#!/bin/bash
# 精确取证：--prefix 模式下，deploy.sh（及其子脚本）到底动了哪些真实系统资源。
#
# 垫片会记录**调用者**（父进程命令行），这样能分清是
# deploy.sh 自己调的，还是它拉起来的 deploy-tune.sh / net-tune.sh 调的。
set -u

SHIM=/tmp/sbxim2
SBX=/tmp/sbxroot2
LOG=$SHIM/calls.log
SCRIPT=${1:-/root/dep/deploy.sh}

rm -rf "$SHIM" "$SBX"
mkdir -p "$SHIM" "$SBX"

for cmd in systemctl iptables ip sysctl modprobe cloudflared apt-get apt \
           service journalctl useradd groupadd chmod chown ln; do
    cat > "$SHIM/$cmd" <<EOF
#!/bin/bash
# 记下调用者和完整参数
PPID_CMD=\$(tr '\0' ' ' < /proc/\$PPID/cmdline 2>/dev/null | cut -c1-90)
echo "[caller: \$PPID_CMD] $cmd \$*" >> $LOG
case "\$1" in
    is-active)  echo "active"; exit 0 ;;
    is-enabled) echo "enabled"; exit 0 ;;
    show)       echo ""; exit 0 ;;
    -S)         exit 0 ;;
esac
exit 0
EOF
    chmod +x "$SHIM/$cmd"
done
: > "$LOG"

echo "════════ 跑 deploy.sh --prefix $SBX --skip-tunnel ════════"
PATH="$SHIM:$PATH" timeout 300 bash "$SCRIPT" --prefix "$SBX" --skip-tunnel \
    > /tmp/sbx2.out 2>&1
echo "  退出码: $?"
echo "  输出末尾:"
tail -8 /tmp/sbx2.out | sed 's/^/    /'

echo
echo "════════ 1. 所有 systemctl 调用 ════════"
if grep -q 'systemctl' "$LOG"; then
    grep 'systemctl' "$LOG" | sed 's/^/  /'
else
    echo "  （没有）"
fi

echo
echo "════════ 2. 所有 iptables / ip / sysctl / modprobe 调用 ════════"
if grep -qE 'iptables|^\[caller[^]]*\] ip |sysctl|modprobe' "$LOG"; then
    grep -E 'iptables|sysctl|modprobe' "$LOG" | sed 's/^/  /' | head -25
    echo "  …（共 $(grep -cE 'iptables|sysctl|modprobe' "$LOG") 条）"
else
    echo "  （没有）"
fi

echo
echo "════════ 3. 按调用者归类 iptables ════════"
grep 'iptables' "$LOG" 2>/dev/null | sed 's/\] iptables.*/]/' | sort | uniq -c | sed 's/^/  /'

echo
echo "════════ 4. 沙箱里 service 单元的 ExecStart（看前缀有没有漏进去）════════"
for f in "$SBX"/etc/systemd/system/*.service; do
    [ -f "$f" ] || continue
    echo "  ── $(basename "$f") ──"
    grep -E '^ExecStart|^WorkingDirectory|^Environment' "$f" | sed 's/^/      /'
done

echo
echo "════════ 5. 沙箱外有没有被写 ════════"
echo "  沙箱里的文件数: $(find "$SBX" -type f 2>/dev/null | wc -l)"
echo "  检查几个关键真实路径的修改时间（今天有没有被动过）:"
for p in /etc/systemd/system /etc/sysctl.d /root/.cloudflared /root/lanremote-relay \
         /usr/local/bin/cloudflared; do
    if [ -e "$p" ]; then
        t=$(stat -c '%y' "$p" 2>/dev/null | cut -d'.' -f1)
        echo "      $p  最后修改: $t"
    else
        echo "      $p  （不存在）"
    fi
done

echo
echo "════════ 6. deploy-tune.sh 在 prefix 模式下的行为 ════════"
if [ -f /root/dep/deploy-tune.sh ]; then
    echo "  deploy-tune.sh 里的 iptables/sysctl 调用:"
    grep -nE 'iptables|sysctl|ip link|modprobe' /root/dep/deploy-tune.sh \
        | head -20 | sed 's/^/      /'
    echo
    echo "  它有没有处理 --prefix:"
    grep -n 'PREFIX' /root/dep/deploy-tune.sh | head -10 | sed 's/^/      /'
fi