init

internal/faketls/domain.go

@@ -0,0 +1,31 @@
+package faketls
+
+// SNIDomain returns hostname bytes for TLS SNI from the raw ee-secret domain suffix.
+//
+// В ссылке tg:// после 16-байтного ключа часто идёт «хвост» домена: один служебный байт (часто 0xd0)
+// и дальше ASCII hostname в hex (например …d0632e61… → "c.api.stepa.one").
+// В extension server_name нужно передавать только hostname в ASCII, иначе прокси обрывает сессию.
+func SNIDomain(raw []byte) []byte {
+	if len(raw) >= 2 {
+		// Типичный префикс Telegram для ASCII-имени после ключа
+		if raw[0] == 0xd0 && raw[1] >= 0x20 && raw[1] < 0x7f {
+			return raw[1:]
+		}
+	}
+	// Fallback: пропускаем ведущие не-hostname байты до первой буквы/цифры/точки
+	i := 0
+	for i < len(raw) {
+		b := raw[i]
+		if (b >= 'a' && b <= 'z') || (b >= 'A' && b <= 'Z') || (b >= '0' && b <= '9') {
+			break
+		}
+		if b == '.' || b == '-' {
+			break
+		}
+		i++
+	}
+	if i >= len(raw) {
+		return raw
+	}
+	return raw[i:]
+}

internal/faketls/domain_test.go

@@ -0,0 +1,20 @@
+package faketls
+
+import (
+	"bytes"
+	"encoding/hex"
+	"testing"
+)
+
+func TestSNIDomain_TelegramD0Prefix(t *testing.T) {
+	// Domain tail from ee5ba9cf...dd0632e6170692e73746570612e6f6e65 (0xd0 + "c.api.stepa.one" hex)
+	d, err := hex.DecodeString("d0632e6170692e73746570612e6f6e65")
+	if err != nil {
+		t.Fatal(err)
+	}
+	got := SNIDomain(d)
+	want := []byte("c.api.stepa.one")
+	if !bytes.Equal(got, want) {
+		t.Fatalf("got %q want %q", got, want)
+	}
+}

internal/faketls/hello.go

@@ -0,0 +1,161 @@
+package faketls
+
+import (
+	"bytes"
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/binary"
+	"fmt"
+	"time"
+)
+
+// Extensions inside ClientHello must total exactly 403 bytes (TelethonFakeTLS / MTProxy expectation).
+const extensionsTotal = 403
+
+// Fixed TLS 1.2 cipher list from telethon-faketls.
+var cipherSuites = []byte{
+	0xfa, 0xfa, 0x13, 0x01, 0x13, 0x02, 0x13, 0x03, 0xc0, 0x2b, 0xc0, 0x2f, 0xc0, 0x2c, 0xc0, 0x30,
+	0xcc, 0xa9, 0xcc, 0xa8, 0xc0, 0x13, 0xc0, 0x14, 0x00, 0x9c, 0x00, 0x9d, 0x00, 0x2f, 0x00, 0x35,
+}
+
+var extBeforeKeyShare = []byte{
+	0x00, 0x17, 0x00, 0x00,
+	0xff, 0x01, 0x00, 0x01, 0x00,
+	0x00, 0x0a, 0x00, 0x0a, 0x00, 0x08, 0xba, 0xba, 0x00, 0x1d, 0x00, 0x17, 0x00, 0x18,
+	0x00, 0x0b, 0x00, 0x02, 0x01, 0x00,
+	0x00, 0x23, 0x00, 0x00,
+	0x00, 0x10, 0x00, 0x0e, 0x00, 0x0c, 0x02, 0x68, 0x32, 0x08, 0x68, 0x74, 0x74, 0x70, 0x2f, 0x31, 0x2e, 0x31,
+	0x00, 0x05, 0x00, 0x05, 0x01, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x0d, 0x00, 0x12, 0x00, 0x10, 0x04, 0x03, 0x08, 0x04, 0x04, 0x01, 0x05, 0x03, 0x08, 0x05, 0x05, 0x01, 0x08, 0x06, 0x06, 0x01,
+	0x00, 0x12, 0x00, 0x00,
+}
+
+var keyShareHeader = []byte{0x00, 0x33, 0x00, 0x2b, 0x00, 0x29, 0xba, 0xba, 0x00, 0x01, 0x00, 0x00, 0x1d, 0x00, 0x20}
+
+var extAfterKeyShare = []byte{
+	0x00, 0x2d, 0x00, 0x02, 0x01, 0x01,
+	0x00, 0x2b, 0x00, 0x0b, 0x0a, 0x9a, 0x9a, 0x03, 0x04, 0x03, 0x03, 0x03, 0x02, 0x03, 0x01,
+	0x00, 0x1b, 0x00, 0x03, 0x02, 0x00, 0x02,
+	0x1a, 0x1a, 0x00, 0x01, 0x00,
+}
+
+func sniExtension(domain []byte) []byte {
+	entry := make([]byte, 0, 3+len(domain))
+	entry = append(entry, 0x00)
+	entry = append(entry, byte(len(domain)>>8), byte(len(domain)))
+	entry = append(entry, domain...)
+	list := make([]byte, 0, 2+len(entry))
+	list = append(list, byte(len(entry)>>8), byte(len(entry)))
+	list = append(list, entry...)
+	out := make([]byte, 0, 4+len(list))
+	out = append(out, 0x00, 0x00)
+	out = append(out, byte(len(list)>>8), byte(len(list)))
+	out = append(out, list...)
+	return out
+}
+
+func buildExtensions(domain []byte, pubKey []byte) ([]byte, error) {
+	if len(pubKey) != 32 {
+		return nil, fmt.Errorf("key share pubkey: need 32 bytes")
+	}
+	var exts bytes.Buffer
+	exts.Write([]byte{0x4a, 0x4a, 0x00, 0x00})
+	exts.Write(sniExtension(domain))
+	exts.Write(extBeforeKeyShare)
+	exts.Write(keyShareHeader)
+	exts.Write(pubKey)
+	exts.Write(extAfterKeyShare)
+
+	core := exts.Len()
+	// padding extension: 00 15 + u16(len) + zeros; total extensions must be 403
+	padHdr := 4
+	padData := extensionsTotal - core - padHdr
+	if padData < 0 {
+		return nil, fmt.Errorf("mtproxy fake-tls: domain too long for fixed 403-byte extension block (core=%d)", core)
+	}
+	exts.Write([]byte{0x00, 0x15})
+	exts.Write([]byte{byte(padData >> 8), byte(padData)})
+	for i := 0; i < padData; i++ {
+		exts.WriteByte(0x00)
+	}
+	if exts.Len() != extensionsTotal {
+		return nil, fmt.Errorf("internal: extensions len %d != %d", exts.Len(), extensionsTotal)
+	}
+	return exts.Bytes(), nil
+}
+
+// ClientHello is the initial raw TLS record and the 32-byte ClientHello.random field (post-HMAC).
+type ClientHello struct {
+	Record      []byte
+	RandomField []byte
+	SessionID   []byte
+}
+
+// BuildClientHello constructs the first wire record (517 bytes) compatible with telethon-faketls.
+func BuildClientHello(secretKey []byte, domain []byte) (*ClientHello, error) {
+	if len(secretKey) != 16 {
+		return nil, fmt.Errorf("secret key must be 16 bytes")
+	}
+	pub, err := GenX25519PublicKey()
+	if err != nil {
+		return nil, err
+	}
+	sessionID, err := Rand32()
+	if err != nil {
+		return nil, err
+	}
+	exts, err := buildExtensions(domain, pub)
+	if err != nil {
+		return nil, err
+	}
+
+	// ClientHello body = 508 bytes
+	var body bytes.Buffer
+	body.Write([]byte{0x03, 0x03})
+	randomZero := make([]byte, 32)
+	body.Write(randomZero)
+	body.WriteByte(32)
+	body.Write(sessionID)
+	body.Write([]byte{0x00, 0x20})
+	body.Write(cipherSuites)
+	body.WriteByte(0x01)
+	body.WriteByte(0x00)
+	body.Write([]byte{byte(extensionsTotal >> 8), byte(extensionsTotal & 0xff)})
+	body.Write(exts)
+	if body.Len() != 508 {
+		return nil, fmt.Errorf("internal: client hello body %d != 508", body.Len())
+	}
+
+	handshake := make([]byte, 0, 4+508)
+	handshake = append(handshake, 0x01)
+	handshake = append(handshake, byte(508>>16), byte((508>>8)&0xff), byte(508&0xff))
+	handshake = append(handshake, body.Bytes()...)
+
+	record := make([]byte, 0, 5+len(handshake))
+	record = append(record, 0x16, 0x03, 0x01)
+	record = binary.BigEndian.AppendUint16(record, uint16(len(handshake)))
+	record = append(record, handshake...)
+
+	randomField := computeRandomField(secretKey, record)
+	copy(record[11:43], randomField)
+
+	return &ClientHello{Record: record, RandomField: randomField, SessionID: sessionID}, nil
+}
+
+func computeRandomField(secretKey []byte, record []byte) []byte {
+	msg := make([]byte, 0, len(record))
+	msg = append(msg, record[:11]...)
+	msg = append(msg, make([]byte, 32)...)
+	msg = append(msg, record[43:]...)
+	mac := hmac.New(sha256.New, secretKey)
+	mac.Write(msg)
+	digest := mac.Sum(nil)
+	ts := uint32(time.Now().Unix())
+	tsb := []byte{byte(ts), byte(ts >> 8), byte(ts >> 16), byte(ts >> 24)}
+	out := make([]byte, 32)
+	copy(out[:28], digest[:28])
+	for i := 0; i < 4; i++ {
+		out[28+i] = digest[28+i] ^ tsb[i]
+	}
+	return out
+}

internal/faketls/hello_test.go

@@ -0,0 +1,32 @@
+package faketls
+
+import (
+	"bytes"
+	"encoding/hex"
+	"testing"
+)
+
+func TestBuildClientHello_Size(t *testing.T) {
+	key, err := hex.DecodeString("5ba9cf5cf84698032e5300c864544dd0")
+	if err != nil || len(key) != 16 {
+		t.Fatalf("key: %v len %d", err, len(key))
+	}
+	domain, err := hex.DecodeString("632e6170692e73746570612e6f6e65")
+	if err != nil {
+		t.Fatal(err)
+	}
+	ch, err := BuildClientHello(key, domain)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(ch.Record) != 517 {
+		t.Fatalf("record len %d", len(ch.Record))
+	}
+	if !bytes.HasPrefix(ch.Record, []byte{0x16, 0x03, 0x01}) {
+		t.Fatal("bad record header")
+	}
+	pl := int(ch.Record[3])<<8 | int(ch.Record[4])
+	if pl != 512 {
+		t.Fatalf("record payload len %d", pl)
+	}
+}

internal/faketls/tdesktop.go

@@ -0,0 +1,471 @@
+// Генерация ClientHello по логике Telegram Desktop (mtproto_tls_socket.cpp, PrepareClientHelloRules).
+// См. https://github.com/telegramdesktop/tdesktop/blob/dev/Telegram/SourceFiles/mtproto/details/mtproto_tls_socket.cpp
+
+package faketls
+
+import (
+	"crypto/ed25519"
+	"crypto/hmac"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/binary"
+	"fmt"
+	"math/big"
+	"time"
+)
+
+const (
+	kMaxGrease        = 8
+	kClientHelloLimit = 2048
+	kHelloDigestLen   = 32
+	kLengthSize       = 2
+	kElementsM        = 384
+	kAddedM           = 32
+)
+
+// BuildTdesktopClientHello строит запись TLS 1.2 ClientHello как в tdesktop (Ed25519, permutation, ECH padding, HMAC).
+func BuildTdesktopClientHello(secretKey []byte, domain []byte) (*ClientHello, error) {
+	if len(secretKey) != 16 {
+		return nil, fmt.Errorf("secret key must be 16 bytes")
+	}
+	greases := prepareGreases()
+	p := newTdesktopPart(domain, greases)
+	writeClientHelloRules(p)
+	if p.err {
+		return nil, fmt.Errorf("tdesktop client hello: build failed")
+	}
+	p.finalize(secretKey)
+	if p.err {
+		return nil, fmt.Errorf("tdesktop client hello: finalize failed")
+	}
+	digest := p.extractDigest()
+	out := p.take()
+	if len(out) == 0 {
+		return nil, fmt.Errorf("tdesktop client hello: empty buffer")
+	}
+	return &ClientHello{
+		Record:      out,
+		RandomField: append([]byte(nil), digest...),
+		SessionID:   p.sessionID(),
+	}, nil
+}
+
+func prepareGreases() []byte {
+	result := make([]byte, kMaxGrease)
+	if _, err := rand.Read(result); err != nil {
+		return bytesRepeat(0x0a, kMaxGrease)
+	}
+	for i := range result {
+		result[i] = (result[i] & 0xf0) + 0x0a
+	}
+	for i := 0; i < kMaxGrease; i += 2 {
+		if result[i] == result[i+1] {
+			result[i+1] ^= 0x10
+		}
+	}
+	return result
+}
+
+func bytesRepeat(b byte, n int) []byte {
+	out := make([]byte, n)
+	for i := range out {
+		out[i] = b
+	}
+	return out
+}
+
+type tdesktopPart struct {
+	domain         []byte
+	greases        []byte
+	buf            []byte
+	digestPosition int
+	err            bool
+}
+
+func newTdesktopPart(domain []byte, greases []byte) *tdesktopPart {
+	return &tdesktopPart{
+		domain:         domain,
+		greases:        greases,
+		digestPosition: -1,
+	}
+}
+
+func (p *tdesktopPart) grow(n int) []byte {
+	if p.err || n <= 0 || len(p.buf)+n > kClientHelloLimit {
+		p.err = true
+		return nil
+	}
+	off := len(p.buf)
+	p.buf = append(p.buf, make([]byte, n)...)
+	return p.buf[off : off+n]
+}
+
+func (p *tdesktopPart) writeString(b []byte) {
+	st := p.grow(len(b))
+	if st == nil {
+		return
+	}
+	copy(st, b)
+}
+
+func (p *tdesktopPart) writeZeros(n int) {
+	already := len(p.buf)
+	st := p.grow(n)
+	if st == nil {
+		return
+	}
+	if n == kHelloDigestLen && p.digestPosition < 0 {
+		p.digestPosition = already
+	}
+	clear(st)
+}
+
+func (p *tdesktopPart) writeGrease(seed int) {
+	if seed < 0 || seed >= len(p.greases) {
+		p.err = true
+		return
+	}
+	st := p.grow(2)
+	if st == nil {
+		return
+	}
+	// В tdesktop: bytes::set_with_const(storage, _greases[seed]) — оба байта равны значению seed.
+	st[0] = p.greases[seed]
+	st[1] = p.greases[seed]
+}
+
+func (p *tdesktopPart) writeRandom(n int) {
+	st := p.grow(n)
+	if st == nil {
+		return
+	}
+	if _, err := rand.Read(st); err != nil {
+		p.err = true
+	}
+}
+
+func (p *tdesktopPart) writeDomain() {
+	st := p.grow(len(p.domain))
+	if st == nil {
+		return
+	}
+	copy(st, p.domain)
+}
+
+func (p *tdesktopPart) writeEd25519PublicKey() {
+	pub, _, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		p.err = true
+		return
+	}
+	st := p.grow(32)
+	if st == nil {
+		return
+	}
+	copy(st, pub)
+}
+
+func (p *tdesktopPart) writeScope(f func()) {
+	st := p.grow(kLengthSize)
+	if st == nil {
+		return
+	}
+	already := len(p.buf)
+	f()
+	length := len(p.buf) - already
+	if length > 65535 {
+		p.err = true
+		return
+	}
+	binary.BigEndian.PutUint16(p.buf[already-2:already], uint16(length))
+}
+
+func (p *tdesktopPart) newSubPart() *tdesktopPart {
+	return newTdesktopPart(p.domain, p.greases)
+}
+
+func (p *tdesktopPart) writePermutation(elements []func(*tdesktopPart)) {
+	var parts [][]byte
+	for _, el := range elements {
+		sub := p.newSubPart()
+		el(sub)
+		if sub.err {
+			p.err = true
+			return
+		}
+		parts = append(parts, sub.take())
+	}
+	shuffleByteSlices(parts)
+	for _, b := range parts {
+		if p.err {
+			return
+		}
+		st := p.grow(len(b))
+		if st == nil {
+			return
+		}
+		copy(st, b)
+	}
+}
+
+func shuffleByteSlices(s [][]byte) {
+	n := len(s)
+	for i := n - 1; i > 0; i-- {
+		jBig, err := rand.Int(rand.Reader, big.NewInt(int64(i+1)))
+		j := 0
+		if err != nil {
+			j = i
+		} else {
+			j = int(jBig.Int64())
+		}
+		s[i], s[j] = s[j], s[i]
+	}
+}
+
+func (p *tdesktopPart) writeM() {
+	kElements := kElementsM
+	kAdded := kAddedM
+	storage := p.grow(kElements*3 + kAdded)
+	if storage == nil {
+		return
+	}
+	random := make([]byte, kElements*8+kAdded)
+	if _, err := rand.Read(random); err != nil {
+		p.err = true
+		return
+	}
+	chars := storage
+	ints := make([]uint32, len(random)/4)
+	for i := 0; i < len(ints); i++ {
+		ints[i] = binary.LittleEndian.Uint32(random[i*4 : i*4+4])
+	}
+	ci := 0
+	for i := 0; i < kElements; i++ {
+		a := int(ints[i*2] % 3329)
+		b := int(ints[i*2+1] % 3329)
+		chars[ci] = byte(a & 255)
+		chars[ci+1] = byte((a >> 8) + ((b & 15) << 4))
+		chars[ci+2] = byte(b >> 4)
+		ci += 3
+	}
+	tail := storage[kElements*3:]
+	if _, err := rand.Read(tail); err != nil {
+		p.err = true
+	}
+}
+
+func (p *tdesktopPart) writeE() {
+	lengths := []int{144, 176, 208, 240}
+	var pick [1]byte
+	if _, err := rand.Read(pick[:]); err != nil {
+		p.err = true
+		return
+	}
+	length := lengths[int(pick[0])%len(lengths)]
+	p.writeRandom(length)
+}
+
+func (p *tdesktopPart) writePadding() {
+	if p.err {
+		return
+	}
+	cur := len(p.buf)
+	if cur >= 513 {
+		return
+	}
+	z := 513 - cur
+	p.writeString([]byte{0x00, 0x15})
+	p.writeScope(func() {
+		p.writeZeros(z)
+	})
+}
+
+func (p *tdesktopPart) finalize(key []byte) {
+	if p.err || p.digestPosition < 0 {
+		p.err = true
+		return
+	}
+	mac := hmac.New(sha256.New, key)
+	mac.Write(p.buf)
+	sum := mac.Sum(nil)
+	copy(p.buf[p.digestPosition:p.digestPosition+kHelloDigestLen], sum)
+	injectTimestamp(p.buf[p.digestPosition : p.digestPosition+kHelloDigestLen])
+}
+
+func injectTimestamp(digest32 []byte) {
+	if len(digest32) != 32 {
+		return
+	}
+	st := digest32[28:32]
+	u := binary.LittleEndian.Uint32(st)
+	ts := uint32(time.Now().Unix())
+	u ^= ts
+	binary.LittleEndian.PutUint32(st, u)
+}
+
+func (p *tdesktopPart) extractDigest() []byte {
+	if p.digestPosition < 0 {
+		return nil
+	}
+	return append([]byte(nil), p.buf[p.digestPosition:p.digestPosition+kHelloDigestLen]...)
+}
+
+func (p *tdesktopPart) take() []byte {
+	if p.err {
+		return nil
+	}
+	return append([]byte(nil), p.buf...)
+}
+
+// sessionID: первый 32-байтный Random сразу после префикса 0x20 (session id в ClientHello).
+func (p *tdesktopPart) sessionID() []byte {
+	if p.err {
+		return nil
+	}
+	return firstR32Payload(p.buf)
+}
+
+func firstR32Payload(buf []byte) []byte {
+	pat := []byte{0x03, 0x03}
+	i := bytesIndex(buf, pat)
+	if i < 0 {
+		return nil
+	}
+	j := i + len(pat) + 32 // после Z(32) digest
+	if j+1+32 > len(buf) {
+		return nil
+	}
+	if buf[j] != 0x20 {
+		return nil
+	}
+	return append([]byte(nil), buf[j+1:j+1+32]...)
+}
+
+func bytesIndex(hay []byte, needle []byte) int {
+outer:
+	for i := 0; i+len(needle) <= len(hay); i++ {
+		for k := range needle {
+			if hay[i+k] != needle[k] {
+				continue outer
+			}
+		}
+		return i
+	}
+	return -1
+}
+
+var cipherList32 = []byte{
+	0x13, 0x01, 0x13, 0x02, 0x13, 0x03, 0xc0, 0x2b, 0xc0, 0x2f, 0xc0, 0x2c, 0xc0, 0x30,
+	0xcc, 0xa9, 0xcc, 0xa8, 0xc0, 0x13, 0xc0, 0x14, 0x00, 0x9c, 0x00, 0x9d, 0x00, 0x2f, 0x00, 0x35,
+	0x01, 0x00,
+}
+
+func writeClientHelloRules(p *tdesktopPart) {
+	p.writeString([]byte{0x16, 0x03, 0x01})
+	p.writeScope(func() {
+		p.writeString([]byte{0x01, 0x00})
+		p.writeScope(func() {
+			p.writeString([]byte{0x03, 0x03})
+			p.writeZeros(32)
+			p.writeString([]byte{0x20})
+			p.writeRandom(32)
+			p.writeString([]byte{0x00, 0x20})
+			p.writeGrease(0)
+			p.writeString(cipherList32)
+			p.writeScope(func() {
+				p.writeGrease(2)
+				p.writeString([]byte{0x00, 0x00})
+				p.writePermutation(tdesktopPermutationElements())
+				p.writeGrease(3)
+				p.writeString([]byte{0x00, 0x01, 0x00})
+				p.writePadding()
+			})
+		})
+	})
+}
+
+func tdesktopPermutationElements() []func(*tdesktopPart) {
+	return []func(*tdesktopPart){
+		func(p *tdesktopPart) {
+			p.writeString([]byte{0x00, 0x00})
+			p.writeScope(func() {
+				p.writeScope(func() {
+					p.writeString([]byte{0x00})
+					p.writeScope(func() {
+						p.writeDomain()
+					})
+				})
+			})
+		},
+		func(p *tdesktopPart) {
+			p.writeString([]byte{0x00, 0x05, 0x00, 0x05, 0x01, 0x00, 0x00, 0x00, 0x00})
+		},
+		func(p *tdesktopPart) {
+			p.writeString([]byte{0x00, 0x0a, 0x00, 0x0c, 0x00, 0x0a})
+			p.writeGrease(4)
+			p.writeString([]byte{0x11, 0xec, 0x00, 0x1d, 0x00, 0x17, 0x00, 0x18})
+		},
+		func(p *tdesktopPart) {
+			p.writeString([]byte{0x00, 0x0b, 0x00, 0x02, 0x01, 0x00})
+		},
+		func(p *tdesktopPart) {
+			p.writeString([]byte{
+				0x00, 0x0d, 0x00, 0x12, 0x00, 0x10, 0x04, 0x03, 0x08, 0x04, 0x04, 0x01, 0x05, 0x03,
+				0x08, 0x05, 0x05, 0x01, 0x08, 0x06, 0x06, 0x01,
+			})
+		},
+		func(p *tdesktopPart) {
+			p.writeString([]byte{
+				0x00, 0x10, 0x00, 0x0e, 0x00, 0x0c, 0x02, 0x68, 0x32, 0x08, 0x68, 0x74, 0x74, 0x70,
+				0x2f, 0x31, 0x2e, 0x31,
+			})
+		},
+		func(p *tdesktopPart) {
+			p.writeString([]byte{0x00, 0x12, 0x00, 0x00})
+		},
+		func(p *tdesktopPart) {
+			p.writeString([]byte{0x00, 0x17, 0x00, 0x00})
+		},
+		func(p *tdesktopPart) {
+			p.writeString([]byte{0x00, 0x1b, 0x00, 0x03, 0x02, 0x00, 0x02})
+		},
+		func(p *tdesktopPart) {
+			p.writeString([]byte{0x00, 0x23, 0x00, 0x00})
+		},
+		func(p *tdesktopPart) {
+			p.writeString([]byte{0x00, 0x2b, 0x00, 0x07, 0x06})
+			p.writeGrease(6)
+			p.writeString([]byte{0x03, 0x04, 0x03, 0x03})
+		},
+		func(p *tdesktopPart) {
+			p.writeString([]byte{0x00, 0x2d, 0x00, 0x02, 0x01, 0x01})
+		},
+		func(p *tdesktopPart) {
+			p.writeString([]byte{0x00, 0x33, 0x04, 0xef, 0x04, 0xed})
+			p.writeGrease(4)
+			p.writeString([]byte{0x00, 0x01, 0x00, 0x11, 0xec, 0x04, 0xc0})
+			p.writeM()
+			p.writeEd25519PublicKey()
+			p.writeString([]byte{0x00, 0x1d, 0x00, 0x20})
+			p.writeEd25519PublicKey()
+		},
+		func(p *tdesktopPart) {
+			p.writeString([]byte{0x44, 0xcd, 0x00, 0x05, 0x00, 0x03, 0x02, 0x68, 0x32})
+		},
+		func(p *tdesktopPart) {
+			p.writeString([]byte{0xfe, 0x0d})
+			p.writeScope(func() {
+				p.writeString([]byte{0x00, 0x00, 0x01, 0x00, 0x01})
+				p.writeRandom(1)
+				p.writeString([]byte{0x00, 0x20})
+				p.writeRandom(32)
+				p.writeScope(func() {
+					p.writeE()
+				})
+			})
+		},
+		func(p *tdesktopPart) {
+			p.writeString([]byte{0xff, 0x01, 0x00, 0x01, 0x00})
+		},
+	}
+}

internal/faketls/tdesktop_test.go

@@ -0,0 +1,34 @@
+package faketls
+
+import (
+	"bytes"
+	"encoding/hex"
+	"testing"
+)
+
+func TestBuildTdesktopClientHello_shape(t *testing.T) {
+	key, err := hex.DecodeString("5ba9cf5cf84698032e5300c864544dd0")
+	if err != nil || len(key) != 16 {
+		t.Fatalf("key: %v len %d", err, len(key))
+	}
+	domain, err := hex.DecodeString("632e6170692e73746570612e6f6e65")
+	if err != nil {
+		t.Fatal(err)
+	}
+	ch, err := BuildTdesktopClientHello(key, domain)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(ch.Record) < 5 || len(ch.Record) > kClientHelloLimit {
+		t.Fatalf("record len %d", len(ch.Record))
+	}
+	if !bytes.HasPrefix(ch.Record, []byte{0x16, 0x03, 0x01}) {
+		t.Fatal("bad record header")
+	}
+	if len(ch.RandomField) != 32 {
+		t.Fatalf("random/digest field len %d", len(ch.RandomField))
+	}
+	if len(ch.SessionID) != 32 {
+		t.Fatalf("session id len %d", len(ch.SessionID))
+	}
+}

internal/faketls/tlsapp.go

@@ -0,0 +1,25 @@
+package faketls
+
+import (
+	"io"
+)
+
+// WriteTLSApplicationData wraps payload in TLS 1.2 application records (type 0x17).
+func WriteTLSApplicationData(w io.Writer, p []byte) error {
+	const maxChunk = 16384
+	for off := 0; off < len(p); off += maxChunk {
+		end := off + maxChunk
+		if end > len(p) {
+			end = len(p)
+		}
+		chunk := p[off:end]
+		hdr := []byte{0x17, 0x03, 0x03, byte(len(chunk) >> 8), byte(len(chunk))}
+		if _, err := w.Write(hdr); err != nil {
+			return err
+		}
+		if _, err := w.Write(chunk); err != nil {
+			return err
+		}
+	}
+	return nil
+}

internal/faketls/verify.go

@@ -0,0 +1,115 @@
+package faketls
+
+import (
+	"bytes"
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/binary"
+	"fmt"
+	"io"
+)
+
+// Маркеры и разбор длин — как в mtproto_tls_socket.cpp (checkHelloParts12 / checkHelloParts34),
+// а не фиксированные 127+6+3+2 байта telethon + «http»-хвост (на части хостов это давало ложную длину хвоста).
+var (
+	kServerHelloPart1 = []byte{0x16, 0x03, 0x03}
+	kServerHelloPart3 = []byte{0x14, 0x03, 0x03, 0x00, 0x01, 0x01, 0x17, 0x03, 0x03}
+)
+
+const kTLSLengthSize = 2
+
+// ReadServerHello читает цепочку fake-TLS ServerHello до конца части, по которой считается digest (как в tdesktop).
+func ReadServerHello(r io.Reader) ([]byte, error) {
+	parts1Size := len(kServerHelloPart1) + kTLSLengthSize
+	header := make([]byte, parts1Size)
+	if _, err := io.ReadFull(r, header); err != nil {
+		return nil, fmt.Errorf("read tls record header: %w", err)
+	}
+	part1Off := parts1Size - kTLSLengthSize - len(kServerHelloPart1)
+	if !bytes.Equal(header[part1Off:part1Off+len(kServerHelloPart1)], kServerHelloPart1) {
+		return nil, fmt.Errorf("server hello: bad tls prefix")
+	}
+	part2Size := int(binary.BigEndian.Uint16(header[parts1Size-kTLSLengthSize:]))
+	if part2Size <= 0 || part2Size > 1<<20 {
+		return nil, fmt.Errorf("invalid tls fragment length %d", part2Size)
+	}
+	midLen := part2Size + len(kServerHelloPart3) + kTLSLengthSize
+	mid := make([]byte, midLen)
+	if _, err := io.ReadFull(r, mid); err != nil {
+		return nil, fmt.Errorf("read server hello body: %w", err)
+	}
+	part3Off := part2Size
+	if !bytes.Equal(mid[part3Off:part3Off+len(kServerHelloPart3)], kServerHelloPart3) {
+		return nil, fmt.Errorf("server hello: unexpected middle tls markers")
+	}
+	part4Size := int(binary.BigEndian.Uint16(mid[len(mid)-kTLSLengthSize:]))
+	if part4Size < 0 || part4Size > 1<<20 {
+		return nil, fmt.Errorf("invalid final fragment length %d", part4Size)
+	}
+	tail := make([]byte, part4Size)
+	if _, err := io.ReadFull(r, tail); err != nil {
+		return nil, fmt.Errorf("read server hello final fragment: %w", err)
+	}
+	out := append(append(append([]byte{}, header...), mid...), tail...)
+	return out, nil
+}
+
+// VerifyServerHelloFull validates the proxy response (telethon-faketls rules).
+func VerifyServerHelloFull(full []byte, secretKey []byte, clientRandom []byte, sessionID []byte) error {
+	if len(full) < 127+6+3+2 {
+		return fmt.Errorf("server hello too short")
+	}
+	if !bytes.HasPrefix(full, []byte{0x16, 0x03, 0x03}) {
+		return fmt.Errorf("server hello: bad tls prefix")
+	}
+	marker := []byte{0x14, 0x03, 0x03, 0x00, 0x01, 0x01, 0x17, 0x03, 0x03}
+	if len(full) < 127+len(marker) || !bytes.Equal(full[127:127+len(marker)], marker) {
+		return fmt.Errorf("server hello: unexpected middle tls markers")
+	}
+	sidStart := 11 + 32 + 1
+	if len(full) < sidStart+32 || !bytes.Equal(full[sidStart:sidStart+32], sessionID) {
+		return fmt.Errorf("server hello: session id mismatch")
+	}
+	patched := make([]byte, len(full))
+	copy(patched, full)
+	clear(patched[11:43])
+	mac := hmac.New(sha256.New, secretKey)
+	mac.Write(clientRandom)
+	mac.Write(patched)
+	want := mac.Sum(nil)
+	if !bytes.Equal(full[11:43], want) {
+		return fmt.Errorf("server hello: digest mismatch")
+	}
+	return nil
+}
+
+const (
+	kServerHelloDigestPosition = 11
+)
+
+// VerifyServerHelloTdesktop проверяет ответ прокси по правилам mtproto_tls_socket.cpp (checkHelloDigest):
+// HMAC-SHA256(key, client_digest||server_bytes) при обнулённом digest сервера в буфере.
+func VerifyServerHelloTdesktop(serverResponse []byte, secretKey []byte, clientDigest []byte) error {
+	if len(secretKey) != 16 {
+		return fmt.Errorf("secret key must be 16 bytes")
+	}
+	if len(clientDigest) != 32 {
+		return fmt.Errorf("client digest must be 32 bytes")
+	}
+	if len(serverResponse) < kServerHelloDigestPosition+32 {
+		return fmt.Errorf("server hello too short for digest")
+	}
+	fulldata := make([]byte, 0, len(clientDigest)+len(serverResponse))
+	fulldata = append(fulldata, clientDigest...)
+	fulldata = append(fulldata, serverResponse...)
+	digestOff := len(clientDigest) + kServerHelloDigestPosition
+	digestCopy := append([]byte(nil), fulldata[digestOff:digestOff+32]...)
+	clear(fulldata[digestOff : digestOff+32])
+	mac := hmac.New(sha256.New, secretKey)
+	mac.Write(fulldata)
+	want := mac.Sum(nil)
+	if !bytes.Equal(digestCopy, want) {
+		return fmt.Errorf("server hello: digest mismatch (tdesktop)")
+	}
+	return nil
+}

internal/faketls/x25519_fake.go

@@ -0,0 +1,27 @@
+package faketls
+
+import (
+	crand "crypto/rand"
+
+	"golang.org/x/crypto/curve25519"
+)
+
+// GenX25519PublicKey returns a valid X25519 public key (32 bytes) for the ClientHello key_share extension.
+// Some MTProxy builds validate the point; a random quadratic residue mod P (older telethon-faketls trick) is rejected.
+func GenX25519PublicKey() ([]byte, error) {
+	var priv, pub [32]byte
+	if _, err := crand.Read(priv[:]); err != nil {
+		return nil, err
+	}
+	curve25519.ScalarBaseMult(&pub, &priv)
+	return pub[:], nil
+}
+
+// Rand32 returns 32 random bytes (session id).
+func Rand32() ([]byte, error) {
+	b := make([]byte, 32)
+	if _, err := crand.Read(b); err != nil {
+		return nil, err
+	}
+	return b, nil
+}