feat: 动态同步 IPv6 前缀到 nftables

tests/test_fw_ipv6_prefix.sh

@@ -0,0 +1,83 @@
+#!/bin/sh
+set -eu
+
+ROOT=$(cd "$(dirname "$0")/.." && pwd)
+. "$ROOT/scripts/starts/fw_getlanip.sh"
+
+assert_equal() {
+    if [ "$1" != "$2" ]; then
+        echo "expected: [$1]" >&2
+        echo "actual:   [$2]" >&2
+        exit 1
+    fi
+}
+
+route_output='default via fe80::1 dev eth0
+default from 240e:1234:5600::/56 via fe80::1 dev pppoe-wan
+2408:8266:501:2443::/64 dev enp2s0 proto kernel
+2606:4700::/48 via fe80::2 dev eth0
+unreachable 240e:1234:5600::/48 dev lo'
+actual=$(printf '%s\n' "$route_output" | ipv6_route_prefixes | sort -u)
+expected='2408:8266:501:2443::/64
+240e:1234:5600::/56'
+assert_equal "$expected" "$actual"
+
+# OpenWrt prefers the LAN assignment over the wider delegated prefix.
+systype=mi_snapshot
+lan_ifaces='br-lan'
+ubus() {
+    printf '%s\n' '{ "l3_device": "br-lan" }'
+}
+ip() {
+    case "$*" in
+    '-6 route show dev br-lan')
+        echo 'default from 240e:1234:5600::/56 via fe80::1 dev br-lan'
+        echo '240e:1234:5600:1::/64 dev br-lan proto static'
+        ;;
+    '-6 route show default') echo 'default from 240e:1234:5600::/56 via fe80::1 dev pppoe-wan' ;;
+    esac
+}
+actual=$(get_ipv6_prefixes)
+assert_equal '240e:1234:5600:1::/64' "$actual"
+
+# OpenWrt falls back to source-specific routes when its LAN route is hidden.
+lan_ifaces=
+ubus() {
+    return 0
+}
+ip() {
+    case "$*" in
+    '-6 route show default') echo 'default from 240e:1234:5600::/56 via fe80::1 dev pppoe-wan' ;;
+    esac
+}
+actual=$(get_ipv6_prefixes)
+assert_equal '240e:1234:5600::/56' "$actual"
+
+# Standard Linux uses the directly connected route on the discovered LAN.
+systype=container
+lan_ifaces='enp2s0'
+ip() {
+    case "$*" in
+    '-6 route show dev enp2s0') echo '2408:8266:501:2443::/64 dev enp2s0 proto kernel metric 256' ;;
+    esac
+}
+actual=$(get_ipv6_prefixes)
+assert_equal '2408:8266:501:2443::/64' "$actual"
+
+# BusyBox based router firmware does not need route protocol metadata.
+systype=Padavan
+lan_ifaces='br0'
+ip() {
+    case "$*" in
+    '-6 route show dev br0') echo '2001:db8:abcd:1::/64 dev br0 metric 256' ;;
+    esac
+}
+actual=$(get_ipv6_prefixes)
+assert_equal '2001:db8:abcd:1::/64' "$actual"
+
+ts_service=ON
+wg_service=OFF
+build_host_ipv6 '2408:8266:501:2443::/64 invalid-value'
+assert_equal '2408:8266:501:2443::/64 fd00::/8 fd7a:115c:a1e0::/48 fe80::/10' "$host_ipv6"
+
+echo 'IPv6 prefix tests passed'

tests/test_fw_nftables_ipv6.sh

@@ -0,0 +1,78 @@
+#!/bin/sh
+set -eu
+
+ROOT=$(cd "$(dirname "$0")/.." && pwd)
+
+reserve_ipv4='0.0.0.0/8 127.0.0.0/8'
+reserve_ipv6='::/128 ::1/128 fe80::/10 ff00::/8'
+host_ipv4='192.168.1.0/24'
+local_ipv4='192.168.1.1'
+host_ipv6='2001:db8:1::/64 fd00::/8 fe80::/10'
+common_ports=OFF
+ports=
+PORTS=
+mix_port=7890
+redir_port=7892
+tproxy_port=7893
+dns_redir_port=1053
+routing_mark=7894
+fwmark=7892
+firewall_area=3
+macfilter_type='黑名单'
+cn_ip_route=OFF
+dns_mod=route
+ipv6_redir=ON
+quic_rj=OFF
+lan_proxy=true
+local_proxy=true
+redir_mod=Tproxy
+tun_statu=false
+vm_redir=OFF
+fw_wan=ON
+fw_wan_ports=
+vms_port=
+sss_port=
+db_port=9090
+systype=linux
+CRASHDIR=/nonexistent
+BINDIR=/nonexistent
+
+nft() {
+    if [ "$1" = list ] && [ "$2" = set ]; then
+        return 1
+    fi
+    printf '%s' "$1"
+    shift
+    printf ' %s' "$@"
+    printf '\n'
+}
+
+modprobe() {
+    return 0
+}
+
+. "$ROOT/scripts/starts/fw_nftables.sh"
+rules=$(start_nftables || :)
+
+require_rule() {
+    if ! printf '%s\n' "$rules" | grep -Fq "$1"; then
+        echo "missing generated rule: $1" >&2
+        exit 1
+    fi
+}
+
+require_rule 'add set inet shellcrash lan_ip6'
+require_rule 'flags interval ; auto-merge'
+require_rule 'add element inet shellcrash lan_ip6'
+require_rule 'add rule inet shellcrash prerouting ip6 daddr @lan_ip6 return'
+require_rule 'add rule inet shellcrash prerouting ip6 saddr != @lan_ip6 return'
+require_rule 'add rule inet shellcrash prerouting_dns ip6 saddr != @lan_ip6 return'
+require_rule 'add rule inet shellcrash input ip6 saddr @lan_ip6 accept'
+require_rule 'add rule inet shellcrash output ip6 daddr @lan_ip6 return'
+
+if printf '%s\n' "$rules" | grep -Fq 'add rule inet shellcrash output ip6 saddr'; then
+    echo 'output must not depend on a dynamic IPv6 source prefix' >&2
+    exit 1
+fi
+
+echo 'nftables IPv6 rule generation tests passed'