Module obfs 

HTTP/3 (QUIC) traffic-shaping obfuscation for the ShadowVPN UDP carrier.

Wraps each finished crypto datagram so it resembles a QUIC 1-RTT (short-header) packet on the wire, and unwraps received packets. This is the server-side counterpart of the iOS client’s obfs module and must stay byte-compatible with it: same first-byte form bits, same fixed 8-byte Destination Connection ID length, same pn_len = (first & 0x03) + 1 decode.

It is cosmetic framing, not a real QUIC stack — it adds no security, only evades naive UDP/protocol classification.

Wire prefix prepended to every datagram

[ first byte (1) ] [ DCID (dcid_len) ] [ packet number (PN_LEN) ] [ payload … ]
  0b01RR_SPKK         random, per-session   big-endian counter        salt ++ AEAD

Decoding is self-describing given the shared dcid_len: read the first byte, take pn_len = (first & 0x03) + 1, then the payload starts at 1 + dcid_len + pn_len.

Structs

QuicObfs

A QUIC short-header obfuscator for one server. Cheap to share via Arc.

Enums

Obfuscator

Carrier obfuscation applied to every datagram. Both ends must select the same variant; wire formats are documented in DESIGN.md.

Constants

DEFAULT_DCID_LEN

Destination Connection ID length, in bytes. Fixed and shared by both ends.

MAX_HEADER

Upper bound on the obfs header size (1 + max DCID + max PN), used to size receive buffers with headroom regardless of the negotiated dcid_len.