359 lines
17 KiB
Swift
359 lines
17 KiB
Swift
import Foundation
|
||
import Localization
|
||
import Network
|
||
|
||
/// 出口检测的一个目标：CleanIP 的国内回显、Cloudflare，或一个常用网站。
|
||
/// 做法参照 cleanip.io/outbound：回显端点直接返回它看到的来源 IP；接入 Cloudflare 的网站读 /cdn-cgi/trace，
|
||
/// 能实测访问它时的出口、节点与国家；其余网站只能测连通与延迟，出口按规则推断
|
||
public struct EgressTarget: Sendable, Hashable, Identifiable {
|
||
public enum Region: String, Sendable, Codable { case domestic, international }
|
||
|
||
public enum Category: String, Sendable, CaseIterable {
|
||
case ai, media, social, developer, common, domestic
|
||
}
|
||
|
||
enum Probe: Sendable, Hashable {
|
||
/// Cloudflare 的 /cdn-cgi/trace
|
||
case trace
|
||
/// 回显 JSON：{"ip": "…"}
|
||
case echo(path: String)
|
||
/// 只测连通与延迟：请求一个很小的资源，收到任何 HTTP 响应都算通
|
||
case reach(path: String, head: Bool)
|
||
}
|
||
|
||
public let id: String
|
||
public let name: String
|
||
public let host: String
|
||
public let category: Category
|
||
/// Resources/Logos 里的图标名
|
||
public let logo: String?
|
||
let probe: Probe
|
||
|
||
public var region: Region { category == .domestic || id == Self.domestic.id ? .domestic : .international }
|
||
|
||
/// 能读出这次连接的出口；否则只知道通不通
|
||
public var measuresExit: Bool {
|
||
if case .reach = probe { return false }
|
||
return true
|
||
}
|
||
|
||
var isIPv6Literal: Bool { host.contains(":") }
|
||
|
||
var url: URL {
|
||
let path = switch probe {
|
||
case .trace: "/cdn-cgi/trace"
|
||
case .echo(let path), .reach(let path, _): path
|
||
}
|
||
return URL(string: "https://\(isIPv6Literal ? "[\(host)]" : host)\(path)")!
|
||
}
|
||
|
||
/// CleanIP 的国内回显机，用 IP 访问：代理规则里的 GEOIP,CN 能命中它，按域名分流的用户也会直连
|
||
public static let domestic = EgressTarget(id: "domestic", name: "CleanIP", host: "124.222.230.137",
|
||
category: .common, logo: nil, probe: .echo(path: "/"))
|
||
/// 用 IP 访问，不经过 DNS，也就不受 fake-ip 与域名规则影响
|
||
public static let cloudflare = EgressTarget(id: "cloudflare", name: "Cloudflare", host: "1.1.1.1",
|
||
category: .common, logo: nil, probe: .trace)
|
||
public static let cloudflareIPv6 = EgressTarget(id: "cloudflare-ipv6", name: "Cloudflare", host: "2606:4700:4700::1111",
|
||
category: .common, logo: nil, probe: .trace)
|
||
|
||
/// 三条路线都要测的基准目标
|
||
public static let baseline = [domestic, cloudflare, cloudflareIPv6]
|
||
|
||
/// 精选网站，只按系统代理测。能读 trace 的优先用 trace（实测出口）
|
||
public static let sites: [EgressTarget] = [
|
||
trace("chatgpt.com", "ChatGPT", .ai, "openai"),
|
||
trace("claude.ai", "Claude", .ai, "claude"),
|
||
reach("gemini.google.com", "Gemini", .ai, "gemini"),
|
||
trace("grok.com", "Grok", .ai, "grok"),
|
||
trace("www.perplexity.ai", "Perplexity", .ai, "perplexity"),
|
||
trace("www.midjourney.com", "Midjourney", .ai, "midjourney"),
|
||
reach("www.youtube.com", "YouTube", .media, "youtube", path: "/generate_204", head: false),
|
||
reach("www.netflix.com", "Netflix", .media, "netflix"),
|
||
reach("www.tiktok.com", "TikTok", .media, "tiktok"),
|
||
reach("www.twitch.tv", "Twitch", .media, "twitch"),
|
||
trace("x.com", "X", .social, "x"),
|
||
reach("telegram.org", "Telegram", .social, "telegram"),
|
||
reach("www.instagram.com", "Instagram", .social, "instagram"),
|
||
reach("discord.com", "Discord", .social, "discord"),
|
||
reach("www.reddit.com", "Reddit", .social, "reddit"),
|
||
reach("github.com", "GitHub", .developer, "github"),
|
||
trace("www.npmjs.com", "npm", .developer, "npm"),
|
||
trace("hub.docker.com", "Docker Hub", .developer, "docker"),
|
||
reach("www.google.com", "Google", .common, "google", path: "/generate_204", head: false),
|
||
trace("www.cloudflare.com", "Cloudflare", .common, "cloudflare"),
|
||
reach("www.baidu.com", tr("百度"), .domestic, "baidu"),
|
||
reach("www.taobao.com", tr("淘宝"), .domestic, "taobao"),
|
||
reach("www.bilibili.com", tr("哔哩哔哩"), .domestic, "bilibili"),
|
||
reach("www.douyin.com", tr("抖音"), .domestic, "douyin"),
|
||
reach("weixin.qq.com", tr("微信"), .domestic, "wechat"),
|
||
]
|
||
|
||
public static let all = baseline + sites
|
||
|
||
private static func trace(_ host: String, _ name: String, _ category: Category, _ logo: String) -> EgressTarget {
|
||
EgressTarget(id: host, name: name, host: host, category: category, logo: "site-" + logo, probe: .trace)
|
||
}
|
||
|
||
/// 默认用 HEAD 请求 favicon：响应小、不跳转到大页面
|
||
private static func reach(_ host: String, _ name: String, _ category: Category, _ logo: String,
|
||
path: String = "/favicon.ico", head: Bool = true) -> EgressTarget {
|
||
EgressTarget(id: host, name: name, host: host, category: category, logo: "site-" + logo, probe: .reach(path: path, head: head))
|
||
}
|
||
}
|
||
|
||
/// 请求怎么发出去
|
||
public enum EgressRoute: String, Sendable, Codable, CaseIterable {
|
||
/// 按系统代理设置发出（URLSession），浏览器等大多数应用都是这样
|
||
case system
|
||
/// 不读代理设置，直接建连接，走系统路由表；VPN 或增强模式会接管它
|
||
case socket
|
||
/// 绑定物理网卡并忽略代理，绕开 VPN 与代理，得到本机网络原本的出口
|
||
case interface
|
||
}
|
||
|
||
/// 一次测量：某个目标经某条路线看到的出口
|
||
public struct EgressHit: Sendable, Codable, Equatable {
|
||
public var targetID: String
|
||
public var route: EgressRoute
|
||
public var ip: String?
|
||
/// Cloudflare 给出的出口国家
|
||
public var country: String?
|
||
/// Cloudflare 接入节点（机场代码）
|
||
public var colo: String?
|
||
public var milliseconds: Int?
|
||
|
||
public init(targetID: String, route: EgressRoute, ip: String? = nil, country: String? = nil, colo: String? = nil,
|
||
milliseconds: Int? = nil) {
|
||
self.targetID = targetID
|
||
self.route = route
|
||
self.ip = ip
|
||
self.country = country
|
||
self.colo = colo
|
||
self.milliseconds = milliseconds
|
||
}
|
||
}
|
||
|
||
/// 出口 IP 的归属地与类型，来自 cleanip.io
|
||
public struct EgressGeo: Sendable, Codable, Equatable {
|
||
public var countryCode: String?
|
||
public var region: String?
|
||
public var city: String?
|
||
public var regionEnglish: String?
|
||
public var cityEnglish: String?
|
||
public var asn: String?
|
||
public var organization: String?
|
||
public var ipType: String?
|
||
public var isNative: Bool?
|
||
|
||
init(_ info: PublicAddressLookup.GeoInfo) {
|
||
countryCode = info.countryCode
|
||
region = info.region
|
||
city = info.city
|
||
regionEnglish = info.regionEnglish
|
||
cityEnglish = info.cityEnglish
|
||
asn = info.asn
|
||
organization = info.organization
|
||
ipType = info.ipType
|
||
isNative = info.isNative
|
||
}
|
||
}
|
||
|
||
public enum EgressProber {
|
||
static let timeout: TimeInterval = 5
|
||
/// 同时进行的请求数：太多会把慢线路上的正常站点挤成超时
|
||
static let concurrency = 10
|
||
|
||
private static let session: URLSession = {
|
||
let configuration = URLSessionConfiguration.ephemeral
|
||
configuration.timeoutIntervalForRequest = timeout
|
||
configuration.timeoutIntervalForResource = timeout + 2
|
||
configuration.requestCachePolicy = .reloadIgnoringLocalCacheData
|
||
configuration.httpShouldSetCookies = false
|
||
configuration.waitsForConnectivity = false
|
||
configuration.httpAdditionalHeaders = ["User-Agent": "OpenStats"]
|
||
return URLSession(configuration: configuration)
|
||
}()
|
||
|
||
/// 所有要做的测量：基准目标三条路线各一次在前（结论靠它们），精选网站只按系统代理测
|
||
public static var jobCount: Int { EgressTarget.baseline.count * 3 + EgressTarget.sites.count }
|
||
|
||
/// `progress` 每完成一项回调一次（已完成数）
|
||
public static func measure(interfaceName: String?, progress: @escaping @Sendable (Int) -> Void = { _ in }) async -> [EgressHit] {
|
||
let interface = await physicalInterface(named: interfaceName)
|
||
var jobs: [(EgressTarget, EgressRoute)] = []
|
||
for target in EgressTarget.baseline {
|
||
jobs.append((target, .system))
|
||
jobs.append((target, .socket))
|
||
jobs.append((target, .interface))
|
||
}
|
||
jobs += EgressTarget.sites.map { ($0, .system) }
|
||
|
||
return await withTaskGroup(of: (Int, EgressHit).self) { group in
|
||
var results = [EgressHit?](repeating: nil, count: jobs.count)
|
||
var next = 0
|
||
var done = 0
|
||
while next < min(concurrency, jobs.count) {
|
||
let (index, job) = (next, jobs[next])
|
||
group.addTask { (index, await measure(job.0, route: job.1, interface: interface)) }
|
||
next += 1
|
||
}
|
||
for await (index, hit) in group {
|
||
results[index] = hit
|
||
done += 1
|
||
progress(done)
|
||
if next < jobs.count {
|
||
let (index, job) = (next, jobs[next])
|
||
group.addTask { (index, await measure(job.0, route: job.1, interface: interface)) }
|
||
next += 1
|
||
}
|
||
}
|
||
return results.compactMap { $0 }
|
||
}
|
||
}
|
||
|
||
/// 系统代理路线先预热一次（建连、握手、代理选路），再计时请求一次，延迟更接近真实往返；
|
||
/// 另外两条路线只用于读出口，请求一次即可
|
||
static func measure(_ target: EgressTarget, route: EgressRoute, interface: NWInterface?) async -> EgressHit {
|
||
var hit = EgressHit(targetID: target.id, route: route)
|
||
if route == .interface && interface == nil { return hit }
|
||
let clock = ContinuousClock()
|
||
var start = clock.now
|
||
guard var response = await fetch(target, route: route, interface: interface) else { return hit }
|
||
if route == .system {
|
||
start = clock.now
|
||
if let timed = await fetch(target, route: route, interface: interface) { response = timed }
|
||
}
|
||
let elapsed = clock.now - start
|
||
hit.milliseconds = Int((Double(elapsed.components.seconds) * 1000 + Double(elapsed.components.attoseconds) / 1e15).rounded())
|
||
|
||
switch target.probe {
|
||
case .trace:
|
||
let fields = PublicAddressLookup.parseTrace(String(decoding: response, as: UTF8.self))
|
||
hit.ip = fields["ip"]
|
||
hit.country = fields["loc"].flatMap(PublicAddressLookup.validCountryCode)
|
||
hit.colo = fields["colo"].flatMap { $0.isEmpty ? nil : $0 }
|
||
case .echo:
|
||
let ip = (try? JSONDecoder().decode([String: String].self, from: response))?["ip"]?
|
||
.trimmingCharacters(in: .whitespacesAndNewlines)
|
||
hit.ip = ip.flatMap { PublicAddressLookup.isAddress($0) ? $0 : nil }
|
||
case .reach:
|
||
break
|
||
}
|
||
// 基准目标就是用来读出口的，没读到地址（比如被拦截页顶替）就算没连上；网站只要有响应就算通
|
||
if EgressTarget.baseline.contains(target) && hit.ip == nil { hit.milliseconds = nil }
|
||
return hit
|
||
}
|
||
|
||
/// 连上了返回响应体（HEAD 为空数据）；读出口的目标要求 200，只测连通的收到任何 HTTP 响应都算
|
||
private static func fetch(_ target: EgressTarget, route: EgressRoute, interface: NWInterface?) async -> Data? {
|
||
switch route {
|
||
case .system:
|
||
var request = URLRequest(url: target.url)
|
||
if case .reach(_, let head) = target.probe, head { request.httpMethod = "HEAD" }
|
||
guard let (data, response) = try? await session.data(for: request),
|
||
let status = (response as? HTTPURLResponse)?.statusCode else { return nil }
|
||
return target.measuresExit ? (status == 200 ? data : nil) : data
|
||
case .socket:
|
||
return ok(await AddressFamilyRequest.get(target.url, ipv6: target.isIPv6Literal, timeout: timeout,
|
||
options: .init(bypassProxies: true)))
|
||
case .interface:
|
||
guard let interface else { return nil }
|
||
return ok(await AddressFamilyRequest.get(target.url, ipv6: target.isIPv6Literal, timeout: timeout,
|
||
options: .init(interface: interface, bypassProxies: true)))
|
||
}
|
||
}
|
||
|
||
// MARK: 归属地
|
||
|
||
/// 查某条路线出口的归属地。cleanip.io 只查请求方自己，所以请求必须沿这条路线发出：
|
||
/// 系统代理路线直接请求；网卡路线先经同一块网卡向 Cloudflare DoH 解析 cleanip.io，再连解析到的 IP，
|
||
/// 避免拿到代理下发的 fake-ip。返回 cleanip.io 看到的地址与结果
|
||
public static func geo(route: EgressRoute, ipv6: Bool, interfaceName: String?) async -> (ip: String, geo: EgressGeo)? {
|
||
let url = PublicAddressLookup.cleanIPURL
|
||
let body: Data?
|
||
switch route {
|
||
case .system:
|
||
body = await get(url)
|
||
case .socket:
|
||
body = ok(await AddressFamilyRequest.get(url, ipv6: ipv6, timeout: timeout, options: .init(bypassProxies: true)))
|
||
case .interface:
|
||
guard let interface = await physicalInterface(named: interfaceName),
|
||
let address = await resolve("cleanip.io", ipv6: ipv6, interface: interface) else { return nil }
|
||
body = ok(await AddressFamilyRequest.get(url, ipv6: ipv6, timeout: timeout,
|
||
options: .init(interface: interface, address: address, bypassProxies: true)))
|
||
}
|
||
guard let body, let info = PublicAddressLookup.parseCleanIP(body), let ip = info.ip else { return nil }
|
||
return (ip, EgressGeo(info))
|
||
}
|
||
|
||
/// 经指定网卡用 DoH（JSON 格式）解析域名。某些线路上连不上 Cloudflare，依次换 Google、阿里
|
||
static func resolve(_ name: String, ipv6: Bool, interface: NWInterface) async -> String? {
|
||
let servers = ipv6
|
||
? ["[2606:4700:4700::1111]/dns-query", "[2001:4860:4860::8888]/resolve", "[2400:3200::1]/resolve"]
|
||
: ["1.1.1.1/dns-query", "8.8.8.8/resolve", "223.5.5.5/resolve"]
|
||
for server in servers {
|
||
guard let url = URL(string: "https://\(server)?name=\(name)&type=\(ipv6 ? 28 : 1)") else { continue }
|
||
if let body = ok(await AddressFamilyRequest.get(url, ipv6: ipv6, timeout: timeout,
|
||
options: .init(interface: interface, bypassProxies: true,
|
||
accept: "application/dns-json"))),
|
||
let address = parseDoH(body, ipv6: ipv6) {
|
||
return address
|
||
}
|
||
}
|
||
return nil
|
||
}
|
||
|
||
static func parseDoH(_ body: Data, ipv6: Bool) -> String? {
|
||
struct Response: Decodable {
|
||
struct Answer: Decodable {
|
||
let type: Int
|
||
let data: String
|
||
}
|
||
let Answer: [Answer]?
|
||
}
|
||
let type = ipv6 ? 28 : 1
|
||
return (try? JSONDecoder().decode(Response.self, from: body))?.Answer?
|
||
.first { $0.type == type && PublicAddressLookup.isAddress($0.data) }?.data
|
||
}
|
||
|
||
// MARK: 工具
|
||
|
||
private static func get(_ url: URL) async -> Data? {
|
||
ok(await PublicAddressLookup.getWithStatus(url, session: session))
|
||
}
|
||
|
||
/// 按接口名找到 Network.framework 的网卡对象；VPN 开着时它仍在可用接口里
|
||
static func physicalInterface(named name: String?) async -> NWInterface? {
|
||
let interfaces = await withCheckedContinuation { (continuation: CheckedContinuation<[NWInterface], Never>) in
|
||
let monitor = NWPathMonitor()
|
||
let resumed = ResumeOnce()
|
||
monitor.pathUpdateHandler = { path in
|
||
guard resumed.claim() else { return }
|
||
monitor.cancel()
|
||
continuation.resume(returning: path.availableInterfaces)
|
||
}
|
||
monitor.start(queue: DispatchQueue(label: "OpenStats.EgressProber.interfaces"))
|
||
}
|
||
if let name, let match = interfaces.first(where: { $0.name == name }) { return match }
|
||
return interfaces.first { $0.type == .wifi || $0.type == .wiredEthernet }
|
||
}
|
||
}
|
||
|
||
private final class ResumeOnce: @unchecked Sendable {
|
||
private let lock = NSLock()
|
||
private var done = false
|
||
|
||
func claim() -> Bool {
|
||
lock.lock()
|
||
defer { lock.unlock() }
|
||
guard !done else { return false }
|
||
done = true
|
||
return true
|
||
}
|
||
}
|
||
|
||
/// 只要 200 的响应体
|
||
private func ok(_ response: (Data?, Int)) -> Data? {
|
||
response.1 == 200 ? response.0 : nil
|
||
}
|