diff --git a/Makefile b/Makefile index d0216b3..c001a39 100644 --- a/Makefile +++ b/Makefile @@ -3,26 +3,28 @@ IMAGE_NAME := mtg APP_NAME := $(IMAGE_NAME) CC_BINARIES := $(shell bash -c "echo -n $(APP_NAME)-{linux,freebsd,openbsd}-{386,amd64} $(APP_NAME)-linux-{arm,arm64}") -APP_DEPS := version.go -GOLANGCI_LINT_VERSION := v1.10.2 +GOLANGCI_LINT_VERSION := v1.11.2 -COMMON_BUILD_FLAGS := -ldflags="-s -w" +VERSION_GO := $(shell go version) +VERSION_DATE := $(shell date -Ru) +VERSION_TAG := $(shell git describe --tags --always) +COMMON_BUILD_FLAGS := -ldflags="-s -w -X 'main.version=$(VERSION_TAG) ($(VERSION_GO)) [$(VERSION_DATE)]'" MOD_ON := env GO111MODULE=on MOD_OFF := env GO111MODULE=auto # ----------------------------------------------------------------------------- -$(APP_NAME): $(APP_DEPS) +$(APP_NAME): @$(MOD_ON) go build $(COMMON_BUILD_FLAGS) -o "$(APP_NAME)" -static-$(APP_NAME): $(APP_DEPS) +static-$(APP_NAME): @$(MOD_ON) env CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo $(COMMON_BUILD_FLAGS) -o "$(APP_NAME)" $(APP_NAME)-%: GOOS=$(shell echo -n "$@" | sed 's?$(APP_NAME)-??' | cut -f1 -d-) $(APP_NAME)-%: GOARCH=$(shell echo -n "$@" | sed 's?$(APP_NAME)-??' | cut -f2 -d-) -$(APP_NAME)-%: $(APP_DEPS) ccbuilds +$(APP_NAME)-%: ccbuilds @$(MOD_ON) env "GOOS=$(GOOS)" "GOARCH=$(GOARCH)" \ go build \ $(COMMON_BUILD_FLAGS) \ @@ -31,9 +33,6 @@ $(APP_NAME)-%: $(APP_DEPS) ccbuilds ccbuilds: @rm -rf ./ccbuilds && mkdir -p ./ccbuilds -version.go: - @$(MOD_ON) go generate main.go - vendor: go.mod go.sum @$(MOD_ON) go mod vendor @@ -53,15 +52,15 @@ crosscompile-dir: @rm -rf "$(CC_DIR)" && mkdir -p "$(CC_DIR)" .PHONY: test -test: vendor $(APP_DEPS) +test: vendor @$(MOD_ON) go test -v ./... .PHONY: lint -lint: vendor $(APP_DEPS) +lint: vendor @$(MOD_OFF) golangci-lint run .PHONY: critic -critic: vendor $(APP_DEPS) +critic: vendor @$(MOD_OFF) gocritic check-project "$(ROOT_DIR)" .PHONY: clean diff --git a/README.md b/README.md index d88ce2a..82c825f 100644 --- a/README.md +++ b/README.md @@ -113,11 +113,49 @@ head -c 512 /dev/urandom | md5sum | cut -f 1 -d ' ' ## Secure mode -If you want to support new secure mode, please prepend `dd` to the -secret. For example, secret `cf18fa8ea0267057e2c61a5f7322a8e7` should -be `ddcf18fa8ea0267057e2c61a5f7322a8e7`. But pay attention that some -old clients won't support this mode. If this is not your case, I would -suggest to go with this mode. +Secure mode is not the best name and of course, it creates a lot of +confusion. To explain what it means, we need to tell you some bits on +dd-secrets. + +MTPROTO proxy protocol requires 16-byte secret. You usually +propagate it as a 32 characters hexadecimal string like +`282831900f371ca182feb0e4e1e1aeef` (if you decode this string +to bytes, you will get a real secret which is used in the +protocol). Everything went quite good until the moment when +developers found an evidence that [protocol is quite weak to +DPI](https://github.com/TelegramMessenger/MTProxy/issues/35) and some +enthusiasts even created simple proofs of concepts on [detecting MTPROTO +traffic](https://github.com/darkk/poormansmtproto). + +Telegram team has introduced a patch called dd-secrets. If you have +a secret `282831900f371ca182feb0e4e1e1aeef` then your dd-secret is +`dd282831900f371ca182feb0e4e1e1aeef`. That is, you just add dd prefix +to the secret, prepend it with dd. In that case, original secret +`282831900f371ca182feb0e4e1e1aeef` is used but client and server start +to act a little bit different: they start to add random noise to the +packets so they can't be detected by their length. In order to keep +backward compatibility, all proxies a quite liberal to the secrets to +use: if the client uses plain secret, without dd prefix, they fall back +to the normal behavior. If dd-secret is used (proxy can extract this +information on the handshake), then more secured, the hardened behavior +is used. + +Yes, it can look like a hack but it is as it is. + +Now going back to the secure mode: if you do not pass `-s` flag to the +mtg, then it checks what mode is requested by the client. If the client +uses plain secret, without dd prefix, then proxy falls back to the +original behavior and do not play with paddings. If dd-secret is used +and client demands this mode, then proxy start to add that random noise +to the packets. But if you pass `-s`, then only clients with dd-secrets +can connect. How to migrate existing clients then? If a client is new +enough, you can just prepend the secret with dd string in the settings. +If it is an old guy, then nothing to do, sorry. + +Why this mode matters? We do not have evidence but there is quite a big +suspicion that some ISPs start to filter MTPROTO traffic. If they detect +the IP address which acts as a proxy, they block it and no clients can +use this proxy. This is an attempt to prevent such a situation. Oneliners to generate such secrets: @@ -131,10 +169,6 @@ or echo dd$(head -c 512 /dev/urandom | md5sum | cut -f 1 -d ' ') ``` -If you want to enforce the usage of secure mode, please pass `-s` or -`--secure-only` flags. In that case, clients which do not use dd-secrets -are going to be disconnected from the proxy. - ## Environment variables @@ -192,13 +226,13 @@ This tool will listen on port 3128 by default with the given secret. # One-line runner ```console -docker run --name mtg --restart=unless-stopped -p 3128:3128 -p 3129:3129 -d nineseconds/mtg:stable $(openssl rand -hex 16) +docker run --name mtg --restart=unless-stopped -p 3128:3128 -q 3129:3129 -d nineseconds/mtg:stable $(openssl rand -hex 16) ``` or in secret mode: ```console -docker run --name mtg --restart=unless-stopped -p 3128:3128 -p 3129:3129 -d nineseconds/mtg:stable dd$(openssl rand -hex 16) +docker run --name mtg --restart=unless-stopped -p 3128:3128 -q 3129:3129 -d nineseconds/mtg:stable dd$(openssl rand -hex 16) ``` You will have this tool up and running on port 3128. Now curl diff --git a/go.mod b/go.mod index 217fe11..221d572 100644 --- a/go.mod +++ b/go.mod @@ -19,13 +19,13 @@ require ( github.com/pmezard/go-difflib v1.0.0 // indirect github.com/prometheus/client_golang v0.9.0 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910 // indirect - github.com/prometheus/common v0.0.0-20181015124227-bcb74de08d37 // indirect + github.com/prometheus/common v0.0.0-20181020173914-7e9e6cabbd39 // indirect github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d // indirect github.com/stretchr/testify v1.2.2 go.uber.org/atomic v1.3.2 // indirect go.uber.org/multierr v1.1.0 // indirect go.uber.org/zap v1.9.1 - golang.org/x/net v0.0.0-20181011144130-49bb7cea24b1 // indirect + golang.org/x/net v0.0.0-20181102091132-c10e9556a7bc // indirect golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f // indirect gopkg.in/alecthomas/kingpin.v2 v2.2.6 gopkg.in/alexcesaro/statsd.v2 v2.0.0 diff --git a/go.sum b/go.sum index 0e1b3b7..bc62614 100644 --- a/go.sum +++ b/go.sum @@ -37,8 +37,8 @@ github.com/prometheus/client_golang v0.9.0 h1:tXuTFVHC03mW0D+Ua1Q2d1EAVqLTuggX50 github.com/prometheus/client_golang v0.9.0/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw= github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910 h1:idejC8f05m9MGOsuEi1ATq9shN03HrxNkD/luQvxCv8= github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo= -github.com/prometheus/common v0.0.0-20181015124227-bcb74de08d37 h1:Y7YdJ9Xb3MoQOzAWXnDunAJYpvhVwZdTirNfGUgPKaA= -github.com/prometheus/common v0.0.0-20181015124227-bcb74de08d37/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro= +github.com/prometheus/common v0.0.0-20181020173914-7e9e6cabbd39 h1:Cto4X6SVMWRPBkJ/3YHn1iDGDGc/Z+sW+AEMKHMVvN4= +github.com/prometheus/common v0.0.0-20181020173914-7e9e6cabbd39/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro= github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d h1:GoAlyOgbOEIFdaDqxJVlbOQ1DtGmZWs/Qau0hIlk+WQ= github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk= github.com/stretchr/testify v1.2.2 h1:bSDNvY7ZPG5RlJ8otE/7V6gMiyenm9RtJ7IUVIAoJ1w= @@ -49,8 +49,8 @@ go.uber.org/multierr v1.1.0 h1:HoEmRHQPVSqub6w2z2d2EOVs2fjyFRGyofhKuyDq0QI= go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0= go.uber.org/zap v1.9.1 h1:XCJQEf3W6eZaVwhRBof6ImoYGJSITeKWsyeh3HFu/5o= go.uber.org/zap v1.9.1/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q= -golang.org/x/net v0.0.0-20181011144130-49bb7cea24b1 h1:Y/KGZSOdz/2r0WJ9Mkmz6NJBusp0kiNx1Cn82lzJQ6w= -golang.org/x/net v0.0.0-20181011144130-49bb7cea24b1/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= +golang.org/x/net v0.0.0-20181102091132-c10e9556a7bc h1:ZMCWScCvS2fUVFw8LOpxyUUW5qiviqr4Dg5NdjLeiLU= +golang.org/x/net v0.0.0-20181102091132-c10e9556a7bc/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f h1:wMNYb4v58l5UBM7MYRLPG6ZhfOqbKu7X5eyFl8ZhKvA= golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= gopkg.in/alecthomas/kingpin.v2 v2.2.6 h1:jMFz6MfLP0/4fUyZle81rXUoxOBFi19VUFKVDOQfozc= diff --git a/main.go b/main.go index 3a12956..7f1c76f 100644 --- a/main.go +++ b/main.go @@ -1,7 +1,5 @@ package main -//go:generate scripts/generate_version.sh - import ( "encoding/json" "fmt" @@ -22,6 +20,8 @@ import ( "github.com/9seconds/mtg/stats" ) +var version = "dev" // this has to be set by build ld flags + var ( app = kingpin.New("mtg", "Simple MTPROTO proxy.") @@ -183,6 +183,7 @@ func main() { // nolint: gocyclo defer logger.Sync() // nolint: errcheck printURLs(conf.GetURLs()) + zap.S().Debugw("Configuration", "config", conf) if conf.UseMiddleProxy() { zap.S().Infow("Use middle proxy connection to Telegram") diff --git a/scripts/generate_version.sh b/scripts/generate_version.sh deleted file mode 100755 index 8a964ec..0000000 --- a/scripts/generate_version.sh +++ /dev/null @@ -1,12 +0,0 @@ -#!/bin/sh -set -eu - -PROJECT_DIR="$(git rev-parse --show-toplevel)" -OUTPUT_FILE="${PROJECT_DIR}/version.go" - -cat > "$OUTPUT_FILE" <