第十一部分：性能优化

36. 网络性能优化

36.1 TCP参数调优

36.1.1 基础TCP优化

优化sysctl参数：

#!/bin/bash
# optimize-tcp.sh

echo "=== TCP性能优化 ==="

SYSCTL_CONF="/etc/sysctl.d/99-wireguard-tcp.conf"

cat << 'EOF' | sudo tee $SYSCTL_CONF
# TCP性能优化

# TCP窗口缩放
net.ipv4.tcp_window_scaling = 1

# 时间戳
net.ipv4.tcp_timestamps = 1

# 选择性确认
net.ipv4.tcp_sack = 1

# TCP Fast Open
net.ipv4.tcp_fastopen = 3

# TCP缓冲区大小
# 格式: min default max
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 65536 16777216

# 核心缓冲区
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.core.rmem_default = 262144
net.core.wmem_default = 262144

# TCP拥塞控制
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr

# TCP保持连接
net.ipv4.tcp_keepalive_time = 600
net.ipv4.tcp_keepalive_intvl = 60
net.ipv4.tcp_keepalive_probes = 3

# 重用TIME_WAIT状态的套接字
net.ipv4.tcp_tw_reuse = 1

# 减少FIN-WAIT-2超时
net.ipv4.tcp_fin_timeout = 30

# SYN重传次数
net.ipv4.tcp_syn_retries = 3
net.ipv4.tcp_synack_retries = 3

# 最大SYN队列
net.ipv4.tcp_max_syn_backlog = 8192

# 连接队列大小
net.core.somaxconn = 8192

# 网络设备队列
net.core.netdev_max_backlog = 5000

# 禁用TCP慢启动（谨慎使用）
# net.ipv4.tcp_slow_start_after_idle = 0

# MTU探测
net.ipv4.tcp_mtu_probing = 1
EOF

# 应用配置
sudo sysctl -p $SYSCTL_CONF

echo "✓ TCP参数已优化"

# 验证关键参数
echo ""
echo "验证关键参数:"
echo "BBR拥塞控制: $(sysctl net.ipv4.tcp_congestion_control)"
echo "TCP Fast Open: $(sysctl net.ipv4.tcp_fastopen)"
echo "默认qdisc: $(sysctl net.core.default_qdisc)"

36.1.2 BBR拥塞控制

启用和验证BBR：

#!/bin/bash
# enable-bbr.sh

echo "=== 启用BBR拥塞控制 ==="

# 1. 检查内核版本（需要4.9+）
echo "[1] 检查内核版本..."
KERNEL_VERSION=$(uname -r | cut -d. -f1,2)
REQUIRED_VERSION="4.9"

if [ "$(printf '%s\n' "$REQUIRED_VERSION" "$KERNEL_VERSION" | sort -V | head -n1)" != "$REQUIRED_VERSION" ]; then
    echo "✗ 内核版本过低，需要4.9或更高"
    echo "当前版本: $(uname -r)"
    exit 1
fi

echo "✓ 内核版本满足要求: $(uname -r)"

# 2. 加载BBR模块
echo ""
echo "[2] 加载BBR模块..."
sudo modprobe tcp_bbr

# 永久加载
if ! grep -q "tcp_bbr" /etc/modules; then
    echo "tcp_bbr" | sudo tee -a /etc/modules
fi

echo "✓ BBR模块已加载"

# 3. 配置sysctl
echo ""
echo "[3] 配置sysctl..."

cat << 'EOF' | sudo tee /etc/sysctl.d/99-bbr.conf
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr
EOF

sudo sysctl -p /etc/sysctl.d/99-bbr.conf

# 4. 验证BBR
echo ""
echo "[4] 验证BBR..."

if sysctl net.ipv4.tcp_congestion_control | grep -q bbr; then
    echo "✓ BBR已启用"
else
    echo "✗ BBR未启用"
    exit 1
fi

# 5. 检查可用的拥塞控制算法
echo ""
echo "[5] 可用的拥塞控制算法:"
sysctl net.ipv4.tcp_available_congestion_control

echo ""
echo "=== BBR配置完成 ==="

BBR性能测试：

#!/bin/bash
# test-bbr-performance.sh

echo "=== BBR性能测试 ==="

SERVER="10.8.0.1"
TEST_DURATION=30

# 测试函数
test_throughput() {
    local cc_algo=$1
    
    echo ""
    echo "测试 $cc_algo..."
    
    # 临时切换拥塞控制算法
    sudo sysctl -w net.ipv4.tcp_congestion_control=$cc_algo > /dev/null
    
    # 使用iperf3测试
    result=$(iperf3 -c $SERVER -t $TEST_DURATION -J 2>/dev/null)
    
    if [ $? -eq 0 ]; then
        # 提取结果
        throughput=$(echo $result | jq -r '.end.sum_received.bits_per_second' | awk '{printf "%.2f", $1/1000000}')
        echo "  吞吐量: ${throughput} Mbps"
    else
        echo "  测试失败"
    fi
}

# 测试不同的拥塞控制算法
for algo in cubic bbr; do
    test_throughput $algo
done

# 恢复BBR
sudo sysctl -w net.ipv4.tcp_congestion_control=bbr > /dev/null

echo ""
echo "=== 测试完成 ==="

36.2 MTU优化

36.2.1 查找最优MTU

MTU探测脚本：

#!/bin/bash
# find-optimal-mtu.sh

TARGET=${1:-10.8.0.1}

echo "=== 查找最优MTU ==="
echo "目标: $TARGET"
echo ""

# 从大到小测试
for mtu in 1500 1400 1380 1360 1340 1320 1300 1280 1260 1240 1220 1200; do
    # 计算数据大小（MTU - 28字节头部）
    data_size=$((mtu - 28))
    
    # 测试（禁止分片）
    if ping -M do -s $data_size -c 3 -W 2 $TARGET > /dev/null 2>&1; then
        echo "✓ MTU $mtu: 成功"
        
        # 找到第一个成功的，就是最优MTU
        echo ""
        echo "推荐MTU: $mtu"
        echo ""
        echo "配置方法:"
        echo "1. 修改WireGuard配置:"
        echo "   [Interface]"
        echo "   MTU = $mtu"
        echo ""
        echo "2. 或修改接口MTU:"
        echo "   sudo ip link set wg0 mtu $mtu"
        
        break
    else
        echo "✗ MTU $mtu: 失败（需要分片）"
    fi
done

36.2.2 动态MTU调整

自动MTU配置脚本：

#!/bin/bash
# auto-mtu.sh

INTERFACE="wg0"
TARGET="10.8.0.1"

echo "=== 自动MTU配置 ==="

# 查找最优MTU
optimal_mtu=1420  # WireGuard默认值

for test_mtu in 1500 1480 1460 1440 1420 1400 1380 1360 1340 1320 1300; do
    data_size=$((test_mtu - 28))
    
    if ping -M do -s $data_size -c 3 -W 2 $TARGET > /dev/null 2>&1; then
        optimal_mtu=$test_mtu
        break
    fi
done

echo "检测到最优MTU: $optimal_mtu"

# 获取当前MTU
current_mtu=$(ip link show $INTERFACE | grep -oP 'mtu \K\d+')
echo "当前MTU: $current_mtu"

# 如果不同，则更新
if [ "$current_mtu" != "$optimal_mtu" ]; then
    echo "更新MTU到 $optimal_mtu..."
    sudo ip link set $INTERFACE mtu $optimal_mtu
    
    # 更新配置文件
    CONFIG_FILE="/etc/wireguard/wg0.conf"
    if grep -q "^MTU" $CONFIG_FILE; then
        sudo sed -i "s/^MTU.*/MTU = $optimal_mtu/" $CONFIG_FILE
    else
        sudo sed -i "/^\[Interface\]/a MTU = $optimal_mtu" $CONFIG_FILE
    fi
    
    echo "✓ MTU已更新"
else
    echo "✓ MTU已是最优值"
fi

36.3 缓冲区优化

36.3.1 网络缓冲区调整

优化网络缓冲区：

#!/bin/bash
# optimize-buffers.sh

echo "=== 网络缓冲区优化 ==="

SYSCTL_CONF="/etc/sysctl.d/99-network-buffers.conf"

cat << 'EOF' | sudo tee $SYSCTL_CONF
# 网络缓冲区优化

# 核心接收缓冲区
net.core.rmem_max = 134217728
net.core.rmem_default = 16777216

# 核心发送缓冲区
net.core.wmem_max = 134217728
net.core.wmem_default = 16777216

# TCP接收缓冲区 (min, default, max)
net.ipv4.tcp_rmem = 4096 87380 134217728

# TCP发送缓冲区 (min, default, max)
net.ipv4.tcp_wmem = 4096 65536 134217728

# UDP缓冲区
net.ipv4.udp_rmem_min = 16384
net.ipv4.udp_wmem_min = 16384

# 网络设备接收队列
net.core.netdev_max_backlog = 250000

# 接收包处理队列
net.core.netdev_budget = 600
net.core.netdev_budget_usecs = 8000
EOF

sudo sysctl -p $SYSCTL_CONF

echo "✓ 缓冲区参数已优化"

# 显示当前配置
echo ""
echo "当前缓冲区配置:"
sysctl net.core.rmem_max net.core.wmem_max
sysctl net.ipv4.tcp_rmem net.ipv4.tcp_wmem

36.3.2 接口队列长度

调整接口队列：

#!/bin/bash
# optimize-queue.sh

INTERFACE="wg0"

echo "=== 优化接口队列 ==="

# 当前队列长度
current_txqueuelen=$(ip link show $INTERFACE | grep -oP 'qlen \K\d+')
echo "当前队列长度: $current_txqueuelen"

# 推荐值：10000
recommended_txqueuelen=10000

if [ "$current_txqueuelen" != "$recommended_txqueuelen" ]; then
    echo "设置队列长度为 $recommended_txqueuelen..."
    sudo ip link set $INTERFACE txqueuelen $recommended_txqueuelen
    
    # 永久配置
    cat << EOF | sudo tee /etc/systemd/system/wg-queue-optimize.service
[Unit]
Description=Optimize WireGuard Queue Length
[email protected]
[email protected]

[Service]
Type=oneshot
ExecStart=/sbin/ip link set $INTERFACE txqueuelen $recommended_txqueuelen
RemainOnExit=yes

[Install]
WantedBy=multi-user.target
EOF
    
    sudo systemctl enable wg-queue-optimize
    
    echo "✓ 队列长度已优化"
else
    echo "✓ 队列长度已是最优值"
fi

37. 系统性能优化

37.1 CPU优化

37.1.1 CPU亲和性设置

绑定WireGuard到特定CPU核心：

#!/bin/bash
# set-cpu-affinity.sh

echo "=== 设置WireGuard CPU亲和性 ==="

# 1. 检查CPU核心数
CPU_CORES=$(nproc)
echo "系统CPU核心数: $CPU_CORES"

if [ $CPU_CORES -lt 2 ]; then
    echo "⚠ 警告: CPU核心数不足，不建议绑定"
    exit 0
fi

# 2. 查找WireGuard相关进程
echo ""
echo "查找WireGuard进程..."

# WireGuard是内核模块，查找相关的kworker
WIREGUARD_WORKERS=$(ps aux | grep -E '\[kworker.*wg\]' | awk '{print $2}')

if [ -z "$WIREGUARD_WORKERS" ]; then
    echo "未找到WireGuard工作进程"
else
    echo "找到WireGuard工作进程:"
    echo "$WIREGUARD_WORKERS"
fi

# 3. 绑定网络中断到特定CPU
echo ""
echo "优化网络中断分布..."

# 查找网卡中断
NIC_INTERFACE="pnet0"  # 根据实际情况修改

if [ -d "/sys/class/net/$NIC_INTERFACE" ]; then
    # 获取IRQ号
    IRQ_NUMBERS=$(grep $NIC_INTERFACE /proc/interrupts | awk -F: '{print $1}' | tr -d ' ')
    
    # 分配到不同CPU（轮询）
    cpu_index=0
    for irq in $IRQ_NUMBERS; do
        # 计算CPU掩码
        cpu_mask=$((1 << cpu_index))
        cpu_mask_hex=$(printf '%x' $cpu_mask)
        
        echo "  IRQ $irq -> CPU $cpu_index (掩码: $cpu_mask_hex)"
        echo $cpu_mask_hex | sudo tee /proc/irq/$irq/smp_affinity > /dev/null
        
        cpu_index=$(((cpu_index + 1) % CPU_CORES))
    done
    
    echo "✓ 网络中断已优化分布"
else
    echo "⚠ 网卡接口 $NIC_INTERFACE 不存在"
fi

# 4. 配置RPS/RPS（接收包控制）
echo ""
echo "配置RPS（接收包控制）..."

# 为wg0配置RPS
WG_INTERFACE="wg0"

if [ -d "/sys/class/net/$WG_INTERFACE" ]; then
    # 启用所有CPU参与处理
    rps_cpus=$(printf '%x' $((2**CPU_CORES - 1)))
    
    for queue in /sys/class/net/$WG_INTERFACE/queues/rx-*/rps_cpus; do
        echo $rps_cpus | sudo tee $queue > /dev/null
    done
    
    # 配置RPS流限制
    for queue in /sys/class/net/$WG_INTERFACE/queues/rx-*/rps_flow_cnt; do
        echo 32768 | sudo tee $queue > /dev/null
    done
    
    echo "✓ RPS已配置"
else
    echo "⚠ WireGuard接口未运行"
fi

echo ""
echo "=== CPU亲和性配置完成 ==="

持久化CPU优化配置：

#!/bin/bash
# persistent-cpu-optimization.sh

# 创建systemd服务
cat << 'EOF' | sudo tee /etc/systemd/system/wireguard-cpu-optimize.service
[Unit]
Description=WireGuard CPU Optimization
[email protected]
[email protected]

[Service]
Type=oneshot
RemainOnExit=yes
ExecStart=/usr/local/bin/set-cpu-affinity.sh

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl enable wireguard-cpu-optimize
sudo systemctl start wireguard-cpu-optimize

echo "✓ CPU优化已持久化"

37.1.2 中断合并

优化网卡中断合并：

#!/bin/bash
# optimize-interrupt-coalescing.sh

NIC_INTERFACE="pnet0"

echo "=== 优化网卡中断合并 ==="

# 1. 查看当前设置
echo "当前中断合并设置:"
sudo ethtool -c $NIC_INTERFACE 2>/dev/null

# 2. 优化设置
echo ""
echo "应用优化设置..."

# 接收中断合并（微秒）
sudo ethtool -C $NIC_INTERFACE rx-usecs 50 2>/dev/null

# 发送中断合并
sudo ethtool -C $NIC_INTERFACE tx-usecs 50 2>/dev/null

# 接收帧数
sudo ethtool -C $NIC_INTERFACE rx-frames 32 2>/dev/null

# 发送帧数
sudo ethtool -C $NIC_INTERFACE tx-frames 32 2>/dev/null

if [ $? -eq 0 ]; then
    echo "✓ 中断合并已优化"
else
    echo "⚠ 此网卡可能不支持中断合并"
fi

# 3. 验证设置
echo ""
echo "验证新设置:"
sudo ethtool -c $NIC_INTERFACE 2>/dev/null

37.2 内存优化

37.2.1 内存参数调优

优化内存管理：

#!/bin/bash
# optimize-memory.sh

echo "=== 内存优化 ==="

SYSCTL_CONF="/etc/sysctl.d/99-memory-optimize.conf"

cat << 'EOF' | sudo tee $SYSCTL_CONF
# 内存优化参数

# 虚拟内存
vm.swappiness = 10
vm.vfs_cache_pressure = 50

# 脏页管理
vm.dirty_ratio = 15
vm.dirty_background_ratio = 5

# 内存overcommit
vm.overcommit_memory = 1
vm.overcommit_ratio = 50

# 透明大页
vm.nr_hugepages = 128

# 内存压缩
vm.page-cluster = 3
EOF

sudo sysctl -p $SYSCTL_CONF

echo "✓ 内存参数已优化"

# 显示当前内存使用
echo ""
echo "当前内存使用:"
free -h

37.2.2 大页内存

配置大页内存：

#!/bin/bash
# setup-hugepages.sh

echo "=== 配置大页内存 ==="

# 1. 检查大页支持
echo "检查大页支持:"
grep -i hugepage /proc/meminfo

# 2. 计算推荐的大页数量
TOTAL_MEM_KB=$(grep MemTotal /proc/meminfo | awk '{print $2}')
TOTAL_MEM_GB=$((TOTAL_MEM_KB / 1048576))

# 分配1GB给大页（2MB页面）
HUGEPAGES_COUNT=512

echo ""
echo "总内存: ${TOTAL_MEM_GB}GB"
echo "推荐大页数: $HUGEPAGES_COUNT (1GB)"

# 3. 配置大页
echo $HUGEPAGES_COUNT | sudo tee /proc/sys/vm/nr_hugepages

# 永久配置
if ! grep -q "vm.nr_hugepages" /etc/sysctl.conf; then
    echo "vm.nr_hugepages = $HUGEPAGES_COUNT" | sudo tee -a /etc/sysctl.conf
fi

# 4. 挂载hugepages
if ! mount | grep -q hugetlbfs; then
    sudo mkdir -p /mnt/huge
    echo "hugetlbfs /mnt/huge hugetlbfs defaults 0 0" | sudo tee -a /etc/fstab
    sudo mount /mnt/huge
    echo "✓ 大页文件系统已挂载"
fi

# 5. 验证
echo ""
echo "验证大页配置:"
grep -i hugepage /proc/meminfo

echo ""
echo "✓ 大页内存配置完成"

37.3 I/O优化

37.3.1 磁盘调度器

优化I/O调度器：

#!/bin/bash
# optimize-io-scheduler.sh

echo "=== I/O调度器优化 ==="

# 1. 检测磁盘类型和当前调度器
for disk in /sys/block/sd*; do
    disk_name=$(basename $disk)
    
    echo "磁盘: $disk_name"
    
    # 检查是否为SSD
    if [ "$(cat $disk/queue/rotational)" = "0" ]; then
        disk_type="SSD"
        recommended_scheduler="none"
    else
        disk_type="HDD"
        recommended_scheduler="mq-deadline"
    fi
    
    current_scheduler=$(cat $disk/queue/scheduler | grep -oP '\[\K[^\]]+')
    
    echo "  类型: $disk_type"
    echo "  当前调度器: $current_scheduler"
    echo "  推荐调度器: $recommended_scheduler"
    
    # 应用推荐调度器
    if [ "$current_scheduler" != "$recommended_scheduler" ]; then
        echo "  应用调度器: $recommended_scheduler"
        echo $recommended_scheduler | sudo tee $disk/queue/scheduler > /dev/null
    fi
    
    echo ""
done

# 2. 创建udev规则持久化配置
cat << 'EOF' | sudo tee /etc/udev/rules.d/60-scheduler.rules
# SSD使用none调度器
ACTION=="add|change", KERNEL=="sd[a-z]", ATTR{queue/rotational}=="0", ATTR{queue/scheduler}="none"

# HDD使用mq-deadline调度器
ACTION=="add|change", KERNEL=="sd[a-z]", ATTR{queue/rotational}=="1", ATTR{queue/scheduler}="mq-deadline"
EOF

sudo udevadm control --reload-rules

echo "✓ I/O调度器已优化"

37.3.2 读写缓存优化

优化文件系统缓存：

#!/bin/bash
# optimize-fs-cache.sh

echo "=== 文件系统缓存优化 ==="

SYSCTL_CONF="/etc/sysctl.d/99-fs-cache.conf"

cat << 'EOF' | sudo tee $SYSCTL_CONF
# 文件系统缓存优化

# inode和dentry缓存
vm.vfs_cache_pressure = 50

# 文件句柄限制
fs.file-max = 2097152

# 单个进程可打开的文件数
fs.nr_open = 1048576

# AIO最大请求数
fs.aio-max-nr = 1048576

# inotify限制
fs.inotify.max_user_watches = 524288
fs.inotify.max_user_instances = 512
EOF

sudo sysctl -p $SYSCTL_CONF

# 配置limits
cat << 'EOF' | sudo tee -a /etc/security/limits.conf
* soft nofile 65535
* hard nofile 65535
* soft nproc 65535
* hard nproc 65535
EOF

echo "✓ 文件系统缓存已优化"

38. 协议优化

38.1 UDP优化

38.1.1 UDP缓冲区调整

优化UDP参数：

#!/bin/bash
# optimize-udp.sh

echo "=== UDP优化 ==="

SYSCTL_CONF="/etc/sysctl.d/99-udp-optimize.conf"

cat << 'EOF' | sudo tee $SYSCTL_CONF
# UDP优化参数

# UDP接收缓冲区
net.core.rmem_max = 134217728
net.core.rmem_default = 16777216

# UDP发送缓冲区
net.core.wmem_max = 134217728
net.core.wmem_default = 16777216

# UDP特定缓冲区
net.ipv4.udp_rmem_min = 16384
net.ipv4.udp_wmem_min = 16384

# UDP内存限制
net.ipv4.udp_mem = 262144 524288 1048576

# 增加接收队列
net.core.netdev_max_backlog = 250000

# 启用早期demux（提高性能）
net.ipv4.ip_early_demux = 1
net.ipv4.udp_early_demux = 1

# 允许重用本地端口
net.ipv4.ip_local_port_range = 1024 65535
net.ipv4.ip_local_reserved_ports = 51820
EOF

sudo sysctl -p $SYSCTL_CONF

echo "✓ UDP参数已优化"

# 验证关键参数
echo ""
echo "验证UDP配置:"
sysctl net.core.rmem_max net.core.wmem_max
sysctl net.ipv4.udp_rmem_min net.ipv4.udp_wmem_min

38.1.2 UDP校验和卸载

配置UDP校验和卸载：

#!/bin/bash
# configure-udp-offload.sh

NIC_INTERFACE="pnet0"

echo "=== 配置UDP校验和卸载 ==="

# 1. 查看当前offload设置
echo "当前offload设置:"
sudo ethtool -k $NIC_INTERFACE | grep udp

# 2. 启用UDP校验和卸载
echo ""
echo "启用UDP校验和卸载..."

# 接收校验和
sudo ethtool -K $NIC_INTERFACE rx-udp_tunnel-port-offload on 2>/dev/null

# 发送校验和
sudo ethtool -K $NIC_INTERFACE tx-udp_tnl-segmentation on 2>/dev/null
sudo ethtool -K $NIC_INTERFACE tx-udp_tnl-csum-segmentation on 2>/dev/null

if [ $? -eq 0 ]; then
    echo "✓ UDP offload已启用"
else
    echo "⚠ 网卡可能不支持某些offload特性"
fi

# 3. 验证
echo ""
echo "验证设置:"
sudo ethtool -k $NIC_INTERFACE | grep -E "udp|segmentation"

# 4. 持久化配置
cat << EOF | sudo tee /etc/systemd/system/udp-offload.service
[Unit]
Description=Configure UDP Offload
After=network.target

[Service]
Type=oneshot
ExecStart=/usr/sbin/ethtool -K $NIC_INTERFACE rx-udp_tunnel-port-offload on
ExecStart=/usr/sbin/ethtool -K $NIC_INTERFACE tx-udp_tnl-segmentation on
RemainOnExit=yes

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl enable udp-offload

echo "✓ UDP offload配置已持久化"

38.2 WireGuard特定优化

38.2.1 持久化保活优化

优化保活策略：

#!/bin/bash
# optimize-keepalive.sh

echo "=== 优化WireGuard保活配置 ==="

CONFIG_FILE="/etc/wireguard/wg0.conf"

# 备份配置
sudo cp $CONFIG_FILE ${CONFIG_FILE}.bak

# 分析网络环境
echo "分析网络环境..."

# 测试NAT超时
echo "测试NAT超时（需要客户端配合）..."
echo "建议根据网络环境设置保活间隔:"
echo ""
echo "环境类型              建议间隔"
echo "-----------------------------------"
echo "企业网络（稳定）      60秒"
echo "家庭网络（一般）      25秒"
echo "移动网络（不稳定）    15秒"
echo "严格NAT环境           10秒"
echo ""

read -p "选择环境类型 (1=企业/2=家庭/3=移动/4=严格NAT): " env_type

case $env_type in
    1)
        KEEPALIVE=60
        ;;
    2)
        KEEPALIVE=25
        ;;
    3)
        KEEPALIVE=15
        ;;
    4)
        KEEPALIVE=10
        ;;
    *)
        KEEPALIVE=25
        ;;
esac

echo "将设置保活间隔为: ${KEEPALIVE}秒"

# 更新所有peer的保活设置
echo ""
echo "更新配置文件..."

# 删除现有PersistentKeepalive设置
sudo sed -i '/PersistentKeepalive/d' $CONFIG_FILE

# 为每个Peer添加保活
sudo awk -v ka=$KEEPALIVE '
    /^\[Peer\]/ {
        print
        peer_found = 1
        next
    }
    peer_found && /^[A-Za-z]/ {
        print "PersistentKeepalive = " ka
        peer_found = 0
    }
    {print}
' $CONFIG_FILE > /tmp/wg0.conf.tmp

sudo mv /tmp/wg0.conf.tmp $CONFIG_FILE

# 重新加载配置
echo ""
echo "重新加载配置..."
sudo wg syncconf wg0 <(wg-quick strip wg0)

echo "✓ 保活配置已优化"

# 验证
echo ""
echo "验证保活设置:"
sudo wg show wg0 persistent-keepalive

38.2.2 多线程优化

WireGuard多线程配置：

#!/bin/bash
# configure-wireguard-threading.sh

echo "=== WireGuard多线程优化 ==="

# WireGuard使用内核线程，可以调整相关参数

# 1. 增加网络处理线程数
SYSCTL_CONF="/etc/sysctl.d/99-wireguard-threads.conf"

cat << 'EOF' | sudo tee $SYSCTL_CONF
# WireGuard多线程优化

# RPS（接收包控制）线程数
net.core.rps_sock_flow_entries = 32768

# 网络设备处理预算
net.core.netdev_budget = 600
net.core.netdev_budget_usecs = 8000

# 软中断处理
net.core.dev_weight = 64
EOF

sudo sysctl -p $SYSCTL_CONF

# 2. 配置接收流控制
WG_INTERFACE="wg0"

if [ -d "/sys/class/net/$WG_INTERFACE" ]; then
    # 设置RPS
    CPU_CORES=$(nproc)
    rps_cpus=$(printf '%x' $((2**CPU_CORES - 1)))
    
    for queue in /sys/class/net/$WG_INTERFACE/queues/rx-*/rps_cpus; do
        echo $rps_cpus | sudo tee $queue > /dev/null
    done
    
    for queue in /sys/class/net/$WG_INTERFACE/queues/rx-*/rps_flow_cnt; do
        echo 32768 | sudo tee $queue > /dev/null
    done
    
    echo "✓ RPS已配置到所有CPU核心"
fi

echo ""
echo "=== 多线程优化完成 ==="

38.3 加密性能优化

38.3.1 硬件加速

检测和启用加密硬件加速：

#!/bin/bash
# enable-crypto-acceleration.sh

echo "=== 检测加密硬件加速 ==="

# 1. 检测CPU加密指令集
echo "检测CPU特性..."

if grep -q aes /proc/cpuinfo; then
    echo "✓ 支持AES-NI"
    AES_NI=true
else
    echo "✗ 不支持AES-NI"
    AES_NI=false
fi

if grep -q avx /proc/cpuinfo; then
    echo "✓ 支持AVX"
fi

if grep -q avx2 /proc/cpuinfo; then
    echo "✓ 支持AVX2"
fi

# 2. 检查加密模块
echo ""
echo "检查加密模块..."

CRYPTO_MODULES="aesni_intel cryptd"

for module in $CRYPTO_MODULES; do
    if lsmod | grep -q $module; then
        echo "✓ $module 已加载"
    else
        echo "  加载 $module..."
        sudo modprobe $module
        
        if [ $? -eq 0 ]; then
            echo "  ✓ $module 已加载"
            
            # 持久化
            if ! grep -q $module /etc/modules; then
                echo $module | sudo tee -a /etc/modules
            fi
        fi
    fi
done

# 3. 验证ChaCha20加速
echo ""
echo "验证ChaCha20性能..."

if [ -f /proc/crypto ]; then
    chacha_driver=$(grep -A 10 "name.*chacha20" /proc/crypto | grep "driver" | head -1)
    echo "ChaCha20驱动: $chacha_driver"
fi

# 4. 性能测试
echo ""
echo "加密性能测试..."

# 测试不同大小数据的加密性能
for size in 1024 4096 16384 65536; do
    speed=$(openssl speed -evp chacha20-poly1305 -bytes $size 2>&1 | \
            grep "^$size" | awk '{print $2}')
    
    echo "  ${size}字节: ${speed} KB/s"
done

echo ""
echo "=== 加密加速配置完成 ==="

38.3.2 加密算法优化

优化ChaCha20-Poly1305性能：

#!/bin/bash
# optimize-chacha20.sh

echo "=== ChaCha20-Poly1305优化 ==="

# 1. 检查当前配置
echo "当前加密配置:"
if [ -f /proc/crypto ]; then
    grep -A 15 "name.*chacha20" /proc/crypto | head -16
fi

# 2. 确保使用最优实现
echo ""
echo "检查可用的ChaCha20实现..."

available_impls=$(grep "name.*chacha20" /proc/crypto | awk '{print $3}')
echo "可用实现:"
echo "$available_impls"

# 3. 内核参数优化
SYSCTL_CONF="/etc/sysctl.d/99-crypto-optimize.conf"

cat << 'EOF' | sudo tee $SYSCTL_CONF
# 加密性能优化

# 禁用加密API节流（提高性能）
crypto.fips_enabled = 0
EOF

sudo sysctl -p $SYSCTL_CONF

# 4. 性能基准测试
echo ""
echo "ChaCha20-Poly1305性能基准:"

# 小数据包
echo "  小数据包 (1KB):"
openssl speed -evp chacha20-poly1305 -bytes 1024 2>&1 | \
    grep "^1024" | awk '{printf "    %s KB/s\n", $2}'

# 中等数据包
echo "  中等数据包 (16KB):"
openssl speed -evp chacha20-poly1305 -bytes 16384 2>&1 | \
    grep "^16384" | awk '{printf "    %s KB/s\n", $2}'

# 大数据包
echo "  大数据包 (64KB):"
openssl speed -evp chacha20-poly1305 -bytes 65536 2>&1 | \
    grep "^65536" | awk '{printf "    %s KB/s\n", $2}'

echo ""
echo "=== 优化完成 ==="