ObfuscatedStream: decode URL-safe base64 and dd-prefixed base64 MTProxy secrets

Proxy links carry secrets in URL-safe base64 (- and _, without padding), which base64_decode()
doesn't know: since secrets are decoded strictly they became false, and before that the - and _
were silently dropped, giving a wrong key. They are now translated to standard base64 first.
The dd prefix of padded intermediate secrets was only stripped from hex secrets, so the key of a
base64 one was hashed with its prefix byte: it is now stripped whatever the encoding. Secrets
that aren't 16 bytes once decoded (like fake TLS ee secrets, not supported) are refused with an
explicit error instead of producing a wrong key.

Author: danog

src/Stream/MTProtoTransport/ObfuscatedStream.php

@@ -20,6 +20,7 @@
 
 namespace danog\MadelineProto\Stream\MTProtoTransport;
 
+use danog\MadelineProto\Exception;
 use danog\MadelineProto\Stream\BufferedProxyStreamInterface;
 use danog\MadelineProto\Stream\Common\CtrStream;
 use danog\MadelineProto\Stream\ConnectionContext;
@@ -81,19 +82,40 @@ public function connect(ConnectionContext $ctx, string $header = ''): void
     public function setExtra($extra): void
     {
         if (isset($extra['secret'])) {
-            if (!preg_match('/^[a-f0-9]+$/i', $extra['secret'])) {
-                $extra['secret'] = base64_decode($extra['secret'], true);
-            } else {
-                if (\strlen($extra['secret']) > 17) {
-                    $extra['secret'] = hex2bin($extra['secret']);
-                }
-                if (\strlen($extra['secret']) == 17) {
-                    $extra['secret'] = substr($extra['secret'], 1, 16);
-                }
-            }
+            $extra['secret'] = self::decodeSecret($extra['secret']);
         }
         $this->extra = $extra;
     }
+
+    /**
+     * The 16-byte key of an MTProxy secret: raw, or hex or (URL-safe, as in proxy links) base64
+     * encoded, optionally with the dd prefix of padded intermediate secrets.
+     *
+     * @psalm-pure
+     */
+    private static function decodeSecret(string $secret): string
+    {
+        if (\strlen($secret) !== 16) {
+            $decoded = preg_match('/^(?:[a-f0-9]{2})+$/i', $secret)
+                ? hex2bin($secret)
+                : base64_decode(strtr($secret, '-_', '+/'), true);
+            if ($decoded === false) {
+                throw new Exception('The MTProxy secret is neither hex nor base64');
+            }
+            $secret = $decoded;
+        }
+        if (\strlen($secret) === 17 && $secret[0] === "\xdd") {
+            $secret = substr($secret, 1);
+        }
+        if (\strlen($secret) !== 16) {
+            throw new Exception(
+                ($secret[0] ?? '') === "\xee"
+                    ? 'MTProxy secrets for fake TLS (starting with ee) are not supported'
+                    : 'Invalid MTProxy secret: it must be 16 bytes long, or 17 starting with dd'
+            );
+        }
+        return $secret;
+    }
     /**
      * @psalm-pure
      */

tests/danog/MadelineProto/ObfuscatedStreamTest.php

@@ -0,0 +1,75 @@
+<?php declare(strict_types=1);
+
+/**
+ * This file is part of MadelineProto.
+ * MadelineProto is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
+ * MadelineProto is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ * See the GNU Affero General Public License for more details.
+ * You should have received a copy of the GNU General Public License along with MadelineProto.
+ * If not, see <http://www.gnu.org/licenses/>.
+ *
+ * @author    Daniil Gentili <daniil@daniil.it>
+ * @copyright 2016-2025 Daniil Gentili <daniil@daniil.it>
+ * @license   https://opensource.org/licenses/AGPL-3.0 AGPLv3
+ * @link https://docs.madelineproto.xyz MadelineProto documentation
+ */
+
+namespace danog\MadelineProto\Test;
+
+use danog\MadelineProto\Exception;
+use danog\MadelineProto\Stream\MTProtoTransport\ObfuscatedStream;
+use PHPUnit\Framework\TestCase;
+use ReflectionMethod;
+
+/**
+ * The encodings of MTProxy secrets.
+ */
+final class ObfuscatedStreamTest extends TestCase
+{
+    private const KEY = "\x00\x11\x22\x33\x44\x55\x66\x77\x88\x99\xaa\xbb\xcc\xdd\xee\xff";
+
+    /**
+     * @return iterable<string, array{string}>
+     */
+    public static function secrets(): iterable
+    {
+        yield 'raw' => [self::KEY];
+        yield 'hex' => [bin2hex(self::KEY)];
+        yield 'hex with the dd prefix' => ['dd'.bin2hex(self::KEY)];
+        yield 'base64' => [base64_encode(self::KEY)];
+        // As in proxy links: URL-safe, without padding.
+        yield 'URL-safe base64 with the dd prefix' => [rtrim(strtr(base64_encode("\xdd".self::KEY), '+/', '-_'), '=')];
+    }
+
+    /**
+     * @dataProvider secrets
+     */
+    public function testSecretsAreDecoded(string $secret): void
+    {
+        self::assertSame(self::KEY, self::decode($secret));
+    }
+
+    /**
+     * @return iterable<string, array{string}>
+     */
+    public static function invalidSecrets(): iterable
+    {
+        yield 'fake TLS' => ['ee'.bin2hex(self::KEY).bin2hex('example.com')];
+        yield 'neither hex nor base64' => ['not a secret!'];
+        yield 'too short' => [bin2hex(substr(self::KEY, 0, 4))];
+    }
+
+    /**
+     * @dataProvider invalidSecrets
+     */
+    public function testInvalidSecretsAreRefused(string $secret): void
+    {
+        $this->expectException(Exception::class);
+        self::decode($secret);
+    }
+
+    private static function decode(string $secret): string
+    {
+        return (string) (new ReflectionMethod(ObfuscatedStream::class, 'decodeSecret'))->invoke(null, $secret);
+    }
+}