119 lines
4.5 KiB
Python
119 lines
4.5 KiB
Python
import time
|
||
from hyper import HTTP20Connection, HTTP11Connection
|
||
from util.thread_timeout import time_limited
|
||
from main import TIMEOUT, UN_CONNECTED, CONNECTED_HTTP1_1, CONNECTED_HTTP2_0, NOT_SUPPORT_FOR_HTTP2, \
|
||
make_doh_request_body, CERTIFICATE_VERIFY_FAILED
|
||
import threading
|
||
from util.util_http import make_ssl_context
|
||
import ssl, socket, sys, csv
|
||
from hyper.http20.exceptions import ConnectionError
|
||
from concurrent.futures import ThreadPoolExecutor
|
||
import os
|
||
|
||
root_dir = sys.path[0]
|
||
|
||
# %Y-%m-%d %H:%M:%S
|
||
datetime_str = time.strftime('%y%m%d%H', time.localtime(time.time()))
|
||
save_dir = "./verify"
|
||
if not os.path.exists(save_dir):
|
||
os.mkdir(save_dir)
|
||
save_file = os.path.join(root_dir, save_dir, f"{datetime_str}.csv")
|
||
# f_verify = csv.writer(open(f"./verify/{datetime_str}.csv", "w", newline=""))
|
||
f = open(save_file, "w", newline="")
|
||
f_verify = csv.writer(f)
|
||
# csv.writer(f_verify)
|
||
|
||
lock = threading.Lock()
|
||
|
||
body = make_doh_request_body()
|
||
|
||
|
||
@time_limited(TIMEOUT * 10)
|
||
def doh_verify(ip, port):
|
||
# print(ip, port, host, path, method)
|
||
verify_mode = ssl.CERT_OPTIONAL
|
||
|
||
ctx_2_0 = make_ssl_context()
|
||
ctx_2_0.set_alpn_protocols(['h2'])
|
||
# ctx_2_0.verify_mode = ssl.CERT_NONE
|
||
conn = HTTP20Connection(ip, port=port, ssl_context=ctx_2_0)
|
||
conn_status = UN_CONNECTED
|
||
try:
|
||
conn.connect()
|
||
conn_status = CONNECTED_HTTP2_0
|
||
# print("成功建立HTTP2.0连接！")
|
||
except (AssertionError, TimeoutError, FileNotFoundError, ConnectionResetError, ConnectionRefusedError, OSError,
|
||
ssl.SSLCertVerificationError, ssl.SSLError,
|
||
socket.timeout,
|
||
ConnectionError, # hyper error
|
||
) as e:
|
||
if e.__str__().startswith(NOT_SUPPORT_FOR_HTTP2): # 预期内的错误，继续尝试HTTP1.1
|
||
# print("建立连接失败！服务端不支持HTTP2.0，继续尝试HTTP1.1")
|
||
...
|
||
elif e.__str__().startswith(CERTIFICATE_VERIFY_FAILED): # 证书导致的错误，将sslContext设置为CERT_NONE
|
||
# print("证书原因导致连接建立失败，设置sslContext为CERT_NONE")
|
||
ctx_2_0.verify_mode = ssl.CERT_NONE
|
||
verify_mode = ssl.CERT_NONE
|
||
conn = HTTP20Connection(ip, port=port, ssl_context=ctx_2_0)
|
||
try:
|
||
conn.connect()
|
||
conn_status = CONNECTED_HTTP2_0
|
||
# print("成功建立HTTP2.0连接！")
|
||
except (
|
||
AssertionError, TimeoutError, FileNotFoundError, ConnectionResetError, ConnectionRefusedError,
|
||
OSError,
|
||
ssl.SSLCertVerificationError, ssl.SSLError,
|
||
socket.timeout,
|
||
ConnectionError, # hyper error
|
||
) as e:
|
||
# print("建立连接失败！服务端不支持HTTP2.0，继续尝试HTTP1.1")
|
||
...
|
||
else:
|
||
# print("建立连接失败！错误信息如下：", e)
|
||
return False
|
||
|
||
if conn_status == UN_CONNECTED:
|
||
ctx_1_1 = make_ssl_context()
|
||
ctx_1_1.verify_mode = verify_mode
|
||
conn = HTTP11Connection(ip, port=port, ssl_context=ctx_1_1)
|
||
try:
|
||
conn.connect()
|
||
conn_status = CONNECTED_HTTP1_1
|
||
# print("成功建立HTTP1.1连接！")
|
||
except (TimeoutError, ConnectionRefusedError, FileNotFoundError, ConnectionAbortedError,
|
||
ssl.SSLCertVerificationError, ssl.SSLError,
|
||
socket.timeout, OSError
|
||
) as e: # 如使用HTTP1.1仍然无法建立连接，则放弃
|
||
# print("建立连接失败！错误信息如下：", e)
|
||
return False
|
||
|
||
try:
|
||
cert = conn._sock.getpeercert()
|
||
except AttributeError:
|
||
cert = None
|
||
lock.acquire()
|
||
try:
|
||
f_verify.writerow([ip, cert.__str__()])
|
||
except UnicodeEncodeError:
|
||
print(ip, cert.__str__())
|
||
lock.release()
|
||
|
||
|
||
def run_with_thread_pool(max_workers, data_group, fn):
|
||
# print("Before ThreadPool!")
|
||
with ThreadPoolExecutor(max_workers=max_workers, thread_name_prefix="") as threadPool:
|
||
for data in data_group:
|
||
threadPool.submit(fn, *data)
|
||
|
||
|
||
if __name__ == '__main__':
|
||
data_group = []
|
||
with open("./suspect/no_cert_ips.csv") as fp:
|
||
csv_reader = csv.reader(fp)
|
||
for row in csv_reader:
|
||
ip = row[0]
|
||
data_group.append((ip, 443))
|
||
print(len(data_group))
|
||
run_with_thread_pool(64, data_group, doh_verify)
|
||
f.close()
|