• Add experimental RFC 9484 CONNECT-IP (so-called "MASQUE") support.
  • Only HTTP/2 and HTTP/3 are implemented. HTTP/1.1 is not implemented.
  • RFC 9484 did not define a standard authentication mechanism. Therefore, Basic Authentication (HTTP "Authorization" header) and mutual TLS are implemented.
  • Similar to WireGuard support, it is not implemented as a VPN. It can only be used as a proxy for TCP stream or UDP datagram.
• Make CONNECT-UDP NAT mapping behavior address-and-port-dependent.