Fix: server entry SSH key uses padded base64 encoding

- Also, move server config GetSSHServerVersion selection above validation,
  making SSHServerVersion optional when ObfuscatedSSHKey is specified.

psiphon/common/protocol/packed.go

@@ -873,7 +873,7 @@ func init() {
 		{6, "sshPort", nil},
 		{7, "sshUsername", nil},
 		{8, "sshPassword", lowerHexConverter},
-		{9, "sshHostKey", unpaddedBase64Converter},
+		{9, "sshHostKey", base64Converter},
 		{10, "sshObfuscatedPort", nil},
 		{11, "sshObfuscatedQUICPort", nil},
 		{12, "limitQUICVersions", nil},

psiphon/server/config.go

@@ -669,6 +669,25 @@ func LoadConfig(configJSON []byte) (*Config, error) {
 		}
 	}
 
+	if config.ObfuscatedSSHKey != "" {
+
+		// Any SSHServerVersion selected here will take precedence over a
+		// value specified in the JSON config. Furthermore, the JSON config
+		// may omit SSHServerVersion as long as ObfuscatedSSHKey is specified
+		// and a value is selected.
+
+		seed, err := protocol.DeriveSSHServerVersionPRNGSeed(config.ObfuscatedSSHKey)
+		if err != nil {
+			return nil, errors.Tracef(
+				"DeriveSSHServerVersionPRNGSeed failed: %s", err)
+		}
+
+		serverVersion := values.GetSSHServerVersion(seed)
+		if serverVersion != "" {
+			config.SSHServerVersion = serverVersion
+		}
+	}
+
 	config.runningProtocols = []string{}
 	config.runningOnlyInproxyBroker = config.MeekServerRunInproxyBroker
 
@@ -766,19 +785,6 @@ func LoadConfig(configJSON []byte) (*Config, error) {
 		config.sshHandshakeTimeout = time.Duration(*config.SSHHandshakeTimeoutMilliseconds) * time.Millisecond
 	}
 
-	if config.ObfuscatedSSHKey != "" {
-		seed, err := protocol.DeriveSSHServerVersionPRNGSeed(config.ObfuscatedSSHKey)
-		if err != nil {
-			return nil, errors.Tracef(
-				"DeriveSSHServerVersionPRNGSeed failed: %s", err)
-		}
-
-		serverVersion := values.GetSSHServerVersion(seed)
-		if serverVersion != "" {
-			config.SSHServerVersion = serverVersion
-		}
-	}
-
 	if config.UDPInterceptUdpgwServerAddress != "" {
 		if err := validateNetworkAddress(config.UDPInterceptUdpgwServerAddress, true); err != nil {
 			return nil, errors.Tracef("UDPInterceptUdpgwServerAddress is invalid: %s", err)
@@ -1298,7 +1304,7 @@ func GenerateConfig(params *GenerateConfigParams) ([]byte, []byte, []byte, []byt
 		SshPort:                             sshPort,
 		SshUsername:                         sshUserName,
 		SshPassword:                         sshPassword,
-		SshHostKey:                          base64.RawStdEncoding.EncodeToString(sshPublicKey.Marshal()),
+		SshHostKey:                          base64.StdEncoding.EncodeToString(sshPublicKey.Marshal()),
 		SshObfuscatedPort:                   obfuscatedSSHPort,
 		SshObfuscatedQUICPort:               obfuscatedSSHQUICPort,
 		SshShadowsocksKey:                   shadowsocksKey,