From 2fdc3890a3009d43abd23b7c1fc86bd26915bd6c Mon Sep 17 00:00:00 2001 From: joe Date: Thu, 22 Jan 2026 14:33:04 +0900 Subject: [PATCH] -d debug --- ipfn | 50 +++++++++++++++++++++++++------------------------- 1 file changed, 25 insertions(+), 25 deletions(-) diff --git a/ipfn b/ipfn index 92a12ef..cc015c3 100755 --- a/ipfn +++ b/ipfn @@ -1,8 +1,8 @@ #!/bin/bash # Name: ipfn -# Version: 1.2.6 +# Version: 1.2.7 # Date: 2026-01-22 -# Description: Fixed 'local' variable error in main loop and improved port-test parsing. +# Description: Fixed grep errors after 'all' delete and streamlined exit paths. if [ "$(id -u)" -ne 0 ]; then exec sudo "$0" "$@" @@ -56,7 +56,7 @@ list_rules() { msg "Forwarding Rules (ipfn):" printf "%-10s %-6s %-20s %-20s %-10s\n" "HANDLE" "PROTO" "LOCAL" "TARGET" "UUID" echo "-----------------------------------------------------------------------------------" - nft -a list chain inet ${TABLE_NAME} prerouting | grep "dnat" | while read -r line; do + nft -a list chain inet "${TABLE_NAME}" prerouting | grep "dnat" | while read -r line; do handle=$(echo "$line" | grep -o 'handle [0-9]*' | awk '{print $2}') proto=$(echo "$line" | grep -q "udp" && echo "udp" || echo "tcp") target=$(echo "$line" | grep -oE '([0-9.]+|\[[0-9a-fA-F:]+\]):[0-9]+' | head -n 1) @@ -84,7 +84,7 @@ test_rule_by_port() { # --- 2. Deletion & Reset --- validate_rule_handle() { - nft -a list chain inet ${TABLE_NAME} prerouting | grep "handle $1" | grep -q "dnat" + nft -a list chain inet "${TABLE_NAME}" prerouting | grep "handle $1" | grep -q "dnat" } all_clear() { @@ -93,21 +93,22 @@ all_clear() { read -p "Are you sure? (y/N): " confirm [[ ! "$confirm" =~ ^[yY]$ ]] && exit 0 fi - nft delete table inet ${TABLE_NAME} 2>/dev/null + nft delete table inet "${TABLE_NAME}" 2>/dev/null init_nft msg "All rules cleared successfully." - exit 0 + list_rules + exit 0 # 全削除したらここで終了 } parse_delete_targets() { - local input=$1 + local input="$1" local -a final_handles=() [[ "$input" == "*" || "$input" == "all" ]] && all_clear IFS=',' read -r -a parts <<< "$input" for part in "${parts[@]}"; do if [[ "$part" =~ ^:([0-9]+)$ ]]; then local target_port="${BASH_REMATCH[1]}" - local found_h=$(nft -a list chain inet ${TABLE_NAME} prerouting | grep "dport $target_port" | grep -o 'handle [0-9]*' | awk '{print $2}') + local found_h=$(nft -a list chain inet "${TABLE_NAME}" prerouting | grep "dport $target_port" | grep -o 'handle [0-9]*' | awk '{print $2}') for h in $found_h; do final_handles+=("$h"); done elif [[ "$part" =~ ^([0-9]+)-([0-9]+)$ ]]; then for ((i=${BASH_REMATCH[1]}; i<=${BASH_REMATCH[2]}; i++)); do @@ -124,7 +125,7 @@ parse_delete_targets() { add_rule() { init_nft - local raw_input=$1 + local raw_input="$1" local lp tip tp if [[ "$raw_input" =~ ^([0-9]+):([0-9\.]+):([0-9]+)$ ]]; then lp=${BASH_REMATCH[1]}; tip=${BASH_REMATCH[2]}; tp=${BASH_REMATCH[3]} @@ -138,12 +139,12 @@ add_rule() { local raw_uuid=$(cat /proc/sys/kernel/random/uuid) local uuid="ipf-id:$raw_uuid" local family="ip"; [[ "$tip" =~ : ]] && family="ip6" - nft add rule inet ${TABLE_NAME} prerouting "$PROTO" dport "$lp" dnat $family to "$tip:$tp" comment "\"$uuid\"" - nft add rule inet ${TABLE_NAME} output "$PROTO" dport "$lp" dnat $family to "$tip:$tp" comment "\"$uuid\"" - nft add rule inet ${TABLE_NAME} forward $family daddr "$tip" "$PROTO" dport "$tp" ct state new,established,related accept comment "\"$uuid\"" - nft add rule inet ${TABLE_NAME} forward $family saddr "$tip" "$PROTO" sport "$tp" ct state established,related accept comment "\"$uuid\"" - nft add rule inet ${TABLE_NAME} forward iifname "lo" accept comment "\"$uuid\"" - nft add rule inet ${TABLE_NAME} postrouting $family daddr "$tip" "$PROTO" dport "$tp" masquerade comment "\"$uuid\"" + nft add rule inet "${TABLE_NAME}" prerouting "$PROTO" dport "$lp" dnat $family to "$tip:$tp" comment "\"$uuid\"" + nft add rule inet "${TABLE_NAME}" output "$PROTO" dport "$lp" dnat $family to "$tip:$tp" comment "\"$uuid\"" + nft add rule inet "${TABLE_NAME}" forward $family daddr "$tip" "$PROTO" dport "$tp" ct state new,established,related accept comment "\"$uuid\"" + nft add rule inet "${TABLE_NAME}" forward $family saddr "$tip" "$PROTO" sport "$tp" ct state established,related accept comment "\"$uuid\"" + nft add rule inet "${TABLE_NAME}" forward iifname "lo" accept comment "\"$uuid\"" + nft add rule inet "${TABLE_NAME}" postrouting $family daddr "$tip" "$PROTO" dport "$tp" masquerade comment "\"$uuid\"" list_rules "$raw_uuid" [[ "$SKIP_TEST" == false ]] && { echo ""; test_rule_by_port "$lp"; } } @@ -162,22 +163,21 @@ if [[ $# -eq 0 ]]; then list_rules; exit 0; fi while [[ $# -gt 0 ]]; do case "$1" in -h|--help) show_help; exit 0 ;; - -v|--verbose) nft list table inet ${TABLE_NAME}; exit 0 ;; + -v|--verbose) nft list table inet "${TABLE_NAME}"; exit 0 ;; -L|-l) list_rules; exit 0 ;; -f) enable_forwarding; [[ $# -eq 1 ]] && exit 0 ;; -t*) h_str="${1#-t}" if [[ -z "$h_str" && -n "$2" ]]; then h_str="$2"; shift; fi - target_port="" # 'local' は削除 + target_port="" if [[ "$h_str" =~ ^:?([0-9]+):?$ ]]; then - # -t :80, -t 80:, -t 80 のいずれもポート指定として拾う target_port="${BASH_REMATCH[1]}" elif [[ -n "$h_str" ]]; then - target_port=$(nft -a list chain inet ${TABLE_NAME} prerouting | grep "handle $h_str" | grep -o 'dport [0-9]*' | awk '{print $2}') + target_port=$(nft -a list chain inet "${TABLE_NAME}" prerouting | grep "handle $h_str" | grep -o 'dport [0-9]*' | awk '{print $2}') else - count=$(nft list chain inet ${TABLE_NAME} prerouting | grep -c "dnat") + count=$(nft list chain inet "${TABLE_NAME}" prerouting | grep -c "dnat") if [ "$count" -eq 1 ]; then - target_port=$(nft -a list chain inet ${TABLE_NAME} prerouting | grep "dnat" | grep -o 'dport [0-9]*' | awk '{print $2}') + target_port=$(nft -a list chain inet "${TABLE_NAME}" prerouting | grep "dnat" | grep -o 'dport [0-9]*' | awk '{print $2}') fi fi [[ -n "$target_port" ]] && test_rule_by_port "$target_port" || msg "Error: Port/Handle not found." @@ -190,18 +190,18 @@ while [[ $# -gt 0 ]]; do if [[ "$FORCE_FLAG" == false ]]; then msg "Review rules to delete (Top-level only):" for h in "${handles[@]}"; do - nft -a list chain inet ${TABLE_NAME} prerouting | grep "handle $h" | sed 's/^/ /' + nft -a list chain inet "${TABLE_NAME}" prerouting | grep "handle $h" | sed 's/^/ /' done read -p "Delete these rules and their sub-rules? (y/N): " confirm [[ ! "$confirm" =~ ^[yY]$ ]] && exit 0 fi for h in "${handles[@]}"; do - ri=$(nft -a list chain inet ${TABLE_NAME} prerouting | grep "handle $h") + ri=$(nft -a list chain inet "${TABLE_NAME}" prerouting | grep "handle $h") [[ -z "$ri" ]] && continue uuid=$(echo "$ri" | grep -o 'ipf-id:[a-z0-9-]*' | head -n 1) for c in prerouting output forward postrouting; do - nft -a list chain inet ${TABLE_NAME} "$c" | grep "$uuid" | grep -o 'handle [0-9]*' | awk '{print $2}' | while read -r rh; do - nft delete rule inet ${TABLE_NAME} "$c" handle "$rh" + nft -a list chain inet "${TABLE_NAME}" "$c" | grep "$uuid" | grep -o 'handle [0-9]*' | awk '{print $2}' | while read -r rh; do + nft delete rule inet "${TABLE_NAME}" "$c" handle "$rh" done done msg "Deleted associated with handle $h"