#!/bin/bash

echo "=========================================="
echo "      开始应用网络与内核参数优化          "
echo "=========================================="

# 1. 尝试加载连接跟踪模块
modprobe nf_conntrack 2>/dev/null || true

# 2. 写入独立的 sysctl 配置文件
cat << 'SYSCTL_EOF' > /etc/sysctl.d/99-network-optimization.conf
# 增大防火墙连接跟踪表上限
net.netfilter.nf_conntrack_max = 262144
net.netfilter.nf_conntrack_tcp_timeout_established = 600
net.netfilter.nf_conntrack_tcp_timeout_time_wait = 30

# TCP 连接回收与端口优化
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_fin_timeout = 15
net.ipv4.ip_local_port_range = 1024 65535

# 文件句柄与连接队列
fs.file-max = 1000000
net.core.somaxconn = 4096
net.ipv4.tcp_max_syn_backlog = 8192
SYSCTL_EOF

# 3. 设置开机自动加载模块（防止重启恢复默认值）
if [ -f /etc/modules ]; then
    grep -qxF "nf_conntrack" /etc/modules || echo "nf_conntrack" >> /etc/modules
fi

# 4. 若开启了 UFW，追加配置防止被 UFW 覆盖
if [ -f /etc/ufw/sysctl.conf ]; then
    grep -q "net/netfilter/nf_conntrack_max" /etc/ufw/sysctl.conf || cat << 'UFW_EOF' >> /etc/ufw/sysctl.conf
net/netfilter/nf_conntrack_max=262144
net/netfilter/nf_conntrack_tcp_timeout_established=600
net/netfilter/nf_conntrack_tcp_timeout_time_wait=30
net/ipv4/tcp_tw_reuse=1
UFW_EOF
fi

# 5. 刷新内核配置
sysctl --system >/dev/null 2>&1

echo ""
echo "=========================================="
echo "              执行结果自动验证            "
echo "=========================================="

# 验证 1: nf_conntrack_max
CONNMAX=$(sysctl -n net.netfilter.nf_conntrack_max 2>/dev/null || echo "未加载")
if [ "$CONNMAX" = "262144" ]; then
    echo "[✓] 内核连接跟踪上限: 262144 (成功)"
elif [ "$CONNMAX" = "未加载" ]; then
    echo "[!] 内核连接跟踪上限: 未启用防火墙/模块未加载 (当前不受限制，正常)"
else
    echo "[X] 内核连接跟踪上限: $CONNMAX (失败，未达到262144)"
fi

# 验证 2: tcp_tw_reuse
TWREUSE=$(sysctl -n net.ipv4.tcp_tw_reuse 2>/dev/null)
if [ "$TWREUSE" = "1" ]; then
    echo "[✓] TCP 连接快速重用: 已开启 (1)"
else
    echo "[X] TCP 连接快速重用: 未开启 ($TWREUSE)"
fi

# 验证 3: 开机模块持久化
if grep -q "nf_conntrack" /etc/modules 2>/dev/null; then
    echo "[✓] 防火墙模块自启设置: 已写入 /etc/modules"
else
    echo "[!] 防火墙模块自启设置: 未写入 (如果没用 UFW 可忽略)"
fi

# 验证 4: Brook 进程句柄数 (自动匹配 PID)
BROOK_PID=$(pgrep -f "brook" | head -n 1)
if [ -n "$BROOK_PID" ]; then
    LIMIT=$(cat /proc/$BROOK_PID/limits 2>/dev/null | grep "Max open files" | awk '{print $4}')
    echo "[✓] 检测到 Brook 进程 (PID: $BROOK_PID), 最大文件句柄数: $LIMIT"
else
    echo "[!] 未检测到运行中的 Brook 进程"
fi

echo "=========================================="