naiveproxy

NaïveProxy is a proxy tool that leverages Chromium's network stack to camouflage traffic, providing strong censorship resistance and low detectability. It mitigates website fingerprinting, TLS parameter fingerprinting, active probing, and length-based traffic analysis through traffic multiplexing, Chrome's TLS stack, application fronting, and padding/fragmentation. Architecture: Browser → Naïve client → Censor → Frontend → Naïve server → Internet. The frontend can be Caddy with forwardproxy plugin or HAProxy, routing HTTP/2 traffic based on authorization headers. The Naïve server acts as a forward proxy with a packet length padding layer. Supported platforms: Windows, Android (via Exclave, husi, NekoBox), Linux, macOS, and OpenWrt. Users should always use the latest version to maintain Chrome-identical signatures. Server setup uses a fork of Caddy forwardproxy with NaïveProxy padding. Example Caddyfile configures TLS, basic auth, IP/Via hiding, and probe resistance on port 443. Client setup runs a SOCKS5 proxy locally (default port 1080) connecting to the server via HTTPS or QUIC. Configuration is via JSON with listen and proxy fields. Padding protocol: First 8 reads/writes per bidirectional stream are padded with random 0-255 bytes. RST_STREAM frames are padded to resemble HEADERS frames. CONNECT request/response HEADERS frames include pseudo-random padding headers. Padding is opt-in via presence of padding header in CONNECT request/response. Changes from Chromium upstream: minimized source (0.3% of original), disabled exceptions/RTTI (except Mac/Android), OpenWrt support, built-in certificate verifier, AIA PKCS#7 handling, higher socket limits, forced tunneling, HTTP/2/3 CONNECT Fast Open, RST_STREAM padding.