wangdefa/tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
e957249f3180b1061490a07f0177e3f6eb5579f5
tools/linux/setup-microsocks.sh
T

604 lines
17 KiB
Bash
Executable File
Raw Blame History

#!/usr/bin/env bash
set -Eeuo pipefail
# Debian/Ubuntu MicroSocks multi-instance installer.
# Status messages go to stderr; created socks5:// links go to stdout.
COUNT=0
COUNT_SET=0
START_PORT=1080
START_PORT_SET=0
LISTEN_ADDR="0.0.0.0"
PUBLIC_HOST=""
COMMON_USER=""
COMMON_PASS=""
NO_AUTH=0
AUTO_BIND=0
REPLACE=0
OPEN_FIREWALL=0
NON_INTERACTIVE=0
DRY_RUN=0
APT_UPDATED=0
MICROSOCKS_BIN=""
WORK_DIR=""
CONF_DIR="/etc/microsocks"
UNIT_FILE="/etc/systemd/system/microsocks@.service"
declare -a BIND_ADDRESSES=()
declare -a RESOLVED_BINDS=()
declare -a PORTS=()
declare -a USERS=()
declare -a PASSWORDS=()
declare -a LOCAL_ADDRESSES=()
log() {
printf '[microsocks] %s\n' "$*" >&2
}
die() {
printf '[microsocks] 错误: %s\n' "$*" >&2
exit 1
}
usage() {
cat <<'EOF'
用法：sudo ./setup-microsocks.sh [选项]
-n, --count N 创建 N 个代理；多个 --bind 时可省略
--start-port PORT 起始端口，默认 1080
--listen IP 监听地址，默认 0.0.0.0
--host HOST 返回链接使用的公网 IP 或域名
--bind IP 绑定出站源地址；可重复指定
--auto-bind 自动轮流使用本机所有全局 IP 作为出口
--user USER 所有实例使用同一用户名
--password PASS 所有实例使用同一密码
--no-auth 仅允许在回环监听地址上关闭认证
--replace 覆盖相同端口的既有 microsocks 实例
--open-firewall 自动放行已启用的 UFW/firewalld 端口
--non-interactive 不询问确认
--dry-run 仅显示计划和链接，不修改系统
-h, --help 显示帮助
示例：
sudo ./setup-microsocks.sh
sudo ./setup-microsocks.sh --count 3 --start-port 1080
sudo ./setup-microsocks.sh --bind 10.0.14.56 --bind 10.0.225.167
EOF
}
need_value() {
[[ $# -ge 2 && -n ${2:-} ]] || die "$1 缺少参数"
}
parse_args() {
while (($#)); do
case "$1" in
-n|--count) need_value "$@"; COUNT=$2; COUNT_SET=1; shift 2 ;;
--start-port) need_value "$@"; START_PORT=$2; START_PORT_SET=1; shift 2 ;;
--listen) need_value "$@"; LISTEN_ADDR=$2; shift 2 ;;
--host) need_value "$@"; PUBLIC_HOST=$2; shift 2 ;;
--bind) need_value "$@"; BIND_ADDRESSES+=("$2"); shift 2 ;;
--user) need_value "$@"; COMMON_USER=$2; shift 2 ;;
--password) need_value "$@"; COMMON_PASS=$2; shift 2 ;;
--auto-bind) AUTO_BIND=1; shift ;;
--no-auth) NO_AUTH=1; shift ;;
--replace) REPLACE=1; shift ;;
--open-firewall) OPEN_FIREWALL=1; shift ;;
--non-interactive) NON_INTERACTIVE=1; shift ;;
--dry-run) DRY_RUN=1; shift ;;
-h|--help) usage; exit 0 ;;
*) die "未知参数: $1" ;;
esac
done
}
prompt_number() {
local prompt=$1 default=$2 value
read -r -p "$prompt [$default]: " value
printf '%s' "${value:-$default}"
}
interactive_options() {
[[ -t 0 && $NON_INTERACTIVE -eq 0 ]] || return 0
if [[ $COUNT_SET -eq 0 ]]; then
COUNT=$(prompt_number "代理数量" 1)
COUNT_SET=1
fi
if [[ $START_PORT_SET -eq 0 ]]; then
START_PORT=$(prompt_number "起始端口" 1080)
fi
if is_uint "$COUNT" && ((COUNT > 1 && ${#BIND_ADDRESSES[@]} == 0)); then
local answer
read -r -p "是否按检测到的本机 IP 自动分配出口？[y/N]: " answer
[[ $answer =~ ^[Yy]$ ]] && AUTO_BIND=1
fi
}
is_uint() {
[[ $1 =~ ^[0-9]+$ ]]
}
valid_token() {
[[ $1 =~ ^[A-Za-z0-9._~-]{1,128}$ ]]
}
valid_ip() {
python3 - "$1" <<'PY' >/dev/null 2>&1
import ipaddress
import sys
ipaddress.ip_address(sys.argv[1])
PY
}
valid_host() {
local host=${1#[}
host=${host%]}
valid_ip "$host" && return 0
[[ $host =~ ^[A-Za-z0-9]([A-Za-z0-9.-]{0,251}[A-Za-z0-9])?$ ]]
}
validate_options() {
if [[ $COUNT_SET -eq 0 ]]; then
COUNT=$((${#BIND_ADDRESSES[@]} > 1 ? ${#BIND_ADDRESSES[@]} : 1))
fi
is_uint "$COUNT" && ((COUNT >= 1)) || die "代理数量必须是正整数"
is_uint "$START_PORT" || die "起始端口必须是整数"
((START_PORT >= 1024 && START_PORT + COUNT - 1 <= 65535)) || die "端口范围必须在 1024-65535"
((AUTO_BIND == 0 || ${#BIND_ADDRESSES[@]} == 0)) || die "--auto-bind 不能和 --bind 同时使用"
[[ -z $COMMON_USER && -z $COMMON_PASS ]] || [[ -n $COMMON_USER && -n $COMMON_PASS ]] || die "--user 和 --password 必须同时指定"
[[ -z $COMMON_USER ]] || valid_token "$COMMON_USER" || die "用户名只能使用字母、数字和 ._~-"
[[ -z $COMMON_PASS ]] || valid_token "$COMMON_PASS" || die "密码只能使用字母、数字和 ._~-"
[[ -z $PUBLIC_HOST ]] || valid_host "$PUBLIC_HOST" || die "--host 格式无效"
valid_ip "$LISTEN_ADDR" || die "--listen 必须是 IPv4 或 IPv6 地址"
}
validate_auth_mode() {
[[ $NO_AUTH -eq 0 ]] && return 0
[[ -z $COMMON_USER && -z $COMMON_PASS ]] || die "--no-auth 不能与用户名密码同时使用"
case "$LISTEN_ADDR" in
127.*|::1) ;;
*) die "为防止开放代理，--no-auth 仅允许监听回环地址" ;;
esac
}
detect_os() {
[[ -r /etc/os-release ]] || die "无法识别操作系统"
# shellcheck disable=SC1091
source /etc/os-release
local family="${ID:-} ${ID_LIKE:-}"
[[ $family == *debian* || $family == *ubuntu* ]] || die "仅支持 Debian/Ubuntu 系统"
command -v systemctl >/dev/null || die "未检测到 systemd"
[[ $(ps -p 1 -o comm= 2>/dev/null) == systemd ]] || die "PID 1 不是 systemd"
log "系统: ${PRETTY_NAME:-$ID}; 架构: $(uname -m)"
}
apt_update_once() {
[[ $APT_UPDATED -eq 1 ]] && return 0
log "更新 APT 索引"
DEBIAN_FRONTEND=noninteractive apt-get update
APT_UPDATED=1
}
ensure_base_tools() {
local missing=() command
for command in curl openssl python3 ip ss flock; do
command -v "$command" >/dev/null || missing+=("$command")
done
((${#missing[@]} == 0)) && return 0
[[ $DRY_RUN -eq 0 ]] || die "dry-run 缺少命令: ${missing[*]}"
apt_update_once
DEBIAN_FRONTEND=noninteractive apt-get install -y curl openssl python3 iproute2 util-linux ca-certificates
}
install_from_source() {
apt_update_once
DEBIAN_FRONTEND=noninteractive apt-get install -y git build-essential ca-certificates
log "从上游源码编译 microsocks"
git clone --depth 1 https://github.com/rofl0r/microsocks.git "$WORK_DIR/microsocks"
make -C "$WORK_DIR/microsocks"
install -m 0755 "$WORK_DIR/microsocks/microsocks" /usr/bin/microsocks
}
install_microsocks() {
if command -v microsocks >/dev/null; then
MICROSOCKS_BIN=$(command -v microsocks)
return 0
fi
apt_update_once
log "尝试从 APT 安装 microsocks"
if DEBIAN_FRONTEND=noninteractive apt-get install -y microsocks; then
MICROSOCKS_BIN=$(command -v microsocks)
return 0
fi
install_from_source
MICROSOCKS_BIN=/usr/bin/microsocks
}
oci_public_ip() {
curl -fsS --max-time 2 -H 'Authorization: Bearer Oracle' \
http://169.254.169.254/opc/v2/vnics/ 2>/dev/null | python3 -c '
import json, sys
items = json.load(sys.stdin)
print(next((x.get("publicIp") for x in items if x.get("publicIp")), ""))
' 2>/dev/null
}
first_global_ipv6() {
ip -o -6 addr show scope global | awk '{sub(/\/.*/, "", $4); print $4; exit}'
}
detect_public_host() {
[[ -n $PUBLIC_HOST ]] && return 0
case "$LISTEN_ADDR" in
127.*|::1) PUBLIC_HOST=$LISTEN_ADDR; return 0 ;;
esac
if [[ $LISTEN_ADDR == *:* ]]; then
[[ $LISTEN_ADDR == "::" ]] && PUBLIC_HOST=$(first_global_ipv6 || true) ||
PUBLIC_HOST=$LISTEN_ADDR
[[ -n $PUBLIC_HOST ]] || die "没有可用于 IPv6 监听的全局地址"
return 0
fi
PUBLIC_HOST=$(oci_public_ip || true)
[[ -n $PUBLIC_HOST ]] && return 0
PUBLIC_HOST=$(curl -4 -fsS --max-time 5 https://api.ipify.org 2>/dev/null || true)
[[ -n $PUBLIC_HOST ]] && return 0
die "无法自动检测公网 IPv4，请使用 --host 指定，或改用 --listen ::"
}
discover_local_addresses() {
mapfile -t LOCAL_ADDRESSES < <(
ip -o addr show up scope global |
awk '$2 !~ /^(docker|br-|veth|virbr|tailscale|wg)/ {sub(/\/.*/, "", $4); print $4}' |
sort -u
)
((${#LOCAL_ADDRESSES[@]} > 0)) || die "没有检测到全局 IPv4/IPv6 地址"
}
address_is_local() {
local target=$1 address
for address in "${LOCAL_ADDRESSES[@]}"; do
[[ $address == "$target" ]] && return 0
done
return 1
}
validate_bind_addresses() {
local address
for address in "${BIND_ADDRESSES[@]}"; do
valid_ip "$address" || die "无效的 --bind 地址: $address"
address_is_local "$address" || die "--bind 地址不在本机: $address"
done
local size=${#BIND_ADDRESSES[@]}
((size == 0 || size == 1 || size == COUNT)) || die "--bind 数量必须是 1 或代理数量 $COUNT"
}
interface_for_address() {
local target=$1
ip -o addr show | awk -v target="$target" '
{address=$4; sub(/\/.*/, "", address)}
address == target {interface=$2; sub(/@.*/, "", interface); print interface; exit}
'
}
route_for_address() {
local address=$1
if [[ $address == *:* ]]; then
ip -6 route get 2606:4700:4700::1111 from "$address"
else
ip -4 route get 1.1.1.1 from "$address"
fi
}
validate_bind_routes() {
local address expected route actual
for address in "${RESOLVED_BINDS[@]}"; do
[[ -n $address ]] || continue
expected=$(interface_for_address "$address")
route=$(route_for_address "$address" 2>/dev/null) || die "$address 没有可用的出站路由"
actual=$(awk '{for(i=1;i<=NF;i++) if($i=="dev"){print $(i+1); exit}}' <<<"$route")
[[ -n $expected && $actual == "$expected" ]] ||
die "$address 应从 $expected 出口，内核实际选择 ${actual:-未知接口}；请先修复策略路由"
done
}
prepare_binds() {
local index size=${#BIND_ADDRESSES[@]}
if ((size == 0 && AUTO_BIND == 0)); then
for ((index = 0; index < COUNT; index++)); do RESOLVED_BINDS+=(""); done
return 0
fi
discover_local_addresses
validate_bind_addresses
for ((index = 0; index < COUNT; index++)); do
if ((size == COUNT)); then
RESOLVED_BINDS+=("${BIND_ADDRESSES[index]}")
elif ((size == 1)); then
RESOLVED_BINDS+=("${BIND_ADDRESSES[0]}")
elif ((AUTO_BIND == 1)); then
RESOLVED_BINDS+=("${LOCAL_ADDRESSES[index % ${#LOCAL_ADDRESSES[@]}]}")
else
RESOLVED_BINDS+=("")
fi
done
}
prepare_credentials() {
local index
for ((index = 0; index < COUNT; index++)); do
if ((NO_AUTH == 1)); then
USERS+=(""); PASSWORDS+=("")
elif [[ -n $COMMON_USER ]]; then
USERS+=("$COMMON_USER"); PASSWORDS+=("$COMMON_PASS")
else
USERS+=("proxy$(openssl rand -hex 3)")
PASSWORDS+=("$(openssl rand -hex 16)")
fi
done
}
prepare_ports() {
local index
for ((index = 0; index < COUNT; index++)); do
PORTS+=("$((START_PORT + index))")
done
}
port_in_use() {
local port=$1
ss -H -ltn | awk -v suffix=":$port" '$4 ~ suffix "$" {found=1} END {exit !found}'
}
validate_ports() {
local port config
for port in "${PORTS[@]}"; do
config="$CONF_DIR/$port.conf"
if [[ -e $config && $REPLACE -eq 0 ]]; then
die "$config 已存在；使用 --replace 才能覆盖"
fi
if [[ ! -e $config ]] && port_in_use "$port"; then
die "端口 $port 已被其他进程占用"
fi
done
}
format_url_host() {
local host=${1#[}
host=${host%]}
[[ $host == *:* ]] && printf '[%s]' "$host" || printf '%s' "$host"
}
print_links() {
local index host
host=$(format_url_host "$PUBLIC_HOST")
for ((index = 0; index < COUNT; index++)); do
if [[ -n ${USERS[index]} ]]; then
printf 'socks5://%s:%s@%s:%s\n' "${USERS[index]}" "${PASSWORDS[index]}" "$host" "${PORTS[index]}"
else
printf 'socks5://%s:%s\n' "$host" "${PORTS[index]}"
fi
done
}
show_plan() {
local index bind auth
log "计划创建 $COUNT 个实例，监听地址 $LISTEN_ADDR"
for ((index = 0; index < COUNT; index++)); do
bind=${RESOLVED_BINDS[index]:-自动}
auth=${USERS[index]:-无认证}
log "端口 ${PORTS[index]}；出口 $bind；用户 $auth"
done
log "链接主机: $PUBLIC_HOST"
}
confirm_plan() {
[[ -t 0 && $NON_INTERACTIVE -eq 0 ]] || return 0
local answer
read -r -p "继续安装并启动服务？[Y/n]: " answer
[[ ! $answer =~ ^[Nn]$ ]] || exit 0
}
check_bind_support() {
local has_bind=0 address help
for address in "${RESOLVED_BINDS[@]}"; do
[[ -n $address ]] && has_bind=1
done
((has_bind == 0)) && return 0
help=$({ "$MICROSOCKS_BIN" -h || true; } 2>&1)
grep -Eq -- '(^|[[:space:]])-b([[:space:]]|$)' <<<"$help" || die "当前 microsocks 不支持 -b 出站绑定"
}
write_unit_header() {
cat >"$1" <<EOF
[Unit]
Description=MicroSocks SOCKS5 Proxy on port %i
Wants=network-online.target
After=network-online.target
[Service]
Type=simple
EnvironmentFile=$CONF_DIR/%i.conf
ExecStart=$MICROSOCKS_BIN -i \${LISTEN_ADDR} -p %i \$AUTH_OPTIONS \$BIND_OPTIONS
Restart=on-failure
RestartSec=2
User=nobody
Group=nogroup
NoNewPrivileges=true
EOF
}
write_unit_sandbox() {
cat >>"$1" <<'EOF'
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictAddressFamilies=AF_INET AF_INET6
LockPersonality=true
MemoryDenyWriteExecute=true
CapabilityBoundingSet=
[Install]
WantedBy=multi-user.target
EOF
}
write_unit_file() {
local temporary="$WORK_DIR/microsocks@.service"
write_unit_header "$temporary"
write_unit_sandbox "$temporary"
install -m 0644 "$temporary" "$UNIT_FILE"
}
write_instance_config() {
local index=$1 port=${PORTS[$1]} temporary="$WORK_DIR/${PORTS[$1]}.conf"
local auth_options="" bind_options=""
[[ -z ${USERS[index]} ]] || auth_options="-u ${USERS[index]} -P ${PASSWORDS[index]}"
[[ -z ${RESOLVED_BINDS[index]} ]] || bind_options="-b ${RESOLVED_BINDS[index]}"
{
printf 'LISTEN_ADDR=%s\n' "$LISTEN_ADDR"
printf 'SOCKS_USER=%s\n' "${USERS[index]}"
printf 'SOCKS_PASS=%s\n' "${PASSWORDS[index]}"
printf 'AUTH_OPTIONS="%s"\n' "$auth_options"
printf 'BIND_OPTIONS="%s"\n' "$bind_options"
printf 'PUBLIC_HOST=%s\n' "$PUBLIC_HOST"
} >"$temporary"
install -m 0600 "$temporary" "$CONF_DIR/$port.conf"
}
install_configuration() {
install -d -m 0750 "$CONF_DIR"
write_unit_file
local index
for ((index = 0; index < COUNT; index++)); do
write_instance_config "$index"
done
systemctl daemon-reload
}
start_services() {
local port
for port in "${PORTS[@]}"; do
if systemctl is-active --quiet "microsocks@$port.service"; then
systemctl restart "microsocks@$port.service"
else
systemctl enable --now "microsocks@$port.service"
fi
if ! systemctl is-active --quiet "microsocks@$port.service"; then
journalctl -u "microsocks@$port.service" -n 30 --no-pager >&2 || true
die "microsocks@$port 启动失败"
fi
done
}
open_detected_firewall() {
[[ $OPEN_FIREWALL -eq 1 ]] || return 0
local port firewalld=0
if command -v ufw >/dev/null && ufw status | head -n 1 | grep -qw active; then
for port in "${PORTS[@]}"; do ufw allow "$port/tcp"; done
fi
if command -v firewall-cmd >/dev/null && systemctl is-active --quiet firewalld; then
firewalld=1
for port in "${PORTS[@]}"; do firewall-cmd --permanent --add-port="$port/tcp"; done
fi
((firewalld == 0)) || firewall-cmd --reload
}
cleanup() {
[[ -n ${WORK_DIR:-} && -d ${WORK_DIR:-} ]] || return 0
[[ $WORK_DIR == /tmp/microsocks-setup.* ]] || return 0
rm -rf -- "$WORK_DIR"
}
prepare_plan() {
detect_public_host
prepare_binds
validate_bind_routes
prepare_ports
prepare_credentials
validate_ports
show_plan
}
main() {
parse_args "$@"
interactive_options
detect_os
[[ $DRY_RUN -eq 1 || $EUID -eq 0 ]] || die "请使用 root 或 sudo 执行"
ensure_base_tools
validate_options
validate_auth_mode
prepare_plan
if [[ $DRY_RUN -eq 1 ]]; then
log "dry-run：未修改系统；以下链接尚未生效"
print_links
return 0
fi
confirm_plan
exec 9>/run/lock/microsocks-setup.lock
flock -n 9 || die "另一个安装任务正在运行"
install_microsocks
check_bind_support
install_configuration
start_services
open_detected_firewall
log "请同时在云平台安全组/安全列表中放行对应 TCP 端口"
print_links
}
trap cleanup EXIT
WORK_DIR=$(mktemp -d /tmp/microsocks-setup.XXXXXX)
if [[ ${BASH_SOURCE[0]} == "$0" ]]; then
main "$@"
fi
Reference in New Issue View Git Blame Copy Permalink