internal/cli: consolidate duplicated SNI-DNS check

contrib/sni-router/Caddyfile

@@ -10,14 +10,16 @@
 	# to Caddy's access log.  The `tls` wrapper must follow so that TLS
 	# is terminated on the unwrapped connection.
 	#
-	# `allow` lists the networks permitted to send PROXY headers.  These
-	# ranges cover docker compose's default bridge networks; tighten
-	# them if you pin a specific subnet in docker-compose.yml.
+	# `allow` lists the networks permitted to send PROXY headers.
+	# 127.0.0.1/32 covers HAProxy reaching Caddy over host loopback (HAProxy
+	# runs in network_mode: host and connects to the published 127.0.0.1
+	# port).  The RFC1918 ranges cover mtg → Caddy on the compose bridge
+	# (fronting path; see "Fronting loop" in README.md).
 	servers :8443 {
 		listener_wrappers {
 			proxy_protocol {
 				timeout 5s
-				allow 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
+				allow 127.0.0.1/32 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
 			}
 			tls
 		}

contrib/sni-router/README.md

@@ -63,6 +63,29 @@ must stay in sync:
 If you disable one, disable all four, otherwise the backend will fail
 to parse the connection.
 
+### Why HAProxy uses `network_mode: host`
+
+A published port on a bridge network rewrites the source IP of inbound
+connections to the bridge gateway before HAProxy sees it (Docker's
+`docker-proxy`, Podman's `slirp4netns`/`pasta`), so the PROXY v2 header
+HAProxy forwards downstream carries that gateway address, not the real
+client.  Host-mode HAProxy binds in the host netns directly, no NAT in
+the path, and the rewrite never happens.  mtg and Caddy stay on the
+compose bridge and are published on `127.0.0.1` only — HAProxy reaches
+them over host loopback.  `mtg-config.toml` does not need to change;
+fronting still uses `host = "web"` over compose-network DNS.
+
+**Trade-offs.**
+- HAProxy owns the host's `:443` and `:80` — don't run anything else
+  on those ports.
+- Linux host only.  On Docker Desktop (macOS/Windows), "host" means
+  the Linux VM, not the user's machine, so external clients can't
+  reach the proxy.
+- If you run Docker with `userns-remap`, the in-container "root"
+  loses the privilege to bind `<1024` on the host; either disable
+  `userns-remap` for this stack or lower `net.ipv4.ip_unprivileged_port_start`
+  on the host.
+
 ## Fronting loop (why `[domain-fronting]` is set explicitly)
 
 When mtg sees TLS that isn't valid Telegram (a probe or a browser

contrib/sni-router/docker-compose.yml

@@ -27,9 +27,10 @@ x-domain-env: &domain-env
 services:
   haproxy:
     image: haproxy:lts-alpine
-    ports:
-      - "443:443"
-      - "80:80"
+    # Host netns so HAProxy sees real client IPs (v4/v6) instead of the
+    # bridge gateway address.  Linux host only; see README → "Why HAProxy
+    # uses network_mode: host" for the rationale and trade-off.
+    network_mode: host
     volumes:
       - ./haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro,Z
     environment:
@@ -38,16 +39,16 @@ services:
       - mtg
       - web
     restart: unless-stopped
-    sysctls:
-      - net.ipv4.ip_unprivileged_port_start=80
 
   mtg:
     # FIXME: :master until #480 lands in a tagged release; switch back to :2/:3 after release
     image: nineseconds/mtg:master
     volumes:
       - ./mtg-config.toml:/config/config.toml:ro,Z
-    expose:
-      - "3128"
+    # Published on host loopback only — HAProxy (host netns) reaches it via
+    # 127.0.0.1.
+    ports:
+      - "127.0.0.1:3128:3128"
     restart: unless-stopped
     extra_hosts:
       - "host.containers.internal:host-gateway"
@@ -58,9 +59,11 @@ services:
       - ./Caddyfile:/etc/caddy/Caddyfile:ro,Z
       - caddy_data:/data
       - ./www:/srv:ro,Z
-    expose:
-      - "80"
-      - "8443"
+    # Published on host loopback only — HAProxy reaches Caddy on 127.0.0.1.
+    # Port 8080 (not 80) on the host because HAProxy already owns host :80.
+    ports:
+      - "127.0.0.1:8080:80"
+      - "127.0.0.1:8443:8443"
     environment:
       <<: *domain-env
     restart: unless-stopped

contrib/sni-router/haproxy.cfg

@@ -23,7 +23,9 @@ defaults
 # --- HTTP :80 — ACME challenges + redirect -----------------------------------
 
 frontend http
-    bind *:80
+    # Explicit v4 + v6 binds so IPv6 clients are accepted regardless of
+    # the host's net.ipv6.bindv6only sysctl.
+    bind :80,[::]:80
     mode http
 
     # Let Caddy answer ACME HTTP-01 challenges for Let's Encrypt.
@@ -35,7 +37,7 @@ frontend http
 # --- TLS :443 — SNI-based routing -------------------------------------------
 
 frontend tls
-    bind *:443
+    bind :443,[::]:443
     tcp-request inspect-delay 5s
     tcp-request content accept if { req_ssl_hello_type 1 }
 
@@ -46,18 +48,23 @@ frontend tls
 
     default_backend web
 
+# Backends reach mtg and web on host loopback — they publish to 127.0.0.1
+# (see docker-compose.yml), and HAProxy runs in the host netns
+# (network_mode: host).  PROXY v2 still carries the real client address
+# (v4 or v6) end-to-end, independent of the loopback transport.
+
 backend mtg
     # send-proxy-v2 prepends a PROXY protocol v2 header so mtg sees the
     # real client IP instead of HAProxy's.  mtg must have
     # `proxy-protocol-listener = true` in its config.
-    server mtg mtg:3128 send-proxy-v2
+    server mtg 127.0.0.1:3128 send-proxy-v2
 
 backend web
     # send-proxy-v2 prepends a PROXY protocol v2 header so Caddy logs the
     # real client IP instead of HAProxy's.  Caddy must enable the
     # proxy_protocol listener wrapper on :8443 (see Caddyfile).
-    server web web:8443 send-proxy-v2
+    server web 127.0.0.1:8443 send-proxy-v2
 
 backend web_acme
     mode http
-    server web web:80
+    server web 127.0.0.1:8080

internal/cli/doctor.go

@@ -18,6 +18,7 @@ import (
 	"github.com/9seconds/mtg/v2/internal/config"
 	"github.com/9seconds/mtg/v2/internal/utils"
 	"github.com/9seconds/mtg/v2/mtglib"
+	"github.com/9seconds/mtg/v2/mtglib/dcprobe"
 	"github.com/9seconds/mtg/v2/network/v2"
 	"github.com/beevik/ntp"
 )
@@ -46,7 +47,7 @@ var (
 	)
 
 	tplODCConnect = template.Must(
-		template.New("").Parse("  ✅ DC {{ .dc }}\n"),
+		template.New("").Parse("  ✅ DC {{ .dc }} (rpc {{ .rtt }})\n"),
 	)
 	tplEDCConnect = template.Must(
 		template.New("").Parse("  ❌ DC {{ .dc }}: {{ .error }}\n"),
@@ -238,17 +239,21 @@ func (d *Doctor) checkNetwork(ntw mtglib.Network) bool {
 	dcs := slices.Collect(maps.Keys(essentials.TelegramCoreAddresses))
 	slices.Sort(dcs)
 
-	errs := make([]error, len(dcs))
+	type dcResult struct {
+		rtt time.Duration
+		err error
+	}
+	results := make([]dcResult, len(dcs))
 
 	var wg sync.WaitGroup
 	for i, dc := range dcs {
 		wg.Go(func() {
 			defer func() {
 				if r := recover(); r != nil {
-					errs[i] = fmt.Errorf("panic: %v", r)
+					results[i].err = fmt.Errorf("panic: %v", r)
 				}
 			}()
-			errs[i] = d.checkNetworkAddresses(ntw, essentials.TelegramCoreAddresses[dc])
+			results[i].rtt, results[i].err = d.checkNetworkAddresses(ntw, dc, essentials.TelegramCoreAddresses[dc])
 		})
 	}
 	wg.Wait()
@@ -256,14 +261,15 @@ func (d *Doctor) checkNetwork(ntw mtglib.Network) bool {
 	ok := true
 
 	for i, dc := range dcs {
-		if errs[i] == nil {
+		if results[i].err == nil {
 			tplODCConnect.Execute(os.Stdout, map[string]any{ //nolint: errcheck
-				"dc": dc,
+				"dc":  dc,
+				"rtt": results[i].rtt.Round(time.Microsecond),
 			})
 		} else {
 			tplEDCConnect.Execute(os.Stdout, map[string]any{ //nolint: errcheck
 				"dc":    dc,
-				"error": errs[i],
+				"error": results[i].err,
 			})
 			ok = false
 		}
@@ -272,7 +278,7 @@ func (d *Doctor) checkNetwork(ntw mtglib.Network) bool {
 	return ok
 }
 
-func (d *Doctor) checkNetworkAddresses(ntw mtglib.Network, addresses []string) error {
+func (d *Doctor) checkNetworkAddresses(ntw mtglib.Network, dc int, addresses []string) (time.Duration, error) {
 	checkAddresses := []string{}
 
 	switch d.conf.PreferIP.Get("prefer-ip4") {
@@ -303,29 +309,33 @@ func (d *Doctor) checkNetworkAddresses(ntw mtglib.Network, addresses []string) e
 	}
 
 	if len(checkAddresses) == 0 {
-		return fmt.Errorf("no suitable addresses after IP version filtering")
+		return 0, fmt.Errorf("no suitable addresses after IP version filtering")
 	}
 
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
 
-	var (
-		conn net.Conn
-		err  error
-	)
+	var lastErr error
 
 	for _, addr := range checkAddresses {
-		conn, err = ntw.DialContext(ctx, "tcp", addr)
+		conn, err := ntw.DialContext(ctx, "tcp", addr)
 		if err != nil {
+			lastErr = fmt.Errorf("tcp connect to %s: %w", addr, err)
 			continue
 		}
 
+		rtt, err := dcprobe.Probe(ctx, conn, dc)
 		conn.Close() //nolint: errcheck
 
-		return nil
+		if err != nil {
+			lastErr = fmt.Errorf("rpc handshake to %s: %w", addr, err)
+			continue
+		}
+
+		return rtt, nil
 	}
 
-	return err
+	return 0, lastErr
 }
 
 func (d *Doctor) checkFrontingDomain(ntw mtglib.Network) bool {
@@ -361,26 +371,17 @@ func (d *Doctor) checkFrontingDomain(ntw mtglib.Network) bool {
 }
 
 func (d *Doctor) checkSecretHost(resolver *net.Resolver, ntw mtglib.Network) bool {
-	addresses, err := resolver.LookupIPAddr(context.Background(), d.conf.Secret.Host)
-	if err != nil {
+	res := runSNICheck(context.Background(), resolver, d.conf, ntw)
+
+	if res.ResolveErr != nil {
 		tplError.Execute(os.Stdout, map[string]any{ //nolint: errcheck
 			"description": fmt.Sprintf("cannot resolve DNS name of %s", d.conf.Secret.Host),
-			"error":       err,
+			"error":       res.ResolveErr,
 		})
 		return false
 	}
 
-	ourIP4 := d.conf.PublicIPv4.Get(nil)
-	if ourIP4 == nil {
-		ourIP4 = getIP(ntw, "tcp4")
-	}
-
-	ourIP6 := d.conf.PublicIPv6.Get(nil)
-	if ourIP6 == nil {
-		ourIP6 = getIP(ntw, "tcp6")
-	}
-
-	if ourIP4 == nil && ourIP6 == nil {
+	if !res.PublicIPKnown() {
 		tplError.Execute(os.Stdout, map[string]any{ //nolint: errcheck
 			"description": "cannot detect public IP address",
 			"error":       errors.New("cannot detect automatically and public-ipv4/public-ipv6 are not set in config"),
@@ -388,25 +389,34 @@ func (d *Doctor) checkSecretHost(resolver *net.Resolver, ntw mtglib.Network) boo
 		return false
 	}
 
-	strAddresses := []string{}
-	for _, value := range addresses {
-		if (ourIP4 != nil && value.IP.String() == ourIP4.String()) ||
-			(ourIP6 != nil && value.IP.String() == ourIP6.String()) {
-			tplODNSSNIMatch.Execute(os.Stdout, map[string]any{ //nolint: errcheck
-				"ip":       value.IP,
-				"hostname": d.conf.Secret.Host,
-			})
-			return true
+	if res.IPv4Match || res.IPv6Match {
+		var matched net.IP
+
+		for _, ip := range res.Resolved {
+			if (res.OurIPv4 != nil && ip.String() == res.OurIPv4.String()) ||
+				(res.OurIPv6 != nil && ip.String() == res.OurIPv6.String()) {
+				matched = ip
+				break
+			}
 		}
 
-		strAddresses = append(strAddresses, `"`+value.IP.String()+`"`)
+		tplODNSSNIMatch.Execute(os.Stdout, map[string]any{ //nolint: errcheck
+			"ip":       matched,
+			"hostname": d.conf.Secret.Host,
+		})
+		return true
+	}
+
+	strAddresses := make([]string, 0, len(res.Resolved))
+	for _, ip := range res.Resolved {
+		strAddresses = append(strAddresses, `"`+ip.String()+`"`)
 	}
 
 	tplEDNSSNIMatch.Execute(os.Stdout, map[string]any{ //nolint: errcheck
 		"hostname": d.conf.Secret.Host,
 		"resolved": strings.Join(strAddresses, ", "),
-		"ip4":      ourIP4,
-		"ip6":      ourIP6,
+		"ip4":      res.OurIPv4,
+		"ip6":      res.OurIPv6,
 	})
 
 	return false

internal/cli/run_proxy.go

@@ -215,72 +215,53 @@ func warnSNIMismatch(conf *config.Config, ntw mtglib.Network, log mtglib.Logger)
 		return
 	}
 
-	addresses, err := net.DefaultResolver.LookupIPAddr(context.Background(), host)
-	if err != nil {
+	res := runSNICheck(context.Background(), net.DefaultResolver, conf, ntw)
+
+	if res.ResolveErr != nil {
 		log.BindStr("hostname", host).
-			WarningError("SNI-DNS check: cannot resolve secret hostname", err)
+			WarningError("SNI-DNS check: cannot resolve secret hostname", res.ResolveErr)
 		return
 	}
 
-	ourIP4 := conf.PublicIPv4.Get(nil)
-	if ourIP4 == nil {
-		ourIP4 = getIP(ntw, "tcp4")
-	}
-
-	ourIP6 := conf.PublicIPv6.Get(nil)
-	if ourIP6 == nil {
-		ourIP6 = getIP(ntw, "tcp6")
-	}
-
-	if ourIP4 == nil && ourIP6 == nil {
+	if !res.PublicIPKnown() {
 		log.Warning("SNI-DNS check: cannot detect public IP address; set public-ipv4/public-ipv6 in config or run 'mtg doctor'")
 		return
 	}
 
-	v4Match := ourIP4 == nil
-	v6Match := ourIP6 == nil
-
-	for _, addr := range addresses {
-		if ourIP4 != nil && addr.IP.String() == ourIP4.String() {
-			v4Match = true
-		}
-
-		if ourIP6 != nil && addr.IP.String() == ourIP6.String() {
-			v6Match = true
-		}
-	}
+	v4Match := res.OurIPv4 == nil || res.IPv4Match
+	v6Match := res.OurIPv6 == nil || res.IPv6Match
 
 	if v4Match && v6Match {
 		return
 	}
 
-	resolved := make([]string, 0, len(addresses))
-	for _, addr := range addresses {
-		resolved = append(resolved, addr.IP.String())
+	resolved := make([]string, 0, len(res.Resolved))
+	for _, ip := range res.Resolved {
+		resolved = append(resolved, ip.String())
 	}
 
 	our := ""
-	if ourIP4 != nil {
-		our = ourIP4.String()
+	if res.OurIPv4 != nil {
+		our = res.OurIPv4.String()
 	}
 
-	if ourIP6 != nil {
+	if res.OurIPv6 != nil {
 		if our != "" {
 			our += "/"
 		}
 
-		our += ourIP6.String()
+		our += res.OurIPv6.String()
 	}
 
 	entry := log.BindStr("hostname", host).
 		BindStr("resolved", strings.Join(resolved, ", ")).
 		BindStr("public_ip", our)
 
-	if ourIP4 != nil {
+	if res.OurIPv4 != nil {
 		entry = entry.BindStr("ipv4_match", fmt.Sprintf("%t", v4Match))
 	}
 
-	if ourIP6 != nil {
+	if res.OurIPv6 != nil {
 		entry = entry.BindStr("ipv6_match", fmt.Sprintf("%t", v6Match))
 	}
 

internal/cli/sni_check.go

@@ -0,0 +1,78 @@
+package cli
+
+import (
+	"context"
+	"net"
+
+	"github.com/9seconds/mtg/v2/internal/config"
+	"github.com/9seconds/mtg/v2/mtglib"
+)
+
+// sniCheckResult holds the data gathered while comparing the secret
+// hostname's DNS records against this server's public IP addresses.
+//
+// IPv4Match / IPv6Match report whether a resolved record actually equals the
+// corresponding public IP. They are false when that family's public IP could
+// not be determined — there is nothing to compare against. Callers decide
+// what counts as a clean result from these fields: `mtg doctor` and the
+// startup warning apply different rules.
+type sniCheckResult struct {
+	Resolved   []net.IP
+	OurIPv4    net.IP
+	OurIPv6    net.IP
+	IPv4Match  bool
+	IPv6Match  bool
+	ResolveErr error
+}
+
+// PublicIPKnown reports whether at least one public IP family was detected.
+func (r sniCheckResult) PublicIPKnown() bool {
+	return r.OurIPv4 != nil || r.OurIPv6 != nil
+}
+
+// runSNICheck resolves conf.Secret.Host and compares the records with this
+// server's public IPv4 and IPv6. Public IPs come from config first and fall
+// back to on-the-fly detection via ntw. It gathers data only — it does not
+// decide success; see sniCheckResult.
+func runSNICheck(
+	ctx context.Context,
+	resolver *net.Resolver,
+	conf *config.Config,
+	ntw mtglib.Network,
+) sniCheckResult {
+	res := sniCheckResult{}
+
+	addrs, err := resolver.LookupIPAddr(ctx, conf.Secret.Host)
+	if err != nil {
+		res.ResolveErr = err
+
+		return res
+	}
+
+	res.Resolved = make([]net.IP, 0, len(addrs))
+	for _, a := range addrs {
+		res.Resolved = append(res.Resolved, a.IP)
+	}
+
+	res.OurIPv4 = conf.PublicIPv4.Get(nil)
+	if res.OurIPv4 == nil {
+		res.OurIPv4 = getIP(ntw, "tcp4")
+	}
+
+	res.OurIPv6 = conf.PublicIPv6.Get(nil)
+	if res.OurIPv6 == nil {
+		res.OurIPv6 = getIP(ntw, "tcp6")
+	}
+
+	for _, ip := range res.Resolved {
+		if res.OurIPv4 != nil && ip.String() == res.OurIPv4.String() {
+			res.IPv4Match = true
+		}
+
+		if res.OurIPv6 != nil && ip.String() == res.OurIPv6.String() {
+			res.IPv6Match = true
+		}
+	}
+
+	return res
+}

mtglib/dcprobe/probe.go

@@ -0,0 +1,181 @@
+// Package dcprobe verifies that a TCP endpoint is a real Telegram DC by
+// performing the unauthenticated first step of the MTProto handshake
+// (req_pq_multi -> resPQ) on top of mtg's existing obfuscated2 transport.
+//
+// No auth_key is generated; no long-lived state is introduced. Two TL
+// messages, one round-trip. A generic listener cannot fake the reply
+// because it must echo back our random nonce in resPQ.
+//
+// References:
+//   - https://core.telegram.org/mtproto/auth_key      (handshake step 1)
+//   - https://core.telegram.org/schema/mtproto        (TL schema)
+//   - https://core.telegram.org/mtproto/mtproto-transports#padded-intermediate
+package dcprobe
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"time"
+
+	"github.com/9seconds/mtg/v2/essentials"
+	"github.com/9seconds/mtg/v2/mtglib/obfuscation"
+)
+
+// MTProto wire constants (https://core.telegram.org/schema/mtproto).
+//
+//	req_pq_multi#be7e8ef1 nonce:int128 = ResPQ;
+//	resPQ#05162463 nonce:int128 server_nonce:int128 pq:string
+//	    server_public_key_fingerprints:Vector<long> = ResPQ;
+const (
+	ctorReqPQMulti uint32 = 0xbe7e8ef1
+	ctorResPQ      uint32 = 0x05162463
+
+	// Minimum legal resPQ frame: 20-byte unencrypted-message envelope +
+	// 4-byte ctor + 16-byte nonce echo. Anything below cannot be a resPQ.
+	minResPQFrame = 20 + 4 + 16
+	// Upper bound: real resPQ replies are ~84 bytes (envelope + ~64-byte
+	// payload). 256 is comfortable headroom; anything beyond is hostile or
+	// not Telegram.
+	maxResPQFrame = 256
+)
+
+// Probe sends req_pq_multi over an obfuscated2 + padded-intermediate transport
+// and verifies that the peer replies with a matching resPQ.
+//
+// conn must be a freshly opened reliable byte stream (typically TCP) to a
+// Telegram DC, but a SOCKS/proxy-wrapped net.Conn works just as well — Probe
+// adapts whatever it gets to the half-close interface mtg's obfuscator
+// requires. Probe does NOT close conn — the caller does. dc is the DC number
+// (1..5) that gets baked into the obfuscated2 handshake frame.
+//
+// The returned duration is the round-trip from "first byte sent after the
+// obfs handshake" to "resPQ frame fully read".
+func Probe(ctx context.Context, conn net.Conn, dc int) (time.Duration, error) {
+	if deadline, ok := ctx.Deadline(); ok {
+		_ = conn.SetDeadline(deadline)
+		defer func() { _ = conn.SetDeadline(time.Time{}) }()
+	}
+
+	// Honour ctx cancellation as well as its deadline: a parent ctx that is
+	// canceled (without an earlier deadline expiring) would otherwise let
+	// Probe block on an in-flight Read until the deadline. Forcing the
+	// deadline to "now" makes the next syscall return an i/o timeout error
+	// that Probe wraps and surfaces.
+	stop := context.AfterFunc(ctx, func() {
+		_ = conn.SetDeadline(time.Now())
+	})
+	defer stop()
+
+	// 1. obfuscated2 handshake. Empty Secret = no MTProxy secret mixing,
+	// which is how mtg itself talks to a DC (see mtglib/proxy.go).
+	obfsConn, err := obfuscation.Obfuscator{}.SendHandshake(adaptConn(conn), dc)
+	if err != nil {
+		return 0, fmt.Errorf("obfuscated2 handshake: %w", err)
+	}
+
+	// 2. build req_pq_multi TL payload: 4-byte LE constructor + 16-byte nonce.
+	var nonce [16]byte
+	if _, err := rand.Read(nonce[:]); err != nil {
+		return 0, fmt.Errorf("read nonce: %w", err)
+	}
+	tlBody := make([]byte, 4+16)
+	binary.LittleEndian.PutUint32(tlBody[:4], ctorReqPQMulti)
+	copy(tlBody[4:], nonce[:])
+
+	// 3. wrap in an MTProto unencrypted message envelope (per
+	// https://core.telegram.org/mtproto/description#unencrypted-message):
+	//   auth_key_id:long(=0) | message_id:long | message_data_length:int | message_data:bytes
+	// Without this envelope the DC silently drops the connection.
+	msg := make([]byte, 8+8+4+len(tlBody))
+	// auth_key_id = 0 (already zeroed by make)
+	binary.LittleEndian.PutUint64(msg[8:16], generateMessageID())
+	binary.LittleEndian.PutUint32(msg[16:20], uint32(len(tlBody)))
+	copy(msg[20:], tlBody)
+
+	// 4. wrap in a padded-intermediate frame: length(LE) + msg.
+	// Padding is allowed [0..15] but not required when len(msg) % 4 == 0.
+	frame := make([]byte, 4+len(msg))
+	binary.LittleEndian.PutUint32(frame[:4], uint32(len(msg)))
+	copy(frame[4:], msg)
+
+	start := time.Now()
+	if _, err := obfsConn.Write(frame); err != nil {
+		return 0, fmt.Errorf("write req_pq_multi: %w", err)
+	}
+
+	// 5. read padded-intermediate reply: length, then that many bytes.
+	// The reply is itself an MTProto unencrypted message (same envelope as
+	// what we sent), so we must skip 20 bytes to get to the resPQ TL.
+	var lenBuf [4]byte
+	if _, err := io.ReadFull(obfsConn, lenBuf[:]); err != nil {
+		return 0, fmt.Errorf("read frame length: %w", err)
+	}
+	respLen := binary.LittleEndian.Uint32(lenBuf[:])
+	if respLen < minResPQFrame {
+		return 0, fmt.Errorf("%w: resPQ frame too short (%d bytes)", ErrNotTelegram, respLen)
+	}
+	if respLen > maxResPQFrame {
+		return 0, fmt.Errorf("%w: resPQ frame too large (%d bytes, max %d)", ErrNotTelegram, respLen, maxResPQFrame)
+	}
+	resp := make([]byte, respLen)
+	if _, err := io.ReadFull(obfsConn, resp); err != nil {
+		return 0, fmt.Errorf("read resPQ frame: %w", err)
+	}
+	rtt := time.Since(start)
+
+	// 6. unwrap the MTProto envelope: skip auth_key_id(8) + message_id(8) +
+	// message_data_length(4) = 20 bytes.
+	tlResp := resp[20:]
+
+	// 7. verify constructor and nonce echo. We deliberately do not parse
+	// server_nonce, pq, or fingerprints — they are not needed to prove
+	// the peer can speak MTProto.
+	if got := binary.LittleEndian.Uint32(tlResp[:4]); got != ctorResPQ {
+		return rtt, fmt.Errorf("%w: got constructor 0x%08x, want resPQ 0x%08x", ErrNotTelegram, got, ctorResPQ)
+	}
+	if !bytes.Equal(tlResp[4:4+16], nonce[:]) {
+		return rtt, fmt.Errorf("%w: nonce echo mismatch", ErrNotTelegram)
+	}
+
+	return rtt, nil
+}
+
+// generateMessageID returns an MTProto message_id roughly synchronized with
+// server time, with the lower 2 bits cleared (client-to-server requests).
+// See https://core.telegram.org/mtproto/description#message-identifier-msg-id.
+func generateMessageID() uint64 {
+	nano := uint64(time.Now().UnixNano())
+	sec := nano / 1_000_000_000
+	nsInSec := nano % 1_000_000_000
+	subsec := (nsInSec << 32) / 1_000_000_000
+	id := (sec << 32) | subsec
+	return id &^ 3
+}
+
+// ErrNotTelegram is returned (wrapped) when the peer's reply is not a
+// well-formed resPQ matching our nonce. Use errors.Is to distinguish
+// "the TCP connection was OK but the peer is not a Telegram DC" from
+// transport errors.
+var ErrNotTelegram = errors.New("peer did not respond with a matching resPQ")
+
+// adaptConn returns conn as essentials.Conn if it already satisfies the
+// interface (typically *net.TCPConn), otherwise wraps it with no-op
+// CloseRead/CloseWrite. mtg's obfuscator only ever calls Read/Write/Close,
+// so the no-ops are safe.
+func adaptConn(conn net.Conn) essentials.Conn {
+	if ec, ok := conn.(essentials.Conn); ok {
+		return ec
+	}
+	return halfCloseShim{Conn: conn}
+}
+
+type halfCloseShim struct{ net.Conn }
+
+func (halfCloseShim) CloseRead() error  { return nil }
+func (halfCloseShim) CloseWrite() error { return nil }

mtglib/dcprobe/probe_test.go

@@ -0,0 +1,110 @@
+package dcprobe_test
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/9seconds/mtg/v2/mtglib/dcprobe"
+)
+
+// TestProbeAgainstTelegramDCs makes outbound TCP connections to public
+// Telegram DCs. Skipped by default; opt-in with MTG_PROBE_NETWORK=1.
+func TestProbeAgainstTelegramDCs(t *testing.T) {
+	if os.Getenv("MTG_PROBE_NETWORK") != "1" {
+		t.Skip("skipping network probe (set MTG_PROBE_NETWORK=1 to enable)")
+	}
+
+	cases := []struct {
+		dc   int
+		addr string
+	}{
+		{1, "149.154.175.50:443"},
+		{2, "149.154.167.51:443"},
+		{2, "95.161.76.100:443"},
+		{3, "149.154.175.100:443"},
+		{4, "149.154.167.91:443"},
+		{5, "149.154.171.5:443"},
+		{1, "[2001:b28:f23d:f001::a]:443"},
+		{2, "[2001:67c:04e8:f002::a]:443"},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.addr, func(t *testing.T) {
+			ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+			defer cancel()
+
+			conn, err := (&net.Dialer{}).DialContext(ctx, "tcp", tc.addr)
+			if err != nil {
+				t.Fatalf("dial: %v", err)
+			}
+			t.Cleanup(func() { _ = conn.Close() })
+
+			rtt, err := dcprobe.Probe(ctx, conn, tc.dc)
+			if err != nil {
+				t.Fatalf("probe DC %d: %v", tc.dc, err)
+			}
+			t.Logf("DC %d (%s): rtt=%s", tc.dc, tc.addr, rtt)
+		})
+	}
+}
+
+// TestProbeRejectsMisbehavingPeer connects to an in-process listener that
+// accepts the obfs2 handshake, then writes back arbitrary bytes. With
+// overwhelming probability the decrypted reply fails one of: frame-length
+// bounds, resPQ constructor, or nonce echo. All three paths wrap
+// ErrNotTelegram, so we assert errors.Is.
+func TestProbeRejectsMisbehavingPeer(t *testing.T) {
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = ln.Close() })
+
+	go func() {
+		c, err := ln.Accept()
+		if err != nil {
+			return
+		}
+		defer c.Close() //nolint: errcheck
+
+		// Discard the 64-byte obfs2 handshake the client sends.
+		var hs [64]byte
+		if _, err := io.ReadFull(c, hs[:]); err != nil {
+			return
+		}
+		// Write enough garbage to satisfy any plausible respLen the client
+		// might decode (we cap at maxResPQFrame=256 in probe.go). Whatever
+		// the client decrypts will fail constructor or nonce verification.
+		junk := make([]byte, 512)
+		for i := range junk {
+			junk[i] = byte(i)
+		}
+		_, _ = c.Write(junk)
+		// Keep the conn open until the client closes it (avoids racing the
+		// client's read against our close).
+		_, _ = io.Copy(io.Discard, c)
+	}()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+
+	conn, err := (&net.Dialer{}).DialContext(ctx, "tcp", ln.Addr().String())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = conn.Close() })
+
+	_, err = dcprobe.Probe(ctx, conn, 2)
+	if err == nil {
+		t.Fatal("expected ErrNotTelegram, got nil")
+	}
+	if !errors.Is(err, dcprobe.ErrNotTelegram) {
+		t.Fatalf("expected errors.Is(err, ErrNotTelegram) to be true, got: %v", err)
+	}
+	t.Logf("rejected: %v", err)
+}