shadowsocks-all.sh

fudyou

1. #!/bin/bash
   
2. #
   
3. # https://github.com/Nyr/openvpn-install
   0 j# @/ o" B: g0 G4 o. S0 `7 |" }. n
4. #
   
5. # Copyright (c) 2013 Nyr. Released under the MIT License.
   
6. 
   
7. 
   3 O& b! `. \; D- j
8. # Detect Debian users running the script with "sh" instead of bash
   
9. if readlink /proc/$$/exe | grep -q "dash"; then
   6 [0 r/ X  d, p7 Q. I# P: o# b
10.         echo 'This installer needs to be run with "bash", not "sh".'
    
11.         exit
    + v2 D7 w1 ^3 h, z9 c1 F2 C$ l
12. fi
    
13. 
    
14. # Discard stdin. Needed when running from an one-liner which includes a newline
    
15. read -N 999999 -t 0.001
    5 W! E4 [2 H8 V: e% k
16. 
      @$ W: t+ B5 O: |$ q
17. # Detect OpenVZ 6
    % J' Y6 @* S5 {9 h- g
18. if [[ $(uname -r | cut -d "." -f 1) -eq 2 ]]; then
    3 g- U; G2 Z' m  a+ k, Q2 X
19.         echo "The system is running an old kernel, which is incompatible with this installer."
    
20.         exit
    . y1 C1 K6 C1 E, Z4 [; B1 L+ _
21. fi
    ! z% P  c5 `2 b& e+ _3 d! I/ @
22. 
    
23. # Detect OS
    
24. # $os_version variables aren't always in use, but are kept here for convenience
    
25. if grep -qs "ubuntu" /etc/os-release; then
    $ @6 v3 U' m! p, U
26.         os="ubuntu"
    
27.         os_version=$(grep 'VERSION_ID' /etc/os-release | cut -d '"' -f 2 | tr -d '.')
    . x, \3 M4 H0 |  [0 W
28.         group_name="nogroup"
    3 I5 E4 h' B( B. F( |
29. elif [[ -e /etc/debian_version ]]; then
    * ~  [5 t# b! L2 R
30.         os="debian"
    
31.         os_version=$(grep -oE '[0-9]+' /etc/debian_version | head -1)
    6 H8 h* l8 g( b' i9 \5 T3 a
32.         group_name="nogroup"
    
33. elif [[ -e /etc/almalinux-release || -e /etc/rocky-release || -e /etc/centos-release ]]; then
    
34.         os="centos"
    & z6 f; F( f2 N( ~9 I/ r2 k
35.         os_version=$(grep -shoE '[0-9]+' /etc/almalinux-release /etc/rocky-release /etc/centos-release | head -1)
    % c" ~" I/ d1 }' B$ p" {
36.         group_name="nobody"
    8 x5 h. m* A: M; W7 _) T" {3 z
37. elif [[ -e /etc/fedora-release ]]; then
    
38.         os="fedora"
    
39.         os_version=$(grep -oE '[0-9]+' /etc/fedora-release | head -1)
    " z+ I4 i- S9 U! t6 p
40.         group_name="nobody"
    " `1 f) ?3 J2 r$ t( b
41. else
    
42.         echo "This installer seems to be running on an unsupported distribution.
    $ J  s5 M2 ?! z9 Q& a9 ?
43. Supported distros are Ubuntu, Debian, AlmaLinux, Rocky Linux, CentOS and Fedora."
    5 @: w0 R& S3 [, r6 w' M# F1 e. v
44.         exit
    * K+ ^0 t% @5 E9 K
45. fi
    3 W: R! V" @  e$ W( x5 ?
46. 
    
47. if [[ "$os" == "ubuntu" && "$os_version" -lt 1804 ]]; then
    
48.         echo "Ubuntu 18.04 or higher is required to use this installer.
    
49. This version of Ubuntu is too old and unsupported."
    
50.         exit
    
51. fi
    2 f7 O# r+ s0 _9 \+ J, j7 O
52. 
    
53. if [[ "$os" == "debian" && "$os_version" -lt 9 ]]; then
    
54.         echo "Debian 9 or higher is required to use this installer.
    
55. This version of Debian is too old and unsupported."
    
56.         exit
    ! [/ D/ [3 c- O- n" e$ k6 ~
57. fi
    
58. 
    4 q: v6 D2 L1 Z, R
59. if [[ "$os" == "centos" && "$os_version" -lt 7 ]]; then
      R- o- S" M! T' Z7 B8 |! p: a
60.         echo "CentOS 7 or higher is required to use this installer.
    
61. This version of CentOS is too old and unsupported."
    . ^& V. J  ]* N- F. R
62.         exit
      F8 W6 Y1 `, N4 a4 Q$ [7 C
63. fi
    
64. 
    
65. # Detect environments where $PATH does not include the sbin directories
    " d  B, W, K3 @
66. if ! grep -q sbin <<< "$PATH"; then
    
67.         echo '$PATH does not include sbin. Try using "su -" instead of "su".'
    % X& B+ a$ \- u1 c6 f
68.         exit
    
69. fi
    0 Q" q: @( l2 }& e
70. 
    
71. if [[ "$EUID" -ne 0 ]]; then
    
72.         echo "This installer needs to be run with superuser privileges."
    7 w9 m9 P' h. L
73.         exit
    , `. |% O, e7 U7 e2 X
74. fi
    % X  [: r7 k; i5 R
75. 
    
76. if [[ ! -e /dev/net/tun ]] || ! ( exec 7<>/dev/net/tun ) 2>/dev/null; then
    
77.         echo "The system does not have the TUN device available.
    
78. TUN needs to be enabled before running this installer."
    
79.         exit
    ) {4 d! D, Z* n: L1 ^8 u
80. fi
    , `4 G4 B  x1 @
81. 
    
82. new_client () {
    
83.         # Generates the custom client.ovpn
    
84.         {
    
85.         cat /etc/openvpn/server/client-common.txt
    0 T* y4 O  z" F. a, j! L/ s
86.         echo "<ca>"
    
87.         cat /etc/openvpn/server/easy-rsa/pki/ca.crt
    
88.         echo "</ca>"
    : d! n) }. Z4 i! \! f  {) c* ~* e
89.         echo "<cert>"
    
90.         sed -ne '/BEGIN CERTIFICATE/,$ p' /etc/openvpn/server/easy-rsa/pki/issued/"$client".crt
    
91.         echo "</cert>"
    
92.         echo "<key>"
    
93.         cat /etc/openvpn/server/easy-rsa/pki/private/"$client".key
    
94.         echo "</key>"
    1 ~% |- T0 T1 Y- [
95.         echo "<tls-crypt>"
    
96.         sed -ne '/BEGIN OpenVPN Static key/,$ p' /etc/openvpn/server/tc.key
    7 \- B) ^7 L0 v4 H8 R
97.         echo "</tls-crypt>"
    
98.         } > ~/"$client".ovpn
    ; x" Y  S3 z1 l7 A
99. }
    ' E6 u- D" R  F5 v, J
100. 
     
101. if [[ ! -e /etc/openvpn/server/server.conf ]]; then
     
102.         # Detect some Debian minimal setups where neither wget nor curl are installed
     , ~9 d( M' O# W7 J
103.         if ! hash wget 2>/dev/null && ! hash curl 2>/dev/null; then
     ; K& W9 F" I3 x- v0 C' N. v
104.                 echo "Wget is required to use this installer."
     - K$ `8 m; s. D! r# m9 }2 X
105.                 read -n1 -r -p "Press any key to install Wget and continue..."
     
106.                 apt-get update
     & J4 Q, Q7 K& u. P3 B2 J
107.                 apt-get install -y wget
     ( T2 P* [. J8 ^% R" @# E3 v
108.         fi
     
109.         clear
     5 q% L! F3 Z% w1 ^6 c
110.         echo 'Welcome to this OpenVPN road warrior installer!'
     
111.         # If system has a single IPv4, it is selected automatically. Else, ask the user
     
112.         if [[ $(ip -4 addr | grep inet | grep -vEc '127(\.[0-9]{1,3}){3}') -eq 1 ]]; then
     / R+ I* Q! w) @$ x( a! k
113.                 ip=$(ip -4 addr | grep inet | grep -vE '127(\.[0-9]{1,3}){3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}')
     
114.         else
     - L# V  _+ C3 e8 H
115.                 number_of_ip=$(ip -4 addr | grep inet | grep -vEc '127(\.[0-9]{1,3}){3}')
     
116.                 echo
     
117.                 echo "Which IPv4 address should be used?"
     
118.                 ip -4 addr | grep inet | grep -vE '127(\.[0-9]{1,3}){3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | nl -s ') '
     
119.                 read -p "IPv4 address [1]: " ip_number
     & O- v& F8 b$ v1 V5 I; E7 }. W3 H
120.                 until [[ -z "$ip_number" || "$ip_number" =~ ^[0-9]+$ && "$ip_number" -le "$number_of_ip" ]]; do
     $ e' e  E3 M. @% w4 v7 i8 T1 q; V
121.                         echo "$ip_number: invalid selection."
     " u) q0 h' K- E* s$ a7 T: M. ~+ V
122.                         read -p "IPv4 address [1]: " ip_number
     
123.                 done
     ( C4 u& @3 Y1 X) W, z" [4 C/ t+ f
124.                 [[ -z "$ip_number" ]] && ip_number="1"
     
125.                 ip=$(ip -4 addr | grep inet | grep -vE '127(\.[0-9]{1,3}){3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | sed -n "$ip_number"p)
       P' C. F  C  `% L
126.         fi
     * W. c. M& M# ^  m; F* s+ I$ P
127.         # If $ip is a private IP address, the server must be behind NAT
     
128.         if echo "$ip" | grep -qE '^(10\.|172\.1[6789]\.|172\.2[0-9]\.|172\.3[01]\.|192\.168)'; then
     
129.                 echo
     
130.                 echo "This server is behind NAT. What is the public IPv4 address or hostname?"
     ; ]/ @  c  F! ^8 q1 {, {3 \
131.                 # Get public IP and sanitize with grep
     
132.                 get_public_ip=$(grep -m 1 -oE '^[0-9]{1,3}(\.[0-9]{1,3}){3}$' <<< "$(wget -T 10 -t 1 -4qO- "http://ip1.dynupdate.no-ip.com/" || curl -m 10 -4Ls "http://ip1.dynupdate.no-ip.com/")")
     ; K/ {) C: w' x+ B+ ~1 O: \
133.                 read -p "Public IPv4 address / hostname [$get_public_ip]: " public_ip
       J; L! P4 I/ i- Q4 h
134.                 # If the checkip service is unavailable and user didn't provide input, ask again
     
135.                 until [[ -n "$get_public_ip" || -n "$public_ip" ]]; do
     
136.                         echo "Invalid input."
     7 H% }. Z( {' r5 H9 X, @7 A1 G. r
137.                         read -p "Public IPv4 address / hostname: " public_ip
     
138.                 done
     - [8 P5 G/ [  l5 `+ ~$ v8 U& B
139.                 [[ -z "$public_ip" ]] && public_ip="$get_public_ip"
     7 h/ {% G0 }! A5 K
140.         fi
     7 r1 C* `7 g9 U% i! x5 T
141.         # If system has a single IPv6, it is selected automatically
     6 d; v+ O$ f# B; R0 A) z3 d( @
142.         if [[ $(ip -6 addr | grep -c 'inet6 [23]') -eq 1 ]]; then
     # p, r3 v. d* J; l
143.                 ip6=$(ip -6 addr | grep 'inet6 [23]' | cut -d '/' -f 1 | grep -oE '([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}')
     5 t$ s7 S3 p+ W
144.         fi
     8 Y# x) v, h) ?1 f* c" J1 d
145.         # If system has multiple IPv6, ask the user to select one
     . A* c& y/ _& U" O& x# d9 h! e
146.         if [[ $(ip -6 addr | grep -c 'inet6 [23]') -gt 1 ]]; then
     
147.                 number_of_ip6=$(ip -6 addr | grep -c 'inet6 [23]')
     ( Q; t$ \5 J: K
148.                 echo
     + y" A* M; l; P- j: b% U
149.                 echo "Which IPv6 address should be used?"
     
150.                 ip -6 addr | grep 'inet6 [23]' | cut -d '/' -f 1 | grep -oE '([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}' | nl -s ') '
     # V. [% ]; Z% r! n3 f
151.                 read -p "IPv6 address [1]: " ip6_number
     - b& }8 W4 ?0 P8 R
152.                 until [[ -z "$ip6_number" || "$ip6_number" =~ ^[0-9]+$ && "$ip6_number" -le "$number_of_ip6" ]]; do
     9 l, p# j. I  m. J7 B& l; K
153.                         echo "$ip6_number: invalid selection."
     
154.                         read -p "IPv6 address [1]: " ip6_number
     
155.                 done
     1 h- p4 Q& x, A: X
156.                 [[ -z "$ip6_number" ]] && ip6_number="1"
     ' [. s& ]! ^. K
157.                 ip6=$(ip -6 addr | grep 'inet6 [23]' | cut -d '/' -f 1 | grep -oE '([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}' | sed -n "$ip6_number"p)
     4 L4 T% c3 ?0 h% Z
158.         fi
     ; i% H6 s- u5 d6 w+ M2 D6 Y
159.         echo
     " ]2 v) j8 C- j- e( K+ E' D
160.         echo "Which protocol should OpenVPN use?"
     
161.         echo "   1) UDP (recommended)"
     
162.         echo "   2) TCP"
     
163.         read -p "Protocol [1]: " protocol
     
164.         until [[ -z "$protocol" || "$protocol" =~ ^[12]$ ]]; do
     
165.                 echo "$protocol: invalid selection."
     
166.                 read -p "Protocol [1]: " protocol
     1 i" \9 m7 K& K( d9 L- O
167.         done
     
168.         case "$protocol" in
     
169.                 1|"")
     ; T% P( F+ w, K; I0 R: y# i3 l1 f
170.                 protocol=udp
     
171.                 ;;
     % u' T* I- ?# _1 Z, _2 a; |' c. S2 u
172.                 2)
     
173.                 protocol=tcp
     
174.                 ;;
     1 }2 g) ]' G' b# D+ ~2 z- |
175.         esac
     6 A/ _: I# e; [' v
176.         echo
     & p  B) K) ?6 n: Z6 u
177.         echo "What port should OpenVPN listen to?"
     / B6 J6 d% p8 X& r& L8 {2 U
178.         read -p "Port [1194]: " port
     
179.         until [[ -z "$port" || "$port" =~ ^[0-9]+$ && "$port" -le 65535 ]]; do
     
180.                 echo "$port: invalid port."
     & {' h0 H. D# O$ H$ Q1 l$ M; q7 {  H
181.                 read -p "Port [1194]: " port
     
182.         done
     
183.         [[ -z "$port" ]] && port="1194"
     
184.         echo
     
185.         echo "Select a DNS server for the clients:"
     * b) g. }) Y) q* N1 n. |: S
186.         echo "   1) Current system resolvers"
     
187.         echo "   2) Google"
     
188.         echo "   3) 1.1.1.1"
     
189.         echo "   4) OpenDNS"
     
190.         echo "   5) Quad9"
     # V, C/ H' V# Q) \' k' s" s9 l
191.         echo "   6) AdGuard"
     
192.         read -p "DNS server [1]: " dns
     + K# o% i. W1 N
193.         until [[ -z "$dns" || "$dns" =~ ^[1-6]$ ]]; do
     6 Y/ _) K: U9 ~7 E& [  @& W  C2 n
194.                 echo "$dns: invalid selection."
     3 a* ?9 c1 X2 U$ `: w
195.                 read -p "DNS server [1]: " dns
     1 i1 h7 v. ~- R9 E; }6 @# `
196.         done
     8 N0 {3 z' |& [4 e8 Z
197.         echo
     ) v$ p1 L7 `2 t
198.         echo "Enter a name for the first client:"
     
199.         read -p "Name [client]: " unsanitized_client
     
200.         # Allow a limited set of characters to avoid conflicts
     
201.         client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
     
202.         [[ -z "$client" ]] && client="client"
     4 W% [8 e- E2 i5 m1 u% M
203.         echo
     " c; ^4 i7 t5 p+ Q0 }- {) Z
204.         echo "OpenVPN installation is ready to begin."
     4 d) \9 ]2 G* D( t2 ~  Q
205.         # Install a firewall if firewalld or iptables are not already available
     
206.         if ! systemctl is-active --quiet firewalld.service && ! hash iptables 2>/dev/null; then
     ; d, O0 X' W9 C8 ]; q
207.                 if [[ "$os" == "centos" || "$os" == "fedora" ]]; then
     5 w& O; c6 T/ X! x  ~
208.                         firewall="firewalld"
     ) J1 d: t6 ?* h* e6 J& R
209.                         # We don't want to silently enable firewalld, so we give a subtle warning
     
210.                         # If the user continues, firewalld will be installed and enabled during setup
     . V: d9 _  g, \7 ^+ T
211.                         echo "firewalld, which is required to manage routing tables, will also be installed."
     2 q4 l& y. H2 L) Z5 \
212.                 elif [[ "$os" == "debian" || "$os" == "ubuntu" ]]; then
     
213.                         # iptables is way less invasive than firewalld so no warning is given
     , r6 v6 d/ Y  {( a6 n
214.                         firewall="iptables"
     0 H4 X: _/ a( l- T. c3 e' v
215.                 fi
     4 t( ?3 j0 b8 E$ w
216.         fi
     
217.         read -n1 -r -p "Press any key to continue..."
     ; t7 v8 w; f! a6 m# r
218.         # If running inside a container, disable LimitNPROC to prevent conflicts
     + y! C9 Y/ t* R3 R8 X# _- b
219.         if systemd-detect-virt -cq; then
     3 d5 T5 C/ s0 k$ Q& p" W  {
220.                 mkdir /etc/systemd/system/openvpn-server@server.service.d/ 2>/dev/null
     
221.                 echo "[Service]
     
222. LimitNPROC=infinity" > /etc/systemd/system/openvpn-server@server.service.d/disable-limitnproc.conf
     
223.         fi
       d- ^; ]7 p& B9 y) s# T4 U
224.         if [[ "$os" = "debian" || "$os" = "ubuntu" ]]; then
     ; X+ B0 Q8 w' p7 g( K$ [
225.                 apt-get update
     9 |. O. m" k2 x! Q3 X+ J" S) D
226.                 apt-get install -y openvpn openssl ca-certificates $firewall
     
227.         elif [[ "$os" = "centos" ]]; then
     
228.                 yum install -y epel-release
     " a0 p& f  Z+ e& A
229.                 yum install -y openvpn openssl ca-certificates tar $firewall
     2 j+ |0 |) |# `6 k
230.         else
     # p) j5 a/ ?' ~7 A0 v# Y
231.                 # Else, OS must be Fedora
     
232.                 dnf install -y openvpn openssl ca-certificates tar $firewall
     5 ?5 `$ W* }: x: K2 y% b
233.         fi
     
234.         # If firewalld was just installed, enable it
     
235.         if [[ "$firewall" == "firewalld" ]]; then
     
236.                 systemctl enable --now firewalld.service
     $ Y2 n5 L9 X2 a
237.         fi
     ) @- }- d6 m( O
238.         # Get easy-rsa
     
239.         easy_rsa_url='https://github.com/OpenVPN/easy-rsa/releases/download/v3.1.0/EasyRSA-3.1.0.tgz'
     
240.         mkdir -p /etc/openvpn/server/easy-rsa/
     
241.         { wget -qO- "$easy_rsa_url" 2>/dev/null || curl -sL "$easy_rsa_url" ; } | tar xz -C /etc/openvpn/server/easy-rsa/ --strip-components 1
     
242.         chown -R root:root /etc/openvpn/server/easy-rsa/
     
243.         cd /etc/openvpn/server/easy-rsa/
     
244.         # Create the PKI, set up the CA and the server and client certificates
     8 V! g8 |( u6 C- i& M: T3 o* I4 ?4 G/ V
245.         ./easyrsa init-pki
     
246.         ./easyrsa --batch build-ca nopass
     1 R, I* R% z7 {- D8 B
247.         EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-server-full server nopass
     ) m  i7 x: {# r3 @6 {. q
248.         EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full "$client" nopass
     1 \* ?  [4 G/ Z" n& t5 O
249.         EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
     
250.         # Move the stuff we need
     7 a+ v) t) e$ y5 }
251.         cp pki/ca.crt pki/private/ca.key pki/issued/server.crt pki/private/server.key pki/crl.pem /etc/openvpn/server
     1 J% i( v) t5 C( P  X: V
252.         # CRL is read with each client connection, while OpenVPN is dropped to nobody
     8 b2 u! I3 T0 Y% \, T
253.         chown nobody:"$group_name" /etc/openvpn/server/crl.pem
     
254.         # Without +x in the directory, OpenVPN can't run a stat() on the CRL file
     
255.         chmod o+x /etc/openvpn/server/
     1 M' K2 A6 Z8 |, d( v
256.         # Generate key for tls-crypt
     $ G, b; k5 U# b( s' e
257.         openvpn --genkey --secret /etc/openvpn/server/tc.key
     
258.         # Create the DH parameters file using the predefined ffdhe2048 group
     
259.         echo '-----BEGIN DH PARAMETERS-----
     
260. MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
     ( b/ `' }0 [$ b9 d2 W! m" h
261. +8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
     
262. 87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
     3 H& Z/ Y1 v  u; P& ?
263. YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
     6 _$ R) g% P2 A- G
264. 7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD
     
265. ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg==
     
266. -----END DH PARAMETERS-----' > /etc/openvpn/server/dh.pem
     
267.         # Generate server.conf
     + \! S0 i- A  T) u  J2 c; X
268.         echo "local $ip
     
269. port $port
     
270. proto $protocol
     
271. dev tun
     . I6 T0 d6 \+ |, a
272. ca ca.crt
     
273. cert server.crt
     
274. key server.key
     % ~9 v! a  V. E! a! @, X* g4 Z7 f$ `
275. dh dh.pem
     
276. auth SHA512
     
277. tls-crypt tc.key
     
278. topology subnet
     4 e/ h+ p3 \0 L7 T  J
279. server 10.8.0.0 255.255.255.0" > /etc/openvpn/server/server.conf
     
280.         # IPv6
     
281.         if [[ -z "$ip6" ]]; then
     $ C- A- b% y. ^
282.                 echo 'push "redirect-gateway def1 bypass-dhcp"' >> /etc/openvpn/server/server.conf
     3 M4 |) B$ r# h
283.         else
     0 q  l% G1 N( B8 S  S
284.                 echo 'server-ipv6 fddd:1194:1194:1194::/64' >> /etc/openvpn/server/server.conf
     
285.                 echo 'push "redirect-gateway def1 ipv6 bypass-dhcp"' >> /etc/openvpn/server/server.conf
     
286.         fi
     
287.         echo 'ifconfig-pool-persist ipp.txt' >> /etc/openvpn/server/server.conf
     ) Y/ A5 z! |1 F+ g- ^& [# F
288.         # DNS
     
289.         case "$dns" in
     
290.                 1|"")
     
291.                         # Locate the proper resolv.conf
     ( O9 Z) m7 o2 ^5 n2 a1 Q
292.                         # Needed for systems running systemd-resolved
     & l3 W' c4 z8 O& u
293.                         if grep -q '^nameserver 127.0.0.53' "/etc/resolv.conf"; then
     
294.                                 resolv_conf="/run/systemd/resolve/resolv.conf"
     
295.                         else
     ; s& q- R" L; E+ \# d5 }
296.                                 resolv_conf="/etc/resolv.conf"
     6 T0 I1 _) p8 E* l- F0 h
297.                         fi
     
298.                         # Obtain the resolvers from resolv.conf and use them for OpenVPN
     
299.                         grep -v '^#\|^;' "$resolv_conf" | grep '^nameserver' | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | while read line; do
     
300.                                 echo "push "dhcp-option DNS $line"" >> /etc/openvpn/server/server.conf
     
301.                         done
     
302.                 ;;
     7 b, ~( U. u, T6 p, y
303.                 2)
     
304.                         echo 'push "dhcp-option DNS 8.8.8.8"' >> /etc/openvpn/server/server.conf
     ; B! T% t, D0 h6 |* I
305.                         echo 'push "dhcp-option DNS 8.8.4.4"' >> /etc/openvpn/server/server.conf
     
306.                 ;;
     9 X+ t( ]2 [/ k, k5 B2 n
307.                 3)
     5 o1 V- w# ?/ v- N) Y
308.                         echo 'push "dhcp-option DNS 1.1.1.1"' >> /etc/openvpn/server/server.conf
     1 n1 G7 ?# x! o2 G+ b; v
309.                         echo 'push "dhcp-option DNS 1.0.0.1"' >> /etc/openvpn/server/server.conf
     " [: D% T2 x4 B- _( ?: |
310.                 ;;
     
311.                 4)
     
312.                         echo 'push "dhcp-option DNS 208.67.222.222"' >> /etc/openvpn/server/server.conf
     . S, ^% ?- ?0 ~- c5 W" p
313.                         echo 'push "dhcp-option DNS 208.67.220.220"' >> /etc/openvpn/server/server.conf
     ' B2 b" \4 A+ a
314.                 ;;
     2 P" X+ M7 A# ?( f7 C6 s
315.                 5)
     
316.                         echo 'push "dhcp-option DNS 9.9.9.9"' >> /etc/openvpn/server/server.conf
     : B  d( F. b! W/ o
317.                         echo 'push "dhcp-option DNS 149.112.112.112"' >> /etc/openvpn/server/server.conf
     
318.                 ;;
     / z1 a1 k. |% Z7 ?2 d: {6 P0 ~
319.                 6)
     ' C( M1 @* z; G) D4 F8 _7 ^4 u, N
320.                         echo 'push "dhcp-option DNS 94.140.14.14"' >> /etc/openvpn/server/server.conf
     
321.                         echo 'push "dhcp-option DNS 94.140.15.15"' >> /etc/openvpn/server/server.conf
     
322.                 ;;
     % p0 t( i% \  u- |
323.         esac
     
324.         echo "keepalive 10 120
     
325. cipher AES-256-CBC
     
326. user nobody
     " z& q& p5 r& q$ t* R4 s
327. group $group_name
     % H" v; H9 o9 w
328. persist-key
     0 N% ^7 ~9 [2 `$ J( S5 o1 n( O
329. persist-tun
     * y* V( ]- N, {* s; y% k
330. verb 3
     , t3 ^3 Y* Y' V5 |- M& D2 h- }
331. crl-verify crl.pem" >> /etc/openvpn/server/server.conf
     ) `5 ?; Y  j9 h4 M. _
332.         if [[ "$protocol" = "udp" ]]; then
     # k( \) C/ w; {
333.                 echo "explicit-exit-notify" >> /etc/openvpn/server/server.conf
     2 H8 l/ u! y8 B; X4 n+ g' k
334.         fi
     
335.         # Enable net.ipv4.ip_forward for the system
     6 e$ B, ^0 z# \4 @7 g
336.         echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/99-openvpn-forward.conf
     9 A: O! \" r4 u. q2 x
337.         # Enable without waiting for a reboot or service restart
     
338.         echo 1 > /proc/sys/net/ipv4/ip_forward
     
339.         if [[ -n "$ip6" ]]; then
     4 C4 {6 z0 u1 y$ B& }, L) [, Q  x
340.                 # Enable net.ipv6.conf.all.forwarding for the system
     ' r; h, |2 P5 `! f
341.                 echo "net.ipv6.conf.all.forwarding=1" >> /etc/sysctl.d/99-openvpn-forward.conf
     
342.                 # Enable without waiting for a reboot or service restart
     
343.                 echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
     
344.         fi
     % H/ }+ r# r. O% u! r
345.         if systemctl is-active --quiet firewalld.service; then
     
346.                 # Using both permanent and not permanent rules to avoid a firewalld
     * n1 r" `& f# g9 M
347.                 # reload.
     2 i. l! T; K( O" L
348.                 # We don't use --add-service=openvpn because that would only work with
     
349.                 # the default port and protocol.
     ' }9 @( @: |2 S- [
350.                 firewall-cmd --add-port="$port"/"$protocol"
     . ?: w! a; v. T! q/ q1 U5 b
351.                 firewall-cmd --zone=trusted --add-source=10.8.0.0/24
     5 ]+ d$ d: x/ |: \
352.                 firewall-cmd --permanent --add-port="$port"/"$protocol"
     2 V/ R: K4 M( ~+ x
353.                 firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24
     
354.                 # Set NAT for the VPN subnet
     
355.                 firewall-cmd --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
     
356.                 firewall-cmd --permanent --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
     
357.                 if [[ -n "$ip6" ]]; then
     , Z2 A& q- m$ n, G5 u  ?" {
358.                         firewall-cmd --zone=trusted --add-source=fddd:1194:1194:1194::/64
     
359.                         firewall-cmd --permanent --zone=trusted --add-source=fddd:1194:1194:1194::/64
     : u) P. W6 Y: p" i
360.                         firewall-cmd --direct --add-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
     
361.                         firewall-cmd --permanent --direct --add-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
     1 ]5 j; Y; y7 X& S( ?8 q
362.                 fi
     * C1 \, V3 t2 w0 r" M( E  |; q8 O
363.         else
     
364.                 # Create a service to set up persistent iptables rules
     9 `# U& P% G, O. j, G
365.                 iptables_path=$(command -v iptables)
     
366.                 ip6tables_path=$(command -v ip6tables)
     : }5 O, J( Q: e  m/ {
367.                 # nf_tables is not available as standard in OVZ kernels. So use iptables-legacy
     ) }8 G0 {$ r% ]1 c1 k/ V. c
368.                 # if we are in OVZ, with a nf_tables backend and iptables-legacy is available.
     
369.                 if [[ $(systemd-detect-virt) == "openvz" ]] && readlink -f "$(command -v iptables)" | grep -q "nft" && hash iptables-legacy 2>/dev/null; then
     6 E* Y. t/ s% ?, i4 ?( @) G
370.                         iptables_path=$(command -v iptables-legacy)
     
371.                         ip6tables_path=$(command -v ip6tables-legacy)
     
372.                 fi
     5 e6 w6 X- x9 h* @% B
373.                 echo "[Unit]
     
374. Before=network.target
     
375. [Service]
     
376. Type=oneshot
     9 [0 U6 X  |" t' k. ?$ \6 H6 W
377. ExecStart=$iptables_path -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $ip
     / S6 f5 U# k) g5 |( j0 C
378. ExecStart=$iptables_path -I INPUT -p $protocol --dport $port -j ACCEPT
     
379. ExecStart=$iptables_path -I FORWARD -s 10.8.0.0/24 -j ACCEPT
     
380. ExecStart=$iptables_path -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
     
381. ExecStop=$iptables_path -t nat -D POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $ip
     7 P2 D$ \/ k0 U( I, p* C+ ?1 X
382. ExecStop=$iptables_path -D INPUT -p $protocol --dport $port -j ACCEPT
     
383. ExecStop=$iptables_path -D FORWARD -s 10.8.0.0/24 -j ACCEPT
     
384. ExecStop=$iptables_path -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" > /etc/systemd/system/openvpn-iptables.service
     - o0 N  F) e8 e, {" m  _* q) T
385.                 if [[ -n "$ip6" ]]; then
     0 X. N3 i9 t' x* |8 {4 N' J
386.                         echo "ExecStart=$ip6tables_path -t nat -A POSTROUTING -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to $ip6
     
387. ExecStart=$ip6tables_path -I FORWARD -s fddd:1194:1194:1194::/64 -j ACCEPT
     & J" I/ H1 m& P. z$ n1 g. a; R9 r
388. ExecStart=$ip6tables_path -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
     & t+ o! z& f$ {$ K
389. ExecStop=$ip6tables_path -t nat -D POSTROUTING -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to $ip6
     
390. ExecStop=$ip6tables_path -D FORWARD -s fddd:1194:1194:1194::/64 -j ACCEPT
     + J$ n8 v% ^* j7 w4 y1 Z$ F5 r5 V
391. ExecStop=$ip6tables_path -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" >> /etc/systemd/system/openvpn-iptables.service
     & y' p. M! q3 h  S2 ^
392.                 fi
     ! A9 l$ b1 P+ e" p: n5 @1 D
393.                 echo "RemainAfterExit=yes
     + ]6 ~$ T5 q& @0 C# x0 C0 v
394. [Install]
     ! v9 K8 V' X' x3 \
395. WantedBy=multi-user.target" >> /etc/systemd/system/openvpn-iptables.service
     
396.                 systemctl enable --now openvpn-iptables.service
     8 w( s  N0 D; G8 u2 S& ^* }
397.         fi
     
398.         # If SELinux is enabled and a custom port was selected, we need this
     3 x/ Q4 _: J) P5 {
399.         if sestatus 2>/dev/null | grep "Current mode" | grep -q "enforcing" && [[ "$port" != 1194 ]]; then
     + f' S& C% Q0 D% V0 l$ h2 _5 G
400.                 # Install semanage if not already present
     ' A& ?7 o) {+ I' ?
401.                 if ! hash semanage 2>/dev/null; then
     
402.                         if [[ "$os_version" -eq 7 ]]; then
     
403.                                 # Centos 7
     & ^( H" u5 q1 t* }) |' A
404.                                 yum install -y policycoreutils-python
     
405.                         else
     
406.                                 # CentOS 8 or Fedora
     
407.                                 dnf install -y policycoreutils-python-utils
     
408.                         fi
     7 }1 \. K' R' B
409.                 fi
     
410.                 semanage port -a -t openvpn_port_t -p "$protocol" "$port"
     
411.         fi
     8 M% w; T- ~9 ~) @7 T2 \
412.         # If the server is behind NAT, use the correct IP address
     
413.         [[ -n "$public_ip" ]] && ip="$public_ip"
     
414.         # client-common.txt is created so we have a template to add further users later
     
415.         echo "client
     
416. dev tun
     & w& }, x% n, R7 M
417. proto $protocol
     ! ]4 X: W: j+ R- x' h: o
418. remote $ip $port
     % L5 x$ G5 y3 F2 \6 T4 g' d
419. resolv-retry infinite
     
420. nobind
     6 i* \$ ]0 j# A5 E0 f
421. persist-key
     7 C6 z, c- d6 }/ f- `
422. persist-tun
     
423. remote-cert-tls server
     2 n' m4 g' {& ]/ Q
424. auth SHA512
     
425. cipher AES-256-CBC
     - y0 }8 w4 O" I, e. q4 i& }) V
426. ignore-unknown-option block-outside-dns
     
427. block-outside-dns
     
428. verb 3" > /etc/openvpn/server/client-common.txt
     
429.         # Enable and start the OpenVPN service
     + ?, d4 {' z6 ?3 j
430.         systemctl enable --now openvpn-server@server.service
     ' z2 p& o. m  l) q/ X, H: N
431.         # Generates the custom client.ovpn
     
432.         new_client
     1 j$ Q0 l! [2 K2 q& z' c
433.         echo
     
434.         echo "Finished!"
     
435.         echo
     
436.         echo "The client configuration is available in:" ~/"$client.ovpn"
     
437.         echo "New clients can be added by running this script again."
     
438. else
     
439.         clear
     
440.         echo "OpenVPN is already installed."
     4 F1 z* t& [: g
441.         echo
     0 |% f) o; i( B
442.         echo "Select an option:"
     
443.         echo "   1) Add a new client"
     
444.         echo "   2) Revoke an existing client"
     
445.         echo "   3) Remove OpenVPN"
     
446.         echo "   4) Exit"
     . d* E, G" `8 ^
447.         read -p "Option: " option
     
448.         until [[ "$option" =~ ^[1-4]$ ]]; do
     / {& n5 f5 y2 e+ h6 V: W
449.                 echo "$option: invalid selection."
     # x% L4 g7 O$ _) T. Q1 C# ~3 c: V, L8 Z
450.                 read -p "Option: " option
     ' E6 F+ |" n/ j
451.         done
     / I& m6 H" V) X+ y/ v( {/ u
452.         case "$option" in
     
453.                 1)
     , @5 N9 @) m7 W: s) v8 p
454.                         echo
     
455.                         echo "Provide a name for the client:"
     
456.                         read -p "Name: " unsanitized_client
     
457.                         client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
     & M; m' Z' z, r6 m! Q
458.                         while [[ -z "$client" || -e /etc/openvpn/server/easy-rsa/pki/issued/"$client".crt ]]; do
     # ?7 G' M7 f9 F/ a0 B
459.                                 echo "$client: invalid name."
     
460.                                 read -p "Name: " unsanitized_client
     
461.                                 client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
     
462.                         done
     & A) S" S3 o9 d8 z; c% s+ ^7 B
463.                         cd /etc/openvpn/server/easy-rsa/
     
464.                         EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full "$client" nopass
     
465.                         # Generates the custom client.ovpn
     
466.                         new_client
     
467.                         echo
     9 L! g) B, H7 F' H( L
468.                         echo "$client added. Configuration available in:" ~/"$client.ovpn"
     ) Y( C0 `( a! Z2 ~6 D# ]$ U& W- ~' q
469.                         exit
     
470.                 ;;
     
471.                 2)
     
472.                         # This option could be documented a bit better and maybe even be simplified
       o& H. [# Q- o8 s5 c+ B( g) X
473.                         # ...but what can I say, I want some sleep too
     * k* ?- _$ Q, ^  W3 N
474.                         number_of_clients=$(tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep -c "^V")
     " _$ u' {. y( ~: Y, z
475.                         if [[ "$number_of_clients" = 0 ]]; then
     # C, H+ G, o$ }3 v( P/ C7 w5 c
476.                                 echo
     
477.                                 echo "There are no existing clients!"
     
478.                                 exit
     9 M; J4 n7 {* B  C+ p7 g. L
479.                         fi
     
480.                         echo
     / H: a- a% \/ ]" C5 A) v& [
481.                         echo "Select the client to revoke:"
     * E; D, |/ B  V8 @3 D4 J
482.                         tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | nl -s ') '
     4 W9 l' W5 p, M; [* t
483.                         read -p "Client: " client_number
     
484.                         until [[ "$client_number" =~ ^[0-9]+$ && "$client_number" -le "$number_of_clients" ]]; do
     
485.                                 echo "$client_number: invalid selection."
     
486.                                 read -p "Client: " client_number
     : J- J9 F) b$ ]$ ^5 N4 u
487.                         done
     9 N: F5 Q: V: v+ T* }  r' h
488.                         client=$(tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | sed -n "$client_number"p)
     
489.                         echo
     7 A; r# h; {9 v$ A2 Q3 C
490.                         read -p "Confirm $client revocation? [y/N]: " revoke
     & \2 ]7 m+ C1 m( [) p6 k
491.                         until [[ "$revoke" =~ ^[yYnN]*$ ]]; do
     
492.                                 echo "$revoke: invalid selection."
     
493.                                 read -p "Confirm $client revocation? [y/N]: " revoke
     7 B( k7 u% Y" k$ I" _2 Y2 ?
494.                         done
     
495.                         if [[ "$revoke" =~ ^[yY]$ ]]; then
     9 }; {+ x9 r* r$ x3 c' K" a
496.                                 cd /etc/openvpn/server/easy-rsa/
     ; F$ o9 n, b2 \# [, P. r
497.                                 ./easyrsa --batch revoke "$client"
     
498.                                 EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
       p5 v0 D" U/ K2 r2 b9 r: |
499.                                 rm -f /etc/openvpn/server/crl.pem
     
500.                                 cp /etc/openvpn/server/easy-rsa/pki/crl.pem /etc/openvpn/server/crl.pem
     3 @7 k' Q- F8 O$ v4 s9 |
501.                                 # CRL is read with each client connection, when OpenVPN is dropped to nobody
     4 i1 q, n4 r7 E$ c
502.                                 chown nobody:"$group_name" /etc/openvpn/server/crl.pem
     0 C7 C% O" \7 i; K$ |5 s- O: z! a
503.                                 echo
     % @5 D( z0 b; Y3 P0 t$ [
504.                                 echo "$client revoked!"
     
505.                         else
     
506.                                 echo
     
507.                                 echo "$client revocation aborted!"
     ( q- t7 x- P  |' T, b8 ]/ s* L
508.                         fi
     
509.                         exit
     ) Y" ~+ ?  n3 Q1 G4 _% i6 t
510.                 ;;
     
511.                 3)
     # e! V7 P& a) i) v$ w3 Y
512.                         echo
     3 W; h% f5 c# k& \- U
513.                         read -p "Confirm OpenVPN removal? [y/N]: " remove
     
514.                         until [[ "$remove" =~ ^[yYnN]*$ ]]; do
     
515.                                 echo "$remove: invalid selection."
     
516.                                 read -p "Confirm OpenVPN removal? [y/N]: " remove
     
517.                         done
     & Y+ E1 G" ^1 A! p5 B
518.                         if [[ "$remove" =~ ^[yY]$ ]]; then
     * _: |- y# W+ J
519.                                 port=$(grep '^port ' /etc/openvpn/server/server.conf | cut -d " " -f 2)
     
520.                                 protocol=$(grep '^proto ' /etc/openvpn/server/server.conf | cut -d " " -f 2)
     
521.                                 if systemctl is-active --quiet firewalld.service; then
     - h: _1 X" u+ a2 X9 W- ?/ [7 z
522.                                         ip=$(firewall-cmd --direct --get-rules ipv4 nat POSTROUTING | grep '\-s 10.8.0.0/24 '"'"'!'"'"' -d 10.8.0.0/24' | grep -oE '[^ ]+$')
     2 p' O: \& F# P# G- @: e! |
523.                                         # Using both permanent and not permanent rules to avoid a firewalld reload.
     
524.                                         firewall-cmd --remove-port="$port"/"$protocol"
     6 n; d8 m0 D% f2 J( `& I
525.                                         firewall-cmd --zone=trusted --remove-source=10.8.0.0/24
     
526.                                         firewall-cmd --permanent --remove-port="$port"/"$protocol"
     
527.                                         firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24
     
528.                                         firewall-cmd --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
     
529.                                         firewall-cmd --permanent --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
     
530.                                         if grep -qs "server-ipv6" /etc/openvpn/server/server.conf; then
     7 ]% [- s: p. [" o
531.                                                 ip6=$(firewall-cmd --direct --get-rules ipv6 nat POSTROUTING | grep '\-s fddd:1194:1194:1194::/64 '"'"'!'"'"' -d fddd:1194:1194:1194::/64' | grep -oE '[^ ]+$')
     5 G7 D  u6 O* ], y/ O/ X5 |  @
532.                                                 firewall-cmd --zone=trusted --remove-source=fddd:1194:1194:1194::/64
     
533.                                                 firewall-cmd --permanent --zone=trusted --remove-source=fddd:1194:1194:1194::/64
     
534.                                                 firewall-cmd --direct --remove-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
     * R0 o# _, d9 y2 h/ f
535.                                                 firewall-cmd --permanent --direct --remove-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
     
536.                                         fi
     
537.                                 else
     
538.                                         systemctl disable --now openvpn-iptables.service
     
539.                                         rm -f /etc/systemd/system/openvpn-iptables.service
     
540.                                 fi
     
541.                                 if sestatus 2>/dev/null | grep "Current mode" | grep -q "enforcing" && [[ "$port" != 1194 ]]; then
     
542.                                         semanage port -d -t openvpn_port_t -p "$protocol" "$port"
     
543.                                 fi
     & e; x8 {" }8 M) C, H: u; m3 b
544.                                 systemctl disable --now openvpn-server@server.service
     
545.                                 rm -f /etc/systemd/system/openvpn-server@server.service.d/disable-limitnproc.conf
     ( ?, h" |+ G# A4 o. v
546.                                 rm -f /etc/sysctl.d/99-openvpn-forward.conf
     4 [) i9 x0 n- l7 ]9 a$ c5 F
547.                                 if [[ "$os" = "debian" || "$os" = "ubuntu" ]]; then
     
548.                                         rm -rf /etc/openvpn/server
     
549.                                         apt-get remove --purge -y openvpn
     ; Q7 N5 p0 X" f. l5 H) m4 D0 q
550.                                 else
     0 I, V6 w7 l/ \3 D
551.                                         # Else, OS must be CentOS or Fedora
     8 k$ K& B) K: _0 B, _/ @
552.                                         yum remove -y openvpn
     
553.                                         rm -rf /etc/openvpn/server
     9 E2 ^) Z8 G* B& B3 H! f
554.                                 fi
     # |, ]( Q0 F- ?5 k+ x3 x$ ~
555.                                 echo
     
556.                                 echo "OpenVPN removed!"
     
557.                         else
     3 \* g! K5 g5 P0 y( w# k6 D1 _
558.                                 echo
     - V. t( W# \% K  L
559.                                 echo "OpenVPN removal aborted!"
     
560.                         fi
     + P/ P& z. T0 t1 n9 S( |3 M: K
561.                         exit
     3 o; K1 P: \/ f
562.                 ;;
     & |0 w+ C  e0 t" ^, H5 B) p" r
563.                 4)
     8 \; G9 O  R' `  Y$ w2 l! p/ _
564.                         exit
     
565.                 ;;
     
566.         esac
     
567. fi
     , d# I' J3 s6 t# f  D' o+ u. z: `

复制代码

, V. R6 ]4 Y6 {! ^. L! |$ T

# K  L0 }! L" y0 g5 E" Y# i3 Y' w