|
|
@@ -17,33 +17,33 @@ are the most notable:
|
|
17
|
17
|
* [Python](https://github.com/alexbers/mtprotoproxy)
|
|
18
|
18
|
* [Erlang](https://github.com/seriyps/mtproto_proxy)
|
|
19
|
19
|
|
|
20
|
|
-Almost all of them follow the way how official proxy was build. This
|
|
21
|
|
-includes support of multiple secrets, support of promoted channels etc.
|
|
|
20
|
+Almost all of them follow the way how official proxy was built. This
|
|
|
21
|
+includes support of multiple secrets, support of promoted channels, etc.
|
|
22
|
22
|
|
|
23
|
23
|
mtg is an implementation in golang which is intended to be:
|
|
24
|
24
|
|
|
25
|
25
|
* **Lightweight**
|
|
26
|
|
- It has to consume as less resources as possible but not by losing
|
|
|
26
|
+ It has to consume as few resources as possible but not by losing
|
|
27
|
27
|
maintainability.
|
|
28
|
28
|
* **Easily deployable**
|
|
29
|
29
|
I strongly believe that Telegram proxies should follow the way of
|
|
30
|
30
|
ShadowSocks: promoted channels is a strange way of doing business
|
|
31
|
31
|
I suppose. I think the only viable way is to have a proxy with
|
|
32
|
32
|
minimum configuration which should work everywhere.
|
|
33
|
|
-* **Single secret**
|
|
34
|
|
- I think that multiple secrets solves no problems and just complexify
|
|
35
|
|
- software. I also believe that in case of throwout proxies, this feature
|
|
36
|
|
- is useless luxury.
|
|
|
33
|
+* **A single secret**
|
|
|
34
|
+ I think that multiple secrets solve no problems and just complexify
|
|
|
35
|
+ software. I also believe that in the case of throwout proxies, this
|
|
|
36
|
+ feature is a useless luxury.
|
|
37
|
37
|
* **Minimum docker image size**
|
|
38
|
38
|
Official image is less than 3 megabytes. Literally.
|
|
39
|
39
|
* **No management WebUI**
|
|
40
|
|
- This is an implementation of simple lightweight proxy. I won't do that.
|
|
|
40
|
+ This is an implementation of a simple lightweight proxy. I won't do that.
|
|
41
|
41
|
|
|
42
|
42
|
This proxy supports 2 modes of work: direct connection to Telegram and
|
|
43
|
43
|
promoted channel mode. If you do not need promoted channels, I would
|
|
44
|
44
|
recommend you to go with direct mode: this way is more robust.
|
|
45
|
45
|
|
|
46
|
|
-To run proxy in direct mode, all you need to do is just provide a
|
|
|
46
|
+To run a proxy in direct mode, all you need to do is just provide a
|
|
47
|
47
|
secret. If you do not provide ADTag as a second parameter, promoted
|
|
48
|
48
|
channels mode won't be activated.
|
|
49
|
49
|
|
|
|
@@ -104,7 +104,7 @@ Also, there is another project on Ansible Galaxy: https://galaxy.ansible.com/iva
|
|
104
|
104
|
|
|
105
|
105
|
# Configuration
|
|
106
|
106
|
|
|
107
|
|
-Basically, to run this tool you need to configure as less as possible. Telegram
|
|
|
107
|
+To run this tool you need to configure as less as possible. Telegram
|
|
108
|
108
|
clients support 3 different secret types:
|
|
109
|
109
|
|
|
110
|
110
|
* Simple - basically, it is just a flow of frames ciphered by AES-CTR stream
|
|
|
@@ -146,22 +146,22 @@ ee852380f362a09343efb4690c4e17862e676f6f676c652e636f6d
|
|
146
|
146
|
|
|
147
|
147
|
## Antireplay cache
|
|
148
|
148
|
|
|
149
|
|
-In order to prevent replay attacks, we have internal storage of first
|
|
150
|
|
-frames messages for connected clients. These frames are generated
|
|
151
|
|
-randomly by design and we have negligible possibility of duplication
|
|
152
|
|
-(probability is 1/(2^64)) but it could be quite effective in order to
|
|
153
|
|
-prevent replays.
|
|
|
149
|
+To prevent replay attacks, we have internal storage of first frames
|
|
|
150
|
+messages for connected clients. These frames are generated randomly
|
|
|
151
|
+by design and we have the negligible possibility of duplication
|
|
|
152
|
+(probability is 1/(2^64)) but it could be quite effective to prevent
|
|
|
153
|
+replays.
|
|
154
|
154
|
|
|
155
|
155
|
|
|
156
|
156
|
## FakeTLS
|
|
157
|
157
|
|
|
158
|
158
|
If you run this a proxy in faketls mode, this proxy will try to hide
|
|
159
|
|
-itself cloaking a host provided as a part of generated secret. It means
|
|
160
|
|
-that if you cloak google.com then you can curl this proxy and you'll get
|
|
161
|
|
-a google.com response back.
|
|
|
159
|
+itself cloaking a host provided as a part of the generated secret. It
|
|
|
160
|
+means that if you cloak google.com then you can curl this proxy and
|
|
|
161
|
+you'll get a google.com response back.
|
|
162
|
162
|
|
|
163
|
|
-mtg proxifies L3 traffic. In other words, only TCP, without interfering
|
|
164
|
|
-in TLS, HTTP or any other high-level protocol.
|
|
|
163
|
+mtg proxies L3 traffic. In other words, only TCP, without interfering in
|
|
|
164
|
+TLS, HTTP or any other high-level protocol.
|
|
165
|
165
|
|
|
166
|
166
|
|
|
167
|
167
|
## Environment variables
|
|
|
@@ -258,11 +258,14 @@ the box, you do not need to setup anything special.
|
|
258
|
258
|
Version 1.0 breaks compatibility with previous versions so please read
|
|
259
|
259
|
this chapter carefully:
|
|
260
|
260
|
|
|
261
|
|
-1. mtg now uses subcommands. Please use `mtg run` instead of just `mtg` to run
|
|
262
|
|
- a proxy.
|
|
263
|
|
-2. Options which set host and port separately were removed in a favor of fused
|
|
264
|
|
- host:port options.
|
|
265
|
|
-3. Own stats server was removed. Prometheus endpoint is moved to default stats
|
|
266
|
|
- endpoint.
|
|
267
|
|
-4. It is possible to connect to this proxy only with a secret which was used to
|
|
268
|
|
- run it. So, no backward compatibility of clients.
|
|
|
261
|
+1. mtg now uses subcommands. Please use `mtg run` instead of just
|
|
|
262
|
+ `mtg` to run a proxy.
|
|
|
263
|
+2. Options which set host and port separately were removed in a
|
|
|
264
|
+ favor of fused `host:port` options.
|
|
|
265
|
+3. Own stats server was removed. Prometheus endpoint is moved to
|
|
|
266
|
+ default stats endpoint.
|
|
|
267
|
+4. It is possible to connect to this proxy only with a secret which
|
|
|
268
|
+ was used to run it. So, no backward compatibility of clients.
|
|
|
269
|
+5. Multiplexing involves connectivity with middle proxies and involves
|
|
|
270
|
+ the most complex code path of this proxy. To avoid potential bugs,
|
|
|
271
|
+ we still recommend using direct mode.
|