sindricn
1039 lines
31 KiB
Bash
1039 lines
31 KiB
Bash
#!/bin/bash
|
|
|
|
# Hysteria2 配置生成脚本 (安全版本)
|
|
# 严格错误处理
|
|
set -euo pipefail
|
|
|
|
# 加载安全输入验证模块
|
|
script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
if [[ -f "$script_dir/input-validation.sh" ]]; then
|
|
source "$script_dir/input-validation.sh"
|
|
else
|
|
echo "警告: 安全输入验证模块未找到" >&2
|
|
fi
|
|
|
|
# 等待用户确认
|
|
wait_for_user() {
|
|
echo ""
|
|
read -p "按回车键继续..." -r
|
|
}
|
|
|
|
# 生成随机密码 (安全版本)
|
|
generate_password() {
|
|
local length="${1:-12}"
|
|
|
|
# 验证长度参数
|
|
if command -v validate_number_secure >/dev/null 2>&1; then
|
|
if ! validate_number_secure "$length" 8 64; then
|
|
echo "警告: 密码长度无效，使用默认值12" >&2
|
|
length=12
|
|
fi
|
|
else
|
|
# 基础验证
|
|
if [[ ! "$length" =~ ^[0-9]+$ ]] || [[ $length -lt 8 ]] || [[ $length -gt 64 ]]; then
|
|
echo "警告: 密码长度无效，使用默认值12" >&2
|
|
length=12
|
|
fi
|
|
fi
|
|
|
|
# 安全生成密码
|
|
openssl rand -base64 "$length" | tr -d "=+/" | cut -c1-"$length"
|
|
}
|
|
|
|
# 验证域名格式
|
|
validate_domain() {
|
|
local domain=$1
|
|
if [[ $domain =~ ^[a-zA-Z0-9]([a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?)*$ ]]; then
|
|
return 0
|
|
else
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
# 验证邮箱格式
|
|
validate_email() {
|
|
local email=$1
|
|
if [[ $email =~ ^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$ ]]; then
|
|
return 0
|
|
else
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
# 获取服务器域名配置
|
|
get_server_domain() {
|
|
if [[ -f "/etc/hysteria/server-domain.conf" ]]; then
|
|
cat "/etc/hysteria/server-domain.conf"
|
|
else
|
|
echo ""
|
|
fi
|
|
}
|
|
|
|
# 获取当前配置文件中的监听端口
|
|
get_current_listen_port() {
|
|
if [[ -f "$CONFIG_PATH" ]]; then
|
|
local port=$(grep -E "^\s*listen:" "$CONFIG_PATH" | awk -F':' '{print $3}' | tr -d ' ' | head -1)
|
|
echo "${port:-443}"
|
|
else
|
|
echo "443"
|
|
fi
|
|
}
|
|
|
|
# ACME 配置模式
|
|
configure_acme_mode() {
|
|
echo -e "${BLUE}ACME 自动证书配置${NC}"
|
|
echo ""
|
|
|
|
# 检查是否已配置服务器域名
|
|
local configured_domain=$(get_server_domain)
|
|
local domain=""
|
|
|
|
if [[ -n "$configured_domain" ]]; then
|
|
echo -e "${GREEN}检测到已配置的服务器域名: $configured_domain${NC}"
|
|
echo ""
|
|
echo -n -e "${YELLOW}是否使用已配置的域名? [Y/n]: ${NC}"
|
|
read -r use_configured
|
|
|
|
if [[ ! $use_configured =~ ^[Nn]$ ]]; then
|
|
domain="$configured_domain"
|
|
echo -e "${GREEN}使用已配置域名: $domain${NC}"
|
|
fi
|
|
fi
|
|
|
|
# 如果没有使用已配置域名，则手动输入
|
|
if [[ -z "$domain" ]]; then
|
|
echo -e "${BLUE}手动输入域名${NC}"
|
|
while true; do
|
|
echo -n -e "${BLUE}请输入域名 (例: your.domain.com): ${NC}"
|
|
read -r domain
|
|
if validate_domain "$domain"; then
|
|
break
|
|
else
|
|
echo -e "${RED}域名格式无效，请重新输入${NC}"
|
|
fi
|
|
done
|
|
fi
|
|
|
|
# 输入邮箱
|
|
while true; do
|
|
echo -n -e "${BLUE}请输入邮箱地址: ${NC}"
|
|
read -r email
|
|
if validate_email "$email"; then
|
|
break
|
|
else
|
|
echo -e "${RED}邮箱格式无效，请重新输入${NC}"
|
|
fi
|
|
done
|
|
|
|
# 输入监听端口
|
|
echo -n -e "${BLUE}请输入监听端口 (默认 443): ${NC}"
|
|
read -r listen_port
|
|
listen_port=${listen_port:-443}
|
|
|
|
# 验证端口范围
|
|
if [[ ! "$listen_port" =~ ^[0-9]+$ ]] || [[ "$listen_port" -lt 1 ]] || [[ "$listen_port" -gt 65535 ]]; then
|
|
echo -e "${YELLOW}端口范围无效，使用默认端口 443${NC}"
|
|
listen_port=443
|
|
fi
|
|
|
|
# 输入认证密码
|
|
echo -n -e "${BLUE}请输入认证密码 (留空自动生成): ${NC}"
|
|
read -r password
|
|
if [[ -z "$password" ]]; then
|
|
password=$(generate_password 16)
|
|
echo -e "${GREEN}自动生成密码: $password${NC}"
|
|
fi
|
|
|
|
# 询问是否启用混淆
|
|
echo ""
|
|
echo -n -e "${BLUE}是否启用混淆功能? [Y/n]: ${NC}"
|
|
read -r enable_obfs
|
|
|
|
local obfs_config=""
|
|
if [[ ! $enable_obfs =~ ^[Nn]$ ]]; then
|
|
echo -n -e "${BLUE}请输入混淆密码 (留空自动生成): ${NC}"
|
|
read -r obfs_password
|
|
if [[ -z "$obfs_password" ]]; then
|
|
obfs_password=$(generate_password 16)
|
|
echo -e "${GREEN}自动生成混淆密码: $obfs_password${NC}"
|
|
fi
|
|
|
|
obfs_config="
|
|
|
|
obfs:
|
|
type: salamander
|
|
salamander:
|
|
password: $obfs_password"
|
|
fi
|
|
|
|
# 选择伪装网站
|
|
echo ""
|
|
echo -e "${BLUE}选择伪装网站:${NC}"
|
|
echo "1. 使用默认 (news.ycombinator.com)"
|
|
echo "2. 自动测试选择最优域名"
|
|
echo "3. 手动输入"
|
|
echo -n -e "${BLUE}请选择 [1-3]: ${NC}"
|
|
read -r masq_choice
|
|
|
|
case $masq_choice in
|
|
1)
|
|
masquerade_url="https://news.ycombinator.com/"
|
|
;;
|
|
2)
|
|
echo -e "${BLUE}正在测试域名延迟...${NC}"
|
|
if [[ -f "$SCRIPTS_DIR/domain-test.sh" ]]; then
|
|
source "$SCRIPTS_DIR/domain-test.sh"
|
|
masquerade_url=$(get_best_domain)
|
|
else
|
|
masquerade_url="https://news.ycombinator.com/"
|
|
fi
|
|
;;
|
|
3)
|
|
echo -n -e "${BLUE}请输入伪装网站URL: ${NC}"
|
|
read -r masquerade_url
|
|
;;
|
|
*)
|
|
masquerade_url="https://news.ycombinator.com/"
|
|
;;
|
|
esac
|
|
|
|
# 生成配置文件
|
|
cat > "$CONFIG_PATH" << EOF
|
|
# Hysteria2 配置文件 - ACME 模式
|
|
# 生成时间: $(date)
|
|
|
|
listen: :$listen_port
|
|
|
|
acme:
|
|
domains:
|
|
- $domain
|
|
email: $email
|
|
|
|
auth:
|
|
type: password
|
|
password: $password$obfs_config
|
|
|
|
masquerade:
|
|
type: proxy
|
|
proxy:
|
|
url: $masquerade_url
|
|
rewriteHost: true
|
|
EOF
|
|
|
|
echo ""
|
|
echo -e "${GREEN}ACME 配置文件生成成功!${NC}"
|
|
echo -e "${YELLOW}域名: $domain${NC}"
|
|
echo -e "${YELLOW}邮箱: $email${NC}"
|
|
echo -e "${YELLOW}监听端口: $listen_port${NC}"
|
|
echo -e "${YELLOW}认证密码: $password${NC}"
|
|
if [[ -n "$obfs_password" ]]; then
|
|
echo -e "${YELLOW}混淆密码: $obfs_password${NC}"
|
|
echo -e "${YELLOW}混淆类型: Salamander${NC}"
|
|
else
|
|
echo -e "${YELLOW}混淆功能: 未启用${NC}"
|
|
fi
|
|
echo -e "${YELLOW}伪装网站: $masquerade_url${NC}"
|
|
|
|
wait_for_user
|
|
}
|
|
|
|
# 自签名证书配置模式
|
|
configure_self_cert_mode() {
|
|
echo -e "${BLUE}自签名证书配置${NC}"
|
|
echo ""
|
|
|
|
# 选择伪装域名
|
|
echo -e "${BLUE}选择伪装域名:${NC}"
|
|
echo "1. 使用默认 (cdn.jsdelivr.net)"
|
|
echo "2. 自动测试选择最优域名"
|
|
echo "3. 手动输入"
|
|
echo -n -e "${BLUE}请选择 [1-3]: ${NC}"
|
|
read -r domain_choice
|
|
|
|
case $domain_choice in
|
|
1)
|
|
cert_domain="cdn.jsdelivr.net"
|
|
masquerade_url="https://cdn.jsdelivr.net/"
|
|
;;
|
|
2)
|
|
echo -e "${BLUE}正在测试域名延迟...${NC}"
|
|
if [[ -f "$SCRIPTS_DIR/domain-test.sh" ]]; then
|
|
source "$SCRIPTS_DIR/domain-test.sh"
|
|
best_domain=$(get_best_domain_name)
|
|
cert_domain="$best_domain"
|
|
masquerade_url="https://$best_domain/"
|
|
else
|
|
cert_domain="cdn.jsdelivr.net"
|
|
masquerade_url="https://cdn.jsdelivr.net/"
|
|
fi
|
|
;;
|
|
3)
|
|
echo -n -e "${BLUE}请输入伪装域名: ${NC}"
|
|
read -r cert_domain
|
|
masquerade_url="https://$cert_domain/"
|
|
;;
|
|
*)
|
|
cert_domain="cdn.jsdelivr.net"
|
|
masquerade_url="https://cdn.jsdelivr.net/"
|
|
;;
|
|
esac
|
|
|
|
# 输入监听端口
|
|
echo -n -e "${BLUE}请输入监听端口 (默认 443): ${NC}"
|
|
read -r listen_port
|
|
listen_port=${listen_port:-443}
|
|
|
|
# 验证端口范围
|
|
if [[ ! "$listen_port" =~ ^[0-9]+$ ]] || [[ "$listen_port" -lt 1 ]] || [[ "$listen_port" -gt 65535 ]]; then
|
|
echo -e "${YELLOW}端口范围无效，使用默认端口 443${NC}"
|
|
listen_port=443
|
|
fi
|
|
|
|
# 输入认证密码
|
|
echo -n -e "${BLUE}请输入认证密码 (留空自动生成): ${NC}"
|
|
read -r password
|
|
if [[ -z "$password" ]]; then
|
|
password=$(generate_password 16)
|
|
echo -e "${GREEN}自动生成密码: $password${NC}"
|
|
fi
|
|
|
|
# 询问是否启用混淆
|
|
echo ""
|
|
echo -n -e "${BLUE}是否启用混淆功能? [Y/n]: ${NC}"
|
|
read -r enable_obfs
|
|
|
|
local obfs_config=""
|
|
if [[ ! $enable_obfs =~ ^[Nn]$ ]]; then
|
|
echo -n -e "${BLUE}请输入混淆密码 (留空自动生成): ${NC}"
|
|
read -r obfs_password
|
|
if [[ -z "$obfs_password" ]]; then
|
|
obfs_password=$(generate_password 16)
|
|
echo -e "${GREEN}自动生成混淆密码: $obfs_password${NC}"
|
|
fi
|
|
|
|
obfs_config="
|
|
obfs:
|
|
type: salamander
|
|
salamander:
|
|
password: $obfs_password"
|
|
fi
|
|
|
|
# 生成自签名证书
|
|
echo -e "${BLUE}生成自签名证书...${NC}"
|
|
mkdir -p /etc/hysteria
|
|
|
|
openssl req -x509 -nodes -newkey ec:<(openssl ecparam -name prime256v1) \
|
|
-keyout /etc/hysteria/server.key \
|
|
-out /etc/hysteria/server.crt \
|
|
-subj "/CN=$cert_domain" \
|
|
-days 3650
|
|
|
|
# 设置证书权限
|
|
if id "hysteria" &>/dev/null; then
|
|
chown hysteria:hysteria /etc/hysteria/server.key
|
|
chown hysteria:hysteria /etc/hysteria/server.crt
|
|
fi
|
|
|
|
# 生成配置文件
|
|
cat > "$CONFIG_PATH" << EOF
|
|
# Hysteria2 配置文件 - 自签名证书模式
|
|
# 生成时间: $(date)
|
|
|
|
listen: :$listen_port
|
|
|
|
tls:
|
|
cert: /etc/hysteria/server.crt
|
|
key: /etc/hysteria/server.key
|
|
|
|
auth:
|
|
type: password
|
|
password: $password$obfs_config
|
|
|
|
masquerade:
|
|
type: proxy
|
|
proxy:
|
|
url: $masquerade_url
|
|
rewriteHost: true
|
|
EOF
|
|
|
|
echo ""
|
|
echo -e "${GREEN}自签名证书配置生成成功!${NC}"
|
|
echo -e "${YELLOW}证书域名: $cert_domain${NC}"
|
|
echo -e "${YELLOW}监听端口: $listen_port${NC}"
|
|
echo -e "${YELLOW}认证密码: $password${NC}"
|
|
if [[ -n "$obfs_password" ]]; then
|
|
echo -e "${YELLOW}混淆密码: $obfs_password${NC}"
|
|
echo -e "${YELLOW}混淆类型: Salamander${NC}"
|
|
else
|
|
echo -e "${YELLOW}混淆功能: 未启用${NC}"
|
|
fi
|
|
echo -e "${YELLOW}伪装网站: $masquerade_url${NC}"
|
|
|
|
wait_for_user
|
|
}
|
|
|
|
# 获取服务器公网IP
|
|
get_server_ip() {
|
|
local ip=""
|
|
|
|
# 尝试多种方法获取公网IP
|
|
ip=$(curl -s --connect-timeout 5 ipv4.icanhazip.com 2>/dev/null) || \
|
|
ip=$(curl -s --connect-timeout 5 ifconfig.me 2>/dev/null) || \
|
|
ip=$(curl -s --connect-timeout 5 ip.sb 2>/dev/null) || \
|
|
ip=$(curl -s --connect-timeout 5 checkip.amazonaws.com 2>/dev/null)
|
|
|
|
if [[ -n "$ip" && "$ip" =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
|
|
echo "$ip"
|
|
else
|
|
# 如果无法获取公网IP，尝试获取本地IP
|
|
ip=$(ip route get 8.8.8.8 2>/dev/null | grep -oP 'src \K\S+')
|
|
echo "${ip:-127.0.0.1}"
|
|
fi
|
|
}
|
|
|
|
# 自动检测网卡
|
|
get_network_interface() {
|
|
# 获取默认路由的网卡
|
|
local interface=$(ip route | grep default | head -1 | awk '{print $5}')
|
|
|
|
# 如果没有找到，尝试其他方法
|
|
if [[ -z "$interface" ]]; then
|
|
interface=$(ip link show | grep -E "^[0-9]+:" | grep -v lo | head -1 | awk -F': ' '{print $2}')
|
|
fi
|
|
|
|
# 最后的备选方案
|
|
if [[ -z "$interface" ]]; then
|
|
interface="eth0"
|
|
fi
|
|
|
|
echo "$interface"
|
|
}
|
|
|
|
# 改进的端口跳跃状态检查
|
|
check_port_hopping_status() {
|
|
local interface=$(get_network_interface)
|
|
local target_port=$(get_current_listen_port)
|
|
|
|
# 多种检测方式
|
|
local found=false
|
|
|
|
# 方式1: 检查 REDIRECT 规则到目标端口
|
|
if iptables -t nat -L PREROUTING -n --line-numbers 2>/dev/null | grep -q "REDIRECT.*dpt:.*--to-ports $target_port"; then
|
|
found=true
|
|
fi
|
|
|
|
# 方式2: 检查端口范围规则
|
|
if iptables -t nat -L PREROUTING -n 2>/dev/null | grep -E "REDIRECT.*dpts:[0-9]+:[0-9]+.*--to-ports $target_port" >/dev/null; then
|
|
found=true
|
|
fi
|
|
|
|
# 方式3: 检查保存的配置文件
|
|
if [[ -f "/etc/hysteria/port-hopping.conf" ]]; then
|
|
source /etc/hysteria/port-hopping.conf 2>/dev/null
|
|
if [[ -n "$IPTABLES_RULE" ]]; then
|
|
# 验证规则是否实际存在
|
|
local rule_parts
|
|
IFS=' ' read -ra rule_parts <<< "$IPTABLES_RULE"
|
|
local check_rule=""
|
|
for part in "${rule_parts[@]}"; do
|
|
if [[ "$part" != "iptables" && "$part" != "-t" && "$part" != "nat" && "$part" != "-A" ]]; then
|
|
check_rule+="$part "
|
|
fi
|
|
done
|
|
if iptables -t nat -C PREROUTING $check_rule 2>/dev/null; then
|
|
found=true
|
|
fi
|
|
fi
|
|
fi
|
|
|
|
# 方式4: 通用检查 - 查找所有 REDIRECT 到目标端口的规则
|
|
if iptables -t nat -S PREROUTING 2>/dev/null | grep -E "REDIRECT.*--to-ports $target_port" >/dev/null; then
|
|
found=true
|
|
fi
|
|
|
|
if $found; then
|
|
return 0 # 已开启
|
|
else
|
|
return 1 # 未开启
|
|
fi
|
|
}
|
|
|
|
# 获取当前端口跳跃配置信息
|
|
get_port_hopping_info() {
|
|
local interface=$(get_network_interface)
|
|
local info=""
|
|
|
|
# 尝试从配置文件获取信息
|
|
if [[ -f "/etc/hysteria/port-hopping.conf" ]]; then
|
|
source /etc/hysteria/port-hopping.conf 2>/dev/null
|
|
if [[ -n "$START_PORT" && -n "$END_PORT" && -n "$TARGET_PORT" ]]; then
|
|
info="端口范围: $START_PORT-$END_PORT -> $TARGET_PORT"
|
|
fi
|
|
fi
|
|
|
|
# 如果配置文件没有信息，尝试从 iptables 规则解析
|
|
if [[ -z "$info" ]]; then
|
|
local target_port=$(get_current_listen_port)
|
|
local rule_info=$(iptables -t nat -L PREROUTING -n 2>/dev/null | grep "REDIRECT.*--to-ports $target_port" | head -1)
|
|
if [[ -n "$rule_info" ]]; then
|
|
# 尝试提取端口范围信息
|
|
if [[ "$rule_info" =~ dpts:([0-9]+):([0-9]+) ]]; then
|
|
local start_port="${BASH_REMATCH[1]}"
|
|
local end_port="${BASH_REMATCH[2]}"
|
|
info="端口范围: $start_port-$end_port -> $target_port"
|
|
elif [[ "$rule_info" =~ dpt:([0-9]+) ]]; then
|
|
local port="${BASH_REMATCH[1]}"
|
|
info="单端口: $port -> $target_port"
|
|
else
|
|
info="检测到端口跳跃规则"
|
|
fi
|
|
fi
|
|
fi
|
|
|
|
echo "$info"
|
|
}
|
|
|
|
# 清除端口跳跃规则
|
|
clear_port_hopping_rules() {
|
|
local cleared=false
|
|
local interface=$(get_network_interface)
|
|
|
|
echo -e "${BLUE}正在清除端口跳跃规则...${NC}"
|
|
|
|
# 方式1: 使用保存的配置文件中的规则
|
|
if [[ -f "/etc/hysteria/port-hopping.conf" ]]; then
|
|
source /etc/hysteria/port-hopping.conf 2>/dev/null
|
|
if [[ -n "$IPTABLES_RULE" ]]; then
|
|
# 将 -A 替换为 -D 来删除规则
|
|
local delete_rule="${IPTABLES_RULE/-A/-D}"
|
|
if eval "$delete_rule" 2>/dev/null; then
|
|
echo "已清除配置文件中记录的规则"
|
|
cleared=true
|
|
fi
|
|
fi
|
|
fi
|
|
|
|
# 方式2: 清除所有到目标端口的REDIRECT规则
|
|
local target_port=$(get_current_listen_port)
|
|
local rules_to_delete=()
|
|
while IFS= read -r line; do
|
|
if [[ "$line" =~ ^-A\ PREROUTING.*REDIRECT.*--to-ports\ $target_port ]]; then
|
|
rules_to_delete+=("${line/-A/-D}")
|
|
fi
|
|
done < <(iptables -t nat -S PREROUTING 2>/dev/null)
|
|
|
|
for rule in "${rules_to_delete[@]}"; do
|
|
if iptables -t nat $rule 2>/dev/null; then
|
|
echo "已清除规则: $rule"
|
|
cleared=true
|
|
fi
|
|
done
|
|
|
|
# 方式3: 通用清理方式（基于行号）
|
|
local line_numbers=($(iptables -t nat -L PREROUTING --line-numbers 2>/dev/null | grep "REDIRECT.*--to-ports $target_port" | awk '{print $1}' | sort -rn))
|
|
for line_num in "${line_numbers[@]}"; do
|
|
if iptables -t nat -D PREROUTING "$line_num" 2>/dev/null; then
|
|
echo "已清除第 $line_num 行规则"
|
|
cleared=true
|
|
fi
|
|
done
|
|
|
|
# 删除配置文件
|
|
if [[ -f "/etc/hysteria/port-hopping.conf" ]]; then
|
|
rm -f "/etc/hysteria/port-hopping.conf"
|
|
echo "已删除端口跳跃配置文件"
|
|
fi
|
|
|
|
if $cleared; then
|
|
echo -e "${GREEN}端口跳跃规则清除成功${NC}"
|
|
else
|
|
echo -e "${YELLOW}没有找到需要清除的端口跳跃规则${NC}"
|
|
fi
|
|
}
|
|
|
|
# 清除所有端口跳跃规则（系统级别）
|
|
clear_all_port_hopping_rules() {
|
|
local cleared=false
|
|
|
|
echo -e "${BLUE}正在清除所有端口跳跃规则...${NC}"
|
|
|
|
# 获取所有REDIRECT规则
|
|
local all_redirect_rules=()
|
|
while IFS= read -r line; do
|
|
if [[ "$line" =~ ^-A\ PREROUTING.*REDIRECT ]]; then
|
|
all_redirect_rules+=("${line/-A/-D}")
|
|
fi
|
|
done < <(iptables -t nat -S PREROUTING 2>/dev/null)
|
|
|
|
# 删除所有REDIRECT规则
|
|
for rule in "${all_redirect_rules[@]}"; do
|
|
if iptables -t nat $rule 2>/dev/null; then
|
|
echo "已清除规则: $rule"
|
|
cleared=true
|
|
fi
|
|
done
|
|
|
|
# 备选方法：按行号删除所有REDIRECT规则
|
|
local line_numbers=($(iptables -t nat -L PREROUTING --line-numbers 2>/dev/null | grep "REDIRECT" | awk '{print $1}' | sort -rn))
|
|
for line_num in "${line_numbers[@]}"; do
|
|
if iptables -t nat -D PREROUTING "$line_num" 2>/dev/null; then
|
|
echo "已清除第 $line_num 行REDIRECT规则"
|
|
cleared=true
|
|
fi
|
|
done
|
|
|
|
# 删除所有相关的配置文件
|
|
if [[ -f "/etc/hysteria/port-hopping.conf" ]]; then
|
|
rm -f "/etc/hysteria/port-hopping.conf"
|
|
echo "已删除端口跳跃配置文件"
|
|
fi
|
|
|
|
if $cleared; then
|
|
echo -e "${GREEN}所有端口跳跃规则清除成功${NC}"
|
|
local remaining_rules=$(iptables -t nat -L PREROUTING -n 2>/dev/null | grep "REDIRECT" | wc -l)
|
|
if [[ $remaining_rules -eq 0 ]]; then
|
|
echo -e "${GREEN}确认：系统中没有剩余的端口重定向规则${NC}"
|
|
else
|
|
echo -e "${YELLOW}警告：系统中还有 $remaining_rules 条端口重定向规则${NC}"
|
|
fi
|
|
else
|
|
echo -e "${YELLOW}没有找到需要清除的端口跳跃规则${NC}"
|
|
fi
|
|
}
|
|
|
|
# 清除指定端口的跳跃规则
|
|
clear_specific_port_rules() {
|
|
local target_port="$1"
|
|
local cleared=false
|
|
|
|
if [[ -z "$target_port" ]]; then
|
|
echo -e "${RED}错误: 未指定目标端口${NC}"
|
|
return 1
|
|
fi
|
|
|
|
echo -e "${BLUE}正在清除指向端口 $target_port 的跳跃规则...${NC}"
|
|
|
|
# 清除指向特定端口的REDIRECT规则
|
|
local rules_to_delete=()
|
|
while IFS= read -r line; do
|
|
if [[ "$line" =~ ^-A\ PREROUTING.*REDIRECT.*--to-ports\ $target_port ]]; then
|
|
rules_to_delete+=("${line/-A/-D}")
|
|
fi
|
|
done < <(iptables -t nat -S PREROUTING 2>/dev/null)
|
|
|
|
for rule in "${rules_to_delete[@]}"; do
|
|
if iptables -t nat $rule 2>/dev/null; then
|
|
echo "已清除规则: $rule"
|
|
cleared=true
|
|
fi
|
|
done
|
|
|
|
# 备选方法：按行号删除
|
|
local line_numbers=($(iptables -t nat -L PREROUTING --line-numbers 2>/dev/null | grep "REDIRECT.*--to-ports $target_port" | awk '{print $1}' | sort -rn))
|
|
for line_num in "${line_numbers[@]}"; do
|
|
if iptables -t nat -D PREROUTING "$line_num" 2>/dev/null; then
|
|
echo "已清除第 $line_num 行规则"
|
|
cleared=true
|
|
fi
|
|
done
|
|
|
|
if $cleared; then
|
|
echo -e "${GREEN}指向端口 $target_port 的跳跃规则清除成功${NC}"
|
|
else
|
|
echo -e "${YELLOW}没有找到指向端口 $target_port 的跳跃规则${NC}"
|
|
fi
|
|
}
|
|
|
|
# 添加端口跳跃规则
|
|
add_port_hopping_rules() {
|
|
local interface=$(get_network_interface)
|
|
local start_port=${1:-20000}
|
|
local end_port=${2:-50000}
|
|
local target_port=${3:-$(get_current_listen_port)}
|
|
|
|
echo -e "${BLUE}正在添加端口跳跃规则...${NC}"
|
|
|
|
# 生成 iptables 规则
|
|
local iptables_rule="iptables -t nat -A PREROUTING -i $interface -p udp --dport $start_port:$end_port -j REDIRECT --to-ports $target_port"
|
|
|
|
if eval "$iptables_rule" 2>/dev/null; then
|
|
echo -e "${GREEN}端口跳跃规则添加成功${NC}"
|
|
echo "规则: $start_port-$end_port -> $target_port (接口: $interface)"
|
|
|
|
# 保存配置到文件
|
|
cat > "/etc/hysteria/port-hopping.conf" << EOF
|
|
# 端口跳跃配置
|
|
# 生成时间: $(date)
|
|
INTERFACE=$interface
|
|
START_PORT=$start_port
|
|
END_PORT=$end_port
|
|
TARGET_PORT=$target_port
|
|
IPTABLES_RULE="$iptables_rule"
|
|
EOF
|
|
echo "配置已保存到: /etc/hysteria/port-hopping.conf"
|
|
return 0
|
|
else
|
|
echo -e "${RED}端口跳跃规则添加失败${NC}"
|
|
echo "请检查 iptables 权限或网络接口设置"
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
# 询问端口跳跃设置
|
|
ask_port_hopping_config() {
|
|
echo -e "${BLUE}检查端口跳跃状态...${NC}"
|
|
|
|
if check_port_hopping_status; then
|
|
local hopping_info=$(get_port_hopping_info)
|
|
echo -e "${GREEN}✅ 端口跳跃已开启${NC}"
|
|
if [[ -n "$hopping_info" ]]; then
|
|
echo " $hopping_info"
|
|
fi
|
|
echo ""
|
|
echo -n -e "${YELLOW}是否保持端口跳跃开启? [Y/n]: ${NC}"
|
|
read -r keep_hopping
|
|
|
|
if [[ $keep_hopping =~ ^[Nn]$ ]]; then
|
|
clear_port_hopping_rules
|
|
else
|
|
echo -e "${GREEN}保持端口跳跃开启${NC}"
|
|
fi
|
|
else
|
|
echo -e "${YELLOW}❌ 端口跳跃未开启${NC}"
|
|
echo ""
|
|
echo -n -e "${YELLOW}是否开启端口跳跃? [y/N]: ${NC}"
|
|
read -r enable_hopping
|
|
|
|
if [[ $enable_hopping =~ ^[Yy]$ ]]; then
|
|
# 询问端口范围
|
|
echo ""
|
|
echo -e "${BLUE}配置端口跳跃范围:${NC}"
|
|
echo -n -e "${BLUE}起始端口 (默认 20000): ${NC}"
|
|
read -r start_port
|
|
start_port=${start_port:-20000}
|
|
|
|
echo -n -e "${BLUE}结束端口 (默认 50000): ${NC}"
|
|
read -r end_port
|
|
end_port=${end_port:-50000}
|
|
|
|
local current_port=$(get_current_listen_port)
|
|
if add_port_hopping_rules "$start_port" "$end_port" "$current_port"; then
|
|
echo -e "${GREEN}端口跳跃配置完成${NC}"
|
|
fi
|
|
else
|
|
echo -e "${BLUE}保持端口跳跃关闭${NC}"
|
|
fi
|
|
fi
|
|
echo ""
|
|
}
|
|
|
|
# 询问是否重启服务
|
|
ask_restart_service() {
|
|
echo ""
|
|
echo -n -e "${YELLOW}配置已完成，是否立即重启 Hysteria2 服务? [Y/n]: ${NC}"
|
|
read -r restart_service
|
|
|
|
if [[ ! $restart_service =~ ^[Nn]$ ]]; then
|
|
echo -e "${BLUE}正在重启 Hysteria2 服务...${NC}"
|
|
systemctl restart hysteria-server
|
|
|
|
sleep 2
|
|
if systemctl is-active --quiet hysteria-server; then
|
|
echo -e "${GREEN}✅ 服务重启成功${NC}"
|
|
else
|
|
echo -e "${RED}❌ 服务重启失败${NC}"
|
|
echo "请检查配置文件或查看日志: journalctl -u hysteria-server.service"
|
|
fi
|
|
else
|
|
echo -e "${YELLOW}请稍后手动重启服务: systemctl restart hysteria-server${NC}"
|
|
fi
|
|
}
|
|
|
|
# 一键快速配置
|
|
quick_setup_hysteria() {
|
|
echo -e "${CYAN}=== Hysteria2 一键快速配置 ===${NC}"
|
|
echo ""
|
|
|
|
# 检查是否已安装
|
|
if ! check_hysteria_installed; then
|
|
echo -e "${RED}错误: Hysteria2 未安装${NC}"
|
|
echo "请先安装 Hysteria2"
|
|
return
|
|
fi
|
|
|
|
# 检查现有配置
|
|
if [[ -f "$CONFIG_PATH" ]]; then
|
|
echo -e "${YELLOW}检测到现有配置文件${NC}"
|
|
echo -n -e "${BLUE}是否覆盖现有配置? [y/N]: ${NC}"
|
|
read -r overwrite
|
|
if [[ ! $overwrite =~ ^[Yy]$ ]]; then
|
|
echo -e "${BLUE}取消配置生成${NC}"
|
|
return
|
|
fi
|
|
|
|
# 备份现有配置
|
|
cp "$CONFIG_PATH" "$CONFIG_PATH.backup.$(date +%Y%m%d_%H%M%S)"
|
|
echo -e "${GREEN}已备份现有配置${NC}"
|
|
fi
|
|
|
|
echo -e "${BLUE}正在执行一键快速配置...${NC}"
|
|
echo ""
|
|
|
|
# 1. 获取服务器信息
|
|
echo -e "${BLUE}步骤 1/7: 获取服务器信息...${NC}"
|
|
local server_ip=$(get_server_ip)
|
|
local network_interface=$(get_network_interface)
|
|
echo "服务器IP: $server_ip"
|
|
echo "网络接口: $network_interface"
|
|
|
|
# 2. 测试最优伪装域名
|
|
echo -e "${BLUE}步骤 2/7: 测试最优伪装域名...${NC}"
|
|
if [[ -f "$SCRIPTS_DIR/domain-test.sh" ]]; then
|
|
source "$SCRIPTS_DIR/domain-test.sh"
|
|
local best_domain=$(get_best_domain_name)
|
|
local masquerade_url="https://$best_domain/"
|
|
echo "最优伪装域名: $best_domain"
|
|
else
|
|
local best_domain="cdn.jsdelivr.net"
|
|
local masquerade_url="https://cdn.jsdelivr.net/"
|
|
echo "使用默认伪装域名: $best_domain"
|
|
fi
|
|
|
|
# 3. 生成密码
|
|
echo -e "${BLUE}步骤 3/7: 生成随机密码...${NC}"
|
|
local auth_password=$(generate_password 16)
|
|
local obfs_password=$(generate_password 16)
|
|
echo "认证密码: $auth_password"
|
|
echo "混淆密码: $obfs_password"
|
|
|
|
# 4. 生成自签名证书
|
|
echo -e "${BLUE}步骤 4/7: 生成自签名证书...${NC}"
|
|
mkdir -p /etc/hysteria
|
|
|
|
openssl req -x509 -nodes -newkey ec:<(openssl ecparam -name prime256v1) \
|
|
-keyout /etc/hysteria/server.key \
|
|
-out /etc/hysteria/server.crt \
|
|
-subj "/CN=$best_domain" \
|
|
-days 3650 &>/dev/null
|
|
|
|
# 设置证书权限
|
|
if id "hysteria" &>/dev/null; then
|
|
chown hysteria:hysteria /etc/hysteria/server.key
|
|
chown hysteria:hysteria /etc/hysteria/server.crt
|
|
fi
|
|
echo "证书生成完成"
|
|
|
|
# 5. 生成配置文件
|
|
echo -e "${BLUE}步骤 5/7: 生成配置文件...${NC}"
|
|
cat > "$CONFIG_PATH" << EOF
|
|
# Hysteria2 配置文件 - 一键快速配置
|
|
# 生成时间: $(date)
|
|
# 服务器IP: $server_ip
|
|
|
|
listen: :443
|
|
|
|
tls:
|
|
cert: /etc/hysteria/server.crt
|
|
key: /etc/hysteria/server.key
|
|
|
|
auth:
|
|
type: password
|
|
password: $auth_password
|
|
|
|
masquerade:
|
|
type: proxy
|
|
proxy:
|
|
url: $masquerade_url
|
|
rewriteHost: true
|
|
|
|
obfs:
|
|
type: salamander
|
|
salamander:
|
|
password: $obfs_password
|
|
EOF
|
|
|
|
# 设置配置文件权限
|
|
if id "hysteria" &>/dev/null; then
|
|
chown hysteria:hysteria "$CONFIG_PATH"
|
|
fi
|
|
chmod 600 "$CONFIG_PATH"
|
|
echo "配置文件生成完成"
|
|
|
|
# 6. 配置端口跳跃
|
|
echo -e "${BLUE}步骤 6/7: 配置端口跳跃...${NC}"
|
|
local start_port=20000
|
|
local end_port=50000
|
|
local target_port=$(get_current_listen_port)
|
|
|
|
if add_port_hopping_rules "$start_port" "$end_port" "$target_port"; then
|
|
echo "端口跳跃配置成功 ($start_port-$end_port -> $target_port)"
|
|
else
|
|
echo "端口跳跃配置失败，跳过此步骤"
|
|
fi
|
|
|
|
# 7. 启动服务
|
|
echo -e "${BLUE}步骤 7/7: 启动服务...${NC}"
|
|
|
|
# 启用并启动服务
|
|
systemctl enable hysteria-server.service &>/dev/null
|
|
if systemctl start hysteria-server.service; then
|
|
sleep 3
|
|
if systemctl is-active --quiet hysteria-server.service; then
|
|
echo -e "${GREEN}服务启动成功!${NC}"
|
|
|
|
# 显示配置信息
|
|
echo ""
|
|
echo -e "${CYAN}=== 一键快速配置完成 ===${NC}"
|
|
echo ""
|
|
echo -e "${YELLOW}配置信息:${NC}"
|
|
echo "服务器地址: $server_ip:443"
|
|
echo "认证密码: $auth_password"
|
|
echo "混淆密码: $obfs_password"
|
|
echo "伪装域名: $best_domain"
|
|
echo "端口跳跃: $start_port-$end_port"
|
|
echo ""
|
|
|
|
# 生成节点信息
|
|
generate_node_info "$server_ip" "$auth_password" "$obfs_password" "$best_domain" "$start_port" "$end_port"
|
|
|
|
else
|
|
echo -e "${RED}服务启动失败${NC}"
|
|
echo "请查看日志: journalctl -u hysteria-server.service"
|
|
fi
|
|
else
|
|
echo -e "${RED}服务启动失败${NC}"
|
|
fi
|
|
|
|
echo ""
|
|
wait_for_user
|
|
}
|
|
|
|
# 生成节点信息
|
|
generate_node_info() {
|
|
local server_ip="$1"
|
|
local auth_password="$2"
|
|
local obfs_password="$3"
|
|
local sni_domain="$4"
|
|
local start_port="$5"
|
|
local end_port="$6"
|
|
|
|
# 检查是否有配置的服务器域名
|
|
local configured_domain=$(get_server_domain)
|
|
local server_address=""
|
|
|
|
if [[ -n "$configured_domain" ]]; then
|
|
server_address="$configured_domain:443"
|
|
echo -e "${GREEN}使用已配置的服务器域名: $configured_domain${NC}"
|
|
else
|
|
server_address="$server_ip:443"
|
|
echo -e "${YELLOW}使用服务器IP地址: $server_ip${NC}"
|
|
fi
|
|
|
|
# 保存节点信息到文件
|
|
local node_file="/etc/hysteria/node-info.txt"
|
|
|
|
cat > "$node_file" << EOF
|
|
# Hysteria2 节点信息
|
|
# 生成时间: $(date)
|
|
|
|
服务器地址: $server_address
|
|
认证密码: $auth_password
|
|
混淆密码: $obfs_password
|
|
SNI域名: $sni_domain
|
|
端口跳跃: $start_port-$end_port
|
|
证书验证: 忽略 (自签名证书)
|
|
|
|
# 客户端配置示例
|
|
server: $server_address
|
|
auth: $auth_password
|
|
tls:
|
|
sni: $sni_domain
|
|
insecure: true
|
|
obfs:
|
|
type: salamander
|
|
salamander:
|
|
password: $obfs_password
|
|
socks5:
|
|
listen: 127.0.0.1:1080
|
|
http:
|
|
listen: 127.0.0.1:8080
|
|
|
|
# 节点链接 (Hysteria2://)
|
|
hysteria2://$auth_password@$server_ip:443?sni=$sni_domain&insecure=1&obfs=salamander&obfs-password=$obfs_password#Hysteria2-QuickSetup
|
|
|
|
# 订阅链接 (Base64编码)
|
|
$(echo "hysteria2://$auth_password@$server_ip:443?sni=$sni_domain&insecure=1&obfs=salamander&obfs-password=$obfs_password#Hysteria2-QuickSetup" | base64 -w 0)
|
|
EOF
|
|
|
|
echo -e "${GREEN}节点信息已保存到: $node_file${NC}"
|
|
}
|
|
|
|
# 主配置生成函数
|
|
generate_hysteria_config() {
|
|
# 检查是否已安装
|
|
if ! check_hysteria_installed; then
|
|
echo -e "${RED}错误: Hysteria2 未安装${NC}"
|
|
echo "请先安装 Hysteria2"
|
|
return
|
|
fi
|
|
|
|
# 检查现有配置
|
|
if [[ -f "$CONFIG_PATH" ]]; then
|
|
echo -e "${YELLOW}检测到现有配置文件${NC}"
|
|
echo -n -e "${BLUE}是否覆盖现有配置? [y/N]: ${NC}"
|
|
read -r overwrite
|
|
if [[ ! $overwrite =~ ^[Yy]$ ]]; then
|
|
echo -e "${BLUE}取消配置生成${NC}"
|
|
return
|
|
fi
|
|
|
|
# 备份现有配置
|
|
cp "$CONFIG_PATH" "$CONFIG_PATH.backup.$(date +%Y%m%d_%H%M%S)"
|
|
echo -e "${GREEN}已备份现有配置${NC}"
|
|
fi
|
|
|
|
echo ""
|
|
echo -e "${BLUE}选择配置模式:${NC}"
|
|
echo ""
|
|
echo -e "${GREEN}1.${NC} ACME 自动证书 (推荐，需要域名)"
|
|
echo -e "${GREEN}2.${NC} 自签名证书 (快速部署，无需域名)"
|
|
echo ""
|
|
echo -n -e "${BLUE}请选择模式 [1-2]: ${NC}"
|
|
read -r config_mode
|
|
|
|
case $config_mode in
|
|
1)
|
|
configure_acme_mode
|
|
;;
|
|
2)
|
|
configure_self_cert_mode
|
|
;;
|
|
*)
|
|
echo -e "${RED}无效选择${NC}"
|
|
return
|
|
;;
|
|
esac
|
|
|
|
# 设置配置文件权限
|
|
if id "hysteria" &>/dev/null; then
|
|
chown hysteria:hysteria "$CONFIG_PATH"
|
|
fi
|
|
chmod 600 "$CONFIG_PATH"
|
|
|
|
echo ""
|
|
echo -e "${GREEN}配置文件已保存到: $CONFIG_PATH${NC}"
|
|
|
|
# 检查端口跳跃状态并询问
|
|
ask_port_hopping_config
|
|
|
|
# 询问是否重启服务
|
|
ask_restart_service
|
|
|
|
echo ""
|
|
echo -e "${YELLOW}其他管理命令:${NC}"
|
|
echo "1. 查看状态: systemctl status hysteria-server.service"
|
|
echo "2. 查看日志: journalctl -u hysteria-server.service"
|
|
|
|
wait_for_user
|
|
}
|