Add HTTP/3 proxying (UDP)

[Manouchehri]

Feature: add CONNECT-UDP (MASQUE / RFC 9298) proxy backend

Tested with:

sudo ip netns add demons
sudo ~/tun2socks-linux-armv7 --device tunudp0 --tcp-proxy "http://REMOVED:REMOVED@brd.superproxy.io:33335" --udp-proxy "masque://REMOVED:REMOVED@brd.superproxy.io:10001"

sudo ip link set tunudp0 netns demons
sudo ip -n demons addr add 198.18.0.1/15 dev tunudp0
sudo ip -n demons link set tunudp0 up
sudo ip -n demons route replace default dev tunudp0
sudo ip netns exec demons curl -v "https://1.1.1.1/cdn-cgi/trace"

sudo ip netns exec demons dig google.com @208.67.222.222 -p443

Bright Data is the only provider I know of currently offering this, and they do filter out a ton of ports.

[Copilot]

Pull request overview

This PR adds UDP proxying via HTTP/3 CONNECT-UDP (MASQUE / RFC 9298) and introduces a split-proxy configuration so TCP and UDP flows can be routed through different backends (required for UDP-only proxies like MASQUE).

Changes:

• Add a MASQUE proxy client implementation (HTTP/3 + QUIC datagrams) with capsule draining and PacketConn adaptation.
• Add proxy.Split plus engine/CLI/YAML support for --tcp-proxy / --udp-proxy override configuration.
• Add tests for MASQUE behavior and for the new split-proxy parsing/building logic.

Reviewed changes

Copilot reviewed 12 out of 13 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
proxy/split.go	New Proxy implementation that delegates TCP vs UDP dialing to different backends.
proxy/masque/masque.go	Core MASQUE (CONNECT-UDP) client, URL parsing, shared H3 connection management, and per-session stream setup.
proxy/masque/packetconn.go	Adapts an HTTP/3 RequestStream datagram API into a net.PacketConn with deadline support.
proxy/masque/capsule.go	Adds capsule draining to prevent stream flow-control stalls.
proxy/masque/masque_test.go	Adds integration-style loopback tests for MASQUE + auth + parsing behaviors.
engine/register.go	Registers the new masque proxy protocol via side-effect import.
engine/key.go	Adds YAML keys tcp-proxy and udp-proxy to support split configuration.
engine/parse.go	Adds buildProxy to resolve (proxy, tcp-proxy, udp-proxy) into a single proxy.Proxy (possibly proxy.Split).
engine/engine.go	Switches netstack initialization to use buildProxy; improves proxy config logging.
engine/parse_test.go	Adds tests for split-proxy parsing/building regression and validation cases.
main.go	Adds CLI flags --tcp-proxy and --udp-proxy.
go.mod	Adds dependencies for QUIC/HTTP3 MASQUE client and URI templates.
go.sum	Updates module sums for new dependencies.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.