73 lines
3.5 KiB
Python
73 lines
3.5 KiB
Python
#!/usr/bin/env python3
|
|
"""Run an isolated SOCKS client with strict TLS; never print QA credentials."""
|
|
import argparse
|
|
import json
|
|
import os
|
|
import pathlib
|
|
import shutil
|
|
import socket
|
|
import subprocess
|
|
import tempfile
|
|
import time
|
|
|
|
p = argparse.ArgumentParser()
|
|
p.add_argument('--qa', required=True)
|
|
p.add_argument('--binary', required=True)
|
|
p.add_argument('--expected-exit', required=True)
|
|
p.add_argument('--port', type=int, default=19080)
|
|
p.add_argument('--subscription')
|
|
a = p.parse_args()
|
|
q = json.loads(pathlib.Path(a.qa).read_text())
|
|
c = {'log': {'level': 'error'}, 'dns': {'servers': [{'type': 'local', 'tag': 'local'}]},
|
|
'inbounds': [{'type': 'mixed', 'listen': '127.0.0.1', 'listen_port': a.port}],
|
|
'outbounds': [{'type': 'anytls', 'tag': 'qa', 'server': q['host'], 'server_port': q['port'],
|
|
'password': q['uuid'], 'tls': {'enabled': True, 'server_name': q['sni'], 'insecure': False}}],
|
|
'route': {'default_domain_resolver': 'local', 'final': 'qa'}}
|
|
if a.subscription:
|
|
c = json.loads(pathlib.Path(a.subscription).read_text())
|
|
nodes = [x for x in c['outbounds'] if x.get('type') == 'anytls']
|
|
assert len(nodes) == 1 and nodes[0]['tls'].get('insecure') is False
|
|
assert nodes[0]['server'] == q['host'] and nodes[0]['server_port'] == q['port']
|
|
assert nodes[0]['password'] == q['uuid']
|
|
c['inbounds'] = [{'type': 'mixed', 'listen': '127.0.0.1', 'listen_port': a.port}]
|
|
c['log'] = {'level': 'error'}
|
|
os.umask(0o077)
|
|
with tempfile.TemporaryDirectory(prefix='dpl-client-') as d:
|
|
config = pathlib.Path(d) / 'client.json'
|
|
config.write_text(json.dumps(c))
|
|
env = dict(os.environ, GOMEMLIMIT='64MiB', GOGC='75')
|
|
with (pathlib.Path(d) / 'client.log').open('wb') as log:
|
|
proc = subprocess.Popen([a.binary, 'run', '-c', str(config)], cwd=d, env=env, stdout=log, stderr=log)
|
|
try:
|
|
for _ in range(50):
|
|
assert proc.poll() is None, 'Client exited during startup'
|
|
try:
|
|
with socket.create_connection(('127.0.0.1', a.port), 0.1):
|
|
break
|
|
except OSError:
|
|
time.sleep(0.1)
|
|
command = ['curl', '-q', '--fail', '--silent', '--show-error', '--max-time', '30',
|
|
'--socks5-hostname', f'127.0.0.1:{a.port}']
|
|
result = subprocess.run(command + ['https://api.ipify.org'], capture_output=True, text=True, check=True)
|
|
ip = result.stdout.strip()
|
|
assert ip == a.expected_exit, 'Unexpected exit IP'
|
|
result = subprocess.run(command + ['https://www.cloudflare.com/cdn-cgi/trace'], capture_output=True, text=True, check=True)
|
|
trace = dict(line.split('=', 1) for line in result.stdout.splitlines() if '=' in line)
|
|
assert trace.get('ip') == a.expected_exit, 'Second exit check mismatch'
|
|
print(json.dumps({'anytls': True, 'relay': q['host'], 'port': q['port'], 'strict_tls': True,
|
|
'exit_ip': ip, 'country': trace.get('loc'), 'https_tls': trace.get('tls')}, ensure_ascii=False))
|
|
except Exception:
|
|
log.flush()
|
|
failure = pathlib.Path(a.qa).parent / 'client-failure.log'
|
|
shutil.copyfile(pathlib.Path(d) / 'client.log', failure)
|
|
failure.chmod(0o600)
|
|
print(f'Client failed; protected diagnostic log: {failure}')
|
|
raise
|
|
finally:
|
|
proc.terminate()
|
|
try:
|
|
proc.wait(timeout=5)
|
|
except subprocess.TimeoutExpired:
|
|
proc.kill()
|
|
proc.wait()
|