joe/ipf
joe/ipf
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

-t 大幅拡張

Browse source
This commit is contained in:
joe 2026-01-22 15:33:06 +09:00
parent 229f756994
commit 38e518b6f0
1 changed files with 55 additions and 63 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

116
ipfn
View file

@ -1,35 +1,21 @@
#!/bin/bash #!/bin/bash
# Name: ipfn # Name: ipfn
# Version: 1.4.3 # Version: 1.4.5
# Date: 2026-01-22 # Date: 2026-01-22
# Description: Register rules first, then report the "honest" status of the connection. # Description: Fixed regex to correctly distinguish between addr:port and port:addr:port.
if [ "$(id -u)" -ne 0 ]; then if [ "$(id -u)" -ne 0 ]; then
exec sudo "$0" "$@" exec sudo "$0" "$@"
fi fi
TABLE_NAME="ipf_wrapper" TABLE_NAME="ipf_wrapper"
VERSION="1.4.3" VERSION="1.4.5"
PROTO="tcp" PROTO="tcp"
FORCE_FLAG=false FORCE_FLAG=false
SKIP_TEST=false SKIP_TEST=false
QUIET_MODE=false QUIET_MODE=false
# --- 1. Functions --- # --- Functions ---
show_help() {
echo "ipfn version ${VERSION}"
echo "Usage: ipfn [OPTIONS] [RULES]"
echo ""
echo "Options:"
echo " -l, -L List all rules"
echo " -d HANDLE/:PORT/all Delete by handle, port (:80), or 'all'"
echo " -R Reset: Clear ALL rules immediately"
echo " -t [HANDLE / :PORT] Test connectivity (Check both rule and target)"
echo " -f Force: No confirmation & Skip test"
echo " -q Quiet mode (No output)"
echo " -h, --help Show help"
}
msg() { [[ "$QUIET_MODE" == false ]] && echo -e "$@"; } msg() { [[ "$QUIET_MODE" == false ]] && echo -e "$@"; }
@ -49,55 +35,48 @@ get_total_packets() {
echo "$total" echo "$total"
} }
# 登録は完了させた上で、テスト結果だけ「正直に」出す test_connection() {
local ip=$1
local port=$2
nc -z -v -w 1 "$ip" "$port" >/dev/null 2>&1
}
test_strict_handle() { test_strict_handle() {
local h=$1 local h=$1
local silent=$2
local info=$(nft -a list chain inet "${TABLE_NAME}" prerouting 2>/dev/null | grep "handle $h") local info=$(nft -a list chain inet "${TABLE_NAME}" prerouting 2>/dev/null | grep "handle $h")
[[ -z "$info" ]] && { [[ "$silent" != "true" ]] && echo -e "Handle $h \e[31mNOT FOUND\e[0m"; return; } [[ -z "$info" ]] && { echo -e "Handle $h \e[31mNOT FOUND\e[0m"; return; }
local lp=$(echo "$info" | grep -o 'dport [0-9]*' | awk '{print $2}') local lp=$(echo "$info" | grep -o 'dport [0-9]*' | awk '{print $2}')
local target=$(echo "$info" | grep -oE 'to ([0-9.]+|\[[0-9a-fA-F:]+\]):[0-9]+' | awk '{print $2}')
local tip=$(echo "$target" | cut -d':' -f1 | tr -d '[]')
local tp=$(echo "$target" | cut -d':' -f2)
local uuid=$(echo "$info" | grep -o 'ipf-id:[a-z0-9-]*') local uuid=$(echo "$info" | grep -o 'ipf-id:[a-z0-9-]*')
local short_id=$(echo "$uuid" | cut -d':' -f2 | cut -c1-8) local short_id=$(echo "$uuid" | cut -d':' -f2 | cut -c1-8)
[[ "$silent" != "true" ]] && echo -n "Testing handle $h (:$lp) [${short_id}]... " || echo -n "Verifying handle $h on :$lp... " echo -n "Testing handle $h (Local :$lp -> Target $tip:$tp) [${short_id}]... "
local count_before=$(get_total_packets "$uuid") local count_before=$(get_total_packets "$uuid")
# 接続確認 (ターゲットが落ちていてもOK、ただの結果報告) if test_connection "$tip" "$tp"; then
local connect_ok=false nc -z -v -w 1 127.0.0.1 "$lp" >/dev/null 2>&1
nc -z -v -w 1 127.0.0.1 "$lp" >/dev/null 2>&1 && connect_ok=true sleep 0.1
local count_after=$(get_total_packets "$uuid")
sleep 0.1
local count_after=$(get_total_packets "$uuid")
if [[ "$connect_ok" == true ]]; then
if (( count_after > count_before )); then if (( count_after > count_before )); then
echo -e "\e[32mPASSED (Rule matched & Connected)\e[0m" echo -e "\e[32mPASSED (Rule active & Target UP)\e[0m"
else else
echo -e "\e[33mSKIPPED (Connected, but via prior rule)\e[0m" echo -e "\e[33mSKIPPED (Target UP, but blocked by prior rule)\e[0m"
fi fi
else else
# 接続できなかった場合 nc -z -v -w 1 127.0.0.1 "$lp" >/dev/null 2>&1
sleep 0.1
local count_after=$(get_total_packets "$uuid")
if (( count_after > count_before )); then if (( count_after > count_before )); then
# 登録作業は成功しているが、ターゲットが未起動
echo -e "\e[33mOFFLINE (Rule matched, but Target Down)\e[0m" echo -e "\e[33mOFFLINE (Rule matched, but Target Down)\e[0m"
else else
echo -e "\e[31mFAILED (Blocked & No Response)\e[0m" echo -e "\e[31mFAILED (Target Down & Rule blocked)\e[0m"
fi fi
fi fi
} }
test_port_simple() {
local p=$1
echo -n "Testing :$p... "
if nc -z -v -w 1 127.0.0.1 "$p" 2>&1 | grep -iqE "succeeded|connected|open"; then
echo -e "\e[32mOK\e[0m"
else
echo -e "\e[31mOFFLINE (No response)\e[0m"
fi
}
list_rules() { list_rules() {
[[ "$QUIET_MODE" == true ]] && return [[ "$QUIET_MODE" == true ]] && return
local highlight_uuid=$1 local highlight_uuid=$1
@ -129,7 +108,7 @@ all_clear() {
init_nft; msg "All rules cleared successfully."; list_rules; exit 0 init_nft; msg "All rules cleared successfully."; list_rules; exit 0
} }
# --- 2. Flag Pre-processing --- # --- Flag Pre-processing ---
for arg in "$@"; do for arg in "$@"; do
[[ "$arg" =~ q ]] && QUIET_MODE=true && FORCE_FLAG=true && SKIP_TEST=true [[ "$arg" =~ q ]] && QUIET_MODE=true && FORCE_FLAG=true && SKIP_TEST=true
@ -141,11 +120,14 @@ done
if [[ "$RESET_MODE" == true ]]; then all_clear; fi if [[ "$RESET_MODE" == true ]]; then all_clear; fi
if [[ $# -eq 0 ]]; then list_rules; exit 0; fi if [[ $# -eq 0 ]]; then list_rules; exit 0; fi
# --- 3. Main Loop --- # --- Main Loop ---
while [[ $# -gt 0 ]]; do while [[ $# -gt 0 ]]; do
case "$1" in case "$1" in
-h|--help) show_help; exit 0 ;; -h|--help)
echo "Usage: ipfn [OPTIONS] [RULES]"
echo "Tests: -t 5 (handle), -t :80 (port), -t 1.1.1.1:80 (direct), -t 80:1.1.1.1:80 (full)"
exit 0 ;;
-L|-l) list_rules; exit 0 ;; -L|-l) list_rules; exit 0 ;;
-*[d]*) -*[d]*)
h_str=$(echo "$1" | sed -E 's/^-q?d?f?//') h_str=$(echo "$1" | sed -E 's/^-q?d?f?//')
@ -172,16 +154,29 @@ while [[ $# -gt 0 ]]; do
list_rules; exit 0 ;; list_rules; exit 0 ;;
-t*) -t*)
h_str="${1#-t}"; [[ -z "$h_str" && -n "$2" ]] && { h_str="$2"; shift; } h_str="${1#-t}"; [[ -z "$h_str" && -n "$2" ]] && { h_str="$2"; shift; }
if [[ "$h_str" =~ ^:?([0-9]+):?$ ]]; then # 1. port:addr:port
target_val="${BASH_REMATCH[1]}" if [[ "$h_str" =~ ^([0-9]+):([0-9\.]+):([0-9]+)$ ]]; then
if nft -a list chain inet "${TABLE_NAME}" prerouting 2>/dev/null | grep -q "handle $target_val"; then lp=${BASH_REMATCH[1]}; tip=${BASH_REMATCH[2]}; tp=${BASH_REMATCH[3]}
test_strict_handle "$target_val" echo -n "Checking Target $tip:$tp... "
else test_connection "$tip" "$tp" && echo -e "\e[32mUP\e[0m" || echo -e "\e[31mDOWN\e[0m"
test_port_simple "$target_val" echo -n "Checking Local :$lp... "
fi nc -z -v -w 1 127.0.0.1 "$lp" >/dev/null 2>&1 && echo -e "\e[32mOPEN\e[0m" || echo -e "\e[31mCLOSED\e[0m"
# 2. addr:port
elif [[ "$h_str" =~ ^([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+):([0-9]+)$ ]]; then
tip=${BASH_REMATCH[1]}; tp=${BASH_REMATCH[2]}
echo -n "Checking Target $tip:$tp... "
test_connection "$tip" "$tp" && echo -e "\e[32mUP\e[0m" || echo -e "\e[31mDOWN\e[0m"
# 3. :port or port:
elif [[ "$h_str" =~ ^:([0-9]+)$ || "$h_str" =~ ^([0-9]+):$ ]]; then
p="${BASH_REMATCH[1]}${BASH_REMATCH[2]}"
echo -n "Checking Local :$p... "
nc -z -v -w 1 127.0.0.1 "$p" >/dev/null 2>&1 && echo -e "\e[32mOK\e[0m" || echo -e "\e[31mOFFLINE\e[0m"
# 4. handle
elif [[ "$h_str" =~ ^[0-9]+$ ]]; then
test_strict_handle "$h_str"
else else
top_h=$(nft -a list chain inet "${TABLE_NAME}" prerouting 2>/dev/null | grep "dnat" | head -n 1 | grep -o 'handle [0-9]*' | awk '{print $2}') top_h=$(nft -a list chain inet "${TABLE_NAME}" prerouting 2>/dev/null | grep "dnat" | head -n 1 | grep -o 'handle [0-9]*' | awk '{print $2}')
[[ -n "$top_h" ]] && test_strict_handle "$top_h" || msg "Error: No rules found." [[ -n "$top_h" ]] && test_strict_handle "$top_h" || msg "Error: No rules to test."
fi fi
exit 0 ;; exit 0 ;;
[0-9]*) [0-9]*)
@ -191,22 +186,19 @@ while [[ $# -gt 0 ]]; do
elif [[ "$raw" =~ ^([0-9]+)$ ]]; then lp=${BASH_REMATCH[1]}; tip="127.0.0.1"; tp=${BASH_REMATCH[1]} elif [[ "$raw" =~ ^([0-9]+)$ ]]; then lp=${BASH_REMATCH[1]}; tip="127.0.0.1"; tp=${BASH_REMATCH[1]}
fi fi
u_raw=$(cat /proc/sys/kernel/random/uuid); u="ipf-id:$u_raw"; fam="ip"; [[ "$tip" =~ : ]] && fam="ip6" u_raw=$(cat /proc/sys/kernel/random/uuid); u="ipf-id:$u_raw"; fam="ip"; [[ "$tip" =~ : ]] && fam="ip6"
# insertを使うので常に最新が優先
nft insert rule inet "${TABLE_NAME}" prerouting "$PROTO" dport "$lp" counter dnat $fam to "$tip:$tp" comment "\"$u\"" nft insert rule inet "${TABLE_NAME}" prerouting "$PROTO" dport "$lp" counter dnat $fam to "$tip:$tp" comment "\"$u\""
nft insert rule inet "${TABLE_NAME}" output "$PROTO" dport "$lp" counter dnat $fam to "$tip:$tp" comment "\"$u\"" nft insert rule inet "${TABLE_NAME}" output "$PROTO" dport "$lp" counter dnat $fam to "$tip:$tp" comment "\"$u\""
nft insert rule inet "${TABLE_NAME}" forward $fam daddr "$tip" "$PROTO" dport "$tp" ct state new,established,related accept comment "\"$u\"" nft insert rule inet "${TABLE_NAME}" forward $fam daddr "$tip" "$PROTO" dport "$tp" ct state new,established,related accept comment "\"$u\""
nft insert rule inet "${TABLE_NAME}" forward $fam saddr "$tip" "$PROTO" sport "$tp" ct state established,related accept comment "\"$u\"" nft insert rule inet "${TABLE_NAME}" forward $fam saddr "$tip" "$PROTO" sport "$tp" ct state established,related accept comment "\"$u\""
nft insert rule inet "${TABLE_NAME}" forward iifname "lo" accept comment "\"$u\"" nft insert rule inet "${TABLE_NAME}" forward iifname "lo" accept comment "\"$u\""
nft insert rule inet "${TABLE_NAME}" postrouting $fam daddr "$tip" "$PROTO" dport "$tp" masquerade comment "\"$u\"" nft insert rule inet "${TABLE_NAME}" postrouting $fam daddr "$tip" "$PROTO" dport "$tp" masquerade comment "\"$u\""
list_rules "$u_raw" list_rules "$u_raw"
if [[ "$SKIP_TEST" == false ]]; then if [[ "$SKIP_TEST" == false ]]; then
new_h=$(nft -a list chain inet "${TABLE_NAME}" prerouting 2>/dev/null | grep "$u_raw" | grep -o 'handle [0-9]*' | awk '{print $2}') new_h=$(nft -a list chain inet "${TABLE_NAME}" prerouting 2>/dev/null | grep "$u_raw" | grep -o 'handle [0-9]*' | awk '{print $2}')
echo ""; test_strict_handle "$new_h" "true" echo ""; test_strict_handle "$new_h"
fi fi
exit 0 ;; exit 0 ;;
*) msg "Error: Unknown option '$1'"; show_help; exit 1 ;; *) msg "Error: Unknown option '$1'"; exit 1 ;;
esac esac
shift shift
done done