#!/usr/bin/env python3
"""Connectivity probe, run as the sandbox uid by tests/vm_host_asserts.sh.

Prints one `target VERDICT` line per argument. Deliberately dumb: it makes
a TCP connection and reports whether it completed. A blocked address looks
the same as an unreachable one from in here, which is why the caller pairs
every must-fail target with a must-pass positive control - without those,
a suite like this passes just as happily when networking is simply broken.
"""
import socket
import sys


def probe(host: str, port: int, timeout: float = 4.0) -> str:
    try:
        socket.create_connection((host, port), timeout).close()
        return "REACHED"
    except Exception as exc:
        return f"blocked({type(exc).__name__})"


for spec in sys.argv[1:]:
    host, _, port = spec.rpartition(":")
    print(f"{spec} {probe(host, int(port))}", flush=True)