sergio/takana

1#!/bin/bash
2# netdiag.sh — diagnostica (y prueba un fix) el camino DHCP del lab de red, todo como root en una corrida.
3# Corré:  sudo bash scripts/netdiag.sh
4# Deja un reporte legible en work/netdiag.txt (chmod 644) y lo imprime.
5set -u
6cd "$(dirname "$0")/.." || exit 1
7BR="${BR:-hmtap0}"; TAP="${TAP:-hmtap0}"; SUBNET="${SUBNET:-192.168.100}"; VMMAC="52:54:00:12:34:56"
8OUT=work/netdiag.txt
9DNSLOG=/tmp/hmdnsmasq.log
10mkdir -p work
11exec > >(tee "$OUT") 2>&1
12
13[ "$(id -u)" = 0 ] || { echo "corré con: sudo bash scripts/netdiag.sh"; exit 1; }
14echo "===== netdiag ====="
15
16run_test() { KVM=1 MEM=4096 DEADLINE=45 LOG=work/netdiag-run.log python3 scripts/drive-netup.py >/dev/null 2>&1; }
17
18echo; echo "### 1. firewall del host (nft) ###"
19echo "-- base chains input + policies --"
20nft list ruleset 2>/dev/null | grep -iE 'table |chain |hook (input|forward|prerouting)|policy|type ' | head -40
21INPUT_DROP=$(nft list ruleset 2>/dev/null | grep -iE 'hook input' | grep -ci 'policy drop')
22echo "input-hook chains con policy drop: $INPUT_DROP"
23
24echo; echo "### 2. captura DHCP en $TAP (egress del VM) + $BR mientras manda DISCOVER ###"
25command -v tcpdump >/dev/null || echo "(tcpdump ausente — salteo captura)"
26: > /tmp/netdiag.pcap.txt; : > /tmp/netdiag.br.txt
27echo "estado del tap/bridge ANTES (idle):"; ip -br link show "$TAP"; ip -br link show "$BR"
28if command -v tcpdump >/dev/null; then
29    timeout 55 tcpdump -i "$TAP" -nnev 'udp port 67 or udp port 68' > /tmp/netdiag.pcap.txt 2>/dev/null &
30    TPID=$!
31    timeout 55 tcpdump -i "$BR"  -nnev 'udp port 67 or udp port 68' > /tmp/netdiag.br.txt   2>/dev/null &
32    TPID2=$!; sleep 1
33fi
34run_test
35sleep 1; for pid in ${TPID:-} ${TPID2:-}; do kill "$pid" 2>/dev/null; wait "$pid" 2>/dev/null; done
36echo "-- DISCOVER/Offer en el TAP $TAP (lo que el VM realmente manda/recibe) --"
37grep -icE 'Discover|Offer|Request|Reply|BOOTP' /tmp/netdiag.pcap.txt; grep -iE 'Discover|Offer|cksum' /tmp/netdiag.pcap.txt | head -6
38echo "-- paquetes DHCP capturados en $BR --"
39grep -icE 'Discover|Offer|Request|Reply|BOOTP' /tmp/netdiag.pcap.txt
40echo "-- muestra (Discover/Offer/checksum) --"
41grep -iE 'Discover|Offer|cksum' /tmp/netdiag.pcap.txt | head -10
42echo "-- dnsmasq: ¿recibió/ofreció? --"
43grep -iE 'DHCPDISCOVER|DHCPOFFER|DHCPACK|no address' "$DNSLOG" 2>/dev/null | tail -8 || echo "(sin entradas DHCP)"
44
45echo; echo "### 3. veredicto del diagnóstico ###"
46SAW_DISC=$(grep -ic 'Discover' /tmp/netdiag.pcap.txt)
47BAD_CKSUM=$(grep -ic 'bad udp cksum' /tmp/netdiag.pcap.txt)
48DNS_SAW=$(grep -ic 'DHCPDISCOVER' "$DNSLOG" 2>/dev/null)
49echo "DISCOVER en bridge=$SAW_DISC  bad-cksum=$BAD_CKSUM  dnsmasq-vio-DISCOVER=$DNS_SAW  input-drop=$INPUT_DROP"
50if [ "$SAW_DISC" = 0 ]; then echo ">> el DISCOVER NO llega al bridge (problema tap/QEMU)"; fi
51if [ "$SAW_DISC" != 0 ] && [ "$BAD_CKSUM" != 0 ]; then echo ">> DISCOVER llega con CHECKSUM MALO (offload) ⇒ dnsmasq lo descarta"; fi
52if [ "$SAW_DISC" != 0 ] && [ "$DNS_SAW" = 0 ] && [ "$BAD_CKSUM" = 0 ]; then echo ">> DISCOVER llega OK pero dnsmasq no lo procesa ⇒ firewall INPUT (drop=$INPUT_DROP)"; fi
53
54echo; echo "### 4. firewall INPUT: inspecciono, meto accepts CONTADOS y retesteo ###"
55echo "-- inet filter input ANTES (con handles) --"
56nft -a list chain inet filter input 2>/dev/null
57echo "-- inserto accepts contados (por iif del bridge y por puerto DHCP/DNS) --"
58nft insert rule inet filter input udp dport '{ 67, 68, 53 }' counter accept comment '"hmlab"' 2>&1 | head -2
59nft insert rule inet filter input iifname "$BR" counter accept comment '"hmlab"' 2>&1 | head -2
60run_test
61echo "-- reglas hmlab DESPUÉS del retest (los counters dicen cuál matcheó) --"
62nft -a list chain inet filter input 2>/dev/null | grep -i hmlab
63echo "-- dnsmasq tras retest --"
64grep -iE 'DHCPDISCOVER|DHCPOFFER|DHCPACK' "$DNSLOG" 2>/dev/null | tail -5 || echo "(nada)"
65echo "-- netup tras retest --"
66grep -aE 'netup: lease|netup: red configurada|sin respuesta DHCP|PING_OK|PING_FAIL|DNS_OK|DNS_FAIL' work/netdiag-run.log | tail -5
67if grep -qa 'netup: red configurada' work/netdiag-run.log; then echo "RESULTADO: ✓ RED OK"; else echo "RESULTADO: ✗ sigue fallando"; fi
68
69echo; echo "### 5. dnsmasq log COMPLETO (volcado para análisis) ###"
70tail -30 "$DNSLOG" 2>/dev/null || echo "(no legible)"
71echo; echo "### 6. netup salida COMPLETA del retest ###"
72tr -d '\r' < work/netdiag-run.log 2>/dev/null | sed 's/\x1b\[[0-9;?]*[a-zA-Z]//g' | grep -aE 'netup:|e1000.*Link|PING_|DNS_' | tail -12
73
74chmod 644 "$OUT" 2>/dev/null
75chmod 666 work/netdiag-run.log 2>/dev/null
76echo; echo "(reporte: $OUT)"