agent-bypass 2.16.0 → 2.17.0

package/tests/test_regressions.py

@@ -250,5 +250,115 @@ class DoctorTests(unittest.TestCase):
             self.assertEqual(list(Path(home).rglob("*")), [], "doctor 不应写文件")
 
 
+class NetDnsScanOriginTests(unittest.TestCase):
+    """fake-IP/TUN：netdns 判定 + portscan 解析守卫 + origin_trace 解析（全部离线）。"""
+
+    @classmethod
+    def setUpClass(cls):
+        sys.path.insert(0, str(SCRIPTS))
+        import netdns
+        import portscan
+        import origin_trace
+        cls.nd = netdns
+        cls.ps = portscan
+        cls.ot = origin_trace
+
+    def test_fake_ip_ranges(self):
+        for ip in ("198.18.0.5", "198.19.255.1", "240.1.2.3", "198.51.100.7", "203.0.113.9"):
+            self.assertTrue(self.nd.is_fake_ip(ip), ip)
+        for ip in ("1.1.1.1", "8.8.8.8", "192.168.1.1", "10.0.0.1"):
+            self.assertFalse(self.nd.is_fake_ip(ip), ip)
+
+    def test_parse_dns_json(self):
+        sample = ('{"Answer":[{"type":1,"data":"93.184.216.34"},'
+                  '{"type":28,"data":"2606:2800::1"},{"type":1,"data":"198.18.0.1"}]}')
+        self.assertEqual(self.nd._parse_dns_json(sample, "A"), ["93.184.216.34", "198.18.0.1"])
+        self.assertEqual(self.nd._parse_dns_json(sample, "AAAA"), ["2606:2800::1"])
+        self.assertEqual(self.nd._parse_dns_json("not-json", "A"), [])
+
+    def test_portscan_split_host_fake_guard(self):
+        self.assertEqual(self.ps.split_host("https://example.com:8443/x"), ("example.com", 8443))
+        self.assertEqual(self.ps.split_host("1.2.3.4"), ("1.2.3.4", None))
+        self.assertIsNone(self.ps.split_host("bad host")[0])
+        self.assertTrue(self.ps.is_fake_ip("198.18.1.2"))
+        ip, src, fake = self.ps.resolve_target("198.18.1.2", mode="auto")
+        self.assertEqual((ip, src), ("198.18.1.2", "ip"))
+        self.assertEqual(fake, [])
+
+    def test_origin_trace_parsers(self):
+        ct = '[{"name_value":"a.example.com\\n*.example.com\\nother.test"}]'
+        self.assertEqual(self.ot.parse_crtsh(ct, "example.com"), ["a.example.com", "example.com"])
+        self.assertEqual(self.ot.extract_title("<title>  Hi   There </title>"), "Hi There")
+        self.assertEqual(self.ot.cdn_markers({"cf-ray": "x", "server": "nginx"}), ["cf-ray"])
+        base = {"title": "X", "server": "nginx", "status": "HTTP/1.1 200 OK", "cdn": ["cf-ray"]}
+        cand = {"title": "X", "server": "nginx", "status": "HTTP/1.1 200 OK", "cdn": [], "cert_domain_ok": True}
+        score, reasons = self.ot.score_candidate(base, cand)
+        self.assertGreaterEqual(score, 5)
+        self.assertIn("title", reasons)
+        self.assertLess(self.ot.score_candidate(base, {"cdn": ["cf-ray"]})[0], score)
+
+    def test_doh_shell_syntax(self):
+        sh = shutil.which("sh")
+        if not sh:
+            self.skipTest("no sh")
+        r = _tmp_run([sh, "-n", str(SCRIPTS / "doh_resolve.sh")])
+        self.assertEqual(r.returncode, 0, r.stderr)
+
+
+class SkillCompactTests(unittest.TestCase):
+    """SKILL.md 体积/去重回归：防止再次膨胀。"""
+
+    def test_skill_structure_and_size(self):
+        skill = (ROOT / "SKILL.md").read_text(encoding="utf-8")
+        self.assertEqual(skill.count("<!-- module:"), 35)
+        self.assertNotIn("## 修正对照", skill, "重复的修正对照表已移除，勿再加回")
+        self.assertLess(len(skill.encode("utf-8")), 132000, "SKILL.md 体积超限（保持精简，长内容放 references/）")
+
+
+class HangProtectionTests(unittest.TestCase):
+    """防卡死：DNS 硬超时、扫描总时限、溯源预算/同名 CDN 扣分（全部离线）。"""
+
+    @classmethod
+    def setUpClass(cls):
+        sys.path.insert(0, str(SCRIPTS))
+        import netdns, portscan, origin_trace
+        cls.nd = netdns
+        cls.ps = portscan
+        cls.ot = origin_trace
+
+    def test_system_resolve_hard_timeout(self):
+        import time as _t
+        orig = self.nd._system_resolve_impl
+        self.nd._system_resolve_impl = lambda name: (_t.sleep(3), ["1.2.3.4"])[1]
+        t0 = _t.monotonic()
+        try:
+            ips = self.nd.system_resolve("example.com", timeout=0.2)
+        finally:
+            self.nd._system_resolve_impl = orig
+        self.assertEqual(ips, [])
+        self.assertLess(_t.monotonic() - t0, 1.5, "system_resolve 必须有硬超时，不能挂住")
+
+    def test_portscan_total_deadline(self):
+        import asyncio, time as _t
+        found, timed_out = asyncio.run(
+            self.ps.scan("127.0.0.1", [9, 10], conc=1, timeout=0.05,
+                         deadline=_t.monotonic() - 1))
+        self.assertEqual(found, [])
+        self.assertTrue(timed_out)
+
+    def test_origin_same_cdn_penalty(self):
+        base = {"title": "X", "server": "nginx", "status": "HTTP/1.1 200 OK", "cdn": ["cf-ray"]}
+        cand_cdn = {"title": "X", "server": "nginx", "status": "HTTP/1.1 200 OK", "cdn": ["cf-ray"]}
+        cand_origin = {"title": "X", "server": "nginx", "status": "HTTP/1.1 200 OK", "cdn": []}
+        s_cdn, r_cdn = self.ot.score_candidate(base, cand_cdn)
+        s_org, r_org = self.ot.score_candidate(base, cand_origin)
+        self.assertIn("same-cdn", r_cdn)
+        self.assertLess(s_cdn, s_org)
+
+    def test_origin_bad_flag_rejected(self):
+        r = _tmp_run([sys.executable, str(SCRIPTS / "origin_trace.py"), "--bogus"])
+        self.assertEqual(r.returncode, 2)
+
+
 if __name__ == "__main__":
     unittest.main()