xudp

app/proxyman/outbound/handler.go

@@ -217,6 +217,7 @@ func (h *Handler) Dispatch(ctx context.Context, link *transport.Link) {
 		if ob.Target.Network == net.Network_UDP && ob.Target.Port == 443 {
 			switch h.udp443 {
 			case "reject":
+				proxy.DropUDP(ctx, link.Reader)
 				test(errors.New("XUDP rejected UDP/443 traffic"))
 				return
 			case "skip":

proxy/blackhole/blackhole.go

@@ -9,11 +9,10 @@ import (
 
 	"github.com/xtls/xray-core/common"
 	"github.com/xtls/xray-core/common/buf"
-	"github.com/xtls/xray-core/common/dice"
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/net"
 	"github.com/xtls/xray-core/common/session"
-	"github.com/xtls/xray-core/common/signal"
+	"github.com/xtls/xray-core/proxy"
 	"github.com/xtls/xray-core/transport"
 	"github.com/xtls/xray-core/transport/internet"
 )
@@ -69,14 +68,8 @@ func (h *Handler) Process(ctx context.Context, link *transport.Link, dialer inte
 	}
 	defer common.Interrupt(link.Writer)
 	defer common.Interrupt(link.Reader)
-	// wait to drain all the possible incoming UDP data
 	if ob.Target.Network == net.Network_UDP {
-		ctx, cancel := context.WithCancel(ctx)
-		timer := signal.CancelAfterInactivity(ctx, func() {
-			cancel()
-		}, time.Duration(30+dice.Roll(61))*time.Second)
-		go buf.Copy(link.Reader, buf.Discard, buf.UpdateActivity(timer))
-		<-ctx.Done()
+		proxy.DropUDP(ctx, link.Reader)
 	}
 	return nil
 }

proxy/drop.go

@@ -0,0 +1,24 @@
+package proxy
+
+import (
+	"context"
+	"math/rand/v2"
+	"time"
+
+	"github.com/xtls/xray-core/common"
+	"github.com/xtls/xray-core/common/buf"
+	"github.com/xtls/xray-core/common/signal"
+)
+
+// wait to drain all the possible incoming UDP data
+// because re-established QUIC UDP may bypass the sniffer
+func DropUDP(ctx context.Context, reader buf.Reader) {
+	ctx, cancel := context.WithCancel(ctx)
+	timer := signal.CancelAfterInactivity(ctx, func() {
+		cancel()
+	}, time.Duration(30+rand.N(60))*time.Second)
+	context.AfterFunc(ctx, func() {
+		common.Interrupt(reader)
+	})
+	buf.Copy(reader, buf.Discard, buf.UpdateActivity(timer))
+}

proxy/vless/outbound/outbound.go

@@ -254,6 +254,7 @@ func (h *Handler) Process(ctx context.Context, link *transport.Link, dialer inte
 		switch request.Command {
 		case protocol.RequestCommandUDP:
 			if !allowUDP443 && request.Port == 443 {
+				proxy.DropUDP(ctx, link.Reader)
 				return errors.New("XTLS rejected UDP/443 traffic")
 			}
 		case protocol.RequestCommandMux: