chore: update changelog for version 1.60.2 and add QUIC packet recognition improvements

Author: DanielLavrushin

changelog.md

@@ -1,5 +1,9 @@
 # B4 - Bye Bye Big Bro
 
+## [1.60.2] - 2026-05-xx
+
+- FIXED: **QUIC blocking sometimes does not work for YouTube on phones** - newer Chrome versions on Android use a QUIC variant b4 didn't recognize, so "block all QUIC" let those packets through and YouTube kept working in the browser. b4 now recognizes any QUIC packet, current or future.
+
 ## [1.60.1] - 2026-05-02
 
 - ADDED: **Per-set strategy escalation** - each set now has an "Escalation" tab with an "Escalate to" dropdown. Pick another set as the failover target: if the current set keeps failing for a destination, b4 switches that destination to the chosen set on the next connection. Tracking is per-hostname, so a problem with one site does not affect others that happen to share the same server IP. How quickly to escalate and how long to keep the switch are configurable per set (defaults: an hour, then retry). Lets you chain several strategies instead of giving up after the first one fails.

src/nfq/handler.go

@@ -606,7 +606,7 @@ func (w *Worker) handleUDPPacket(q *nfqueue.Nfqueue, id uint32, pkt *pktInfo, cf
 
 	isSTUN = stun.IsSTUNMessage(payload)
 
-	isQUIC := quic.IsInitial(payload)
+	isQUIC := quic.LooksLikeQUIC(payload)
 
 	if host == "" && isQUIC {
 		if h, ok := sni.ParseQUICClientHelloSNI(payload); ok {

src/quic/initial.go

@@ -47,6 +47,28 @@ func IsInitial(b []byte) bool {
 	}
 }
 
+func LooksLikeQUIC(b []byte) bool {
+	if len(b) < 7 || b[0]&longHdrBit == 0 {
+		return false
+	}
+	off := 1 + 4
+	if len(b) < off+1 {
+		return false
+	}
+	dlen := int(b[off])
+	off++
+	if dlen > 20 || len(b) < off+dlen+1 {
+		return false
+	}
+	off += dlen
+	slen := int(b[off])
+	off++
+	if slen > 20 || len(b) < off+slen {
+		return false
+	}
+	return true
+}
+
 func DecryptInitial(dcid, packet []byte) ([]byte, bool) {
 	if len(packet) < 7 || packet[0]&0x80 == 0 {
 		return nil, false