📝 Release Notes
- Add MASQUE client and server support 1
- Add HTTP/2, HTTP/3 and UDP support for HTTP proxy 2
- Add full certificate pinning for TLS 3
- Fixes and improvements
1:
The new MASQUE Client and MASQUE Server endpoints provide IP proxying over HTTP (CONNECT-IP), supporting HTTP/1.1, HTTP/2 and HTTP/3, address assignment and route advertisement. They can use the internal network stack or a system TUN interface.
2:
The HTTP proxy implementation has been rewritten, adding HTTP/2, HTTP/3 and UDP proxying through CONNECT-UDP to HTTP inbounds and outbounds.
HTTP outbounds now use HTTP/2 by default with automatic fallback to HTTP/1.1. Configurations using path or the Host header continue to use HTTP/1.1. HTTP/3 can be enabled through the version option.
The term "MASQUE VPN" usually refers to CONNECT-IP, rather than a combination of CONNECT and CONNECT-UDP, which is an enhancement to HTTP proxying. CONNECT-UDP and CONNECT-IP are collectively known as MASQUE in the IETF; the traditional CONNECT method for TCP proxying is not itself a MASQUE protocol.
See HTTP Inbound and HTTP Outbound.
3:
The new certificate_sha256 and client_certificate_sha256 TLS options pin the SHA-256 hash of the whole certificate, complementing the existing public key pinning options.
See TLS.