security: 6-item hardening pass (OTA auth, SQLi, HMAC, SSRF, supply chain, env) (#109)

- #106 Master OTA Telegram callback requires TG_MASTER_TOKEN authentication
- #105 toggle command uses whitelist validation instead of raw SQL concat
- #108 HMAC signature covers all query params (path + sorted params) on both sides
- #107 Remove curl -k, add internal domain SSRF interception (.local/.internal/.nip.io)
- Supply chain: IPS-MAGIC integrity verification for all 6 install modules
- Env: confirmed config.conf/master.conf chmod 600, no .env leak risk

9 files changed, +120/-13 lines

Co-authored-by: hotyue <hotyue@users.noreply.github.com>

install/build_agent.sh

@@ -1,10 +1,29 @@
 #!/bin/bash
-
+# IPS-MAGIC:IP-SENTINEL-BUILD-AGENT-v4.3.0
 # ==========================================================
 # 模块名称: build_agent.sh (Orchestrator 编排大管家)
 # 核心功能: 严格遵循原版 install.sh 判定树时序，实现无损热更新
 # ==========================================================
 
+# [安全修复] 供应链完整性校验 — 防止远程脚本被投毒替换
+verify_magic() {
+    local file="$1"
+    local expected_magic="# IPS-MAGIC:"
+    if ! head -5 "$file" 2>/dev/null | grep -q "$expected_magic"; then
+        echo -e "\033[31m❌ 完整性校验失败：${file} 缺少 MAGIC STRING，疑似供应链投毒！\033[0m"
+        exit 1
+    fi
+    local fsize=$(stat -c%s "$file" 2>/dev/null || echo 0)
+    if [ "$fsize" -lt 50 ]; then
+        echo -e "\033[31m❌ 完整性校验失败：${file} 文件过小 (${fsize} bytes)，疑似被截断！\033[0m"
+        exit 1
+    fi
+    if [ "$fsize" -gt 512000 ]; then
+        echo -e "\033[31m❌ 完整性校验失败：${file} 文件过大 (${fsize} bytes)，疑似注入攻击！\033[0m"
+        exit 1
+    fi
+}
+
 # 传递中断引信
 trap 'exit 1' INT QUIT TERM
 
@@ -22,6 +41,12 @@ for mod in "${MODULES[@]}"; do
         echo -e "\033[31m❌ 致命错误：依赖模块 [${mod}] 装载失败！\033[0m"
         exit 1
     fi
+    # [安全修复] 下载后校验完整性再执行
+    verify_magic "${SECURE_TMP}/${mod}"
+    bash -n "${SECURE_TMP}/${mod}" >/dev/null 2>&1 || {
+        echo -e "\033[31m❌ 语法校验失败：${mod} 脚本格式异常，已熔断！\033[0m"
+        exit 1
+    }
     source "${SECURE_TMP}/${mod}"
 done
 

install/build_master.sh

@@ -1,9 +1,30 @@
 #!/bin/bash
+# IPS-MAGIC:IP-SENTINEL-BUILD-MASTER-v4.3.0
 # ==========================================================
 # 模块名称: build_master.sh (v4.3.0 Orchestrator)
 # 核心功能: Master 安装业务总指挥，按原版时序复用组件
 # ==========================================================
 
+# [安全修复] 供应链完整性校验 — 防止远程脚本被投毒替换
+verify_magic() {
+    local file="$1"
+    local expected_magic="# IPS-MAGIC:"
+    if ! head -5 "$file" 2>/dev/null | grep -q "$expected_magic"; then
+        echo -e "\033[31m❌ 完整性校验失败：${file} 缺少 MAGIC STRING，疑似供应链投毒！\033[0m"
+        exit 1
+    fi
+    # [安全修复] 文件大小检查 — 拒绝空脚本和异常大的脚本（>500KB）
+    local fsize=$(stat -c%s "$file" 2>/dev/null || echo 0)
+    if [ "$fsize" -lt 50 ]; then
+        echo -e "\033[31m❌ 完整性校验失败：${file} 文件过小 (${fsize} bytes)，疑似被截断！\033[0m"
+        exit 1
+    fi
+    if [ "$fsize" -gt 512000 ]; then
+        echo -e "\033[31m❌ 完整性校验失败：${file} 文件过大 (${fsize} bytes)，疑似注入攻击！\033[0m"
+        exit 1
+    fi
+}
+
 # 传递中断引信
 trap 'exit 1' INT QUIT TERM
 
@@ -19,6 +40,12 @@ for mod in "${MODULES[@]}"; do
         echo -e "\033[31m❌ 致命错误：中枢依赖模块 [${mod}] 装载失败！\033[0m"
         exit 1
     fi
+    # [安全修复] 下载后校验完整性再执行
+    verify_magic "${SECURE_TMP}/${mod}"
+    bash -n "${SECURE_TMP}/${mod}" >/dev/null 2>&1 || {
+        echo -e "\033[31m❌ 语法校验失败：${mod} 脚本格式异常，已熔断！\033[0m"
+        exit 1
+    }
     source "${SECURE_TMP}/${mod}"
 done
 

install/env_setup.sh

@@ -1,4 +1,5 @@
 #!/bin/bash
+# IPS-MAGIC:IP-SENTINEL-ENV-SETUP-v4.3.0
 # ==========================================================
 # 模块名称: env_setup.sh
 # 核心功能: 靶机架构预检、多分支包管理器依赖补全

install/master_setup.sh

@@ -1,4 +1,5 @@
 #!/bin/bash
+# IPS-MAGIC:IP-SENTINEL-MASTER-SETUP-v4.3.0
 # ==========================================================
 # 模块名称: master_setup.sh
 # 核心功能: Master 环境清洗、令牌交互、SQLite 建库、守护进程注入与结果呈现

install/net_engine.sh

@@ -1,4 +1,5 @@
 #!/bin/bash
+# IPS-MAGIC:IP-SENTINEL-NET-ENGINE-v4.3.0
 # ==========================================================
 # 模块名称: net_engine.sh
 # 核心功能: 冗余网络栈探测、多出口容灾弹匣装填、老节点平滑迁移网络配置

install/sys_daemon.sh

@@ -1,4 +1,5 @@
 #!/bin/bash
+# IPS-MAGIC:IP-SENTINEL-SYSDAEMON-v4.3.0
 # ==========================================================
 # 模块名称: sys_daemon.sh
 # 核心功能: 安装前物理清洗、双缓冲下载执行域、Systemd/Cron 进程注入

install/ui_menu.sh

@@ -1,4 +1,5 @@
 #!/bin/bash
+# IPS-MAGIC:IP-SENTINEL-UI-MENU-v4.3.0
 # ==========================================================
 # 模块名称: ui_menu.sh
 # 核心功能: 交互式状态机、LBS 地图解析、Telegram 控制中枢配置