SOCKS5 proxy with a raw IPv4 TCP connector that implements wire obfuscation primitives:
- send outbound TCP SYN packets with random payload bytes;
- skip future SYN-payload injection for endpoints that ACK data in SYN; and
- before every outbound data packet, inject an empty out-of-sequence
RST|ACK.
This is packet-level behavior, so the proxy does not use the kernel TCP stack for outbound connections. It requires Linux and raw socket privileges.
cargo build --releasesudo setcap cap_net_raw,cap_net_admin+ep target/release/syncopation-proxy
sudo iptables -I OUTPUT -p tcp --sport 42000:60999 --tcp-flags RST RST -m mark ! --mark 0x53594e43 -j DROP
./target/release/syncopation-proxy --listen 127.0.0.1:1080The iptables rule prevents Linux from resetting raw TCP flows that are owned
by this process instead of by the kernel TCP stack. The proxy marks its own raw
packets with SO_MARK, so its intentional out-of-sequence RST|ACK packets
are not dropped by that rule. On Linux 5.17 and newer, CAP_NET_RAW is enough
to set SO_MARK; on older kernels, keep CAP_NET_ADMIN too.
Only SOCKS5 CONNECT is supported. Outbound raw TCP currently supports IPv4
targets; domain names are resolved to IPv4 addresses.
curl -x socks5h://127.0.0.1:1080 https://example.com