#! /bin/bash -e
# IPTadmin: Laden/Beobachten/Speichern von Netfilter-Regelsätzen und IP Sets
# IPTadmin: Load/Watch/Save Netfilter rules or IP sets
# Version 2022-03-26
# Copyright (C) 2022 kB @ UbuntuUsers.de
# SPDX-License-Identifier: GPL-2.0-or-later
# https://spdx.org/licenses/GPL-2.0-or-later.html

test $UID = 0 || exec sudo env IPT_DATA=$IPT_DATA "$0" "$@"	# Mach mich Admin!

minN()	case $1	in (0)		cat -
		;; (1)		awk -v RS="\n\n+" "/$2./"
		;; ([0-9]*)	(( N = $1, --N )) ; minN $N "\n(.)*$2"
		;; (*)		false
	esac
Page()	{ printf '%s\n' "$*" ; cat - ; echo ;}

IPT ()	{ test $proto = 6 && X=6 || X= ; ip${X}tables -t $table $* ;}
Rules()	for proto in $PROTOs
  do	for table in raw mangle nat filter security
    do	case $1
	  in	(load)	while read ; do IPT $REPLY ; done < $table-$proto
	  ;&  (status)	IPT -nvL | minN  3 | sed "s/Chain/$table-$proto:/"
	  ;;	(save)	IPT -S	| tee $table-$proto | Page "# IP$proto-Tabelle $table"
	  ;;	(null)	IPT -S 	| while read PN chain _
			do	case $PN in (-P|-N)	IPT -F $chain ; esac
				case $PN in (-N)	IPT -X $chain ; esac
			done
	  ;;	(zero)	IPT -Z
	esac
  done	| minN 3 | Page "= Regeln für IPv$proto ="
  done

Sets()	{
	case $1
	  in	(load)	ipset restore < ipset
	  ;&  (status)	ipset list -output save | awk '/add/{print $2" "$3}'
	  ;;	(save)	ipset save | tee ipset
	  ;;	(null)	ipset destroy ; echo
	esac		| minN 2 | Page "= IP Sets ="
	}	&&	test -x /sbin/ipset	||	Sets() { true ;}

Files()	case $1
	  in	(null)	rm -f ./* 2>/dev/null || true
	  ;;	(save)	Dir=$( mktemp -d -p $PWD $(date +%F)~XXX )
			for File in * ; do test -d $File || cp $File $Dir ; done
	  ;;	(load)	select Dir in *
			do	test -d "$Dir" && cp "$Dir"/* $PWD || continue 
				break
			done
	esac

Run()	case $1
	  in 	(4|6)		PROTOs=$1	;; (46|''|64)	PROTOs='6 4'
	  ;;	(z|zero)	Rules zero
	  ;;	(h|halt)	Rules null
	  ;;	(n|null)	Rules null ; Sets null
	  ;;	(l|load)	Run null ; Sets load ; Rules load
	  ;;	(s|save)	Files null ; Rules save ; Sets save
	  ;;	(c|copy)	Files save
	  ;;	(r|read)	Files null ; Files load
	  ;; (status|i|info)	TMOUT=3 PROTOs=${PROTOs: -1} Info
	  ;;	(*)		echo "??? Unknown command: $1" >&2 ; false
	esac

Info()	while	clear ; echo -n "Alle $TMOUT Sekunden: " ; Rules status
		KEY '46zhnls5, 8=seltener, 2=öfter, 0=beenden '
	do	case $REPLY
		  in ([4zhn6])	Run $REPLY
		  ;;	(2)	((  0 < --TMOUT )) || TMOUT=1
		  ;;	(5)	clear ; Sets status ; TMOUT=	KEY '> '
		  ;;	(8)	(( TMOUT++ < 30 )) || TMOUT=30
		  ;; ([ZHNLS])	PROTOs='6 4' Run ${REPLY,}
		  ;;	(0)	break
		esac
	done	>&2

KEY()	{ read -s -n1 ${*:+ -p "$*"} ; echo $REPLY	;}

mkdir -p "${IPT_DATA:=/var/local}/${0##*/}" ; cd "$_"
test $TERM = none || KEY "Arbeitsverzeichnis: $PWD. OK oder Abbruch mit CRTL-C: "
for CMD in 64 $@ ; do Run $CMD ; done
case $CMD in (4|46|''|64|6) Rules status ; esac