mirror of
https://github.com/hotyue/IP-Sentinel.git
synced 2026-09-05 07:28:14 +08:00
refactor(docs): 启动架构文档全量重构，统一 V4.1.1 工业级防渗透注释标准，彻底抹除历史版本碎片
This commit is contained in:
hotyue
+14
-33
@@ -1,43 +1,35 @@
|
||||
#!/bin/bash
|
||||
|
||||
# ==========================================================
|
||||
# 脚本名称: updater.sh (IP-Sentinel 养料注入与分频调度中枢 - 动态锚点版)
|
||||
# 核心功能: 静默更新热数据/LBS、指纹库错峰调度、强制出站死锁、版本无缝继承
|
||||
# 脚本名称: updater.sh
|
||||
# 核心功能: 指纹防惊群错峰轮换、LBS 底层静默分发、深度探针签名防伪
|
||||
# ==========================================================
|
||||
|
||||
INSTALL_DIR="/opt/ip_sentinel"
|
||||
CONFIG_FILE="${INSTALL_DIR}/config.conf"
|
||||
UA_TIME_FILE="${INSTALL_DIR}/core/.ua_last_update"
|
||||
|
||||
# GitHub 仓库 Raw 数据直链前缀
|
||||
REPO_RAW_URL="https://raw.githubusercontent.com/hotyue/IP-Sentinel/main"
|
||||
# 临时改为开发地址用于测试
|
||||
# REPO_RAW_URL="https://raw.githubusercontent.com/hotyue/IP-Sentinel/v3.6.2-rc"
|
||||
|
||||
# 1. 加载本地冷数据配置
|
||||
# --- [底层数据链装载] ---
|
||||
if [ ! -f "$CONFIG_FILE" ]; then
|
||||
exit 1
|
||||
fi
|
||||
source "$CONFIG_FILE"
|
||||
|
||||
# 2. 全局日志写入函数 (v3.4.0 引入版本探针)
|
||||
# --- [全局态势日志系统] ---
|
||||
log() {
|
||||
# [v3.4.0 核心] 提取当前配置中的版本锚点
|
||||
local local_ver="${AGENT_VERSION:-未知}"
|
||||
|
||||
# 保证日志目录存在
|
||||
mkdir -p "${INSTALL_DIR}/logs"
|
||||
|
||||
# 日志格式注入 [版本号] 追踪标识
|
||||
local core_msg=$(printf "[v%-5s] [%-5s] [%-7s] [%s] %s" "$local_ver" "$2" "$1" "$REGION_CODE" "$3")
|
||||
# [时区对齐] 强制无视本地时区，以绝对 UTC 时间写入日志
|
||||
# 强制剔除节点宿主机本地时差，严格对齐指挥部 UTC 基准
|
||||
echo "[$(date -u '+%Y-%m-%d %H:%M:%S UTC')] $core_msg" >> "$LOG_FILE"
|
||||
|
||||
# 强制推送到 Systemd Journal (如果系统支持)
|
||||
if command -v logger >/dev/null 2>&1; then
|
||||
logger -t ip-sentinel "$core_msg"
|
||||
else
|
||||
# 降级输出到 stdout，让 Systemd 捕获
|
||||
echo "$core_msg"
|
||||
fi
|
||||
}
|
||||
@@ -45,16 +37,12 @@ log() {
|
||||
log "Updater" "INFO " "========== 触发后台静默 OTA 热数据更新 =========="
|
||||
|
||||
# ==========================================================
|
||||
# 🛡️ 终极护城河：构建强锚定出站的 curl 请求引擎
|
||||
# [网络路由锁定] 构建强锚定出站屏障，彻底阻断跨协议溢出逃逸
|
||||
# ==========================================================
|
||||
# 基础参数：跟随 install.sh 锁定的协议偏好 (4 或 6)
|
||||
CURL_CMD="curl -${IP_PREF:-4} -sL"
|
||||
|
||||
# 【防坑核心】如果用户配置了死锁锚点，必须强制绑定网卡，杜绝流量溢出！
|
||||
if [ -n "$BIND_IP" ]; then
|
||||
# curl 的 --interface 参数不支持带方括号的 IPv6 地址，必须强行脱壳
|
||||
RAW_BIND_IP=$(echo "$BIND_IP" | tr -d '[]')
|
||||
# [v3.6.3 容错层补丁] 探测网卡存活状态，防止 IP 漂移导致永久断网
|
||||
if ! ip addr show 2>/dev/null | grep -qw "$RAW_BIND_IP"; then
|
||||
log "Updater" "WARN " "检测到绑定的出口 IP ($RAW_BIND_IP) 已丢失，自动退回默认路由！"
|
||||
else
|
||||
@@ -63,28 +51,24 @@ if [ -n "$BIND_IP" ]; then
|
||||
fi
|
||||
|
||||
# ==========================================================
|
||||
# 3. 容灾机制拉取 UA 指纹池 (V3.3.0 引入 30 天错峰防惊群逻辑)
|
||||
# [指纹池滚动更新] 错峰调度防惊群风暴算法
|
||||
# 强制设定 30 天超长冷静期以规避 Github 限流与特征同构
|
||||
# ==========================================================
|
||||
NOW=$(date +%s)
|
||||
LAST_UPDATE=0
|
||||
|
||||
# 读取上一次更新的时间戳
|
||||
if [ -f "$UA_TIME_FILE" ]; then
|
||||
# tr -d 清除可能存在的换行或回车符，防止算术崩溃
|
||||
LAST_UPDATE=$(cat "$UA_TIME_FILE" | tr -d '\r\n')
|
||||
fi
|
||||
|
||||
# 校验数据合法性，防崩溃
|
||||
if ! [[ "$LAST_UPDATE" =~ ^[0-9]+$ ]]; then
|
||||
LAST_UPDATE=0
|
||||
fi
|
||||
|
||||
DIFF=$((NOW - LAST_UPDATE))
|
||||
|
||||
# 距离上次拉取超过 30 天 (2592000 秒)，才执行下载
|
||||
if [ "$DIFF" -ge 2592000 ] || [ "$LAST_UPDATE" -eq 0 ]; then
|
||||
TMP_UA="/tmp/ip_sentinel_ua.txt"
|
||||
# 使用重装升级后的 CURL_CMD
|
||||
$CURL_CMD "${REPO_RAW_URL}/data/user_agents.txt" -o "$TMP_UA"
|
||||
|
||||
if [ -s "$TMP_UA" ]; then
|
||||
@@ -100,9 +84,9 @@ else
|
||||
log "Updater" "INFO " "⏳ 设备指纹池处于 30 天静默期 (剩余约 ${DAYS_LEFT} 天)，跳过拉取"
|
||||
fi
|
||||
|
||||
# ==========================================================
|
||||
# 4. 容灾机制拉取当地最新搜索词库 (每日高频拉取，保证活体新鲜度)
|
||||
# ==========================================================
|
||||
# ----------------------------------------------------------
|
||||
# [态势感知热更] 动态注入本土高权热搜及战区 LBS 规则
|
||||
# ----------------------------------------------------------
|
||||
TMP_KW="/tmp/ip_sentinel_kw.txt"
|
||||
$CURL_CMD "${REPO_RAW_URL}/data/keywords/kw_${REGION_CODE}.txt" -o "$TMP_KW"
|
||||
|
||||
@@ -114,9 +98,6 @@ else
|
||||
rm -f "$TMP_KW"
|
||||
fi
|
||||
|
||||
# ==========================================================
|
||||
# 5. 自适应拉取本地 LBS 专属 JSON 规则库 (每日同步)
|
||||
# ==========================================================
|
||||
REGION_JSON_FILE=$(find "${INSTALL_DIR}/data/regions" -name "*.json" 2>/dev/null | head -n 1)
|
||||
|
||||
if [ -n "$REGION_JSON_FILE" ] && [ -f "$REGION_JSON_FILE" ]; then
|
||||
@@ -135,12 +116,12 @@ if [ -n "$REGION_JSON_FILE" ] && [ -f "$REGION_JSON_FILE" ]; then
|
||||
fi
|
||||
|
||||
# ==========================================================
|
||||
# 5.5. 容灾更新深海声呐底层探针 (彻底消除第三方 RCE 依赖)
|
||||
# [容灾校验] 外置供应链投毒防线与底层签名嗅探
|
||||
# ==========================================================
|
||||
TMP_PROBE="/tmp/ip_sentinel_probe.sh"
|
||||
$CURL_CMD "https://raw.githubusercontent.com/xykt/IPQuality/main/ip.sh" -o "$TMP_PROBE"
|
||||
|
||||
# 🛡️ 供应链防毒：验证脚本内是否包含原作者特有签名，防止被墙重定向为 HTML
|
||||
# 严格过滤无标识或 HTML 劫持阻断页面，免疫上游源的降级攻击
|
||||
if [ -s "$TMP_PROBE" ] && grep -q "xykt" "$TMP_PROBE" 2>/dev/null; then
|
||||
mv "$TMP_PROBE" "${INSTALL_DIR}/core/ip_probe.sh"
|
||||
chmod +x "${INSTALL_DIR}/core/ip_probe.sh"
|
||||
@@ -151,7 +132,7 @@ else
|
||||
fi
|
||||
|
||||
# ==========================================================
|
||||
# 6. 日志防满瘦身机制 (保留最近 2000 行)
|
||||
# [空间瘦身] 长效健康清理与爆栈预防机制
|
||||
# ==========================================================
|
||||
if [ -f "$LOG_FILE" ]; then
|
||||
tail -n 2000 "$LOG_FILE" > "${LOG_FILE}.tmp"
|
||||
|
||||
Reference in New Issue
Block a user