AwesomeREA.org

Case study

usque: an open reimplementation of Cloudflare WARP’s MASQUE mode

Reimplements the MASQUE mode of Cloudflare’s WARP client in Go, tunnelling IP traffic over QUIC/HTTP/3 with Connect-IP (RFC 9484) and exposing it as a native TUN device, SOCKS5 or HTTP proxies, TCP-only L4 proxies or port forwarding. RESEARCH.md describes how the author worked out device enrollment, TLS client authentication and Cloudflare’s non-standard cf-connect-ip variant by analyzing the official Android client with Frida, mitmproxy, JADX, IDA Free and Wireshark. It registers with and connects to Cloudflare’s service outside the official client.

Requirements & limits

  • Reviewed at the 2026-07-20 main head, identical to release v4.2.1. The README calls the project early-stage, says its Go API is unstable if used as a library, and states that only the Linux amd64 release binary was tested, although builds are published for Android, Linux, Windows and macOS on several architectures. RESEARCH.md is a narrative research log; the concise protocol document the README plans has not been written.
  • Requires access to Cloudflare’s WARP service: the register command creates a new WARP account and enrolls a device key, and the generated config holds that registration’s keys and tokens. The tool uses Cloudflare’s service outside the official client; the README says it is not affiliated with, endorsed by or reviewed by Cloudflare, asks users not to abuse the service and notes that the tool is detectable. ZeroTrust login needs SSO the tool cannot perform; this record gives no token, account or configuration details.
  • Building needs Go 1.26.3+ with CGO disabled. The project depends on the author’s fork of connect-ip-go because, the README says, Cloudflare’s implementation is not fully RFC 9484-compliant; quic-go carries the connection, and gVisor and wireguard-go netstacks let the proxy modes run in user space without root. Native TUN mode is limited to Linux and Windows, while the README’s Known Issues list still says Linux only. A Dockerfile is provided.
  • CI verifies modules and runs go build, go vet, go test and golangci-lint, but the reviewed tree contains no Go test files, so correctness evidence is the author’s own use. The README reports one SOCKS5 speed test of about 834/773 Mbps on a 1 Gbps link and lists missing features such as happy eyeballs, WireGuard and DNS-over-HTTPS. These results are author-reported, and this source review ran nothing.
  • MIT (LICENSE.md). Cloudflare’s service terms and trademarks apply separately, and the README describes usque as an independent research project. The reviewed sources establish no AI or REA use.

About this entry

Type
Case study
Category
Independent reconstruction cases
Relationship
Independent reconstruction project
Targets
App · Protocol

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · Diniboy1123/usque · Revision 6aa03fc
  2. RESEARCH.md GitHub · Diniboy1123/usque · Revision 6aa03fc
  3. go.mod GitHub · Diniboy1123/usque · Revision 6aa03fc
  4. api/masque.go GitHub · Diniboy1123/usque · Revision 6aa03fc
  5. api/tunnel.go GitHub · Diniboy1123/usque · Revision 6aa03fc
  6. cmd/nativetun_windows.go GitHub · Diniboy1123/usque · Revision 6aa03fc
  7. .github/workflows/ci.yml GitHub · Diniboy1123/usque · Revision 6aa03fc
  8. goreleaser.yml GitHub · Diniboy1123/usque · Revision 6aa03fc
  9. Dockerfile GitHub · Diniboy1123/usque · Revision 6aa03fc
  10. LICENSE.md GitHub · Diniboy1123/usque · Revision 6aa03fc
  11. https://github.com/Diniboy1123/usque/releases/tag/v4.2.1
  12. https://datatracker.ietf.org/doc/rfc9484/

More in Apps

All 86 entries in AppsApps case studies (37)