ykxmz 1.5.0锛氫慨澶嶆墜琛ㄧ TLS 璇佷功鏍￠獙 + MTU 淇缃戠粶绋冲畾鎬?

琚帶绔?- 淇 MTU 闂锛氬す MSS + 璺緞 MTU 鎺㈡祴锛堝叕缃戝彲鐢ㄧ巼 48% -> 100%锛?- 澶嶇敤 HTTP 杩炴帴锛堝厤鎺夋瘡娆℃柊寤?TLS 鐨?30% 鎻℃墜澶辫触锛?- 姣忓垎閽熷洖澶存壘灞€鍩熺綉锛岃嚜鍔ㄥ垏鍥炲揩 400 鍊嶇殑璺緞
- 鐢婚潰蹇冭烦甯э細闈欐鏃剁渷娴侀噺锛屽鎴风浠嶇煡閬撴祦鏄椿鐨?- 閿佸睆鏃剁粰鍑哄彲鎿嶄綔鐨勬彁绀?
鎵嬭〃绔?- 鍐呯疆 GTS Root R4 / GlobalSign Root CA锛屼慨 SSLHandshakeException
- 杩炴帴閿欒缈昏瘧鎴愪汉璇濓紙璇佷功/鏃堕棿/瑙ｆ瀽/瓒呮椂鍒嗗埆鎻愮ず锛?- 缁忎腑杞繛涓婂悗鐢ㄦ湇鍔″櫒鎶ョ殑鍦板潃鍒锋柊宸查厤瀵硅褰?- 鏂板灞€鍩熺綉杩炴帴椤甸潰銆佹湇鍔″櫒寤惰繜妫€娴?
鏈嶅姟鍣ㄧ
- 鏀寔 chunked 璇锋眰浣擄紙淇瘡 16 绉掍竴娆＄殑杩炴帴閿欎贡涓庡ぇ闈㈢Н 502锛?- 缃戠粶璋冧紭鑴氭湰 net-tune.sh锛堝紑鏈鸿嚜鍔ㄥ簲鐢級
- 绠＄悊椤碉細鎵归噺鍒犻櫎銆佺綉缁滀綋妫€銆佷笅杞藉尯
- 闅ч亾鏀?HTTP/2 + 鍙岃繛鎺?
鏂囨。
- 璁稿彲鍗忚 / 瀹夎鍓嶅繀璇?/ 瀹夎鍚庨』鐭ワ紙浣滆€咃細灏忛害瀛愶級

_tests/test_net_tune.py

@@ -0,0 +1,95 @@
+# -*- coding: utf-8 -*-
+"""验证 MTU 调优脚本和安装集成。
+
+为什么值得单独回归：
+    这是这次可用率从 48% 提到 100% 的关键，而且**很容易被后人误改** ——
+    比如"顺手把接口 MTU 也降一点"（实测那样会掉到 50%）。
+    所以把关键决策钉在测试里。
+"""
+from __future__ import annotations
+
+import re
+import subprocess
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent.parent
+NET_TUNE = ROOT / "relay" / "net-tune.sh"
+INSTALL = ROOT / "relay" / "install.sh"
+
+passed = 0
+failed = 0
+
+
+def check(name, ok, detail=""):
+    global passed, failed
+    if ok:
+        passed += 1
+        print("  [PASS] " + name)
+    else:
+        failed += 1
+        print("  [FAIL] " + name + "  " + str(detail))
+
+
+def main() -> int:
+    print("一、调优脚本本身")
+    check("net-tune.sh 在", NET_TUNE.is_file())
+    if not NET_TUNE.is_file():
+        return 1
+    text = NET_TUNE.read_text(encoding="utf-8")
+
+    # bash 语法（在 Linux 上才有 bash，本机没有就跳过）
+    check("打开 tcp_mtu_probing", "tcp_mtu_probing=1" in text)
+    check("夹 MSS", "--set-mss" in text)
+    check("MSS 默认值合理（1300~1440）",
+          bool(re.search(r"MSS_VALUE=\$\{MSS_VALUE:-(\d+)\}", text))
+          and 1300 <= int(re.search(r"MSS_VALUE=\$\{MSS_VALUE:-(\d+)\}", text)
+                          .group(1)) <= 1440,
+          re.search(r"MSS_VALUE=.*", text).group(0) if "MSS_VALUE" in text else "")
+    check("OUTPUT 链上夹", "OUTPUT" in text)
+    check("POSTROUTING 链上夹", "POSTROUTING" in text)
+
+    # 关键：明确写了不要改接口 MTU，并且确实把接口 MTU 设回 1500
+    check("不把接口 MTU 调小（写回了 1500）",
+          "mtu 1500" in text, "接口 MTU 降到 1400 实测会掉到 50%")
+    check("注释里说明了为什么不动接口 MTU",
+          "不要改接口 MTU" in text or "反而" in text)
+
+    # 清理旧规则，避免重启后越积越多
+    check("会先清掉旧 MSS 规则", "-D" in text and "while" in text)
+
+    print()
+    print("二、安装脚本带上了它")
+    check("install.sh 在", INSTALL.is_file())
+    install = INSTALL.read_text(encoding="utf-8")
+    check("有 [3c] 网络调优段", "[3c]" in install)
+    check("会拷 net-tune.sh", "net-tune.sh" in install)
+    check("会写 sysctl 配置", "99-lanremote-mtu.conf" in install)
+    check("会注册开机服务", "lanremote-nettune.service" in install)
+    check("服务 enabled", "systemctl enable lanremote-nettune" in install)
+    check("开机服务在隧道之前跑（新连接就用上新参数）",
+          "Before=lanremote-relay.service lanremote-tunnel.service" in install)
+
+    print()
+    print("三、打包会带上这两个文件")
+    package = (ROOT / "_build" / "package_remote.py").read_text(
+        encoding="utf-8")
+    check("打包脚本扫描整个 relay 目录（不是硬编码文件名）",
+          "iterdir" in package or "rglob" in package, "")
+    check("relay/net-tune.sh 会被打进去（同目录扫描即可）",
+          NET_TUNE.is_file())
+
+    print()
+    print("四、说明文档里记了实测数据")
+    check("写了不夹 MSS 的对照（87%）", "87" in text)
+    check("写了 MSS 各档都 100%", "100%" in text)
+    check("写了接口 MTU 1400 更差的教训", "50%" in text)
+
+    print()
+    print("=" * 58)
+    print(f"通过 {passed} 项，失败 {failed} 项")
+    return 0 if failed == 0 else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())