From df59b6f1c4ea1b92b1918bd190709e6ac7092185 Mon Sep 17 00:00:00 2001 From: joe Date: Thu, 22 Jan 2026 12:05:14 +0900 Subject: [PATCH] =?UTF-8?q?=E3=82=AA=E3=83=97=E3=82=B7=E3=83=A7=E3=83=B3?= =?UTF-8?q?=E6=8C=87=E5=AE=9ABUG?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ipfn1.0 | 69 +++++++++++++++++++++++++++++++++------------------------ 1 file changed, 40 insertions(+), 29 deletions(-) diff --git a/ipfn1.0 b/ipfn1.0 index 6225433..bdab95a 100755 --- a/ipfn1.0 +++ b/ipfn1.0 @@ -1,8 +1,8 @@ #!/bin/bash # Name: ipfn -# Version: 1.1.5 +# Version: 1.1.6 # Date: 2026-01-22 -# Description: Supports deleting by port (e.g., -d :80). +# Description: Fixed argument parsing order and combined flags. if [ "$(id -u)" -ne 0 ]; then exec sudo "$0" "$@" @@ -24,14 +24,13 @@ init_nft() { nft add chain inet ${TABLE_NAME} forward { type filter hook forward priority 0 \; policy accept \; } 2>/dev/null } -# --- 削除解析の心臓部 --- +# (parse_delete_targets, list_rules, test_rule_by_port, add_rule などは 1.1.5 と同様) parse_delete_targets() { local input=$1 local -a final_handles=() IFS=',' read -r -a parts <<< "$input" for part in "${parts[@]}"; do if [[ "$part" =~ ^:([0-9]+)$ ]]; then - # ポート指定 (:80) の場合、ハンドルを逆引き local target_port="${BASH_REMATCH[1]}" local found_h=$(nft -a list chain inet ${TABLE_NAME} prerouting | grep "dport $target_port" | grep -o 'handle [0-9]*' | awk '{print $2}') if [[ -n "$found_h" ]]; then @@ -40,53 +39,65 @@ parse_delete_targets() { msg "Warning: No rules found for port :$target_port" fi elif [[ "$part" =~ ^([0-9]+)-([0-9]+)$ ]]; then - # 範囲指定 for ((i=${BASH_REMATCH[1]}; i<=${BASH_REMATCH[2]}; i++)); do final_handles+=("$i"); done else - # 単一ハンドル final_handles+=("$part") fi done echo "${final_handles[@]}" } -# (中略: show_help, list_rules, test_rule_by_port, add_rule は ver.1.1.4 と同様) +# --- メインパース (順序を修正) --- -show_help() { - echo "Usage: ipfn [OPTIONS] [PORT:TARGET_IP:TARGET_PORT]" - echo "" - echo "Options:" - echo " -d HANDLE/PORT Delete by handle(17) or port(:80). Supports list(17,:80) or range(10-15)" - echo " -df HANDLE/PORT Force delete" - echo " -qd HANDLE/PORT Quiet delete" - echo " -l List rules" - echo " -t [HANDLE] Test connectivity" - echo " -f Skip test / Enable IP forward" - echo " -v Verbose (raw nftables)" - echo " -h Help" -} +# 先読みフラグ +for arg in "$@"; do + [[ "$arg" =~ q ]] && QUIET_MODE=true && FORCE_FLAG=true && SKIP_TEST=true + [[ "$arg" =~ f ]] && FORCE_FLAG=true && SKIP_TEST=true +done + +if [[ $# -eq 0 ]]; then list_rules; exit 0; fi -# --- 以下、削除ロジックの統合 --- while [[ $# -gt 0 ]]; do case "$1" in -h|--help) show_help; exit 0 ;; -v|--verbose) nft list table inet ${TABLE_NAME}; exit 0 ;; -L|-l) list_rules; exit 0 ;; - -*[qd]*) + + # 先に単独の -f や -t を処理する + -f) + if [[ $# -eq 1 ]]; then + sysctl -w net.ipv4.ip_forward=1 >/dev/null + sysctl -w net.ipv4.conf.all.route_localnet=1 >/dev/null + msg "Kernel parameters updated."; exit 0 + fi ;; + -t*) + h_str="${1#-t}" + if [[ -z "$h_str" && ( "$2" =~ ^[0-9,-]+$ ) ]]; then h_str="$2"; shift; fi + if [[ -z "$h_str" ]]; then + count=$(nft list chain inet ${TABLE_NAME} prerouting | grep -c "dnat") + if [ "$count" -eq 1 ]; then + h_str=$(nft -a list chain inet ${TABLE_NAME} prerouting | grep "handle" | awk '{print $NF}') + else + msg "Error: Multiple rules exist. Specify a handle."; exit 1 + fi + fi + # get_port_by_handle ロジック (nftからポートを取得) + lp=$(nft -a list chain inet ${TABLE_NAME} prerouting | grep "handle $h_str" | grep -o 'dport [0-9]*' | awk '{print $2}') + [[ -n "$lp" ]] && test_rule_by_port "$lp" || msg "Error: Handle $h_str not found." + exit 0 ;; + + # その後で削除フラグを含むものを処理 + -*[d]*) h_str=$(echo "$1" | sed -E 's/^-q?d?f?//') [[ -z "$h_str" ]] && { h_str="$2"; shift; } - - # ポートとハンドルを統合して解析 handles=($(parse_delete_targets "$h_str")) - [[ ${#handles[@]} -eq 0 ]] && { msg "No handles to delete."; exit 1; } - + [[ ${#handles[@]} -eq 0 ]] && { msg "No targets to delete."; exit 1; } if [[ "$FORCE_FLAG" == false ]]; then msg "Review rules to delete:" for h in "${handles[@]}"; do nft -a list table inet ${TABLE_NAME} | grep "handle $h" | sed 's/^/ /'; done read -p "Delete these rules? (y/N): " confirm [[ ! "$confirm" =~ ^[yY]$ ]] && exit 0 fi - for h in "${handles[@]}"; do ri=$(nft -a list chain inet ${TABLE_NAME} prerouting | grep "handle $h") [[ -z "$ri" ]] && continue @@ -96,10 +107,10 @@ while [[ $# -gt 0 ]]; do nft delete rule inet ${TABLE_NAME} "$c" handle "$rh" done done - msg "Deleted rule associated with handle $h" + msg "Deleted handle $h" done list_rules; exit 0 ;; - # (中略: -t, -f, add_rule の case 処理は ver.1.1.4 と同じ) + *) if [[ "$1" =~ ^[0-9]+: ]]; then add_rule "$1"; exit 0 else msg "\e[31mError: Unknown option '$1'\e[0m\n"; show_help; exit 1; fi ;;