joe/ipf
joe/ipf
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

BUG付き -q でテストスキップ無い

Browse source
This commit is contained in:
joe 2026-01-22 20:53:02 +09:00
parent f809ee5c16
commit 3d2b788372
1 changed files with 62 additions and 50 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

112
ipf
View file

@ -1,47 +1,53 @@
#!/bin/bash #!/bin/bash
# Name: ipf # Name: ipf
# Version: 1.4.7 # Version: 1.5.2
# Date: 2026-01-22 # Date: 2026-01-22
# Description: Modern port forwarding tool. Replaces complex iptables workflows. # Description: -f for Kernel Sysctl & Force. Full logic restored.
if [ "$(id -u)" -ne 0 ]; then if [ "$(id -u)" -ne 0 ]; then
exec sudo "$0" "$@" exec sudo "$0" "$@"
fi fi
TABLE_NAME="ipf" TABLE_NAME="ipf"
VERSION="1.4.7" VERSION="1.5.2"
PROTO="tcp" PROTO="tcp"
FORCE_FLAG=false FORCE_FLAG=false
SKIP_TEST=false SKIP_TEST=false
QUIET_MODE=false QUIET_MODE=false
# --- 1. Functions --- # --- 1. Functions ---
enable_forwarding() {
msg "\e[34m[System]\e[0m Enabling IP forwarding and localnet routing..."
sysctl -w net.ipv4.ip_forward=1 >/dev/null
for dev in /proc/sys/net/ipv4/conf/*/route_localnet; do
echo 1 > "$dev" 2>/dev/null
done
}
show_help() { show_help() {
echo "ipf version ${VERSION}" echo "ipf version ${VERSION}"
echo "Usage: ipf [OPTIONS] [RULES]" echo "Usage: ipf [OPTIONS] [RULE]"
echo "" echo ""
echo "Options:" echo "Options:"
echo " -f Kernel: Enable forwarding & route_localnet"
echo " Global: Acts as 'Force' for delete/reset"
echo " -l, -L List all forwarding rules" echo " -l, -L List all forwarding rules"
echo " -d HANDLE/:PORT/all Delete by handle, port (e.g. :80), or 'all'" echo " -d HANDLE/:PORT/all Delete rule (Add -f to skip confirmation)"
echo " -R Reset: Clear ALL ipf rules immediately" echo " -R Reset: Clear ALL rules (Add -f to skip confirmation)"
echo " -t [TARGET] Test connectivity (Handle, :Port, or Addr:Port)" echo " -t [TARGET] Test connectivity (Handle, :Port, or Addr:Port)"
echo " -f Force: Skip confirmation and testing" echo " -y Same as -f (Force/Yes)"
echo " -q Quiet mode: No output (implies -f)" echo " -q Quiet mode (implies -f)"
echo " -h, --help Show this help message" echo " -v, --version Show version"
echo "" echo ""
echo "Rules Syntax:" echo "Quick Start:"
echo " LPORT:TIP:TPORT Forward LPORT to TIP:TPORT" echo " ipf -f 80:10.0.0.1:80 # Setup kernel AND add rule"
echo " LPORT:TPORT Forward LPORT to 127.0.0.1:TPORT" echo " ipf -fd all # Force delete everything"
echo " LPORT Forward LPORT to 127.0.0.1:LPORT"
} }
msg() { [[ "$QUIET_MODE" == false ]] && echo -e "$@"; } msg() { [[ "$QUIET_MODE" == false ]] && echo -e "$@"; }
init_nft() { init_nft() {
# 旧 ipf_wrapper があれば削除を試みる（移行用）
nft delete table inet ipf_wrapper 2>/dev/null
nft add table inet "${TABLE_NAME}" 2>/dev/null nft add table inet "${TABLE_NAME}" 2>/dev/null
nft add chain inet "${TABLE_NAME}" prerouting { type nat hook prerouting priority -100 \; } 2>/dev/null nft add chain inet "${TABLE_NAME}" prerouting { type nat hook prerouting priority -100 \; } 2>/dev/null
nft add chain inet "${TABLE_NAME}" output { type nat hook output priority -100 \; } 2>/dev/null nft add chain inet "${TABLE_NAME}" output { type nat hook output priority -100 \; } 2>/dev/null
@ -83,19 +89,12 @@ test_strict_handle() {
sleep 0.1 sleep 0.1
local count_after=$(get_total_packets "$uuid") local count_after=$(get_total_packets "$uuid")
if (( count_after > count_before )); then if (( count_after > count_before )); then
echo -e "\e[32mPASSED (Rule active & Target UP)\e[0m" echo -e "\e[32mPASSED (Active)\e[0m"
else else
echo -e "\e[33mSKIPPED (Target UP, but blocked by prior rule)\e[0m" echo -e "\e[33mSKIPPED (Blocked by prior rule)\e[0m"
fi fi
else else
nc -z -v -w 1 127.0.0.1 "$lp" >/dev/null 2>&1 echo -e "\e[31mOFFLINE (Target Down)\e[0m"
sleep 0.1
local count_after=$(get_total_packets "$uuid")
if (( count_after > count_before )); then
echo -e "\e[33mOFFLINE (Rule matched, but Target Down)\e[0m"
else
echo -e "\e[31mFAILED (Target Down & Rule blocked)\e[0m"
fi
fi fi
} }
@ -120,6 +119,32 @@ list_rules() {
done done
} }
add_rule() {
local raw=$1
init_nft
[[ "$FORCE_FLAG" == true ]] && enable_forwarding
if [[ "$raw" =~ ^([0-9]+):([0-9\.]+):([0-9]+)$ ]]; then lp=${BASH_REMATCH[1]}; tip=${BASH_REMATCH[2]}; tp=${BASH_REMATCH[3]}
elif [[ "$raw" =~ ^([0-9]+):([0-9]+)$ ]]; then lp=${BASH_REMATCH[1]}; tip="127.0.0.1"; tp=${BASH_REMATCH[2]}
elif [[ "$raw" =~ ^([0-9]+)$ ]]; then lp=${BASH_REMATCH[1]}; tip="127.0.0.1"; tp=${BASH_REMATCH[1]}
else msg "\e[31mError: Invalid rule format '$raw'\e[0m"; return 1; fi
u_raw=$(cat /proc/sys/kernel/random/uuid); u="ipf-id:$u_raw"; fam="ip"; [[ "$tip" =~ : ]] && fam="ip6"
nft insert rule inet "${TABLE_NAME}" prerouting "$PROTO" dport "$lp" counter dnat $fam to "$tip:$tp" comment "\"$u\""
nft insert rule inet "${TABLE_NAME}" output "$PROTO" dport "$lp" counter dnat $fam to "$tip:$tp" comment "\"$u\""
nft insert rule inet "${TABLE_NAME}" forward $fam daddr "$tip" "$PROTO" dport "$tp" ct state new,established,related accept comment "\"$u\""
nft insert rule inet "${TABLE_NAME}" forward $fam saddr "$tip" "$PROTO" sport "$tp" ct state established,related accept comment "\"$u\""
nft insert rule inet "${TABLE_NAME}" forward iifname "lo" accept comment "\"$u\""
nft insert rule inet "${TABLE_NAME}" postrouting $fam daddr "$tip" "$PROTO" dport "$tp" masquerade comment "\"$u\""
list_rules "$u_raw"
if [[ "$SKIP_TEST" == false ]]; then
new_h=$(nft -a list chain inet "${TABLE_NAME}" prerouting 2>/dev/null | grep "$u_raw" | grep -o 'handle [0-9]*' | awk '{print $2}')
echo ""; test_strict_handle "$new_h"
fi
}
all_clear() { all_clear() {
if [[ "$FORCE_FLAG" == false ]]; then if [[ "$FORCE_FLAG" == false ]]; then
echo -e "\e[33mWarning: This will delete ALL ipf rules.\e[0m" echo -e "\e[33mWarning: This will delete ALL ipf rules.\e[0m"
@ -134,9 +159,10 @@ all_clear() {
for arg in "$@"; do for arg in "$@"; do
[[ "$arg" =~ q ]] && QUIET_MODE=true && FORCE_FLAG=true && SKIP_TEST=true [[ "$arg" =~ q ]] && QUIET_MODE=true && FORCE_FLAG=true && SKIP_TEST=true
[[ "$arg" =~ f ]] && FORCE_FLAG=true && SKIP_TEST=true [[ "$arg" =~ f ]] && FORCE_FLAG=true
[[ "$arg" =~ y ]] && FORCE_FLAG=true
[[ "$arg" == "-R" ]] && RESET_MODE=true [[ "$arg" == "-R" ]] && RESET_MODE=true
[[ "$arg" == "--version" ]] && { echo "ipf version ${VERSION}"; exit 0; } [[ "$arg" == "-v" || "$arg" == "--version" ]] && { echo "ipf version ${VERSION}"; exit 0; }
done done
if [[ "$RESET_MODE" == true ]]; then all_clear; fi if [[ "$RESET_MODE" == true ]]; then all_clear; fi
@ -147,9 +173,12 @@ if [[ $# -eq 0 ]]; then list_rules; exit 0; fi
while [[ $# -gt 0 ]]; do while [[ $# -gt 0 ]]; do
case "$1" in case "$1" in
-h|--help) show_help; exit 0 ;; -h|--help) show_help; exit 0 ;;
-L|-l) list_rules; exit 0 ;; -l|-L) list_rules; exit 0 ;;
-f|-y|-q)
[[ "$1" == "-f" ]] && enable_forwarding
shift; [[ $# -eq 0 ]] && exit 0; continue ;;
-*[d]*) -*[d]*)
h_str=$(echo "$1" | sed -E 's/^-q?d?f?//') h_str=$(echo "$1" | sed -E 's/^-q?d?f?y?//')
[[ -z "$h_str" ]] && { h_str="$2"; shift; } [[ -z "$h_str" ]] && { h_str="$2"; shift; }
if [[ "$h_str" == "all" || "$h_str" == "*" ]]; then all_clear; fi if [[ "$h_str" == "all" || "$h_str" == "*" ]]; then all_clear; fi
handles=() handles=()
@ -195,25 +224,8 @@ while [[ $# -gt 0 ]]; do
fi fi
exit 0 ;; exit 0 ;;
[0-9]*) [0-9]*)
init_nft; raw="$1" add_rule "$1"; exit 0 ;;
if [[ "$raw" =~ ^([0-9]+):([0-9\.]+):([0-9]+)$ ]]; then lp=${BASH_REMATCH[1]}; tip=${BASH_REMATCH[2]}; tp=${BASH_REMATCH[3]} *) msg "\e[31mError: Unknown option '$1'\e[0m"; show_help; exit 1 ;;
elif [[ "$raw" =~ ^([0-9]+):([0-9]+)$ ]]; then lp=${BASH_REMATCH[1]}; tip="127.0.0.1"; tp=${BASH_REMATCH[2]}
elif [[ "$raw" =~ ^([0-9]+)$ ]]; then lp=${BASH_REMATCH[1]}; tip="127.0.0.1"; tp=${BASH_REMATCH[1]}
fi
u_raw=$(cat /proc/sys/kernel/random/uuid); u="ipf-id:$u_raw"; fam="ip"; [[ "$tip" =~ : ]] && fam="ip6"
nft insert rule inet "${TABLE_NAME}" prerouting "$PROTO" dport "$lp" counter dnat $fam to "$tip:$tp" comment "\"$u\""
nft insert rule inet "${TABLE_NAME}" output "$PROTO" dport "$lp" counter dnat $fam to "$tip:$tp" comment "\"$u\""
nft insert rule inet "${TABLE_NAME}" forward $fam daddr "$tip" "$PROTO" dport "$tp" ct state new,established,related accept comment "\"$u\""
nft insert rule inet "${TABLE_NAME}" forward $fam saddr "$tip" "$PROTO" sport "$tp" ct state established,related accept comment "\"$u\""
nft insert rule inet "${TABLE_NAME}" forward iifname "lo" accept comment "\"$u\""
nft insert rule inet "${TABLE_NAME}" postrouting $fam daddr "$tip" "$PROTO" dport "$tp" masquerade comment "\"$u\""
list_rules "$u_raw"
if [[ "$SKIP_TEST" == false ]]; then
new_h=$(nft -a list chain inet "${TABLE_NAME}" prerouting 2>/dev/null | grep "$u_raw" | grep -o 'handle [0-9]*' | awk '{print $2}')
echo ""; test_strict_handle "$new_h"
fi
exit 0 ;;
*) msg "Error: Unknown option '$1'"; exit 1 ;;
esac esac
shift shift
done done