Support for MASQUE / CONNECT-UDP over HTTP/3 to tunnel UDP traffic (e.g. WireGuard)

[Ho3einWave]

Hello 👋

First, thanks for the great project gost already covers many transports like QUIC, HTTP/2, gRPC, etc.

I was wondering about support for the new MASQUE / CONNECT-UDP protocol over HTTP/3 (see [RFC 9298](https://www.rfc-editor.org/rfc/rfc9298.html) and [draft-ietf-masque-quic-proxy](https://datatracker.ietf.org/doc/html/draft-ietf-masque-quic-proxy)).

MASQUE allows proxying arbitrary UDP traffic over HTTP/3 using extended CONNECT requests. This would make it possible to tunnel protocols like WireGuard or other UDP-based VPNs through HTTP/3 in a way that looks like normal web traffic.

At the moment gost supports QUIC forwarding (quic://) and HTTP3 transports (h3://), but I don’t see MASQUE / CONNECT-UDP support mentioned.

Questions:

• Is MASQUE (CONNECT-UDP) on the roadmap for gost?
• If so, do you have a rough timeline or milestone when it might land?
• Would contributions/PRs implementing it be welcome?

This feature would be extremely useful for tunneling UDP applications (like DNS, WireGuard, or gaming traffic) through HTTP/3 while blending into normal web flows.

Thanks again for your work on gost! 🙏

[Manouchehri]

I tried adding it in go-gost/x#75, but my pull request seems stale.

[Skyb0rg007]

Looks like this was added in 3d1f6fc, just needs docs

[ginuerzh]

MASQUE support (both CONNECT-UDP RFC 9298 and CONNECT-TCP RFC 9114) is already implemented and available in the current master branch. The server handler (masque) and client dialer (h3-masque) / connector (masque) are registered and ready to use.

We are currently working on refactoring and comprehensive testing of existing feature modules — formal documentation and examples for MASQUE will follow after this work is complete.

Contributions to documentation are also welcome!

[Niek]

Thanks @ginuerzh! I tested gogost/gost:latest (3.3.0) with:

gost -L 'socks5://:1080?udp=true' -F 'masque+h3-masque://user:pass@proxy:port'

A fixed-destination UDP forward reaches the MASQUE proxy with the expected CONNECT-UDP request. However, SOCKS5 UDP ASSOCIATE fails before any datagram is sent: the SOCKS handler dials udp, "", while the MASQUE connector requires a concrete host:port, resulting in masque: invalid address : missing port in address and SOCKS reply 0x01.

It looks like SOCKS5 → MASQUE needs a PacketConn that lazily opens/caches a CONNECT-UDP tunnel per destination. Happy to provide more logs or a focused test case!