Block compromised eMudhra intermediates.

ALL USERS MUST UPGRADE as old versions are no longer safe from MitM attack using forged eMudhra certificates.

Improved QUIC throughput to near TLS performance with higher receive window and BBR congestion control. Users are recommended to update Caddy server to v2.11.7-naive2.

Softened old tunnel cleanup that breaks long-lived user connections. Now in old tunnels, long-lived connections are only closed after 1/10 idle timeout.

Fix QUIC certificate verifier loading locally trusted roots.

Try to fix crash after suspend and short idle timeout.

Rebased to 154.0.8037.49.

Added trust_anchors in ClientHello.

Rebased to 150.0.7871.63.

Rebased to 149.0.7827.114.

Disable DCHECK which causes crashes on mipsel.

Fix various crashes since introducing preambles.

Limit tunnel lifetime (configurable with --tunnel-timeout and --idle-timeout). This helps with network stall and slowness after long-lived connections, possibly caused by CGNAT.

Now NaiveProxy will send realistic Chrome requests as preambles before and during tunneled TLS handshakes, making traffic analysis based on the initial period of TLS connections much harder.

The preamble URLs are extracted from the root page source of the fronting web server, and can be configured by editing the root page.

Other notes about Caddyfile:

Prevent Caddy from logging http.log.error http2: stream closed which contains user activity information:

{
  log {
    exclude http.log.error # Avoid logging user activity
  }
}

A realistic fronting website should enable content compression:

:443, example.com {
  encode
}