[braydos-h]

Summary

This completes UDP support in wireproxy:

• SOCKS5 UDP ASSOCIATE now respects routing rules. The split-routing path previously set only WithDialAndRequest, which is used by TCP CONNECT but not by UDP ASSOCIATE; UDP datagrams therefore fell back to a direct dial and bypassed WireGuard. UDP now uses a context-aware routed dialer, so each datagram is routed through the tunnel or directly based on its destination host.
• TunnelDomains / LogDomains apply to UDP destinations. Destination FQDNs are preserved from the SOCKS5 UDP header, resolved on the selected network (tunnel DNS for tunnelled hosts, system DNS for direct hosts), and logged the same way as TCP connections.
• Upgrade go-socks5 to v0.1.4 for the SOCKS5 UDP datagram parsing fixes.
• Add [UDPServerTunnel] as the server-side counterpart to the existing UDP client tunnel. It listens on the WireGuard side and forwards each remote peer to a local target, mirroring [TCPServerTunnel].
• Share the UDP response/session handling between [UDPProxyTunnel] and [UDPServerTunnel], including closing sessions on inactivity.

New configuration

# Existing client-side UDP tunnel:
[UDPProxyTunnel]
BindAddress = 127.0.0.1:53
Target = 1.1.1.1:53
InactivityTimeout = 30

# New server-side UDP tunnel:
[UDPServerTunnel]
ListenPort = 19132
Target = 127.0.0.1:19132
InactivityTimeout = 30

Tests

Added coverage for:

• SOCKS5 UDP ASSOCIATE with a directly dialled destination
• SOCKS5 UDP ASSOCIATE with a tunnelled destination through netstack
• UDP server tunnel forwarding over a netstack listener
• UDP server tunnel shutdown
• [UDPServerTunnel] config parsing and validation
• RoutedDialContext direct fallback

Validated with:

go test ./... -count=1
go test -race ./...
go vet ./...
make

Note

The implementation uses the built-in go-socks5 UDP relay: one connected UDP socket per client/destination pair, with endpoint-dependent mapping. This covers DNS, QUIC, voice, and typical game traffic, but is not a full-cone NAT implementation.