hysteria2 obfs (Salamander)

Integrity requirements

• I have read all the comments in the issue template and ensured that this issue meet the requirements.
• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I provided the complete config and logs, rather than just providing the truncated parts based on my own judgment.
• I searched issues and did not find any similar issues.
• The problem can be successfully reproduced in the latest Release

Description

When using Hysteria2 as the server with obfs: salamander enabled, and Xray-core as the client with udpmasks: salamander in the Hysteria2 outbound, the connection fails with a timeout error on the client side. Packets appear to reach the server machine, but Hysteria2 logs show nothing (even in debug mode). Disabling obfs on the Hysteria2 server makes everything work fine.
This seems like a potential compatibility issue between the Salamander implementations in Hysteria2 and Xray-core.

Reproduction Method

1. Set up Hysteria2 server with obfs enabled:

obfs:
  type: salamander
  salamander:
    password: "your_password_here"

2. Set up Xray-core outbound for Hysteria2 with udpmasks:

"udpmasks": [
      {
        "type": "salamander",
        "settings": {
          "password": "your_password_here"  // Same as server
        }
      }
    ]

Overall scheme: VLESS + Reality inbound, Hysteria2 outbound.
3. Attempt to connect: Client times out.

Client config

{
  "log": {
    "loglevel": "warning"
  },
  "routing": {
    "domainStrategy": "IPIfNonMatch",
    "rules": [
      {
        "type": "field",
        "ip": [
          "geoip:private"
        ],
        "outboundTag": "direct"
      },
      {
        "type": "field",
        "domain": [
          "geosite:category-ads-all"
        ],
        "outboundTag": "block"
      }
    ]
  },
  "inbounds": [
    {
      "listen": "127.0.0.1",
      "port": 10809,
      "protocol": "http",
      "sniffing": {
        "enabled": true,
        "destOverride": ["http", "tls", "quic"]
      }
    }
  ],
  "outbounds": [
    {
      "tag": "proxy",
      "protocol": "vless",
      "settings": {
        "vnext": [
          {
            "address": "ADDR",
            "port": 443,
            "users": [
              {
                "id": "ID",
                "encryption": "none"
              }
            ]
          }
        ]
      },
      "streamSettings": {
        "network": "tcp",
        "security": "reality",
        "realitySettings": {
          "show": false,
          "fingerprint": "chrome",
          "serverName": "SNI",
          "publicKey": "PUBLIC KEY",
          "shortId": "SHORT ID",
          "spiderX": "/"
        }
      }
    },
    {
      "tag": "direct",
      "protocol": "freedom"
    },
    {
      "tag": "block",
      "protocol": "blackhole"
    }
  ],
  "dns": {
    "servers": [
      "1.1.1.1",
      "8.8.8.8",
      "localhost"
    ]
  }
}

Server config

{
  "log": {
    "loglevel": "debug"
  },
  "dns": {
    "servers": [
      "https+local://1.1.1.1/dns-query", 
      "localhost"
    ]
  },
  "routing": {
    "domainStrategy": "IPIfNonMatch",
    "rules": [
      {
        "ip": [
          "geoip:private" 
        ],
        "outboundTag": "block" 
      },
      {
        "ip": [
          "geoip:cn"
        ],
        "outboundTag": "block"
      },
      {
        "domain": [
          "geosite:category-ads-all"
        ],
        "outboundTag": "block" 
      }
    ]
  },
  "inbounds": [
    {
      "tag": "reality",
      "listen": "127.0.0.1",
      "port": 10001,
      "protocol": "vless",
      "settings": {
        "clients": [
          {
            "id": "ID",  
            "email": "reality-user"
          }
        ],
        "decryption": "none",
        "fallbacks": [
          {
            "dest": "127.0.0.1:8444",
            "xver": 1
          }
        ]
      },
      "streamSettings": {
        "network": "tcp",
        "security": "reality",
        "realitySettings": {
          "show": false,
          "dest": "127.0.0.1:8443", 
          "serverNames": ["SNI", "www.SNI"],
          "privateKey": "PRIVATE KEY",
          "shortIds": ["SHORT ID"]
        },
        "sockopt": {
          "acceptProxyProtocol": true
        }
      },
      "sniffing": {
        "enabled": true,
        "destOverride": ["http", "tls", "quic"]
      }
    }
  ],  
  "outbounds": [
    {
      "tag": "proxy",
      "protocol": "hysteria",
      "settings": {
        "version": 2,
        "address": "ADDR",
        "port": 443
      },
      "streamSettings": {
        "network": "hysteria",
        "security": "tls",
        "tlsSettings": {
          "serverName": "SNI",
          "fingerprint": "chrome",
          "alpn": ["h3"]
        },
        "hysteriaSettings": {
          "version": 2,
          "auth": "AUTH PASSWORD",
          "up": "100 mbps",
          "down": "200 mbps"
        },
        "udpmasks": [
          {
            "type": "salamander",
            "settings": {
              "password": "PASSWORD"
            }
          }
        ]
      }
    },
    {
      "tag": "direct",
      "protocol": "freedom"
    },
    {
      "tag": "block",
      "protocol": "blackhole"
    }
  ],
  "routing": {
    "rules": [
      {
        "type": "field",
        "inboundTag": ["reality"],
        "outboundTag": "proxy"  
      }
    ]
  }
}

Client log

2026/02/21 03:51:06.488000 from 127.0.0.1:42732 accepted http://ifconfig.me/ [proxy]
2026/02/21 03:51:13.545698 [Warning] [2894305569] proxy/http: failed to read response from ifconfig.me > unexpected EOF

Server log

Feb 21 00:25:20 compute-vm-2-2-20-ssd-1771514652551 xray[43085]: 2026/02/21 00:25:20.223735 [Info] [2277118454] app/proxyman/outbound: app/proxyman/outbound: failed to process outbound traffic > proxy/hysteria: failed to find an available destination > transport/internet/hysteria: RoundTrip err > timeout: no recent network activity

[Fangliding]

@LjhAUMEM

[RPRX]

这位是专门注册了个号来开 issue 吗，开完就销号了

[LjhAUMEM]

@LjhAUMEM

奇怪，这个艾特我邮件好像没通知，让我看看

[LjhAUMEM]

应该把 [我确认是最新版] 改成 xx 版本，这是旧版的配置吧

话说为什么多了一级，直接连接也会这样吗

盲猜一波是因为配置 break 到 finalmask/udp 了导致 udpmask 没设置上

[LjhAUMEM]

https://github.com/apernet/hysteria/releases/tag/app%2Fv2.7.1

https://github.com/XTLS/Xray-core/releases/tag/v26.2.6

测试正常

curl ip.sb -x socks5h://127.0.0.1:1080

listen: 127.0.0.1:1081

auth:
  type: password
  password: 5783a3e7-e373-51cd-8642-c83782b807c5

obfs:
  type: salamander 
  salamander:
    password: 4321

bandwidth:
  up: 100 mbps
  down: 100 mbps

tls:
  cert: ca.crt
  key: ca.key

{
  "log": { "loglevel": "debug" },
  "inbounds": [
    {
      "listen": "127.0.0.1",
      "port": 1080,
      "protocol": "socks",
      "settings": {
        "auth": "noauth",
        "udp": true
      }
    }
  ],
  "outbounds": [
    {
      "protocol": "hysteria",
      "settings": {
        "version": 2,
        "address": "127.0.0.1",
        "port": 1081
      },
      "streamSettings": {
        "network": "hysteria",
        "hysteriaSettings": {
          "version": 2,
          "auth": "5783a3e7-e373-51cd-8642-c83782b807c5",
          "up": "100 mbps",
          "down": "200 mbps"
        },
        "security": "tls",
        "tlsSettings": {
          "serverName": "xray.com",
          "alpn": ["h3"],
          "pinnedPeerCertSha256": "f91e9cf7e75e42b020eb974e44302430157bd665a2c402e6dc3c7fd9fb7d7e1b"
        },
        "finalmask": {
          "udp": [
            {
              "type": "salamander",
              "settings": {
                "password": "4321"
              }
            }
          ]
        }
      }
    }
  ]
}

才发现 hy 更新了，又可以 bump quic 了

[Fangliding]

那没事了 我才发现它这conf也奇奇怪怪 哎小号开的就是一坨