jocay
140 lines
4.6 KiB
Bash
140 lines
4.6 KiB
Bash
#!/usr/bin/env bash
|
|
# ==============================================================================
|
|
# 模块：系统架构识别、依赖安装与安全防火墙配置
|
|
# ==============================================================================
|
|
|
|
# 识别系统架构
|
|
detect_arch() {
|
|
local raw_arch
|
|
raw_arch=$(uname -m)
|
|
case "${raw_arch}" in
|
|
x86_64|amd64)
|
|
echo "amd64"
|
|
;;
|
|
aarch64|arm64)
|
|
echo "arm64"
|
|
;;
|
|
armv7*|armv8l)
|
|
echo "armv7"
|
|
;;
|
|
*)
|
|
log_error "暂不支持的 CPU 架构: ${raw_arch}"
|
|
return 1
|
|
;;
|
|
esac
|
|
}
|
|
|
|
# 识别系统包管理器并安装基础依赖
|
|
install_dependencies() {
|
|
log_info "检查并安装必要系统工具 (curl, tar, jq, openssl, ca-certificates)..."
|
|
|
|
local pkgs=("curl" "tar" "jq" "openssl" "ca-certificates")
|
|
|
|
if command -v apt-get >/dev/null 2>&1; then
|
|
apt-get update -y >/dev/null 2>&1
|
|
apt-get install -y "${pkgs[@]}" >/dev/null 2>&1
|
|
elif command -v dnf >/dev/null 2>&1; then
|
|
dnf install -y "${pkgs[@]}" >/dev/null 2>&1
|
|
elif command -v yum >/dev/null 2>&1; then
|
|
yum install -y "${pkgs[@]}" >/dev/null 2>&1
|
|
elif command -v apk >/dev/null 2>&1; then
|
|
apk update >/dev/null 2>&1
|
|
apk add --no-cache "${pkgs[@]}" >/dev/null 2>&1
|
|
else
|
|
log_warn "未识别的包管理器，请手动确保安装了: ${pkgs[*]}"
|
|
fi
|
|
|
|
# 验证关键工具安装结果
|
|
for cmd in curl tar jq openssl; do
|
|
if ! command -v "$cmd" >/dev/null 2>&1; then
|
|
log_error "关键依赖工具 [${cmd}] 安装失败，请检查网络或系统源设置！"
|
|
return 1
|
|
fi
|
|
done
|
|
|
|
log_success "系统基础依赖检测通过！"
|
|
return 0
|
|
}
|
|
|
|
# 获取公网 IP（具备多节点故障自动切换机制）
|
|
get_public_ip() {
|
|
local ip=""
|
|
local apis=(
|
|
"https://api.ipify.org"
|
|
"https://icanhazip.com"
|
|
"https://ifconfig.me/ip"
|
|
"https://checkip.amazonaws.com"
|
|
)
|
|
|
|
for api in "${apis[@]}"; do
|
|
ip=$(curl -s4m 4 "$api" 2>/dev/null | tr -d '[:space:]')
|
|
if [[ -n "$ip" && "$ip" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
|
|
echo "$ip"
|
|
return 0
|
|
fi
|
|
done
|
|
|
|
# 尝试获取 IPv6 (如果仅有 IPv6)
|
|
ip=$(curl -s6m 4 "https://api64.ipify.org" 2>/dev/null | tr -d '[:space:]')
|
|
if [[ -n "$ip" ]]; then
|
|
echo "$ip"
|
|
return 0
|
|
fi
|
|
|
|
echo "127.0.0.1"
|
|
}
|
|
|
|
# 安全配置防火墙：精准仅开放代理端口，杜绝关闭防火墙或全盘清空规则
|
|
open_firewall_port() {
|
|
local port="$1"
|
|
local protocol="${2:-tcp}"
|
|
[[ -z "$port" ]] && return 0
|
|
|
|
log_info "正在配置防火墙放行端口: ${port}/${protocol}..."
|
|
|
|
# 1. 检测 UFW
|
|
if command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -qw "active"; then
|
|
ufw allow "${port}/${protocol}" comment "sing-box" >/dev/null 2>&1
|
|
log_success "UFW 已放行端口 ${port}/${protocol}"
|
|
return 0
|
|
fi
|
|
|
|
# 2. 检测 Firewalld
|
|
if command -v firewall-cmd >/dev/null 2>&1 && systemctl is-active --quiet firewalld 2>/dev/null; then
|
|
firewall-cmd --permanent --add-port="${port}/${protocol}" >/dev/null 2>&1
|
|
firewall-cmd --reload >/dev/null 2>&1
|
|
log_success "Firewalld 已放行端口 ${port}/${protocol}"
|
|
return 0
|
|
fi
|
|
|
|
# 3. iptables 兜底安全追加（不重置现有规则链）
|
|
if command -v iptables >/dev/null 2>&1; then
|
|
if ! iptables -C INPUT -p "${protocol}" --dport "${port}" -j ACCEPT 2>/dev/null; then
|
|
iptables -I INPUT -p "${protocol}" --dport "${port}" -j ACCEPT 2>/dev/null
|
|
log_success "iptables 已安全追加放行规则: ${port}/${protocol}"
|
|
fi
|
|
fi
|
|
}
|
|
|
|
# 卸载或更换端口时安全移除端口规则
|
|
close_firewall_port() {
|
|
local port="$1"
|
|
local protocol="${2:-tcp}"
|
|
[[ -z "$port" ]] && return 0
|
|
|
|
log_info "正在清理防火墙放行规则: ${port}/${protocol}..."
|
|
|
|
if command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -qw "active"; then
|
|
ufw delete allow "${port}/${protocol}" >/dev/null 2>&1 || true
|
|
fi
|
|
|
|
if command -v firewall-cmd >/dev/null 2>&1 && systemctl is-active --quiet firewalld 2>/dev/null; then
|
|
firewall-cmd --permanent --remove-port="${port}/${protocol}" >/dev/null 2>&1 || true
|
|
firewall-cmd --reload >/dev/null 2>&1 || true
|
|
fi
|
|
|
|
if command -v iptables >/dev/null 2>&1; then
|
|
iptables -D INPUT -p "${protocol}" --dport "${port}" -j ACCEPT 2>/dev/null || true
|
|
fi
|
|
}
|