#!/bin/sh /etc/rc.common

START=95
USE_PROCD=1
PROG=/usr/local/bin/sing-box
CONFIG=/etc/sing-box/config.json
DNSMASQ_CONF=/etc/dnsmasq-proxy.conf

# ====== SS 配置 (改这里, restart 生效) ======
SS_SERVER="<your-ss-domain-or-ip>"
SS_PORT="<port>"
SS_PASSWORD="<password>"
SS_METHOD="aes-256-gcm"
# ==========================================

boot() { start; }

start_service() {
    # 优先解析 SS 域名，失败则干净退出，等下回 start
    SS_IP="$SS_SERVER"
    case "$SS_SERVER" in
        [0-9]*.[0-9]*.[0-9]*.[0-9]*) ;;
        *) SS_IP=$(nslookup "$SS_SERVER" 223.5.5.5 2>/dev/null | grep "Address: [0-9]" | awk "{print \$NF}" | head -1) ;;
    esac
    case "$SS_IP" in
        [0-9]*.[0-9]*.[0-9]*.[0-9]*) ;;
        *) echo "$(date) start aborted: nslookup $SS_SERVER failed" >> /tmp/sing-box.log; return 1 ;;
    esac

    mkdir -p /var/cache/sing-box
    ip link del tun0 2>/dev/null
    sleep 1

    WAN_IP=$(ip addr show br-wan | grep "inet " | awk "{print \$2}" | cut -d/ -f1)
    DNS_IPS=$(grep "server=/" $DNSMASQ_CONF | awk -F/ "{print \$NF}" | sort -u)

    sed -i "/\"server\":/{ /dns/! s|\"server\": *\"[^\"]*\"|\"server\": \"$SS_IP\"| }" $CONFIG
    sed -i "s|\"server_port\": [0-9]*|\"server_port\": $SS_PORT|" $CONFIG
    sed -i "s|\"password\": *\"[^\"]*\"|\"password\": \"$SS_PASSWORD\"|" $CONFIG
    sed -i "s|\"method\": *\"[^\"]*\"|\"method\": \"$SS_METHOD\"|" $CONFIG

    sed -i "/^listen-address=/d" $DNSMASQ_CONF
    sed -i "1i listen-address=127.0.0.1\nlisten-address=${WAN_IP}" $DNSMASQ_CONF
    sed -i "s/^server=[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}$/server=10.10.10.2/" $DNSMASQ_CONF

    while ip rule del priority 8999 2>/dev/null; do :; done
    for ip in 223.5.5.5 ${SS_IP} ${DNS_IPS}; do
        [ -n "$ip" ] && ip rule add to ${ip}/32 table main priority 8999
    done

    killall dnsmasq 2>/dev/null
    sleep 1
    dnsmasq -C $DNSMASQ_CONF

    rm -f /etc/resolv.conf
    echo "nameserver 127.0.0.1" > /etc/resolv.conf

    procd_open_instance
    procd_set_param command /bin/sh -c "$PROG run -c $CONFIG > /tmp/sing-box.log 2>&1"
    procd_set_param respawn
    procd_close_instance
}

stop_service() {
    ip link del tun0 2>/dev/null
    while ip rule del priority 8999 2>/dev/null; do :; done

    sed -i "s/^server=10\.10\.10\.2$/server=223.5.5.5/" $DNSMASQ_CONF
    killall dnsmasq 2>/dev/null
    sleep 1
    dnsmasq -C $DNSMASQ_CONF

    rm -f /etc/resolv.conf
    echo "nameserver 127.0.0.1" > /etc/resolv.conf
}

#!/bin/sh
GEOIP_URL="https://raw.githubusercontent.com/SagerNet/sing-geoip/rule-set/geoip-cn.srs"
GEOSITE_URL="https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-cn.srs"
DST="/etc/sing-box"

wget -q --timeout=15 -O "$DST/geoip-cn.srs.new" "$GEOIP_URL" 2>/dev/null && \
    [ -s "$DST/geoip-cn.srs.new" ] && mv "$DST/geoip-cn.srs.new" "$DST/geoip-cn.srs"

wget -q --timeout=15 -O "$DST/geosite-cn.srs.new" "$GEOSITE_URL" 2>/dev/null && \
    [ -s "$DST/geosite-cn.srs.new" ] && mv "$DST/geosite-cn.srs.new" "$DST/geosite-cn.srs"

/etc/init.d/sing-box restart 2>/dev/null

#!/bin/sh
# MIPS (ramips/mt7621) 透明代理一键部署
# 旁路由模式, 流量进出 br-wan

SS_SERVER="<your-ss-server>"
SS_PORT="<port>"
SS_PASSWORD="<password>"
SS_METHOD="aes-256-gcm"
SING_BOX_VER="1.11.9"
SING_ARCH="linux-mipsle-softfloat"
TUN_ADDR="10.10.10.1/30"
WAN_IF="br-wan"

set -e
echo "========================================"
echo " MIPS 透明代理部署"
echo " sing-box ${SING_BOX_VER} ${SING_ARCH}"
echo "========================================"

echo "[1/8] 内核模块..."
apk add kmod-tun kmod-nf-tproxy kmod-nft-tproxy 2>&1 | tail -1
modprobe tun nf_tproxy nft_tproxy 2>/dev/null

echo "[2/8] sing-box..."
mkdir -p /usr/local/bin /var/cache/sing-box /etc/sing-box
if [ -x /usr/local/bin/sing-box ]; then
    echo "  已安装"
else
    URL="https://github.com/SagerNet/sing-box/releases/download/v${SING_BOX_VER}/sing-box-${SING_BOX_VER}-${SING_ARCH}.tar.gz"
    wget -q --timeout=30 -O /tmp/sb.tar.gz "$URL" || {
        echo "下载失败! 手动下载 $URL"
        exit 1
    }
    cd /tmp && tar xzf sb.tar.gz && cp sing-box-*/sing-box /usr/local/bin/
    chmod 755 /usr/local/bin/sing-box
    rm -rf /tmp/sb.tar.gz /tmp/sing-box-*
fi

echo "[3/8] geo 规则..."
for f in geoip-cn.srs geosite-cn.srs; do
    repo="sing-geoip"; [ "$f" = "geosite-cn.srs" ] && repo="sing-geosite"
    wget -q --timeout=15 -O /etc/sing-box/$f \
      "https://raw.githubusercontent.com/SagerNet/${repo}/rule-set/${f}" 2>/dev/null
done

echo "[4/8] 配置..."
WAN_IP=$(ip addr show $WAN_IF | grep "inet " | awk '{print $2}' | cut -d/ -f1)
cat > /etc/sing-box/config.json << EOF
{"log":{"level":"info","timestamp":true},"dns":{"servers":[{"tag":"dns-direct","address":"223.5.5.5","detour":"direct"},{"tag":"dns-remote","address":"tcp://8.8.8.8","detour":"ss-out"}],"rules":[{"rule_set":"geosite-cn","server":"dns-direct"}],"final":"dns-remote","strategy":"ipv4_only"},"inbounds":[{"type":"tun","tag":"tun-in","interface_name":"tun0","mtu":1500,"address":["${TUN_ADDR}"],"auto_route":true,"strict_route":true,"sniff":true,"sniff_override_destination":false}],"outbounds":[{"type":"dns","tag":"dns-out"},{"type":"shadowsocks","tag":"ss-out","server":"${SS_SERVER}","server_port":${SS_PORT},"password":"${SS_PASSWORD}","method":"${SS_METHOD}"},{"type":"direct","tag":"direct"}],"route":{"rule_set":[{"tag":"geoip-cn","type":"local","format":"binary","path":"/etc/sing-box/geoip-cn.srs"},{"tag":"geosite-cn","type":"local","format":"binary","path":"/etc/sing-box/geosite-cn.srs"}],"rules":[{"protocol":"dns","outbound":"dns-out"},{"ip_is_private":true,"outbound":"direct"},{"rule_set":"geoip-cn","outbound":"direct"},{"rule_set":"geosite-cn","outbound":"direct"}],"final":"ss-out","auto_detect_interface":true},"experimental":{"cache_file":{"enabled":false}}}
EOF

echo "[5/8] init 脚本..."
# 使用第七步中的完整 init 脚本，不再内嵌重复

echo "[6/8] geo 更新..."
cat > /usr/local/bin/update-geo.sh << 'SCRIPT'
#!/bin/sh
for f in geoip-cn.srs geosite-cn.srs; do
    repo="sing-geoip"; [ "$f" = "geosite-cn.srs" ] && repo="sing-geosite"
    wget -q --timeout=15 -O "/etc/sing-box/$f.new" \
      "https://raw.githubusercontent.com/SagerNet/${repo}/rule-set/${f}" && \
      [ -s "/etc/sing-box/$f.new" ] && mv "/etc/sing-box/$f.new" "/etc/sing-box/$f"
done
/etc/init.d/sing-box restart 2>/dev/null
SCRIPT
chmod 755 /usr/local/bin/update-geo.sh
grep -q update-geo /etc/crontabs/root 2>/dev/null || \
  echo "17 03 * * * /usr/local/bin/update-geo.sh" >> /etc/crontabs/root

echo "[7/8] IP 转发..."
echo 1 > /proc/sys/net/ipv4/ip_forward
grep -q ip_forward /etc/sysctl.conf 2>/dev/null || echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf

echo "[8/8] 启动..."
/etc/init.d/dnsmasq disable 2>/dev/null; rm -f /etc/rc.d/S*dnsmasq*
/etc/init.d/sing-box enable 2>/dev/null
killall sing-box dnsmasq 2>/dev/null; ip link del tun0 2>/dev/null; sleep 1
/etc/init.d/sing-box start 2>&1; sleep 3

echo ""
echo "========================================"
echo " 部署完成"
echo " sing-box: $(pgrep sing-box|xargs)  dnsmasq: $(pgrep dnsmasq|xargs)"
echo " TUN: $(ip addr show tun0 2>/dev/null|grep 'inet '|awk '{print $2}')"
echo " 客户端: 网关+DNS = $(ip addr show br-wan|grep 'inet '|awk '{print $2}'|cut -d/ -f1)"
echo "========================================"

#!/bin/sh
# 透明代理故障诊断脚本
# 用法: sh /root/troubleshoot.sh

echo "========================================"
echo " 透明代理诊断报告"
echo " 时间: $(date)"
echo "========================================"

ERRORS=0

check() {
    local desc="$1"
    local cmd="$2"
    printf "%-50s" "  $desc..."
    if eval "$cmd" > /dev/null 2>&1; then
        echo "✓"
    else
        echo "✗ 故障"
        ERRORS=$((ERRORS + 1))
    fi
}

info() {
    local desc="$1"
    local cmd="$2"
    echo ""
    echo "--- $desc ---"
    eval "$cmd" 2>&1
}

echo ""
echo "【1】基础连通性"
check "本机默认路由" "ip route show | grep -q default"
info "路由表" "ip route show | grep -E 'default|br-wan|tun0'"

echo ""
echo "【2】进程状态"
check "sing-box 运行中" "pgrep sing-box > /dev/null 2>&1"
check "dnsmasq 运行中" "pgrep dnsmasq > /dev/null 2>&1"
info "进程详情" "ps | grep -E 'sing-box|dnsmasq' | grep -v grep"

echo ""
echo "【3】端口监听"
check "DNS 53 端口" "netstat -tlnp 2>/dev/null | grep -q ':53 '"

echo ""
echo "【4】TUN 接口"
check "tun0 存在" "ip link show tun0 > /dev/null 2>&1"
info "TUN 详情" "ip addr show tun0 2>&1"

echo ""
echo "【5】路由规则"
check "bypass 规则存在" "ip rule show 2>&1 | grep -q '8999'"
info "策略路由" "ip rule show 2>&1 | grep -E '8999|2022|2023|2024'"

echo ""
echo "【6】DNS 解析"
info "百度 (应返回国内IP)" "nslookup www.baidu.com 127.0.0.1 2>&1 | grep -E 'Address: [0-9]+\.'"
info "Google (应返回海外IP)" "nslookup www.google.com 127.0.0.1 2>&1 | grep -E 'Address: [0-9]+\.'"

echo ""
echo "【7】sing-box 日志 (最近 20 行)"
if which logread > /dev/null 2>&1; then
    logread -e sing-box | tail -20
elif [ -f /tmp/sing-box.log ]; then
    tail -20 /tmp/sing-box.log
fi

echo ""
echo "【8】IP 转发"
info "转发状态" "cat /proc/sys/net/ipv4/ip_forward"

echo ""
echo "【9】磁盘空间"
info "空间" "df -h /"

echo ""
echo "========================================"
if [ $ERRORS -eq 0 ]; then
    echo " 诊断结果: 全部通过 ✓"
else
    echo " 诊断结果: $ERRORS 项异常, 请检查上方 ✗ 项"
fi
echo ""
echo " 快速修复: /etc/init.d/sing-box restart"
echo "========================================"