feat: initial commit of clean multi-protocol singbox core script

2026-09-27 13:11:24 +08:00
commit 34565faa6b
10 changed files with 1475 additions and 0 deletions
@@ -0,0 +1,139 @@
+#!/usr/bin/env bash
+# ==============================================================================
+# 模块：系统架构识别、依赖安装与安全防火墙配置
+# ==============================================================================
+
+# 识别系统架构
+detect_arch() {
+    local raw_arch
+    raw_arch=$(uname -m)
+    case "${raw_arch}" in
+        x86_64|amd64)
+            echo "amd64"
+            ;;
+        aarch64|arm64)
+            echo "arm64"
+            ;;
+        armv7*|armv8l)
+            echo "armv7"
+            ;;
+        *)
+            log_error "暂不支持的 CPU 架构: ${raw_arch}"
+            return 1
+            ;;
+    esac
+}
+
+# 识别系统包管理器并安装基础依赖
+install_dependencies() {
+    log_info "检查并安装必要系统工具 (curl, tar, jq, openssl, ca-certificates)..."
+
+    local pkgs=("curl" "tar" "jq" "openssl" "ca-certificates")
+
+    if command -v apt-get >/dev/null 2>&1; then
+        apt-get update -y >/dev/null 2>&1
+        apt-get install -y "${pkgs[@]}" >/dev/null 2>&1
+    elif command -v dnf >/dev/null 2>&1; then
+        dnf install -y "${pkgs[@]}" >/dev/null 2>&1
+    elif command -v yum >/dev/null 2>&1; then
+        yum install -y "${pkgs[@]}" >/dev/null 2>&1
+    elif command -v apk >/dev/null 2>&1; then
+        apk update >/dev/null 2>&1
+        apk add --no-cache "${pkgs[@]}" >/dev/null 2>&1
+    else
+        log_warn "未识别的包管理器，请手动确保安装了: ${pkgs[*]}"
+    fi
+
+    # 验证关键工具安装结果
+    for cmd in curl tar jq openssl; do
+        if ! command -v "$cmd" >/dev/null 2>&1; then
+            log_error "关键依赖工具 [${cmd}] 安装失败，请检查网络或系统源设置！"
+            return 1
+        fi
+    done
+
+    log_success "系统基础依赖检测通过！"
+    return 0
+}
+
+# 获取公网 IP（具备多节点故障自动切换机制）
+get_public_ip() {
+    local ip=""
+    local apis=(
+        "https://api.ipify.org"
+        "https://icanhazip.com"
+        "https://ifconfig.me/ip"
+        "https://checkip.amazonaws.com"
+    )
+
+    for api in "${apis[@]}"; do
+        ip=$(curl -s4m 4 "$api" 2>/dev/null | tr -d '[:space:]')
+        if [[ -n "$ip" && "$ip" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "$ip"
+            return 0
+        fi
+    done
+
+    # 尝试获取 IPv6 (如果仅有 IPv6)
+    ip=$(curl -s6m 4 "https://api64.ipify.org" 2>/dev/null | tr -d '[:space:]')
+    if [[ -n "$ip" ]]; then
+        echo "$ip"
+        return 0
+    fi
+
+    echo "127.0.0.1"
+}
+
+# 安全配置防火墙：精准仅开放代理端口，杜绝关闭防火墙或全盘清空规则
+open_firewall_port() {
+    local port="$1"
+    local protocol="${2:-tcp}"
+    [[ -z "$port" ]] && return 0
+
+    log_info "正在配置防火墙放行端口: ${port}/${protocol}..."
+
+    # 1. 检测 UFW
+    if command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -qw "active"; then
+        ufw allow "${port}/${protocol}" comment "sing-box" >/dev/null 2>&1
+        log_success "UFW 已放行端口 ${port}/${protocol}"
+        return 0
+    fi
+
+    # 2. 检测 Firewalld
+    if command -v firewall-cmd >/dev/null 2>&1 && systemctl is-active --quiet firewalld 2>/dev/null; then
+        firewall-cmd --permanent --add-port="${port}/${protocol}" >/dev/null 2>&1
+        firewall-cmd --reload >/dev/null 2>&1
+        log_success "Firewalld 已放行端口 ${port}/${protocol}"
+        return 0
+    fi
+
+    # 3. iptables 兜底安全追加（不重置现有规则链）
+    if command -v iptables >/dev/null 2>&1; then
+        if ! iptables -C INPUT -p "${protocol}" --dport "${port}" -j ACCEPT 2>/dev/null; then
+            iptables -I INPUT -p "${protocol}" --dport "${port}" -j ACCEPT 2>/dev/null
+            log_success "iptables 已安全追加放行规则: ${port}/${protocol}"
+        fi
+    fi
+}
+
+# 卸载或更换端口时安全移除端口规则
+close_firewall_port() {
+    local port="$1"
+    local protocol="${2:-tcp}"
+    [[ -z "$port" ]] && return 0
+
+    log_info "正在清理防火墙放行规则: ${port}/${protocol}..."
+
+    if command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -qw "active"; then
+        ufw delete allow "${port}/${protocol}" >/dev/null 2>&1 || true
+    fi
+
+    if command -v firewall-cmd >/dev/null 2>&1 && systemctl is-active --quiet firewalld 2>/dev/null; then
+        firewall-cmd --permanent --remove-port="${port}/${protocol}" >/dev/null 2>&1 || true
+        firewall-cmd --reload >/dev/null 2>&1 || true
+    fi
+
+    if command -v iptables >/dev/null 2>&1; then
+        iptables -D INPUT -p "${protocol}" --dport "${port}" -j ACCEPT 2>/dev/null || true
+    fi
+}