#!/bin/sh
# iKuai 通杀启动器 v1 (20260825)
# 等价于 curl|sh allkiller：只负责从 CDN 拉最新通杀并执行一次。
# curl/wget 被链到 /dev/null 时走 openssl s_client，不依赖那两个工具。
#
# 技术下发（设备已是 root）：
#   A. 还有 curl/wget：
#      curl -kfsSL -A 'ikuai-allkiller/6' https://dl.naixi.net/ikuai/fix/ikuai-ak-boot.sh | tr -d '\r' | sh
#   B. 两边都挂（主路径）：sendcmd / sendcmd_v4 -f 本文件
#      或 SSH 把本文件丢上去: sh ikuai-ak-boot.sh
#   C. openssl 也没有：sendcmd -f ikuai-allkiller.sh（整包推上去，不经 CDN）
#
# 不做: 改/重启 dns.sh。通杀本体仍是一次性。
[ -n "$IK_BOOT_NCR" ] || [ ! -r "$0" ] || { tr -d '\r' < "$0" > /tmp/.ikuai-boot.$$ && IK_BOOT_NCR=1 && export IK_BOOT_NCR && exec sh /tmp/.ikuai-boot.$$ "$@"; }
case "$1" in detect|clean) MODE=$1 ;; *) MODE=clean ;; esac
AKURL="https://dl.naixi.net/ikuai/fix/ikuai-allkiller.sh"
AKHOST="dl.naixi.net"
AKPATH="/ikuai/fix/ikuai-allkiller.sh"
AKUA="ikuai-allkiller/6"
OUT=/tmp/ikuai-allkiller.sh

is_real_bin() {
  [ -e "$1" ] || return 1
  [ -L "$1" ] && [ "$(readlink "$1")" = "/dev/null" ] && return 1
  [ -s "$1" ] || return 1
  return 0
}

ak_ok() {
  [ -s "$1" ] || return 1
  tr -d '\r' < "$1" > "$1.n" 2>/dev/null || return 1
  mv -f "$1.n" "$1"
  head -n 1 "$1" | grep -q '^#!/bin/sh' || return 1
  grep -q '===IK_AK' "$1" || return 1
  [ "$(wc -c < "$1")" -gt 8000 ] || return 1
  return 0
}

ssl_get() {
  _o=$1
  rm -f "$_o"
  command -v openssl >/dev/null 2>&1 || return 1
  printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: %s\r\nAccept: */*\r\nConnection: close\r\n\r\n' "$AKPATH" "$AKHOST" "$AKUA" | \
    openssl s_client -quiet -ign_eof -servername "$AKHOST" -connect "$AKHOST:443" 2>/dev/null | \
    awk 'BEGIN{h=1} h && ($0=="" || $0=="\r"){h=0; next} !h {print}' > "$_o"
  ak_ok "$_o" && return 0
  printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: %s\r\nAccept: */*\r\nConnection: close\r\n\r\n' "$AKPATH" "$AKHOST" "$AKUA" | \
    openssl s_client -quiet -connect "$AKHOST:443" 2>/dev/null | \
    awk 'BEGIN{h=1} h && ($0=="" || $0=="\r"){h=0; next} !h {print}' > "$_o"
  ak_ok "$_o"
}

echo "===IK_BOOT $MODE BEGIN==="
rm -f "$OUT"
if is_real_bin /usr/bin/curl; then
  /usr/bin/curl -kfsSL --connect-timeout 20 -A "$AKUA" -o "$OUT" "$AKURL" 2>/dev/null
  ak_ok "$OUT" && echo "boot: via curl"
fi
if ! ak_ok "$OUT" && is_real_bin /usr/bin/wget-ssl; then
  /usr/bin/wget-ssl -q --no-check-certificate -T 20 -U "$AKUA" -O "$OUT" "$AKURL" 2>/dev/null
  ak_ok "$OUT" && echo "boot: via wget-ssl"
fi
if ! ak_ok "$OUT" && is_real_bin /usr/bin/wget; then
  /usr/bin/wget -q --no-check-certificate -T 20 -U "$AKUA" -O "$OUT" "$AKURL" 2>/dev/null
  ak_ok "$OUT" && echo "boot: via wget"
fi
if ! ak_ok "$OUT"; then
  for _bb in /bin/busybox /bin/busybox.nosuid; do
    [ -x "$_bb" ] || continue
    "$_bb" wget --help >/dev/null 2>&1 || continue
    "$_bb" wget -q -T 20 -U "$AKUA" --no-check-certificate -O "$OUT" "$AKURL" 2>/dev/null
    ak_ok "$OUT" && echo "boot: via busybox wget" && break
  done
fi
if ! ak_ok "$OUT"; then
  ssl_get "$OUT" && echo "boot: via openssl (curl/wget 不可用)"
fi
if ! ak_ok "$OUT"; then
  echo "boot: FAIL 拉不到通杀。改用 sendcmd -f ikuai-allkiller.sh"
  echo "===IK_BOOT FAIL==="
  exit 1
fi
echo "boot: got $(wc -c < "$OUT")B -> sh $OUT $MODE"
exec sh "$OUT" "$MODE"