enhance dnat rule format, support src/dst/tgtHEADmaster

1 files changed, 51 insertions, 40 deletions

diff --git a/wg-netns-exec b/wg-netns-exec
index 38667bd..0259e07 100755
--- a/wg-netns-exec
+++ b/wg-netns-exec
@@ -60,16 +60,16 @@ echo "config: $wg_conf"
 wg_if="wg-${netns}"
 
 ((!${#tap_addrs[@]})) && tap_addrs=(10.0.0.1/32 fd00::1/64)
-def_daddr=
-def_daddr6=
+def_taddr=
+def_taddr6=
 for addr in "${tap_addrs[@]}"; do
 	addr="${addr%%/*}"
 	if [[ "${addr}" == *:* ]]; then
-		[[ -z "${def_daddr6}" ]] && def_daddr6="${addr%:1}:2" &&
-			[[ -n "${def_daddr}" ]] && break
+		[[ -z "${def_taddr6}" ]] && def_taddr6="${addr%:1}:2" &&
+			[[ -n "${def_taddr}" ]] && break
 	else
-		[[ -z "${def_daddr}" ]] && def_daddr="${addr%.1}.2" &&
-			[[ -n "${def_daddr6}" ]] && break
+		[[ -z "${def_taddr}" ]] && def_taddr="${addr%.1}.2" &&
+			[[ -n "${def_taddr6}" ]] && break
 	fi
 done
 
@@ -107,52 +107,63 @@ if ((enable_tap)); then
 
 	pre=
 	if ((${#dnat_rules[@]})); then
-		pre='chain prerouting {
-			type nat hook prerouting priority dstnat
-			policy accept'
-		for saddr in "${dnat_rules[@]}"; do
-			sport= proto= daddr= dport=
-			if [[ "${saddr}" =~ ^((.*)\ +)?to\ +(.*) ]]; then
-				saddr="${BASH_REMATCH[2]}"
-				daddr="${BASH_REMATCH[3]}"
+		printf -v pre '%s\n' 'chain prerouting {' \
+			'type nat hook prerouting priority dstnat' \
+			'policy accept'
+		for daddr in "${dnat_rules[@]}"; do
+			saddr= sport= dport= proto= taddr= tport=
+
+			if [[ "${daddr}" =~ ^((.*)\ +)?to\ +(.*) ]]; then
+				daddr="${BASH_REMATCH[2]}"
+				taddr="${BASH_REMATCH[3]}"
+			fi
+			if [[ "${daddr}" =~ ^\ *from\ +(.*)\ +for\ +(.*) ||
+					"${daddr}" =~ ^\ *from\ +(.*)()
+					]]; then
+				saddr="${BASH_REMATCH[1]}"
+				daddr="${BASH_REMATCH[2]}"
 			fi
 
+			[[ "${daddr}" =~ ^\ *any\ *(/.*)?$ ]] &&
+				daddr=":${BASH_REMATCH[1]}"
 			ip_re='(([^:]*\[[^]]*\]([^:]*\[[^]]*\])*)?[^:]*)'
-			[[ "${saddr}" =~ ^\ *any\ *(/.*)?$ ]] &&
-				saddr=":${BASH_REMATCH[1]}"
-			[[ "${saddr}" =~ ^${ip_re}:?([^/]*)/?(.*) ]]
-			saddr="${BASH_REMATCH[1]}"
-			sport="${BASH_REMATCH[4]}"
+			[[ "${daddr}" =~ ^${ip_re}:?([^/]*)/?(.*) ]]
+			daddr="${BASH_REMATCH[1]}"
+			dport="${BASH_REMATCH[4]}"
 			proto="${BASH_REMATCH[5]}"
-
-			if [[ -n "${daddr}" ]]; then
-				[[ "${daddr}" =~ ^${ip_re}:?(.*) ]]
-				daddr="${BASH_REMATCH[1]}"
-				dport="${BASH_REMATCH[4]}"
+			if [[ -n "${saddr}" ]]; then
+				[[ "${saddr}" =~ ^${ip_re}:?(.*) ]]
+				saddr="${BASH_REMATCH[1]}"
+				sport="${BASH_REMATCH[4]}"
+			fi
+			if [[ -n "${taddr}" ]]; then
+				[[ "${taddr}" =~ ^${ip_re}:?(.*) ]]
+				taddr="${BASH_REMATCH[1]}"
+				tport="${BASH_REMATCH[4]}"
 			fi
 
-			[[ "${saddr}" == *:* || "${daddr}" == *:* ]] &&
+			[[ "${saddr}${daddr}${taddr}" == *:* ]] &&
 				ip6=1 || ip6=
+			[[ -n "${sport}${dport}${tport}" ]] &&
+				: "${proto:=tcp}"
+			printf -v r '%s' "iifname ${wg_if}" \
+				"${saddr:+ ip${ip6:+6} saddr ${saddr}}" \
+				"${daddr:+ ip${ip6:+6} daddr ${daddr}}" \
+				"${proto:+ meta l4proto {${proto}\}}" \
+				"${sport:+ th sport ${sport}}" \
+				"${dport:+ th dport ${dport}}"
 
-			r="iifname ${wg_if}"
-			[[ -n "${saddr}" ]] && r+=" ip${ip6:+6} saddr ${saddr}"
-			[[ -n "${sport}" || -n "${dport}" ||
-					-n "${proto}" ]] &&
-				r+=" meta l4proto {${proto:-tcp}}"
-			[[ -n "${sport}" ]] && r+=" th dport ${sport}"
-			dport="${dport:+:${dport}}"
-
+			tport="${tport:+:${tport}}"
 			((!ip6)) &&
-				d="${daddr:-${def_daddr}}" &&
+				d="${taddr:-${def_taddr}}" &&
 				[[ -n "${d}" ]] &&
-				pre+=$'\n'"${r} dnat ip to ${d}${dport}"
-
-			((ip6)) || [[ -z "${saddr}" && -z "${daddr}" ]] &&
-				d="${daddr:-${def_daddr6}}" &&
+				pre+="${r} dnat ip to ${d}${tport}"$'\n'
+			((ip6)) || [[ -z "${saddr}${daddr}${taddr}" ]] &&
+				d="${taddr:-[${def_taddr6}]}" &&
 				[[ -n "${d}" ]] &&
-				pre+=$'\n'"${r} dnat ip6 to ${d}${dport}"
+				pre+="${r} dnat ip6 to ${d}${tport}"$'\n'
 		done
-		pre+=$'\n}'
+		pre+='}'
 	fi
 	run ip netns exec "${netns}" nft -f - <<-EOF
 		table inet nat {