Hermes
88f2ff44aa
设备把自己当 USB 网卡挂给上游主机时会出现 usb0（驱动 configfs-gadget.g1， IP 192.168.68.1）。该链路只通向 PC，被当成出口后所有出站都 context deadline exceeded，客户端看到 socks connect failed rep=0x01。 误选原因：score_iface_as_cellular 给 usb0 与真出口 wwan0 都打 175 分。 usb0 靠名称命中 patterns 里的 usb（+80）与非默认路由（+40）；wwan0 的 bam-dmux 驱动不在白名单里，白丢 +100。detect_cellular_iface 用 -gt 比较， list_ifaces 按名排序让 usb0 先入选，平分下无法被顶替。 改动： - lib.sh 新增 iface_is_usb_gadget()，按驱动名与 gadget 总线路径识别， 并并入 is_virtual_or_skip_iface（usb0 评分 175 -> 0） - 驱动白名单补 bam-dmux/bam_dmux/qcom-ipa/ipa_wan；名称权重 80 -> 40， 确保驱动证据始终压过名称猜测 - 新增 detect_cellular_iface_via_mm()，把 ModemManager bearer 的 interface: 作为第 0 步权威来源 - detect_cellular_iface / resolve_cellular 全链路拒绝 gadget 网卡， 取不到真出口时按 REQUIRE_CELLULAR_IFACE 直接失败而不是绑错 - generate/install/upgrade/watch/detect/verify 各入口独立设闸， verify.sh 发现出口是 gadget 时直接 exit 4 并给出修复命令 - 默认 CELLULAR_IFACE_PATTERNS 去掉 usb/enx；upgrade.sh 与根 install.sh 就地迁移已有 settings.conf，旧机器升级即修复 - 新增 tests/detect-gadget.sh：18 条离线断言，无需真机
419 lines
14 KiB
Bash
Executable File
419 lines
14 KiB
Bash
Executable File
#!/usr/bin/env bash
|
||
# 公共库
|
||
set -euo pipefail
|
||
|
||
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||
CONFIG_FILE="${CONFIG_FILE:-$ROOT_DIR/config/settings.conf}"
|
||
|
||
log() { printf '[%s] %s\n' "$(date '+%F %T')" "$*" >&2; }
|
||
info() { log "INFO $*"; }
|
||
warn() { log "WARN $*"; }
|
||
err() { log "ERROR $*"; }
|
||
die() { err "$*"; exit 1; }
|
||
|
||
need_root() {
|
||
if [[ "${EUID:-$(id -u)}" -ne 0 ]]; then
|
||
die "请用 root 运行（sudo）"
|
||
fi
|
||
}
|
||
|
||
load_config() {
|
||
if [[ ! -f "$CONFIG_FILE" ]]; then
|
||
die "缺少配置: $CONFIG_FILE
|
||
请先: cp $ROOT_DIR/config/settings.conf.example $ROOT_DIR/config/settings.conf"
|
||
fi
|
||
set -a
|
||
# shellcheck disable=SC1090
|
||
source "$CONFIG_FILE"
|
||
set +a
|
||
|
||
INSTALL_DIR="${INSTALL_DIR:-/opt/cellular-proxy}"
|
||
LOG_DIR="${LOG_DIR:-/var/log/cellular-proxy}"
|
||
CELLULAR_IFACE="${CELLULAR_IFACE:-}"
|
||
CELLULAR_SOURCE_IP="${CELLULAR_SOURCE_IP:-}"
|
||
BIND_SOURCE_IP="${BIND_SOURCE_IP:-false}"
|
||
REQUIRE_CELLULAR_IFACE="${REQUIRE_CELLULAR_IFACE:-true}"
|
||
CELLULAR_IFACE_PATTERNS="${CELLULAR_IFACE_PATTERNS:-wwan,wwp,ppp,cdc,rmnet,ccmni,mbim,qmi}"
|
||
ENABLE_CELLULAR_WATCH="${ENABLE_CELLULAR_WATCH:-true}"
|
||
WATCH_INTERVAL_SEC="${WATCH_INTERVAL_SEC:-60}"
|
||
WATCH_MM_EVENTS="${WATCH_MM_EVENTS:-true}"
|
||
WATCH_MM_UNIT="${WATCH_MM_UNIT:-ModemManager}"
|
||
WATCH_MM_SETTLE_SEC="${WATCH_MM_SETTLE_SEC:-5}"
|
||
WATCH_MM_READY_TIMEOUT_SEC="${WATCH_MM_READY_TIMEOUT_SEC:-90}"
|
||
WATCH_MM_READY_POLL_SEC="${WATCH_MM_READY_POLL_SEC:-2}"
|
||
WATCH_MM_COALESCE_SEC="${WATCH_MM_COALESCE_SEC:-20}"
|
||
PROXY_LISTEN_HOST="${PROXY_LISTEN_HOST:-0.0.0.0}"
|
||
PROXY_MIXED_PORT="${PROXY_MIXED_PORT:-7890}"
|
||
PROXY_USER="${PROXY_USER:-}"
|
||
PROXY_PASS="${PROXY_PASS:-}"
|
||
PANEL_LISTEN_HOST="${PANEL_LISTEN_HOST:-0.0.0.0}"
|
||
PANEL_PORT="${PANEL_PORT:-9090}"
|
||
PANEL_SECRET="${PANEL_SECRET:-please-change-me}"
|
||
ENABLE_DNS="${ENABLE_DNS:-true}"
|
||
LOG_LEVEL="${LOG_LEVEL:-warn}"
|
||
SING_BOX_SOURCE="${SING_BOX_SOURCE:-auto}"
|
||
SING_BOX_VERSION="${SING_BOX_VERSION:-1.11.7}"
|
||
SING_BOX_BIN="${SING_BOX_BIN:-}"
|
||
GITEA_BASE="${GITEA_BASE:-https://gitea.chickliu.fun}"
|
||
GITEA_OWNER="${GITEA_OWNER:-Hermes}"
|
||
GITEA_REPO="${GITEA_REPO:-cellular-proxy}"
|
||
SING_BOX_RELEASE_TAG="${SING_BOX_RELEASE_TAG:-bin-v${SING_BOX_VERSION}}"
|
||
GITHUB_PROXY="${GITHUB_PROXY:-https://git.86482425.xyz}"
|
||
MEMORY_MAX_MB="${MEMORY_MAX_MB:-96}"
|
||
EGRESS_CHECK_URL="${EGRESS_CHECK_URL:-https://ifconfig.me}"
|
||
EXPECTED_CELLULAR_PUBLIC_IP="${EXPECTED_CELLULAR_PUBLIC_IP:-}"
|
||
|
||
for v in REQUIRE_CELLULAR_IFACE ENABLE_DNS; do
|
||
val="${!v}"
|
||
case "${val,,}" in
|
||
1|true|yes|on) printf -v "$v" '%s' true ;;
|
||
*) printf -v "$v" '%s' false ;;
|
||
esac
|
||
done
|
||
}
|
||
|
||
iface_exists() {
|
||
local ifc="$1"
|
||
[[ -n "$ifc" ]] && [[ -d "/sys/class/net/$ifc" ]]
|
||
}
|
||
|
||
# 识别「本机当 USB 设备端」的 gadget 网卡（usb0/rndis0 等）。
|
||
# 这类接口是本机 → 上游主机（PC/路由）的下行链路，绑上去所有出站都会失败，
|
||
# sing-box 表现为 open outbound connection: context deadline exceeded，SOCKS 回 rep=0x01。
|
||
# 注意与真正的 USB 上行模组区分：qmi_wwan / cdc_* / rndis_host 是 host 侧驱动，可作出口。
|
||
iface_is_usb_gadget() {
|
||
local ifc="$1" drv dev
|
||
[[ -n "$ifc" ]] || return 1
|
||
drv="$(iface_driver "$ifc" 2>/dev/null || true)"
|
||
case "${drv,,}" in
|
||
configfs-gadget*|g_ether*|g_ncm*|g_ether|g_multi*|g_cdc*|gadget*|usb_f_*)
|
||
return 0
|
||
;;
|
||
esac
|
||
# configfs 组合设备的 device 实体挂在 gadget 总线下
|
||
dev="$(readlink -f "/sys/class/net/$ifc/device" 2>/dev/null || true)"
|
||
if [[ -n "$dev" && "$dev" == *"/gadget"* ]]; then
|
||
return 0
|
||
fi
|
||
if [[ -d "/sys/class/net/$ifc/device" ]]; then
|
||
local sub
|
||
sub="$(readlink -f "/sys/class/net/$ifc/device/subsystem" 2>/dev/null || true)"
|
||
if [[ "$(basename "${sub:-}")" == "gadget" ]]; then
|
||
return 0
|
||
fi
|
||
fi
|
||
return 1
|
||
}
|
||
|
||
is_virtual_or_skip_iface() {
|
||
local name="$1"
|
||
case "$name" in
|
||
lo|docker*|br-*|veth*|virbr*|cni*|flannel*|tun*|tap*|wg*|zt*|tailscale*|easy*|et*|nlmon*|dummy*|ifb*|bond*|team*|macvlan*|ipvlan*)
|
||
return 0
|
||
;;
|
||
esac
|
||
# bridge that is not a physical device
|
||
if [[ -d "/sys/class/net/$name/bridge" ]]; then
|
||
return 0
|
||
fi
|
||
# 本机作为 USB gadget 暴露给上游主机的链路（RNDIS/NCM/ECM），只通向 PC，不是数据出口
|
||
if iface_is_usb_gadget "$name"; then
|
||
return 0
|
||
fi
|
||
return 1
|
||
}
|
||
|
||
list_ifaces() {
|
||
local name state ip
|
||
for name in $(ls /sys/class/net 2>/dev/null | sort); do
|
||
[[ "$name" == "lo" ]] && continue
|
||
state="$(cat "/sys/class/net/$name/operstate" 2>/dev/null || echo unknown)"
|
||
ip="$(ip -4 -o addr show dev "$name" 2>/dev/null | awk '{print $4}' | head -1)"
|
||
printf '%s|%s|%s\n' "$name" "$state" "${ip:-}"
|
||
done
|
||
}
|
||
|
||
detect_default_iface() {
|
||
ip route show default 2>/dev/null | awk '/default/ {print $5; exit}'
|
||
}
|
||
|
||
iface_has_carrier() {
|
||
local ifc="$1" c
|
||
c="$(cat "/sys/class/net/$ifc/carrier" 2>/dev/null || echo 0)"
|
||
[[ "$c" == "1" ]]
|
||
}
|
||
|
||
iface_driver() {
|
||
local ifc="$1" link
|
||
link="$(readlink -f "/sys/class/net/$ifc/device/driver" 2>/dev/null || true)"
|
||
if [[ -n "$link" ]]; then
|
||
basename "$link"
|
||
return
|
||
fi
|
||
# some USB eth put driver under device
|
||
if [[ -f "/sys/class/net/$ifc/device/uevent" ]]; then
|
||
awk -F= '/^DRIVER=/{print $2; exit}' "/sys/class/net/$ifc/device/uevent" 2>/dev/null || true
|
||
fi
|
||
}
|
||
|
||
iface_looks_cellular_by_driver() {
|
||
local ifc="$1" drv
|
||
drv="$(iface_driver "$ifc" || true)"
|
||
# gadget 网卡即使名字像 usb0 也不算蜂窝
|
||
iface_is_usb_gadget "$ifc" && return 1
|
||
case "${drv,,}" in
|
||
qmi_wwan|cdc_mbim|cdc_ncm|cdc_ether|cdc_wdm|option|huawei_cdc_ncm|rndis_host|GobiNet|GobiSerial|simcom*|rmnet*|mhi_net|ipa|bam-dmux|bam_dmux|qcom-ipa|ipa_wan)
|
||
return 0
|
||
;;
|
||
esac
|
||
return 1
|
||
}
|
||
|
||
iface_matches_patterns() {
|
||
local name="$1" p
|
||
# 默认不含 usb/enx：本机的 USB gadget 链路也叫 usb0，靠名字猜会把出口绑到 PC 侧。
|
||
# 真正的 USB 上行模组由 iface_looks_cellular_by_driver（rndis_host/cdc_*/qmi_wwan）识别。
|
||
local patterns="${CELLULAR_IFACE_PATTERNS:-wwan,wwp,ppp,cdc,rmnet,ccmni,mbim,qmi}"
|
||
IFS=',' read -r -a arr <<< "$patterns"
|
||
for p in "${arr[@]}"; do
|
||
p="${p// /}"
|
||
[[ -z "$p" ]] && continue
|
||
if [[ "$name" == *"$p"* ]]; then
|
||
return 0
|
||
fi
|
||
done
|
||
return 1
|
||
}
|
||
|
||
# 最权威的来源：ModemManager 自己报的 bearer 网卡名。
|
||
# 比名称/驱动启发式打分更可靠，能彻底避开 usb0 这类同分误选。
|
||
detect_cellular_iface_via_mm() {
|
||
local m b ifc
|
||
command -v mmcli >/dev/null 2>&1 || return 1
|
||
for m in $(mmcli -L 2>/dev/null | grep -oE 'Modem/[0-9]+' | grep -oE '[0-9]+$'); do
|
||
for b in $(mmcli -m "$m" 2>/dev/null | grep -oE 'Bearer/[0-9]+' | grep -oE '[0-9]+$'); do
|
||
ifc="$(mmcli -b "$b" 2>/dev/null | sed -n 's/.*interface:[[:space:]]*\([A-Za-z0-9._-]\{1,\}\).*/\1/p' | head -1)"
|
||
if [[ -n "$ifc" ]] && iface_exists "$ifc" && ! iface_is_usb_gadget "$ifc"; then
|
||
echo "$ifc"
|
||
return 0
|
||
fi
|
||
done
|
||
done
|
||
return 1
|
||
}
|
||
|
||
# 多默认路由时，metric 更大的往往是数据网（WiFi metric 更小优先）
|
||
detect_secondary_default_iface() {
|
||
local primary secondary
|
||
primary="$(detect_default_iface || true)"
|
||
secondary="$(
|
||
ip route show default 2>/dev/null | awk -v p="$primary" '
|
||
/default/ {
|
||
iface=""; metric=0
|
||
for (i=1;i<=NF;i++) {
|
||
if ($i=="dev") iface=$(i+1)
|
||
if ($i=="metric") metric=$(i+1)+0
|
||
}
|
||
if (iface!="" && iface!=p) {
|
||
print metric, iface
|
||
}
|
||
}
|
||
' | sort -n | awk 'END {print $2}'
|
||
)"
|
||
if [[ -n "$secondary" && "$secondary" != "$primary" ]]; then
|
||
echo "$secondary"
|
||
return 0
|
||
fi
|
||
return 1
|
||
}
|
||
|
||
# 打分选数据网卡（stdout 仅输出网卡名）
|
||
# 更高分优先
|
||
score_iface_as_cellular() {
|
||
local name="$1"
|
||
local default_if="$2"
|
||
local state ip score=0 drv
|
||
|
||
is_virtual_or_skip_iface "$name" && { echo 0; return; }
|
||
state="$(cat "/sys/class/net/$name/operstate" 2>/dev/null || echo unknown)"
|
||
ip="$(ip -4 -o addr show dev "$name" 2>/dev/null | awk '{print $4}' | head -1 | cut -d/ -f1)"
|
||
drv="$(iface_driver "$name" || true)"
|
||
|
||
# 名称（仅启发式，权重必须低于驱动判定，避免 usb0 与 wwan0 打成平手）
|
||
if iface_matches_patterns "$name"; then score=$((score + 40)); fi
|
||
# 驱动（强证据）
|
||
if iface_looks_cellular_by_driver "$name"; then score=$((score + 100)); fi
|
||
# 非默认网卡（关键：系统默认走 WiFi）
|
||
if [[ -n "$default_if" && "$name" != "$default_if" ]]; then score=$((score + 40)); fi
|
||
# 有 IPv4
|
||
if [[ -n "$ip" ]]; then score=$((score + 30)); fi
|
||
# up/carrier
|
||
if [[ "$state" == "up" || "$state" == "unknown" ]]; then score=$((score + 15)); fi
|
||
if iface_has_carrier "$name"; then score=$((score + 10)); fi
|
||
# 默认网卡通常是 WiFi/有线，大幅降权
|
||
if [[ -n "$default_if" && "$name" == "$default_if" ]]; then score=$((score - 60)); fi
|
||
# docker 等已在 skip；再防 enp/eth 当默认时
|
||
case "$name" in
|
||
eth*|enp*|eno*|ens*|wlan*|wlp*|wl*)
|
||
if [[ "$name" == "$default_if" ]]; then score=$((score - 20)); fi
|
||
;;
|
||
esac
|
||
|
||
echo "$score"
|
||
}
|
||
|
||
# 自动探测数据网卡：ModemManager bearer > 配置 > 名称/驱动打分 > 次默认路由 > 非默认有 IP 物理口
|
||
# 任何一步都不允许返回 USB gadget 网卡
|
||
detect_cellular_iface() {
|
||
local configured="${1:-}"
|
||
local default_if name state ip best_name="" best_score=0 score
|
||
|
||
if [[ -n "$configured" ]]; then
|
||
if [[ "$configured" == "lo" ]]; then
|
||
warn "CELLULAR_IFACE=lo 无效，将尝试自动探测"
|
||
elif iface_is_usb_gadget "$configured"; then
|
||
warn "CELLULAR_IFACE=$configured 是本机对上游主机暴露的 USB gadget 网卡，不能作为数据出口，将重新探测"
|
||
elif iface_exists "$configured"; then
|
||
echo "$configured"
|
||
return 0
|
||
else
|
||
warn "配置的 CELLULAR_IFACE=$configured 不存在，将尝试自动探测"
|
||
if [[ "${REQUIRE_CELLULAR_IFACE:-true}" == "true" && -n "${FORCE_CONFIGURED_ONLY:-}" ]]; then
|
||
return 1
|
||
fi
|
||
fi
|
||
fi
|
||
|
||
default_if="$(detect_default_iface || true)"
|
||
|
||
# 0) ModemManager bearer 是权威答案，优先采用
|
||
if name="$(detect_cellular_iface_via_mm 2>/dev/null || true)"; then
|
||
if [[ -n "$name" ]]; then
|
||
info "按 ModemManager bearer 确定数据网卡: $name"
|
||
echo "$name"
|
||
return 0
|
||
fi
|
||
fi
|
||
|
||
# 1) 按评分扫描全部接口
|
||
while IFS='|' read -r name state ip; do
|
||
[[ -z "$name" ]] && continue
|
||
is_virtual_or_skip_iface "$name" && continue
|
||
score="$(score_iface_as_cellular "$name" "$default_if")"
|
||
if [[ "$score" -gt "$best_score" ]]; then
|
||
best_score="$score"
|
||
best_name="$name"
|
||
fi
|
||
done < <(list_ifaces)
|
||
|
||
# 需要足够置信度（避免把唯一的 WiFi 当数据）
|
||
if [[ -n "$best_name" && "$best_score" -ge 70 ]]; then
|
||
info "自动探测数据网卡: $best_name (score=$best_score, default=$default_if, driver=$(iface_driver "$best_name" || true))"
|
||
echo "$best_name"
|
||
return 0
|
||
fi
|
||
|
||
# 2) 多默认路由的次要口
|
||
if name="$(detect_secondary_default_iface 2>/dev/null || true)"; then
|
||
if [[ -n "$name" ]] && iface_exists "$name" && ! iface_is_usb_gadget "$name"; then
|
||
info "根据次要默认路由探测数据网卡: $name"
|
||
echo "$name"
|
||
return 0
|
||
fi
|
||
fi
|
||
|
||
# 3) 任意非默认、有 IPv4、非虚拟
|
||
while IFS='|' read -r name state ip; do
|
||
[[ -z "$name" ]] && continue
|
||
is_virtual_or_skip_iface "$name" && continue
|
||
[[ -z "$ip" ]] && continue
|
||
if [[ -n "$default_if" && "$name" == "$default_if" ]]; then
|
||
continue
|
||
fi
|
||
if [[ "$state" == "up" || "$state" == "unknown" ]]; then
|
||
info "回退选择非默认网卡: $name"
|
||
echo "$name"
|
||
return 0
|
||
fi
|
||
done < <(list_ifaces)
|
||
|
||
if [[ -n "$best_name" && "$best_score" -gt 0 ]]; then
|
||
warn "置信度较低，选用: $best_name (score=$best_score)"
|
||
echo "$best_name"
|
||
return 0
|
||
fi
|
||
|
||
return 1
|
||
}
|
||
|
||
detect_source_ip() {
|
||
local ifc="$1"
|
||
ip -4 -o addr show dev "$ifc" 2>/dev/null | awk '{print $4}' | head -1 | cut -d/ -f1
|
||
}
|
||
|
||
# 把探测结果写回 settings.conf
|
||
persist_cellular_to_settings() {
|
||
local conf="${1:-$CONFIG_FILE}"
|
||
local cell="$2"
|
||
local src_ip="${3:-}"
|
||
[[ -f "$conf" ]] || return 1
|
||
local tmp
|
||
tmp="$(mktemp)"
|
||
awk -v k="CELLULAR_IFACE" -v v="$cell" '
|
||
BEGIN { done=0 }
|
||
index($0, k "=")==1 { print k "=" v; done=1; next }
|
||
{ print }
|
||
END { if (!done) print k "=" v }
|
||
' "$conf" > "$tmp"
|
||
mv "$tmp" "$conf"
|
||
if [[ -n "$src_ip" ]]; then
|
||
tmp="$(mktemp)"
|
||
awk -v k="CELLULAR_SOURCE_IP" -v v="$src_ip" '
|
||
BEGIN { done=0 }
|
||
index($0, k "=")==1 { print k "=" v; done=1; next }
|
||
{ print }
|
||
END { if (!done) print k "=" v }
|
||
' "$conf" > "$tmp"
|
||
mv "$tmp" "$conf"
|
||
fi
|
||
}
|
||
|
||
arch_go() {
|
||
case "$(uname -m)" in
|
||
x86_64|amd64) echo amd64 ;;
|
||
aarch64|arm64) echo arm64 ;;
|
||
armv7l|armhf) echo armv7 ;;
|
||
*) die "不支持的架构: $(uname -m)" ;;
|
||
esac
|
||
}
|
||
|
||
ensure_dirs() {
|
||
mkdir -p "$INSTALL_DIR"/{bin,etc,ui,generated} "$LOG_DIR"
|
||
}
|
||
|
||
resolve_cellular() {
|
||
local cell
|
||
if ! cell="$(detect_cellular_iface "$CELLULAR_IFACE")"; then
|
||
if [[ "$REQUIRE_CELLULAR_IFACE" == "true" ]]; then
|
||
die "无法确定数据网卡。请设置 CELLULAR_IFACE= 或运行 scripts/detect.sh / cpxy detect"
|
||
fi
|
||
warn "未找到数据网卡"
|
||
cell=""
|
||
fi
|
||
# 最后一道闸：探测链路上任何环节都不得交出 gadget 网卡
|
||
if [[ -n "$cell" ]] && iface_is_usb_gadget "$cell"; then
|
||
warn "拒绝把 USB gadget 网卡 $cell 当作数据出口，改问 ModemManager"
|
||
cell="$(detect_cellular_iface_via_mm 2>/dev/null || true)"
|
||
if [[ -z "$cell" ]]; then
|
||
if [[ "$REQUIRE_CELLULAR_IFACE" == "true" ]]; then
|
||
die "唯一候选是 USB gadget 网卡，无法确定数据出口。请设置 CELLULAR_IFACE=wwanX"
|
||
fi
|
||
warn "未找到可用数据网卡"
|
||
cell=""
|
||
else
|
||
info "改用 $cell"
|
||
fi
|
||
fi
|
||
echo "$cell"
|
||
}
|