[Feature request] MASQUE support, modeled similarly to WireGuard endpoint

I would like to request MASQUE client support in sing-box.

My suggestion is to consider CONNECT-IP first, and to model it closer to the existing WireGuard endpoint design, instead of treating it as a regular outbound proxy protocol.

Why I think it fits the WireGuard model better

From an implementation and routing perspective, MASQUE CONNECT-IP looks much closer to an IP tunnel than to a normal stream proxy:

• it needs local tunnel addresses
• it carries full IP packets instead of only independent TCP streams
• TCP and UDP can share the same L3 tunnel path
• DNS and route handling need to avoid tunnel loops

Because of that, it seems conceptually closer to WireGuard than to SOCKS / HTTP / VMess / VLESS / Trojan style outbounds.

In other words, if sing-box ever supports MASQUE CONNECT-IP, an endpoint-style design may be more natural than a traditional outbound-style design.

Reference

There is already a practical implementation in mihomo:

• Repository: https://github.com/MetaCubeX/mihomo
• MASQUE outbound: https://github.com/MetaCubeX/mihomo/blob/Alpha/adapter/outbound/masque.go
• MASQUE transport: https://github.com/MetaCubeX/mihomo/blob/Alpha/transport/masque/masque.go

That implementation is useful as a reference because it treats MASQUE as an IP tunnel over HTTP/3 + QUIC, which is the main reason I think the WireGuard endpoint model is a better comparison point than a normal proxy outbound.

Scope suggestion

A reasonable initial scope could be:

• client-side support only
• prioritize CONNECT-IP
• model it similarly to WireGuard endpoint behavior
• support TCP and UDP through the IP tunnel path

Possible later work:

• CONNECT-UDP
• server-side support
• vendor-specific compatibility options only when needed

Rough configuration idea

{
  "type": "masque",
  "tag": "masque-ep",
  "server": "example.com",
  "server_port": 443,
  "address": ["172.16.0.2/32", "fd00::2/128"],
  "url": "https://example.com/masque",
  "tls": {
    "enabled": true,
    "server_name": "example.com"
  }
}

This is only a rough example. The main point is not the exact schema, but the idea that MASQUE CONNECT-IP may fit better as a WireGuard-like endpoint.

Start by reviewing mihomo's adapter/outbound/masque.go and transport/masque/masque.go to understand the referenced CONNECT-IP implementation and its HTTP/3 and QUIC handling. Then compare that model with sing-box's existing WireGuard endpoint design. Done means a client-side CONNECT-IP implementation supporting TCP and UDP through an IP-tunnel-style endpoint, with routing and DNS behavior that avoids tunnel loops.