scan-sni: add automated SNI discovery + DPI validation (#83)

New `mhrv-rs scan-sni` subcommand: pulls Google's published IP ranges, issues PTR lookups via dns.google, filters results to Google-related hostnames, then TLS-probes each discovered SNI against the user's configured `google_ip`. Prints the SNIs that pass DPI for the user to paste into `sni_hosts`. Also expands the hardcoded FAMOUS_GOOGLE_DOMAINS list the existing scan-ips command already used.

Adds `url` crate for URL parsing in the DNS-over-HTTPS client. No other behavioural changes.

Author: v4g4b0nd-0x76

Cargo.lock

@@ -72,6 +72,7 @@ eframe = { version = "0.28", default-features = false, features = [
     "wgpu",
     "persistence",
 ], optional = true }
+url = "2.5.8"
 
 # Unix-only deps. Must come after `[dependencies]` because starting a new
 # table here otherwise ends the main one — anything below it (incl. eframe)

Cargo.toml

@@ -11,7 +11,7 @@ use mhrv_rs::cert_installer::{install_ca, is_ca_trusted};
 use mhrv_rs::config::Config;
 use mhrv_rs::mitm::{MitmCertManager, CA_CERT_FILE};
 use mhrv_rs::proxy_server::ProxyServer;
-use mhrv_rs::{scan_ips, test_cmd};
+use mhrv_rs::{scan_ips, scan_sni, test_cmd};
 
 const VERSION: &str = env!("CARGO_PKG_VERSION");
 
@@ -27,6 +27,7 @@ enum Command {
     Test,
     ScanIps,
     TestSni,
+    ScanSni,
 }
 
 fn print_help() {
@@ -37,6 +38,7 @@ USAGE:
     mhrv-rs [OPTIONS]                  Start the proxy server (default)
     mhrv-rs test [OPTIONS]             Probe the Apps Script relay end-to-end
     mhrv-rs scan-ips [OPTIONS]         Scan Google frontend IPs for reachability + latency
+    mhrv-rs scan-sni         Scan Google SNI name using Google frontend IPs found in 'scan-ips' command
     mhrv-rs test-sni [OPTIONS]         Probe each SNI name in the rotation pool against google_ip
 
 OPTIONS:
@@ -70,6 +72,10 @@ fn parse_args() -> Result<Args, String> {
                 command = Command::ScanIps;
                 raw.remove(0);
             }
+            "scan-sni" => {
+                command = Command::ScanSni;
+                raw.remove(0);
+            }
             "test-sni" => {
                 command = Command::TestSni;
                 raw.remove(0);
@@ -190,8 +196,17 @@ async fn main() -> ExitCode {
                 ExitCode::FAILURE
             };
         }
+        Command::ScanSni => {
+            let ok = scan_sni::discover_snis_from_google_ips(&config).await;
+            return if ok {
+                ExitCode::SUCCESS
+            } else {
+                ExitCode::FAILURE
+            };
+        }
+
         Command::TestSni => {
-            let ok = mhrv_rs::scan_sni::run(&config).await;
+            let ok = scan_sni::run(&config).await;
             return if ok {
                 ExitCode::SUCCESS
             } else {

src/main.rs

@@ -44,16 +44,118 @@ const CANDIDATE_IPS: &[&str] = &[
     "142.250.64.206",
     "142.250.72.110",
 ];
-
-const FAMOUS_GOOGLE_DOMAINS: &[&str] = &[
+pub const FAMOUS_GOOGLE_DOMAINS: &[&str] = &[
+    // Core services
     "google.com",
     "www.google.com",
     "youtube.com",
     "www.youtube.com",
     "gmail.com",
+    "www.gmail.com",
     "drive.google.com",
     "docs.google.com",
+    "sheets.google.com",
+    "slides.google.com",
     "maps.google.com",
+    "www.maps.google.com",
+    // Search & Discovery
+    "search.google.com",
+    "images.google.com",
+    "www.images.google.com",
+    "news.google.com",
+    "www.news.google.com",
+    "scholar.google.com",
+    "www.scholar.google.com",
+    "books.google.com",
+    "translate.google.com",
+    "www.translate.google.com",
+    // Communication
+    "mail.google.com",
+    "chat.google.com",
+    "meet.google.com",
+    "hangouts.google.com",
+    "voice.google.com",
+    "allo.google.com",
+    // Media & Entertainment
+    "play.google.com",
+    "music.google.com",
+    "movies.google.com",
+    "video.google.com",
+    "videos.google.com",
+    "photos.google.com",
+    "picasa.google.com",
+    "picasaweb.google.com",
+    // Productivity
+    "calendar.google.com",
+    "keep.google.com",
+    "contacts.google.com",
+    "tasks.google.com",
+    "forms.google.com",
+    "sites.google.com",
+    "www.sites.google.com",
+    // Account & Settings
+    "accounts.google.com",
+    "myaccount.google.com",
+    "myactivity.google.com",
+    "passwords.google.com",
+    "adssettings.google.com",
+    // Business & Ads
+    "ads.google.com",
+    "adwords.google.com",
+    "www.adwords.google.com",
+    "adsense.google.com",
+    "analytics.google.com",
+    "business.google.com",
+    "mybusiness.google.com",
+    "merchants.google.com",
+    // Developer & Cloud
+    "console.cloud.google.com",
+    "cloud.google.com",
+    "firebase.google.com",
+    "console.firebase.google.com",
+    "developers.google.com",
+    "console.developers.google.com",
+    "apis.google.com",
+    "fonts.google.com",
+    // Mobile & Apps
+    "android.google.com",
+    "chrome.google.com",
+    "chromebook.google.com",
+    // Education & Learning
+    "classroom.google.com",
+    "edu.google.com",
+    // Shopping & Payments
+    "shopping.google.com",
+    "pay.google.com",
+    "payments.google.com",
+    "wallet.google.com",
+    "store.google.com",
+    // Travel & Local
+    "flights.google.com",
+    "hotels.google.com",
+    "travel.google.com",
+    // Other Services
+    "blogger.google.com",
+    "domains.google.com",
+    "trends.google.com",
+    "alerts.google.com",
+    "podcasts.google.com",
+    "fit.google.com",
+    "home.google.com",
+    "assistant.google.com",
+    "gemini.google.com",
+    // Support & Info
+    "support.google.com",
+    "policies.google.com",
+    "privacy.google.com",
+    "about.google.com",
+    "blog.google.com",
+    // Legacy/Regional
+    "plus.google.com",
+    "www.plus.google.com",
+    "orkut.google.com",
+    "reader.google.com",
+    "wave.google.com",
 ];
 
 const PROBE_TIMEOUT: Duration = Duration::from_secs(4);
@@ -92,7 +194,7 @@ pub async fn run(config: &Config) -> bool {
         let ip = ip.to_string();
         tasks.push(tokio::spawn(async move {
             let _permit: Option<tokio::sync::SemaphorePermit<'_>> = sem.acquire().await.ok();
-            probe(&ip, &sni, connector,google_ip_validation).await
+            probe(&ip, &sni, connector, google_ip_validation).await
         }));
     }
 
@@ -134,7 +236,7 @@ pub async fn run(config: &Config) -> bool {
     }
 }
 
-async fn fetch_google_ips(config: &Config) -> Vec<String> {
+pub async fn fetch_google_ips(config: &Config) -> Vec<String> {
     if !config.fetch_ips_from_api {
         tracing::info!("fetch_ips_from_api disabled, using static fallback");
         return CANDIDATE_IPS.iter().map(|s| s.to_string()).collect();
@@ -144,7 +246,7 @@ async fn fetch_google_ips(config: &Config) -> Vec<String> {
         &config.front_domain,
         config.max_ips_to_scan,
         config.scan_batch_size,
-        config.google_ip_validation
+        config.google_ip_validation,
     )
     .await
     {
@@ -170,7 +272,7 @@ async fn fetch_and_validate_google_ips(
     sni: &str,
     max_ips: usize,
     batch_size: usize,
-     google_ip_validation: bool
+    google_ip_validation: bool,
 ) -> Result<Vec<String>, Box<dyn std::error::Error>> {
     let famous_ips = resolve_famous_domains().await;
     tracing::info!(
@@ -224,21 +326,32 @@ async fn fetch_and_validate_google_ips(
     if candidate_ips.is_empty() {
         return Err("No valid IPs extracted from CIDRs".into());
     }
-
+    let total_batches = (candidate_ips.len() + batch_size - 1) / batch_size;
     tracing::info!(
-        "Selected {} IPs to test (from {} total), testing in batches...",
+        "Selected {} IPs to test (from {} total), testing in {} batches...",
         candidate_ips.len(),
-        priority_ips_len + other_ips_len
+        priority_ips_len + other_ips_len,
+        total_batches
     );
 
     let mut working_ips = Vec::new();
+    let mut total_tested = 0;
 
     for (i, chunk) in candidate_ips.chunks(batch_size).enumerate() {
-        tracing::debug!("Testing batch {} ({} IPs)...", i + 1, chunk.len());
-        let batch_working = validate_ips(chunk, sni,google_ip_validation).await;
-        working_ips.extend(batch_working);
+        let batch_working = validate_ips(chunk, sni, google_ip_validation).await;
+        working_ips.extend(batch_working.clone());
+        total_tested += chunk.len();
+
+        tracing::info!(
+            "Batch {}/{}: tested {} IPs, found {} working (total: {}/{})",
+            i + 1,
+            total_batches,
+            chunk.len(),
+            batch_working.len(),
+            total_tested,
+            candidate_ips.len()
+        );
     }
-
     tracing::info!(
         "Found {} working IPs from {} tested",
         working_ips.len(),
@@ -415,7 +528,11 @@ fn cidr_to_ips(cidr: &str) -> Vec<String> {
         return Vec::new();
     }
     let host_bits = 32 - prefix_len;
-    let num_hosts: u32 = if host_bits >= 32 { u32::MAX } else { 1u32 << host_bits };
+    let num_hosts: u32 = if host_bits >= 32 {
+        u32::MAX
+    } else {
+        1u32 << host_bits
+    };
 
     let limit = num_hosts.min(256);
     if limit < 2 {
@@ -621,7 +738,7 @@ async fn probe(
             }
 
             let lower = response.to_lowercase();
-            let mut  is_google = true;
+            let mut is_google = true;
             if google_ip_validation {
                 is_google = lower.contains("server: gws")
                     || lower.contains("x-google-")