#!/bin/sh
# ShakerScan connection check, version 2026-11-10.
# The full report plus the checks only this machine can run, each with a result scoped to what
# it measured.
#
#   Run it:        curl -fsSL https://shakerscan.com/x | sh
#   Read it first: open https://shakerscan.com/x in a browser, or
#                  curl -fsSL https://shakerscan.com/x | less
#   For scripts:   curl -fsSL https://shakerscan.com/x | sh -s -- --json
#   Its SHA-256:   https://shakerscan.com/x.sha256
#
# Needs curl; uses dig when installed. It contacts only shakerscan.com, ShakerScan's probe
# hostnames and ShakerScan's DNS server, changes nothing on this machine and uploads no results.
# Exit status: 0 nothing found, 1 something found, 2 nothing found but a check did not run,
# 3 the report could not be fetched.
#
# Everything is inside main, called on the last line, so a download cut short runs nothing.
set -u

main() {
  zone=probe.shakerscan.com
  ns=205.251.192.197 # ns-197.awsdns-24.com, an authoritative Route 53 server for the probe zone
  https_found='' dns_found='' skipped='' rows='' json=0
  for arg in "$@"; do
    case "$arg" in
      --json) json=1 ;;
      *) echo "Unknown option: $arg (the only option is --json)" >&2; return 3 ;;
    esac
  done
  # --json: the readable output is dropped and one JSON object goes to the original stdout.
  [ "$json" -eq 1 ] && exec 3>&1 1>/dev/null
  # Colour only on a terminal; NO_COLOR (no-color.org) or TERM=dumb turns it off.
  if [ -t 1 ] && [ -z "${NO_COLOR:-}" ] && [ "${TERM:-dumb}" != dumb ]; then
    esc=$(printf '\033'); B="$esc[1m" D="$esc[2m" G="$esc[32m" R="$esc[31m" Y="$esc[33m" C="$esc[36m" N="$esc[0m"
  else B='' D='' G='' R='' Y='' C='' N=''; fi
  # say <ok|bad|warn|skip> <label> <result>: one line now, and one row for --json.
  say() {
    case "$1" in ok) c=$G ;; bad) c=$R ;; warn) c=$Y ;; *) c=$D ;; esac
    if [ "$1" = skip ]; then case ", $skipped," in *", $2,"*) ;; *) skipped="${skipped:+$skipped, }$2" ;; esac; fi
    printf '  %-13s%s%s%s\n' "$2" "$c" "$3" "$N"
    rows="$rows$1|$2|$3
"
  }
  # add <https|dns> <coloured summary line>
  add() {
    if [ "$1" = dns ]; then dns_found="$dns_found
$2"; else https_found="$https_found
$2"; fi
  }
  # flag <bad|warn> <https|dns> <summary line>
  flag() {
    c=$R; [ "$1" = warn ] && c=$Y
    add "$2" "    $c! $3$N"
  }
  # -q: ignore ~/.curlrc, so a local "insecure" or proxy setting cannot change a result.
  # --proto: HTTPS only, redirects included. Proxy environment variables still apply.
  get() { curl -q --proto '=https' --proto-redir '=https' -s -m 15 "$@"; }
  esc_json() { printf '%s' "$1" | sed -e 's/\\/\\\\/g' -e 's/"/\\"/g' | tr -d '\000-\037'; }

  command -v curl >/dev/null 2>&1 || { echo 'This check needs curl.' >&2; return 3; }
  # wait=0: the report answers at once. The resolver that looked the hostname up is asked for
  # at the end, after the checks below, because its log takes 10 to 60 s to arrive.
  report=$(get -L -m 20 'https://shakerscan.com/check/https?wait=0')
  case "$report" in
    'ShakerScan connection report'*) ;;
    *'block access from your country'*)
      echo 'The ShakerScan connection check is not available in your country or region.' >&2; return 3 ;;
    *) echo 'Could not get the report from shakerscan.com.' >&2; [ -n "$report" ] && printf '%s\n' "$report" >&2; return 3 ;;
  esac
  # What ShakerScan saw, without the manual checks this script runs below.
  # Headings bold, findings red, scoped negative results green, the pending resolver yellow.
  printf '%s\n' "$report" | sed '/^CHECK ON YOUR MACHINE/,$d' | sed \
    -e '/^ \{13\}the log can take up to a minute/d' -e '/^ \{13\}curl -s "https:\/\/connection/d' \
    -e '/^ \{13\}still nothing:/d' \
    -e 's/no lookup reached ShakerScan in time$/asked for at the end (its log takes 10 to 60 s)/' \
    -e "1s/.*/$B&$N/" \
    -e "s/^\([A-Z][A-Z]*\( [A-Z][A-Z]*\)*\)\( · .*\)\{0,1\}$/$B$C\1$N$D\3$N/" \
    -e "s/^\(  [a-z ]\{11\}\)\(! .*\)$/\1$R\2$N/" \
    -e "s/^\(  [a-z ]\{11\}\)\(.*nothing added on the way.*\)$/\1$G\2$N/" \
    -e "s/^\(  [a-z ]\{11\}\)\(no proxy-related names\)$/\1$G\2$N/" \
    -e "s/^\(  [a-z ]\{11\}\)\(.*one route for both sites.*\)$/\1$G\2$N/" \
    -e "s/^\(  [a-z ]\{11\}\)\(.*not a published.*\)$/\1$G\2$N/" \
    -e "s/^\(  [a-z ]\{11\}\)\(asked for at the end .*\)$/\1$Y\2$N/"
  # The report's own findings, sorted into the two halves of the summary. A finding's
  # continuation lines follow it into the same half.
  server=$(printf '%s\n' "$report" | sed -n '/^SUMMARY$/,/^$/p' | grep -E '^  ! |^    ')
  half=https
  while IFS= read -r l; do
    case "$l" in
      '  ! '*) case "$l" in *DNS*|*'different networks'*) half=dns ;; *) half=https ;; esac
        add "$half" "    $R${l#  }$N" ;;
      '    '*) add "$half" "      $R${l#    }$N" ;;
    esac
  done <<EOF
$server
EOF
  version=$(printf '%s\n' "$report" | sed -n 's/^  ip  *[^ ]* (IPv\([46]\)).*/\1/p' | head -n 1)
  asn=$(printf '%s\n' "$report" | sed -n 's/^  network  *AS\([0-9][0-9]*\).*/\1/p' | head -n 1)

  printf '%s%sON THIS MACHINE%s\n' "$B" "$C" "$N"

  # 1. The certificate this machine was given. An HTTPS-inspecting proxy or antivirus re-signs it,
  #    and this machine then trusts that proxy's certificate authority. curl keeps verification on.
  out=$(curl -q --proto '=https' -sv -o /dev/null -m 15 https://connection.shakerscan.com/ 2>&1); rc=$?
  issuer=$(printf '%s\n' "$out" | sed -n 's/^\*  *issuer: *//p' | head -n 1)
  case "$rc:$issuer" in
    0:*O=Amazon*) say ok certificate 'ok, Amazon as expected: no sign of a replaced certificate' ;;
    0:) say skip certificate 'not checked (connected, but curl did not show the issuer)' ;;
    0:*) say bad certificate "! issued by $issuer, not Amazon"
       flag bad https 'The certificate came from another issuer than expected: often a company proxy or antivirus that decrypts HTTPS.' ;;
    51:*|60:*) say warn certificate '! not trusted by this machine (curl 60)'
       flag warn https 'This machine did not trust the certificate it was given: an untrusted proxy, a wrong clock or a missing CA bundle.' ;;
    35:*) say skip certificate 'not checked (TLS handshake failed, curl 35)' ;;
    *) say skip certificate "not checked (curl error $rc)" ;;
  esac

  # 2. One query, without recursion, to ShakerScan's authoritative server: over UDP, and over TCP
  #    as well when UDP did not get through. It shows whether these queries reached that server;
  #    it does not describe every DNS server or protocol.
  #    Route 53 never offers recursion, so "ra" in a reply means another server sent it, whatever
  #    its status. That is checked before REFUSED.
  ask() { # ask <extra dig option>: prints direct, elsewhere:<status>, refused or none
    o=$(dig +norec +time=3 +tries=1 $1 "@$ns" "canary.$zone" CNAME 2>&1)
    f=$(printf '%s\n' "$o" | sed -n 's/.*flags: \([a-z ]*\);.*/\1/p' | head -n 1)
    st=$(printf '%s\n' "$o" | sed -n 's/.*status: \([A-Z]*\),.*/\1/p' | head -n 1)
    a=$(printf '%s\n' "$o" | grep -c "^canary\.$zone\..*CNAME.*\.cloudfront\.net\.$")
    case " $f :$st" in
      '  :') echo none ;;
      *' ra '*) echo "elsewhere:$st" ;;
      *:REFUSED) echo refused ;;
      *' aa '*:NOERROR) if [ "$a" -gt 0 ]; then echo direct; else echo "elsewhere:$st"; fi ;;
      *) echo "elsewhere:$st" ;;
    esac
  }
  if command -v dig >/dev/null 2>&1; then
    udp=$(ask '')
    if [ "$udp" = direct ]; then say ok dns 'ok, ShakerScan'"'"'s server answered this query directly'
    else
      tcp=$(ask +tcp)
      case "$tcp" in
        direct) also='; the same query over TCP got through' ;;
        none) also='; no answer over TCP either' ;;
        refused) also='; refused over TCP too' ;;
        *) also='; the same over TCP' ;;
      esac
      case "$udp" in
        elsewhere:*) say warn dns "! answered by another server (${udp#elsewhere:}): likely your network's resolver$also"
          flag warn dns 'A DNS query to an outside server was answered by something else, likely your network'"'"'s resolver (router, VPN, filter or ISP).' ;;
        refused) say warn dns "! a query to an outside DNS server was refused (VPNs and firewalls do this)$also"
          flag warn dns 'A DNS query to an outside server was refused: your network may allow only its own DNS (VPNs and firewalls do this on purpose).' ;;
        *) say warn dns "! no answer to a query to an outside DNS server (blocked or dropped)$also"
          flag warn dns 'A DNS query to an outside server got no answer: your network may block outside DNS (VPNs and firewalls do this on purpose).' ;;
      esac
    fi
  else
    say skip dns 'not checked (needs dig: dnsutils or bind-utils)'
  fi

  # 3. DNSSEC through this machine's own resolver, without a proxy: x.t sits under a broken
  #    signature, x.ok is the same setup with a valid one. curl 6 means the name did not resolve;
  #    0, 7 and TLS errors (35, 51, 60) mean it resolved. A timeout (28) with no time spent on the
  #    lookup means the lookup itself never finished: macOS reports a failed validation this way.
  resolved() { case "$1" in 0|7|35|51|60) return 0 ;; *) return 1 ;; esac; }
  get --noproxy '*' -m 8 -o /dev/null "https://x.ok.$zone/"; control=$?
  looked=$(get --noproxy '*' -m 8 -o /dev/null -w '%{time_namelookup}' "https://x.t.$zone/"); bogus=$?
  if ! resolved "$control"; then say skip dnssec "not checked (the control name did not resolve, curl $control)"
  elif [ "$bogus" -eq 6 ]; then say ok dnssec 'ok, the broken-signature name did not resolve (validation or a filter)'
  elif resolved "$bogus"; then
    say warn dnssec '! your resolver returned an address for a name with a broken signature'
    flag warn dns 'Your DNS resolver does not appear to validate DNSSEC: it resolved a name with a broken signature.'
  elif [ "$bogus" -eq 28 ] && printf '%s' "$looked" | grep -Eq '^0([.,]0*)?$'; then
    say ok dnssec 'ok, the broken-signature name did not resolve (its lookup never finished; the control resolved)'
  else say skip dnssec "not checked (curl $bogus on the test name)"
  fi

  # 4. Cloudflare's view of a separate request to shakerscan.com: key exchange, WARP and Gateway.
  trace=$(get https://shakerscan.com/cdn-cgi/trace)
  kex=$(printf '%s\n' "$trace" | sed -n 's/^kex=//p')
  case "$kex" in
    *MLKEM*) say ok 'key exchange' "$kex, hybrid post-quantum" ;;
    '') say skip 'key exchange' 'not checked' ;;
    *) say ok 'key exchange' "$kex (classical; post-quantum depends on curl's TLS library)" ;;
  esac
  if printf '%s\n' "$trace" | grep -qx 'warp=on'; then say warn warp 'on: Cloudflare reports WARP carries this traffic'; fi
  if printf '%s\n' "$trace" | grep -qx 'gateway=on'; then
    say warn gateway '! on: Cloudflare Gateway handles this traffic'
    flag warn https 'Cloudflare reports Gateway on: your traffic passes a filter that can inspect HTTPS (often an employer'"'"'s Zero Trust).'
  fi

  # 5. The other address family: which network it leaves from, compared with the report's.
  #    A family the test cannot reach was not measured; that is not proof this machine has none.
  other=6; [ "$version" = 6 ] && other=4
  out=$(curl -q --proto '=https' -sS -m 10 "https://v$other.$zone/v1/leak?asn=${asn:-0}" 2>&1); rc=$?
  net=$(printf '%s\n' "$out" | sed -n 's/^  network  *//p' | head -n 1)
  case "$rc:$out" in
    0:*'Same network'*) say ok "IPv$other" "same network as the report ($net)" ;;
    0:*'Different network'*) say warn "IPv$other" "! leaves from another network: $net"
       flag warn dns "IPv$other leaves from another network ($net) than the report. On a VPN, check that it carries IPv$other too." ;;
    6:*) say skip "IPv$other" "not reached (could not resolve the IPv$other test host)" ;;
    7:*) say skip "IPv$other" "not reached (could not connect over IPv$other)" ;;
    28:*) say skip "IPv$other" 'not reached (timed out)' ;;
    0:*) say skip "IPv$other" 'not compared (no network for one of the two families)' ;;
    *) say skip "IPv$other" "not checked (curl error $rc)" ;;
  esac

  # 6. The resolver that looked the report's hostname up. Its log reaches ShakerScan 10 to 60 s
  #    after the lookup, so ask until it is there.
  probe=$(printf '%s\n' "$report" | sed -n 's/.*v1\/dns?probe=\([0-9a-f]\{32\}\).*/\1/p' | head -n 1)
  if [ -n "$probe" ]; then
    [ -t 1 ] && printf '  %-13s%swaiting for the DNS log (up to 45 s)%s' 'resolver' "$D" "$N"
    i=0 dns=''
    while [ "$i" -lt 15 ]; do
      dns=$(get "https://connection.shakerscan.com/v1/dns?probe=$probe")
      case "$dns" in *'"status":"observed"'*) break ;; esac
      [ -t 1 ] && printf '%s.%s' "$D" "$N"
      sleep 3; i=$((i + 1))
    done
    [ -t 1 ] && printf '\r\033[K'
    case "$dns" in
      *'"status":"observed"'*)
        # One line per resolver: ip, ASN, network name, operator (attributed by network), protocol,
        # and whether it forwards a client subnet.
        seen=$(printf '%s\n' "$dns" | awk '{
          n = split($0, part, /\{"ip":"/)
          for (i = 2; i <= n; i++) {
            s = part[i]; ip = s; sub(/".*/, "", ip); asn = ""; name = ""; op = ""; proto = ""; ecs = ""
            if (match(s, /"asn":[0-9]+/)) asn = substr(s, RSTART + 6, RLENGTH - 6)
            if (match(s, /"name":"[^"]*"/)) name = substr(s, RSTART + 8, RLENGTH - 9)
            if (match(s, /"operator":"[^"]*"/)) op = substr(s, RSTART + 12, RLENGTH - 13)
            if (match(s, /"protocol":"[A-Z]+"/)) proto = substr(s, RSTART + 12, RLENGTH - 13)
            if (match(s, /"ecs":"[^"]*"/) || match(s, /"ecs_withheld":true/)) ecs = "yes"
            print ip "|" asn "|" name "|" op "|" proto "|" ecs
          }
        }')
        foreign=''
        while IFS='|' read -r rip rasn rname rop rproto recs; do
          where="$rip (AS${rasn:-?} $rname, $rproto)"
          [ -n "$recs" ] && where="$where, forwards a client subnet"
          if [ -n "$rop" ]; then say ok resolver "$where: $rop, a public resolver"
          elif [ -z "$asn" ] || [ -z "$rasn" ]; then say skip resolver "$where: not compared (a network is unknown)"
          elif [ "$rasn" = "$asn" ]; then say ok resolver "$where: same network as your IP"
          else say warn resolver "! $where: another network than your IP"; foreign=1
          fi
        done <<EOF
$seen
EOF
        [ -n "$foreign" ] && flag warn dns 'Your DNS was looked up from another network than your traffic. On a VPN, check that it handles DNS.' ;;
      *) say skip resolver 'not measured (no lookup reached ShakerScan'"'"'s DNS log in time)' ;;
    esac
  fi

  echo
  printf '%s%sSUMMARY%s\n' "$B" "$C" "$N"
  printf '  %sHTTPS%s\n' "$B" "$N"
  if [ -z "$https_found" ]; then printf '    %sNo signs of interception in the checks above.%s\n' "$G" "$N"
  else printf '%s\n' "$https_found" | sed '/^$/d'; fi
  printf '  %sDNS and route%s\n' "$B" "$N"
  if [ -z "$dns_found" ]; then printf '    %sNothing unusual in the checks above.%s\n' "$G" "$N"
  else printf '%s\n' "$dns_found" | sed '/^$/d'; fi
  [ -n "$skipped" ] && printf '  %sNot checked: %s. Something there could be missed.%s\n' "$D" "$skipped" "$N"
  echo
  printf '%s\n' "$report" | grep '^Kept:' | sed "s/.*/$D&$N/"
  printf '%sResults stay on this machine. The checks send test requests to ShakerScan only.%s\n' "$D" "$N"
  printf '%sIn a browser: https://shakerscan.com/check/connection%s\n' "$D" "$N"

  status=0
  if [ -n "$https_found$dns_found" ]; then status=1; elif [ -n "$skipped" ]; then status=2; fi
  if [ "$json" -eq 1 ]; then
    {
      printf '{"document_type":"shakerscan.connection_script","schema_version":"1","exit_status":%s,' "$status"
      printf '"ip_version":%s,"asn":%s,"checks":[' "${version:-null}" "${asn:-null}"
      first=1
      while IFS='|' read -r kind label detail; do
        [ -z "$kind" ] && continue
        case "$kind" in ok) result=ok ;; bad) result=finding ;; warn) result=warning ;; *) result=not_checked ;; esac
        [ "$first" -eq 1 ] || printf ','
        first=0
        printf '{"check":"%s","result":"%s","detail":"%s"}' "$(esc_json "$label")" "$result" "$(esc_json "$detail")"
      done <<EOF
$rows
EOF
      printf ']}\n'
    } >&3
  fi
  return "$status"
}

main "$@"