Igor Artamonov
64bf6bfe90
The ClientHello builder used a closure G(n) that was supposed to insert two random GREASE bytes (RFC 8701, 0x?A?A pattern) at known positions but expanded the buffer by zero. Every grease slot was therefore omitted, and the trailing padding extension was written as a bare ext id 0x0015 followed by raw zeros — its length field was never set. Concretely, the old output looked structurally invalid to mtg's faketls validator: the cipher list was off by two, supported_groups declared a list_length larger than its body, and what should have been the padding extension parsed as a stream of empty server_name extensions. mtg responded with a fatal TLS Alert (description 50, decode_error) and shut the connection. Fix: - generate seven distinct GREASE bytes per ClientHello, with the tdlib constraint grease[3] != grease[4] - thread an io.Reader through writeClientHello so generation is deterministic in tests and keyed off the FakeTLS rand source in prod - replace the trailing zero-pad with a proper padding extension whose length field is computed so the ClientHello is exactly 517 bytes Add a regression test (structure_test.go) that feeds the result to crypto/tls.Server: it must not return decode_error / malformed / syntax errors. The previous output failed this; the new output passes. The TestTLS golden vector is regenerated for the new layout. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
113 lines
2.5 KiB
Go
113 lines
2.5 KiB
Go
package faketls
|
|
|
|
import (
|
|
"bytes"
|
|
"io"
|
|
"sync"
|
|
|
|
"github.com/go-faster/errors"
|
|
|
|
"go.mau.fi/mautrix-telegram/pkg/gotd/clock"
|
|
"go.mau.fi/mautrix-telegram/pkg/gotd/mtproxy"
|
|
)
|
|
|
|
// FakeTLS implements FakeTLS obfuscation protocol.
|
|
type FakeTLS struct {
|
|
rand io.Reader
|
|
clock clock.Clock
|
|
conn io.ReadWriter
|
|
|
|
version [2]byte
|
|
firstPacket bool
|
|
|
|
readBuf bytes.Buffer
|
|
readBufMux sync.Mutex
|
|
}
|
|
|
|
// NewFakeTLS creates new FakeTLS.
|
|
func NewFakeTLS(r io.Reader, conn io.ReadWriter) *FakeTLS {
|
|
return &FakeTLS{
|
|
rand: r,
|
|
clock: clock.System,
|
|
conn: conn,
|
|
version: Version12Bytes,
|
|
readBuf: bytes.Buffer{},
|
|
}
|
|
}
|
|
|
|
// Handshake performs FakeTLS handshake.
|
|
func (o *FakeTLS) Handshake(protocol [4]byte, dc int, s mtproxy.Secret) error {
|
|
o.readBufMux.Lock()
|
|
o.readBuf.Reset()
|
|
o.readBufMux.Unlock()
|
|
|
|
var sessionID [32]byte
|
|
if _, err := o.rand.Read(sessionID[:]); err != nil {
|
|
return errors.Wrap(err, "generate sessionID")
|
|
}
|
|
|
|
clientDigest, err := writeClientHello(o.conn, o.rand, o.clock, sessionID, s.CloakHost, s.Secret)
|
|
if err != nil {
|
|
return errors.Wrap(err, "send ClientHello")
|
|
}
|
|
|
|
if err := readServerHello(o.conn, clientDigest, s.Secret); err != nil {
|
|
return errors.Wrap(err, "receive ServerHello")
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// Write implements io.Writer.
|
|
func (o *FakeTLS) Write(b []byte) (n int, err error) {
|
|
// Some proxies require sending first packet with RecordTypeChangeCipherSpec.
|
|
//
|
|
// See https://github.com/tdlib/td/blob/master/td/mtproto/TcpTransport.cpp#L266.
|
|
if !o.firstPacket {
|
|
_, err = writeRecord(o.conn, record{
|
|
Type: RecordTypeChangeCipherSpec,
|
|
Version: o.version,
|
|
Data: []byte("\x01"),
|
|
})
|
|
if err != nil {
|
|
return 0, errors.Wrap(err, "write first TLS packet")
|
|
}
|
|
o.firstPacket = true
|
|
}
|
|
n, err = writeRecord(o.conn, record{
|
|
Type: RecordTypeApplication,
|
|
Version: o.version,
|
|
Data: b,
|
|
})
|
|
if err != nil {
|
|
return 0, errors.Wrap(err, "write TLS record")
|
|
}
|
|
return
|
|
}
|
|
|
|
// Read implements io.Reader.
|
|
func (o *FakeTLS) Read(b []byte) (n int, err error) {
|
|
o.readBufMux.Lock()
|
|
defer o.readBufMux.Unlock()
|
|
|
|
if o.readBuf.Len() > 0 {
|
|
return o.readBuf.Read(b)
|
|
}
|
|
|
|
rec, err := readRecord(o.conn)
|
|
if err != nil {
|
|
return 0, errors.Wrap(err, "read TLS record")
|
|
}
|
|
|
|
switch rec.Type {
|
|
case RecordTypeChangeCipherSpec:
|
|
case RecordTypeApplication:
|
|
case RecordTypeHandshake:
|
|
return 0, errors.New("unexpected record type handshake")
|
|
default:
|
|
return 0, errors.Errorf("unsupported record type %v", rec.Type)
|
|
}
|
|
o.readBuf.Write(rec.Data)
|
|
|
|
return o.readBuf.Read(b)
|
|
}
|