Merge remote-tracking branch 'origin/stable' into v2

Allow using directory bind mounts for a docker container

.gitattributes

@@ -0,0 +1,3 @@
+# git config merge.theirs.name "Always accept theirs"
+# git config merge.theirs.driver "cp %B %A"
+default.pgo binary merge=theirs

.goreleaser.yml

@@ -10,13 +10,15 @@ before:
     - go generate ./...
 
 builds:
-  - binary: '{{ .ProjectName }}'
+  - id: default
+    binary: '{{ .ProjectName }}'
     goos:
       - darwin
       - freebsd
       - linux
       - netbsd
       - openbsd
+      - windows
     goarch:
       - 386
       - amd64
@@ -34,15 +36,92 @@ builds:
     ignore:
       - goos: darwin
         goarch: 386
+      - goos: darwin
+        goarch: arm
       - goos: freebsd
         goarch: arm64
       - goos: netbsd
         goarch: arm64
       - goos: openbsd
         goarch: arm64
+      - goos: windows
+        goarch: 386
+      - goos: windows
+        goarch: arm
+  - id: mips
+    binary: '{{ .ProjectName }}'
+    goos:
+      - linux
+    goarch:
+      - mips
+      - mipsle
+    gomips:
+      - softfloat
+    env:
+      - CGO_ENABLED=0
+    flags:
+      - -trimpath
+      - -mod=readonly
+    ldflags: -s -w -X main.version={{ .Version }}
+  - id: arm64-v9
+    binary: '{{ .ProjectName }}'
+    goos:
+      - darwin
+      - linux
+    goarch:
+      - arm64
+    goarm64:
+      - v9.0
+    env:
+      - CGO_ENABLED=0
+    flags:
+      - -trimpath
+      - -mod=readonly
+    ldflags: -s -w -X main.version={{ .Version }}
+  - id: amd64-v3
+    binary: '{{ .ProjectName }}'
+    goos:
+      - darwin
+      - freebsd
+      - linux
+      - netbsd
+      - openbsd
+      - windows
+    goarch:
+      - amd64
+    goamd64:
+      - v3
+    env:
+      - CGO_ENABLED=0
+    flags:
+      - -trimpath
+      - -mod=readonly
+    ldflags: -s -w -X main.version={{ .Version }}
 
 archives:
-  - name_template: '{{ .ProjectName }}-{{ .Version }}-{{ .Os }}-{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}'
+  - id: default
+    ids:
+      - default
+      - mips
+    name_template: '{{ .ProjectName }}-{{ .Version }}-{{ .Os }}-{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}'
+    formats:
+      - tar.gz
+    wrap_in_directory: true
+    format_overrides:
+      - goos: windows
+        formats:
+          - zip
+    files:
+      - LICENSE
+      - README.md
+      - SECURITY.md
+      - BEST_PRACTICES.md
+      - example.config.toml
+  - id: optimized
+    ids:
+      - arm64-v9
+      - amd64-v3
+    name_template: '{{ .ProjectName }}-{{ .Version }}-{{ .Os }}-{{ .Arch }}{{ if .Arm64 }}-{{ .Arm64 }}{{ end }}{{ if .Amd64 }}-{{ .Amd64 }}{{ end }}'
     formats:
       - tar.gz
     wrap_in_directory: true

Dockerfile

@@ -5,6 +5,19 @@ FROM golang:1.26-alpine AS build
 
 ENV CGO_ENABLED=0
 
+# this is done for backward compatibility: before that we mounted a config
+# into /config.toml. Some application allow mounting directories only,
+# so it makes problems. So, instead we are going to do 2 steps:
+#  1. Create /config/config.toml as a symlink to /config.toml
+#  2. Force /mtg to use /config/config.toml
+#
+# it helps in both ways: users with directories could use /config directory
+# and overlap a symlink by their bind mount. Old users could continue using
+# /config.toml as a real config.
+RUN set -x \
+  && mkdir -p /config \
+  && ln -sv /config.toml /config/config.toml
+
 RUN --mount=type=cache,target=/var/cache/apk \
     set -x \
     && apk --update add \
@@ -35,8 +48,9 @@ RUN set -x \
 FROM scratch
 
 ENTRYPOINT ["/mtg"]
-CMD ["run", "/config.toml"]
+CMD ["run", "/config/config.toml"]
 
 COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 COPY --from=build /app/mtg /mtg
 COPY --from=build /app/example.config.toml /config.toml
+COPY --from=build /config /config

README.md

@@ -301,6 +301,38 @@ For example, you've bought a VPS from [Digital
 Ocean](https://www.digitalocean.com/). Then it might be a good idea to
 generate a secret for _digitalocean.com_ then.
 
+### Check configuration
+
+There is a special command for secret verification:
+
+```
+$ mtg doctor /path/to/my/config.toml
+Deprecated options
+  ✅ All good
+Time skewness
+  ✅ Time drift is -607.048µs, but tolerate-time-skewness is 5s
+Validate native network connectivity
+  ✅ DC 1
+  ✅ DC 2
+  ✅ DC 3
+  ✅ DC 4
+  ✅ DC 5
+  ✅ DC 203
+Validate network connectivity with proxy socks5://127.0.0.1:1080
+  ✅ DC 1
+  ✅ DC 2
+  ✅ DC 3
+  ✅ DC 4
+  ✅ DC 5
+  ✅ DC 203
+Validate fronting domain connectivity
+  ✅ xx.xx.xx.xx:yyy is reachable
+Validate SNI-DNS match
+  ✅ IP address xx.xx.xx.xx matches secret hostname <REDACTED>
+```
+
+It aims to find out possible inconsistencies and problems with your
+configuration. It makes sense to run it before executing any relevant commands.
 
 ### Simple run mode
 
@@ -380,6 +412,7 @@ ExecStart=/usr/local/bin/mtg run /etc/mtg.toml
 Restart=always
 RestartSec=3
 DynamicUser=true
+LimitNOFILE=65536
 AmbientCapabilities=CAP_NET_BIND_SERVICE
 
 [Install]

essentials/addresses.go

@@ -0,0 +1,30 @@
+package essentials
+
+// TelegramCoreAddresses are publicly known addresses of Telegram core network.
+var TelegramCoreAddresses = map[int][]string{
+	1: {
+		"149.154.175.50:443",
+		"[2001:b28:f23d:f001::a]:443",
+	},
+	2: {
+		"149.154.167.51:443",
+		"95.161.76.100:443",
+		"[2001:67c:04e8:f002::a]:443",
+	},
+	3: {
+		"149.154.175.100:443",
+		"[2001:b28:f23d:f003::a]:443",
+	},
+	4: {
+		"149.154.167.91:443",
+		"[2001:67c:04e8:f004::a]:443",
+	},
+	5: {
+		"149.154.171.5:443",
+		"[2001:b28:f23f:f005::a]:443",
+	},
+	203: {
+		"91.105.192.100:443",
+		"[2a0a:f280:0203:000a:5000:0000:0000:0100]:443",
+	},
+}

go.mod

@@ -11,7 +11,7 @@ require (
 	github.com/d4l3k/messagediff v1.2.1 // indirect
 	github.com/jarcoal/httpmock v1.0.8
 	github.com/mccutchen/go-httpbin v1.1.1
-	github.com/panjf2000/ants/v2 v2.11.6
+	github.com/panjf2000/ants/v2 v2.12.0
 	github.com/prometheus/client_golang v1.23.2
 	github.com/prometheus/common v0.67.5 // indirect
 	github.com/prometheus/procfs v0.20.1 // indirect
@@ -27,6 +27,7 @@ require (
 )
 
 require (
+	github.com/beevik/ntp v1.5.0
 	github.com/ncruces/go-dns v1.3.2
 	github.com/pelletier/go-toml/v2 v2.2.4
 	github.com/pires/go-proxyproto v0.11.0

go.sum

@@ -12,6 +12,8 @@ github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPd
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
 github.com/babolivier/go-doh-client v0.0.0-20201028162107-a76cff4cb8b6 h1:4NNbNM2Iq/k57qEu7WfL67UrbPq1uFWxW4qODCohi+0=
 github.com/babolivier/go-doh-client v0.0.0-20201028162107-a76cff4cb8b6/go.mod h1:J29hk+f9lJrblVIfiJOtTFk+OblBawmib4uz/VdKzlg=
+github.com/beevik/ntp v1.5.0 h1:y+uj/JjNwlY2JahivxYvtmv4ehfi3h74fAuABB9ZSM4=
+github.com/beevik/ntp v1.5.0/go.mod h1:mJEhBrwT76w9D+IfOEGvuzyuudiW9E52U2BaTrMOYow=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
@@ -53,8 +55,8 @@ github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/ncruces/go-dns v1.3.2 h1:kBLuUZBgkQ4qF4WDXZRQ4rG0Gk6sLVJQ5tESkWrxUa0=
 github.com/ncruces/go-dns v1.3.2/go.mod h1:tuzixNY8PY/M7yUzcvRbUaeLs3ifIdydpi5H2bfRU+s=
-github.com/panjf2000/ants/v2 v2.11.6 h1:JKsoIUukIoCO0sP0gcOqdyoXmpyKXuU6fC57rODtpug=
-github.com/panjf2000/ants/v2 v2.11.6/go.mod h1:8u92CYMUc6gyvTIw8Ru7Mt7+/ESnJahz5EVtqfrilek=
+github.com/panjf2000/ants/v2 v2.12.0 h1:u9JhESo83i/GkZnhfTNuFMMWcNt7mnV1bGJ6FT4wXH8=
+github.com/panjf2000/ants/v2 v2.12.0/go.mod h1:tSQuaNQ6r6NRhPt+IZVUevvDyFMTs+eS4ztZc52uJTY=
 github.com/patrickmn/go-cache v2.1.0+incompatible h1:HRMgzkcYKYpi3C8ajMPV8OFXaaRUnok+kx1WdO15EQc=
 github.com/patrickmn/go-cache v2.1.0+incompatible/go.mod h1:3Qf8kWWT7OJRJbdiICTKqZju1ZixQ/KpMGzzAfe6+WQ=
 github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=

internal/cli/access.go

@@ -1,22 +1,16 @@
 package cli
 
 import (
-	"context"
 	"encoding/json"
 	"fmt"
-	"io"
 	"net"
-	"net/http"
 	"net/url"
 	"os"
 	"strconv"
-	"strings"
 	"sync"
 
-	"github.com/9seconds/mtg/v2/essentials"
 	"github.com/9seconds/mtg/v2/internal/config"
 	"github.com/9seconds/mtg/v2/internal/utils"
-	"github.com/9seconds/mtg/v2/mtglib"
 )
 
 type accessResponse struct {
@@ -65,7 +59,7 @@ func (a *Access) Run(cli *CLI, version string) error {
 	wg.Go(func() {
 		ip := a.PublicIPv4
 		if ip == nil {
-			ip = a.getIP(ntw, "tcp4")
+			ip = getIP(ntw, "tcp4")
 		}
 
 		if ip != nil {
@@ -77,7 +71,7 @@ func (a *Access) Run(cli *CLI, version string) error {
 	wg.Go(func() {
 		ip := a.PublicIPv6
 		if ip == nil {
-			ip = a.getIP(ntw, "tcp6")
+			ip = getIP(ntw, "tcp6")
 		}
 
 		if ip != nil {
@@ -100,45 +94,6 @@ func (a *Access) Run(cli *CLI, version string) error {
 	return nil
 }
 
-func (a *Access) getIP(ntw mtglib.Network, protocol string) net.IP {
-	dialer := ntw.NativeDialer()
-	client := ntw.MakeHTTPClient(func(ctx context.Context, network, address string) (essentials.Conn, error) {
-		conn, err := dialer.DialContext(ctx, protocol, address)
-		if err != nil {
-			return nil, err
-		}
-		return essentials.WrapNetConn(conn), err
-	})
-
-	req, err := http.NewRequest(http.MethodGet, "https://ifconfig.co", nil) //nolint: noctx
-	if err != nil {
-		panic(err)
-	}
-
-	req.Header.Add("Accept", "text/plain")
-
-	resp, err := client.Do(req)
-	if err != nil {
-		return nil
-	}
-
-	if resp.StatusCode != http.StatusOK {
-		return nil
-	}
-
-	defer func() {
-		io.Copy(io.Discard, resp.Body) //nolint: errcheck
-		resp.Body.Close()              //nolint: errcheck
-	}()
-
-	data, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return nil
-	}
-
-	return net.ParseIP(strings.TrimSpace(string(data)))
-}
-
 func (a *Access) makeURLs(conf *config.Config, ip net.IP) *accessResponseURLs {
 	if ip == nil {
 		return nil

internal/cli/cli.go

@@ -4,6 +4,7 @@ import "github.com/alecthomas/kong"
 
 type CLI struct {
 	GenerateSecret GenerateSecret   `kong:"cmd,help='Generate new proxy secret'"`
+	Doctor         Doctor           `kong:"cmd,help='Check that proxy can run correctly'"`
 	Access         Access           `kong:"cmd,help='Print access information.'"`
 	Run            Run              `kong:"cmd,help='Run proxy.'"`
 	SimpleRun      SimpleRun        `kong:"cmd,help='Run proxy without config file.'"`

internal/cli/doctor.go

@@ -0,0 +1,368 @@
+package cli
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"maps"
+	"net"
+	"os"
+	"slices"
+	"strconv"
+	"strings"
+	"text/template"
+	"time"
+
+	"github.com/9seconds/mtg/v2/essentials"
+	"github.com/9seconds/mtg/v2/internal/config"
+	"github.com/9seconds/mtg/v2/internal/utils"
+	"github.com/9seconds/mtg/v2/mtglib"
+	"github.com/9seconds/mtg/v2/network/v2"
+	"github.com/beevik/ntp"
+)
+
+var (
+	tplError = template.Must(
+		template.New("").Parse("  ‼️ {{ .description }}: {{ .error }}\n"),
+	)
+
+	tplWDeprecatedConfig = template.Must(
+		template.New("").
+			Parse(`  ⚠️ Option {{ .old | printf "%q" }}{{ if .old_section }} from section [{{ .old_section }}]{{ end }} is deprecated and will be removed in v{{ .when }}. Please use {{ .new | printf "%q" }}{{ if .new_section }} in [{{ .new_section }}] section{{ end }} instead.` + "\n"),
+	)
+
+	tplOTimeSkewness = template.Must(
+		template.New("").
+			Parse("  ✅ Time drift is {{ .drift }}, but tolerate-time-skewness is {{ .value }}\n"),
+	)
+	tplWTimeSkewness = template.Must(
+		template.New("").
+			Parse("  ⚠️ Time drift is {{ .drift }}, but tolerate-time-skewness is {{ .value }}. Please check ntp.\n"),
+	)
+	tplETimeSkewness = template.Must(
+		template.New("").
+			Parse("  ❌ Time drift is {{ .drift }}, but tolerate-time-skewness is {{ .value }}. You will get many rejected connections!\n"),
+	)
+
+	tplODCConnect = template.Must(
+		template.New("").Parse("  ✅ DC {{ .dc }}\n"),
+	)
+	tplEDCConnect = template.Must(
+		template.New("").Parse("  ❌ DC {{ .dc }}: {{ .error }}\n"),
+	)
+
+	tplODNSSNIMatch = template.Must(
+		template.New("").Parse("  ✅ IP address {{ .ip }} matches secret hostname {{ .hostname }}\n"),
+	)
+	tplEDNSSNIMatch = template.Must(
+		template.New("").Parse("  ❌ Hostname {{ .hostname }} {{ if .resolved }}is resolved to {{ .resolved }} addresses, not {{ if .ip4 }}{{ .ip4 }}{{ else }}{{ .ip6 }}{{ end }}{{ else }}cannot be resolved to any host{{ end }}\n"),
+	)
+
+	tplOFrontingDomain = template.Must(
+		template.New("").Parse("  ✅ {{ .address }} is reachable\n"),
+	)
+	tplEFrontingDomain = template.Must(
+		template.New("").Parse("  ❌ {{ .address }}: {{ .error }}\n"),
+	)
+)
+
+type Doctor struct {
+	conf *config.Config
+
+	ConfigPath string `kong:"arg,required,type='existingfile',help='Path to the configuration file.',name='config-path'"` //nolint: lll
+}
+
+func (d *Doctor) Run(cli *CLI, version string) error {
+	conf, err := utils.ReadConfig(d.ConfigPath)
+	if err != nil {
+		return fmt.Errorf("cannot init config: %w", err)
+	}
+
+	d.conf = conf
+
+	fmt.Println("Deprecated options")
+	everythingOK := d.checkDeprecatedConfig()
+
+	fmt.Println("Time skewness")
+	everythingOK = d.checkTimeSkewness() && everythingOK
+
+	resolver, err := network.GetDNS(conf.GetDNS())
+	if err != nil {
+		return fmt.Errorf("cannot create DNS resolver: %w", err)
+	}
+
+	base := network.New(
+		resolver,
+		"",
+		conf.Network.Timeout.TCP.Get(10*time.Second),
+		conf.Network.Timeout.HTTP.Get(0),
+		conf.Network.Timeout.Idle.Get(0),
+	)
+
+	fmt.Println("Validate native network connectivity")
+	everythingOK = d.checkNetwork(base) && everythingOK
+
+	for _, url := range conf.Network.Proxies {
+		value, err := network.NewProxyNetwork(base, url.Get(nil))
+		if err != nil {
+			return err
+		}
+
+		fmt.Printf("Validate network connectivity with proxy %s\n", url.Get(nil))
+		everythingOK = d.checkNetwork(value) && everythingOK
+	}
+
+	fmt.Println("Validate fronting domain connectivity")
+	everythingOK = d.checkFrontingDomain(base) && everythingOK
+
+	fmt.Println("Validate SNI-DNS match")
+	everythingOK = d.checkSecretHost(resolver, base) && everythingOK
+
+	if !everythingOK {
+		os.Exit(1)
+	}
+
+	return nil
+}
+
+func (d *Doctor) checkDeprecatedConfig() bool {
+	ok := true
+
+	if d.conf.DomainFrontingIP.Value != nil {
+		ok = false
+		tplWDeprecatedConfig.Execute(os.Stdout, map[string]string{ //nolint: errcheck
+			"when":        "2.3.0",
+			"old":         "domain-fronting-ip",
+			"old_section": "",
+			"new":         "ip",
+			"new_section": "domain-fronting",
+		})
+	}
+
+	if d.conf.DomainFrontingPort.Value != 0 {
+		ok = false
+		tplWDeprecatedConfig.Execute(os.Stdout, map[string]string{ //nolint: errcheck
+			"when":        "2.3.0",
+			"old":         "domain-fronting-port",
+			"old_section": "",
+			"new":         "port",
+			"new_section": "domain-fronting",
+		})
+	}
+
+	if d.conf.DomainFrontingProxyProtocol.Value {
+		ok = false
+		tplWDeprecatedConfig.Execute(os.Stdout, map[string]string{ //nolint: errcheck
+			"when":        "2.3.0",
+			"old":         "domain-fronting-proxy-protocol",
+			"old_section": "",
+			"new":         "proxy-protocol",
+			"new_section": "domain-fronting",
+		})
+	}
+
+	if d.conf.Network.DOHIP.Value != nil {
+		ok = false
+		tplWDeprecatedConfig.Execute(os.Stdout, map[string]string{ //nolint: errcheck
+			"when":        "2.3.0",
+			"old":         "doh-ip",
+			"old_section": "network",
+			"new":         "dns",
+			"new_section": "network",
+		})
+	}
+
+	if ok {
+		fmt.Println("  ✅ All good")
+	}
+
+	return ok
+}
+
+func (d *Doctor) checkTimeSkewness() bool {
+	response, err := ntp.Query("0.pool.ntp.org")
+	if err != nil {
+		tplError.Execute(os.Stdout, map[string]any{ //nolint: errcheck
+			"description": "cannot access ntp pool",
+			"error":       err,
+		})
+		return false
+	}
+
+	skewness := response.ClockOffset.Abs()
+	confValue := d.conf.TolerateTimeSkewness.Get(mtglib.DefaultTolerateTimeSkewness)
+	diff := float64(skewness) / float64(confValue)
+	tplData := map[string]any{
+		"drift": response.ClockOffset,
+		"value": confValue,
+	}
+
+	switch {
+	case diff < 0.3:
+		tplOTimeSkewness.Execute(os.Stdout, tplData) //nolint: errcheck
+		return true
+	case diff < 0.7:
+		tplWTimeSkewness.Execute(os.Stdout, tplData) //nolint: errcheck
+	default:
+		tplETimeSkewness.Execute(os.Stdout, tplData) //nolint: errcheck
+	}
+
+	return false
+}
+
+func (d *Doctor) checkNetwork(ntw mtglib.Network) bool {
+	dcs := slices.Collect(maps.Keys(essentials.TelegramCoreAddresses))
+	slices.Sort(dcs)
+
+	ok := true
+
+	for _, dc := range dcs {
+		err := d.checkNetworkAddresses(ntw, essentials.TelegramCoreAddresses[dc])
+		if err == nil {
+			tplODCConnect.Execute(os.Stdout, map[string]any{ //nolint: errcheck
+				"dc": dc,
+			})
+		} else {
+			tplEDCConnect.Execute(os.Stdout, map[string]any{ //nolint: errcheck
+				"dc":    dc,
+				"error": err,
+			})
+			ok = false
+		}
+	}
+
+	return ok
+}
+
+func (d *Doctor) checkNetworkAddresses(ntw mtglib.Network, addresses []string) error {
+	checkAddresses := []string{}
+
+	switch d.conf.PreferIP.Get("prefer-ip4") {
+	case "only-ipv4":
+		for _, addr := range addresses {
+			host, _, err := net.SplitHostPort(addr)
+			if err != nil {
+				panic(err)
+			}
+
+			if ip := net.ParseIP(host); ip != nil && ip.To4() != nil {
+				checkAddresses = append(checkAddresses, addr)
+			}
+		}
+	case "only-ipv6":
+		for _, addr := range addresses {
+			host, _, err := net.SplitHostPort(addr)
+			if err != nil {
+				panic(err)
+			}
+
+			if ip := net.ParseIP(host); ip != nil && ip.To4() == nil {
+				checkAddresses = append(checkAddresses, addr)
+			}
+		}
+	default:
+		checkAddresses = addresses
+	}
+
+	if len(checkAddresses) == 0 {
+		return fmt.Errorf("no suitable addresses after IP version filtering")
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	var (
+		conn net.Conn
+		err  error
+	)
+
+	for _, addr := range checkAddresses {
+		conn, err = ntw.DialContext(ctx, "tcp", addr)
+		if err != nil {
+			continue
+		}
+
+		conn.Close() //nolint: errcheck
+
+		return nil
+	}
+
+	return err
+}
+
+func (d *Doctor) checkFrontingDomain(ntw mtglib.Network) bool {
+	host := d.conf.Secret.Host
+	if ip := d.conf.GetDomainFrontingIP(nil); ip != "" {
+		host = ip
+	}
+
+	port := d.conf.GetDomainFrontingPort(mtglib.DefaultDomainFrontingPort)
+	address := net.JoinHostPort(host, strconv.Itoa(int(port)))
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	dialer := ntw.NativeDialer()
+
+	conn, err := dialer.DialContext(ctx, "tcp", address)
+	if err != nil {
+		tplEFrontingDomain.Execute(os.Stdout, map[string]any{ //nolint: errcheck
+			"address": address,
+			"error":   err,
+		})
+		return false
+	}
+
+	conn.Close() //nolint: errcheck
+
+	tplOFrontingDomain.Execute(os.Stdout, map[string]any{ //nolint: errcheck
+		"address": address,
+	})
+
+	return true
+}
+
+func (d *Doctor) checkSecretHost(resolver *net.Resolver, ntw mtglib.Network) bool {
+	addresses, err := resolver.LookupIPAddr(context.Background(), d.conf.Secret.Host)
+	if err != nil {
+		tplError.Execute(os.Stdout, map[string]any{ //nolint: errcheck
+			"description": fmt.Sprintf("cannot resolve DNS name of %s", d.conf.Secret.Host),
+			"error":       err,
+		})
+		return false
+	}
+
+	ourIP4 := getIP(ntw, "tcp4")
+	ourIP6 := getIP(ntw, "tcp6")
+
+	if ourIP4 == nil && ourIP6 == nil {
+		tplError.Execute(os.Stdout, map[string]any{ //nolint: errcheck
+			"description": "cannot detect public IP address",
+			"error":       errors.New("ifconfig.co is unreachable for both IPv4 and IPv6"),
+		})
+		return false
+	}
+
+	strAddresses := []string{}
+	for _, value := range addresses {
+		if (ourIP4 != nil && value.IP.String() == ourIP4.String()) ||
+			(ourIP6 != nil && value.IP.String() == ourIP6.String()) {
+			tplODNSSNIMatch.Execute(os.Stdout, map[string]any{ //nolint: errcheck
+				"ip":       value.IP,
+				"hostname": d.conf.Secret.Host,
+			})
+			return true
+		}
+
+		strAddresses = append(strAddresses, `"`+value.IP.String()+`"`)
+	}
+
+	tplEDNSSNIMatch.Execute(os.Stdout, map[string]any{ //nolint: errcheck
+		"hostname": d.conf.Secret.Host,
+		"resolved": strings.Join(strAddresses, ", "),
+		"ip4":      ourIP4,
+		"ip6":      ourIP6,
+	})
+
+	return false
+}

internal/cli/run_proxy.go

@@ -253,6 +253,7 @@ func runProxy(conf *config.Config, version string) error { //nolint: funlen
 		EventStream:     eventStream,
 
 		Secret:                      conf.Secret,
+		Concurrency:                 conf.GetConcurrency(mtglib.DefaultConcurrency),
 		DomainFrontingPort:          conf.GetDomainFrontingPort(mtglib.DefaultDomainFrontingPort),
 		DomainFrontingIP:            conf.GetDomainFrontingIP(nil),
 		DomainFrontingProxyProtocol: conf.GetDomainFrontingProxyProtocol(false),

internal/cli/utils.go

@@ -0,0 +1,51 @@
+package cli
+
+import (
+	"context"
+	"io"
+	"net"
+	"net/http"
+	"strings"
+
+	"github.com/9seconds/mtg/v2/essentials"
+	"github.com/9seconds/mtg/v2/mtglib"
+)
+
+func getIP(ntw mtglib.Network, protocol string) net.IP {
+	dialer := ntw.NativeDialer()
+	client := ntw.MakeHTTPClient(func(ctx context.Context, network, address string) (essentials.Conn, error) {
+		conn, err := dialer.DialContext(ctx, protocol, address)
+		if err != nil {
+			return nil, err
+		}
+		return essentials.WrapNetConn(conn), err
+	})
+
+	req, err := http.NewRequest(http.MethodGet, "https://ifconfig.co", nil) //nolint: noctx
+	if err != nil {
+		panic(err)
+	}
+
+	req.Header.Add("Accept", "text/plain")
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return nil
+	}
+
+	defer func() {
+		io.Copy(io.Discard, resp.Body) //nolint: errcheck
+		resp.Body.Close()              //nolint: errcheck
+	}()
+
+	data, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil
+	}
+
+	return net.ParseIP(strings.TrimSpace(string(data)))
+}

internal/config/config.go

@@ -84,6 +84,13 @@ type Config struct {
 	} `json:"stats"`
 }
 
+func (c *Config) GetConcurrency(defaultValue uint) uint {
+	if concurrency := c.Concurrency.Get(0); concurrency != 0 {
+		return concurrency
+	}
+	return c.Concurrency.Get(defaultValue)
+}
+
 func (c *Config) GetDNS() *url.URL {
 	var dohURL *url.URL
 

main.go

@@ -14,6 +14,23 @@ import (
 )
 
 func main() {
+	// this runs profiling server. To enable it, build with prof tag
+	//   $ go build -tags prof
+	//
+	// Then you can pass a port using MTG_PROF_PORT environment variable.
+	// Default is 6000
+	//   $ MTG_PROF_PORT=6000 mtg run config.toml
+	//
+	// It will run a webserver with profiling data on
+	// localhost:${MTG_PROF_PORT:-6000}.
+	//
+	// To collect PGO do following:
+	//   $ curl -o default.pgo 'http://localhost:6000/debug/pprof/profile?seconds=300'
+	//
+	// See also https://pkg.go.dev/net/http/pprof
+	//          https://go.dev/blog/pprof
+	runProfile()
+
 	cli := &cli.CLI{}
 	ctx := kong.Parse(cli, kong.Vars{
 		"version": getVersion(),

mise.lock

@@ -1,11 +1,36 @@
+# @generated - this file is auto-generated by `mise lock` https://mise.jdx.dev/dev-tools/mise-lock.html
+
 [[tools.go]]
 version = "1.26.1"
 backend = "core:go"
-"platforms.linux-arm64" = { checksum = "sha256:a290581cfe4fe28ddd737dde3095f3dbeb7f2e4065cab4eae44dfc53b760c2f7", url = "https://dl.google.com/go/go1.26.1.linux-arm64.tar.gz"}
-"platforms.linux-x64" = { checksum = "sha256:031f088e5d955bab8657ede27ad4e3bc5b7c1ba281f05f245bcc304f327c987a", url = "https://dl.google.com/go/go1.26.1.linux-amd64.tar.gz"}
-"platforms.macos-arm64" = { checksum = "sha256:353df43a7811ce284c8938b5f3c7df40b7bfb6f56cb165b150bc40b5e2dd541f", url = "https://dl.google.com/go/go1.26.1.darwin-arm64.tar.gz"}
-"platforms.macos-x64" = { checksum = "sha256:65773dab2f8cc4cd23d93ba6d0a805de150ca0b78378879292be0b903b8cdd08", url = "https://dl.google.com/go/go1.26.1.darwin-amd64.tar.gz"}
-"platforms.windows-x64" = { checksum = "sha256:9b68112c913f45b7aebbf13c036721264bbba7e03a642f8f7490c561eebd1ecc", url = "https://dl.google.com/go/go1.26.1.windows-amd64.zip"}
+
+[tools.go."platforms.linux-arm64"]
+checksum = "sha256:a290581cfe4fe28ddd737dde3095f3dbeb7f2e4065cab4eae44dfc53b760c2f7"
+url = "https://dl.google.com/go/go1.26.1.linux-arm64.tar.gz"
+
+[tools.go."platforms.linux-arm64-musl"]
+checksum = "sha256:a290581cfe4fe28ddd737dde3095f3dbeb7f2e4065cab4eae44dfc53b760c2f7"
+url = "https://dl.google.com/go/go1.26.1.linux-arm64.tar.gz"
+
+[tools.go."platforms.linux-x64"]
+checksum = "sha256:031f088e5d955bab8657ede27ad4e3bc5b7c1ba281f05f245bcc304f327c987a"
+url = "https://dl.google.com/go/go1.26.1.linux-amd64.tar.gz"
+
+[tools.go."platforms.linux-x64-musl"]
+checksum = "sha256:031f088e5d955bab8657ede27ad4e3bc5b7c1ba281f05f245bcc304f327c987a"
+url = "https://dl.google.com/go/go1.26.1.linux-amd64.tar.gz"
+
+[tools.go."platforms.macos-arm64"]
+checksum = "sha256:353df43a7811ce284c8938b5f3c7df40b7bfb6f56cb165b150bc40b5e2dd541f"
+url = "https://dl.google.com/go/go1.26.1.darwin-arm64.tar.gz"
+
+[tools.go."platforms.macos-x64"]
+checksum = "sha256:65773dab2f8cc4cd23d93ba6d0a805de150ca0b78378879292be0b903b8cdd08"
+url = "https://dl.google.com/go/go1.26.1.darwin-amd64.tar.gz"
+
+[tools.go."platforms.windows-x64"]
+checksum = "sha256:9b68112c913f45b7aebbf13c036721264bbba7e03a642f8f7490c561eebd1ecc"
+url = "https://dl.google.com/go/go1.26.1.windows-amd64.zip"
 
 [[tools."go:golang.org/x/pkgsite/cmd/pkgsite"]]
 version = "latest"
@@ -24,19 +49,73 @@ version = "0.9.2"
 backend = "go:mvdan.cc/gofumpt"
 
 [[tools.golangci-lint]]
-version = "2.11.3"
+version = "2.11.4"
 backend = "aqua:golangci/golangci-lint"
-"platforms.linux-arm64" = { checksum = "sha256:ee3d95f301359e7d578e6d99c8ad5aeadbabc5a13009a30b2b0df11c8058afe9", url = "https://github.com/golangci/golangci-lint/releases/download/v2.11.3/golangci-lint-2.11.3-linux-arm64.tar.gz"}
-"platforms.linux-x64" = { checksum = "sha256:87bb8cddbcc825d5778b64e8a91b46c0526b247f4e2f2904dea74ec7450475d1", url = "https://github.com/golangci/golangci-lint/releases/download/v2.11.3/golangci-lint-2.11.3-linux-amd64.tar.gz"}
-"platforms.macos-arm64" = { checksum = "sha256:30ee39979c516b9d1adca289a3f93429d130c4c0fda5e57d637850894221f6cc", url = "https://github.com/golangci/golangci-lint/releases/download/v2.11.3/golangci-lint-2.11.3-darwin-arm64.tar.gz"}
-"platforms.macos-x64" = { checksum = "sha256:f93bda1f2cc981fd1326464020494be62f387bbf262706e1b3b644e5afacc440", url = "https://github.com/golangci/golangci-lint/releases/download/v2.11.3/golangci-lint-2.11.3-darwin-amd64.tar.gz"}
-"platforms.windows-x64" = { checksum = "sha256:cd42e890176bc5cfeb36225a77e66b9410ddd3a59a03551e23f6b210d29e1f67", url = "https://github.com/golangci/golangci-lint/releases/download/v2.11.3/golangci-lint-2.11.3-windows-amd64.zip"}
+
+[tools.golangci-lint."platforms.linux-arm64"]
+checksum = "sha256:3bcfa2e6f3d32b2bf5cd75eaa876447507025e0303698633f722a05331988db4"
+url = "https://github.com/golangci/golangci-lint/releases/download/v2.11.4/golangci-lint-2.11.4-linux-arm64.tar.gz"
+
+[tools.golangci-lint."platforms.linux-arm64-musl"]
+checksum = "sha256:3bcfa2e6f3d32b2bf5cd75eaa876447507025e0303698633f722a05331988db4"
+url = "https://github.com/golangci/golangci-lint/releases/download/v2.11.4/golangci-lint-2.11.4-linux-arm64.tar.gz"
+
+[tools.golangci-lint."platforms.linux-x64"]
+checksum = "sha256:200c5b7503f67b59a6743ccf32133026c174e272b930ee79aa2aa6f37aca7ef1"
+url = "https://github.com/golangci/golangci-lint/releases/download/v2.11.4/golangci-lint-2.11.4-linux-amd64.tar.gz"
+
+[tools.golangci-lint."platforms.linux-x64-musl"]
+checksum = "sha256:200c5b7503f67b59a6743ccf32133026c174e272b930ee79aa2aa6f37aca7ef1"
+url = "https://github.com/golangci/golangci-lint/releases/download/v2.11.4/golangci-lint-2.11.4-linux-amd64.tar.gz"
+
+[tools.golangci-lint."platforms.macos-arm64"]
+checksum = "sha256:02db2a2dae8b26812e53b0688a6f617e3ef1f489790e829ea22862cf76945675"
+url = "https://github.com/golangci/golangci-lint/releases/download/v2.11.4/golangci-lint-2.11.4-darwin-arm64.tar.gz"
+provenance = "github-attestations"
+
+[tools.golangci-lint."platforms.macos-x64"]
+checksum = "sha256:c900d4048db75d1edfd550fd11cf6a9b3008e7caa8e119fcddbc700412d63e60"
+url = "https://github.com/golangci/golangci-lint/releases/download/v2.11.4/golangci-lint-2.11.4-darwin-amd64.tar.gz"
+
+[tools.golangci-lint."platforms.windows-x64"]
+checksum = "sha256:4932cfca5e75bf60fe1c576edf459e5e809e6644664a068185d64b84af3fad9e"
+url = "https://github.com/golangci/golangci-lint/releases/download/v2.11.4/golangci-lint-2.11.4-windows-amd64.zip"
 
 [[tools.goreleaser]]
 version = "2.14.3"
 backend = "aqua:goreleaser/goreleaser"
-"platforms.linux-arm64" = { checksum = "sha256:581a10e53c1176b3e81ee45cf531e02dbf899db0bc7b795669347df4276ce948", url = "https://github.com/goreleaser/goreleaser/releases/download/v2.14.3/goreleaser_Linux_arm64.tar.gz"}
-"platforms.linux-x64" = { checksum = "sha256:dc7faeeeb6da8bdfda788626263a4ae725892a8c7504b975c3234127d4a44579", url = "https://github.com/goreleaser/goreleaser/releases/download/v2.14.3/goreleaser_Linux_x86_64.tar.gz"}
-"platforms.macos-arm64" = { checksum = "sha256:3507798489e107a78aff36b169de48148a335ac26eb3161608d905f3f3a957bd", url = "https://github.com/goreleaser/goreleaser/releases/download/v2.14.3/goreleaser_Darwin_all.tar.gz"}
-"platforms.macos-x64" = { checksum = "sha256:3507798489e107a78aff36b169de48148a335ac26eb3161608d905f3f3a957bd", url = "https://github.com/goreleaser/goreleaser/releases/download/v2.14.3/goreleaser_Darwin_all.tar.gz"}
-"platforms.windows-x64" = { checksum = "sha256:3deea8ff471aa258a2d99f3e5302971d7028647ae8ddaf103257a8113e485a31", url = "https://github.com/goreleaser/goreleaser/releases/download/v2.14.3/goreleaser_Windows_x86_64.zip"}
+
+[tools.goreleaser."platforms.linux-arm64"]
+checksum = "sha256:581a10e53c1176b3e81ee45cf531e02dbf899db0bc7b795669347df4276ce948"
+url = "https://github.com/goreleaser/goreleaser/releases/download/v2.14.3/goreleaser_Linux_arm64.tar.gz"
+provenance = "cosign"
+
+[tools.goreleaser."platforms.linux-arm64-musl"]
+checksum = "sha256:581a10e53c1176b3e81ee45cf531e02dbf899db0bc7b795669347df4276ce948"
+url = "https://github.com/goreleaser/goreleaser/releases/download/v2.14.3/goreleaser_Linux_arm64.tar.gz"
+provenance = "cosign"
+
+[tools.goreleaser."platforms.linux-x64"]
+checksum = "sha256:dc7faeeeb6da8bdfda788626263a4ae725892a8c7504b975c3234127d4a44579"
+url = "https://github.com/goreleaser/goreleaser/releases/download/v2.14.3/goreleaser_Linux_x86_64.tar.gz"
+provenance = "cosign"
+
+[tools.goreleaser."platforms.linux-x64-musl"]
+checksum = "sha256:dc7faeeeb6da8bdfda788626263a4ae725892a8c7504b975c3234127d4a44579"
+url = "https://github.com/goreleaser/goreleaser/releases/download/v2.14.3/goreleaser_Linux_x86_64.tar.gz"
+provenance = "cosign"
+
+[tools.goreleaser."platforms.macos-arm64"]
+checksum = "sha256:3507798489e107a78aff36b169de48148a335ac26eb3161608d905f3f3a957bd"
+url = "https://github.com/goreleaser/goreleaser/releases/download/v2.14.3/goreleaser_Darwin_all.tar.gz"
+provenance = "cosign"
+
+[tools.goreleaser."platforms.macos-x64"]
+checksum = "sha256:3507798489e107a78aff36b169de48148a335ac26eb3161608d905f3f3a957bd"
+url = "https://github.com/goreleaser/goreleaser/releases/download/v2.14.3/goreleaser_Darwin_all.tar.gz"
+provenance = "cosign"
+
+[tools.goreleaser."platforms.windows-x64"]
+checksum = "sha256:3deea8ff471aa258a2d99f3e5302971d7028647ae8ddaf103257a8113e485a31"
+url = "https://github.com/goreleaser/goreleaser/releases/download/v2.14.3/goreleaser_Windows_x86_64.zip"
+provenance = "cosign"

mtglib/internal/dc/init.go

@@ -2,7 +2,10 @@ package dc
 
 import (
 	"context"
+	"net"
 	"time"
+
+	"github.com/9seconds/mtg/v2/essentials"
 )
 
 type preferIP uint8
@@ -39,46 +42,36 @@ type Updater interface {
 }
 
 // https://github.com/telegramdesktop/tdesktop/blob/master/Telegram/SourceFiles/mtproto/mtproto_dc_options.cpp#L30
-var defaultDCAddrSet = dcAddrSet{
-	v4: map[int][]Addr{
-		1: {
-			{Network: "tcp4", Address: "149.154.175.50:443"},
-		},
-		2: {
-			{Network: "tcp4", Address: "149.154.167.51:443"},
-			{Network: "tcp4", Address: "95.161.76.100:443"},
-		},
-		3: {
-			{Network: "tcp4", Address: "149.154.175.100:443"},
-		},
-		4: {
-			{Network: "tcp4", Address: "149.154.167.91:443"},
-		},
-		5: {
-			{Network: "tcp4", Address: "149.154.171.5:443"},
-		},
-		203: {
-			{Network: "tcp4", Address: "91.105.192.100:443"},
-		},
-	},
-	v6: map[int][]Addr{
-		1: {
-			{Network: "tcp6", Address: "[2001:b28:f23d:f001::a]:443"},
-		},
-		2: {
-			{Network: "tcp6", Address: "[2001:67c:04e8:f002::a]:443"},
-		},
-		3: {
-			{Network: "tcp6", Address: "[2001:b28:f23d:f003::a]:443"},
-		},
-		4: {
-			{Network: "tcp6", Address: "[2001:67c:04e8:f004::a]:443"},
-		},
-		5: {
-			{Network: "tcp6", Address: "[2001:b28:f23f:f005::a]:443"},
-		},
-		203: {
-			{Network: "tcp6", Address: "[2a0a:f280:0203:000a:5000:0000:0000:0100]:443"},
-		},
-	},
+var defaultDCAddrSet = (func() dcAddrSet {
+	addrSet := dcAddrSet{
+		v4: make(map[int][]Addr),
+		v6: make(map[int][]Addr),
 	}
+
+	for dcid, ips := range essentials.TelegramCoreAddresses {
+		for _, addr := range ips {
+			host, _, err := net.SplitHostPort(addr)
+			if err != nil {
+				panic(err)
+			}
+
+			ip := net.ParseIP(host)
+			if ip == nil {
+				panic(addr)
+			}
+			if ip.To4() == nil {
+				addrSet.v6[dcid] = append(addrSet.v6[dcid], Addr{
+					Network: "tcp6",
+					Address: addr,
+				})
+			} else {
+				addrSet.v4[dcid] = append(addrSet.v4[dcid], Addr{
+					Network: "tcp4",
+					Address: addr,
+				})
+			}
+		}
+	}
+
+	return addrSet
+})()

mtglib/internal/doppel/conn.go

@@ -20,44 +20,21 @@ type connPayload struct {
 	ctxCancel   context.CancelCauseFunc
 	clock       Clock
 	wg          sync.WaitGroup
-	syncWriteLock sync.RWMutex
 	writeStream bytes.Buffer
-	writeCond     *sync.Cond
+	writtenCond sync.Cond
+	done        bool
 }
 
 func (c Conn) Write(p []byte) (int, error) {
-	c.p.syncWriteLock.RLock()
-	defer c.p.syncWriteLock.RUnlock()
+	if len(p) == 0 {
+		return 0, context.Cause(c.p.ctx)
+	}
 
-	c.p.writeCond.L.Lock()
+	c.p.writtenCond.L.Lock()
 	c.p.writeStream.Write(p)
-	c.p.writeCond.L.Unlock()
+	c.p.writtenCond.L.Unlock()
 
-	return len(p), context.Cause(c.p.ctx)
-}
-
-func (c Conn) SyncWrite(p []byte) (int, error) {
-	c.p.syncWriteLock.Lock()
-	defer c.p.syncWriteLock.Unlock()
-
-	c.p.writeCond.L.Lock()
-	// wait until buffer is exhausted
-	for c.p.writeStream.Len() != 0 && context.Cause(c.p.ctx) == nil {
-		c.p.writeCond.Wait()
-	}
-	c.p.writeStream.Write(p)
-	c.p.writeCond.L.Unlock()
-
-	if err := context.Cause(c.p.ctx); err != nil {
-		return len(p), err
-	}
-
-	c.p.writeCond.L.Lock()
-	// wait until data will be sent
-	for c.p.writeStream.Len() != 0 && context.Cause(c.p.ctx) == nil {
-		c.p.writeCond.Wait()
-	}
-	c.p.writeCond.L.Unlock()
+	c.p.writtenCond.Signal()
 
 	return len(p), context.Cause(c.p.ctx)
 }
@@ -69,8 +46,6 @@ func (c Conn) Start() {
 }
 
 func (c Conn) start() {
-	defer c.p.writeCond.Broadcast()
-
 	buf := [tls.MaxRecordSize]byte{}
 
 	for {
@@ -80,25 +55,34 @@ func (c Conn) start() {
 		case <-c.p.clock.tick:
 		}
 
-		c.p.writeCond.L.Lock()
-		n, err := c.p.writeStream.Read(buf[:c.p.clock.stats.Size()])
-		c.p.writeCond.L.Unlock()
+		size := c.p.clock.stats.Size()
 
-		if n == 0 || err != nil {
+		c.p.writtenCond.L.Lock()
+		for c.p.writeStream.Len() == 0 && !c.p.done {
+			c.p.writtenCond.Wait()
+		}
+		n, _ := c.p.writeStream.Read(buf[tls.SizeHeader : tls.SizeHeader+size])
+		c.p.writtenCond.L.Unlock()
+
+		if n == 0 {
 			continue
 		}
 
-		if err := tls.WriteRecord(c.Conn, buf[:n]); err != nil {
+		if err := tls.WriteRecordInPlace(c.Conn, buf[:], n); err != nil {
 			c.p.ctxCancel(err)
 			return
 		}
-
-		c.p.writeCond.Signal()
 	}
 }
 
 func (c Conn) Stop() {
 	c.p.ctxCancel(nil)
+
+	c.p.writtenCond.L.Lock()
+	c.p.done = true
+	c.p.writtenCond.L.Unlock()
+	c.p.writtenCond.Broadcast()
+
 	c.p.wg.Wait()
 }
 
@@ -109,7 +93,9 @@ func NewConn(ctx context.Context, conn essentials.Conn, stats *Stats) Conn {
 		p: &connPayload{
 			ctx:       ctx,
 			ctxCancel: cancel,
-			writeCond: sync.NewCond(&sync.Mutex{}),
+			writtenCond: sync.Cond{
+				L: &sync.Mutex{},
+			},
 			clock: Clock{
 				stats: stats,
 				tick:  make(chan struct{}),

mtglib/internal/doppel/conn_test.go

@@ -141,6 +141,37 @@ func (suite *ConnTestSuite) TestWriteReturnsErrorAfterStop() {
 	suite.Error(err)
 }
 
+func (suite *ConnTestSuite) TestStopDoesNotDeadlockWhenStartIsWaiting() {
+	suite.connMock.
+		On("Write", mock.AnythingOfType("[]uint8")).
+		Return(0, nil).
+		Maybe()
+
+	for range 100 {
+		func() {
+			ctx, cancel := context.WithCancel(suite.ctx)
+			defer cancel()
+
+			c := NewConn(ctx, suite.connMock, &Stats{
+				k:      2.0,
+				lambda: 0.01,
+			})
+
+			done := make(chan struct{})
+			go func() {
+				defer close(done)
+				c.Stop()
+			}()
+
+			select {
+			case <-done:
+			case <-time.After(2 * time.Second):
+				suite.Fail("Stop() deadlocked: start() likely stuck in writtenCond.Wait()")
+			}
+		}()
+	}
+}
+
 func (suite *ConnTestSuite) TestStopOnUnderlyingWriteError() {
 	suite.connMock.
 		On("Write", mock.AnythingOfType("[]uint8")).
@@ -157,136 +188,6 @@ func (suite *ConnTestSuite) TestStopOnUnderlyingWriteError() {
 	}, 2*time.Second, time.Millisecond)
 }
 
-func (suite *ConnTestSuite) TestSyncWriteDataSent() {
-	suite.connMock.
-		On("Write", mock.AnythingOfType("[]uint8")).
-		Return(0, nil).
-		Maybe()
-
-	c := suite.makeConn()
-	defer c.Stop()
-
-	payload := []byte("sync hello")
-	n, err := c.SyncWrite(payload)
-	suite.NoError(err)
-	suite.Equal(len(payload), n)
-
-	// SyncWrite returns only after data is flushed to the wire.
-	assembled := &bytes.Buffer{}
-	reader := bytes.NewReader(suite.connMock.Written())
-
-	for {
-		header := make([]byte, tls.SizeHeader)
-		if _, err := io.ReadFull(reader, header); err != nil {
-			break
-		}
-
-		suite.Equal(byte(tls.TypeApplicationData), header[0])
-
-		length := binary.BigEndian.Uint16(header[tls.SizeRecordType+tls.SizeVersion:])
-		rec := make([]byte, length)
-		_, err := io.ReadFull(reader, rec)
-		suite.NoError(err)
-
-		assembled.Write(rec)
-	}
-
-	suite.Equal(payload, assembled.Bytes())
-}
-
-func (suite *ConnTestSuite) TestSyncWriteDrainsBufferFirst() {
-	suite.connMock.
-		On("Write", mock.AnythingOfType("[]uint8")).
-		Return(0, nil).
-		Maybe()
-
-	c := suite.makeConn()
-	defer c.Stop()
-
-	// Buffer some data via async Write.
-	_, err := c.Write([]byte("first"))
-	suite.NoError(err)
-
-	// SyncWrite must drain "first" before sending "second".
-	n, err := c.SyncWrite([]byte("second"))
-	suite.NoError(err)
-	suite.Equal(6, n)
-
-	// All data should be on the wire now.
-	assembled := &bytes.Buffer{}
-	reader := bytes.NewReader(suite.connMock.Written())
-
-	for {
-		header := make([]byte, tls.SizeHeader)
-		if _, err := io.ReadFull(reader, header); err != nil {
-			break
-		}
-
-		length := binary.BigEndian.Uint16(header[tls.SizeRecordType+tls.SizeVersion:])
-		rec := make([]byte, length)
-		_, err := io.ReadFull(reader, rec)
-		suite.NoError(err)
-
-		assembled.Write(rec)
-	}
-
-	suite.Equal([]byte("firstsecond"), assembled.Bytes())
-}
-
-func (suite *ConnTestSuite) TestSyncWriteBlocksAsyncWrite() {
-	suite.connMock.
-		On("Write", mock.AnythingOfType("[]uint8")).
-		Return(0, nil).
-		Maybe()
-
-	c := suite.makeConn()
-	defer c.Stop()
-
-	// Start SyncWrite — it holds exclusive lock.
-	syncDone := make(chan struct{})
-
-	go func() {
-		defer close(syncDone)
-		c.SyncWrite([]byte("exclusive")) //nolint: errcheck
-	}()
-
-	// Give SyncWrite time to acquire the lock.
-	time.Sleep(10 * time.Millisecond)
-
-	// Async Write should block until SyncWrite completes.
-	writeDone := make(chan struct{})
-
-	go func() {
-		defer close(writeDone)
-		c.Write([]byte("blocked")) //nolint: errcheck
-	}()
-
-	// SyncWrite should finish first.
-	<-syncDone
-
-	select {
-	case <-writeDone:
-		// Write completed after SyncWrite — correct.
-	case <-time.After(2 * time.Second):
-		suite.Fail("async Write did not unblock after SyncWrite completed")
-	}
-}
-
-func (suite *ConnTestSuite) TestSyncWriteReturnsErrorAfterStop() {
-	suite.connMock.
-		On("Write", mock.AnythingOfType("[]uint8")).
-		Return(0, nil).
-		Maybe()
-
-	c := suite.makeConn()
-	c.Stop()
-
-	time.Sleep(10 * time.Millisecond)
-
-	_, err := c.SyncWrite([]byte("too late"))
-	suite.Error(err)
-}
-
 func TestConn(t *testing.T) {
 	t.Parallel()
 	suite.Run(t, &ConnTestSuite{})

mtglib/internal/doppel/ganger.go

@@ -98,7 +98,8 @@ func (g *Ganger) run() {
 			g.durations = append(g.durations, durations...)
 
 			if len(g.durations) > DoppelGangerMaxDurations {
-				g.durations = g.durations[len(g.durations)-DoppelGangerMaxDurations:]
+				copy(g.durations, g.durations[len(g.durations)-DoppelGangerMaxDurations:])
+				g.durations = g.durations[:DoppelGangerMaxDurations]
 			}
 
 			if len(g.durations) < MinDurationsToCalculate {

mtglib/internal/tls/conn.go

@@ -34,7 +34,6 @@ type Conn struct {
 
 type connPayload struct {
 	readBuf      bytes.Buffer
-	writeBuf     bytes.Buffer
 	connBuffered *bufio.Reader
 	read         bool
 	write        bool
@@ -80,7 +79,6 @@ func New(conn essentials.Conn, read, write bool) Conn {
 	}
 
 	newConn.p.readBuf.Grow(DefaultBufferSize)
-	newConn.p.writeBuf.Grow(DefaultBufferSize)
 
 	return newConn
 }

mtglib/internal/tls/utils.go

@@ -29,20 +29,24 @@ func ReadRecord(r io.Reader, w io.Writer) (byte, int64, error) {
 
 func WriteRecord(w io.Writer, payload []byte) error {
 	buf := [MaxRecordSize]byte{}
-	buf[0] = TypeApplicationData
+	copy(buf[SizeHeader:], payload)
 
-	bufV := buf[SizeRecordType:]
-	copy(bufV[:SizeVersion], TLSVersion[:])
-
-	bufS := bufV[SizeVersion:]
-	binary.BigEndian.PutUint16(bufS[:SizeSize], uint16(len(payload)))
-
-	bufP := buf[SizeHeader:]
-	if n := copy(bufP, payload); n != len(payload) {
-		return fmt.Errorf("copied %d bytes of payload instead of %d", n, len(payload))
+	return WriteRecordInPlace(w, buf[:], len(payload))
 }
 
-	_, err := w.Write(buf[:SizeHeader+len(payload)])
+func WriteRecordInPlace(w io.Writer, buf []byte, payloadLen int) error {
+	if payloadLen > MaxRecordPayloadSize {
+		return fmt.Errorf("payload %d exceeds max %d", payloadLen, MaxRecordPayloadSize)
+	}
+
+	buf[0] = TypeApplicationData
+	copy(buf[SizeRecordType:SizeRecordType+SizeVersion], TLSVersion[:])
+	binary.BigEndian.PutUint16(
+		buf[SizeRecordType+SizeVersion:SizeRecordType+SizeVersion+SizeSize],
+		uint16(payloadLen),
+	)
+
+	_, err := w.Write(buf[:SizeHeader+payloadLen])
 
 	return err
 }

mtglib/internal/tls/utils_test.go

@@ -119,6 +119,84 @@ func (suite *UtilsTestSuite) TestWriteRecordPayloadTooLarge() {
 	suite.Error(err)
 }
 
+func (suite *UtilsTestSuite) TestWriteRecordInPlace() {
+	payload := []byte("hello in-place")
+
+	var buf [MaxRecordSize]byte
+	copy(buf[SizeHeader:], payload)
+
+	err := WriteRecordInPlace(suite.dst, buf[:], len(payload))
+	suite.NoError(err)
+
+	written := suite.dst.Bytes()
+	suite.Equal(byte(TypeApplicationData), written[0])
+	suite.Equal(TLSVersion[:], written[SizeRecordType:SizeRecordType+SizeVersion])
+
+	length := binary.BigEndian.Uint16(written[SizeRecordType+SizeVersion:])
+	suite.Equal(uint16(len(payload)), length)
+	suite.Equal(payload, written[SizeHeader:])
+}
+
+func (suite *UtilsTestSuite) TestWriteRecordInPlaceRoundTrip() {
+	payload := []byte("round trip in-place")
+
+	var buf [MaxRecordSize]byte
+	copy(buf[SizeHeader:], payload)
+
+	var wire bytes.Buffer
+
+	err := WriteRecordInPlace(&wire, buf[:], len(payload))
+	suite.NoError(err)
+
+	var recovered bytes.Buffer
+
+	recordType, length, err := ReadRecord(&wire, &recovered)
+	suite.NoError(err)
+	suite.Equal(byte(TypeApplicationData), recordType)
+	suite.Equal(int64(len(payload)), length)
+	suite.Equal(payload, recovered.Bytes())
+}
+
+func (suite *UtilsTestSuite) TestWriteRecordInPlacePayloadTooLarge() {
+	var buf [MaxRecordSize]byte
+
+	err := WriteRecordInPlace(suite.dst, buf[:], MaxRecordPayloadSize+1)
+	suite.Error(err)
+}
+
+func (suite *UtilsTestSuite) TestWriteRecordInPlacePropagatesError() {
+	m := &WriterMock{}
+	m.
+		On("Write", mock.AnythingOfType("[]uint8")).
+		Once().
+		Return(0, errors.New("disk full"))
+
+	var buf [MaxRecordSize]byte
+	copy(buf[SizeHeader:], []byte("data"))
+
+	err := WriteRecordInPlace(m, buf[:], 4)
+	suite.Error(err)
+
+	m.AssertExpectations(suite.T())
+}
+
+func (suite *UtilsTestSuite) TestWriteRecordInPlaceMatchesWriteRecord() {
+	payload := []byte("equivalence check")
+
+	var legacy bytes.Buffer
+	err := WriteRecord(&legacy, payload)
+	suite.NoError(err)
+
+	var buf [MaxRecordSize]byte
+	copy(buf[SizeHeader:], payload)
+
+	var inPlace bytes.Buffer
+	err = WriteRecordInPlace(&inPlace, buf[:], len(payload))
+	suite.NoError(err)
+
+	suite.Equal(legacy.Bytes(), inPlace.Bytes())
+}
+
 func TestUtils(t *testing.T) {
 	t.Parallel()
 	suite.Run(t, &UtilsTestSuite{})

mtglib/proxy.go

@@ -259,9 +259,16 @@ func (p *Proxy) doTelegramCall(ctx *streamContext) error {
 		ctx:      ctx,
 	}
 
+	telegramHost, _, err := net.SplitHostPort(foundAddr.Address)
+	if err != nil {
+		conn.Close() //nolint: errcheck
+
+		return fmt.Errorf("cannot parse telegram address %s: %w", foundAddr.Address, err)
+	}
+
 	p.eventStream.Send(ctx,
 		NewEventConnectedToDC(ctx.streamID,
-			conn.RemoteAddr().(*net.TCPAddr).IP, //nolint: forcetypeassert
+			net.ParseIP(telegramHost),
 			ctx.dc),
 	)
 

run_profile.go

@@ -0,0 +1,6 @@
+//go:build !prof
+
+package main
+
+func runProfile() {
+}

run_profile_tag_prof.go

@@ -0,0 +1,27 @@
+//go:build prof
+
+package main
+
+import (
+	"fmt"
+	"net"
+	"net/http"
+	_ "net/http/pprof" //nolint: gosec
+	"os"
+)
+
+const DefaultProfPort = "6000"
+
+func runProfile() {
+	port := os.Getenv("MTG_PROF_PORT")
+	if port == "" {
+		port = DefaultProfPort
+	}
+
+	listener, err := net.Listen("tcp", net.JoinHostPort("127.0.0.1", port))
+	if err != nil {
+		panic(err)
+	}
+
+	go http.Serve(listener, nil)
+}