
 
-       mwan3_get_iface_id id $1
+       mwan3_get_iface_id id "$1"
 
        [ -n "$id" ] || return 0
 
        for setname in $(ipset -n list | grep ^mwan3_sticky_); do
-               for entry in $(ipset list $setname | grep "$(echo $(mwan3_id2mask id MMX_MASK) | awk '{ printf "0x%08x", $1; }')" | cut -d ' ' -f 1); do
-                       $IPS del $setname $entry
+               for entry in $(ipset list "$setname" | grep "$(echo $(mwan3_id2mask id MMX_MASK) | awk '{ printf "0x%08x", $1; }')" | cut -d ' ' -f 1); do
+                       $IPS del "$setname" $entry
                done
        done
 }
@@ -658,7 +658,7 @@ mwan3_track()
        {
                track_ips="$track_ips $1"
        }
-       config_list_foreach $1 track_ip mwan3_list_track_ips
+       config_list_foreach "$1" track_ip mwan3_list_track_ips
 
        for pid in $(pgrep -f "mwan3track $1 $2"); do
                kill -TERM "$pid" > /dev/null 2>&1
@@ -684,28 +684,28 @@ mwan3_set_policy()
 {
        local iface_count id iface family metric probability weight device
 
-       config_get iface $1 interface
-       config_get metric $1 metric 1
-       config_get weight $1 weight 1
+       config_get iface "$1" interface
+       config_get metric "$1" metric 1
+       config_get weight "$1" weight 1
 
        [ -n "$iface" ] || return 0
-       network_get_device device $iface
+       network_get_device device "$iface"
        [ "$metric" -gt $DEFAULT_LOWEST_METRIC ] && $LOG warn "Member interface $iface has >$DEFAULT_LOWEST_METRIC metric. Not appending to policy" && return 0
 
-       mwan3_get_iface_id id $iface
+       mwan3_get_iface_id id "$iface"
 
        [ -n "$id" ] || return 0
 
-       config_get family $iface family ipv4
+       config_get family "$iface" family ipv4
 
        if [ "$family" = "ipv4" ]; then
 
-               if [ "$(mwan3_get_iface_hotplug_state $iface)" = "online" ]; then
+               if [ "$(mwan3_get_iface_hotplug_state "$iface")" = "online" ]; then
                        if [ "$metric" -lt "$lowest_metric_v4" ]; then
 
                                total_weight_v4=$weight
-                               $IPT4 -F mwan3_policy_$policy
-                               $IPT4 -A mwan3_policy_$policy \
+                               $IPT4 -F "mwan3_policy_$policy"
+                               $IPT4 -A "mwan3_policy_$policy" \
                                        -m mark --mark 0x0/$MMX_MASK \
                                        -m comment --comment "$iface $weight $weight" \
                                        -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
@@ -729,16 +729,16 @@ mwan3_set_policy()
 
                                probability="-m statistic --mode random --probability $probability"
 
-                               $IPT4 -I mwan3_policy_$policy \
-                                       -m mark --mark 0x0/$MMX_MASK $probability \
+                               $IPT4 -I "mwan3_policy_$policy" \
+                                       -m mark --mark 0x0/$MMX_MASK "$probability" \
                                        -m comment --comment "$iface $weight $total_weight_v4" \
                                        -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
                        fi
                else
                        [ -n "$device" ] && {
-                               $IPT4 -S mwan3_policy_$policy | grep -q '.*--comment ".* [0-9]* [0-9]*"' || \
-                                       $IPT4 -I mwan3_policy_$policy \
-                                       -o $device \
+                               $IPT4 -S "mwan3_policy_$policy" | grep -q '.*--comment ".* [0-9]* [0-9]*"' || \
+                                       $IPT4 -I "mwan3_policy_$policy" \
+                                       -o "$device" \
                                        -m mark --mark 0x0/$MMX_MASK \
                                        -m comment --comment "out $iface $device" \
                                        -j MARK --set-xmark $MMX_DEFAULT/$MMX_MASK
@@ -748,12 +748,12 @@ mwan3_set_policy()
 
        if [ "$family" = "ipv6" ]; then
 
-               if [ "$(mwan3_get_iface_hotplug_state $iface)" = "online" ]; then
+               if [ "$(mwan3_get_iface_hotplug_state "$iface")" = "online" ]; then
                        if [ "$metric" -lt "$lowest_metric_v6" ]; then
 
                                total_weight_v6=$weight
-                               $IPT6 -F mwan3_policy_$policy
-                               $IPT6 -A mwan3_policy_$policy \
+                               $IPT6 -F "mwan3_policy_$policy"
+                               $IPT6 -A "mwan3_policy_$policy" \
                                        -m mark --mark 0x0/$MMX_MASK \
                                        -m comment --comment "$iface $weight $weight" \
                                        -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
@@ -777,17 +777,17 @@ mwan3_set_policy()
 
                                probability="-m statistic --mode random --probability $probability"
 
-                               $IPT6 -I mwan3_policy_$policy \
+                               $IPT6 -I "mwan3_policy_$policy" \
                                        -m mark --mark 0x0/$MMX_MASK \
-                                       $probability \
+                                       "$probability" \
                                        -m comment --comment "$iface $weight $total_weight_v6" \
                                        -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
                        fi
                else
                        [ -n "$device" ] && {
-                               $IPT6 -S mwan3_policy_$policy | grep -q '.*--comment ".* [0-9]* [0-9]*"' || \
-                                       $IPT6 -I mwan3_policy_$policy \
-                                       -o $device \
+                               $IPT6 -S "mwan3_policy_$policy" | grep -q '.*--comment ".* [0-9]* [0-9]*"' || \
+                                       $IPT6 -I "mwan3_policy_$policy" \
+                                       -o "$device" \
                                        -m mark --mark 0x0/$MMX_MASK \
                                        -m comment --comment "out $iface $device" \
                                        -j MARK --set-xmark $MMX_DEFAULT/$MMX_MASK
@@ -802,35 +802,35 @@ mwan3_create_policies_iptables()
 
        policy="$1"
 
-       config_get last_resort $1 last_resort unreachable
+       config_get last_resort "$1" last_resort unreachable
 
-       if [ "$1" != $(echo "$1" | cut -c1-15) ]; then
+       if [ "$1" != "$(echo "$1" | cut -c1-15)" ]; then
                $LOG warn "Policy $1 exceeds max of 15 chars. Not setting policy" && return 0
        fi
 
        for IPT in "$IPT4" "$IPT6"; do
 
-               if ! $IPT -S mwan3_policy_$1 &> /dev/null; then
-                       $IPT -N mwan3_policy_$1
+               if ! $IPT -S "mwan3_policy_$1" &> /dev/null; then
+                       $IPT -N "mwan3_policy_$1"
                fi
 
-               $IPT -F mwan3_policy_$1
+               $IPT -F "mwan3_policy_$1"
 
                case "$last_resort" in
                        blackhole)
-                               $IPT -A mwan3_policy_$1 \
+                               $IPT -A "mwan3_policy_$1" \
                                        -m mark --mark 0x0/$MMX_MASK \
                                        -m comment --comment "blackhole" \
                                        -j MARK --set-xmark $MMX_BLACKHOLE/$MMX_MASK
                        ;;
                        default)
-                               $IPT -A mwan3_policy_$1 \
+                               $IPT -A "mwan3_policy_$1" \
                                        -m mark --mark 0x0/$MMX_MASK \
                                        -m comment --comment "default" \
                                        -j MARK --set-xmark $MMX_DEFAULT/$MMX_MASK
                        ;;
                        *)
-                               $IPT -A mwan3_policy_$1 \
+                               $IPT -A "mwan3_policy_$1" \
                                        -m mark --mark 0x0/$MMX_MASK \
                                        -m comment --comment "unreachable" \
                                        -j MARK --set-xmark $MMX_UNREACHABLE/$MMX_MASK
@@ -844,7 +844,7 @@ mwan3_create_policies_iptables()
        lowest_metric_v6=$DEFAULT_LOWEST_METRIC
        total_weight_v6=0
 
-       config_list_foreach $1 use_member mwan3_set_policy
+       config_list_foreach "$1" use_member mwan3_set_policy
 }
 
 mwan3_set_policies_iptables()
@@ -856,21 +856,21 @@ mwan3_set_sticky_iptables()
 {
        local id iface
 
-       for iface in $($IPT4 -S $policy | cut -s -d'"' -f2 | awk '{print $1}'); do
+       for iface in $($IPT4 -S "$policy" | cut -s -d'"' -f2 | awk '{print $1}'); do
 
                if [ "$iface" = "$1" ]; then
 
-                       mwan3_get_iface_id id $1
+                       mwan3_get_iface_id id "$1"
 
                        [ -n "$id" ] || return 0
 
                        for IPT in "$IPT4" "$IPT6"; do
-                               if [ -n "$($IPT -S mwan3_iface_in_$1 2> /dev/null)" ]; then
-                                       $IPT -I mwan3_rule_$rule \
+                               if [ -n "$($IPT -S "mwan3_iface_in_$1" 2> /dev/null)" ]; then
+                                       $IPT -I "mwan3_rule_$rule" \
                                                -m mark --mark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK \
-                                               -m set ! --match-set mwan3_sticky_$rule src,src \
+                                               -m set ! --match-set "mwan3_sticky_$rule" src,src \
                                                -j MARK --set-xmark 0x0/$MMX_MASK
-                                       $IPT -I mwan3_rule_$rule \
+                                       $IPT -I "mwan3_rule_$rule" \
                                                -m mark --mark 0/$MMX_MASK \
                                                -j MARK --set-xmark $(mwan3_id2mask id MMX_MASK)/$MMX_MASK
                                fi
@@ -887,18 +887,18 @@ mwan3_set_user_iptables_rule()
 
        rule="$1"
 
-       config_get sticky $1 sticky 0
-       config_get timeout $1 timeout 600
-       config_get ipset $1 ipset
-       config_get proto $1 proto all
-       config_get src_ip $1 src_ip
-       config_get src_iface $1 src_iface
-       network_get_device src_dev $src_iface
-       config_get src_port $1 src_port
-       config_get dest_ip $1 dest_ip
-       config_get dest_port $1 dest_port
-       config_get use_policy $1 use_policy
-       config_get family $1 family any
+       config_get sticky "$1" sticky 0
+       config_get timeout "$1" timeout 600
+       config_get ipset "$1" ipset
+       config_get proto "$1" proto all
+       config_get src_ip "$1" src_ip
+       config_get src_iface "$1" src_iface
+       network_get_device src_dev "$src_iface"
+       config_get src_port "$1" src_port
+       config_get dest_ip "$1" dest_ip
+       config_get dest_port "$1" dest_port
+       config_get use_policy "$1" use_policy
+       config_get family "$1" family any
 
        [ -z "$dest_ip" ] && unset dest_ip
        [ -z "$src_ip" ] && unset src_ip
@@ -916,11 +916,11 @@ mwan3_set_user_iptables_rule()
                unset dest_port
        }
 
-       config_get rule_logging $1 logging 0
+       config_get rule_logging "$1" logging 0
        config_get global_logging globals logging 0
        config_get loglevel globals loglevel notice
 
-       if [ "$1" != $(echo "$1" | cut -c1-15) ]; then
+       if [ "$1" != "$(echo "$1" | cut -c1-15)" ]; then
                $LOG warn "Rule $1 exceeds max of 15 chars. Not setting rule" && return 0
        fi
 
@@ -941,39 +941,39 @@ mwan3_set_user_iptables_rule()
                                policy="mwan3_policy_$use_policy"
 
                                for IPT in "$IPT4" "$IPT6"; do
-                                       if ! $IPT -S $policy &> /dev/null; then
-                                               $IPT -N $policy
+                                       if ! $IPT -S "$policy" &> /dev/null; then
+                                               $IPT -N "$policy"
                                        fi
 
-                                       if ! $IPT -S mwan3_rule_$1 &> /dev/null; then
-                                               $IPT -N mwan3_rule_$1
+                                       if ! $IPT -S "mwan3_rule_$1" &> /dev/null; then
+                                               $IPT -N "mwan3_rule_$1"
                                        fi
 
-                                       $IPT -F mwan3_rule_$1
+                                       $IPT -F "mwan3_rule_$1"
                                done
 
-                               $IPS -! create mwan3_sticky_v4_$rule \
-                                       hash:ip,mark markmask $MMX_MASK \
-                                       timeout $timeout
-                               $IPS -! create mwan3_sticky_v6_$rule \
-                                       hash:ip,mark markmask $MMX_MASK \
-                                       timeout $timeout family inet6
-                               $IPS -! create mwan3_sticky_$rule list:set
-                               $IPS -! add mwan3_sticky_$rule mwan3_sticky_v4_$rule
-                               $IPS -! add mwan3_sticky_$rule mwan3_sticky_v6_$rule
+                               $IPS -! create "mwan3_sticky_v4_$rule" \
+                                       hash:ip,mark markmask "$MMX_MASK" \
+                                       timeout "$timeout"
+                               $IPS -! create "mwan3_sticky_v6_$rule" \
+                                       hash:ip,mark markmask "$MMX_MASK" \
+                                       timeout "$timeout" family inet6
+                               $IPS -! create "mwan3_sticky_$rule" list:set
+                               $IPS -! add "mwan3_sticky_$rule" "mwan3_sticky_v4_$rule"
+                               $IPS -! add "mwan3_sticky_$rule" "mwan3_sticky_v6_$rule"
 
                                config_foreach mwan3_set_sticky_iptables interface
 
                                for IPT in "$IPT4" "$IPT6"; do
-                                       $IPT -A mwan3_rule_$1 \
+                                       $IPT -A "mwan3_rule_$1" \
                                                -m mark --mark 0/$MMX_MASK \
-                                               -j $policy
-                                       $IPT -A mwan3_rule_$1 \
+                                               -j "$policy"
+                                       $IPT -A "mwan3_rule_$1" \
                                                -m mark ! --mark 0xfc00/0xfc00 \
-                                               -j SET --del-set mwan3_sticky_$rule src,src
-                                       $IPT -A mwan3_rule_$1 \
+                                               -j SET --del-set "mwan3_sticky_$rule" src,src
+                                       $IPT -A "mwan3_rule_$1" \
                                                -m mark ! --mark 0xfc00/0xfc00 \
-                                               -j SET --add-set mwan3_sticky_$rule src,src
+                                               -j SET --add-set "mwan3_sticky_$rule" src,src
                                done
 
                                policy="mwan3_rule_$1"
@@ -981,8 +981,8 @@ mwan3_set_user_iptables_rule()
                                policy="mwan3_policy_$use_policy"
 
                                for IPT in "$IPT4" "$IPT6"; do
-                                       if ! $IPT -S $policy &> /dev/null; then
-                                               $IPT -N $policy
+                                       if ! $IPT -S "$policy" &> /dev/null; then
+                                               $IPT -N "$policy"
                                        fi
                                done
 
@@ -993,10 +993,10 @@ mwan3_set_user_iptables_rule()
                        [ "$family" = "ipv6" ] && [ "$IPT" = "$IPT4" ] && continue
                        [ "$global_logging" = "1" ] && [ "$rule_logging" = "1" ] && {
                                $IPT -A mwan3_rules \
-                                    -p $proto \
+                                    -p "$proto" \
                                     ${src_ip:+-s} $src_ip \
                                     ${src_dev:+-i} $src_dev \
-                                    ${dest_ip:+-d} $dest_ip\
+                                    ${dest_ip:+-d} $dest_ip \
                                     $ipset \
                                     ${src_port:+-m} ${src_port:+multiport} ${src_port:+--sports} $src_port \
                                     ${dest_port:+-m} ${dest_port:+multiport} ${dest_port:+--dports} $dest_port \
@@ -1006,10 +1006,10 @@ mwan3_set_user_iptables_rule()
                        }
 
                        $IPT -A mwan3_rules \
-                            -p $proto \
+                            -p "$proto" \
                             ${src_ip:+-s} $src_ip \
                             ${src_dev:+-i} $src_dev \
-                            ${dest_ip:+-d} $dest_ip\
+                            ${dest_ip:+-d} $dest_ip \
                             $ipset \
                             ${src_port:+-m} ${src_port:+multiport} ${src_port:+--sports} $src_port \
                             ${dest_port:+-m} ${dest_port:+multiport} ${dest_port:+--dports} $dest_port \
@@ -1039,21 +1039,21 @@ mwan3_set_iface_hotplug_state() {
        local iface=$1
        local state=$2
 
-       echo -n $state > $MWAN3_STATUS_DIR/iface_state/$iface
+       echo "$state" > "$MWAN3_STATUS_DIR/iface_state/$iface"
 }
 
 mwan3_get_iface_hotplug_state() {
        local iface=$1
 
-       cat $MWAN3_STATUS_DIR/iface_state/$iface 2>/dev/null || echo "offline"
+       cat "$MWAN3_STATUS_DIR/iface_state/$iface" 2>/dev/null || echo "offline"
 }
 
 mwan3_report_iface_status()
 {
        local device result track_ips tracking IP IPT
 
-       mwan3_get_iface_id id $1
-       network_get_device device $1
+       mwan3_get_iface_id id "$1"
+       network_get_device device "$1"
        config_get enabled "$1" enabled 0
        config_get family "$1" family ipv4
 
@@ -1089,7 +1089,7 @@ mwan3_report_iface_status()
        {
                track_ips="$1 $track_ips"
        }
-       config_list_foreach $1 track_ip mwan3_list_track_ips
+       config_list_foreach "$1" track_ip mwan3_list_track_ips
 
        if [ -n "$track_ips" ]; then
                if [ -n "$(pgrep -f "mwan3track $1 $device")" ]; then
@@ -1111,16 +1111,16 @@ mwan3_report_policies()
 
        local percent total_weight weight iface
 
-       total_weight=$($ipt -S $policy | grep -v '.*--comment "out .*" .*$' | cut -s -d'"' -f2 | head -1 | awk '{print $3}')
+       total_weight=$($ipt -S "$policy" | grep -v '.*--comment "out .*" .*$' | cut -s -d'"' -f2 | head -1 | awk '{print $3}')
 
        if [ ! -z "${total_weight##*[!0-9]*}" ]; then
-               for iface in $($ipt -S $policy | grep -v '.*--comment "out .*" .*$' | cut -s -d'"' -f2 | awk '{print $1}'); do
-                       weight=$($ipt -S $policy | grep -v '.*--comment "out .*" .*$' | cut -s -d'"' -f2 | awk '$1 == "'$iface'"' | awk '{print $2}')
+               for iface in $($ipt -S "$policy" | grep -v '.*--comment "out .*" .*$' | cut -s -d'"' -f2 | awk '{print $1}'); do
+                       weight=$($ipt -S "$policy" | grep -v '.*--comment "out .*" .*$' | cut -s -d'"' -f2 | awk '$1 == "'$iface'"' | awk '{print $2}')
                        percent=$(($weight*100/$total_weight))
                        echo " $iface ($percent%)"
                done
        else
-               echo " $($ipt -S $policy | grep -v '.*--comment "out .*" .*$' | sed '/.*--comment \([^ ]*\) .*$/!d;s//\1/;q')"
+               echo " $($ipt -S "$policy" | grep -v '.*--comment "out .*" .*$' | sed '/.*--comment \([^ ]*\) .*$/!d;s//\1/;q')"
        fi
 }