#!/bin/sh
# 软加速功能验证脚本 v2
# 用法: curl -fsSL https://dl.naixi.net/ikuai/tmp/qos-check2.sh | sh

echo "=========================================="
echo "  软加速功能验证 v2"
echo "=========================================="
echo ""

PASS=0
FAIL=0
SKIP=0

ok()   { echo "  [PASS] $1"; PASS=$((PASS+1)); }
fail() { echo "  [FAIL] $1"; FAIL=$((FAIL+1)); }
skip() { echo "  [SKIP] $1 (条件不满足)"; SKIP=$((SKIP+1)); }

# 用iptables-save输出，避免-L换行截断问题
FO_RULES=$(iptables-save -t mangle 2>/dev/null | grep "FASTOFFLOAD")

# 1. 软加速状态
echo "--- 1. 软加速状态 ---"
HAS_FOFFLOAD=$(echo "$FO_RULES" | grep -c "FLOWOFFLOAD")
echo "  FLOWOFFLOAD规则数: $HAS_FOFFLOAD"
if [ "$HAS_FOFFLOAD" -ge 1 ]; then
	ok "软加速已开启"
else
	fail "软加速未开启"
fi
echo ""

# 2. EMARK RETURN
echo "--- 2. EMARK RETURN (layer7_qos保护) ---"
HAS_EMARK=$(echo "$FO_RULES" | grep -c "emark.*RETURN")
echo "  EMARK RETURN规则数: $HAS_EMARK"
if [ "$HAS_EMARK" -ge 1 ]; then
	ok "EMARK RETURN规则存在"
else
	fail "EMARK RETURN规则缺失"
fi
echo ""

# 3. simple_qos ipset RETURN
echo "--- 3. simple_qos ipset RETURN保护 ---"
QOS_SETS=$(ipset list -n 2>/dev/null | grep "^simple_qos_[0-9]")
echo "  simple_qos ipset列表: ${QOS_SETS:-无}"
if [ -n "$QOS_SETS" ]; then
	for sname in $QOS_SETS; do
		HAS_SRC=$(echo "$FO_RULES" | grep -c "match-set $sname src.*RETURN")
		HAS_DST=$(echo "$FO_RULES" | grep -c "match-set $sname dst.*RETURN")
		if [ "$HAS_SRC" -ge 1 ] && [ "$HAS_DST" -ge 1 ]; then
			ok "$sname src/dst RETURN存在"
		else
			fail "$sname RETURN缺失 (src=$HAS_SRC dst=$HAS_DST)"
		fi
	done
else
	skip "无simple_qos ipset"
fi
echo ""

# 4. IP_QOS链
echo "--- 4. simple_qos限速规则 (IP_QOS链) ---"
HAS_IP_QOS=$(iptables-save -t filter 2>/dev/null | grep "IP_QOS" | grep -c "simple_qos")
echo "  IP_QOS规则数: $HAS_IP_QOS"
if [ "$HAS_IP_QOS" -gt 0 ]; then
	ok "simple_qos限速规则已加载"
else
	skip "IP_QOS链无规则"
fi
echo ""

# 5. 数据库
echo "--- 5. 限速规则数据库 ---"
QOS_CNT=$(sqlite3 /etc/mnt/ikuai/config.db "SELECT count(*) FROM simple_qos WHERE enabled='yes';" 2>/dev/null)
L7_CNT=$(sqlite3 /etc/mnt/ikuai/config.db "SELECT count(*) FROM layer7_qos WHERE enabled='yes';" 2>/dev/null)
echo "  simple_qos: ${QOS_CNT:-0}条  layer7_qos: ${L7_CNT:-0}条"
echo ""

# 6. 包计数 (用iptables -L -v直接看)
echo "--- 6. 包计数统计 ---"
iptables -t mangle -L FASTOFFLOAD -v -n 2>/dev/null | grep -E "RETURN|FLOWOFFLOAD" | while read line; do
	echo "  $line"
done
echo ""

# 7. Ping
echo "--- 7. Ping验证 ---"
PING_OK=$(ping -c 3 -W 2 223.5.5.5 2>/dev/null | grep -c "time=")
echo "  ping 223.5.5.5: ${PING_OK}/3包"
if [ "$PING_OK" -ge 1 ]; then
	ok "路由器ping外网正常"
else
	fail "路由器ping外网失败"
fi
echo ""

# 8. ARP绑定
echo "--- 8. ARP绑定 ---"
ARP_CNT=$(iptables-save 2>/dev/null | grep -c "arp_bind")
if [ "$ARP_CNT" -gt 0 ]; then
	ok "ARP绑定规则存在 ($ARP_CNT条)"
	echo "  >>> 请用未绑定MAC设备尝试上网，预期: 无法上网"
else
	skip "无ARP绑定规则"
fi
echo ""

# 9. 协议识别
echo "--- 9. 协议识别 ---"
DPROTOS_PID=$(pgrep -f dprotos 2>/dev/null)
if [ -n "$DPROTOS_PID" ]; then
	ok "dprotos运行中 (PID=$DPROTOS_PID)"
else
	skip "dprotos未运行"
fi
echo ""

# 汇总
echo "=========================================="
echo "  验证结果汇总"
echo "=========================================="
echo "  PASS: $PASS  FAIL: $FAIL  SKIP: $SKIP"
if [ "$FAIL" -gt 0 ]; then
	echo "  >>> 有$FAIL项未通过"
else
	echo "  >>> 自动检查全部通过"
fi
echo ""
echo "  需手动验证:"
echo "  1. IP限速: 用限速IP设备测速"
echo "  2. ARP绑定: 非绑定MAC设备上网"
echo "  3. 协议识别: Web界面查看"
echo "  4. Ping: LAN设备ping路由器+外网"
echo "=========================================="