zhangxiaokun
29cf67154a
基于 v46 正式版(mt76)只恢复 UI 层: - luci-theme-argon 2.4.3: local-background-wins 登录页 + bg1.jpg fallback - luci-app-argon-config: 去 ui.changes.apply, ACL mutator 移 write - luci-app-wgtunnel: rpcd ucode 后端(get/status/prepare/apply/rollback/reconnect), JSONMap 前端, 60s 一次性 token, 快照回滚, 无全局 network ACL - luci-app-tr3000-status: 只读 rpcd ucode + 5s 轮询仪表盘 - tools/: audit_ui_packages.py + install_preview.sh + rollback_watchdog.sh - docs/: 开发经历与翻车记录 + 固件哈希记录 固件本体(含烤入 WG 私钥/PSK)不入 git, 仅 K 盘保存. kernel 成员与 v46 byte-identical; 尚未刷机.
32 lines
1.2 KiB
Bash
32 lines
1.2 KiB
Bash
#!/usr/bin/env bash
|
|
# Verify the immutable v46 network surface is unchanged after the plugin
|
|
# preview install. Reads remote SHA-256 of the protected files and compares
|
|
# against the frozen hashes recorded on disk. Strictly read-only.
|
|
|
|
set -euo pipefail
|
|
|
|
ROUTER="${ROUTER:-root@192.168.1.2}"
|
|
HASH_FILE="${HASH_FILE:?usage: verify_immutable.sh /path/to/hashes.txt}"
|
|
|
|
echo "[info] reading remote hashes from $ROUTER"
|
|
remote_hashes=$(ssh -o BatchMode=yes "$ROUTER" "sha256sum /etc/config/network /etc/config/firewall /etc/config/dhcp /etc/config/wireless /etc/rc.local /etc/hotplug.d/iface/20-vxlan /etc/hotplug.d/iface/30-mss-clamp /usr/share/nftables.d/chain-pre/mangle_forward/30-mss-clamp.nft 2>/dev/null" | sort)
|
|
|
|
echo "[info] comparing against $HASH_FILE"
|
|
while read -r expected_hash rest; do
|
|
[ -z "$expected_hash" ] && continue
|
|
remote_line=$(echo "$remote_hashes" | awk -v want="$rest" '$2 == want {print}')
|
|
if [ -z "$remote_line" ]; then
|
|
echo "MISSING: $rest"
|
|
exit 1
|
|
fi
|
|
if [ "${remote_line%% *}" != "$expected_hash" ]; then
|
|
echo "DRIFT: $rest"
|
|
echo " expected $expected_hash"
|
|
echo " got ${remote_line%% *}"
|
|
exit 1
|
|
fi
|
|
echo "OK: $rest"
|
|
done < "$HASH_FILE"
|
|
|
|
echo "[ok] all immutable files match frozen hashes"
|