Feature request: QUICstep-style QUIC handshake routing with post-handshake bypass

Summary

I would like to request support for a QUICstep-style routing mode in sing-box.

QUICstep is a censorship-circumvention technique presented at PETS 2026:

• Paper: https://gfw.report/publications/pets26a/en/
• Artifact / reference implementation: https://github.com/inspire-group/QUICstep-PETS

The basic idea is simple:

1. Route QUIC Initial / Handshake packets through a censorship-resistant proxy or tunnel.
2. Once the QUIC connection switches to short-header 1-RTT packets, bypass the proxy and let those packets use the native network path.
3. If the destination server supports QUIC connection migration, the same QUIC connection continues over the direct path.

This hides the QUIC/TLS handshake, including SNI, from a censor while avoiding the bandwidth and latency cost of proxying the entire connection.

Why this seems to fit sing-box

This should not need to be implemented inside Hysteria2, WireGuard, or any other specific outbound protocol.

The handshake path can use any UDP-capable outbound, for example:

QUIC Initial / Handshake
        |
        v
sing-box routing
        |
        +--> Hysteria2
        +--> WireGuard
        +--> another UDP-capable outbound

After the handshake:

QUIC 1-RTT short-header packets
        |
        v
bypass sing-box
        |
        v
native network path

So conceptually this looks more like a routing / pre-match feature than a protocol-specific outbound feature.

sing-box already has relevant Linux infrastructure through auto_redirect and NFQUEUE-based pre-matching, so QUICstep may be implementable as a relatively narrow extension of the existing packet pre-match path.

Motivation

The PETS 2026 QUICstep paper reports that this approach can significantly reduce proxy bandwidth usage and page-load overhead compared with tunneling the entire QUIC connection, while still bypassing QUIC SNI censorship when the destination supports connection migration.

It also fits sing-box's architecture well because sing-box already provides:

• TUN / transparent routing
• NFQUEUE pre-match infrastructure
• multiple UDP-capable proxy outbounds
• kernel-level bypass behavior

So I think sing-box may be a good place to expose QUICstep as a transport-agnostic routing feature.

Start by reviewing sing-box's existing auto_redirect and NFQUEUE-based pre-match infrastructure, then compare the requested behavior with the QUICstep paper and reference implementation. The work is done when a concrete, transport-agnostic routing design supports proxying QUIC Initial/Handshake packets and bypassing the proxy for short-header 1-RTT packets, including defined behavior for connection migration.