[Feature Request] Enhance finalmask (or add AWG 3.1 support) to allow packet payload padding and random trailers for clean WireGuard / WARP outbounds

Is your feature request related to a problem? Please describe.

Currently, using Xray-core as a client to route traffic through pure WireGuard / Cloudflare WARP endpoints in censorship-heavy environments (like Russia) is becoming increasingly unreliable.

In previous discussions, when asked about incorporating AmneziaWG (AWG 2.0) features, the core team reasonably pointed out that finalmask covers these needs by sending pre-handshake noise (noise array).

However, censorship filters (DPI/TSPU) have evolved. While finalmask is great for generating noise packets before the handshake, it cannot modify the payload size/structure of the actual Handshake packet itself.

With the release of AmneziaWG 3.0 / 3.1, several new evasion mechanisms were introduced. Some of these—specifically RandomTrailers (appending random padding to the end of the handshake packet) and Content Padding—happen to work one-way against user-space WireGuard implementations like Cloudflare WARP (e.g. BoringTun strips trailing unknown bytes after parsing the 148-byte Noise IK payload).

Because finalmask currently only sends standalone UDP noise packets prior to the main payload, it is mathematically impossible to achieve packet-level padding/trailers with the existing finalmask implementation.

---

Describe the solution you'd like

We kindly request one of the following approaches:

1. Extend finalmask capability:

   • Add a feature inside finalmask (or a new mask type like padding / trailer) that allows appending random/custom padding bytes directly to the outgoing WireGuard Handshake UDP datagram, rather than sending them as separate UDP packets.

2. Native AmneziaWG 3.1 Outbound Support:

   • Alternatively, add native support for AWG 3.1 parameters in the WireGuard outbound module (e.g. Jc, Jmin, Jmax, S1-S4, RandomTrailers, DisableCookies, CPS syntax), allowing users to fine-tune both two-way and one-way obfuscation settings.

---

Describe alternatives you've considered

• Using finalmask noise arrays: Only sends separate pre-packets. DPI now easily correlates standalone pre-noise followed by an unpadded 148-byte WG handshake packet and drops the connection.
• Running external awg-go / amneziawg processes and routing Xray through local TUN devices: Works, but adds significant setup complexity, memory overhead, and resource usage compared to having this capability directly in Xray-core outbounds.

---

Additional context

Cloudflare WARP and many pure WireGuard deployments remain a vital gateway for free internet access in restricted regions. Having the ability to pad the handshake packet or attach random trailers natively within Xray-core would greatly improve connection stability for thousands of users without requiring full two-way protocol changes on the remote server side.

Thank you for your incredible work on Xray-core!