1033 lines
29 KiB
Bash
Executable File
1033 lines
29 KiB
Bash
Executable File
#!/usr/bin/env bash
|
||
set -Eeuo pipefail
|
||
|
||
# Debian/Ubuntu MicroSocks multi-instance installer and manager.
|
||
# Status messages go to stderr; socks5:// links and instance lists go to stdout.
|
||
|
||
ACTION="create"
|
||
COUNT=0
|
||
COUNT_SET=0
|
||
START_PORT=1080
|
||
START_PORT_SET=0
|
||
LISTEN_ADDR="0.0.0.0"
|
||
PUBLIC_HOST=""
|
||
COMMON_USER=""
|
||
COMMON_PASS=""
|
||
ALLOW_LIST=""
|
||
ALLOW_ALL=0
|
||
NO_AUTH=0
|
||
AUTO_BIND=0
|
||
REPLACE=0
|
||
OPEN_FIREWALL=0
|
||
NON_INTERACTIVE=0
|
||
DRY_RUN=0
|
||
APT_UPDATED=0
|
||
MICROSOCKS_BIN=""
|
||
WORK_DIR=""
|
||
CONF_DIR="/etc/microsocks"
|
||
ACL_FILE="$CONF_DIR/acl.nft"
|
||
UNIT_FILE="/etc/systemd/system/microsocks@.service"
|
||
SOURCE_BIN="/usr/local/bin/microsocks"
|
||
|
||
INST_LISTEN=""
|
||
INST_USER=""
|
||
INST_PASS=""
|
||
INST_BIND=""
|
||
INST_HOST=""
|
||
INST_ALLOW=""
|
||
INST_FIREWALL=0
|
||
|
||
declare -a BIND_ADDRESSES=()
|
||
declare -a RESOLVED_BINDS=()
|
||
declare -a PORTS=()
|
||
declare -a USERS=()
|
||
declare -a PASSWORDS=()
|
||
declare -a LOCAL_ADDRESSES=()
|
||
declare -a ALLOW_ARGS=()
|
||
declare -a TARGET_PORTS=()
|
||
|
||
|
||
log() {
|
||
printf '[microsocks] %s\n' "$*" >&2
|
||
}
|
||
|
||
|
||
die() {
|
||
printf '[microsocks] 错误: %s\n' "$*" >&2
|
||
exit 1
|
||
}
|
||
|
||
|
||
usage() {
|
||
cat <<'EOF'
|
||
用法：
|
||
sudo ./setup_microsocks.sh [create] [选项] 创建代理（默认）
|
||
sudo ./setup_microsocks.sh list [PORT...] 查看实例状态
|
||
sudo ./setup_microsocks.sh links [PORT...] 输出连接字符串；可用 --host 替换主机
|
||
sudo ./setup_microsocks.sh update [PORT...] --allow CIDR | --allow-all | --host HOST
|
||
sudo ./setup_microsocks.sh start|stop|restart [PORT...]
|
||
sudo ./setup_microsocks.sh remove PORT... [-y]
|
||
|
||
创建选项：
|
||
-n, --count N 创建 N 个代理；多个 --bind 时可省略
|
||
--start-port PORT 起始端口，默认 1080
|
||
--listen IP 监听地址，默认 0.0.0.0
|
||
--host HOST 返回链接使用的公网 IP 或域名
|
||
--bind IP 绑定出站源地址；可重复指定
|
||
--auto-bind 自动轮流使用本机所有全局 IP 作为出口
|
||
--allow CIDR 仅允许这些来源 IP/网段连接；可重复指定或用逗号分隔
|
||
--user USER 所有实例使用同一用户名
|
||
--password PASS 所有实例使用同一密码
|
||
--no-auth 仅允许在回环监听地址上关闭认证
|
||
--replace 覆盖相同端口的既有 microsocks 实例
|
||
--open-firewall 自动放行已启用的 UFW/firewalld 端口
|
||
-y, --non-interactive 不询问确认
|
||
--dry-run 仅显示计划和链接，不修改系统
|
||
-h, --help 显示帮助
|
||
EOF
|
||
usage_examples
|
||
}
|
||
|
||
|
||
usage_examples() {
|
||
cat <<'EOF'
|
||
|
||
说明：
|
||
管理命令省略 PORT 时作用于全部实例（remove 除外）；start/stop 同时开启/关闭开机自启。
|
||
来源限制写入 nftables 表 inet microsocks，与 UFW/firewalld 叠加生效；本机回环不受限。
|
||
|
||
示例：
|
||
sudo ./setup_microsocks.sh
|
||
sudo ./setup_microsocks.sh --count 3 --start-port 1080
|
||
sudo ./setup_microsocks.sh --bind 10.0.14.56 --bind 10.0.225.167
|
||
sudo ./setup_microsocks.sh --allow 203.0.113.5,198.51.100.0/24
|
||
sudo ./setup_microsocks.sh update 1080 --allow 203.0.113.7
|
||
sudo ./setup_microsocks.sh links
|
||
EOF
|
||
}
|
||
|
||
|
||
need_value() {
|
||
[[ $# -ge 2 && -n ${2:-} ]] || die "$1 缺少参数"
|
||
}
|
||
|
||
|
||
parse_cli() {
|
||
case "${1:-}" in
|
||
create|list|links|update|start|stop|restart|remove) ACTION=$1; shift ;;
|
||
esac
|
||
if [[ $ACTION == create ]]; then
|
||
parse_args "$@"
|
||
else
|
||
parse_manage_args "$@"
|
||
fi
|
||
}
|
||
|
||
|
||
parse_args() {
|
||
while (($#)); do
|
||
case "$1" in
|
||
-n|--count) need_value "$@"; COUNT=$2; COUNT_SET=1; shift 2 ;;
|
||
--start-port) need_value "$@"; START_PORT=$2; START_PORT_SET=1; shift 2 ;;
|
||
--listen) need_value "$@"; LISTEN_ADDR=$2; shift 2 ;;
|
||
--host) need_value "$@"; PUBLIC_HOST=$2; shift 2 ;;
|
||
--bind) need_value "$@"; BIND_ADDRESSES+=("$2"); shift 2 ;;
|
||
--allow) need_value "$@"; ALLOW_ARGS+=("$2"); shift 2 ;;
|
||
--user) need_value "$@"; COMMON_USER=$2; shift 2 ;;
|
||
--password) need_value "$@"; COMMON_PASS=$2; shift 2 ;;
|
||
--auto-bind) AUTO_BIND=1; shift ;;
|
||
--no-auth) NO_AUTH=1; shift ;;
|
||
--replace) REPLACE=1; shift ;;
|
||
--open-firewall) OPEN_FIREWALL=1; shift ;;
|
||
-y|--non-interactive) NON_INTERACTIVE=1; shift ;;
|
||
--dry-run) DRY_RUN=1; shift ;;
|
||
-h|--help) usage; exit 0 ;;
|
||
*) die "未知参数: $1" ;;
|
||
esac
|
||
done
|
||
}
|
||
|
||
|
||
parse_manage_args() {
|
||
while (($#)); do
|
||
case "$1" in
|
||
--allow) need_value "$@"; ALLOW_ARGS+=("$2"); shift 2 ;;
|
||
--allow-all) ALLOW_ALL=1; shift ;;
|
||
--host) need_value "$@"; PUBLIC_HOST=$2; shift 2 ;;
|
||
-y|--non-interactive) NON_INTERACTIVE=1; shift ;;
|
||
-h|--help) usage; exit 0 ;;
|
||
-*) die "未知参数: $1" ;;
|
||
*) is_uint "$1" || die "无效的端口: $1"; TARGET_PORTS+=("$1"); shift ;;
|
||
esac
|
||
done
|
||
}
|
||
|
||
|
||
prompt_number() {
|
||
local prompt=$1 default=$2 value
|
||
read -r -p "$prompt [$default]: " value
|
||
printf '%s' "${value:-$default}"
|
||
}
|
||
|
||
|
||
interactive_options() {
|
||
[[ -t 0 && $NON_INTERACTIVE -eq 0 ]] || return 0
|
||
local answer
|
||
if [[ $COUNT_SET -eq 0 ]]; then
|
||
COUNT=$(prompt_number "代理数量" 1)
|
||
COUNT_SET=1
|
||
fi
|
||
if [[ $START_PORT_SET -eq 0 ]]; then
|
||
START_PORT=$(prompt_number "起始端口" 1080)
|
||
fi
|
||
if is_uint "$COUNT" && ((COUNT > 1 && ${#BIND_ADDRESSES[@]} == 0)); then
|
||
read -r -p "是否按检测到的本机 IP 自动分配出口？[y/N]: " answer
|
||
if [[ $answer =~ ^[Yy]$ ]]; then AUTO_BIND=1; fi
|
||
fi
|
||
if ((${#ALLOW_ARGS[@]} == 0)); then
|
||
read -r -p "允许连接的来源 IP/CIDR（逗号分隔，留空不限制）: " answer
|
||
if [[ -n $answer ]]; then ALLOW_ARGS+=("$answer"); fi
|
||
fi
|
||
}
|
||
|
||
|
||
is_uint() {
|
||
[[ $1 =~ ^[0-9]+$ ]]
|
||
}
|
||
|
||
|
||
valid_token() {
|
||
[[ $1 =~ ^[A-Za-z0-9._~-]{1,128}$ ]]
|
||
}
|
||
|
||
|
||
valid_ip() {
|
||
python3 - "$1" <<'PY' >/dev/null 2>&1
|
||
import ipaddress
|
||
import sys
|
||
ipaddress.ip_address(sys.argv[1])
|
||
PY
|
||
}
|
||
|
||
|
||
valid_host() {
|
||
local host=${1#[}
|
||
host=${host%]}
|
||
valid_ip "$host" && return 0
|
||
[[ $host =~ ^[A-Za-z0-9]([A-Za-z0-9.-]{0,251}[A-Za-z0-9])?$ ]]
|
||
}
|
||
|
||
|
||
# Prints the merged networks, or the first invalid value on failure.
|
||
normalize_cidrs() {
|
||
python3 - "$@" <<'PY'
|
||
import ipaddress
|
||
import sys
|
||
|
||
values = [v.strip() for arg in sys.argv[1:] for v in arg.split(",") if v.strip()]
|
||
if not values:
|
||
sys.exit(1)
|
||
networks = []
|
||
for value in values:
|
||
try:
|
||
networks.append(ipaddress.ip_network(value, strict=False))
|
||
except ValueError:
|
||
print(value)
|
||
sys.exit(1)
|
||
merged = []
|
||
for version in (4, 6):
|
||
family = [n for n in networks if n.version == version]
|
||
merged += [str(n) for n in ipaddress.collapse_addresses(family)]
|
||
print(" ".join(merged))
|
||
PY
|
||
}
|
||
|
||
|
||
prepare_allow_list() {
|
||
((${#ALLOW_ARGS[@]} > 0)) || return 0
|
||
local output
|
||
output=$(normalize_cidrs "${ALLOW_ARGS[@]}") || die "无效的 --allow 地址: ${output:-空}"
|
||
ALLOW_LIST=$output
|
||
}
|
||
|
||
|
||
validate_options() {
|
||
if [[ $COUNT_SET -eq 0 ]]; then
|
||
COUNT=$((${#BIND_ADDRESSES[@]} > 1 ? ${#BIND_ADDRESSES[@]} : 1))
|
||
fi
|
||
is_uint "$COUNT" && ((COUNT >= 1)) || die "代理数量必须是正整数"
|
||
is_uint "$START_PORT" || die "起始端口必须是整数"
|
||
((START_PORT >= 1024 && START_PORT + COUNT - 1 <= 65535)) || die "端口范围必须在 1024-65535"
|
||
((AUTO_BIND == 0 || ${#BIND_ADDRESSES[@]} == 0)) || die "--auto-bind 不能和 --bind 同时使用"
|
||
[[ -z $COMMON_USER && -z $COMMON_PASS ]] || [[ -n $COMMON_USER && -n $COMMON_PASS ]] || die "--user 和 --password 必须同时指定"
|
||
[[ -z $COMMON_USER ]] || valid_token "$COMMON_USER" || die "用户名只能使用字母、数字和 ._~-"
|
||
[[ -z $COMMON_PASS ]] || valid_token "$COMMON_PASS" || die "密码只能使用字母、数字和 ._~-"
|
||
[[ -z $PUBLIC_HOST ]] || valid_host "$PUBLIC_HOST" || die "--host 格式无效"
|
||
valid_ip "$LISTEN_ADDR" || die "--listen 必须是 IPv4 或 IPv6 地址"
|
||
prepare_allow_list
|
||
}
|
||
|
||
|
||
validate_auth_mode() {
|
||
[[ $NO_AUTH -eq 0 ]] && return 0
|
||
[[ -z $COMMON_USER && -z $COMMON_PASS ]] || die "--no-auth 不能与用户名密码同时使用"
|
||
case "$LISTEN_ADDR" in
|
||
127.*|::1) ;;
|
||
*) die "为防止开放代理，--no-auth 仅允许监听回环地址" ;;
|
||
esac
|
||
}
|
||
|
||
|
||
validate_manage_options() {
|
||
local allow_used=$((${#ALLOW_ARGS[@]} > 0 || ALLOW_ALL == 1))
|
||
((ALLOW_ALL == 0 || ${#ALLOW_ARGS[@]} == 0)) || die "--allow 不能和 --allow-all 同时使用"
|
||
case "$ACTION" in
|
||
update)
|
||
((allow_used == 1)) || [[ -n $PUBLIC_HOST ]] ||
|
||
die "update 需要 --allow、--allow-all 或 --host"
|
||
;;
|
||
links) ((allow_used == 0)) || die "links 只支持 --host 选项" ;;
|
||
*)
|
||
((allow_used == 0)) || die "$ACTION 不支持 --allow"
|
||
[[ -z $PUBLIC_HOST ]] || die "$ACTION 不支持 --host"
|
||
;;
|
||
esac
|
||
[[ $ACTION != remove || ${#TARGET_PORTS[@]} -gt 0 ]] || die "remove 必须指定端口"
|
||
[[ -z $PUBLIC_HOST ]] || valid_host "$PUBLIC_HOST" || die "--host 格式无效"
|
||
prepare_allow_list
|
||
}
|
||
|
||
|
||
detect_os() {
|
||
[[ -r /etc/os-release ]] || die "无法识别操作系统"
|
||
# shellcheck disable=SC1091
|
||
source /etc/os-release
|
||
local family="${ID:-} ${ID_LIKE:-}"
|
||
[[ $family == *debian* || $family == *ubuntu* ]] || die "仅支持 Debian/Ubuntu 系统"
|
||
command -v systemctl >/dev/null || die "未检测到 systemd"
|
||
[[ $(ps -p 1 -o comm= 2>/dev/null) == systemd ]] || die "PID 1 不是 systemd"
|
||
log "系统: ${PRETTY_NAME:-$ID}; 架构: $(uname -m)"
|
||
}
|
||
|
||
|
||
apt_update_once() {
|
||
[[ $APT_UPDATED -eq 1 ]] && return 0
|
||
log "更新 APT 索引"
|
||
DEBIAN_FRONTEND=noninteractive apt-get update >&2
|
||
APT_UPDATED=1
|
||
}
|
||
|
||
|
||
ensure_base_tools() {
|
||
local missing=() command
|
||
for command in curl openssl python3 ip ss flock; do
|
||
command -v "$command" >/dev/null || missing+=("$command")
|
||
done
|
||
((${#missing[@]} == 0)) && return 0
|
||
[[ $DRY_RUN -eq 0 ]] || die "dry-run 缺少命令: ${missing[*]}"
|
||
apt_update_once
|
||
DEBIAN_FRONTEND=noninteractive apt-get install -y curl openssl python3 iproute2 util-linux ca-certificates >&2
|
||
}
|
||
|
||
|
||
install_from_source() {
|
||
apt_update_once
|
||
DEBIAN_FRONTEND=noninteractive apt-get install -y git build-essential ca-certificates >&2
|
||
log "从上游源码编译 microsocks"
|
||
rm -rf -- "$WORK_DIR/microsocks"
|
||
git clone --depth 1 https://github.com/rofl0r/microsocks.git "$WORK_DIR/microsocks"
|
||
make -C "$WORK_DIR/microsocks" >&2
|
||
install -m 0755 "$WORK_DIR/microsocks/microsocks" "$SOURCE_BIN"
|
||
MICROSOCKS_BIN=$SOURCE_BIN
|
||
}
|
||
|
||
|
||
install_microsocks() {
|
||
if command -v microsocks >/dev/null; then
|
||
MICROSOCKS_BIN=$(command -v microsocks)
|
||
return 0
|
||
fi
|
||
apt_update_once
|
||
log "尝试从 APT 安装 microsocks"
|
||
if DEBIAN_FRONTEND=noninteractive apt-get install -y microsocks >&2; then
|
||
MICROSOCKS_BIN=$(command -v microsocks)
|
||
return 0
|
||
fi
|
||
install_from_source
|
||
}
|
||
|
||
|
||
oci_public_ip() {
|
||
curl -fsS --max-time 2 -H 'Authorization: Bearer Oracle' \
|
||
http://169.254.169.254/opc/v2/vnics/ 2>/dev/null | python3 -c '
|
||
import json, sys
|
||
items = json.load(sys.stdin)
|
||
print(next((x.get("publicIp") for x in items if x.get("publicIp")), ""))
|
||
' 2>/dev/null
|
||
}
|
||
|
||
|
||
first_global_ipv6() {
|
||
ip -o -6 addr show scope global | awk '{sub(/\/.*/, "", $4); print $4; exit}'
|
||
}
|
||
|
||
|
||
detect_public_host() {
|
||
[[ -n $PUBLIC_HOST ]] && return 0
|
||
case "$LISTEN_ADDR" in
|
||
127.*|::1) PUBLIC_HOST=$LISTEN_ADDR; return 0 ;;
|
||
esac
|
||
if [[ $LISTEN_ADDR == *:* ]]; then
|
||
[[ $LISTEN_ADDR == "::" ]] && PUBLIC_HOST=$(first_global_ipv6 || true) ||
|
||
PUBLIC_HOST=$LISTEN_ADDR
|
||
[[ -n $PUBLIC_HOST ]] || die "没有可用于 IPv6 监听的全局地址"
|
||
return 0
|
||
fi
|
||
PUBLIC_HOST=$(oci_public_ip || true)
|
||
[[ -n $PUBLIC_HOST ]] && return 0
|
||
PUBLIC_HOST=$(curl -4 -fsS --max-time 5 https://api.ipify.org 2>/dev/null || true)
|
||
[[ -n $PUBLIC_HOST ]] && return 0
|
||
die "无法自动检测公网 IPv4，请使用 --host 指定，或改用 --listen ::"
|
||
}
|
||
|
||
|
||
discover_local_addresses() {
|
||
mapfile -t LOCAL_ADDRESSES < <(
|
||
ip -o addr show up scope global |
|
||
awk '$2 !~ /^(docker|br-|veth|virbr|tailscale|wg)/ {sub(/\/.*/, "", $4); print $4}' |
|
||
sort -u
|
||
)
|
||
((${#LOCAL_ADDRESSES[@]} > 0)) || die "没有检测到全局 IPv4/IPv6 地址"
|
||
}
|
||
|
||
|
||
address_is_local() {
|
||
local target=$1 address
|
||
for address in "${LOCAL_ADDRESSES[@]}"; do
|
||
[[ $address == "$target" ]] && return 0
|
||
done
|
||
return 1
|
||
}
|
||
|
||
|
||
validate_bind_addresses() {
|
||
local address
|
||
for address in "${BIND_ADDRESSES[@]}"; do
|
||
valid_ip "$address" || die "无效的 --bind 地址: $address"
|
||
address_is_local "$address" || die "--bind 地址不在本机: $address"
|
||
done
|
||
local size=${#BIND_ADDRESSES[@]}
|
||
((size == 0 || size == 1 || size == COUNT)) || die "--bind 数量必须是 1 或代理数量 $COUNT"
|
||
}
|
||
|
||
|
||
interface_for_address() {
|
||
local target=$1
|
||
ip -o addr show | awk -v target="$target" '
|
||
{address=$4; sub(/\/.*/, "", address)}
|
||
address == target {interface=$2; sub(/@.*/, "", interface); print interface; exit}
|
||
'
|
||
}
|
||
|
||
|
||
route_for_address() {
|
||
local address=$1
|
||
if [[ $address == *:* ]]; then
|
||
ip -6 route get 2606:4700:4700::1111 from "$address"
|
||
else
|
||
ip -4 route get 1.1.1.1 from "$address"
|
||
fi
|
||
}
|
||
|
||
|
||
validate_bind_routes() {
|
||
local address expected route actual
|
||
for address in "${RESOLVED_BINDS[@]}"; do
|
||
[[ -n $address ]] || continue
|
||
expected=$(interface_for_address "$address")
|
||
route=$(route_for_address "$address" 2>/dev/null) || die "$address 没有可用的出站路由"
|
||
actual=$(awk '{for(i=1;i<=NF;i++) if($i=="dev"){print $(i+1); exit}}' <<<"$route")
|
||
[[ -n $expected && $actual == "$expected" ]] ||
|
||
die "$address 应从 $expected 出口，内核实际选择 ${actual:-未知接口}；请先修复策略路由"
|
||
done
|
||
}
|
||
|
||
|
||
prepare_binds() {
|
||
local index size=${#BIND_ADDRESSES[@]}
|
||
if ((size == 0 && AUTO_BIND == 0)); then
|
||
for ((index = 0; index < COUNT; index++)); do RESOLVED_BINDS+=(""); done
|
||
return 0
|
||
fi
|
||
discover_local_addresses
|
||
validate_bind_addresses
|
||
for ((index = 0; index < COUNT; index++)); do
|
||
if ((size == COUNT)); then
|
||
RESOLVED_BINDS+=("${BIND_ADDRESSES[index]}")
|
||
elif ((size == 1)); then
|
||
RESOLVED_BINDS+=("${BIND_ADDRESSES[0]}")
|
||
elif ((AUTO_BIND == 1)); then
|
||
RESOLVED_BINDS+=("${LOCAL_ADDRESSES[index % ${#LOCAL_ADDRESSES[@]}]}")
|
||
else
|
||
RESOLVED_BINDS+=("")
|
||
fi
|
||
done
|
||
}
|
||
|
||
|
||
prepare_credentials() {
|
||
local index
|
||
for ((index = 0; index < COUNT; index++)); do
|
||
if ((NO_AUTH == 1)); then
|
||
USERS+=(""); PASSWORDS+=("")
|
||
elif [[ -n $COMMON_USER ]]; then
|
||
USERS+=("$COMMON_USER"); PASSWORDS+=("$COMMON_PASS")
|
||
else
|
||
USERS+=("proxy$(openssl rand -hex 3)")
|
||
PASSWORDS+=("$(openssl rand -hex 16)")
|
||
fi
|
||
done
|
||
}
|
||
|
||
|
||
prepare_ports() {
|
||
local index
|
||
for ((index = 0; index < COUNT; index++)); do
|
||
PORTS+=("$((START_PORT + index))")
|
||
done
|
||
}
|
||
|
||
|
||
port_in_use() {
|
||
local port=$1
|
||
ss -H -ltn | awk -v suffix=":$port" '$4 ~ suffix "$" {found=1} END {exit !found}'
|
||
}
|
||
|
||
|
||
validate_ports() {
|
||
local port config
|
||
for port in "${PORTS[@]}"; do
|
||
config="$CONF_DIR/$port.conf"
|
||
if [[ -e $config && $REPLACE -eq 0 ]]; then
|
||
die "$config 已存在；使用 --replace 才能覆盖"
|
||
fi
|
||
if [[ ! -e $config ]] && port_in_use "$port"; then
|
||
die "端口 $port 已被其他进程占用"
|
||
fi
|
||
done
|
||
}
|
||
|
||
|
||
format_url_host() {
|
||
local host=${1#[}
|
||
host=${host%]}
|
||
[[ $host == *:* ]] && printf '[%s]' "$host" || printf '%s' "$host"
|
||
}
|
||
|
||
|
||
format_link() {
|
||
local user=$1 pass=$2 host port=$4
|
||
host=$(format_url_host "$3")
|
||
if [[ -n $user ]]; then
|
||
printf 'socks5://%s:%s@%s:%s\n' "$user" "$pass" "$host" "$port"
|
||
else
|
||
printf 'socks5://%s:%s\n' "$host" "$port"
|
||
fi
|
||
}
|
||
|
||
|
||
print_links() {
|
||
local index
|
||
for ((index = 0; index < COUNT; index++)); do
|
||
format_link "${USERS[index]}" "${PASSWORDS[index]}" "$PUBLIC_HOST" "${PORTS[index]}"
|
||
done
|
||
}
|
||
|
||
|
||
show_plan() {
|
||
local index bind auth
|
||
log "计划创建 $COUNT 个实例，监听地址 $LISTEN_ADDR"
|
||
for ((index = 0; index < COUNT; index++)); do
|
||
bind=${RESOLVED_BINDS[index]:-自动}
|
||
auth=${USERS[index]:-无认证}
|
||
log "端口 ${PORTS[index]}；出口 ${bind}；用户 $auth"
|
||
done
|
||
log "来源限制: ${ALLOW_LIST:-不限制}"
|
||
log "链接主机: $PUBLIC_HOST"
|
||
}
|
||
|
||
|
||
confirm_plan() {
|
||
[[ -t 0 && $NON_INTERACTIVE -eq 0 ]] || return 0
|
||
local answer
|
||
read -r -p "继续安装并启动服务？[Y/n]: " answer
|
||
[[ ! $answer =~ ^[Nn]$ ]] || exit 0
|
||
}
|
||
|
||
|
||
bind_supported() {
|
||
local usage
|
||
usage=$({ "$MICROSOCKS_BIN" -h || true; } 2>&1 | grep -m1 '^usage:' || true)
|
||
# microsocks 1.0.1 lists a bare "-b" flag; only "-b bindaddr" accepts an address.
|
||
[[ $usage =~ [[:space:]]-b[[:space:]]+[[:alnum:]] ]]
|
||
}
|
||
|
||
|
||
check_bind_support() {
|
||
local has_bind=0 address
|
||
for address in "${RESOLVED_BINDS[@]}"; do
|
||
[[ -n $address ]] && has_bind=1
|
||
done
|
||
((has_bind == 0)) && return 0
|
||
bind_supported && return 0
|
||
log "$MICROSOCKS_BIN 的 -b 不能指定出站地址，改用上游源码编译"
|
||
install_from_source
|
||
bind_supported || die "当前 microsocks 不支持 -b 出站绑定"
|
||
}
|
||
|
||
|
||
write_unit_header() {
|
||
cat >"$1" <<EOF
|
||
[Unit]
|
||
Description=MicroSocks SOCKS5 Proxy on port %i
|
||
Wants=network-online.target
|
||
After=network-online.target
|
||
|
||
[Service]
|
||
Type=simple
|
||
EnvironmentFile=$CONF_DIR/%i.conf
|
||
ExecStart=$MICROSOCKS_BIN -i \${LISTEN_ADDR} -p %i \$AUTH_OPTIONS \$BIND_OPTIONS
|
||
Restart=on-failure
|
||
RestartSec=2
|
||
User=nobody
|
||
Group=nogroup
|
||
NoNewPrivileges=true
|
||
EOF
|
||
}
|
||
|
||
|
||
write_unit_sandbox() {
|
||
cat >>"$1" <<'EOF'
|
||
PrivateTmp=true
|
||
ProtectSystem=strict
|
||
ProtectHome=true
|
||
ProtectKernelTunables=true
|
||
ProtectKernelModules=true
|
||
ProtectControlGroups=true
|
||
RestrictAddressFamilies=AF_INET AF_INET6
|
||
LockPersonality=true
|
||
MemoryDenyWriteExecute=true
|
||
CapabilityBoundingSet=
|
||
|
||
[Install]
|
||
WantedBy=multi-user.target
|
||
EOF
|
||
}
|
||
|
||
|
||
write_unit_file() {
|
||
local temporary="$WORK_DIR/microsocks@.service"
|
||
write_unit_header "$temporary"
|
||
write_unit_sandbox "$temporary"
|
||
install -m 0644 "$temporary" "$UNIT_FILE"
|
||
}
|
||
|
||
|
||
render_instance_config() {
|
||
local auth_options="" bind_options=""
|
||
[[ -z $INST_USER ]] || auth_options="-u $INST_USER -P $INST_PASS"
|
||
[[ -z $INST_BIND ]] || bind_options="-b $INST_BIND"
|
||
printf 'LISTEN_ADDR=%s\n' "$INST_LISTEN"
|
||
printf 'SOCKS_USER=%s\n' "$INST_USER"
|
||
printf 'SOCKS_PASS=%s\n' "$INST_PASS"
|
||
printf 'AUTH_OPTIONS="%s"\n' "$auth_options"
|
||
printf 'BIND_OPTIONS="%s"\n' "$bind_options"
|
||
printf 'PUBLIC_HOST=%s\n' "$INST_HOST"
|
||
printf 'ALLOW_CIDRS="%s"\n' "$INST_ALLOW"
|
||
printf 'FIREWALL_OPENED=%s\n' "$INST_FIREWALL"
|
||
}
|
||
|
||
|
||
save_instance() {
|
||
local temporary="$WORK_DIR/$1.conf"
|
||
render_instance_config >"$temporary"
|
||
install -m 0600 "$temporary" "$CONF_DIR/$1.conf"
|
||
}
|
||
|
||
|
||
write_instance_config() {
|
||
local index=$1
|
||
INST_LISTEN=$LISTEN_ADDR
|
||
INST_USER=${USERS[index]}
|
||
INST_PASS=${PASSWORDS[index]}
|
||
INST_BIND=${RESOLVED_BINDS[index]}
|
||
INST_HOST=$PUBLIC_HOST
|
||
INST_ALLOW=$ALLOW_LIST
|
||
INST_FIREWALL=$OPEN_FIREWALL
|
||
save_instance "${PORTS[index]}"
|
||
}
|
||
|
||
|
||
install_configuration() {
|
||
install -d -m 0750 "$CONF_DIR"
|
||
write_unit_file
|
||
local index
|
||
for ((index = 0; index < COUNT; index++)); do
|
||
write_instance_config "$index"
|
||
done
|
||
systemctl daemon-reload
|
||
}
|
||
|
||
|
||
ensure_active() {
|
||
systemctl is-active --quiet "$1" && return 0
|
||
journalctl -u "$1" -n 30 --no-pager >&2 || true
|
||
die "$1 启动失败"
|
||
}
|
||
|
||
|
||
start_services() {
|
||
local port unit
|
||
for port in "${PORTS[@]}"; do
|
||
unit="microsocks@$port.service"
|
||
if systemctl is-active --quiet "$unit"; then
|
||
systemctl restart "$unit" || true
|
||
else
|
||
systemctl enable --now "$unit" || true
|
||
fi
|
||
ensure_active "$unit"
|
||
done
|
||
}
|
||
|
||
|
||
ufw_active() {
|
||
command -v ufw >/dev/null && ufw status | head -n 1 | grep -qw active
|
||
}
|
||
|
||
|
||
firewalld_active() {
|
||
command -v firewall-cmd >/dev/null && systemctl is-active --quiet firewalld
|
||
}
|
||
|
||
|
||
open_detected_firewall() {
|
||
[[ $OPEN_FIREWALL -eq 1 ]] || return 0
|
||
local port
|
||
if ufw_active; then
|
||
for port in "${PORTS[@]}"; do ufw allow "$port/tcp" >&2; done
|
||
fi
|
||
if firewalld_active; then
|
||
for port in "${PORTS[@]}"; do firewall-cmd --permanent --add-port="$port/tcp" >&2; done
|
||
firewall-cmd --reload >&2
|
||
fi
|
||
}
|
||
|
||
|
||
close_detected_firewall() {
|
||
(($# > 0)) || return 0
|
||
local port
|
||
if ufw_active; then
|
||
for port in "$@"; do ufw delete allow "$port/tcp" >&2 || log "UFW 未能删除 $port/tcp"; done
|
||
fi
|
||
if firewalld_active; then
|
||
for port in "$@"; do
|
||
firewall-cmd --permanent --remove-port="$port/tcp" >&2 || log "firewalld 未能删除 $port/tcp"
|
||
done
|
||
firewall-cmd --reload >&2
|
||
fi
|
||
}
|
||
|
||
|
||
render_acl_rules() {
|
||
local port cidr v4 v6
|
||
local -a ports=() cidrs=()
|
||
mapfile -t ports < <(instance_ports)
|
||
for port in "${ports[@]}"; do
|
||
load_instance "$port"
|
||
[[ -n $INST_ALLOW ]] || continue
|
||
read -r -a cidrs <<<"$INST_ALLOW"
|
||
v4="" v6=""
|
||
for cidr in "${cidrs[@]}"; do
|
||
if [[ $cidr == *:* ]]; then v6+=${v6:+, }$cidr; else v4+=${v4:+, }$cidr; fi
|
||
done
|
||
[[ -z $v4 ]] || printf '\t\ttcp dport %s ip saddr { %s } accept\n' "$port" "$v4"
|
||
[[ -z $v6 ]] || printf '\t\ttcp dport %s ip6 saddr { %s } accept\n' "$port" "$v6"
|
||
printf '\t\ttcp dport %s drop\n' "$port"
|
||
done
|
||
}
|
||
|
||
|
||
write_acl_file() {
|
||
local temporary="$WORK_DIR/acl.nft"
|
||
{
|
||
printf 'table inet microsocks\ndelete table inet microsocks\n'
|
||
printf 'table inet microsocks {\n\tchain input {\n'
|
||
printf '\t\ttype filter hook input priority 0; policy accept;\n'
|
||
printf '\t\tiif "lo" accept\n%s\n\t}\n}\n' "$1"
|
||
} >"$temporary"
|
||
nft -c -f "$temporary" || die "nftables 规则校验失败"
|
||
install -m 0600 "$temporary" "$ACL_FILE"
|
||
}
|
||
|
||
|
||
# Reload the allow list before every start so it survives reboots and fails closed.
|
||
install_acl_hook() {
|
||
local dropin="$UNIT_FILE.d/10-acl.conf" temporary="$WORK_DIR/10-acl.conf"
|
||
cat >"$temporary" <<EOF
|
||
[Service]
|
||
ExecStartPre=+/bin/sh -c 'test ! -e $ACL_FILE || exec nft -f $ACL_FILE'
|
||
EOF
|
||
cmp -s "$temporary" "$dropin" && return 0
|
||
install -d -m 0755 "$UNIT_FILE.d"
|
||
install -m 0644 "$temporary" "$dropin"
|
||
systemctl daemon-reload
|
||
}
|
||
|
||
|
||
ensure_nft() {
|
||
command -v nft >/dev/null && return 0
|
||
apt_update_once
|
||
DEBIAN_FRONTEND=noninteractive apt-get install -y nftables >&2
|
||
}
|
||
|
||
|
||
acl_table_loaded() {
|
||
command -v nft >/dev/null && nft list table inet microsocks >/dev/null 2>&1
|
||
}
|
||
|
||
|
||
apply_acl() {
|
||
local rules
|
||
rules=$(render_acl_rules)
|
||
if [[ -z $rules ]]; then
|
||
rm -f -- "$ACL_FILE"
|
||
if acl_table_loaded; then
|
||
nft delete table inet microsocks
|
||
log "已移除来源限制规则"
|
||
fi
|
||
return 0
|
||
fi
|
||
ensure_nft
|
||
write_acl_file "$rules"
|
||
install_acl_hook
|
||
nft -f "$ACL_FILE"
|
||
log "来源限制已生效（nftables 表 inet microsocks）"
|
||
}
|
||
|
||
|
||
instance_ports() {
|
||
local conf name
|
||
for conf in "$CONF_DIR"/*.conf; do
|
||
name=${conf##*/}
|
||
name=${name%.conf}
|
||
if [[ -f $conf ]] && is_uint "$name"; then
|
||
printf '%s\n' "$name"
|
||
fi
|
||
done | sort -n
|
||
}
|
||
|
||
|
||
load_instance() {
|
||
local line key value
|
||
INST_LISTEN="" INST_USER="" INST_PASS="" INST_BIND=""
|
||
INST_HOST="" INST_ALLOW="" INST_FIREWALL=0
|
||
while IFS= read -r line || [[ -n $line ]]; do
|
||
key=${line%%=*}
|
||
value=${line#*=}
|
||
value=${value#\"}
|
||
value=${value%\"}
|
||
case "$key" in
|
||
LISTEN_ADDR) INST_LISTEN=$value ;;
|
||
SOCKS_USER) INST_USER=$value ;;
|
||
SOCKS_PASS) INST_PASS=$value ;;
|
||
BIND_OPTIONS) INST_BIND=${value#-b } ;;
|
||
PUBLIC_HOST) INST_HOST=$value ;;
|
||
ALLOW_CIDRS) INST_ALLOW=$value ;;
|
||
FIREWALL_OPENED) INST_FIREWALL=$value ;;
|
||
esac
|
||
done <"$CONF_DIR/$1.conf"
|
||
}
|
||
|
||
|
||
resolve_targets() {
|
||
local port
|
||
local -a existing=()
|
||
mapfile -t existing < <(instance_ports)
|
||
if ((${#existing[@]} == 0)); then
|
||
[[ $ACTION == list || $ACTION == links ]] || die "没有找到 microsocks 实例"
|
||
log "没有找到 microsocks 实例"
|
||
exit 0
|
||
fi
|
||
((${#TARGET_PORTS[@]} > 0)) || TARGET_PORTS=("${existing[@]}")
|
||
mapfile -t TARGET_PORTS < <(printf '%s\n' "${TARGET_PORTS[@]}" | sort -nu)
|
||
for port in "${TARGET_PORTS[@]}"; do
|
||
[[ -f $CONF_DIR/$port.conf ]] || die "实例 $port 不存在"
|
||
done
|
||
}
|
||
|
||
|
||
print_row() {
|
||
printf '%-6s %-10s %-16s %-16s %-14s %s\n' "$@"
|
||
}
|
||
|
||
|
||
list_instances() {
|
||
local port state allow
|
||
print_row PORT STATE LISTEN EGRESS USER ALLOW
|
||
for port in "${TARGET_PORTS[@]}"; do
|
||
load_instance "$port"
|
||
state=$(systemctl is-active "microsocks@$port.service" 2>/dev/null || true)
|
||
allow=${INST_ALLOW// /,}
|
||
print_row "$port" "${state:-unknown}" "$INST_LISTEN" "${INST_BIND:-default}" \
|
||
"${INST_USER:--}" "${allow:-any}"
|
||
done
|
||
}
|
||
|
||
|
||
print_instance_links() {
|
||
local port
|
||
for port in "${TARGET_PORTS[@]}"; do
|
||
load_instance "$port"
|
||
format_link "$INST_USER" "$INST_PASS" "${PUBLIC_HOST:-$INST_HOST}" "$port"
|
||
done
|
||
}
|
||
|
||
|
||
update_instances() {
|
||
local port
|
||
for port in "${TARGET_PORTS[@]}"; do
|
||
load_instance "$port"
|
||
if ((${#ALLOW_ARGS[@]} > 0 || ALLOW_ALL == 1)); then
|
||
INST_ALLOW=$ALLOW_LIST
|
||
fi
|
||
if [[ -n $PUBLIC_HOST ]]; then
|
||
INST_HOST=$PUBLIC_HOST
|
||
fi
|
||
save_instance "$port"
|
||
log "已更新 ${port}：来源限制 ${INST_ALLOW:-不限制}；链接主机 $INST_HOST"
|
||
done
|
||
apply_acl
|
||
print_instance_links
|
||
}
|
||
|
||
|
||
control_instances() {
|
||
local port unit
|
||
for port in "${TARGET_PORTS[@]}"; do
|
||
unit="microsocks@$port.service"
|
||
case "$ACTION" in
|
||
start) systemctl enable --now "$unit" || true ;;
|
||
stop) systemctl disable --now "$unit" ;;
|
||
restart) systemctl restart "$unit" || true ;;
|
||
esac
|
||
[[ $ACTION == stop ]] || ensure_active "$unit"
|
||
log "$unit: $(systemctl is-active "$unit" || true)"
|
||
done
|
||
}
|
||
|
||
|
||
confirm_remove() {
|
||
[[ -t 0 && $NON_INTERACTIVE -eq 0 ]] || return 0
|
||
local answer
|
||
read -r -p "确认删除实例 ${TARGET_PORTS[*]}？[y/N]: " answer
|
||
[[ $answer =~ ^[Yy]$ ]] || exit 0
|
||
}
|
||
|
||
|
||
remove_instances() {
|
||
local port
|
||
local -a opened=()
|
||
for port in "${TARGET_PORTS[@]}"; do
|
||
load_instance "$port"
|
||
[[ $INST_FIREWALL != 1 ]] || opened+=("$port")
|
||
systemctl disable --now "microsocks@$port.service" || log "停止 microsocks@$port 失败"
|
||
rm -f -- "$CONF_DIR/$port.conf"
|
||
log "已删除 microsocks@$port"
|
||
done
|
||
apply_acl
|
||
close_detected_firewall "${opened[@]}"
|
||
}
|
||
|
||
|
||
acquire_lock() {
|
||
exec 9>/run/lock/microsocks-setup.lock
|
||
flock -n 9 || die "另一个 microsocks 任务正在运行"
|
||
}
|
||
|
||
|
||
cleanup() {
|
||
[[ -n ${WORK_DIR:-} && -d ${WORK_DIR:-} ]] || return 0
|
||
[[ $WORK_DIR == /tmp/microsocks-setup.* ]] || return 0
|
||
rm -rf -- "$WORK_DIR"
|
||
}
|
||
|
||
|
||
prepare_plan() {
|
||
detect_public_host
|
||
prepare_binds
|
||
validate_bind_routes
|
||
prepare_ports
|
||
prepare_credentials
|
||
validate_ports
|
||
show_plan
|
||
}
|
||
|
||
|
||
run_create() {
|
||
interactive_options
|
||
detect_os
|
||
[[ $DRY_RUN -eq 1 || $EUID -eq 0 ]] || die "请使用 root 或 sudo 执行"
|
||
ensure_base_tools
|
||
validate_options
|
||
validate_auth_mode
|
||
prepare_plan
|
||
if [[ $DRY_RUN -eq 1 ]]; then
|
||
log "dry-run：未修改系统；以下链接尚未生效"
|
||
print_links
|
||
return 0
|
||
fi
|
||
confirm_plan
|
||
acquire_lock
|
||
install_microsocks
|
||
check_bind_support
|
||
install_configuration
|
||
apply_acl
|
||
start_services
|
||
open_detected_firewall
|
||
log "请同时在云平台安全组/安全列表中放行对应 TCP 端口"
|
||
print_links
|
||
}
|
||
|
||
|
||
run_manage() {
|
||
[[ $EUID -eq 0 ]] || die "请使用 root 或 sudo 执行"
|
||
command -v systemctl >/dev/null || die "未检测到 systemd"
|
||
validate_manage_options
|
||
resolve_targets
|
||
case "$ACTION" in
|
||
list) list_instances ;;
|
||
links) print_instance_links ;;
|
||
update) acquire_lock; update_instances ;;
|
||
start|stop|restart) acquire_lock; control_instances ;;
|
||
remove) confirm_remove; acquire_lock; remove_instances ;;
|
||
esac
|
||
}
|
||
|
||
|
||
main() {
|
||
parse_cli "$@"
|
||
if [[ $ACTION == create ]]; then
|
||
run_create
|
||
else
|
||
run_manage
|
||
fi
|
||
}
|
||
|
||
|
||
trap cleanup EXIT
|
||
WORK_DIR=$(mktemp -d /tmp/microsocks-setup.XXXXXX)
|
||
|
||
if [[ ${BASH_SOURCE[0]} == "$0" ]]; then
|
||
main "$@"
|
||
fi
|