evo-cli 0.24.0__tar.gz → 0.25.1__tar.gz

{evo_cli-0.24.0 → evo_cli-0.25.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: evo_cli
-Version: 0.24.0
+Version: 0.25.1
 Summary: Evolution CLI - a developer toolbox for setting up dev machines
 Author: maycuatroi
 Project-URL: Homepage, https://github.com/maycuatroi/evo-cli

evo_cli-0.25.1/evo_cli/VERSION

@@ -0,0 +1 @@
+0.25.1

{evo_cli-0.24.0 → evo_cli-0.25.1}/evo_cli/cli.py

@@ -20,6 +20,7 @@ from evo_cli.commands.netcheck import netcheck
 from evo_cli.commands.ngrok import setup_ngrok
 from evo_cli.commands.opencode import setup_opencode
 from evo_cli.commands.plantuml import plantuml
+from evo_cli.commands.route import route_group
 from evo_cli.commands.serp import serp_group, setup_serp
 from evo_cli.commands.site2s import site2s
 from evo_cli.commands.ssh import setupssh
@@ -79,6 +80,7 @@ cli.add_command(localproxy)
 cli.add_command(mcp_group)
 cli.add_command(netcheck)
 cli.add_command(plantuml)
+cli.add_command(route_group)
 cli.add_command(serp_group)
 cli.add_command(sysmon)
 cli.add_command(tts_group)

evo_cli-0.25.1/evo_cli/commands/route/__init__.py

@@ -0,0 +1,33 @@
+import rich_click as click
+
+from evo_cli.commands.route.check import check
+from evo_cli.commands.route.fix import close_route, open_route
+from evo_cli.commands.route.probe import probe
+from evo_cli.commands.route.status import status
+
+HELP = """Find a way through to somewhere the network is keeping from you.
+
+Two blocks look identical from a browser and need opposite fixes. A **poisoned
+DNS** answer hands you a dead address while the route itself stays open, so
+pinning the real address fixes it. A **DPI filter** reading the server name out
+of your TLS handshake blocks every address for that name, and no hosts or DNS
+edit can touch it.
+
+- `check <host>` - what stands in the way, and which of the two it is
+- `probe <host>` - every address for the name, ranked by what answers
+- `open <host>` - apply the fix the diagnosis calls for
+- `close <host>` - undo it again
+- `status` - which fixes are currently in place
+
+`check` and `probe` are pure Python sockets and need no privileges. `open` and
+`close` edit hosts or manage a service, so they want administrator rights.
+"""
+
+
+@click.group("route", help=HELP)
+def route_group():
+    pass
+
+
+for command in (check, probe, open_route, close_route, status):
+    route_group.add_command(command)

evo_cli-0.25.1/evo_cli/commands/route/_dns.py

@@ -0,0 +1,142 @@
+from __future__ import annotations
+
+import json as jsonlib
+import socket
+import struct
+import urllib.error
+import urllib.parse
+import urllib.request
+
+PORT = 443
+
+PUBLIC_RESOLVERS = [
+    ("8.8.8.8", "google"),
+    ("1.1.1.1", "cloudflare"),
+    ("9.9.9.9", "quad9"),
+    ("208.67.222.222", "opendns"),
+]
+
+VN_RESOLVERS = [
+    ("210.245.0.10", "fpt"),
+    ("203.113.131.1", "vnpt"),
+    ("183.91.160.11", "viettel"),
+]
+
+DOH_ENDPOINT = "https://dns.google/resolve"
+
+# A resolver that answers with one of these is not answering, it is lying: an
+# ISP hijack points the name at the machine itself or at the resolver's own
+# address so the connection dies locally instead of visibly being blocked.
+BOGUS_PREFIXES = ("127.", "0.")
+
+
+def _encode_qname(host):
+    out = bytearray()
+    for label in host.rstrip(".").split("."):
+        raw = label.encode("idna") if any(ord(c) > 127 for c in label) else label.encode()
+        out.append(len(raw))
+        out.extend(raw)
+    out.append(0)
+    return bytes(out)
+
+
+def _skip_name(data, off):
+    while off < len(data):
+        length = data[off]
+        if length == 0:
+            return off + 1
+        if length & 0xC0 == 0xC0:
+            return off + 2
+        off += 1 + length
+    return off
+
+
+def query_a(host, resolver, timeout=2.5):
+    header = struct.pack(">HHHHHH", 0x4242, 0x0100, 1, 0, 0, 0)
+    packet = header + _encode_qname(host) + struct.pack(">HH", 1, 1)
+    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+    sock.settimeout(timeout)
+    try:
+        sock.sendto(packet, (resolver, 53))
+        data, _ = sock.recvfrom(4096)
+    except OSError:
+        return None
+    finally:
+        sock.close()
+
+    if len(data) < 12:
+        return None
+    ancount = struct.unpack(">H", data[6:8])[0]
+    off = _skip_name(data, 12) + 4
+    found = []
+    for _ in range(ancount):
+        off = _skip_name(data, off)
+        if off + 10 > len(data):
+            break
+        rtype, _rclass, _ttl, rdlength = struct.unpack(">HHIH", data[off : off + 10])
+        off += 10
+        rdata = data[off : off + rdlength]
+        off += rdlength
+        if rtype == 1 and rdlength == 4:
+            found.append(socket.inet_ntop(socket.AF_INET, rdata))
+    return found
+
+
+def system_resolve(host):
+    try:
+        infos = socket.getaddrinfo(host, PORT, socket.AF_INET, socket.SOCK_STREAM)
+    except socket.gaierror:
+        return None
+    seen = []
+    for info in infos:
+        ip = info[4][0]
+        if ip not in seen:
+            seen.append(ip)
+    return seen
+
+
+def doh_resolve(host, timeout=8.0):
+    url = f"{DOH_ENDPOINT}?name={urllib.parse.quote(host)}&type=A"
+    request = urllib.request.Request(url, headers={"accept": "application/dns-json", "User-Agent": "evo-cli/route"})
+    try:
+        with urllib.request.urlopen(request, timeout=timeout) as response:
+            payload = jsonlib.loads(response.read().decode("utf-8", "replace"))
+    except (urllib.error.URLError, OSError, ValueError, TimeoutError):
+        return None
+    return [a["data"] for a in payload.get("Answer") or [] if a.get("type") == 1]
+
+
+def is_bogus(ip):
+    return any(ip.startswith(prefix) for prefix in BOGUS_PREFIXES)
+
+
+def gather(host, timeout=2.5, include_vn=True):
+    resolvers = list(PUBLIC_RESOLVERS)
+    if include_vn:
+        resolvers += VN_RESOLVERS
+
+    answers = {}
+    for address, label in resolvers:
+        answers[label] = query_a(host, address, timeout)
+
+    doh = doh_resolve(host)
+    if doh is not None:
+        answers["doh"] = doh
+
+    return {
+        "system": system_resolve(host),
+        "resolvers": answers,
+        "trusted": _trusted_union(answers),
+    }
+
+
+def _trusted_union(answers):
+    trusted_labels = {label for _, label in PUBLIC_RESOLVERS} | {"doh"}
+    out = []
+    for label, ips in answers.items():
+        if label not in trusted_labels or not ips:
+            continue
+        for ip in ips:
+            if not is_bogus(ip) and ip not in out:
+                out.append(ip)
+    return out

evo_cli-0.25.1/evo_cli/commands/route/_dpi.py

@@ -0,0 +1,160 @@
+from __future__ import annotations
+
+import hashlib
+import os
+import subprocess
+import tempfile
+import zipfile
+from pathlib import Path
+
+from evo_cli.console import download_file, info, resolve_executable
+
+RELEASE_URL = "https://github.com/ValdikSS/GoodbyeDPI/releases/download/0.2.2/goodbyedpi-0.2.2.zip"
+RELEASE_SIZE = 635551
+RELEASE_SHA256 = "00a2f8b99cd817f8c7fc4c449033015f039d18af213de78cb66bf202277c0628"
+
+SERVICE_NAME = "GoodbyeDPI"
+
+# Deliberately NOT the bundled `-5` preset. `-5` is these flags plus
+# `--max-payload`, whose 1200-byte ceiling skips the very packet that matters:
+# a modern Chrome ClientHello carries a post-quantum key share and runs past
+# 1200 bytes, so it sails through untouched while curl - whose ClientHello is
+# small - looks like it works. Without --max-payload both are handled.
+DEFAULT_ARGS = ["-f", "2", "-e", "2", "--auto-ttl", "--reverse-frag"]
+
+
+def is_windows():
+    return os.name == "nt"
+
+
+def is_admin():
+    if not is_windows():
+        return os.geteuid() == 0 if hasattr(os, "geteuid") else False
+    try:
+        import ctypes
+
+        return bool(ctypes.windll.shell32.IsUserAnAdmin())
+    except Exception:
+        return False
+
+
+def install_dir():
+    root = os.environ.get("ProgramFiles", r"C:\Program Files")
+    return Path(root) / "GoodbyeDPI"
+
+
+def executable():
+    return install_dir() / "x86_64" / "goodbyedpi.exe"
+
+
+def _sc(*args, check=False):
+    cmd = resolve_executable(["sc.exe", *args])
+    return subprocess.run(
+        cmd,
+        capture_output=True,
+        text=True,
+        encoding="utf-8",
+        errors="replace",
+        check=check,
+    )
+
+
+def service_state():
+    if not is_windows():
+        return {"installed": False, "running": False, "args": None, "reason": "windows only"}
+    result = _sc("qc", SERVICE_NAME)
+    if result.returncode != 0:
+        return {"installed": False, "running": False, "args": None, "reason": None}
+
+    binary = None
+    for line in (result.stdout or "").splitlines():
+        if "BINARY_PATH_NAME" in line:
+            binary = line.split(":", 1)[1].strip()
+            break
+
+    query = _sc("query", SERVICE_NAME)
+    running = "RUNNING" in (query.stdout or "")
+    return {"installed": True, "running": running, "args": binary, "reason": None}
+
+
+def verify_download(path):
+    size = Path(path).stat().st_size
+    if size != RELEASE_SIZE:
+        return False, f"size mismatch: got {size}, expected {RELEASE_SIZE}"
+    digest = hashlib.sha256(Path(path).read_bytes()).hexdigest()
+    if digest != RELEASE_SHA256:
+        return False, f"sha256 mismatch: got {digest}"
+    return True, None
+
+
+def fetch(destination=None):
+    destination = Path(destination or (Path(tempfile.gettempdir()) / "goodbyedpi-0.2.2.zip"))
+    download_file(RELEASE_URL, destination, description="GoodbyeDPI 0.2.2")
+    ok, reason = verify_download(destination)
+    if not ok:
+        destination.unlink(missing_ok=True)
+        raise RuntimeError(f"refusing to install a tampered download - {reason}")
+    return destination
+
+
+def unpack(archive, target=None):
+    target = Path(target or install_dir())
+    target.mkdir(parents=True, exist_ok=True)
+    with tempfile.TemporaryDirectory() as tmp:
+        with zipfile.ZipFile(archive) as zf:
+            zf.extractall(tmp)
+        root = next(Path(tmp).glob("goodbyedpi-*"))
+        source = root / "x86_64"
+        dest = target / "x86_64"
+        dest.mkdir(parents=True, exist_ok=True)
+        for item in source.iterdir():
+            dest.joinpath(item.name).write_bytes(item.read_bytes())
+    return target
+
+
+def install_service(args=None):
+    args = list(args or DEFAULT_ARGS)
+    binary = f'"{executable()}" ' + " ".join(args)
+
+    existing = service_state()
+    if existing["installed"]:
+        _sc("stop", SERVICE_NAME)
+        _sc("delete", SERVICE_NAME)
+
+    # sc.exe wants "binPath=" and its value as two separate argv entries. Passing
+    # an explicit list keeps that shape; a shell would glue them and sc would
+    # silently print its usage instead of creating anything.
+    created = _sc("create", SERVICE_NAME, "binPath=", binary, "start=", "auto")
+    if created.returncode != 0:
+        raise RuntimeError((created.stdout or created.stderr or "sc create failed").strip())
+    _sc("description", SERVICE_NAME, "Passive DPI blocker and Active DPI circumvention utility")
+    return binary
+
+
+def start():
+    result = _sc("start", SERVICE_NAME)
+    return result.returncode == 0 or "ALREADY_RUNNING" in (result.stdout or "")
+
+
+def stop():
+    result = _sc("stop", SERVICE_NAME)
+    return result.returncode == 0 or "NOT_ACTIVE" in (result.stdout or "")
+
+
+def remove():
+    stop()
+    result = _sc("delete", SERVICE_NAME)
+    return result.returncode == 0
+
+
+def ensure(args=None):
+    state = service_state()
+    if not executable().exists():
+        info("GoodbyeDPI is not installed yet, fetching it")
+        archive = fetch()
+        unpack(archive)
+        Path(archive).unlink(missing_ok=True)
+    if not state["installed"]:
+        install_service(args)
+    start()
+    return service_state()

evo_cli-0.25.1/evo_cli/commands/route/_hosts.py

@@ -0,0 +1,91 @@
+from __future__ import annotations
+
+import os
+import re
+import shutil
+import time
+from pathlib import Path
+
+MARK_START = "# >>> evo route >>>"
+MARK_END = "# <<< evo route <<<"
+
+BLOCK_RE = re.compile(
+    re.escape(MARK_START) + r".*?" + re.escape(MARK_END) + r"\r?\n?",
+    re.DOTALL,
+)
+
+
+def hosts_path():
+    if os.name == "nt":
+        root = os.environ.get("SystemRoot", r"C:\Windows")
+        return Path(root) / "System32" / "drivers" / "etc" / "hosts"
+    return Path("/etc/hosts")
+
+
+def read_block(path=None):
+    path = Path(path) if path else hosts_path()
+    try:
+        raw = path.read_text(encoding="utf-8", errors="replace")
+    except OSError:
+        return {}
+    match = BLOCK_RE.search(raw)
+    if not match:
+        return {}
+    entries = {}
+    for line in match.group(0).splitlines():
+        line = line.strip()
+        if not line or line.startswith("#"):
+            continue
+        parts = line.split()
+        if len(parts) >= 2:
+            entries[parts[1]] = parts[0]
+    return entries
+
+
+def backup(path=None):
+    path = Path(path) if path else hosts_path()
+    stamp = time.strftime("%Y%m%d-%H%M%S")
+    target = path.with_name(path.name + f".evo-route.{stamp}")
+    shutil.copy2(path, target)
+    return target
+
+
+def write_block(entries, path=None, make_backup=True):
+    path = Path(path) if path else hosts_path()
+    raw = path.read_text(encoding="utf-8", errors="replace")
+    if make_backup:
+        backup(path)
+
+    raw = BLOCK_RE.sub("", raw)
+    if raw and not raw.endswith("\n"):
+        raw += "\n"
+
+    if entries:
+        lines = [MARK_START]
+        for host in sorted(entries):
+            lines.append(f"{entries[host]}  {host}")
+        lines.append(MARK_END)
+        raw += "\n".join(lines) + "\n"
+
+    path.write_text(raw, encoding="utf-8")
+    return path
+
+
+def pin(host, ip, path=None, make_backup=True):
+    entries = read_block(path)
+    entries[host] = ip
+    write_block(entries, path=path, make_backup=make_backup)
+    return entries
+
+
+def unpin(host, path=None, make_backup=True):
+    entries = read_block(path)
+    if host not in entries:
+        return entries, False
+    entries.pop(host)
+    write_block(entries, path=path, make_backup=make_backup)
+    return entries, True
+
+
+def clear(path=None, make_backup=True):
+    write_block({}, path=path, make_backup=make_backup)

evo_cli-0.25.1/evo_cli/commands/route/_probe.py

@@ -0,0 +1,122 @@
+from __future__ import annotations
+
+import socket
+import ssl
+import time
+
+from evo_cli.commands.route import _dns
+
+PORT = 443
+
+# A name nobody blocks, used as the control in the SNI experiment below.
+CONTROL_SNI = "example.com"
+
+OPEN = "open"
+DNS_POISONED = "dns-poisoned"
+SNI_BLOCKED = "sni-blocked"
+IP_BLOCKED = "ip-blocked"
+UNREACHABLE = "unreachable"
+
+VERDICT_TEXT = {
+    OPEN: "reachable - nothing in the way",
+    DNS_POISONED: "DNS is poisoned, the route itself is open",
+    SNI_BLOCKED: "DPI blocks the TLS handshake by server name",
+    IP_BLOCKED: "the address itself is blocked or dead",
+    UNREACHABLE: "no address answers at all",
+}
+
+
+def _ms(start):
+    return (time.perf_counter() - start) * 1000
+
+
+def tls_probe(ip, sni, timeout=6.0):
+    """Open one TLS connection to ``ip`` announcing ``sni``.
+
+    Certificate checking is off on purpose: the question is whether the
+    handshake is allowed to finish, not whether the certificate matches the
+    name we announced.
+    """
+    result = {"ip": ip, "sni": sni, "tcp": False, "tls": False, "ms": None, "error": None, "reset": False}
+    started = time.perf_counter()
+    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    sock.settimeout(timeout)
+    try:
+        sock.connect((ip, PORT))
+        result["tcp"] = True
+        context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+        context.check_hostname = False
+        context.verify_mode = ssl.CERT_NONE
+        with context.wrap_socket(sock, server_hostname=sni):
+            result["tls"] = True
+            result["ms"] = _ms(started)
+    except ConnectionResetError as exc:
+        result["error"] = str(exc)
+        result["reset"] = True
+    except TimeoutError as exc:
+        result["error"] = f"timeout: {exc}"
+    except ssl.SSLError as exc:
+        result["error"] = str(exc)
+        result["reset"] = "reset" in str(exc).lower() or "ILLEGAL_MESSAGE" in str(exc)
+    except OSError as exc:
+        result["error"] = str(exc)
+    finally:
+        try:
+            sock.close()
+        except OSError:
+            pass
+    return result
+
+
+def rank(host, candidates, timeout=6.0):
+    rows = []
+    for ip in candidates:
+        row = tls_probe(ip, host, timeout=timeout)
+        rows.append(row)
+    rows.sort(key=lambda r: (not r["tls"], r["ms"] if r["ms"] is not None else 1e9))
+    return rows
+
+
+def diagnose(host, timeout=6.0, include_vn=True):
+    answers = _dns.gather(host, include_vn=include_vn)
+    system_ips = answers["system"] or []
+    trusted = answers["trusted"]
+
+    poisoned = bool(system_ips) and all(_dns.is_bogus(ip) for ip in system_ips)
+    if not poisoned and system_ips and trusted:
+        poisoned = not set(system_ips) & set(trusted) and any(_dns.is_bogus(ip) for ip in system_ips)
+
+    candidates = trusted or [ip for ip in system_ips if not _dns.is_bogus(ip)]
+    probes = rank(host, candidates, timeout=timeout) if candidates else []
+    working = [row for row in probes if row["tls"]]
+
+    control = None
+    if candidates and not working:
+        control = tls_probe(candidates[0], CONTROL_SNI, timeout=timeout)
+
+    verdict = _verdict(candidates, probes, working, control, poisoned)
+
+    return {
+        "host": host,
+        "verdict": verdict,
+        "poisoned": poisoned,
+        "system_ips": system_ips,
+        "answers": answers["resolvers"],
+        "candidates": candidates,
+        "probes": probes,
+        "working": working,
+        "control": control,
+        "best": working[0]["ip"] if working else None,
+    }
+
+
+def _verdict(candidates, probes, working, control, poisoned):
+    if not candidates:
+        return UNREACHABLE
+    if working:
+        return DNS_POISONED if poisoned else OPEN
+    if control and control["tls"]:
+        return SNI_BLOCKED
+    if any(row["tcp"] for row in probes):
+        return IP_BLOCKED
+    return UNREACHABLE