ScuroNeko/mtg
1
0
Fork 0
mirror of https://github.com/ScuroNeko/mtg.git synced 2026-08-31 11:44:02 +03:00
Code Issues Packages Projects Releases Wiki Activity

Move cert noise calibration into doppelganger scout

Browse Source 
Instead of a separate cert_probe.go that duplicates the scout's TLS
connection logic, measure the cert chain size directly from the same
HTTPS connections the scout already makes.

Changes:
- Extend ScoutConnResult with payloadLen field
- Add Write interception to ScoutConn for handshake boundary detection
- Scout.learn() now computes cert size (sum of ApplicationData between
  CCS and first client Write) alongside inter-record durations
- Ganger aggregates cert sizes across raids and exposes NoiseParams()
  via atomic pointer for lock-free reads from proxy goroutines
- Proxy reads NoiseParams from Ganger on each handshake instead of
  probing at startup
- Remove cert_probe.go, disk cache, and related config options
  (noise-cache-path, noise-cache-ttl, noise-probe-count)

Falls back to legacy 2500-4700 range until the first scout raid
completes (typically within 1-2 seconds of startup).
This commit is contained in:
Alexey Dolotov
2026-03-27 16:34:42 +03:00
parent 80213ad35d
commit 9dfd992c1d
12 changed files with 177 additions and 363 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mtglib/proxy.go
+4 -42
View File
@@ -36,7 +36,6 @@ type Proxy struct {
doppelGanger *doppel.Ganger
clientObfuscatror obfuscation.Obfuscator
noiseParams fake.NoiseParams
secret Secret
network Network
antiReplayCache AntiReplayCache
@@ -193,7 +192,10 @@ func (p *Proxy) doFakeTLSHandshake(ctx *streamContext) bool {
return false
}
if err := fake.SendServerHello(ctx.clientConn, p.secret.Key[:], clientHello, p.noiseParams); err != nil {
gangerNoise := p.doppelGanger.NoiseParams()
noiseParams := fake.NoiseParams{Mean: gangerNoise.Mean, Jitter: gangerNoise.Jitter}
if err := fake.SendServerHello(ctx.clientConn, p.secret.Key[:], clientHello, noiseParams); err != nil {
p.logger.InfoError("cannot send welcome packet", err)
return false
}
@@ -324,49 +326,9 @@ func NewProxy(opts ProxyOpts) (*Proxy, error) {
logger := opts.getLogger("proxy")
updatersLogger := logger.Named("telegram-updaters")
// Probe the fronting domain's cert chain size for noise calibration.
probeHost := opts.Secret.Host
probePort := opts.getDomainFrontingPort()
noiseParams := fake.NoiseParams{}
probeCount := int(opts.NoiseProbeCount)
if probeCount <= 0 {
probeCount = 15
}
cacheTTL := opts.NoiseCacheTTL
// Try loading from cache first.
if opts.NoiseCachePath != "" {
if cached, ok := fake.LoadCachedProbe(opts.NoiseCachePath, probeHost, probePort, cacheTTL); ok {
noiseParams = fake.NoiseParams(cached)
logger.Info(fmt.Sprintf("cert probe: loaded from cache, host=%s mean=%d jitter=%d",
probeHost, cached.Mean, cached.Jitter))
}
}
// If no cached result, probe live.
if noiseParams.Mean == 0 {
probeResult, probeErr := fake.ProbeCertSize(probeHost, probePort, probeCount)
if probeErr != nil {
logger.WarningError("cert probe failed, using default noise size", probeErr)
} else {
noiseParams = fake.NoiseParams(probeResult)
logger.Info(fmt.Sprintf("cert probe: host=%s mean=%d jitter=%d",
probeHost, probeResult.Mean, probeResult.Jitter))
if opts.NoiseCachePath != "" {
if saveErr := fake.SaveCachedProbe(opts.NoiseCachePath, probeHost, probePort, probeResult); saveErr != nil {
logger.WarningError("failed to save cert probe cache", saveErr)
}
}
}
}
proxy := &Proxy{
ctx: ctx,
ctxCancel: cancel,
noiseParams: noiseParams,
secret: opts.Secret,
network: opts.Network,
antiReplayCache: opts.AntiReplayCache,