volmon-node.sh

#!/bin/sh
# =============================================================
#  volmon-node.sh  —  VolMonitor 被控机助手
#  在被控机上安装「受限监控公钥」:该公钥只能触发只读采集脚本,
#  拿不到 shell、禁止端口/agent/X11 转发、不分配 pty,泄露也基本无害。
#  纯 POSIX sh,兼容 Debian/Ubuntu/Alpine/OpenWrt(OpenSSH 与 Dropbear)。
# =============================================================
VER="1.1.1"

umask 077

# ---------- 更新源 ----------
REPO_RAW="${VOLMON_REPO:-https://raw.githubusercontent.com/chnnic/VolMonitor/main}"
SELF_FILE="volmon-node.sh"

# ---------- 颜色 ----------
if [ -t 1 ]; then
  N='\033[0m'; B='\033[1m'; R='\033[31m'; G='\033[32m'; Y='\033[33m'; C='\033[36m'; GR='\033[90m'
else
  N=''; B=''; R=''; G=''; Y=''; C=''; GR=''
fi
say(){ printf '%b\n' "$*"; }
cls(){ [ -t 1 ] && { clear 2>/dev/null || printf '\033[2J\033[3J\033[H'; }; }
pause(){ [ -t 0 ] && { printf '\n%b按回车返回...%b' "$GR" "$N"; read -r _; }; }

# =============================================================
#  只读采集脚本(与主控内嵌版一致;POSIX sh)
# =============================================================
COLLECTOR=$(cat <<'COLLECT'
LC_ALL=C; export LC_ALL
H=$(hostname 2>/dev/null || cat /proc/sys/kernel/hostname 2>/dev/null)
echo "HOST=$H"
echo "TIME=$(date '+%F %T %Z' 2>/dev/null)"
[ -r /proc/uptime ] && echo "UPTIME_S=$(cut -d. -f1 /proc/uptime)"
[ -r /proc/loadavg ] && echo "LOAD=$(cut -d' ' -f1-3 /proc/loadavg)"
CPU=$(grep -c '^processor' /proc/cpuinfo 2>/dev/null)
[ -n "$CPU" ] && [ "$CPU" -gt 0 ] 2>/dev/null && echo "CPU=$CPU"
awk '/^MemTotal/{t=$2}/^MemAvailable/{a=$2}END{if(t>0){printf "MEM_USED_MB=%d\n",(t-a)/1024;printf "MEM_TOTAL_MB=%d\n",t/1024;printf "MEM_PCT=%.0f\n",(t-a)*100/t}}' /proc/meminfo 2>/dev/null
df -h -P / 2>/dev/null | awk 'NR==2{printf "DISK_USED=%s\nDISK_TOTAL=%s\nDISK_PCT=%s\n",$3,$2,$5}'
awk -F: 'NR>2{i=$1;gsub(/[ \t]/,"",i);if(i!="lo"){split($2,a," ");if((a[1]+a[9])>0)printf "NET=%s %s %s\n",i,a[1],a[9]}}' /proc/net/dev 2>/dev/null
if command -v ss >/dev/null 2>&1; then
  E=$(ss -tnH state established 2>/dev/null | wc -l | tr -d ' ')
  [ -n "$E" ] && echo "TCP_EST=$E"
  L=$(ss -tlnH 2>/dev/null | wc -l | tr -d ' ')
  [ -n "$L" ] && echo "TCP_LISTEN=$L"
elif command -v netstat >/dev/null 2>&1; then
  echo "TCP_EST=$(netstat -tn 2>/dev/null | grep -c ESTABLISHED)"
fi
svc_check(){
  if command -v pgrep >/dev/null 2>&1 && pgrep -x "$1" >/dev/null 2>&1; then return 0; fi
  for c in /proc/[0-9]*/comm; do
    [ -r "$c" ] || continue
    [ "$(cat "$c" 2>/dev/null)" = "$1" ] && return 0
  done
  return 1
}
for p in xray sing-box shadowsocks-rust ss-server ss-rust hysteria hysteria2 tuic naive gost mihomo; do
  svc_check "$p" && echo "SVC=$p"
done
exit 0
COLLECT
)

# =============================================================
#  采集脚本落地路径(挑一个可写目录)
# =============================================================
collect_path(){
  for d in /usr/local/bin /usr/bin /opt; do
    if mkdir -p "$d" 2>/dev/null && [ -w "$d" ]; then echo "$d/volmon-collect"; return; fi
  done
  echo "$HOME/.volmon-collect"
}

write_collector(){
  p=$1
  { echo '#!/bin/sh'; printf '%s\n' "$COLLECTOR"; } > "$p" || return 1
  chmod 755 "$p"
}

validate_pubkey(){
  pub=$1; cr=$(printf '\r')
  case "$pub" in
    *'
'*|*"$cr"*) return 1 ;;
  esac
  PUB_TYPE=$(printf '%s\n' "$pub" | awk 'NF>=2{print $1; exit}')
  PUB_BODY=$(printf '%s\n' "$pub" | awk 'NF>=2{print $2; exit}')
  case "$PUB_TYPE" in
    ssh-ed25519|ssh-rsa|ecdsa-sha2-nistp256|ecdsa-sha2-nistp384|ecdsa-sha2-nistp521|sk-ssh-ed25519@openssh.com|sk-ecdsa-sha2-nistp256@openssh.com) ;;
    *) return 1 ;;
  esac
  case "$PUB_BODY" in ''|*[!A-Za-z0-9+/=]*) return 1 ;; esac
  [ "${#PUB_BODY}" -ge 32 ] || return 1
  PUB_NORMALIZED="$PUB_TYPE $PUB_BODY volmon-monitor"
  if command -v ssh-keygen >/dev/null 2>&1; then
    key_tmp=$(mktemp) || return 1
    printf '%s\n' "$PUB_NORMALIZED" > "$key_tmp"
    ssh-keygen -lf "$key_tmp" >/dev/null 2>&1 || { rm -f "$key_tmp"; return 1; }
    rm -f "$key_tmp"
  fi
}

validate_from(){
  from_value=$1
  [ -z "$from_value" ] && return 0
  case "$from_value" in
    ,*|*,|*,,*|*[!0-9A-Fa-f:.,/!-]*) return 1 ;;
  esac
}

volmon_collector_paths(){
  ak="$HOME/.ssh/authorized_keys"
  [ -f "$ak" ] || return 0
  awk '
    match($0, /command="[^"]*\/\.?volmon-collect"/) {
      print substr($0, RSTART+9, RLENGTH-10)
    }
  ' "$ak"
}

remove_recorded_collectors(){
  collector_paths=$1
  while IFS= read -r collector_path; do
    case "$collector_path" in
      /usr/local/bin/volmon-collect|/usr/bin/volmon-collect|/opt/volmon-collect|"$HOME/.volmon-collect") rm -f "$collector_path" 2>/dev/null ;;
    esac
  done <<EOF
$collector_paths
EOF
}

authorized_keys_update(){
  ak_mode=$1; ak_value=${2:-}; sshdir="$HOME/.ssh"; ak="$sshdir/authorized_keys"
  mkdir -p "$sshdir" || return 1
  chmod 700 "$sshdir" || return 1
  [ ! -L "$ak" ] || { say "${R}拒绝改写符号链接: $ak${N}"; return 1; }
  ak_tmp=$(mktemp "$sshdir/.authorized_keys.volmon.XXXXXX") || return 1
  ak_input=/dev/null; [ -f "$ak" ] && ak_input=$ak
  awk -v mode="$ak_mode" -v body="${PUB_BODY:-}" -v from="$ak_value" '
    function is_volmon(line) {
      return line ~ /command="[^"]*\/\.?volmon-collect",no-port-forwarding,no-agent-forwarding,no-x11-forwarding,no-pty[[:space:]]/
    }
    mode=="install" {
      drop=0; for(i=1;i<=NF;i++) if($i==body) drop=1
      if(!drop) print
      next
    }
    mode=="remove" {
      if(is_volmon($0)) found=1; else print
      next
    }
    mode=="set-from" {
      if(is_volmon($0)) {
        found=1
        sub(/^from="[^"]*",/, "")
        if(from!="") print "from=\"" from "\"," $0; else print
      } else print
      next
    }
    END { if(mode=="set-from" && !found) exit 3 }
  ' "$ak_input" > "$ak_tmp"
  ak_rc=$?
  if [ "$ak_rc" = "0" ] && [ "$ak_mode" = "install" ]; then
    printf '%s\n' "$ak_value" >> "$ak_tmp" || ak_rc=1
  fi
  if [ "$ak_rc" != "0" ]; then rm -f "$ak_tmp"; return "$ak_rc"; fi
  chmod 600 "$ak_tmp" || { rm -f "$ak_tmp"; return 1; }
  if [ -f "$ak" ]; then
    [ ! -L "$ak.volmon.bak" ] || { rm -f "$ak_tmp"; say "${R}拒绝覆盖符号链接备份: $ak.volmon.bak${N}"; return 1; }
    cp -p "$ak" "$ak.volmon.bak" || { rm -f "$ak_tmp"; return 1; }
    chmod 600 "$ak.volmon.bak" 2>/dev/null
  fi
  mv "$ak_tmp" "$ak"
}

# =============================================================
#  安装受限公钥
# =============================================================
install_pubkey(){
  pub=$1; from=$2
  validate_pubkey "$pub" || { say "${R}公钥格式或内容无效${N}"; return 1; }
  validate_from "$from" || { say "${R}来源限制只接受 IP、CIDR 或逗号列表${N}"; return 1; }
  cp=$(collect_path)
  if ! write_collector "$cp"; then say "${R}无法写入采集脚本到 $cp${N}"; return 1; fi
  escaped_cp=$(printf '%s' "$cp" | sed 's/\\/\\\\/g; s/"/\\"/g')
  opts="command=\"$escaped_cp\",no-port-forwarding,no-agent-forwarding,no-x11-forwarding,no-pty"
  [ -n "$from" ] && opts="from=\"$from\",$opts"
  authorized_keys_update install "$opts $PUB_NORMALIZED" || { say "${R}写入 authorized_keys 失败,原文件未替换${N}"; return 1; }
  say "${G}已安装受限监控公钥${N}"
  say "  采集脚本: ${C}$cp${N}"
  say "  authorized_keys: ${C}$ak${N}"
  [ -n "$from" ] && say "  来源限制: ${C}from=\"$from\"${N}(仅此 IP 可用此钥)"
  say "  ${GR}该公钥仅能执行只读采集,无 shell / 无转发 / 无 pty${N}"
  say "${GR}主控侧:用对应私钥添加节点即可拉取(host 填本机 DDNS 域名)${N}"
}

# =============================================================
#  本机生成密钥对(打印私钥转交主控)
# =============================================================
gen_key(){
  if ! command -v ssh-keygen >/dev/null 2>&1; then
    say "${R}本机无 ssh-keygen(OpenWrt/Dropbear 常见)。${N}"
    say "${Y}请在主控生成密钥后,用 add 粘贴公钥安装。${N}"
    return 1
  fi
  tmpdir=$(mktemp -d "${TMPDIR:-/tmp}/volmon_key.XXXXXX") || { say "${R}创建临时目录失败${N}"; return 1; }
  chmod 700 "$tmpdir" 2>/dev/null
  tmp="$tmpdir/key"
  ssh-keygen -t ed25519 -N "" -C "volmon-monitor" -f "$tmp" -q || { say "${R}生成失败${N}"; rm -rf "$tmpdir"; return 1; }
  install_pubkey "$(cat "$tmp.pub")" || { rm -rf "$tmpdir"; return 1; }
  echo
  say "${Y}===== 以下私钥请复制到【主控】导入,然后从本机抹除 =====${N}"
  cat "$tmp"
  say "${Y}=========================================================${N}"
  shred -u "$tmp" 2>/dev/null || rm -f "$tmp"
  rm -f "$tmp.pub"; rmdir "$tmpdir" 2>/dev/null
  say "${GR}本机私钥已删除,只保留受限公钥${N}"
}

# =============================================================
#  卸载
# =============================================================
uninstall(){
  collector_paths=$(volmon_collector_paths)
  authorized_keys_update remove || { say "${R}更新 authorized_keys 失败,未执行卸载${N}"; return 1; }
  remove_recorded_collectors "$collector_paths"
  say "${G}已移除受限公钥行与采集脚本${N}"
}

# =============================================================
#  修改 / 查看 受限公钥的来源 IP 限制(from=)
# =============================================================
current_from(){
  ak="$HOME/.ssh/authorized_keys"
  [ -f "$ak" ] || return 1
  awk '
    /command="[^"]*\/\.?volmon-collect",no-port-forwarding,no-agent-forwarding,no-x11-forwarding,no-pty[[:space:]]/ {
      if(match($0, /^from="[^"]*"/)) { value=substr($0, 7, RLENGTH-7); print value }
      exit
    }
  ' "$ak"
}

set_from(){
  newfrom=$1
  validate_from "$newfrom" || { say "${R}来源限制只接受 IP、CIDR 或逗号列表${N}"; return 1; }
  ak="$HOME/.ssh/authorized_keys"
  [ -f "$ak" ] || { say "${R}未找到 $ak${N}"; return 1; }
  authorized_keys_update set-from "$newfrom"
  case "$?" in
    0) ;;
    3) say "${R}未找到已安装的受限公钥,请先用 add 安装${N}"; return 1 ;;
    *) say "${R}更新 authorized_keys 失败,原文件未替换${N}"; return 1 ;;
  esac
  if [ -n "$newfrom" ]; then say "${G}已设置来源限制: from=\"$newfrom\"${N}"
  else say "${G}已移除来源限制(任意 IP 可用此钥)${N}"; fi
}

# =============================================================
#  本机状态
# =============================================================
field(){ printf '%s\n' "$2" | sed -n "s/^$1=//p" | head -1; }
do_local(){
  out=$(printf '%s\n' "$COLLECTOR" | sh)
  host=$(field HOST "$out"); t=$(field TIME "$out")
  up=$(field UPTIME_S "$out"); load=$(field LOAD "$out"); cpu=$(field CPU "$out")
  mu=$(field MEM_USED_MB "$out"); mt=$(field MEM_TOTAL_MB "$out"); mp=$(field MEM_PCT "$out")
  du=$(field DISK_USED "$out"); dt=$(field DISK_TOTAL "$out"); dp=$(field DISK_PCT "$out")
  est=$(field TCP_EST "$out")
  svcs=$(printf '%s\n' "$out" | sed -n 's/^SVC=//p' | tr '\n' ' ')
  read -r rxg txg <<EOF
$(printf '%s\n' "$out" | awk -F'[= ]' '/^NET=/{rx+=$3;tx+=$4}END{printf "%.2f %.2f",rx/1073741824,tx/1073741824}')
EOF
  say "${B}● 本机 ${G}${host}${N}  ${GR}${t}${N}"
  [ -n "$up" ] && say "  运行 $(awk -v s="$up" 'BEGIN{printf "%dd %02dh %02dm",s/86400,s%86400/3600,s%3600/60}')  负载 ${load}  CPU ${cpu}核"
  [ -n "$mt" ] && say "  内存 ${mu}/${mt} MB (${mp}%)   磁盘 ${du}/${dt} (${dp})"
  say "  流量 ↓${rxg}G ↑${txg}G   TCP活动 ${est:-?}"
  [ -n "$svcs" ] && say "  服务 ${G}${svcs}${N}"
  return 0
}

# =============================================================
#  自更新
# =============================================================
self_path(){ readlink -f "$0" 2>/dev/null || echo "$PWD/$(basename "$0")"; }

sha256_file(){
  if command -v sha256sum >/dev/null 2>&1; then
    sha256sum "$1" | awk '{print $1}'
  elif command -v shasum >/dev/null 2>&1; then
    shasum -a 256 "$1" | awk '{print $1}'
  elif command -v openssl >/dev/null 2>&1; then
    openssl dgst -sha256 "$1" | awk '{print $NF}'
  else
    return 1
  fi
}

do_update(){
  expected=${1:-${VOLMON_UPDATE_SHA256:-}}
  url="$REPO_RAW/$SELF_FILE"; self=$(self_path); self_dir=$(dirname "$self")
  if [ -z "$expected" ] && [ -t 0 ]; then
    printf "目标脚本 SHA-256 (从独立可信渠道获取;留空取消): "; read -r expected
  fi
  expected=$(printf '%s' "$expected" | tr 'A-F' 'a-f')
  case "$expected" in
    ""|*[!0-9a-f]*) say "${R}安全更新需要有效的 64 位 SHA-256,已取消${N}"; return 1 ;;
  esac
  [ "${#expected}" = "64" ] || { say "${R}SHA-256 长度必须为 64 位${N}"; return 1; }
  if ! command -v curl >/dev/null 2>&1 && ! command -v wget >/dev/null 2>&1; then
    say "${R}需要 curl 或 wget 才能更新${N}"; return 1
  fi
  command -v sha256sum >/dev/null 2>&1 || command -v shasum >/dev/null 2>&1 || command -v openssl >/dev/null 2>&1 \
    || { say "${R}需要 sha256sum、shasum 或 openssl 才能安全更新${N}"; return 1; }
  tmp=$(mktemp "$self_dir/.${SELF_FILE}.update.XXXXXX") || { say "${R}脚本目录不可写,无法原子更新${N}"; return 1; }
  say "${GR}下载: $url${N}"
  if command -v curl >/dev/null 2>&1; then
    curl -fsSL --max-time 30 "$url" -o "$tmp" || { say "${R}下载失败${N}"; rm -f "$tmp"; return 1; }
  else
    wget -qO "$tmp" "$url" || { say "${R}下载失败${N}"; rm -f "$tmp"; return 1; }
  fi
  head -1 "$tmp" | grep -q '^#!/bin/sh' || { say "${R}下载内容异常(非 POSIX sh 脚本),已放弃${N}"; rm -f "$tmp"; return 1; }
  sh -n "$tmp" 2>/dev/null || { say "${R}远程脚本语法检查未通过,已放弃${N}"; rm -f "$tmp"; return 1; }
  newver=$(sed -n 's/^VER="\([^"]*\)".*/\1/p' "$tmp" | head -1)
  if [ -z "$newver" ] || ! grep -q '^#  volmon-node\.sh' "$tmp"; then
    say "${R}无法确认远程脚本身份,已放弃${N}"; rm -f "$tmp"; return 1
  fi
  actual=$(sha256_file "$tmp") || { say "${R}无法计算 SHA-256${N}"; rm -f "$tmp"; return 1; }
  if [ "$actual" != "$expected" ]; then
    say "${R}SHA-256 不匹配,已放弃${N}"
    printf '  期望: %s\n  实际: %s\n' "$expected" "$actual"
    rm -f "$tmp"
    return 1
  fi
  say "  本地: ${C}v$VER${N}   远程: ${C}v$newver${N}"
  if [ "$newver" = "$VER" ]; then
    printf "已是最新,仍强制覆盖? [y/N]: "; read -r yn
    case "$yn" in y|Y) : ;; *) rm -f "$tmp"; say "已取消"; return ;; esac
  else
    printf "更新到 v%s? [Y/n]: " "$newver"; read -r yn
    case "$yn" in n|N) rm -f "$tmp"; say "已取消"; return ;; esac
  fi
  [ ! -L "$self.bak" ] || { say "${R}拒绝覆盖符号链接备份: $self.bak${N}"; rm -f "$tmp"; return 1; }
  cp -p "$self" "$self.bak" 2>/dev/null \
    || { say "${R}备份旧版失败,已取消更新${N}"; rm -f "$tmp"; return 1; }
  say "${GR}已备份旧版: $self.bak${N}"
  chmod +x "$tmp" 2>/dev/null
  if mv "$tmp" "$self" 2>/dev/null; then
    say "${G}已更新到 v$newver${N}"
    if [ -t 0 ] && [ -t 1 ]; then
      say "${GR}正在以新版本重新启动...${N}"; sleep 1
      exec "$self"
    fi
    say "${GR}请重新运行脚本${N}"; exit 0
  else
    say "${R}原子替换失败;下载文件保留在 $tmp${N}"; return 1
  fi
}

# =============================================================
#  菜单
# =============================================================
menu_group(){ say ""; say "  ${GR}── $1${N}"; }
menu_item(){
  key=$1; label=$2; hint=${3:-}
  printf '  %b%-6s%b %s' "$B$C" "$key" "$N" "$label"
  [ -n "$hint" ] && printf ' %b- %s%b' "$GR" "$hint" "$N"
  printf '\n'
}
menu_prompt(){ printf '%b选择命令%b > ' "$B" "$N"; }

menu(){
  while :; do
    cls
    say "${C}  ────────────────────────────────────────${N}"
    say "${B}${C}  VolMonitor 被控机助手${N}   ${GR}v${VER}${N}"
    say "${GR}  安装受限监控公钥 · 被控端零常驻${N}"
    say "${C}  ────────────────────────────────────────${N}"
    menu_group "安装"
    menu_item "1/a" "粘贴主控公钥并安装" "推荐,私钥不离开主控"
    menu_item "2/g" "本机生成密钥对" "打印私钥转交主控"
    menu_group "维护"
    menu_item "3/s" "查看本机状态"
    menu_item "4/r" "卸载受限公钥与采集脚本"
    menu_item "5/f" "修改来源 IP 限制" "from="
    menu_item "6/u" "检查更新"
    menu_item "0/q" "退出"
    echo
    menu_prompt; read -r ch
    case "$ch" in
      1|a|A)
        say "${GR}粘贴主控的【公钥】单行内容(ssh-ed25519 AAAA... 形式):${N}"
        read -r pub
        [ -z "$pub" ] && { say "取消"; pause; continue; }
        printf "限制来源 IP(主控IP,可逗号分隔多个;留空=不限制): "; read -r fip
        install_pubkey "$pub" "$fip"; pause ;;
      2|g|G) gen_key; pause ;;
      3|s|S) do_local; pause ;;
      4|r|R) uninstall; pause ;;
      5|f|F)
        cur=$(current_from)
        say "当前来源限制: ${C}${cur:-无(任意IP)}${N}"
        printf "新的来源 IP(主控IP/CIDR/逗号列表;输入 no 取消限制;回车放弃修改): "; read -r nf
        case "$nf" in
          "") say "未修改" ;;
          no|NO|none) set_from "" ;;
          *) set_from "$nf" ;;
        esac
        pause ;;
      6|u|U) do_update; pause ;;
      0|q|Q) exit 0 ;;
      *) say "${R}无效选择${N}"; pause ;;
    esac
  done
}

# =============================================================
#  入口
# =============================================================
if [ "${VOLMON_SOURCE_ONLY:-0}" = "1" ]; then
  # shellcheck disable=SC2317
  return 0 2>/dev/null || exit 0
fi

case "${1:-}" in
  add)
    # add "公钥" ["来源IP"]
    if [ -n "$2" ]; then install_pubkey "$2" "$3"
    else
      say "${GR}粘贴主控的公钥(单行)后回车:${N}"; read -r pub
      printf "限制来源 IP(主控IP,留空=不限制): "; read -r fip
      install_pubkey "$pub" "$fip"
    fi ;;
  gen|generate) gen_key ;;
  status|local) do_local ;;
  remove|uninstall) uninstall ;;
  setip|from)
    # setip [IP]  ;  setip no 取消限制
    case "${2:-}" in
      "") cur=$(current_from); printf "当前: %s\n新来源 IP(no=取消): " "${cur:-无}"; read -r nf
          case "$nf" in ""|no|NO|none) set_from "" ;; *) set_from "$nf" ;; esac ;;
      no|NO|none) set_from "" ;;
      *) set_from "$2" ;;
    esac ;;
  update|upgrade) do_update "${2:-}" ;;
  ""|menu) menu ;;
  -h|--help|help)
    echo "用法: $0 [add [\"公钥\"] [\"来源IP\"]|gen|status|setip [IP]|remove|update [SHA256]|menu]"
    echo "  add [公钥] [IP]   安装受限公钥;给 IP 则用 from= 限制仅该 IP 可用"
    echo "  gen          本机生成密钥对并安装受限公钥,打印私钥给主控"
    echo "  status       查看本机状态"
    echo "  setip [IP]   修改来源 IP 限制(无参数交互;IP=no 取消限制)"
    echo "  remove       卸载受限公钥与采集脚本"
    echo "  update [SHA256] 从 GitHub 更新并校验目标脚本 SHA-256"
    echo "  无参数        进入交互菜单" ;;
  *) echo "未知命令: $1 (用 $0 --help)"; exit 1 ;;
esac