A QUICker SASE client: re-building Proxy Mode

Cloudflare rebuilt the proxy mode of the Cloudflare One Client by replacing WireGuard and smoltcp with QUIC-based direct L4 proxying to eliminate performance bottlenecks.

• •The previous architecture used smoltcp (a Rust-based user-space TCP stack) to convert L4 TCP traffic into L3 WireGuard packets, creating a performance ceiling.
• •The new approach uses HTTP/3 CONNECT method via QUIC streams to keep traffic at Layer 4, bypassing the L3 translation entirely.
• •This removes smoltcp's limitations and enables native QUIC congestion control and flow control at the transport layer.
• •Internal testing showed download and upload speeds doubled and latency decreased significantly.
• •The improvement benefits three scenarios: coexistence with third-party VPNs, high-bandwidth app partitioning, and CLI/SOCKS5 power users.