evo-cli 0.32.0__tar.gz → 0.32.1__tar.gz

{evo_cli-0.32.0 → evo_cli-0.32.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: evo_cli
-Version: 0.32.0
+Version: 0.32.1
 Summary: Evolution CLI - a developer toolbox for setting up dev machines
 Author: maycuatroi
 Project-URL: Homepage, https://github.com/maycuatroi/evo-cli

evo_cli-0.32.1/evo_cli/VERSION

@@ -0,0 +1 @@
+0.32.1

{evo_cli-0.32.0 → evo_cli-0.32.1}/evo_cli/commands/route/_probe.py

@@ -13,6 +13,7 @@ CONTROL_SNI = "example.com"
 
 OPEN = "open"
 DNS_POISONED = "dns-poisoned"
+ADDRESS_BLOCKED = "address-blocked"
 SNI_BLOCKED = "sni-blocked"
 IP_BLOCKED = "ip-blocked"
 UNREACHABLE = "unreachable"
@@ -20,6 +21,7 @@ UNREACHABLE = "unreachable"
 VERDICT_TEXT = {
     OPEN: "reachable - nothing in the way",
     DNS_POISONED: "DNS is poisoned, the route itself is open",
+    ADDRESS_BLOCKED: "the address your system resolves is blocked, another one works",
     SNI_BLOCKED: "DPI blocks the TLS handshake by server name",
     IP_BLOCKED: "the address itself is blocked or dead",
     UNREACHABLE: "no address answers at all",
@@ -103,24 +105,32 @@ def rank(host, candidates, timeout=6.0):
     return rows
 
 
+def candidates(answers):
+    """The system's own addresses first, since those are what a browser connects to, then every trusted one."""
+    system = [ip for ip in answers["system"] or [] if not _dns.is_bogus(ip)]
+    return system + [ip for ip in answers["trusted"] if ip not in system]
+
+
 def diagnose(host, timeout=6.0, include_vn=True):
     answers = _dns.gather(host, include_vn=include_vn)
     system_ips = answers["system"] or []
     trusted = answers["trusted"]
 
-    poisoned = bool(system_ips) and all(_dns.is_bogus(ip) for ip in system_ips)
+    # A name the system cannot resolve at all, while trusted resolvers can, is as dead to a browser as a bogus one.
+    poisoned = (bool(system_ips) and all(_dns.is_bogus(ip) for ip in system_ips)) or (not system_ips and bool(trusted))
     if not poisoned and system_ips and trusted:
         poisoned = not set(system_ips) & set(trusted) and any(_dns.is_bogus(ip) for ip in system_ips)
 
-    candidates = trusted or [ip for ip in system_ips if not _dns.is_bogus(ip)]
-    probes = rank(host, candidates, timeout=timeout) if candidates else []
+    addresses = candidates(answers)
+    probes = rank(host, addresses, timeout=timeout) if addresses else []
     working = [row for row in probes if row["tls"]]
+    system_ok = any(row["ip"] in system_ips for row in working)
 
     control = None
-    if candidates and not working:
-        control = tls_probe(candidates[0], CONTROL_SNI, timeout=timeout)
+    if addresses and not working:
+        control = tls_probe(addresses[0], CONTROL_SNI, timeout=timeout)
 
-    verdict = _verdict(candidates, probes, working, control, poisoned)
+    verdict = _verdict(addresses, probes, working, control, poisoned, system_ok)
 
     return {
         "host": host,
@@ -128,7 +138,7 @@ def diagnose(host, timeout=6.0, include_vn=True):
         "poisoned": poisoned,
         "system_ips": system_ips,
         "answers": answers["resolvers"],
-        "candidates": candidates,
+        "candidates": addresses,
         "probes": probes,
         "working": working,
         "control": control,
@@ -136,11 +146,14 @@ def diagnose(host, timeout=6.0, include_vn=True):
     }
 
 
-def _verdict(candidates, probes, working, control, poisoned):
+def _verdict(candidates, probes, working, control, poisoned, system_ok=True):
     if not candidates:
         return UNREACHABLE
     if working:
-        return DNS_POISONED if poisoned else OPEN
+        if poisoned:
+            return DNS_POISONED
+        # Some address works, but not the one the system hands the browser: the name only opens once it is pinned.
+        return OPEN if system_ok else ADDRESS_BLOCKED
     if control and control["tls"]:
         return SNI_BLOCKED
     if any(row["tcp"] for row in probes):

{evo_cli-0.32.0 → evo_cli-0.32.1}/evo_cli/commands/route/check.py

@@ -24,6 +24,7 @@ EPILOG = Text.from_markup(
 VERDICT_STYLE = {
     _probe.OPEN: "success",
     _probe.DNS_POISONED: "warning",
+    _probe.ADDRESS_BLOCKED: "warning",
     _probe.SNI_BLOCKED: "error",
     _probe.IP_BLOCKED: "error",
     _probe.UNREACHABLE: "error",
@@ -32,6 +33,7 @@ VERDICT_STYLE = {
 ADVICE = {
     _probe.OPEN: "Nothing to do.",
     _probe.DNS_POISONED: "Run `evo route open {host}` to pin the working address, or fix DNS at the source.",
+    _probe.ADDRESS_BLOCKED: "Run `evo route open {host}` to pin the working address.",
     _probe.SNI_BLOCKED: "hosts and DNS cannot help here. Run `evo route open {host}` to bring up the DPI bypass.",
     _probe.IP_BLOCKED: "The address answers TCP but nothing completes - you need a tunnel or VPN.",
     _probe.UNREACHABLE: "No address resolved or answered. Check the name, then your link.",
@@ -92,6 +94,9 @@ def render(report):
         success(f"{host} is reachable. {message}")
     elif verdict == _probe.DNS_POISONED:
         warning(f"DNS hands back a bogus address for {host}, but {report['best']} works. {message}")
+    elif verdict == _probe.ADDRESS_BLOCKED:
+        dead = ", ".join(report["system_ips"])
+        warning(f"{host} resolves to {dead}, which is blocked, but {report['best']} works. {message}")
     else:
         error(f"{host}: {_probe.VERDICT_TEXT[verdict]}. {message}")
 

{evo_cli-0.32.0 → evo_cli-0.32.1}/evo_cli/commands/route/fix.py

@@ -130,7 +130,7 @@ def open_route(host, method, dry_run, timeout):
         if verdict == _probe.OPEN:
             success(f"{host} is already reachable - nothing to do.")
             return report
-        if verdict == _probe.DNS_POISONED:
+        if verdict in (_probe.DNS_POISONED, _probe.ADDRESS_BLOCKED):
             method = "hosts"
         elif verdict == _probe.SNI_BLOCKED:
             method = "dpi"

{evo_cli-0.32.0 → evo_cli-0.32.1}/evo_cli/commands/route/probe.py

@@ -37,7 +37,7 @@ def probe(host, timeout, show_all, no_vn, as_json):
         with console.status(f"[info]collecting addresses for {host}...[/info]", spinner="dots"):
             answers = _dns.gather(host, include_vn=not no_vn)
 
-        candidates = answers["trusted"] or [ip for ip in (answers["system"] or []) if not _dns.is_bogus(ip)]
+        candidates = _probe.candidates(answers)
         if not candidates:
             error(f"No usable address for {host}.")
             sys.exit(1)
@@ -61,13 +61,13 @@ def probe(host, timeout, show_all, no_vn, as_json):
     table.add_column("time")
     table.add_column("seen from")
 
-    origin = _origin_map(answers["resolvers"])
+    origin = _origin_map({"system": answers["system"], **answers["resolvers"]})
     for row in shown:
         table.add_row(
             row["ip"],
             "[success]ok[/success]" if row["tls"] else "[error]blocked[/error]",
             f"{row['ms']:.0f}ms" if row["ms"] is not None else "-",
-            ", ".join(origin.get(row["ip"], [])) or "[dim]system[/dim]",
+            ", ".join(origin.get(row["ip"], [])),
         )
     console.print()
     console.print(table)

{evo_cli-0.32.0 → evo_cli-0.32.1}/evo_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: evo_cli
-Version: 0.32.0
+Version: 0.32.1
 Summary: Evolution CLI - a developer toolbox for setting up dev machines
 Author: maycuatroi
 Project-URL: Homepage, https://github.com/maycuatroi/evo-cli

{evo_cli-0.32.0 → evo_cli-0.32.1}/tests/test_route.py

@@ -123,6 +123,52 @@ def test_verdict_unreachable_when_tcp_never_opens():
     assert _probe._verdict(["1.2.3.4"], probes, [], control, False) == _probe.UNREACHABLE
 
 
+def test_verdict_address_blocked_when_only_a_foreign_address_works():
+    probes = [_probe_row("5.6.7.8", tls=True), _probe_row("1.2.3.4", tcp=False)]
+    assert _probe._verdict(["1.2.3.4", "5.6.7.8"], probes, probes[:1], None, False, False) == _probe.ADDRESS_BLOCKED
+
+
+def _fake_network(monkeypatch, system, trusted, live):
+    """Resolvers answer with ``system`` and ``trusted``; only the addresses in ``live`` finish a handshake."""
+    answers = {"system": system, "resolvers": {"doh": trusted}, "trusted": trusted}
+    monkeypatch.setattr(_dns, "gather", lambda host, include_vn=True: answers)
+    tried = []
+
+    def tls_probe(ip, sni, timeout=6.0):
+        tried.append(ip)
+        return _probe_row(ip, tcp=ip in live, tls=ip in live)
+
+    monkeypatch.setattr(_probe, "tls_probe", tls_probe)
+    return tried
+
+
+def test_diagnose_probes_the_address_the_system_uses(monkeypatch):
+    # www.facebook.com, 2026-10: the system answer is a real Meta address that the network drops,
+    # while the one DoH hands out works. Testing only the DoH address read that as open.
+    tried = _fake_network(monkeypatch, ["57.144.64.1"], ["157.240.13.35"], {"157.240.13.35"})
+    report = _probe.diagnose("www.facebook.com")
+    assert "57.144.64.1" in tried
+    assert report["verdict"] == _probe.ADDRESS_BLOCKED
+    assert report["best"] == "157.240.13.35"
+
+
+def test_diagnose_open_when_the_system_address_works(monkeypatch):
+    _fake_network(monkeypatch, ["1.2.3.4"], ["5.6.7.8"], {"1.2.3.4", "5.6.7.8"})
+    assert _probe.diagnose("example.org")["verdict"] == _probe.OPEN
+
+
+def test_diagnose_without_a_system_answer_needs_a_pin(monkeypatch):
+    _fake_network(monkeypatch, None, ["5.6.7.8"], {"5.6.7.8"})
+    assert _probe.diagnose("example.org")["verdict"] == _probe.DNS_POISONED
+
+
+def test_open_pins_a_host_whose_system_address_is_blocked(monkeypatch):
+    _fake_network(monkeypatch, ["57.144.64.1"], ["157.240.13.35"], {"157.240.13.35"})
+    result = CliRunner().invoke(cli, ["route", "open", "www.facebook.com", "--dry-run"])
+    assert result.exit_code == 0, result.output
+    assert "Would pin" in result.output and "157.240.13.35" in result.output
+
+
 HOSTS_SAMPLE = "127.0.0.1 localhost\n192.168.1.9 nas.local\n"
 
 

evo_cli-0.32.0/evo_cli/VERSION

@@ -1 +0,0 @@
-0.32.0