Titanium Web Proxy Files

What's Changed

• Reverse-proxy parity (phases 0–11) and the follow-ups on top of it. Documented limits that stay: a decrypting MASQUE hairpin is not implemented, and QUIC origins are not retried on the path that was called out in the HTTP/3 notes.
• MASQUE is opt-in. The listener can relay CONNECT-UDP over HTTP/2 capsules, and over HTTP/1.1 when the listener opts in. Credentials are per listener. A chunked HTTP/1.1 connect-udp upgrade is rejected. The tunnel slot and UDP socket survive ordinary failures. The TLS handshake continues when the leaf is not this manager's certificate.
• HTTP/3 origins: race TCP/HTTP/2 against a cold QUIC handshake; stop retrying a blackholed QUIC origin and keep HTTP/2 clients on HTTP/2; replay a safe request over TCP when a QUIC origin goes silent; do not re-dial QUIC from a call queued behind a failed handshake; replay an HTTP/2 or HTTP/3 client once when the HTTP/1.1 origin returns a gateway status; do not replay a slow origin when the QUIC connection is already answering; the stall guard keeps waiting while some other stream is alive, skips event streams, and cold dial waiters fall back to TCP; a broken QUIC origin backs off instead of a flat five minutes.
• Keep-alive and pooling: replay on a fresh connection when a reused socket closes without a response; hold the body for replay only on an idle keep-alive socket, and replay a POST only when the EOF follows the write closely; drop a pooled connection the origin already closed; keep the origin connection when throttling an HTTP/2 client bridged to an HTTP/1.1 origin; wake pooled waiters, and let a no-cache request evict an idle socket.
• HTTP/2: do not relay a client RST_STREAM before the request HEADERS were sent. The HTTP/2 probe finishes at the ServerHello budget instead of failing the CONNECT.
• Certificates and trust: do not learn a pin for a host the client already trusted; learn a decrypt bypass once when several connections to a host fail together; present the leaf directly when the OS cannot pre-build its chain; client-certificate checks no longer fetch an attacker-chosen URL. The private-network guard also blocks embedded and documentation addresses.
• Forwarded headers: trusted proxies match with CIDR for IPv4 and IPv6; an entry that does not parse is rejected; an IPv4-mapped client is written as IPv4.
• Mirror routes get their own queue and workers. MaxBodyBytes is capped at 1 MiB. Request lines and headers that contain control characters are refused.
• A slow passthrough or PROXY-protocol client no longer stalls the accept loop. A drained accept closes with FIN after the leftover bytes are discarded. The connection-cap slot is released on dispose. A full cap does not eject the destination. A failed retry is counted once when no alternate exists.
• Health probes run concurrently, probe a unix socket by connecting, bracket IPv6 hosts, and bound DNS refresh. Routing honors HalfOpenSuccesses, resets ejection state on restore, and keeps DNS-pinned destinations off the fast path. A generated config file keeps its schema bounds. Stop returns without waiting out one-second delays.
• Bridged exchanges report the real client and origin protocol. DBSC secure-session challenges are ignored for bot-block learning, and the Inspector file log writer stays alive.
• The Titanium.Web.Proxy package carries MIT license metadata. The unused Hosting project is gone.

Full Changelog: https://github.com/justcoding121/titanium-web-proxy/compare/v7.0.26...v7.0.27