ScuroNeko/mtg
1
0
Fork 0
mirror of https://github.com/ScuroNeko/mtg.git synced 2026-09-01 08:14:02 +03:00
Code Issues Packages Projects Releases Wiki Activity

Add dynamic cert noise calibration for FakeTLS handshake

Browse Source 
The hardcoded noise range (2500-4700 bytes) in the FakeTLS ServerHello
does not match the real certificate chain sizes of many popular fronting
domains (e.g., dl.google.com ≈ 6480 bytes, microsoft.com ≈ 13004 bytes).
This makes the proxy detectable by DPI systems that compare the
ApplicationData size with the real cert chain size for the SNI domain.

On startup, probe the fronting domain's actual TLS handshake size and
use the measured value ± jitter instead of the static range. Falls back
to the legacy 2500-4700 range if the probe fails.

Also adds optional caching of probe results between restarts
(noise-cache-path, noise-cache-ttl) and a configurable probe count
(noise-probe-count) under [defense.doppelganger].

Closes #408
This commit is contained in:
Alexey Dolotov
2026-03-26 23:38:58 +03:00
parent d32e8e8b97
commit 80213ad35d
8 changed files with 405 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mtglib/proxy.go
+42 -1
View File
@@ -36,6 +36,7 @@ type Proxy struct {
doppelGanger *doppel.Ganger
clientObfuscatror obfuscation.Obfuscator
noiseParams fake.NoiseParams
secret Secret
network Network
antiReplayCache AntiReplayCache
@@ -192,7 +193,7 @@ func (p *Proxy) doFakeTLSHandshake(ctx *streamContext) bool {
return false
}
if err := fake.SendServerHello(ctx.clientConn, p.secret.Key[:], clientHello); err != nil {
if err := fake.SendServerHello(ctx.clientConn, p.secret.Key[:], clientHello, p.noiseParams); err != nil {
p.logger.InfoError("cannot send welcome packet", err)
return false
}
@@ -323,9 +324,49 @@ func NewProxy(opts ProxyOpts) (*Proxy, error) {
logger := opts.getLogger("proxy")
updatersLogger := logger.Named("telegram-updaters")
// Probe the fronting domain's cert chain size for noise calibration.
probeHost := opts.Secret.Host
probePort := opts.getDomainFrontingPort()
noiseParams := fake.NoiseParams{}
probeCount := int(opts.NoiseProbeCount)
if probeCount <= 0 {
probeCount = 15
}
cacheTTL := opts.NoiseCacheTTL
// Try loading from cache first.
if opts.NoiseCachePath != "" {
if cached, ok := fake.LoadCachedProbe(opts.NoiseCachePath, probeHost, probePort, cacheTTL); ok {
noiseParams = fake.NoiseParams(cached)
logger.Info(fmt.Sprintf("cert probe: loaded from cache, host=%s mean=%d jitter=%d",
probeHost, cached.Mean, cached.Jitter))
}
}
// If no cached result, probe live.
if noiseParams.Mean == 0 {
probeResult, probeErr := fake.ProbeCertSize(probeHost, probePort, probeCount)
if probeErr != nil {
logger.WarningError("cert probe failed, using default noise size", probeErr)
} else {
noiseParams = fake.NoiseParams(probeResult)
logger.Info(fmt.Sprintf("cert probe: host=%s mean=%d jitter=%d",
probeHost, probeResult.Mean, probeResult.Jitter))
if opts.NoiseCachePath != "" {
if saveErr := fake.SaveCachedProbe(opts.NoiseCachePath, probeHost, probePort, probeResult); saveErr != nil {
logger.WarningError("failed to save cert probe cache", saveErr)
}
}
}
}
proxy := &Proxy{
ctx: ctx,
ctxCancel: cancel,
noiseParams: noiseParams,
secret: opts.Secret,
network: opts.Network,
antiReplayCache: opts.AntiReplayCache,