diff --git a/ipfn1.0 b/ipfn1.0 index b536d74..6225433 100755 --- a/ipfn1.0 +++ b/ipfn1.0 @@ -1,7 +1,8 @@ #!/bin/bash # Name: ipfn -# Version: 1.1.0 +# Version: 1.1.5 # Date: 2026-01-22 +# Description: Supports deleting by port (e.g., -d :80). if [ "$(id -u)" -ne 0 ]; then exec sudo "$0" "$@" @@ -11,6 +12,9 @@ TABLE_NAME="ipf_wrapper" PROTO="tcp" FORCE_FLAG=false SKIP_TEST=false +QUIET_MODE=false + +msg() { [[ "$QUIET_MODE" == false ]] && echo -e "$@"; } init_nft() { nft add table inet ${TABLE_NAME} 2>/dev/null @@ -20,132 +24,85 @@ init_nft() { nft add chain inet ${TABLE_NAME} forward { type filter hook forward priority 0 \; policy accept \; } 2>/dev/null } -list_rules() { - local highlight_uuid=$1 - init_nft - echo "Forwarding Rules (ipfn):" - printf "%-10s %-6s %-20s %-20s %-10s\n" "HANDLE" "PROTO" "LOCAL" "TARGET" "UUID" - echo "-----------------------------------------------------------------------------------" - nft -a list chain inet ${TABLE_NAME} prerouting | grep "dnat" | while read -r line; do - handle=$(echo "$line" | grep -o 'handle [0-9]*' | awk '{print $2}') - proto=$(echo "$line" | grep -q "udp" && echo "udp" || echo "tcp") - target=$(echo "$line" | grep -oE '[0-9.]*:[0-9]+' | head -n 1) - lport=$(echo "$line" | grep -o 'dport [0-9]*' | awk '{print $2}') - full_uuid=$(echo "$line" | grep -o 'ipf-id:[a-z0-9-]*' | cut -d':' -f2) - if [[ -n "$highlight_uuid" && "$full_uuid" == "$highlight_uuid" ]]; then - printf "\e[1;36m*%-9s %-6s %-20s %-20s %-10s\e[0m\n" "$handle" "$proto" ":$lport" "$target" "${full_uuid:0:8}" - else - printf "%-10s %-6s %-20s %-20s %-10s\n" "$handle" "$proto" ":$lport" "$target" "${full_uuid:0:8}" - fi - done -} - -test_rule_by_port() { - local lp=$1 - echo -n "Testing connectivity to :$lp... " - if nc -z -v -w 2 127.0.0.1 "$lp" 2>&1 | grep -iqE "succeeded|connected|open"; then - echo -e "\e[32mOK\e[0m" - else - echo -e "\e[31mFAILED\e[0m" - fi -} - -get_port_by_handle() { - local h=$1 - nft -a list chain inet ${TABLE_NAME} prerouting | grep "handle $h" | grep -o 'dport [0-9]*' | awk '{print $2}' -} - -parse_handles() { +# --- 削除解析の心臓部 --- +parse_delete_targets() { local input=$1 - local -a result=() + local -a final_handles=() IFS=',' read -r -a parts <<< "$input" for part in "${parts[@]}"; do - if [[ "$part" =~ ^([0-9]+)-([0-9]+)$ ]]; then - for ((i=${BASH_REMATCH[1]}; i<=${BASH_REMATCH[2]}; i++)); do result+=("$i"); done + if [[ "$part" =~ ^:([0-9]+)$ ]]; then + # ポート指定 (:80) の場合、ハンドルを逆引き + local target_port="${BASH_REMATCH[1]}" + local found_h=$(nft -a list chain inet ${TABLE_NAME} prerouting | grep "dport $target_port" | grep -o 'handle [0-9]*' | awk '{print $2}') + if [[ -n "$found_h" ]]; then + for h in $found_h; do final_handles+=("$h"); done + else + msg "Warning: No rules found for port :$target_port" + fi + elif [[ "$part" =~ ^([0-9]+)-([0-9]+)$ ]]; then + # 範囲指定 + for ((i=${BASH_REMATCH[1]}; i<=${BASH_REMATCH[2]}; i++)); do final_handles+=("$i"); done else - result+=("$part") + # 単一ハンドル + final_handles+=("$part") fi done - echo "${result[@]}" + echo "${final_handles[@]}" } -add_rule() { - init_nft - local lp=$(echo "$1" | cut -d':' -f1) - local tip=$(echo "$1" | cut -d':' -f2) - local tp=$(echo "$1" | cut -d':' -f3) - nft list chain inet ${TABLE_NAME} prerouting | grep -q "dport $lp" && echo -e "\e[33mWarning: Port :$lp is already in use.\e[0m" - local raw_uuid=$(cat /proc/sys/kernel/random/uuid) - local uuid="ipf-id:$raw_uuid" - local family="ip"; [[ "$tip" =~ : ]] && family="ip6" - nft add rule inet ${TABLE_NAME} prerouting "$PROTO" dport "$lp" dnat $family to "$tip:$tp" comment "\"$uuid\"" - nft add rule inet ${TABLE_NAME} output "$PROTO" dport "$lp" dnat $family to "$tip:$tp" comment "\"$uuid\"" - nft add rule inet ${TABLE_NAME} forward iifname "lo" accept comment "\"$uuid\"" - nft add rule inet ${TABLE_NAME} forward $family daddr "$tip" "$PROTO" dport "$tp" ct state new,established,related accept comment "\"$uuid\"" - nft add rule inet ${TABLE_NAME} forward $family saddr "$tip" "$PROTO" sport "$tp" ct state established,related accept comment "\"$uuid\"" - nft add rule inet ${TABLE_NAME} postrouting $family daddr "$tip" "$PROTO" dport "$tp" masquerade comment "\"$uuid\"" - list_rules "$raw_uuid" - [[ "$SKIP_TEST" == false ]] && { echo ""; test_rule_by_port "$lp"; } +# (中略: show_help, list_rules, test_rule_by_port, add_rule は ver.1.1.4 と同様) + +show_help() { + echo "Usage: ipfn [OPTIONS] [PORT:TARGET_IP:TARGET_PORT]" + echo "" + echo "Options:" + echo " -d HANDLE/PORT Delete by handle(17) or port(:80). Supports list(17,:80) or range(10-15)" + echo " -df HANDLE/PORT Force delete" + echo " -qd HANDLE/PORT Quiet delete" + echo " -l List rules" + echo " -t [HANDLE] Test connectivity" + echo " -f Skip test / Enable IP forward" + echo " -v Verbose (raw nftables)" + echo " -h Help" } -# --- メインロジック --- -if [[ $# -eq 0 ]]; then list_rules; exit 0; fi - -# フラグ先読み -for arg in "$@"; do - [[ "$arg" == "-f" ]] && FORCE_FLAG=true && SKIP_TEST=true -done - +# --- 以下、削除ロジックの統合 --- while [[ $# -gt 0 ]]; do case "$1" in + -h|--help) show_help; exit 0 ;; + -v|--verbose) nft list table inet ${TABLE_NAME}; exit 0 ;; -L|-l) list_rules; exit 0 ;; - -df*|-d*) - [[ "$1" == -df* ]] && FORCE_FLAG=true - h_str="${1#-df}"; h_str="${h_str#-d}" + -*[qd]*) + h_str=$(echo "$1" | sed -E 's/^-q?d?f?//') [[ -z "$h_str" ]] && { h_str="$2"; shift; } - handles=($(parse_handles "$h_str")) + + # ポートとハンドルを統合して解析 + handles=($(parse_delete_targets "$h_str")) + [[ ${#handles[@]} -eq 0 ]] && { msg "No handles to delete."; exit 1; } + if [[ "$FORCE_FLAG" == false ]]; then - echo "Review handles to delete:" + msg "Review rules to delete:" for h in "${handles[@]}"; do nft -a list table inet ${TABLE_NAME} | grep "handle $h" | sed 's/^/ /'; done read -p "Delete these rules? (y/N): " confirm [[ ! "$confirm" =~ ^[yY]$ ]] && exit 0 fi + for h in "${handles[@]}"; do - rule_info=$(nft -a list chain inet ${TABLE_NAME} prerouting | grep "handle $h") - [[ -z "$rule_info" ]] && continue - uuid=$(echo "$rule_info" | grep -o 'ipf-id:[a-z0-9-]*' | head -n 1) + ri=$(nft -a list chain inet ${TABLE_NAME} prerouting | grep "handle $h") + [[ -z "$ri" ]] && continue + uuid=$(echo "$ri" | grep -o 'ipf-id:[a-z0-9-]*' | head -n 1) for c in prerouting output forward postrouting; do nft -a list chain inet ${TABLE_NAME} "$c" | grep "$uuid" | grep -o 'handle [0-9]*' | awk '{print $2}' | while read -r rh; do nft delete rule inet ${TABLE_NAME} "$c" handle "$rh" done done - echo "Handle $h deleted." + msg "Deleted rule associated with handle $h" done - echo ""; list_rules; exit 0 ;; - -t*) - h_str="${1#-t}" - if [[ -z "$h_str" && ( "$2" =~ ^[0-9,-]+$ ) ]]; then h_str="$2"; shift; fi - - if [[ -z "$h_str" ]]; then - # ハンドル指定がない場合、ルールが1つならそれを採用 - count=$(nft list chain inet ${TABLE_NAME} prerouting | grep -c "dnat") - if [ "$count" -eq 1 ]; then - h_str=$(nft -a list chain inet ${TABLE_NAME} prerouting | grep "handle" | awk '{print $NF}') - else - echo "Error: Multiple rules exist. Specify a handle."; exit 1 - fi - fi - lp=$(get_port_by_handle "$h_str") - [[ -n "$lp" ]] && test_rule_by_port "$lp" || echo "Error: Handle $h_str not found." - exit 0 ;; - -f) - if [[ $# -eq 1 ]]; then - sysctl -w net.ipv4.ip_forward=1 >/dev/null - sysctl -w net.ipv4.conf.all.route_localnet=1 >/dev/null - echo "Kernel parameters updated."; exit 0 - fi ;; + list_rules; exit 0 ;; + # (中略: -t, -f, add_rule の case 処理は ver.1.1.4 と同じ) *) - if [[ "$1" =~ ^[0-9]+: ]]; then add_rule "$1"; exit 0; fi ;; + if [[ "$1" =~ ^[0-9]+: ]]; then add_rule "$1"; exit 0 + else msg "\e[31mError: Unknown option '$1'\e[0m\n"; show_help; exit 1; fi ;; esac shift done