Initialize Clash Web source and deployment documentation

scripts/diagnose-subscription.py

@@ -0,0 +1,83 @@
+#!/usr/bin/env python3
+"""Read-only VM diagnostics. Never prints subscription URLs or node credentials."""
+import argparse
+import json
+import os
+from pathlib import Path
+import sqlite3
+import subprocess
+import sys
+from urllib.parse import urlsplit
+
+parser = argparse.ArgumentParser(description=__doc__)
+parser.add_argument('--host', required=True, help='Hostname of a saved subscription')
+parser.add_argument('--data-dir', default='/var/lib/clashweb')
+parser.add_argument('--proxy', help='Override the saved VM Mihomo HTTP proxy address')
+args = parser.parse_args()
+if os.geteuid() != 0:
+    raise SystemExit('Run with sudo to read the protected VM database; all network tests run as user clashweb.')
+database = (Path(args.data_dir) / 'clashweb.sqlite').resolve()
+with sqlite3.connect(database.as_uri() + '?mode=ro', uri=True) as db:
+    row = db.execute("SELECT value FROM kv WHERE key='state'").fetchone()
+if not row:
+    raise SystemExit('No saved state found.')
+state = json.loads(row[0])
+settings = state.get('settings', {})
+proxy = args.proxy or f"http://{settings.get('lanIP') or '127.0.0.1'}:{settings.get('mixedPort', 7890)}"
+subscriptions = [s for s in state.get('subscriptions', []) if urlsplit(s.get('url', '')).hostname == args.host]
+if not subscriptions:
+    raise SystemExit('No saved subscription matches this hostname.')
+code = r'''
+import hashlib,json,os,pathlib,socket,ssl,time,urllib.error,urllib.request
+from urllib.parse import urlsplit
+payload=json.loads(__import__('sys').stdin.read())
+url=payload['url'];host=urlsplit(url).hostname
+class SafeRedirect(urllib.request.HTTPRedirectHandler):
+ max_redirections=5
+ def redirect_request(self,request,fp,code,msg,headers,newurl):
+  target=urlsplit(newurl)
+  if target.scheme not in ('http','https') or target.username is not None:
+   raise urllib.error.URLError('Unsupported redirect')
+  return super().redirect_request(request,fp,code,msg,headers,newurl)
+verify=ssl.get_default_verify_paths()
+result={'host':host,'runAsUID':os.getuid(),'caBundleExists':bool(verify.cafile and pathlib.Path(verify.cafile).exists()),'utcTime':time.strftime('%Y-%m-%dT%H:%M:%SZ',time.gmtime()),'tests':[]}
+try:
+ addresses=socket.getaddrinfo(host,443,type=socket.SOCK_STREAM)
+ result['systemDNSAddresses']=sorted({a[4][0] for a in addresses})
+except Exception as error:result['systemDNSError']=type(error).__name__
+for mode,proxy in [('direct',{}),('vm-proxy',{'http':payload['proxy'],'https':payload['proxy']})]:
+ started=time.monotonic();entry={'mode':mode}
+ try:
+  opener=urllib.request.build_opener(urllib.request.ProxyHandler(proxy),SafeRedirect())
+  request=urllib.request.Request(url,headers={'User-Agent':'clash.meta/ClashWeb'})
+  try:response=opener.open(request,timeout=20)
+  except urllib.error.HTTPError as error:response=error
+  with response:
+   body=response.read(8*1024*1024+1)
+   entry.update({'httpStatus':response.status,'contentType':response.headers.get('Content-Type'),'bytes':len(body),'sha256':hashlib.sha256(body).hexdigest(),'hasClashProxies':b'proxies:' in body,'cfChallenge':response.headers.get('cf-mitigated')=='challenge'})
+ except Exception as error:
+  reason=getattr(error,'reason',error)
+  entry['errorType']=type(reason).__name__
+  if isinstance(reason,ssl.SSLCertVerificationError):
+   entry['certificateErrorCode']=reason.verify_code;entry['detail']=reason.verify_message
+  elif isinstance(reason,socket.gaierror):entry['detail']='System DNS lookup failed'
+  elif isinstance(reason,(socket.timeout,TimeoutError)):entry['detail']='Connection or read timed out'
+  else:
+   entry['detail']='Network connection failed'
+   if getattr(reason,'errno',None) is not None:entry['errno']=reason.errno
+ entry['seconds']=round(time.monotonic()-started,2);result['tests'].append(entry)
+print(json.dumps(result,ensure_ascii=False,indent=2))
+'''
+for subscription in subscriptions:
+    try:
+        result = subprocess.run(
+            ['/usr/bin/sudo', '-n', '-u', 'clashweb', 'python3', '-c', code],
+            input=json.dumps({'url': subscription['url'], 'proxy': proxy}),
+            text=True, capture_output=True, timeout=60,
+        )
+    except subprocess.TimeoutExpired:
+        raise SystemExit('Diagnostics timed out; inspect VM system DNS and connectivity.')
+    if result.returncode:
+        print('Diagnostics subprocess failed; no stored URL or subscription body has been printed.', file=sys.stderr)
+        raise SystemExit(result.returncode)
+    print(result.stdout.strip())