# ============================================================
#  公司电脑网络与设备自测脚本
#  用途：验证公司电脑能否走通「远程串流家里的电脑」所需条件
#  用法：先在开始菜单打开 Windows PowerShell，再执行：
#         powershell -ExecutionPolicy Bypass -File "公司电脑网络自测.ps1"
#  结果：屏幕输出 + 同目录下「网络自测结果_时间戳.txt」
# ============================================================

$ErrorActionPreference = 'Continue'
$resultFile = Join-Path $PSScriptRoot ('网络自测结果_' + (Get-Date -Format 'yyyyMMdd_HHmmss') + '.txt')
# 注意：PowerShell 变量名不区分大小写，这里刻意避开 $r / $R 这类易冲突的名字
$Lines = New-Object System.Collections.ArrayList

function Add-Line {
    param([string]$Text)
    [void]$Lines.Add($Text)
    Write-Host $Text
}
function Add-Section {
    param([string]$Title)
    Add-Line ''
    Add-Line ('===== ' + $Title + ' =====')
}

# 用绝对路径调用系统命令：某些受管控环境的 PATH 会被裁剪，直接写 ping / netsh 会找不到
$Sys32    = Join-Path $env:SystemRoot 'System32'
$pingExe  = Join-Path $Sys32 'ping.exe'
$netshExe = Join-Path $Sys32 'netsh.exe'

# 强制走 IPv6 的 TCP 连通性测试（ICMPv6 常被系统/网关默认拦截，所以必须用 TCP 判断）
function Test-TcpIPv6 {
    param([string]$Address, [int]$Port, [int]$TimeoutMs = 5000)
    $c = $null
    try {
        $c = New-Object System.Net.Sockets.TcpClient ([System.Net.Sockets.AddressFamily]::InterNetworkV6)
        $iar = $c.BeginConnect($Address, $Port, $null, $null)
        $ok = $iar.AsyncWaitHandle.WaitOne($TimeoutMs, $false)
        if ($ok -and $c.Connected) { return $true }
        return $false
    } catch { return $false }
    finally { if ($c) { $c.Close() } }
}

# 把外部命令输出安全地拼成一行文本（命令无输出时返回空串，避免 Join 抛异常）
function Get-NativeText {
    param($Output)
    return (@($Output) -join ' ')
}

Add-Line ('公司电脑网络自测  ' + (Get-Date -Format 'yyyy-MM-dd HH:mm:ss'))

# ---------- 1. 设备与显示（决定解码能力与串流分辨率） ----------
Add-Section '1. 设备与显示'
try {
    $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1
    Add-Line ('CPU      : ' + $cpu.Name.Trim())
    $cs = Get-CimInstance Win32_ComputerSystem
    Add-Line ('内存     : ' + [math]::Round($cs.TotalPhysicalMemory / 1GB, 1) + ' GB')
    $os = Get-CimInstance Win32_OperatingSystem
    Add-Line ('系统     : ' + $os.Caption + '  build ' + $os.BuildNumber)
    foreach ($g in (Get-CimInstance Win32_VideoController)) {
        Add-Line ('显卡     : ' + $g.Name + '   驱动 ' + $g.DriverVersion +
                  '   当前 ' + $g.CurrentHorizontalResolution + 'x' + $g.CurrentVerticalResolution + '@' + $g.CurrentRefreshRate + 'Hz')
    }
    Add-Line '提示     : 若屏幕是 120/144Hz，请到「设置-系统-屏幕-高级显示」把刷新率手动调到最高'
}
catch { Add-Line ('读取设备信息失败: ' + $_.Exception.Message) }

# ---------- 2. IPv6 能力（最关键的一项：家里只有公网 IPv6 可直连） ----------
Add-Section '2. IPv6 能力（关键）'
try {
    $v6 = Get-NetIPAddress -AddressFamily IPv6 -ErrorAction SilentlyContinue |
          Where-Object { $_.IPAddress -notlike 'fe80*' -and $_.IPAddress -ne '::1' -and $_.PrefixOrigin -ne 'WellKnown' }
    if ($v6) {
        foreach ($a in $v6) { Add-Line ('本机 IPv6 : ' + $a.IPAddress + '   (' + $a.InterfaceAlias + ')') }
    } else {
        Add-Line '本机 IPv6 : 无 -> 公司是纯 IPv4 网络，家里 IPv6 直连走不通，只能靠打洞或中转'
    }
    # 用 TCP 而不是 ping 来判断：ICMPv6 默认会被 Windows 防火墙拦掉，ping 不通不代表 IPv6 不可用
    $v6Targets = @(
        @{ Name = '阿里公共DNS v6 (2400:3200::1:53)'; Addr = '2400:3200::1'; Port = 53 },
        @{ Name = '电信DNS v6 (240e:4c:4008::1:53)';  Addr = '240e:4c:4008::1'; Port = 53 }
    )
    foreach ($t in $v6Targets) {
        if (Test-TcpIPv6 -Address $t.Addr -Port $t.Port) {
            Add-Line ('IPv6 出网 : ' + $t.Name + ' -> 通（公司有可用的 IPv6）')
        } else {
            Add-Line ('IPv6 出网 : ' + $t.Name + ' -> 不通')
        }
    }
    Add-Line '说明 : 只要有任意一条通，说明公司网络能跑 IPv6，家里的 IPv6 直连方案就有戏'
}
catch { Add-Line ('IPv6 检测失败: ' + $_.Exception.Message) }

# ---------- 3. 代理与审计软件初筛（决定会不会被拦） ----------
Add-Section '3. 代理与审计软件初筛'
try {
    $wOut = & $netshExe winhttp show proxy
    $w = (Get-NativeText $wOut) -replace '\s+', ' '
    Add-Line ('WinHTTP 代理 : ' + $w.Trim())
    $envProxy = @()
    if ($env:HTTP_PROXY)  { $envProxy += ('HTTP_PROXY=' + $env:HTTP_PROXY) }
    if ($env:HTTPS_PROXY) { $envProxy += ('HTTPS_PROXY=' + $env:HTTPS_PROXY) }
    if ($envProxy.Count -gt 0) { Add-Line ('环境变量代理 : ' + ($envProxy -join '; ')) } else { Add-Line '环境变量代理 : 无' }
    $ieProxy = Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings' -ErrorAction SilentlyContinue
    if ($ieProxy) {
        Add-Line ('系统代理 : 开关=' + $ieProxy.ProxyEnable + '  服务器=' + $ieProxy.ProxyServer + '  PAC=' + $ieProxy.AutoConfigURL)
    }
    $keywords = 'Sangfor|深信服|QiAnXin|奇安信|360|TianQing|天擎|NSFOCUS|绿盟|EDR|Sentinel|CrowdStrike|Symantec|McAfee|Sophos|ESET|Kaspersky|卡巴|Huorong|火绒|IP-guard|亿赛通|天锐|网神|亚信|安恒|Forcepoint|Zscaler|Netskope|Umbrella|AnyConnect'
    $hit = @()
    $hit += Get-Process -ErrorAction SilentlyContinue | Where-Object { $_.Name -match $keywords }
    $hit += Get-Service -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName -match $keywords }
    if ($hit.Count -gt 0) {
        Add-Line '命中管控/安全类软件（可能拦截远控或加密流量）:'
        $hit | Select-Object -First 12 | ForEach-Object { Add-Line ('   - ' + $_.Name) }
    } else {
        Add-Line '未发现明显的安全审计类软件'
    }
}
catch { Add-Line ('代理/审计检测失败: ' + $_.Exception.Message) }

# ---------- 4. 出站 TCP 端口自由度（是否只放行 80/443） ----------
Add-Section '4. 出站 TCP 端口自由度'
$tcpTargets = @(
    @{ Name = 'github.com:22 (SSH)';          Host = 'github.com';       Port = 22 },
    @{ Name = 'github.com:443 (HTTPS)';       Host = 'github.com';       Port = 443 },
    @{ Name = '114.114.114.114:53 (TCP DNS)'; Host = '114.114.114.114';  Port = 53 },
    @{ Name = '114.114.114.114:8080';         Host = '114.114.114.114';  Port = 8080 }
)
foreach ($t in $tcpTargets) {
    try {
        $c = Test-NetConnection -ComputerName $t.Host -Port $t.Port -InformationLevel Quiet -WarningAction SilentlyContinue
        if ($c) { Add-Line ($t.Name.PadRight(28) + ' -> 通') } else { Add-Line ($t.Name.PadRight(28) + ' -> 不通或被拦') }
    } catch { Add-Line ($t.Name.PadRight(28) + ' -> 检测异常') }
}
Add-Line '说明 : 若只有 443 通、非标端口不通，说明公司做了端口白名单，串流要依赖打洞或中转'

# ---------- 5. UDP 出站能力（串流视频走 UDP，最关键的一测） ----------
Add-Section '5. UDP 出站能力（关键）'

# 5.1 DNS over UDP 53：最基础的 UDP 通断验证
try {
    $udp = New-Object System.Net.Sockets.UdpClient
    $udp.Client.ReceiveTimeout = 3000
    $srv = New-Object System.Net.IPEndPoint ([System.Net.IPAddress]::Parse('114.114.114.114'), 53)
    $q = [byte[]](0xAB,0xCD, 0x01,0x00, 0x00,0x01, 0x00,0x00, 0x00,0x00, 0x00,0x00,
                  0x02,0x71,0x71, 0x03,0x63,0x6F,0x6D, 0x00, 0x00,0x01, 0x00,0x01)
    [void]$udp.Send($q, $q.Length, $srv)
    $remote = New-Object System.Net.IPEndPoint ([System.Net.IPAddress]::Any, 0)
    $resp = $udp.Receive([ref]$remote)
    $udp.Close()
    Add-Line ('UDP/53 (114.114.114.114) -> 通，收到 ' + $resp.Length + ' 字节')
}
catch { Add-Line ('UDP/53 -> 不通或被拦 : ' + $_.Exception.Message) }

# 5.2 STUN：验证任意高位 UDP 端口能否出去，并取出 NAT 映射出的公网地址
function Invoke-StunProbe {
    param([string]$Server, [int]$Port = 3478, [int]$TimeoutMs = 3000)
    $res = New-Object psobject -Property @{ Server = ($Server + ':' + $Port); Ok = $false; Mapped = ''; LocalPort = 0; Err = '' }
    try {
        $ip = ([System.Net.Dns]::GetHostAddresses($Server) |
               Where-Object { $_.AddressFamily -eq [System.Net.Sockets.AddressFamily]::InterNetwork } |
               Select-Object -First 1)
        if (-not $ip) { throw 'DNS 解析失败' }
        $udp = New-Object System.Net.Sockets.UdpClient 0
        $udp.Client.ReceiveTimeout = $TimeoutMs
        $res.LocalPort = $udp.Client.LocalEndPoint.Port
        $ep = New-Object System.Net.IPEndPoint ($ip, $Port)
        $pkt = New-Object byte[] 20
        $pkt[0] = 0x00; $pkt[1] = 0x01
        $pkt[4] = 0x21; $pkt[5] = 0x12; $pkt[6] = 0xA4; $pkt[7] = 0x42
        $rnd = New-Object System.Random
        for ($i = 8; $i -lt 20; $i++) { $pkt[$i] = [byte]$rnd.Next(0, 256) }
        [void]$udp.Send($pkt, 20, $ep)
        $remote = New-Object System.Net.IPEndPoint ([System.Net.IPAddress]::Any, 0)
        $resp = $udp.Receive([ref]$remote)
        $udp.Close()
        $pos = 20
        while ($pos + 4 -le $resp.Length) {
            # 注意：必须先把 byte 转成 int 再位移，否则 [byte] -shl 8 会溢出归零
            $atype = ([int]$resp[$pos] -shl 8) -bor [int]$resp[$pos + 1]
            $alen  = ([int]$resp[$pos + 2] -shl 8) -bor [int]$resp[$pos + 3]
            if ($atype -eq 0x0020 -and $alen -ge 8) {
                $b = [byte[]]$resp[($pos + 8)..($pos + 11)]
                $b[0] = [byte]($b[0] -bxor 0x21)
                $b[1] = [byte]($b[1] -bxor 0x12)
                $b[2] = [byte]($b[2] -bxor 0xA4)
                $b[3] = [byte]($b[3] -bxor 0x42)
                $xp = ((([int]$resp[$pos + 6] -shl 8) -bor [int]$resp[$pos + 7]) -bxor 0x2112)
                $res.Mapped = (New-Object System.Net.IPAddress (, $b)).ToString() + ':' + $xp
                break
            }
            elseif ($atype -eq 0x0001 -and $alen -ge 8) {
                $b = [byte[]]$resp[($pos + 8)..($pos + 11)]
                $mp = (([int]$resp[$pos + 6] -shl 8) -bor [int]$resp[$pos + 7])
                $res.Mapped = (New-Object System.Net.IPAddress (, $b)).ToString() + ':' + $mp
                break
            }
            $pos += 4 + $alen + ((4 - ($alen % 4)) % 4)
        }
        $res.Ok = $true
    } catch { $res.Err = $_.Exception.Message }
    return $res
}

$stunServers = @('stun.miwifi.com', 'stun.qq.com', 'stun.hitv.com')
$mappedPorts = @()
foreach ($s in $stunServers) {
    $r = Invoke-StunProbe -Server $s
    if ($r.Ok) {
        Add-Line ('STUN ' + $r.Server.PadRight(24) + ' -> 通  本地端口 ' + $r.LocalPort + '  映射为 ' + $r.Mapped)
        if ($r.Mapped) { $mappedPorts += ($r.Mapped -split ':')[-1] }
    } else {
        Add-Line ('STUN ' + $r.Server.PadRight(24) + ' -> 不通 : ' + $r.Err)
    }
}
if ($mappedPorts.Count -ge 2) {
    $uniq = ($mappedPorts | Sort-Object -Unique).Count
    if ($uniq -eq 1) {
        Add-Line 'NAT 判断 : 多次映射端口一致 -> 锥形 NAT，P2P 打洞成功率高（好消息）'
    } else {
        Add-Line 'NAT 判断 : 每次映射端口都不同 -> 对称 NAT，P2P 打洞较难，需要中继兜底'
    }
}
Add-Line '说明 : STUN 能通 = 高位 UDP 端口可出网，这是 Sunshine/Moonlight 直连的前提'

# ---------- 6. 到家里的链路（核心结论所在） ----------
Add-Section '6. 到家里的链路（核心）'
# 家里主机的公网 IPv6（若网关重新拨号 / 前缀变化，需要重新获取后替换）
$homeV6 = '240e:338:263:3600:e591:cb62:3503:8a23'
# 家里的运营商出口 IPv4（100.64 开头 = 运营商级 NAT，无法直连，这是正常现象）
$homeV4 = ''

if ($homeV6 -ne '') {
    # 先 TCP 再 ping：TCP 通即可确认入站放行；ping 不通多半只是 ICMPv6 被拦，不必惊慌
    # 端口 38443 对应家里临时监听；正式启用 Sunshine 后应改成 47989 / 47990
    if (Test-TcpIPv6 -Address $homeV6 -Port 38443) {
        Add-Line '家里 IPv6:38443 -> 通  ★ IPv6 入站放行，可以走「最优路径：IPv6 直连」'
    } else {
        Add-Line '家里 IPv6:38443 -> 不通（可能网关 IPv6 防火墙拦了入站，或家里测试监听没开）'
    }
    $pOut = & $pingExe -6 -n 2 -w 2000 $homeV6
    $p = Get-NativeText $pOut
    if ($p -match 'Reply from|来自') { Add-Line 'ping6 家里 -> 通' } else { Add-Line 'ping6 家里 -> 不通（ICMPv6 常被默认拦截，仅供参考）' }
} else { Add-Line '未填写家里 IPv6，跳过' }

if ($homeV4 -ne '') {
    $pOut = & $pingExe -n 2 -w 2000 $homeV4
    $p = Get-NativeText $pOut
    if ($p -match 'Reply from|来自') { Add-Line 'ping4 家里出口 -> 通' } else { Add-Line 'ping4 家里出口 -> 不通（被运营商 NAT 拦，属正常）' }
} else { Add-Line '未填写家里 IPv4，跳过' }

# ---------- 收尾 ----------
Add-Section '自测完成'
Add-Line '把结果文件发给 AI 助手，据此决定走 IPv6 直连 / 打洞 / 中转。'
Add-Line ('结果已保存: ' + $resultFile)
try { $Lines | Out-File -FilePath $resultFile -Encoding UTF8 } catch { Write-Host ('写文件失败: ' + $_.Exception.Message) }
Write-Host ''
Write-Host ('结果文件：' + $resultFile)