#!/bin/sh
# 软加速功能验证脚本
# 用法: curl -fsSL https://dl.naixi.net/ikuai/tmp/qos-check.sh | sh

echo "=========================================="
echo "  软加速功能验证"
echo "=========================================="
echo ""

PASS=0
FAIL=0
SKIP=0

ok()   { echo "  [PASS] $1"; PASS=$((PASS+1)); }
fail() { echo "  [FAIL] $1"; FAIL=$((FAIL+1)); }
skip() { echo "  [SKIP] $1 (条件不满足)"; SKIP=$((SKIP+1)); }

# 1. 检查软加速状态
echo "--- 1. 软加速状态 ---"
FAST_NAT=$(grep "fast_nat" /tmp/iktmp/config/basic 2>/dev/null | head -1)
if [ -z "$FAST_NAT" ]; then
	# 从数据库读
	FAST_NAT=$(sqlite3 /etc/mnt/ikuai/config.db "SELECT fast_nat FROM basic LIMIT 1;" 2>/dev/null)
fi
echo "  fast_nat = $FAST_NAT"

# FASTOFFLOAD链有没有规则
HAS_FOFFLOAD=$(iptables -t mangle -L FASTOFFLOAD -n 2>/dev/null | grep -c "FLOWOFFLOAD")
echo "  FLOWOFFLOAD规则数: $HAS_FOFFLOAD"

if [ "$HAS_FOFFLOAD" -gt 0 ]; then
	ok "软加速已开启 (FLOWOFFLOAD规则存在)"
else
	fail "软加速未开启，请在Web界面开启软加速后重试"
fi
echo ""

# 2. 检查EMARK RETURN规则
echo "--- 2. EMARK RETURN (layer7_qos保护) ---"
HAS_EMARK=$(iptables -t mangle -L FASTOFFLOAD -n 2>/dev/null | grep -c "emark.*RETURN")
echo "  EMARK RETURN规则数: $HAS_EMARK"
if [ "$HAS_EMARK" -ge 1 ]; then
	ok "EMARK RETURN规则存在"
else
	fail "EMARK RETURN规则缺失 — layer7_qos限速会被offload跳过"
fi
echo ""

# 3. 检查simple_qos ipset RETURN规则
echo "--- 3. simple_qos ipset RETURN保护 ---"
# 获取所有simple_qos ipset
QOS_SETS=$(ipset list -n 2>/dev/null | grep "^simple_qos_[0-9]")
echo "  simple_qos ipset列表: ${QOS_SETS:-无}"

if [ -n "$QOS_SETS" ]; then
	for sname in $QOS_SETS; do
		HAS_SRC=$(iptables -t mangle -L FASTOFFLOAD -n 2>/dev/null | grep -c "match-set $sname src.*RETURN")
		HAS_DST=$(iptables -t mangle -L FASTOFFLOAD -n 2>/dev/null | grep -c "match-set $sname dst.*RETURN")
		if [ "$HAS_SRC" -ge 1 ] && [ "$HAS_DST" -ge 1 ]; then
			ok "$sname src/dst RETURN存在"
		else
			fail "$sname RETURN缺失 (src=$HAS_SRC dst=$HAS_DST)"
		fi
	done
else
	skip "simple_qos ipset不存在 (未配置IP限速)"
fi
echo ""

# 4. 检查IP_QOS链 (simple_qos限速规则)
echo "--- 4. simple_qos限速规则 (IP_QOS链) ---"
HAS_IP_QOS=$(iptables -L IP_QOS -n 2>/dev/null | grep -c "simple_qos")
echo "  IP_QOS规则数: $HAS_IP_QOS"
if [ "$HAS_IP_QOS" -gt 0 ]; then
	ok "simple_qos限速规则已加载"
else
	skip "IP_QOS链无规则 (未配置IP限速或未加载simple_qos.sh)"
fi
echo ""

# 5. 检查限速规则数据库
echo "--- 5. 限速规则数据库 ---"
QOS_CNT=$(sqlite3 /etc/mnt/ikuai/config.db "SELECT count(*) FROM simple_qos WHERE enabled='yes';" 2>/dev/null)
L7_CNT=$(sqlite3 /etc/mnt/ikuai/config.db "SELECT count(*) FROM layer7_qos WHERE enabled='yes';" 2>/dev/null)
MACQ_CNT=$(sqlite3 /etc/mnt/ikuai/config.db "SELECT count(*) FROM mac_qos WHERE enabled='yes';" 2>/dev/null)
echo "  simple_qos规则: ${QOS_CNT:-0}条"
echo "  layer7_qos规则: ${L7_CNT:-0}条"
echo "  mac_qos规则: ${MACQ_CNT:-0}条"
echo ""

# 6. 统计验证 — FLOWOFFLOAD和RETURN的包计数
echo "--- 6. 包计数统计 ---"
iptables -t mangle -L FASTOFFLOAD -v -n 2>/dev/null | while read pkts bytes rest; do
	if echo "$rest" | grep -qE "RETURN|FLOWOFFLOAD"; then
		echo "  $rest | pkts=$pkts bytes=$bytes"
	fi
done
echo ""

# 7. ARP绑定验证
echo "--- 7. ARP绑定 ---"
ARP_BIND_CNT=$(iptables -L FORWARD -n 2>/dev/null | grep -c "match-set.*arp_bind")
echo "  ARP绑定规则数: $ARP_BIND_CNT"
if [ "$ARP_BIND_CNT" -gt 0 ]; then
	# 检查ARP绑定规则在filter表FORWARD链
	# 软加速跳过的是mangle表，filter表FORWARD链在offload前
	# 但FLOWOFFLOAD跳过后FORWARD的后续规则也会跳过
	ok "ARP绑定规则存在 — 验证: 非绑定MAC能否上网"
	echo "  >>> 请用未绑定MAC设备尝试上网，预期: 无法上网"
else
	skip "无ARP绑定规则"
fi
echo ""

# 8. 协议识别验证
echo "--- 8. 协议识别 ---"
# 协议识别依赖L7过滤，检查dprotos模块
DPROTOS_PID=$(pgrep -f dprotos 2>/dev/null)
echo "  dprotos进程: ${DPROTOS_PID:-未运行}"
if [ -n "$DPROTOS_PID" ]; then
	ok "协议识别模块运行中"
	echo "  >>> 请在Web界面查看协议识别是否正常显示"
else
	skip "dprotos未运行"
fi
echo ""

# 9. Ping验证
echo "--- 9. Ping验证 ---"
# 路由器自身ping外网
PING_RESULT=$(ping -c 3 -W 2 223.5.5.5 2>/dev/null)
PING_OK=$(echo "$PING_RESULT" | grep -c "time=")
echo "  ping 223.5.5.5: ${PING_OK}/3包"
if [ "$PING_OK" -ge 1 ]; then
	ok "路由器ping外网正常"
else
	fail "路由器ping外网失败"
fi

# ping从LAN侧设备
echo "  >>> 请从LAN设备ping路由器网关(192.168.9.1)，预期: 能通"
echo "  >>> 请从LAN设备ping外网(223.5.5.5)，预期: 能通"
echo ""

# 10. 综合结论
echo "=========================================="
echo "  验证结果汇总"
echo "=========================================="
echo "  PASS: $PASS"
echo "  FAIL: $FAIL"
echo "  SKIP: $SKIP"
echo ""

if [ "$FAIL" -gt 0 ]; then
	echo "  >>> 有$FAIL项未通过，请检查上方详细信息"
else
	echo "  >>> 全部通过"
fi

echo ""
echo "  以下需手动验证:"
echo "  1. IP限速: 用限速IP设备测速，确认限速生效"
echo "  2. ARP绑定: 用非绑定MAC设备尝试上网，预期无法上网"
echo "  3. 协议识别: Web界面查看应用识别列表是否正常"
echo "  4. Ping: LAN设备ping路由器+ping外网"
echo "=========================================="