From 88b1a633d74c62afbe94a31e7c13d55022ce5684 Mon Sep 17 00:00:00 2001 From: ctaoist Date: Fri, 25 Sep 2026 13:18:43 +0800 Subject: [PATCH] =?UTF-8?q?feat:=20=E5=8A=A8=E6=80=81=E5=90=8C=E6=AD=A5=20?= =?UTF-8?q?IPv6=20=E5=89=8D=E7=BC=80=E5=88=B0=20nftables?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- scripts/init.sh | 2 +- scripts/starts/fw_getlanip.sh | 179 ++++++++++++++++++++++++++++---- scripts/starts/fw_ipv6_watch.sh | 123 ++++++++++++++++++++++ scripts/starts/fw_nftables.sh | 26 +++-- scripts/starts/fw_start.sh | 5 + scripts/starts/fw_stop.sh | 3 +- tests/test_fw_ipv6_prefix.sh | 83 +++++++++++++++ tests/test_fw_nftables_ipv6.sh | 78 ++++++++++++++ 8 files changed, 466 insertions(+), 33 deletions(-) create mode 100755 scripts/starts/fw_ipv6_watch.sh create mode 100755 tests/test_fw_ipv6_prefix.sh create mode 100755 tests/test_fw_nftables_ipv6.sh diff --git a/scripts/init.sh b/scripts/init.sh index 00d7a4b8..46295b78 100644 --- a/scripts/init.sh +++ b/scripts/init.sh @@ -77,7 +77,7 @@ rm -rf "$CRASHDIR"/starts/shellcrash.openrc command -v bash >/dev/null 2>&1 && shtype=bash [ -x /bin/ash ] && shtype=ash #批量授权 -for file in start.sh starts/bfstart.sh starts/afstart.sh starts/fw_stop.sh menu.sh menus/task_cmd.sh menus/bot_tg.sh; do +for file in start.sh starts/bfstart.sh starts/afstart.sh starts/fw_stop.sh starts/fw_ipv6_watch.sh menu.sh menus/task_cmd.sh menus/bot_tg.sh; do sed -i "s|/bin/sh|/bin/$shtype|" "$CRASHDIR/$file" 2>/dev/null chmod +x "$CRASHDIR/$file" 2>/dev/null done diff --git a/scripts/starts/fw_getlanip.sh b/scripts/starts/fw_getlanip.sh index 2d9e3a39..d5812e49 100644 --- a/scripts/starts/fw_getlanip.sh +++ b/scripts/starts/fw_getlanip.sh @@ -1,34 +1,171 @@ +ipv6_route_prefixes() { + awk ' + function is_global_prefix(value) { + return value ~ /^[23][0-9A-Fa-f]*:/ && value ~ /\/[0-9]+$/ + } + $1 == "default" { + for (i = 1; i < NF; i++) { + if ($i == "from" && is_global_prefix($(i + 1))) + print $(i + 1) + } + next + } + is_global_prefix($1) { + via = 0 + for (i = 1; i <= NF; i++) { + if ($i == "via") + via = 1 + } + if (!via) + print $1 + }' +} + +get_lan_ifaces() { + ip route show scope link 2>/dev/null | + grep -Ev 'default|ppp|wan|utun|iot|peer|docker|podman|virbr|vnet|ovs|vmbr|veth|vmnic|vboxnet|lxcbr|xenbr|vEthernet|wgs|multicast|anycast' | + awk '{for(i=1;i<=NF;i++) if($i=="dev") {print $(i+1); break}}' | + grep -v '^lo$' | + sort -u +} + +get_openwrt_lan_ifaces() { + if command -v ubus >/dev/null 2>&1; then + ubus -S call network.interface.lan status 2>/dev/null | + awk -F '"' '$2 == "l3_device" {print $4}' + fi + printf '%s\n' $lan_ifaces +} + +get_ipv6_prefixes_openwrt() { + ipv6_prefixes=$( + for ipv6_iface in $(get_openwrt_lan_ifaces | sort -u); do + ip -6 route show dev "$ipv6_iface" 2>/dev/null | + grep -v '^default' | + ipv6_route_prefixes + done + ) + # Some OpenWrt variants do not expose the LAN route through BusyBox ip. + # In that case, use netifd's source-specific default route as a fallback. + [ -n "$ipv6_prefixes" ] || ipv6_prefixes=$( + ip -6 route show default 2>/dev/null | ipv6_route_prefixes + ) + printf '%s\n' "$ipv6_prefixes" | sort -u +} + +get_ipv6_prefixes_linux() { + ipv6_prefixes=$( + for ipv6_iface in $lan_ifaces; do + ip -6 route show dev "$ipv6_iface" 2>/dev/null | grep -v '^default' + done | ipv6_route_prefixes | sort -u + ) + # A host may use one interface for both its uplink and LAN, or may not + # have an IPv4 LAN route. Fall back to directly connected global routes. + [ -n "$ipv6_prefixes" ] || ipv6_prefixes=$( + ip -6 route show 2>/dev/null | + grep -Ev 'unreachable|prohibit|blackhole|ppp|wan|utun|iot|peer|docker|podman|virbr|vnet|ovs|vmbr|veth|vmnic|vboxnet|lxcbr|xenbr|vEthernet|wgs|multicast|anycast' | + ipv6_route_prefixes | + sort -u + ) + printf '%s\n' "$ipv6_prefixes" +} + +get_ipv6_prefixes_router() { + # Padavan/Asuswrt and other BusyBox based firmware do not consistently + # expose route protocol metadata. Only depend on route shape and devices. + ipv6_prefixes=$( + for ipv6_iface in $lan_ifaces; do + ip -6 route show dev "$ipv6_iface" 2>/dev/null | + grep -v '^default' | + ipv6_route_prefixes + done + ) + [ -n "$ipv6_prefixes" ] || ipv6_prefixes=$( + ip -6 route show default 2>/dev/null | ipv6_route_prefixes + ) + printf '%s\n' "$ipv6_prefixes" | sort -u +} + +get_ipv6_prefixes_fallback() { + # Generic fallback for systems unknown to ShellCrash. Avoid fixed field + # positions and route protocol names, which differ across ip variants. + ip -6 route show 2>/dev/null | ipv6_route_prefixes | sort -u +} + +get_ipv6_platform() { + case "$systype" in + mi_snapshot | ng_snapshot) + echo openwrt + return + ;; + Padavan | asusrouter) + echo router + return + ;; + container) + echo linux + return + ;; + esac + + if [ -f /etc/openwrt_release ] || { [ -f /etc/rc.common ] && command -v uci >/dev/null 2>&1; }; then + echo openwrt + elif [ "$(uname -s 2>/dev/null)" = Linux ]; then + echo linux + else + echo fallback + fi +} + +get_ipv6_prefixes() { + [ -n "$lan_ifaces" ] || lan_ifaces=$(get_lan_ifaces) + case "$(get_ipv6_platform)" in + openwrt) get_ipv6_prefixes_openwrt ;; + router) get_ipv6_prefixes_router ;; + linux) get_ipv6_prefixes_linux ;; + *) get_ipv6_prefixes_fallback ;; + esac +} + +build_host_ipv6() { + host_ipv6="fe80::/10 fd00::/8 $1" + [ "$ts_service" = ON ] && host_ipv6="$host_ipv6 fd7a:115c:a1e0::/48" + if [ "$wg_service" = ON ]; then + [ -f "$CRASHDIR"/configs/gateway.cfg ] && . "$CRASHDIR"/configs/gateway.cfg + [ -n "$wg_ipv6" ] && host_ipv6="$host_ipv6 $wg_ipv6" + fi + # Only pass prefix-shaped values to firewall generators and keep the + # result stable so the watcher can compare it cheaply. + host_ipv6=$(printf '%s\n' "$host_ipv6" | + tr ' ' '\n' | + awk '/^[0-9A-Fa-f:]+\/[0-9]+$/ {print}' | + sort -u | + tr '\n' ' ' | + sed 's/ $//') +} + getlanip() { #获取局域网host地址 i=1 while [ "$i" -le "20" ]; do #ipv4局域网网段 host_ipv4=$(ip route show scope link | grep -Ev 'default|wan|utun|iot|peer|docker|podman|virbr|vnet|ovs|vmbr|veth|vmnic|vboxnet|lxcbr|xenbr|vEthernet|wgs|multicast|anycast' | awk '{print $1}') - #ipv6局域网网段 - 从IPv4已识别的LAN接口获取全局IPv6前缀 - [ "$ipv6_redir" = "ON" ] && { - lan_ifaces=$(ip route show scope link | grep -Ev 'ppp|wan|utun|iot|peer|docker|podman|virbr|vnet|ovs|vmbr|veth|vmnic|vboxnet|lxcbr|xenbr|vEthernet|wgs|multicast|anycast' | awk '{for(i=1;i<=NF;i++) if($i=="dev") {print $(i+1); break}}' | grep -v '^lo$' | sort -u) - host_ipv6=$( - for iface in $lan_ifaces; do - ip -6 addr show dev $iface 2>/dev/null - done | grep 'scope global' | awk '{print $2}' | tr '\n' ' ' | sed 's/ $//' - ) - [ -z "$host_ipv6" ] && host_ipv6=$(ip -6 route show | grep -Ev 'default|unreachable|fe80::/|wan|ppp|utun|iot|peer|docker|podman|virbr|vnet|ovs|vmbr|veth|vmnic|vboxnet|lxcbr|xenbr|vEthernet|wgs|multicast|anycast' | awk '{print $1}' | tr '\n' ' ' | sed 's/ $//') - } + #ipv6局域网网段 + if [ "$ipv6_redir" = "ON" ]; then + lan_ifaces=$(get_lan_ifaces) + detected_host_ipv6=$(get_ipv6_prefixes) + fi [ -f "$TMPDIR"/ShellCrash.log ] && break - [ -n "$host_ipv4" -a "$ipv6_redir" != "ON" ] && break - [ -n "$host_ipv4" -a -n "$host_ipv6" ] && break + [ -n "$host_ipv4" ] && [ "$ipv6_redir" != "ON" ] && break + [ -n "$host_ipv4" ] && [ -n "$detected_host_ipv6" ] && break sleep 1 && i=$((i + 1)) done #Tailscale - [ "$ts_service" = ON ] && { - ts_host_ipv4=' 100.64.0.0/10' - ts_host_ipv6=' fd7a:115c:a1e0::/48' - } + [ "$ts_service" = ON ] && ts_host_ipv4=' 100.64.0.0/10' #Wireguard - [ "$wg_service" = ON ] && { + if [ "$wg_service" = ON ]; then . "$CRASHDIR"/configs/gateway.cfg - wg_host_ipv4=' $wg_ipv4' - [ -n "$wg_ipv6" ] && wg_host_ipv6=' $wg_ipv6' - } + wg_host_ipv4=" $wg_ipv4" + fi #添加自定义ipv4局域网网段 if [ "$replace_default_host_ipv4" = "ON" ]; then host_ipv4="$cust_host_ipv4" @@ -40,7 +177,7 @@ getlanip() { #获取局域网host地址 host_ipv4='192.168.0.0/16 10.0.0.0/12 172.16.0.0/12' logger "无法获取本地LAN-IPV4网段，请前往流量过滤设置界面设置自定义网段！" 31 } - host_ipv6="fe80::/10 fd00::/8 $host_ipv6$ts_host_ipv6$wg_host_ipv6" + build_host_ipv6 "$detected_host_ipv6" #获取本机出口IP地址 local_ipv4=$(ip route 2>&1 | grep -Ev 'utun|iot|docker|linkdown' | grep -Eo 'src.*' | grep -Eo '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sort -u) [ -z "$local_ipv4" ] && local_ipv4=$(ip route 2>&1 | grep -Eo 'src.*' | grep -Eo '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sort -u) diff --git a/scripts/starts/fw_ipv6_watch.sh b/scripts/starts/fw_ipv6_watch.sh new file mode 100755 index 00000000..dd66ee92 --- /dev/null +++ b/scripts/starts/fw_ipv6_watch.sh @@ -0,0 +1,123 @@ +#!/bin/sh +# Keep the nftables LAN IPv6 prefix set in sync with dynamic prefixes. + +[ -z "$CRASHDIR" ] && CRASHDIR=$( + cd "$(dirname "$0")" + cd .. + pwd +) +. "$CRASHDIR"/libs/get_config.sh +. "$CRASHDIR"/starts/fw_getlanip.sh + +[ -z "$TMPDIR" ] && TMPDIR=/tmp/ShellCrash +ipv6_watch_pid="$TMPDIR/ipv6_watch.pid" +ipv6_watch_fifo="$TMPDIR/ipv6_route_monitor.$$" +ipv6_nft_family=${SHELLCRASH_NFT_FAMILY:-inet} +ipv6_nft_table=${SHELLCRASH_NFT_TABLE:-shellcrash} +ipv6_nft_set=${SHELLCRASH_IPV6_SET:-lan_ip6} + +stop_ipv6_watch() { + [ -s "$ipv6_watch_pid" ] || return 0 + ipv6_watch_old_pid=$(cat "$ipv6_watch_pid" 2>/dev/null) + case "$ipv6_watch_old_pid" in + '' | *[!0-9]*) ;; + *) + if [ ! -r "/proc/$ipv6_watch_old_pid/cmdline" ] || + tr '\0' ' ' <"/proc/$ipv6_watch_old_pid/cmdline" 2>/dev/null | grep -q 'fw_ipv6_watch.sh'; then + kill "$ipv6_watch_old_pid" 2>/dev/null + fi + ;; + esac + rm -f "$ipv6_watch_pid" +} + +cleanup_ipv6_watch() { + trap - EXIT INT TERM + [ -n "$ipv6_monitor_pid" ] && kill "$ipv6_monitor_pid" 2>/dev/null + [ -p "$ipv6_watch_fifo" ] && rm -f "$ipv6_watch_fifo" + if [ "$(cat "$ipv6_watch_pid" 2>/dev/null)" = "$$" ]; then + rm -f "$ipv6_watch_pid" + fi + exit 0 +} + +update_ipv6_set() { + lan_ifaces=$(get_lan_ifaces) + detected_host_ipv6=$(get_ipv6_prefixes) + build_host_ipv6 "$detected_host_ipv6" + ipv6_watch_state="$host_ipv6" + + if [ "$ipv6_watch_state" = "$ipv6_watch_last_state" ] && + nft list set "$ipv6_nft_family" "$ipv6_nft_table" "$ipv6_nft_set" >/dev/null 2>&1; then + return 0 + fi + + ipv6_watch_elements=$(echo "$host_ipv6" | sed 's/[[:space:]]\+/, /g') + [ -n "$ipv6_watch_elements" ] || return 1 + nft list set "$ipv6_nft_family" "$ipv6_nft_table" "$ipv6_nft_set" >/dev/null 2>&1 || return 1 + + # nft processes a batch atomically, so packets never observe a partially + # updated set while an ISP prefix is being replaced. + printf 'flush set %s %s %s\nadd element %s %s %s { %s }\n' \ + "$ipv6_nft_family" "$ipv6_nft_table" "$ipv6_nft_set" \ + "$ipv6_nft_family" "$ipv6_nft_table" "$ipv6_nft_set" "$ipv6_watch_elements" | + nft -f - >/dev/null 2>&1 || return 1 + ipv6_watch_last_state="$ipv6_watch_state" +} + +run_iproute2_monitor() { + rm -f "$ipv6_watch_fifo" + mkfifo "$ipv6_watch_fifo" 2>/dev/null || return 1 + ip -6 monitor route >"$ipv6_watch_fifo" 2>/dev/null & + ipv6_monitor_pid=$! + while IFS= read -r _ipv6_route_event; do + # Coalesce delete/add notifications emitted during renumbering. + sleep 1 + update_ipv6_set + done <"$ipv6_watch_fifo" + wait "$ipv6_monitor_pid" 2>/dev/null + ipv6_monitor_pid= + rm -f "$ipv6_watch_fifo" + return 1 +} + +run_ipv6_watch() { + mkdir -p "$TMPDIR" + echo $$ >"$ipv6_watch_pid" + trap cleanup_ipv6_watch EXIT INT TERM + ipv6_watch_last_state= + update_ipv6_set + + # Full iproute2 has event monitoring. BusyBox/router variants that do not + # support it use a small polling fallback instead. + if ip -Version 2>&1 | grep -qi 'iproute2'; then + run_iproute2_monitor + fi + while :; do + sleep 30 + update_ipv6_set + done +} + +case "$1" in +start) + mkdir -p "$TMPDIR" + stop_ipv6_watch + /bin/sh "$0" run >/dev/null 2>&1 & + echo $! >"$ipv6_watch_pid" + ;; +stop) + stop_ipv6_watch + ;; +run) + run_ipv6_watch + ;; +once) + ipv6_watch_last_state= + update_ipv6_set + ;; +*) + echo "Usage: $0 {start|stop|run|once}" >&2 + exit 1 + ;; +esac diff --git a/scripts/starts/fw_nftables.sh b/scripts/starts/fw_nftables.sh index c1d5e2c9..66cd831e 100644 --- a/scripts/starts/fw_nftables.sh +++ b/scripts/starts/fw_nftables.sh @@ -2,13 +2,22 @@ # Copyright (C) Juewuy RESERVED_IP=$(echo $reserve_ipv4 | sed 's/[[:space:]]\+/, /g') -RESERVED_IP6=$(echo "$reserve_ipv6 $host_ipv6" | sed 's/[[:space:]]\+/, /g') +RESERVED_IP6=$(echo "$reserve_ipv6" | sed 's/[[:space:]]\+/, /g') + +start_nft_ipv6_set() { + HOST_IP6=$(echo "$host_ipv6" | sed 's/[[:space:]]\+/, /g') + nft list set inet shellcrash lan_ip6 >/dev/null 2>&1 || + nft add set inet shellcrash lan_ip6 { type ipv6_addr \; flags interval \; auto-merge \; } + nft flush set inet shellcrash lan_ip6 2>/dev/null + [ -n "$HOST_IP6" ] && nft add element inet shellcrash lan_ip6 { $HOST_IP6 } +} add_ip6_route(){ - #过滤保留地址及本机地址 + #过滤保留地址及当前局域网地址 nft add rule inet shellcrash $1 ip6 daddr {$RESERVED_IP6} return - #仅代理本机局域网网段流量 - nft add rule inet shellcrash $1 ip6 saddr != {$HOST_IP6} return + nft add rule inet shellcrash $1 ip6 daddr @lan_ip6 return + #OUTPUT只包含本机流量，无需依赖动态公网源前缀 + [ "$1" = 'prerouting' ] && nft add rule inet shellcrash $1 ip6 saddr != @lan_ip6 return #绕过CN_IPV6 [ "$dns_mod" != "fake-ip" -a "$cn_ip_route" = "ON" -a -f "$BINDIR"/cn_ipv6.txt ] && { CN_IP6=$(awk '{printf "%s, ",$1}' "$BINDIR"/cn_ipv6.txt) @@ -83,10 +92,8 @@ start_nft_route() { #nftables-route通用工具 } #局域网ipv6支持 if [ "$ipv6_redir" = "ON" -a "$1" = 'prerouting' -a "$firewall_area" != 5 ]; then - HOST_IP6=$(echo $host_ipv6 | sed 's/[[:space:]]\+/, /g') add_ip6_route "$1" elif [ "$ipv6_redir" = "ON" -a "$1" = 'output' -a \( "$firewall_area" = 2 -o "$firewall_area" = 3 \) ]; then - HOST_IP6="::1, $(echo $host_ipv6 | sed 's/[[:space:]]\+/, /g')" add_ip6_route "$1" else nft add rule inet shellcrash $1 meta nfproto ipv6 return @@ -106,7 +113,6 @@ start_nft_route() { #nftables-route通用工具 start_nft_dns() { #nftables-dns [ "$1" = 'prerouting' ] && { HOST_IP=$(echo $host_ipv4 | sed 's/[[:space:]]\+/, /g') - HOST_IP6=$(echo $host_ipv6 | sed 's/[[:space:]]\+/, /g') } [ "$1" = 'output' ] && HOST_IP="127.0.0.0/8, $(echo $local_ipv4 | sed 's/[[:space:]]\+/, /g')" [ "$1" = 'prerouting_vm' ] && HOST_IP="$(echo $vm_ipv4 | sed 's/[[:space:]]\+/, /g')" @@ -119,7 +125,7 @@ start_nft_dns() { #nftables-dns nft add rule inet shellcrash "$1"_dns meta skgid { 453, 7890 } return [ "$firewall_area" = 5 ] && nft add rule inet shellcrash "$1"_dns ip saddr $bypass_host return nft add rule inet shellcrash "$1"_dns ip saddr != {$HOST_IP} return #屏蔽外部请求 - [ "$1" = 'prerouting' ] && nft add rule inet shellcrash "$1"_dns ip6 saddr != {$HOST_IP6} return #屏蔽外部请求 + [ "$1" = 'prerouting' ] && nft add rule inet shellcrash "$1"_dns ip6 saddr != @lan_ip6 return #屏蔽外部请求 #过滤局域网设备 [ "$1" = 'prerouting' ] && [ -s "$CRASHDIR"/configs/mac ] && { MAC=$(awk '{printf "%s, ",$1}' "$CRASHDIR"/configs/mac) @@ -134,7 +140,6 @@ start_nft_dns() { #nftables-dns } start_nft_wan() { #nftables公网防火墙 HOST_IP=$(echo $host_ipv4 | sed 's/[[:space:]]\+/, /g') - HOST_IP6=$(echo $host_ipv6 | sed 's/[[:space:]]\+/, /g') nft add chain inet shellcrash input { type filter hook input priority -100 \; } nft add rule inet shellcrash input iif lo accept #本机请求全放行 #端口放行 @@ -148,7 +153,7 @@ start_nft_wan() { #nftables公网防火墙 #端口拦截 reject_ports="{ $mix_port, $db_port }" nft add rule inet shellcrash input ip saddr {$HOST_IP} accept - nft add rule inet shellcrash input ip6 saddr {$HOST_IP6} accept + nft add rule inet shellcrash input ip6 saddr @lan_ip6 accept nft add rule inet shellcrash input tcp dport $reject_ports reject nft add rule inet shellcrash input udp dport $reject_ports reject #fw4特殊处理 @@ -160,6 +165,7 @@ start_nftables() { #nftables配置总入口 #初始化nftables nft add table inet shellcrash 2>/dev/null nft flush table inet shellcrash 2>/dev/null + start_nft_ipv6_set #公网访问防火墙 [ "$fw_wan" != OFF ] && [ "$systype" != 'container' ] && start_nft_wan #启动DNS劫持 diff --git a/scripts/starts/fw_start.sh b/scripts/starts/fw_start.sh index 6a6927ab..c81a9c05 100644 --- a/scripts/starts/fw_start.sh +++ b/scripts/starts/fw_start.sh @@ -1,6 +1,8 @@ #!/bin/sh # Copyright (C) Juewuy +#停止旧的IPv6前缀监听，避免防火墙重建期间并发更新 +[ -f "$CRASHDIR"/starts/fw_ipv6_watch.sh ] && /bin/sh "$CRASHDIR"/starts/fw_ipv6_watch.sh stop #获取局域网host地址 . "$CRASHDIR"/starts/fw_getlanip.sh && getlanip #缺省值 @@ -46,6 +48,9 @@ #防火墙配置 [ "$firewall_mod" = 'iptables' ] && . "$CRASHDIR"/starts/fw_iptables.sh && start_iptables [ "$firewall_mod" = 'nftables' ] && . "$CRASHDIR"/starts/fw_nftables.sh && start_nftables +#动态更新nftables中的IPv6局域网前缀集合 +[ "$firewall_mod" = 'nftables' -a "$ipv6_redir" = "ON" ] && + /bin/sh "$CRASHDIR"/starts/fw_ipv6_watch.sh start #修复部分虚拟机dns查询失败的问题 [ "$firewall_area" = 2 -o "$firewall_area" = 3 ] && [ -z "$(grep '127.0.0.1' /etc/resolv.conf 2>/dev/null)" ] && [ "$systype" != 'container' ] && { line=$(grep -n 'nameserver' /etc/resolv.conf | awk -F: 'FNR==1{print $1}') diff --git a/scripts/starts/fw_stop.sh b/scripts/starts/fw_stop.sh index 2a5d99c6..354f138d 100644 --- a/scripts/starts/fw_stop.sh +++ b/scripts/starts/fw_stop.sh @@ -5,6 +5,8 @@ [ -z "$CRASHDIR" ] && CRASHDIR=$( cd $(dirname $0);cd ..;pwd) . "$CRASHDIR"/libs/get_config.sh . "$CRASHDIR"/libs/check_cmd.sh +#停止IPv6前缀监听 +[ -f "$CRASHDIR"/starts/fw_ipv6_watch.sh ] && /bin/sh "$CRASHDIR"/starts/fw_ipv6_watch.sh stop . "$CRASHDIR"/starts/fw_getlanip.sh && getlanip #获取局域网host地址 #缺省值 [ -z "$common_ports" ] && common_ports='ON' @@ -172,4 +174,3 @@ ckcmd nft && nft delete table inet shellcrash >/dev/null 2>&1 [ -s /etc/init.d/firewall.bak ] && mv -f /etc/init.d/firewall.bak /etc/init.d/firewall #others sed -i '/shellcrash-dns-repair/d' /etc/resolv.conf 2>/dev/null - diff --git a/tests/test_fw_ipv6_prefix.sh b/tests/test_fw_ipv6_prefix.sh new file mode 100755 index 00000000..63e7982f --- /dev/null +++ b/tests/test_fw_ipv6_prefix.sh @@ -0,0 +1,83 @@ +#!/bin/sh +set -eu + +ROOT=$(cd "$(dirname "$0")/.." && pwd) +. "$ROOT/scripts/starts/fw_getlanip.sh" + +assert_equal() { + if [ "$1" != "$2" ]; then + echo "expected: [$1]" >&2 + echo "actual: [$2]" >&2 + exit 1 + fi +} + +route_output='default via fe80::1 dev eth0 +default from 240e:1234:5600::/56 via fe80::1 dev pppoe-wan +2408:8266:501:2443::/64 dev enp2s0 proto kernel +2606:4700::/48 via fe80::2 dev eth0 +unreachable 240e:1234:5600::/48 dev lo' +actual=$(printf '%s\n' "$route_output" | ipv6_route_prefixes | sort -u) +expected='2408:8266:501:2443::/64 +240e:1234:5600::/56' +assert_equal "$expected" "$actual" + +# OpenWrt prefers the LAN assignment over the wider delegated prefix. +systype=mi_snapshot +lan_ifaces='br-lan' +ubus() { + printf '%s\n' '{ "l3_device": "br-lan" }' +} +ip() { + case "$*" in + '-6 route show dev br-lan') + echo 'default from 240e:1234:5600::/56 via fe80::1 dev br-lan' + echo '240e:1234:5600:1::/64 dev br-lan proto static' + ;; + '-6 route show default') echo 'default from 240e:1234:5600::/56 via fe80::1 dev pppoe-wan' ;; + esac +} +actual=$(get_ipv6_prefixes) +assert_equal '240e:1234:5600:1::/64' "$actual" + +# OpenWrt falls back to source-specific routes when its LAN route is hidden. +lan_ifaces= +ubus() { + return 0 +} +ip() { + case "$*" in + '-6 route show default') echo 'default from 240e:1234:5600::/56 via fe80::1 dev pppoe-wan' ;; + esac +} +actual=$(get_ipv6_prefixes) +assert_equal '240e:1234:5600::/56' "$actual" + +# Standard Linux uses the directly connected route on the discovered LAN. +systype=container +lan_ifaces='enp2s0' +ip() { + case "$*" in + '-6 route show dev enp2s0') echo '2408:8266:501:2443::/64 dev enp2s0 proto kernel metric 256' ;; + esac +} +actual=$(get_ipv6_prefixes) +assert_equal '2408:8266:501:2443::/64' "$actual" + +# BusyBox based router firmware does not need route protocol metadata. +systype=Padavan +lan_ifaces='br0' +ip() { + case "$*" in + '-6 route show dev br0') echo '2001:db8:abcd:1::/64 dev br0 metric 256' ;; + esac +} +actual=$(get_ipv6_prefixes) +assert_equal '2001:db8:abcd:1::/64' "$actual" + +ts_service=ON +wg_service=OFF +build_host_ipv6 '2408:8266:501:2443::/64 invalid-value' +assert_equal '2408:8266:501:2443::/64 fd00::/8 fd7a:115c:a1e0::/48 fe80::/10' "$host_ipv6" + +echo 'IPv6 prefix tests passed' diff --git a/tests/test_fw_nftables_ipv6.sh b/tests/test_fw_nftables_ipv6.sh new file mode 100755 index 00000000..4da01b46 --- /dev/null +++ b/tests/test_fw_nftables_ipv6.sh @@ -0,0 +1,78 @@ +#!/bin/sh +set -eu + +ROOT=$(cd "$(dirname "$0")/.." && pwd) + +reserve_ipv4='0.0.0.0/8 127.0.0.0/8' +reserve_ipv6='::/128 ::1/128 fe80::/10 ff00::/8' +host_ipv4='192.168.1.0/24' +local_ipv4='192.168.1.1' +host_ipv6='2001:db8:1::/64 fd00::/8 fe80::/10' +common_ports=OFF +ports= +PORTS= +mix_port=7890 +redir_port=7892 +tproxy_port=7893 +dns_redir_port=1053 +routing_mark=7894 +fwmark=7892 +firewall_area=3 +macfilter_type='黑名单' +cn_ip_route=OFF +dns_mod=route +ipv6_redir=ON +quic_rj=OFF +lan_proxy=true +local_proxy=true +redir_mod=Tproxy +tun_statu=false +vm_redir=OFF +fw_wan=ON +fw_wan_ports= +vms_port= +sss_port= +db_port=9090 +systype=linux +CRASHDIR=/nonexistent +BINDIR=/nonexistent + +nft() { + if [ "$1" = list ] && [ "$2" = set ]; then + return 1 + fi + printf '%s' "$1" + shift + printf ' %s' "$@" + printf '\n' +} + +modprobe() { + return 0 +} + +. "$ROOT/scripts/starts/fw_nftables.sh" +rules=$(start_nftables || :) + +require_rule() { + if ! printf '%s\n' "$rules" | grep -Fq "$1"; then + echo "missing generated rule: $1" >&2 + exit 1 + fi +} + +require_rule 'add set inet shellcrash lan_ip6' +require_rule 'flags interval ; auto-merge' +require_rule 'add element inet shellcrash lan_ip6' +require_rule 'add rule inet shellcrash prerouting ip6 daddr @lan_ip6 return' +require_rule 'add rule inet shellcrash prerouting ip6 saddr != @lan_ip6 return' +require_rule 'add rule inet shellcrash prerouting_dns ip6 saddr != @lan_ip6 return' +require_rule 'add rule inet shellcrash input ip6 saddr @lan_ip6 accept' +require_rule 'add rule inet shellcrash output ip6 daddr @lan_ip6 return' + +if printf '%s\n' "$rules" | grep -Fq 'add rule inet shellcrash output ip6 saddr'; then + echo 'output must not depend on a dynamic IPv6 source prefix' >&2 + exit 1 +fi + +echo 'nftables IPv6 rule generation tests passed'