From 3d8ffdcc56c2132be9cec3d94f16e07a65dc8d2e Mon Sep 17 00:00:00 2001
From: 9seconds <nineseconds@yandex.ru>
Date: Tue, 10 Jul 2018 09:37:04 +0300
Subject: [PATCH 1/3] Add secure mode

---
 config/config.go              | 4 ++++
 mtproto/connection_options.go | 7 +++++++
 2 files changed, 11 insertions(+)

diff --git a/config/config.go b/config/config.go
index f5fd97f..52cc25c 100644
--- a/config/config.go
+++ b/config/config.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"net"
 	"strconv"
+	"strings"
 
 	"github.com/juju/errors"
 )
@@ -90,6 +91,9 @@ func NewConfig(debug, verbose bool, // nolint: gocyclo
 	publicIPv6 net.IP, publicIPv6Port uint16,
 	statsIP net.IP, statsPort uint16,
 	secret, adtag string) (*Config, error) {
+	if strings.HasPrefix(secret, "dd") {
+		secret = secret[2:]
+	}
 	if len(secret) != 32 {
 		return nil, errors.New("Telegram demands secret of length 32")
 	}
diff --git a/mtproto/connection_options.go b/mtproto/connection_options.go
index 76d2bfe..0230f5f 100644
--- a/mtproto/connection_options.go
+++ b/mtproto/connection_options.go
@@ -39,6 +39,7 @@ const (
 	ConnectionTypeUnknown ConnectionType = iota
 	ConnectionTypeAbridged
 	ConnectionTypeIntermediate
+	ConnectionTypeSecure
 )
 
 // ConnectionProtocol* define which connection protocols to use.
@@ -53,6 +54,7 @@ const (
 var (
 	ConnectionTagAbridged     = []byte{0xef, 0xef, 0xef, 0xef}
 	ConnectionTagIntermediate = []byte{0xee, 0xee, 0xee, 0xee}
+	ConnectionTagSecure       = []byte{0xdd, 0xdd, 0xdd, 0xdd}
 )
 
 // Tag maps connection type to the corresponding handshake tag.
@@ -62,6 +64,8 @@ func (t ConnectionType) Tag() ([]byte, error) {
 		return ConnectionTagAbridged, nil
 	case ConnectionTypeIntermediate:
 		return ConnectionTagIntermediate, nil
+	case ConnectionTypeSecure:
+		return ConnectionTagSecure, nil
 	default:
 		return nil, errors.Errorf("Unknown connection type %d", t)
 	}
@@ -75,6 +79,9 @@ func ConnectionTagFromHandshake(magic []byte) (ConnectionType, error) {
 	if bytes.Equal(magic, ConnectionTagAbridged) {
 		return ConnectionTypeAbridged, nil
 	}
+	if bytes.Equal(magic, ConnectionTagSecure) {
+		return ConnectionTypeSecure, nil
+	}
 
 	return ConnectionTypeUnknown, errors.New("Unknown handshake protocol")
 }

From 0b555c4deb97a08ee08eced5828054c7f4488b2e Mon Sep 17 00:00:00 2001
From: 9seconds <nineseconds@yandex.ru>
Date: Tue, 10 Jul 2018 09:49:48 +0300
Subject: [PATCH 2/3] Update README

---
 README.md | 37 ++++++++++++++++++++++++++++++++++++-
 1 file changed, 36 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 50fa296..b65f5ac 100644
--- a/README.md
+++ b/README.md
@@ -91,20 +91,55 @@ or
 $ head -c 512 /dev/urandom | md5sum | cut -f 1 -d ' '
 ```
 
+## Secure mode
+
+If you want to support new secure mode, please prepend `dd` to the
+secret. For example, secret `cf18fa8ea0267057e2c61a5f7322a8e7` should
+be `ddcf18fa8ea0267057e2c61a5f7322a8e7`. But pay attention that some
+old clients won't support this mode. If this is not your case, I would
+suggest to go with this mode.
+
+Oneliners to generate such secrets:
+
+```console
+$ echo dd$(openssl rand -hex 16)
+```
+
+or
+
+```console
+$ echo dd$(head -c 512 /dev/urandom | md5sum | cut -f 1 -d ' ')
+```
+
+
+# How to run the tool
+
 Now run the tool:
 
 ```console
 $ mtg <secret>
 ```
 
+How to run the tool with ADTag:
+
+```console
+$ mtg <secret> <adtag>
+```
+
 This tool will listen on port 3128 by default with the given secret.
 
 # One-line runner
 
-```
+```console
 $ docker run --name mtg --restart=unless-stopped -p 3128:3128 -p 3129:3129 -d nineseconds/mtg $(openssl rand -hex 16)
 ```
 
+or in secret mode:
+
+```console
+$ docker run --name mtg --restart=unless-stopped -p 3128:3128 -p 3129:3129 -d nineseconds/mtg dd$(openssl rand -hex 16)
+```
+
 You will have this tool up and running on port 3128. Now curl
 `localhost:3129` to get `tg://` links or do `docker logs mtg`. Also,
 port 3129 will show you some statistics if you are interested in.

From 31f71b0e12eb81692853618f7e5e57e44bdb0227 Mon Sep 17 00:00:00 2001
From: 9seconds <nineseconds@yandex.ru>
Date: Tue, 10 Jul 2018 09:59:30 +0300
Subject: [PATCH 3/3] Satisfy linters

---
 config/config.go | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/config/config.go b/config/config.go
index 52cc25c..396d1fa 100644
--- a/config/config.go
+++ b/config/config.go
@@ -91,9 +91,7 @@ func NewConfig(debug, verbose bool, // nolint: gocyclo
 	publicIPv6 net.IP, publicIPv6Port uint16,
 	statsIP net.IP, statsPort uint16,
 	secret, adtag string) (*Config, error) {
-	if strings.HasPrefix(secret, "dd") {
-		secret = secret[2:]
-	}
+	secret = strings.TrimPrefix(secret, "dd")
 	if len(secret) != 32 {
 		return nil, errors.New("Telegram demands secret of length 32")
 	}