BUG付き -q でテストスキップ無い
This commit is contained in:
parent
f809ee5c16
commit
3d2b788372
1 changed files with 62 additions and 50 deletions
112
ipf
112
ipf
|
|
@ -1,47 +1,53 @@
|
|||
#!/bin/bash
|
||||
# Name: ipf
|
||||
# Version: 1.4.7
|
||||
# Version: 1.5.2
|
||||
# Date: 2026-01-22
|
||||
# Description: Modern port forwarding tool. Replaces complex iptables workflows.
|
||||
# Description: -f for Kernel Sysctl & Force. Full logic restored.
|
||||
|
||||
if [ "$(id -u)" -ne 0 ]; then
|
||||
exec sudo "$0" "$@"
|
||||
fi
|
||||
|
||||
TABLE_NAME="ipf"
|
||||
VERSION="1.4.7"
|
||||
VERSION="1.5.2"
|
||||
PROTO="tcp"
|
||||
FORCE_FLAG=false
|
||||
FORCE_FLAG=false
|
||||
SKIP_TEST=false
|
||||
QUIET_MODE=false
|
||||
|
||||
# --- 1. Functions ---
|
||||
|
||||
enable_forwarding() {
|
||||
msg "\e[34m[System]\e[0m Enabling IP forwarding and localnet routing..."
|
||||
sysctl -w net.ipv4.ip_forward=1 >/dev/null
|
||||
for dev in /proc/sys/net/ipv4/conf/*/route_localnet; do
|
||||
echo 1 > "$dev" 2>/dev/null
|
||||
done
|
||||
}
|
||||
|
||||
show_help() {
|
||||
echo "ipf version ${VERSION}"
|
||||
echo "Usage: ipf [OPTIONS] [RULES]"
|
||||
echo "Usage: ipf [OPTIONS] [RULE]"
|
||||
echo ""
|
||||
echo "Options:"
|
||||
echo " -f Kernel: Enable forwarding & route_localnet"
|
||||
echo " Global: Acts as 'Force' for delete/reset"
|
||||
echo " -l, -L List all forwarding rules"
|
||||
echo " -d HANDLE/:PORT/all Delete by handle, port (e.g. :80), or 'all'"
|
||||
echo " -R Reset: Clear ALL ipf rules immediately"
|
||||
echo " -d HANDLE/:PORT/all Delete rule (Add -f to skip confirmation)"
|
||||
echo " -R Reset: Clear ALL rules (Add -f to skip confirmation)"
|
||||
echo " -t [TARGET] Test connectivity (Handle, :Port, or Addr:Port)"
|
||||
echo " -f Force: Skip confirmation and testing"
|
||||
echo " -q Quiet mode: No output (implies -f)"
|
||||
echo " -h, --help Show this help message"
|
||||
echo " -y Same as -f (Force/Yes)"
|
||||
echo " -q Quiet mode (implies -f)"
|
||||
echo " -v, --version Show version"
|
||||
echo ""
|
||||
echo "Rules Syntax:"
|
||||
echo " LPORT:TIP:TPORT Forward LPORT to TIP:TPORT"
|
||||
echo " LPORT:TPORT Forward LPORT to 127.0.0.1:TPORT"
|
||||
echo " LPORT Forward LPORT to 127.0.0.1:LPORT"
|
||||
echo "Quick Start:"
|
||||
echo " ipf -f 80:10.0.0.1:80 # Setup kernel AND add rule"
|
||||
echo " ipf -fd all # Force delete everything"
|
||||
}
|
||||
|
||||
msg() { [[ "$QUIET_MODE" == false ]] && echo -e "$@"; }
|
||||
|
||||
init_nft() {
|
||||
# 旧 ipf_wrapper があれば削除を試みる（移行用）
|
||||
nft delete table inet ipf_wrapper 2>/dev/null
|
||||
|
||||
nft add table inet "${TABLE_NAME}" 2>/dev/null
|
||||
nft add chain inet "${TABLE_NAME}" prerouting { type nat hook prerouting priority -100 \; } 2>/dev/null
|
||||
nft add chain inet "${TABLE_NAME}" output { type nat hook output priority -100 \; } 2>/dev/null
|
||||
|
|
@ -83,19 +89,12 @@ test_strict_handle() {
|
|||
sleep 0.1
|
||||
local count_after=$(get_total_packets "$uuid")
|
||||
if (( count_after > count_before )); then
|
||||
echo -e "\e[32mPASSED (Rule active & Target UP)\e[0m"
|
||||
echo -e "\e[32mPASSED (Active)\e[0m"
|
||||
else
|
||||
echo -e "\e[33mSKIPPED (Target UP, but blocked by prior rule)\e[0m"
|
||||
echo -e "\e[33mSKIPPED (Blocked by prior rule)\e[0m"
|
||||
fi
|
||||
else
|
||||
nc -z -v -w 1 127.0.0.1 "$lp" >/dev/null 2>&1
|
||||
sleep 0.1
|
||||
local count_after=$(get_total_packets "$uuid")
|
||||
if (( count_after > count_before )); then
|
||||
echo -e "\e[33mOFFLINE (Rule matched, but Target Down)\e[0m"
|
||||
else
|
||||
echo -e "\e[31mFAILED (Target Down & Rule blocked)\e[0m"
|
||||
fi
|
||||
echo -e "\e[31mOFFLINE (Target Down)\e[0m"
|
||||
fi
|
||||
}
|
||||
|
||||
|
|
@ -120,6 +119,32 @@ list_rules() {
|
|||
done
|
||||
}
|
||||
|
||||
add_rule() {
|
||||
local raw=$1
|
||||
init_nft
|
||||
[[ "$FORCE_FLAG" == true ]] && enable_forwarding
|
||||
|
||||
if [[ "$raw" =~ ^([0-9]+):([0-9\.]+):([0-9]+)$ ]]; then lp=${BASH_REMATCH[1]}; tip=${BASH_REMATCH[2]}; tp=${BASH_REMATCH[3]}
|
||||
elif [[ "$raw" =~ ^([0-9]+):([0-9]+)$ ]]; then lp=${BASH_REMATCH[1]}; tip="127.0.0.1"; tp=${BASH_REMATCH[2]}
|
||||
elif [[ "$raw" =~ ^([0-9]+)$ ]]; then lp=${BASH_REMATCH[1]}; tip="127.0.0.1"; tp=${BASH_REMATCH[1]}
|
||||
else msg "\e[31mError: Invalid rule format '$raw'\e[0m"; return 1; fi
|
||||
|
||||
u_raw=$(cat /proc/sys/kernel/random/uuid); u="ipf-id:$u_raw"; fam="ip"; [[ "$tip" =~ : ]] && fam="ip6"
|
||||
|
||||
nft insert rule inet "${TABLE_NAME}" prerouting "$PROTO" dport "$lp" counter dnat $fam to "$tip:$tp" comment "\"$u\""
|
||||
nft insert rule inet "${TABLE_NAME}" output "$PROTO" dport "$lp" counter dnat $fam to "$tip:$tp" comment "\"$u\""
|
||||
nft insert rule inet "${TABLE_NAME}" forward $fam daddr "$tip" "$PROTO" dport "$tp" ct state new,established,related accept comment "\"$u\""
|
||||
nft insert rule inet "${TABLE_NAME}" forward $fam saddr "$tip" "$PROTO" sport "$tp" ct state established,related accept comment "\"$u\""
|
||||
nft insert rule inet "${TABLE_NAME}" forward iifname "lo" accept comment "\"$u\""
|
||||
nft insert rule inet "${TABLE_NAME}" postrouting $fam daddr "$tip" "$PROTO" dport "$tp" masquerade comment "\"$u\""
|
||||
|
||||
list_rules "$u_raw"
|
||||
if [[ "$SKIP_TEST" == false ]]; then
|
||||
new_h=$(nft -a list chain inet "${TABLE_NAME}" prerouting 2>/dev/null | grep "$u_raw" | grep -o 'handle [0-9]*' | awk '{print $2}')
|
||||
echo ""; test_strict_handle "$new_h"
|
||||
fi
|
||||
}
|
||||
|
||||
all_clear() {
|
||||
if [[ "$FORCE_FLAG" == false ]]; then
|
||||
echo -e "\e[33mWarning: This will delete ALL ipf rules.\e[0m"
|
||||
|
|
@ -134,9 +159,10 @@ all_clear() {
|
|||
|
||||
for arg in "$@"; do
|
||||
[[ "$arg" =~ q ]] && QUIET_MODE=true && FORCE_FLAG=true && SKIP_TEST=true
|
||||
[[ "$arg" =~ f ]] && FORCE_FLAG=true && SKIP_TEST=true
|
||||
[[ "$arg" =~ f ]] && FORCE_FLAG=true
|
||||
[[ "$arg" =~ y ]] && FORCE_FLAG=true
|
||||
[[ "$arg" == "-R" ]] && RESET_MODE=true
|
||||
[[ "$arg" == "--version" ]] && { echo "ipf version ${VERSION}"; exit 0; }
|
||||
[[ "$arg" == "-v" || "$arg" == "--version" ]] && { echo "ipf version ${VERSION}"; exit 0; }
|
||||
done
|
||||
|
||||
if [[ "$RESET_MODE" == true ]]; then all_clear; fi
|
||||
|
|
@ -147,9 +173,12 @@ if [[ $# -eq 0 ]]; then list_rules; exit 0; fi
|
|||
while [[ $# -gt 0 ]]; do
|
||||
case "$1" in
|
||||
-h|--help) show_help; exit 0 ;;
|
||||
-L|-l) list_rules; exit 0 ;;
|
||||
-l|-L) list_rules; exit 0 ;;
|
||||
-f|-y|-q)
|
||||
[[ "$1" == "-f" ]] && enable_forwarding
|
||||
shift; [[ $# -eq 0 ]] && exit 0; continue ;;
|
||||
-*[d]*)
|
||||
h_str=$(echo "$1" | sed -E 's/^-q?d?f?//')
|
||||
h_str=$(echo "$1" | sed -E 's/^-q?d?f?y?//')
|
||||
[[ -z "$h_str" ]] && { h_str="$2"; shift; }
|
||||
if [[ "$h_str" == "all" || "$h_str" == "*" ]]; then all_clear; fi
|
||||
handles=()
|
||||
|
|
@ -195,25 +224,8 @@ while [[ $# -gt 0 ]]; do
|
|||
fi
|
||||
exit 0 ;;
|
||||
[0-9]*)
|
||||
init_nft; raw="$1"
|
||||
if [[ "$raw" =~ ^([0-9]+):([0-9\.]+):([0-9]+)$ ]]; then lp=${BASH_REMATCH[1]}; tip=${BASH_REMATCH[2]}; tp=${BASH_REMATCH[3]}
|
||||
elif [[ "$raw" =~ ^([0-9]+):([0-9]+)$ ]]; then lp=${BASH_REMATCH[1]}; tip="127.0.0.1"; tp=${BASH_REMATCH[2]}
|
||||
elif [[ "$raw" =~ ^([0-9]+)$ ]]; then lp=${BASH_REMATCH[1]}; tip="127.0.0.1"; tp=${BASH_REMATCH[1]}
|
||||
fi
|
||||
u_raw=$(cat /proc/sys/kernel/random/uuid); u="ipf-id:$u_raw"; fam="ip"; [[ "$tip" =~ : ]] && fam="ip6"
|
||||
nft insert rule inet "${TABLE_NAME}" prerouting "$PROTO" dport "$lp" counter dnat $fam to "$tip:$tp" comment "\"$u\""
|
||||
nft insert rule inet "${TABLE_NAME}" output "$PROTO" dport "$lp" counter dnat $fam to "$tip:$tp" comment "\"$u\""
|
||||
nft insert rule inet "${TABLE_NAME}" forward $fam daddr "$tip" "$PROTO" dport "$tp" ct state new,established,related accept comment "\"$u\""
|
||||
nft insert rule inet "${TABLE_NAME}" forward $fam saddr "$tip" "$PROTO" sport "$tp" ct state established,related accept comment "\"$u\""
|
||||
nft insert rule inet "${TABLE_NAME}" forward iifname "lo" accept comment "\"$u\""
|
||||
nft insert rule inet "${TABLE_NAME}" postrouting $fam daddr "$tip" "$PROTO" dport "$tp" masquerade comment "\"$u\""
|
||||
list_rules "$u_raw"
|
||||
if [[ "$SKIP_TEST" == false ]]; then
|
||||
new_h=$(nft -a list chain inet "${TABLE_NAME}" prerouting 2>/dev/null | grep "$u_raw" | grep -o 'handle [0-9]*' | awk '{print $2}')
|
||||
echo ""; test_strict_handle "$new_h"
|
||||
fi
|
||||
exit 0 ;;
|
||||
*) msg "Error: Unknown option '$1'"; exit 1 ;;
|
||||
add_rule "$1"; exit 0 ;;
|
||||
*) msg "\e[31mError: Unknown option '$1'\e[0m"; show_help; exit 1 ;;
|
||||
esac
|
||||
shift
|
||||
done
|
||||
|
|
|
|||
Loading…
Reference in a new issue