[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f4yJETK6EqH6sxhAWlTejk6szg8tKAOb1rKqGJToxCXs":3},{"item":4,"related":44},{"id":5,"type":6,"title":7,"slug":8,"summary":9,"body":10,"coverUrl":11,"productScreenshots":12,"productLinks":13,"authorName":14,"authorUrl":15,"authorSubject":16,"category":17,"tags":22,"sourceLabel":35,"sourceName":35,"sourceUrl":36,"status":37,"seoTitle":7,"seoDescription":9,"canonicalUrl":38,"isFeatured":39,"sno":40,"sortOrder":41,"publishedAt":42,"updatedAt":43,"createdAt":43},"c5860dc7-9e5c-4564-bc17-a58195409ff2","article","MASQUE CONNECT-UDP：HTTP 代理怎样替你转发 UDP 流量？","masque-connect-udp-http-proxy","CONNECT-UDP 定义了通过 HTTP 代理转发 UDP 数据报的一种方式，是 MASQUE 技术体系的重要构件。本文用“把数据交给中转站再封装送出”的路径解释它，并厘清代理能看到什么、它不等同于什么。","有些应用只会发送 UDP 数据，却希望网络流量经过一个 HTTP 代理；代理协议原本更擅长转发网页请求。MASQUE 中的 CONNECT-UDP 扩展把两者连接起来：客户端可以通过 HTTP 隧道，请求代理代为向指定目标转发 UDP 数据报。\n\n## 把 UDP 包交给 HTTP 中转站\n\n客户端先与代理建立 HTTP 连接，再发送 CONNECT-UDP 请求，指明要连接的目标。代理接受后，客户端就能把 UDP 数据报装入隧道传给代理；代理取出数据，再通过 UDP 发往目标。返回的数据沿相反方向封装回客户端。HTTP\u002F3 与 QUIC 的组合能让这类隧道适配基于 QUIC 的应用场景，但协议本身也定义了相应的 HTTP 扩展机制。\n\n可以把它想成跨国寄送一种特殊包裹：本地承运公司不直接经营目的地路线，于是把包裹交给有资质的中转站。HTTP 隧道是承运单和转运线路，UDP 数据报是包裹里的内容。应用无需为每个网络环境重新发明代理协议，只要客户端和代理实现了约定即可。\n\n## 代理拓宽了连通性，也带来新的信任点\n\nCONNECT-UDP 能让受限网络中的应用借助代理访问 UDP 服务，但代理并非隐形。它会知道客户端连接了哪个代理，并按请求看到目标等路由信息；具体能否读取隧道内容，取决于外层加密、应用自身加密及代理部署方式。若应用数据本来没有端到端保护，不能假设“走 HTTP 隧道就自动保密”。\n\n这也不等于传统意义上所有 VPN 的功能。VPN 往往在网络层建立虚拟接口，把更多设备流量纳入隧道；CONNECT-UDP 是面向特定应用或协议栈的代理机制，访问范围、DNS 行为、代理策略和认证方式取决于实现。客户端必须信任代理，并考虑代理故障、滥用与隐私日志。\n\nMASQUE 的实用价值在于复用成熟的 HTTP 代理与加密连接能力，为 UDP 流量提供可组合的隧道方式。部署前应先明确目标服务、代理可见信息、端到端加密需求和失败回退策略；“能够转发”只是连通性的答案，不是完整的安全评估。\n\n来源：[IETF RFC 9298：Proxying UDP in HTTP](https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc9298.html)","\u002Fuploads\u002F2026-10-17\u002F9bfb91ce-2008-4074-972d-35c34d424219.jpg",[],[],"Foundit","https:\u002F\u002Ffoundit.cn","foundit-ai-editorial",{"id":18,"name":19,"slug":20,"description":21},"6179d3b6-dc34-4483-9ded-3cd9f1b37a47","科普","abbreviation","介绍各领域新兴概念",[23,27,31],{"id":24,"name":25,"slug":26},"7c76bfc2-f80f-4ee0-a95d-27bd8708b434","技术","slug",{"id":28,"name":29,"slug":30},"a202d639-99a6-488a-a712-4d4c6ffd7e15","开发","dev",{"id":32,"name":33,"slug":34},"4c2bbea6-eab7-40a8-8447-1de478ff7749","分析","analyse","IETF RFC 9298","https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc9298.html","published",null,false,51,0,"2026-10-17T00:00:00.000Z","2026-10-17T03:08:44.695Z",[45,54,62],{"id":46,"type":6,"title":47,"slug":48,"summary":49,"coverUrl":50,"authorName":14,"sno":51,"publishedAt":52,"createdAt":53},"9ccde95c-d754-4808-91f7-488f392e3eeb","你的品牌在AI眼里到底存不存在？这套系统说了算","automated-geo-monitoring-system","靠手动抽查来验证GEO效果，本质上是在跟概率玩游戏。赢一次，不代表能一直赢。","\u002Fuploads\u002F2026-08-07\u002Fdf111c0d-f14a-4b2a-8347-141e96b71654.jpg",1,"2026-08-07T00:00:00.000Z","2026-08-07T04:31:30.843Z",{"id":55,"type":6,"title":56,"slug":57,"summary":58,"coverUrl":59,"authorName":14,"sno":60,"publishedAt":42,"createdAt":61},"9865c835-21fc-4f74-b154-19c054173557","fscrypt：只给手机里的某个文件夹加密，系统怎么做到？","linux-fscrypt-file-based-encryption","Linux fscrypt 在支持的文件系统中为目录树、文件内容和文件名提供文件级加密。它与整盘加密保护的范围不同，也不会隐藏所有文件系统元数据；本文从解锁密钥说到备份与恢复的边界。","\u002Fuploads\u002F2026-10-17\u002Fdec803fe-0da3-4a9e-8ffc-47427cf599d6.jpg",41,"2026-10-17T03:08:37.641Z",{"id":63,"type":6,"title":64,"slug":65,"summary":66,"coverUrl":67,"authorName":14,"sno":68,"publishedAt":69,"createdAt":70},"56d3ebcb-170a-4f96-9134-ae85fb65542b","DANE\u002FTLSA：DNSSEC 能否帮助验证网站的 TLS 证书？","dane-tlsa-dnssec-tls-authentication","DANE 使用 DNS 中的 TLSA 记录发布与 TLS 服务证书或公钥相关的约束，并依赖 DNSSEC 验证记录来源。本文解释它如何补充信任路径，以及为什么它不等于所有网站都能抛弃 CA。","\u002Fuploads\u002F2026-10-13\u002F8c7d9bf5-62c6-47d4-b8eb-c4db7a21fa61.jpg",42,"2026-10-13T00:00:00.000Z","2026-10-13T02:13:55.563Z"]