#!/bin/bash
# 查 api.trycloudflare.com 是不是也被 DNS 劫持了。
#
# 隧道一直在报：
#     Post "https://api.trycloudflare.com/tunnel": context deadline exceeded
# 而我们刚刚才发现 api.cloudflare.com 被劫持到 141.193.154.210。
# 很可能同一个劫持设备把 trycloudflare 也劫了 —— 那才是隧道时好时坏的真正原因。
set -u

echo "===== 1. 解析结果 ====="
for host in api.trycloudflare.com trycloudflare.com api.cloudflare.com; do
    V4=$(getent ahostsv4 "$host" 2>/dev/null | awk 'NR==1{print $1}')
    printf "  %-26s -> %s\n" "$host" "${V4:-解析不出来}"
done

echo
echo "===== 2. 这个 IP 是不是 Cloudflare 的 ====="
check_ip() {
    case "$1" in
        104.16.*|104.17.*|104.18.*|104.19.*|104.20.*|104.21.*|172.64.*|172.66.*|172.67.*|162.159.*|188.114.*|141.193.*)
            if [ "${1#141.193.}" != "$1" ]; then
                echo "    ✗ $1 是 141.193 网段 —— 疑似运营商劫持设备"
            else
                echo "    ✓ $1 是 Cloudflare 网段"
            fi
            ;;
        *) echo "    ? $1 不属于已知的 Cloudflare 网段" ;;
    esac
}
for host in api.trycloudflare.com api.cloudflare.com; do
    V4=$(getent ahostsv4 "$host" 2>/dev/null | awk 'NR==1{print $1}')
    echo "  $host:"
    [ -n "$V4" ] && check_ip "$V4"
done

echo
echo "===== 3. 实测连不连得上 ====="
for host in api.trycloudflare.com api.cloudflare.com; do
    echo "  --- $host ---"
    timeout 15 curl -4 -v -o /dev/null "https://$host" 2>&1 \
        | grep -E 'Trying|Connected|self-signed|SSL certificate|HTTP/' \
        | head -4 | sed 's/^/      /'
done

echo
echo "===== 4. 找 api.trycloudflare.com 的真实 IP ====="
echo "  用公共 DNS 查（绕开本地劫持）："
for dns in 1.1.1.1 8.8.8.8; do
    echo "    经 $dns:"
    timeout 8 nslookup api.trycloudflare.com "$dns" 2>/dev/null \
        | grep -A6 'Name:' | grep -E 'Address' | head -4 | sed 's/^/      /'
done

echo
echo "===== 5. 用真实 IP 试着连 ====="
# trycloudflare 和 cloudflare 走同一套边缘，用已知真实 IP 试
for ip in 104.16.132.229 104.17.0.1; do
    C=$(timeout 10 curl -4 -s -o /dev/null -w '%{http_code}' \
        --resolve "api.trycloudflare.com:443:$ip" \
        https://api.trycloudflare.com/ 2>/dev/null)
    printf "  经 %-16s -> %s\n" "$ip" "${C:-超时}"
done

echo
echo "===== 6. 结论 ====="
TRY_IP=$(getent ahostsv4 api.trycloudflare.com 2>/dev/null | awk 'NR==1{print $1}')
case "$TRY_IP" in
    141.193.*)
        echo "  ✗ api.trycloudflare.com 也被劫持到 $TRY_IP"
        echo "    → 这就是隧道一直 context deadline exceeded 的真正原因"
        echo "    → 修法：同样的 hosts 钉 IP"
        ;;
    "")
        echo "  ✗ 解析不出来"
        ;;
    *)
        echo "  api.trycloudflare.com 解析到 $TRY_IP"
        C=$(timeout 10 curl -4 -s -o /dev/null -w '%{http_code}' https://api.trycloudflare.com/ 2>/dev/null)
        echo "  实测 HTTP ${C:-超时}"
        if [ "${C:-000}" = "000" ]; then
            echo "  → 连不上。可能也是劫持，或者被限流"
        else
            echo "  → 能连上，那隧道失败是 Cloudflare 侧限流"
        fi
        ;;
esac