feat(xray): add the MASQUE protocol and transport

xray-core v26.10.10 serves MASQUE: CONNECT-IP over HTTP/3 or HTTP/2,
always behind TLS, as an inbound and an outbound protocol riding a
dedicated "masque" transport. The panel could not create either.

Inbound: MASQUE is a multi-user protocol whose users log in with their
email and password over Basic auth. The panel keeps the client's
"password" like trojan and GenXrayInboundConfig hands it to the core as
"pass", so the full-config path, the live AddInbound path and node
pushes all emit what the core reads; one user with an empty pass makes
the core refuse the whole inbound. Live user adds build a masque.Account
from either key, client-only changes diff per user so a new client does
not drop every connected tunnel, and client creation, copy, validation
and edits key on the password. The address pool and MTU get form
fields, TLS is mandatory, and the port check follows the core's
listener choice: HTTP/2 on TCP when the ALPN offers h2, HTTP/3 on UDP
when it offers h3 or not h2. Nodes may host MASQUE from v3.9.1, the
first panel release that knows to rename the password.

MASQUE has no share-link format, so links and Clash skip it; the JSON
subscription builds the client's masque outbound with its email and
password, and the subscription allowlist now lets a subId see MASQUE
inbounds at all. The IP-limit job, client pages and traffic tracking
list the protocol.

Outbound: the form edits the server, remote DNS, and the transport's
host, path, Basic credentials, headers and WARP block (enrolled key,
endpoint public key, tunnel addresses), which xray-core refuses next to
user/pass. The outbound test probes it through the core, since its
default HTTP/3 dial is UDP.

internal/web/service/client_crud.go

@@ -411,7 +411,7 @@ func (s *ClientService) fillProtocolDefaults(c *model.Client, ib *model.Inbound)
 		if c.ID == "" {
 			c.ID = uuid.NewString()
 		}
-	case model.Trojan:
+	case model.Trojan, model.MASQUE:
 		if c.Password == "" {
 			c.Password = strings.ReplaceAll(uuid.NewString(), "-", "")
 		}

internal/web/service/client_inbound_apply.go

@@ -443,7 +443,7 @@ func (s *ClientService) AddInboundClient(inboundSvc *InboundService, data *model
 			return false, common.NewError("client email is required")
 		}
 		switch oldInbound.Protocol {
-		case "trojan":
+		case "trojan", "masque":
 			if client.Password == "" {
 				return false, common.NewError("empty client ID")
 			}
@@ -688,7 +688,7 @@ func (s *ClientService) UpdateInboundClient(inboundSvc *InboundService, data *mo
 
 	newClientId := ""
 	switch oldInbound.Protocol {
-	case "trojan":
+	case "trojan", "masque":
 		newClientId = clients[0].Password
 	case "shadowsocks":
 		newClientId = clients[0].Email

internal/web/service/inbound.go

@@ -656,6 +656,7 @@ func (s *InboundService) normalizeStreamSettings(inbound *model.Inbound) {
 		model.Hysteria:    true,
 		model.WireGuard:   true,
 		model.Tunnel:      true,
+		model.MASQUE:      true,
 	}
 
 	if !protocolsWithStream[inbound.Protocol] {
@@ -1241,7 +1242,7 @@ func (s *InboundService) AddInbound(inbound *model.Inbound) (*model.Inbound, boo
 	// Secure client ID
 	for _, client := range clients {
 		switch inbound.Protocol {
-		case "trojan":
+		case "trojan", "masque":
 			if client.Password == "" {
 				return inbound, false, common.NewError("empty client ID")
 			}
@@ -1767,6 +1768,10 @@ func (s *InboundService) validateUpdatedInboundClients(inbound *model.Inbound) e
 			if client.Auth == "" {
 				return common.NewError("empty client ID")
 			}
+		case model.MASQUE:
+			if client.Password == "" {
+				return common.NewError("empty client ID")
+			}
 		case model.TUIC:
 			if client.ID == "" {
 				return common.NewError("empty client ID")

internal/web/service/inbound_clients.go

@@ -230,7 +230,7 @@ func (s *InboundService) buildTargetClientFromSource(source model.Client, target
 			inboundCanEnableTlsFlow(string(targetProtocol), targetInbound.StreamSettings, targetInbound.Settings) {
 			target.Flow = flow
 		}
-	case model.Trojan, model.Shadowsocks:
+	case model.Trojan, model.Shadowsocks, model.MASQUE:
 		target.Password = s.generateRandomCredential(targetProtocol)
 	case model.Hysteria:
 		target.Auth = s.generateRandomCredential(targetProtocol)

internal/web/service/inbound_masque_test.go

@@ -0,0 +1,101 @@
+package service
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/mhsanaei/3x-ui/v3/internal/database/model"
+)
+
+const masqueTestStream = `{"network":"masque","security":"tls","masqueSettings":{"path":"/.well-known/masque/ip/*/*/"},
+	"tlsSettings":{"alpn":["h3"],"certificates":[{"certificateFile":"/etc/ssl/certs/m.crt","keyFile":"/etc/ssl/private/m.key"}]}}`
+
+// GetXrayConfig rebuilds every inbound's users from the clients table; a MASQUE user
+// emitted without its password makes xray-core refuse the whole config at startup.
+func TestGetXrayConfig_EmitsMasqueUserPasswords(t *testing.T) {
+	setupConflictDB(t)
+	in := &model.Inbound{
+		Tag: "in-8443-masque", Enable: true, Listen: "127.0.0.1", Port: 8443, Protocol: model.MASQUE,
+		Settings:       `{"clients":[{"email":"ivy@example.test","password":"masque-pass-ivy","enable":true}],"address":["10.14.0.1/24"]}`,
+		StreamSettings: masqueTestStream,
+	}
+	if _, _, err := (&InboundService{}).AddInbound(in); err != nil {
+		t.Fatalf("AddInbound: %v", err)
+	}
+
+	cfg, err := (&XrayService{}).GetXrayConfig()
+	if err != nil {
+		t.Fatalf("GetXrayConfig: %v", err)
+	}
+	for i := range cfg.InboundConfigs {
+		if cfg.InboundConfigs[i].Tag != "in-8443-masque" {
+			continue
+		}
+		var settings struct {
+			Clients []map[string]any `json:"clients"`
+		}
+		if err := json.Unmarshal(cfg.InboundConfigs[i].Settings, &settings); err != nil {
+			t.Fatalf("decode emitted settings: %v", err)
+		}
+		if len(settings.Clients) != 1 || settings.Clients[0]["pass"] != "masque-pass-ivy" {
+			t.Fatalf("emitted clients = %v, want one with pass masque-pass-ivy", settings.Clients)
+		}
+		raw, err := json.Marshal(cfg.InboundConfigs[i])
+		if err != nil {
+			t.Fatalf("marshal emitted inbound: %v", err)
+		}
+		var emitted map[string]any
+		if err := json.Unmarshal(raw, &emitted); err != nil {
+			t.Fatalf("decode emitted inbound: %v", err)
+		}
+		if stream, _ := emitted["streamSettings"].(map[string]any); stream["network"] != "masque" {
+			t.Fatalf("emitted streamSettings = %v, want the stored masque transport", emitted["streamSettings"])
+		}
+		assertXrayAccepts(t, "the emitted MASQUE inbound", buildGoldenInbound(t, emitted))
+		return
+	}
+	t.Fatal("inbound in-8443-masque not found in the generated config")
+}
+
+// A client added to a MASQUE inbound without a password could never authenticate,
+// and xray-core refuses the whole inbound over one empty pass.
+func TestFillProtocolDefaults_MintsMasquePassword(t *testing.T) {
+	client := model.Client{Email: "ivy@example.test"}
+	if err := (&ClientService{}).fillProtocolDefaults(&client, &model.Inbound{Protocol: model.MASQUE}); err != nil {
+		t.Fatalf("fillProtocolDefaults: %v", err)
+	}
+	if len(client.Password) != 32 {
+		t.Fatalf("Password = %q, want a minted 32-character password", client.Password)
+	}
+	kept := model.Client{Email: "ivy@example.test", Password: "chosen"}
+	if err := (&ClientService{}).fillProtocolDefaults(&kept, &model.Inbound{Protocol: model.MASQUE}); err != nil {
+		t.Fatalf("fillProtocolDefaults: %v", err)
+	}
+	if kept.Password != "chosen" {
+		t.Fatalf("Password = %q, want the chosen password kept", kept.Password)
+	}
+}
+
+// Editing a MASQUE client must key on its password like trojan; falling back to the
+// empty UUID refused every MASQUE client edit with "empty client ID".
+func TestUpdateInboundClient_MasquePasswordChange(t *testing.T) {
+	setupBulkDB(t)
+	svc := &ClientService{}
+	source := []model.Client{{Email: "ivy@x", Password: "pw-old", SubID: "sub-ivy", Enable: true}}
+	ib := mkInbound(t, 22101, model.MASQUE, clientsSettings(t, source))
+	if err := svc.SyncInbound(nil, ib.Id, source); err != nil {
+		t.Fatalf("seed linkage: %v", err)
+	}
+
+	updated := []model.Client{{Email: "ivy@x", Password: "pw-new", SubID: "sub-ivy", Enable: true}}
+	if _, err := svc.UpdateInboundClient(&InboundService{}, &model.Inbound{
+		Id:       ib.Id,
+		Settings: clientsSettings(t, updated),
+	}, "ivy@x"); err != nil {
+		t.Fatalf("UpdateInboundClient: %v", err)
+	}
+
+	if rec := lookupClientRecord(t, "ivy@x"); rec.Password != "pw-new" {
+		t.Fatalf("stored password = %q, want pw-new", rec.Password)
+	}
+}

internal/web/service/inbound_protocol.go

@@ -70,6 +70,7 @@ var nodeEligibleProtocols = map[model.Protocol]bool{
 	model.MTProto:     true,
 	model.AmneziaWG:   true,
 	model.TUIC:        true,
+	model.MASQUE:      true,
 }
 
 // nodeProtocolFirstRelease is the panel release that introduced each protocol
@@ -78,6 +79,7 @@ var nodeProtocolFirstRelease = map[model.Protocol]string{
 	model.MTProto:   "v3.5.0",
 	model.AmneziaWG: "v3.7.0",
 	model.TUIC:      "v3.8.0",
+	model.MASQUE:    "v3.9.1",
 }
 
 // checkNodeCanHostProtocol refuses assigning protocol to nodeID unless the

internal/web/service/inbound_protocol_masque_test.go

@@ -0,0 +1,41 @@
+package service
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/mhsanaei/3x-ui/v3/internal/database"
+	"github.com/mhsanaei/3x-ui/v3/internal/database/model"
+)
+
+// MASQUE is native Xray, so a node runs it, but a node panel older than the release
+// that knows it would hand the clients' "password" to a core that reads "pass".
+func TestCheckNodeCanHostProtocol_Masque(t *testing.T) {
+	setupConflictDB(t)
+	tests := []struct {
+		version string
+		wantErr string
+	}{
+		{"v3.9.0", "need v3.9.1 or newer"},
+		{"v3.9.1", ""},
+		{"dev+1d1128cf", ""},
+	}
+	for i, tc := range tests {
+		t.Run(tc.version, func(t *testing.T) {
+			node := &model.Node{Name: "masque-node-" + tc.version, Address: "127.0.0.1", Port: 2096 + i, PanelVersion: tc.version}
+			if err := database.GetDB().Create(node).Error; err != nil {
+				t.Fatalf("create node: %v", err)
+			}
+			err := checkNodeCanHostProtocol(database.GetDB(), node.Id, model.MASQUE)
+			if tc.wantErr == "" {
+				if err != nil {
+					t.Fatalf("node on %s refused MASQUE: %v", tc.version, err)
+				}
+				return
+			}
+			if err == nil || !strings.Contains(err.Error(), tc.wantErr) {
+				t.Fatalf("node on %s: err = %v, want one containing %q", tc.version, err, tc.wantErr)
+			}
+		})
+	}
+}

internal/web/service/outbound/outbound.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"net"
+	"slices"
 	"strconv"
 	"strings"
 	"sync"
@@ -225,6 +226,9 @@ func outboundTransportIsUDP(ob map[string]any) bool {
 	if protocol, _ := ob["protocol"].(string); equalsAnyFold(protocol, "hysteria", "wireguard", "amneziawg") {
 		return true
 	}
+	if protocol, _ := ob["protocol"].(string); equalsAnyFold(protocol, "masque") {
+		return masqueDialsHTTP3(ob)
+	}
 	if stream, ok := ob["streamSettings"].(map[string]any); ok {
 		// The core resolves "kcp" and "mkcp" to the same mKCP transport.
 		if n, _ := stream["network"].(string); equalsAnyFold(n, "hysteria", "kcp", "mkcp", "quic") {
@@ -234,6 +238,15 @@ func outboundTransportIsUDP(ob map[string]any) bool {
 	return false
 }
 
+// masqueDialsHTTP3 mirrors the core's MASQUE client, which falls back to HTTP/2 over
+// TCP only when the TLS ALPN offers h2 and not h3.
+func masqueDialsHTTP3(ob map[string]any) bool {
+	stream, _ := ob["streamSettings"].(map[string]any)
+	tlsSettings, _ := stream["tlsSettings"].(map[string]any)
+	alpn, _ := tlsSettings["alpn"].([]any)
+	return !slices.Contains(alpn, any("h2")) || slices.Contains(alpn, any("h3"))
+}
+
 // equalsAnyFold mirrors the core, which lowercases a protocol id and a
 // transport name before it resolves either of them.
 func equalsAnyFold(value string, want ...string) bool {
@@ -281,7 +294,7 @@ func extractOutboundEndpoints(ob map[string]any) []string {
 		if len(out) == 0 {
 			addServer(settings["address"], settings["port"])
 		}
-	case "hysteria":
+	case "hysteria", "masque":
 		addServer(settings["address"], settings["port"])
 	case "trojan", "shadowsocks", "http", "socks":
 		if servers, ok := settings["servers"].([]any); ok {

internal/web/service/outbound/outbound_endpoints_test.go

@@ -52,3 +52,15 @@ func TestExtractOutboundEndpointsVLESS(t *testing.T) {
 		})
 	}
 }
+
+// A MASQUE outbound names its server flat in settings, like hysteria; without it the
+// outbound test has no endpoint to resolve and reports the outbound unreachable.
+func TestExtractOutboundEndpointsMasque(t *testing.T) {
+	got := extractOutboundEndpoints(map[string]any{
+		"protocol": "masque",
+		"settings": map[string]any{"address": "masque.example.com", "port": float64(8443)},
+	})
+	if want := []string{"masque.example.com:8443"}; !reflect.DeepEqual(got, want) {
+		t.Fatalf("extractOutboundEndpoints() = %v, want %v", got, want)
+	}
+}

internal/web/service/outbound/probe_protocol_case_test.go

@@ -51,6 +51,9 @@ func TestOutboundTransportIsUDPMatchesTheCore(t *testing.T) {
 		{"capitalised wireguard", map[string]any{"protocol": "WireGuard"}, true},
 		{"upper hysteria", map[string]any{"protocol": "HYSTERIA"}, true},
 		{"amneziawg", map[string]any{"protocol": "amneziawg"}, true},
+		// The core's MASQUE client dials HTTP/3 over QUIC unless the ALPN offers h2 without h3.
+		{"masque over http/3", map[string]any{"protocol": "masque", "streamSettings": map[string]any{"network": "masque"}}, true},
+		{"masque pinned to http/2", map[string]any{"protocol": "masque", "streamSettings": map[string]any{"network": "masque", "tlsSettings": map[string]any{"alpn": []any{"h2"}}}}, false},
 		{"kcp transport", map[string]any{"streamSettings": map[string]any{"network": "kcp"}}, true},
 		{"kcp transport capitalised", map[string]any{"streamSettings": map[string]any{"network": "KCP"}}, true},
 		{"mkcp alias", map[string]any{"streamSettings": map[string]any{"network": "mkcp"}}, true},

internal/web/service/port_conflict.go

@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"net"
+	"slices"
 	"strings"
 
 	"github.com/mhsanaei/3x-ui/v3/internal/amneziawg"
@@ -30,6 +31,8 @@ func inboundTransports(protocol model.Protocol, streamSettings, settings string)
 		return transportUDP
 	case model.MTProto:
 		return transportTCP
+	case model.MASQUE:
+		return masqueTransports(streamSettings)
 	}
 
 	var bits transportBits
@@ -93,6 +96,26 @@ func inboundTransports(protocol model.Protocol, streamSettings, settings string)
 	return bits
 }
 
+// masqueTransports mirrors xray-core's MASQUE listener: HTTP/2 on TCP when the TLS
+// ALPN offers h2, HTTP/3 on UDP when it offers h3 or does not offer h2.
+func masqueTransports(streamSettings string) transportBits {
+	var stream struct {
+		TLSSettings struct {
+			ALPN []string `json:"alpn"`
+		} `json:"tlsSettings"`
+	}
+	_ = json.Unmarshal([]byte(streamSettings), &stream)
+	h2 := slices.Contains(stream.TLSSettings.ALPN, "h2")
+	var bits transportBits
+	if h2 {
+		bits |= transportTCP
+	}
+	if !h2 || slices.Contains(stream.TLSSettings.ALPN, "h3") {
+		bits |= transportUDP
+	}
+	return bits
+}
+
 // bindAddr is a listen address plus sockopt.v6only. xray listens on "tcp"/"udp",
 // so Go opens every wildcard, 0.0.0.0 included, dual-stack unless v6only is set.
 type bindAddr struct {

internal/web/service/port_conflict_test.go

@@ -75,6 +75,13 @@ func TestInboundTransports(t *testing.T) {
 		{"hysteria forced udp", model.Hysteria, `{"network":"tcp"}`, ``, transportUDP},
 		{"wireguard forced udp", model.WireGuard, ``, ``, transportUDP},
 
+		// MASQUE serves HTTP/3 on UDP unless the TLS ALPN offers only h2, and adds an
+		// HTTP/2 listener on TCP whenever h2 is offered.
+		{"masque without alpn is udp", model.MASQUE, `{"network":"masque","tlsSettings":{}}`, ``, transportUDP},
+		{"masque h3 is udp", model.MASQUE, `{"network":"masque","tlsSettings":{"alpn":["h3"]}}`, ``, transportUDP},
+		{"masque h2 is tcp", model.MASQUE, `{"network":"masque","tlsSettings":{"alpn":["h2"]}}`, ``, transportTCP},
+		{"masque h3+h2 is both", model.MASQUE, `{"network":"masque","tlsSettings":{"alpn":["h3","h2"]}}`, ``, transportTCP | transportUDP},
+
 		{"shadowsocks tcp,udp", model.Shadowsocks, ``, `{"network":"tcp,udp"}`, transportTCP | transportUDP},
 		{"shadowsocks udp only", model.Shadowsocks, ``, `{"network":"udp"}`, transportUDP},
 		{"shadowsocks tcp only", model.Shadowsocks, ``, `{"network":"tcp"}`, transportTCP},

internal/web/service/xray.go

@@ -282,6 +282,10 @@ func (s *XrayService) GetXrayConfig() (*xray.Config, error) {
 				if c.Auth != "" {
 					entry["auth"] = c.Auth
 				}
+			case model.MASQUE:
+				if c.Password != "" {
+					entry["password"] = c.Password
+				}
 			case model.WireGuard:
 				if inboundClient, ok := wireguardClientsByEmail[strings.ToLower(strings.TrimSpace(c.Email))]; ok {
 					c.AllowedIPs = inboundClient.AllowedIPs