diff --git a/ipfn1.0 b/ipfn1.0 index 1edd03d..4633835 100755 --- a/ipfn1.0 +++ b/ipfn1.0 @@ -1,10 +1,9 @@ #!/bin/bash # Name: ipfn -# Version: 1.0.7 +# Version: 1.0.9 # Date: 2026-01-22 -# Description: Default to list, auto-test on add, skip test with -f, and port collision warning. +# Description: Supports range deletion (e.g., -d 80-85) and complex handle lists. -# sudo権限チェック if [ "$(id -u)" -ne 0 ]; then exec sudo "$0" "$@" fi @@ -14,7 +13,6 @@ PROTO="tcp" FORCE_FLAG=false SKIP_TEST=false -# --- 初期化 --- init_nft() { nft add table inet ${TABLE_NAME} 2>/dev/null nft add chain inet ${TABLE_NAME} prerouting { type nat hook prerouting priority -100 \; } 2>/dev/null @@ -23,21 +21,18 @@ init_nft() { nft add chain inet ${TABLE_NAME} forward { type filter hook forward priority 0 \; policy accept \; } 2>/dev/null } -# --- ルール表示 (アスタリスク強調) --- list_rules() { local highlight_uuid=$1 init_nft echo "Forwarding Rules (ipfn):" printf "%-10s %-6s %-20s %-20s %-10s\n" "HANDLE" "PROTO" "LOCAL" "TARGET" "UUID" echo "-----------------------------------------------------------------------------------" - nft -a list chain inet ${TABLE_NAME} prerouting | grep "dnat" | while read -r line; do handle=$(echo "$line" | grep -o 'handle [0-9]*' | awk '{print $2}') proto=$(echo "$line" | grep -q "udp" && echo "udp" || echo "tcp") target=$(echo "$line" | grep -oE '[0-9.]*:[0-9]+' | head -n 1) lport=$(echo "$line" | grep -o 'dport [0-9]*' | awk '{print $2}') full_uuid=$(echo "$line" | grep -o 'ipf-id:[a-z0-9-]*' | cut -d':' -f2) - if [[ -n "$highlight_uuid" && "$full_uuid" == "$highlight_uuid" ]]; then printf "\e[1;36m*%-9s %-6s %-20s %-20s %-10s\e[0m\n" "$handle" "$proto" ":$lport" "$target" "${full_uuid:0:8}" else @@ -46,7 +41,40 @@ list_rules() { done } -# --- 疎通確認 --- +perform_delete() { + local handle=$1 + local rule_info=$(nft -a list chain inet ${TABLE_NAME} prerouting | grep "handle $handle") + [[ -z "$rule_info" ]] && return # 存在しないハンドルは静かにスルー + local uuid=$(echo "$rule_info" | grep -o 'ipf-id:[a-z0-9-]*' | head -n 1) + for chain in prerouting output forward postrouting; do + nft -a list chain inet ${TABLE_NAME} "$chain" | grep "$uuid" | grep -o 'handle [0-9]*' | awk '{print $2}' | while read -r h; do + nft delete rule inet ${TABLE_NAME} "$chain" handle "$h" + done + done + echo "ipfn: Handle $handle deleted." +} + +# --- メインパース部分の強化 --- +parse_handles() { + local input=$1 + local -a result=() + # カンマで分割 + IFS=',' read -r -a parts <<< "$input" + for part in "${parts[@]}"; do + if [[ "$part" =~ ^([0-9]+)-([0-9]+)$ ]]; then + # 範囲指定 (start-end) の処理 + start=${BASH_REMATCH[1]} + end=${BASH_REMATCH[2]} + for ((i=start; i<=end; i++)); do result+=("$i"); done + else + # 単一指定 + result+=("$part") + fi + done + echo "${result[@]}" +} + +# (add_rule, test_rule_by_port は前バージョンと同じ) test_rule_by_port() { local lp=$1 echo -n "Testing connectivity to :$lp... " @@ -57,106 +85,55 @@ test_rule_by_port() { fi } -# --- ルール追加 --- add_rule() { init_nft local port_ip_port=$1 - local local_port=$(echo "$port_ip_port" | cut -d':' -f1) - local target_ip=$(echo "$port_ip_port" | cut -d':' -f2) - local target_port=$(echo "$port_ip_port" | cut -d':' -f3) - - # 重複チェック (警告のみ) - if nft list chain inet ${TABLE_NAME} prerouting | grep -q "dport $local_port"; then - echo -e "\e[33mWarning: Port :$local_port is already in use by another rule.\e[0m" - fi - + local lp=$(echo "$port_ip_port" | cut -d':' -f1) + local tip=$(echo "$port_ip_port" | cut -d':' -f2) + local tp=$(echo "$port_ip_port" | cut -d':' -f3) + [[ -n "$lp" ]] && nft list chain inet ${TABLE_NAME} prerouting | grep -q "dport $lp" && echo -e "\e[33mWarning: Port :$lp is already in use.\e[0m" local raw_uuid=$(cat /proc/sys/kernel/random/uuid) local uuid="ipf-id:$raw_uuid" local comment="comment \"$uuid\"" - local family="ip" - [[ "$target_ip" =~ : ]] && family="ip6" - - nft add rule inet ${TABLE_NAME} prerouting "$PROTO" dport "$local_port" dnat $family to "$target_ip:$target_port" "$comment" - nft add rule inet ${TABLE_NAME} output "$PROTO" dport "$local_port" dnat $family to "$target_ip:$target_port" "$comment" + local family="ip"; [[ "$tip" =~ : ]] && family="ip6" + nft add rule inet ${TABLE_NAME} prerouting "$PROTO" dport "$lp" dnat $family to "$tip:$tp" "$comment" + nft add rule inet ${TABLE_NAME} output "$PROTO" dport "$lp" dnat $family to "$tip:$tp" "$comment" nft add rule inet ${TABLE_NAME} forward iifname "lo" accept "$comment" - nft add rule inet ${TABLE_NAME} forward $family daddr "$target_ip" "$PROTO" dport "$target_port" ct state new,established,related accept "$comment" - nft add rule inet ${TABLE_NAME} forward $family saddr "$target_ip" "$PROTO" sport "$target_port" ct state established,related accept "$comment" - nft add rule inet ${TABLE_NAME} postrouting $family daddr "$target_ip" "$PROTO" dport "$target_port" masquerade "$comment" - - echo "ipfn: Rule added." - echo "" - list_rules "$raw_uuid" - - # 自動テスト - if [[ "$SKIP_TEST" == false ]]; then - echo "" - test_rule_by_port "$local_port" - fi + nft add rule inet ${TABLE_NAME} forward $family daddr "$tip" "$PROTO" dport "$tp" ct state new,established,related accept "$comment" + nft add rule inet ${TABLE_NAME} forward $family saddr "$tip" "$PROTO" sport "$tp" ct state established,related accept "$comment" + nft add rule inet ${TABLE_NAME} postrouting $family daddr "$tip" "$PROTO" dport "$tp" masquerade "$comment" + echo "ipfn: Rule added."; echo ""; list_rules "$raw_uuid" + [[ "$SKIP_TEST" == false ]] && { echo ""; test_rule_by_port "$lp"; } } -# --- ルール削除 --- -delete_rule() { - init_nft - local handle=$1 - local rule_info=$(nft -a list chain inet ${TABLE_NAME} prerouting | grep "handle $handle") - [[ -z "$rule_info" ]] && { echo "Error: Handle $handle not found."; exit 1; } - - local uuid=$(echo "$rule_info" | grep -o 'ipf-id:[a-z0-9-]*' | head -n 1) - local lp=$(echo "$rule_info" | grep -o 'dport [0-9]*' | awk '{print $2}') - local tg=$(echo "$rule_info" | grep -oE '[0-9.]*:[0-9]+' | head -n 1) - - if [[ "$FORCE_FLAG" == false ]]; then - echo "Delete Handle $handle (:$lp -> $tg)?" - echo -n "Are you sure? (y/N): " - read -r confirm - [[ ! "$confirm" =~ ^[yY]$ ]] && { echo "Aborted."; exit 0; } - fi - - for chain in prerouting output forward postrouting; do - nft -a list chain inet ${TABLE_NAME} "$chain" | grep "$uuid" | grep -o 'handle [0-9]*' | awk '{print $2}' | while read -r h; do - nft delete rule inet ${TABLE_NAME} "$chain" handle "$h" - done - done - echo "ipfn: Deleted."; echo ""; list_rules -} - -# --- メインパース --- -# 先にフラグをスキャン -for arg in "$@"; do - [[ "$arg" == "-f" ]] && FORCE_FLAG=true && SKIP_TEST=true -done - -if [[ $# -eq 0 ]]; then - list_rules - exit 0 -fi +for arg in "$@"; do [[ "$arg" == "-f" ]] && FORCE_FLAG=true && SKIP_TEST=true; done +if [[ $# -eq 0 ]]; then list_rules; exit 0; fi while [[ $# -gt 0 ]]; do case "$1" in -L|-l) list_rules; exit 0 ;; -df*|-d*) [[ "$1" == -df* ]] && FORCE_FLAG=true - h="${1#-df}"; h="${h#-d}" - [[ -z "$h" ]] && { h="$2"; shift; } - delete_rule "$h"; exit 0 ;; - -t*) - h="${1#-t}" - [[ -z "$h" ]] && { h="$2"; shift; } - # ハンドルからポートを引いてテスト - lp=$(nft -a list chain inet ${TABLE_NAME} prerouting | grep "handle $h" | grep -o 'dport [0-9]*' | awk '{print $2}') - test_rule_by_port "$lp"; exit 0 ;; - -f) # 単体実行時はカーネル設定 - if [[ $# -eq 1 ]]; then - sysctl -w net.ipv4.ip_forward=1 >/dev/null - sysctl -w net.ipv4.conf.all.route_localnet=1 >/dev/null - echo "Kernel parameters updated." - exit 0 - fi ;; - *) - if [[ "$1" =~ ^[0-9]+: ]]; then - add_rule "$1" - exit 0 - fi ;; + raw_h="${1#-df}"; raw_h="${raw_h#-d}" + [[ -z "$raw_h" ]] && { raw_h="$2"; shift; } + + # 範囲指定を含むハンドルリストを解析 + handles=($(parse_handles "$raw_h")) + + if [[ "$FORCE_FLAG" == false ]]; then + echo "Review handles to delete:" + for h in "${handles[@]}"; do + rule=$(nft -a list chain inet ${TABLE_NAME} prerouting | grep "handle $h") + [[ -n "$rule" ]] && echo " $rule" + done + echo -n "Delete these rules? (y/N): " + read -r confirm + [[ ! "$confirm" =~ ^[yY]$ ]] && { echo "Aborted."; exit 0; } + fi + for h in "${handles[@]}"; do perform_delete "$h"; done + echo ""; list_rules; exit 0 ;; + -f) [[ $# -eq 1 ]] && { sysctl -w net.ipv4.ip_forward=1 >/dev/null; sysctl -w net.ipv4.conf.all.route_localnet=1 >/dev/null; echo "Kernel parameters updated."; exit 0; } ;; + *) [[ "$1" =~ ^[0-9]+: ]] && { add_rule "$1"; exit 0; } ;; esac shift done