65 lines
2.4 KiB
Python
65 lines
2.4 KiB
Python
"""VPN-aware chain leak detection."""
|
|
from __future__ import annotations
|
|
|
|
|
|
def is_same_subnet(ip_a: str | None, ip_b: str | None, prefix_len: int = 16) -> bool:
|
|
"""True if two IPv4 addresses share the same /prefix_len subnet."""
|
|
if not ip_a or not ip_b:
|
|
return False
|
|
try:
|
|
a_parts = [int(x) for x in ip_a.split(".")]
|
|
b_parts = [int(x) for x in ip_b.split(".")]
|
|
if len(a_parts) != 4 or len(b_parts) != 4:
|
|
return False
|
|
|
|
def to_int(parts: list[int]) -> int:
|
|
return (parts[0] << 24) | (parts[1] << 16) | (parts[2] << 8) | parts[3]
|
|
|
|
mask = (0xFFFFFFFF << (32 - prefix_len)) & 0xFFFFFFFF
|
|
return (to_int(a_parts) & mask) == (to_int(b_parts) & mask)
|
|
except Exception:
|
|
return False
|
|
|
|
|
|
def is_chain_leak(exit_ip: str | None, real_ip: str | None, vpn_active: bool) -> bool:
|
|
"""True when the chain is not forwarding (traffic still looks like direct/VPN exit).
|
|
|
|
With VPN: compare /16 — VPN IPs rotate but stay in-provider ranges.
|
|
Without VPN: exact IP match only (avoid false positives on same ISP /16).
|
|
|
|
**Fail-closed**: when ``real_ip`` is unknown we cannot prove the chain is
|
|
safe, so we conservatively return ``True``. The service loop applies a
|
|
short warm-up grace period before this verdict kicks in so a transient
|
|
direct-IP lookup failure doesn't cause perpetual rotation.
|
|
"""
|
|
if not exit_ip:
|
|
return True
|
|
if not real_ip:
|
|
# Fail-closed: README promises "fail closed" when trust dies.
|
|
return True
|
|
if exit_ip == real_ip:
|
|
return True
|
|
if vpn_active:
|
|
return is_same_subnet(exit_ip, real_ip)
|
|
return False
|
|
|
|
|
|
def leak_reason(exit_ip: str | None, real_ip: str | None, vpn_active: bool) -> str:
|
|
if not exit_ip:
|
|
return "exit IP unreachable"
|
|
if not real_ip:
|
|
return (
|
|
"direct IP unknown — cannot prove the chain is forwarding "
|
|
"(fail-closed). Check internet connectivity and ip_check_url."
|
|
)
|
|
if exit_ip == real_ip:
|
|
if vpn_active:
|
|
return f"exit {exit_ip} equals VPN/direct IP (chain not forwarding)"
|
|
return f"exit {exit_ip} equals your real IP (no anonymization)"
|
|
if vpn_active and is_same_subnet(exit_ip, real_ip):
|
|
return (
|
|
f"exit {exit_ip} shares /16 with direct {real_ip} "
|
|
"(likely exiting via VPN tunnel, not proxy chain)"
|
|
)
|
|
return "ok"
|