0904

dev/eo-probe-v2.py

@@ -0,0 +1,101 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""
+EO 优选 IP 扫描 v2 (schannel 证书校验版)
+判据更严格: 用 curl (Windows schannel, 系统证书链) + --resolve 强制 SNI,
+           只有当 TLS 证书链校验通过(浏览器视角可访问)且返回 HTTP 响应才算 hit。
+这能区分 "CDN 通用池 IP (证书 *.cdn.myqcloud.com 不匹配)" 与 "真正承载目标站点的 EO 边缘"。
+用法: python eo-probe-v2.py --cidrs 43.174.246.0/24 43.174.247.0/24 ...
+"""
+import argparse
+import concurrent.futures
+import json
+import subprocess
+import time
+
+DEFAULT_CIDRS = [
+    "43.174.150.0/24", "43.174.151.0/24", "43.174.152.0/24", "43.174.153.0/24",
+    "43.174.78.0/24", "43.174.79.0/24", "43.174.57.0/24",
+    "43.175.130.0/24", "43.175.131.0/24", "43.175.132.0/24", "43.175.133.0/24",
+    "43.175.150.0/24", "43.175.151.0/24", "43.175.152.0/24",
+    "43.175.165.0/24", "43.175.166.0/24",
+    "43.175.185.0/24", "43.175.186.0/24",
+    "43.174.246.0/24", "43.174.247.0/24",  # EO 官方当前分配段(新加坡)
+]
+
+def cidr_hosts(cidr):
+    net, bits = cidr.split("/")
+    bits = int(bits)
+    a, b, c, d = map(int, net.split("."))
+    base = (a << 24) + (b << 16) + (c << 8) + d
+    count = 1 << (32 - bits)
+    for i in range(1, count - 1):
+        v = base + i
+        yield f"{(v >> 24) & 255}.{(v >> 16) & 255}.{(v >> 8) & 255}.{v & 255}"
+
+def probe(ip, host, timeout):
+    t0 = time.perf_counter()
+    # schannel on Windows: 默认走系统 CA, 证书不匹配会直接失败 => http_code 000 + 错误
+    cmd = ["curl", "-sS", "--resolve", f"{host}:443:{ip}",
+           "--connect-timeout", str(timeout), "--max-time", str(timeout * 2),
+           "-o", "NUL", "-w", "%{http_code}|%{time_total}|%{time_starttransfer}",
+           f"https://{host}/"]
+    try:
+        r = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout * 3,
+                           errors="replace")
+        out = r.stdout.strip()
+        parts = out.split("|")
+        code = parts[0] if parts else "000"
+        el = (time.perf_counter() - t0) * 1000
+        err = r.stderr.strip() if r.stderr else ""
+        if code not in ("000",):
+            return {"ip": ip, "http": code, "total_s": float(parts[1]) if len(parts) > 1 else None,
+                    "elapsed_ms": round(el, 1), "note": err.splitlines()[-1] if err else ""}
+        # 000: 看看是不是证书错误
+        note = ""
+        if "SEC_E_WRONG_PRINCIPAL" in err or "certificate" in err.lower():
+            note = "cert-mismatch"
+        elif err:
+            note = err.splitlines()[-1][:80]
+        return None
+    except Exception as e:
+        return None
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--host", default="box.shiroko.one")
+    ap.add_argument("--cidrs", nargs="*", default=None)
+    ap.add_argument("--workers", type=int, default=64)
+    ap.add_argument("--timeout", type=float, default=3)
+    ap.add_argument("--out", default="eo-hits-v2.json")
+    args = ap.parse_args()
+
+    cidrs = args.cidrs or DEFAULT_CIDRS
+    ips = []
+    for c in cidrs:
+        ips.extend(cidr_hosts(c))
+    print(f"[*] host={args.host} 段={len(cidrs)} IP={len(ips)} workers={args.workers}")
+
+    hits = []
+    t_start = time.perf_counter()
+    with concurrent.futures.ThreadPoolExecutor(max_workers=args.workers) as ex:
+        futs = {ex.submit(probe, ip, args.host, args.timeout): ip for ip in ips}
+        done = 0
+        for fut in concurrent.futures.as_completed(futs):
+            done += 1
+            r = fut.result()
+            if r:
+                hits.append(r)
+                print(f"  HIT {r['ip']:16s} http={r['http']} total={r['total_s']}s {r['note']}")
+            if done % 500 == 0:
+                print(f"  [{done}/{len(ips)}] hits={len(hits)} elapsed={time.perf_counter()-t_start:.0f}s")
+
+    print(f"\n[*] done in {time.perf_counter()-t_start:.0f}s, hits={len(hits)}")
+    if hits:
+        hits.sort(key=lambda x: x["total_s"] or 99)
+        with open(args.out, "w", encoding="utf-8") as f:
+            json.dump(hits, f, ensure_ascii=False, indent=2)
+        print(f"[*] saved: {args.out}")
+
+if __name__ == "__main__":
+    main()