v25.11.0

changelog.md

@@ -1,5 +1,47 @@
 # Changelog
 
+## 2026-03-15 - 25.11.0 - feat(rustproxy-http)
+add HTTP/2 Extended CONNECT WebSocket proxy support
+
+- Enable HTTP/2 CONNECT protocol support on the Hyper auto connection builder
+- Detect WebSocket requests for both HTTP/1 Upgrade and HTTP/2 Extended CONNECT flows
+- Translate HTTP/2 WebSocket requests to an HTTP/1.1 backend handshake and return RFC-compliant client responses
+
+## 2026-03-12 - 25.10.7 - fix(rustproxy-http)
+remove Host header from HTTP/2 upstream requests while preserving it for HTTP/1 retries
+
+- strips the Host header before sending HTTP/2 upstream requests so :authority from the URI is used instead
+- avoids 400 responses from nginx caused by sending both Host and :authority headers
+- keeps a cloned header set for bodyless request retries so HTTP/1 fallback still retains the Host header
+
+## 2026-03-12 - 25.10.6 - fix(rustproxy-http)
+use the requested domain as HTTP/2 authority instead of the backend host and port
+
+- build HTTP/2 absolute URIs from the client-facing domain so the :authority pseudo-header matches the Host header
+- remove backend port from generated HTTP/2 request URIs and fall back to the upstream host only when no domain is available
+- apply the authority handling consistently across pooled, inline, and generic upstream request paths
+
+## 2026-03-12 - 25.10.5 - fix(rustproxy-http)
+configure HTTP/2 client builders with a Tokio timer for keep-alive handling
+
+- Adds TokioTimer to all HTTP/2 client builder instances in proxy_service.
+- Ensures configured HTTP/2 keep-alive interval and timeout settings have the required timer runtime support.
+
+## 2026-03-12 - 25.10.4 - fix(rustproxy-http)
+stabilize upstream HTTP/2 forwarding and fallback behavior
+
+- Remove hop-by-hop headers before forwarding requests to HTTP/2 backends to comply with RFC 9113.
+- Use ALPN-enabled TLS configuration whenever HTTP/2 is possible, including explicit H2 connections and retries.
+- Add HTTP/2 handshake timeouts, tuned connection settings, and fallback to HTTP/1 when H2 negotiation times out or fails.
+- Register pooled HTTP/2 senders only after a successful first request to avoid reusing broken connections.
+- Build absolute URIs for HTTP/2 upstream requests so pseudo-headers such as scheme and authority are derived correctly.
+
+## 2026-03-12 - 25.10.3 - fix(rustproxy-http)
+include request domain in backend proxy error and protocol detection logs
+
+- Adds domain context to backend TCP/TLS connect, handshake, request failure, retry, and fallback log entries in the Rust HTTP proxy service.
+- Propagates the resolved host/domain through H1, H2, pooled, and fallback forwarding paths so backend-level diagnostics can be correlated with the original request domain.
+
 ## 2026-03-12 - 25.10.2 - fix(repo)
 no code changes to release
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartproxy",
-  "version": "25.10.2",
+  "version": "25.11.0",
   "private": false,
   "description": "A powerful proxy package with unified route-based configuration for high traffic management. Features include SSL/TLS support, flexible routing patterns, WebSocket handling, advanced security options, and automatic ACME certificate management.",
   "main": "dist_ts/index.js",

rust/crates/rustproxy-http/src/proxy_service.rs

@@ -304,8 +304,10 @@ impl HttpProxyService {
         });
 
         // Auto-detect h1 vs h2 based on ALPN / connection preface.
-        // serve_connection_with_upgrades supports h1 Upgrade (WebSocket) and h2 CONNECT.
-        let builder = hyper_util::server::conn::auto::Builder::new(hyper_util::rt::TokioExecutor::new());
+        // serve_connection_with_upgrades supports h1 Upgrade (WebSocket) and h2 Extended CONNECT (RFC 8441).
+        let mut builder = hyper_util::server::conn::auto::Builder::new(hyper_util::rt::TokioExecutor::new());
+        // Advertise Extended CONNECT support so H2 clients can initiate WebSocket connections
+        builder.http2().enable_connect_protocol();
         let conn = builder.serve_connection_with_upgrades(io, service);
         // Pin on the heap — auto::UpgradeableConnection is !Unpin
         let mut conn = Box::pin(conn);
@@ -479,18 +481,25 @@ impl HttpProxyService {
         }
 
         let upstream_key = format!("{}:{}", upstream.host, upstream.port);
+        let domain_str = host.as_deref().unwrap_or("-");
         self.upstream_selector.connection_started(&upstream_key);
 
-        // Check for WebSocket upgrade
-        let is_websocket = req.headers()
+        // Check for WebSocket upgrade: H1 (Upgrade header) or H2 Extended CONNECT (RFC 8441)
+        let is_h1_websocket = req.headers()
             .get("upgrade")
             .and_then(|v| v.to_str().ok())
             .map(|v| v.eq_ignore_ascii_case("websocket"))
             .unwrap_or(false);
 
-        if is_websocket {
+        let is_h2_websocket = req.method() == hyper::Method::CONNECT
+            && req.extensions()
+                .get::<hyper::ext::Protocol>()
+                .map(|p| p.as_str().eq_ignore_ascii_case("websocket"))
+                .unwrap_or(false);
+
+        if is_h1_websocket || is_h2_websocket {
             let result = self.handle_websocket_upgrade(
-                req, peer_addr, &upstream, route_match.route, route_id, &upstream_key, cancel, &ip_str,
+                req, peer_addr, &upstream, route_match.route, route_id, &upstream_key, cancel, &ip_str, is_h2_websocket,
             ).await;
             // Note: for WebSocket, connection_ended is called inside
             // the spawned tunnel task when the connection closes.
@@ -538,6 +547,15 @@ impl HttpProxyService {
             }
         }
 
+        // Remove hop-by-hop headers (RFC 9113 §8.2.2 forbids connection-specific headers in H2)
+        upstream_headers.remove("connection");
+        upstream_headers.remove("keep-alive");
+        upstream_headers.remove("proxy-connection");
+        upstream_headers.remove("transfer-encoding");
+        upstream_headers.remove("te");
+        upstream_headers.remove("trailer");
+        upstream_headers.remove("upgrade");
+
         // Add standard reverse-proxy headers (X-Forwarded-*)
         {
             let original_host = host.as_deref().unwrap_or("");
@@ -622,7 +640,7 @@ impl HttpProxyService {
                     self.metrics.set_backend_protocol(&upstream_key, "h2");
                     let result = self.forward_h2_pooled(
                         sender, parts, body, upstream_headers, &upstream_path,
-                        route_match.route, route_id, &ip_str, &pool_key,
+                        route_match.route, route_id, &ip_str, &pool_key, domain_str,
                     ).await;
                     self.upstream_selector.connection_ended(&upstream_key);
                     return result;
@@ -633,8 +651,8 @@ impl HttpProxyService {
         // --- Fresh connection path ---
         self.metrics.backend_pool_miss(&upstream_key);
 
-        // Choose TLS config: use ALPN config for auto-detect probe, plain config otherwise
-        let tls_config = if needs_alpn_probe {
+        // Choose TLS config: use ALPN config when H2 is possible (auto-detect probe OR explicit H2)
+        let tls_config = if needs_alpn_probe || use_h2 {
             &self.backend_tls_config_alpn
         } else {
             &self.backend_tls_config
@@ -668,6 +686,7 @@ impl HttpProxyService {
 
                         info!(
                             backend = %upstream_key,
+                            domain = %domain_str,
                             protocol = if is_h2 { "h2" } else { "h1" },
                             connect_time_ms = %connect_start.elapsed().as_millis(),
                             "Backend protocol detected via ALPN"
@@ -684,6 +703,7 @@ impl HttpProxyService {
                 Ok(Err(e)) => {
                     error!(
                         backend = %upstream_key,
+                        domain = %domain_str,
                         connect_time_ms = %connect_start.elapsed().as_millis(),
                         error = %e,
                         "Backend TLS connect failed"
@@ -695,6 +715,7 @@ impl HttpProxyService {
                 Err(_) => {
                     error!(
                         backend = %upstream_key,
+                        domain = %domain_str,
                         connect_time_ms = %connect_start.elapsed().as_millis(),
                         "Backend TLS connect timeout"
                     );
@@ -720,6 +741,7 @@ impl HttpProxyService {
                 Ok(Err(e)) => {
                     error!(
                         backend = %upstream_key,
+                        domain = %domain_str,
                         connect_time_ms = %connect_start.elapsed().as_millis(),
                         error = %e,
                         "Backend TCP connect failed"
@@ -731,6 +753,7 @@ impl HttpProxyService {
                 Err(_) => {
                     error!(
                         backend = %upstream_key,
+                        domain = %domain_str,
                         connect_time_ms = %connect_start.elapsed().as_millis(),
                         "Backend TCP connect timeout"
                     );
@@ -756,19 +779,19 @@ impl HttpProxyService {
                 self.forward_h2_with_fallback(
                     io, parts, body, upstream_headers, &upstream_path,
                     &upstream, route_match.route, route_id, &ip_str, &final_pool_key,
-                    host.clone(),
+                    host.clone(), domain_str,
                 ).await
             } else {
                 // Explicit H2 mode: hard-fail on handshake error (preserved behavior)
                 self.forward_h2(
                     io, parts, body, upstream_headers, &upstream_path,
-                    &upstream, route_match.route, route_id, &ip_str, &final_pool_key,
+                    &upstream, route_match.route, route_id, &ip_str, &final_pool_key, domain_str,
                 ).await
             }
         } else {
             self.forward_h1(
                 io, parts, body, upstream_headers, &upstream_path,
-                &upstream, route_match.route, route_id, &ip_str, &final_pool_key,
+                &upstream, route_match.route, route_id, &ip_str, &final_pool_key, domain_str,
             ).await
         };
         self.upstream_selector.connection_ended(&upstream_key);
@@ -790,6 +813,7 @@ impl HttpProxyService {
         route_id: Option<&str>,
         source_ip: &str,
         pool_key: &crate::connection_pool::PoolKey,
+        domain: &str,
     ) -> Result<Response<BoxBody<Bytes, hyper::Error>>, hyper::Error> {
         let backend_key = format!("{}:{}", pool_key.host, pool_key.port);
 
@@ -798,7 +822,7 @@ impl HttpProxyService {
             self.metrics.backend_pool_hit(&backend_key);
             return self.forward_h1_with_sender(
                 pooled_sender, parts, body, upstream_headers, upstream_path,
-                route, route_id, source_ip, pool_key,
+                route, route_id, source_ip, pool_key, domain,
             ).await;
         }
 
@@ -809,7 +833,7 @@ impl HttpProxyService {
         ) = match hyper::client::conn::http1::handshake(io).await {
             Ok(h) => h,
             Err(e) => {
-                error!(backend = %backend_key, error = %e, "Backend H1 handshake failed");
+                error!(backend = %backend_key, domain = %domain, error = %e, "Backend H1 handshake failed");
                 self.metrics.backend_handshake_error(&backend_key);
                 return Ok(error_response(StatusCode::BAD_GATEWAY, "Backend handshake failed"));
             }
@@ -821,7 +845,7 @@ impl HttpProxyService {
             }
         });
 
-        self.forward_h1_with_sender(sender, parts, body, upstream_headers, upstream_path, route, route_id, source_ip, pool_key).await
+        self.forward_h1_with_sender(sender, parts, body, upstream_headers, upstream_path, route, route_id, source_ip, pool_key, domain).await
     }
 
     /// Common H1 forwarding logic used by both fresh and pooled paths.
@@ -836,6 +860,7 @@ impl HttpProxyService {
         route_id: Option<&str>,
         source_ip: &str,
         pool_key: &crate::connection_pool::PoolKey,
+        domain: &str,
     ) -> Result<Response<BoxBody<Bytes, hyper::Error>>, hyper::Error> {
         // Always use HTTP/1.1 for h1 backend connections (h2 incoming requests have version HTTP/2.0)
         let mut upstream_req = Request::builder()
@@ -863,7 +888,7 @@ impl HttpProxyService {
             Ok(resp) => resp,
             Err(e) => {
                 let bk = format!("{}:{}", pool_key.host, pool_key.port);
-                error!(backend = %bk, error = %e, "Backend H1 request failed");
+                error!(backend = %bk, domain = %domain, error = %e, "Backend H1 request failed");
                 self.metrics.backend_request_error(&bk);
                 return Ok(error_response(StatusCode::BAD_GATEWAY, "Backend request failed"));
             }
@@ -889,20 +914,32 @@ impl HttpProxyService {
         route_id: Option<&str>,
         source_ip: &str,
         pool_key: &crate::connection_pool::PoolKey,
+        domain: &str,
     ) -> Result<Response<BoxBody<Bytes, hyper::Error>>, hyper::Error> {
         let backend_key = format!("{}:{}", pool_key.host, pool_key.port);
         let exec = hyper_util::rt::TokioExecutor::new();
-        // Explicitly type the handshake with BoxBody for uniform pool type
+        let mut h2_builder = hyper::client::conn::http2::Builder::new(exec);
+        h2_builder
+            .timer(hyper_util::rt::TokioTimer::new())
+            .keep_alive_interval(std::time::Duration::from_secs(10))
+            .keep_alive_timeout(std::time::Duration::from_secs(5))
+            .adaptive_window(true)
+            .initial_stream_window_size(2 * 1024 * 1024);
         let (sender, conn): (
             hyper::client::conn::http2::SendRequest<BoxBody<Bytes, hyper::Error>>,
             hyper::client::conn::http2::Connection<TokioIo<BackendStream>, BoxBody<Bytes, hyper::Error>, hyper_util::rt::TokioExecutor>,
-        ) = match hyper::client::conn::http2::handshake(exec, io).await {
-            Ok(h) => h,
-            Err(e) => {
-                error!(backend = %backend_key, error = %e, "Backend H2 handshake failed");
+        ) = match tokio::time::timeout(self.connect_timeout, h2_builder.handshake(io)).await {
+            Ok(Ok(h)) => h,
+            Ok(Err(e)) => {
+                error!(backend = %backend_key, domain = %domain, error = %e, "Backend H2 handshake failed");
                 self.metrics.backend_handshake_error(&backend_key);
                 return Ok(error_response(StatusCode::BAD_GATEWAY, "Backend H2 handshake failed"));
             }
+            Err(_) => {
+                error!(backend = %backend_key, domain = %domain, "Backend H2 handshake timeout");
+                self.metrics.backend_handshake_error(&backend_key);
+                return Ok(error_response(StatusCode::GATEWAY_TIMEOUT, "Backend H2 handshake timeout"));
+            }
         };
 
         tokio::spawn(async move {
@@ -911,10 +948,13 @@ impl HttpProxyService {
             }
         });
 
-        // Register for multiplexed reuse
-        self.connection_pool.register_h2(pool_key.clone(), sender.clone());
-
-        self.forward_h2_with_sender(sender, parts, body, upstream_headers, upstream_path, route, route_id, source_ip, Some(pool_key)).await
+        // Clone sender for potential pool registration; register only after first request succeeds
+        let sender_for_pool = sender.clone();
+        let result = self.forward_h2_with_sender(sender, parts, body, upstream_headers, upstream_path, route, route_id, source_ip, Some(pool_key), domain).await;
+        if matches!(&result, Ok(ref resp) if resp.status() != StatusCode::BAD_GATEWAY) {
+            self.connection_pool.register_h2(pool_key.clone(), sender_for_pool);
+        }
+        result
     }
 
     /// Forward request using an existing (pooled) HTTP/2 sender.
@@ -931,6 +971,7 @@ impl HttpProxyService {
         route_id: Option<&str>,
         source_ip: &str,
         pool_key: &crate::connection_pool::PoolKey,
+        domain: &str,
     ) -> Result<Response<BoxBody<Bytes, hyper::Error>>, hyper::Error> {
         // Save retry state for bodyless requests (cheap: Method is an enum, HeaderMap clones Arc-backed Bytes)
         let retry_state = if body.is_end_stream() {
@@ -941,18 +982,18 @@ impl HttpProxyService {
 
         let result = self.forward_h2_with_sender(
             sender, parts, body, upstream_headers, upstream_path,
-            route, route_id, source_ip, Some(pool_key),
+            route, route_id, source_ip, Some(pool_key), domain,
         ).await;
 
         // If the request failed (502) and we can retry with an empty body, do so
         let is_502 = matches!(&result, Ok(resp) if resp.status() == StatusCode::BAD_GATEWAY);
         if is_502 {
             if let Some((method, headers)) = retry_state {
-                warn!("Stale pooled H2 sender for {}:{}, retrying with fresh connection",
-                    pool_key.host, pool_key.port);
+                warn!(backend = %format!("{}:{}", pool_key.host, pool_key.port), domain = %domain,
+                    "Stale pooled H2 sender, retrying with fresh connection");
                 return self.retry_h2_with_fresh_connection(
                     method, headers, upstream_path,
-                    pool_key, route, route_id, source_ip,
+                    pool_key, route, route_id, source_ip, domain,
                 ).await;
             }
         }
@@ -970,6 +1011,7 @@ impl HttpProxyService {
         route: &rustproxy_config::RouteConfig,
         route_id: Option<&str>,
         source_ip: &str,
+        domain: &str,
     ) -> Result<Response<BoxBody<Bytes, hyper::Error>>, hyper::Error> {
         let backend_key = format!("{}:{}", pool_key.host, pool_key.port);
 
@@ -978,16 +1020,16 @@ impl HttpProxyService {
         let backend = if pool_key.use_tls {
             match tokio::time::timeout(
                 self.connect_timeout,
-                connect_tls_backend(&self.backend_tls_config, &pool_key.host, pool_key.port),
+                connect_tls_backend(&self.backend_tls_config_alpn, &pool_key.host, pool_key.port),
             ).await {
                 Ok(Ok(tls)) => BackendStream::Tls(tls),
                 Ok(Err(e)) => {
-                    error!(backend = %backend_key, error = %e, "H2 retry: TLS connect failed");
+                    error!(backend = %backend_key, domain = %domain, error = %e, "H2 retry: TLS connect failed");
                     self.metrics.backend_connect_error(&backend_key);
                     return Ok(error_response(StatusCode::BAD_GATEWAY, "Backend unavailable on H2 retry"));
                 }
                 Err(_) => {
-                    error!(backend = %backend_key, "H2 retry: TLS connect timeout");
+                    error!(backend = %backend_key, domain = %domain, "H2 retry: TLS connect timeout");
                     self.metrics.backend_connect_error(&backend_key);
                     return Ok(error_response(StatusCode::GATEWAY_TIMEOUT, "Backend timeout on H2 retry"));
                 }
@@ -1002,12 +1044,12 @@ impl HttpProxyService {
                     BackendStream::Plain(s)
                 }
                 Ok(Err(e)) => {
-                    error!(backend = %backend_key, error = %e, "H2 retry: TCP connect failed");
+                    error!(backend = %backend_key, domain = %domain, error = %e, "H2 retry: TCP connect failed");
                     self.metrics.backend_connect_error(&backend_key);
                     return Ok(error_response(StatusCode::BAD_GATEWAY, "Backend unavailable on H2 retry"));
                 }
                 Err(_) => {
-                    error!(backend = %backend_key, "H2 retry: TCP connect timeout");
+                    error!(backend = %backend_key, domain = %domain, "H2 retry: TCP connect timeout");
                     self.metrics.backend_connect_error(&backend_key);
                     return Ok(error_response(StatusCode::GATEWAY_TIMEOUT, "Backend timeout on H2 retry"));
                 }
@@ -1017,16 +1059,30 @@ impl HttpProxyService {
 
         let io = TokioIo::new(backend);
         let exec = hyper_util::rt::TokioExecutor::new();
+        let mut h2_builder = hyper::client::conn::http2::Builder::new(exec);
+        h2_builder
+            .timer(hyper_util::rt::TokioTimer::new())
+            .keep_alive_interval(std::time::Duration::from_secs(10))
+            .keep_alive_timeout(std::time::Duration::from_secs(5))
+            .adaptive_window(true)
+            .initial_stream_window_size(2 * 1024 * 1024);
         let (mut sender, conn): (
             hyper::client::conn::http2::SendRequest<BoxBody<Bytes, hyper::Error>>,
             hyper::client::conn::http2::Connection<TokioIo<BackendStream>, BoxBody<Bytes, hyper::Error>, hyper_util::rt::TokioExecutor>,
-        ) = match hyper::client::conn::http2::handshake(exec, io).await {
-            Ok(h) => h,
-            Err(e) => {
-                error!(backend = %backend_key, error = %e, "H2 retry: handshake failed");
+        ) = match tokio::time::timeout(self.connect_timeout, h2_builder.handshake(io)).await {
+            Ok(Ok(h)) => h,
+            Ok(Err(e)) => {
+                error!(backend = %backend_key, domain = %domain, error = %e, "H2 retry: handshake failed");
                 self.metrics.backend_handshake_error(&backend_key);
+                self.metrics.backend_connection_closed(&backend_key);
                 return Ok(error_response(StatusCode::BAD_GATEWAY, "Backend H2 retry handshake failed"));
             }
+            Err(_) => {
+                error!(backend = %backend_key, domain = %domain, "H2 retry: handshake timeout");
+                self.metrics.backend_handshake_error(&backend_key);
+                self.metrics.backend_connection_closed(&backend_key);
+                return Ok(error_response(StatusCode::GATEWAY_TIMEOUT, "Backend H2 retry handshake timeout"));
+            }
         };
 
         tokio::spawn(async move {
@@ -1035,13 +1091,17 @@ impl HttpProxyService {
             }
         });
 
-        // Register fresh sender in pool for future requests
-        self.connection_pool.register_h2(pool_key.clone(), sender.clone());
-
-        // Build request with empty body
+        // Build request with empty body using absolute URI for H2 pseudo-headers
+        let scheme = if pool_key.use_tls { "https" } else { "http" };
+        let authority = if domain != "-" { domain } else { pool_key.host.as_str() };
+        let h2_uri = format!("{}://{}{}", scheme, authority, upstream_path);
         let mut upstream_req = Request::builder()
             .method(method)
-            .uri(upstream_path);
+            .uri(&h2_uri);
+
+        // Remove Host header for H2 — :authority pseudo-header (from URI) is sufficient
+        let mut upstream_headers = upstream_headers;
+        upstream_headers.remove("host");
 
         if let Some(headers) = upstream_req.headers_mut() {
             *headers = upstream_headers;
@@ -1054,16 +1114,17 @@ impl HttpProxyService {
 
         match sender.send_request(upstream_req).await {
             Ok(resp) => {
+                // Register in pool only after request succeeds
+                self.connection_pool.register_h2(pool_key.clone(), sender);
                 let result = self.build_streaming_response(resp, route, route_id, source_ip).await;
-                // Close the fresh backend connection (opened at line 1016 above)
+                // Close the fresh backend connection (opened above)
                 self.metrics.backend_connection_closed(&backend_key);
                 result
             }
             Err(e) => {
-                error!(backend = %backend_key, error = %e, "H2 retry: request failed");
+                error!(backend = %backend_key, domain = %domain, error = %e, "H2 retry: request failed");
                 self.metrics.backend_request_error(&backend_key);
-                self.connection_pool.remove_h2(pool_key);
-                // Close the fresh backend connection (opened at line 1016 above)
+                // Close the fresh backend connection (opened above)
                 self.metrics.backend_connection_closed(&backend_key);
                 Ok(error_response(StatusCode::BAD_GATEWAY, "Backend H2 request failed on retry"))
             }
@@ -1082,7 +1143,7 @@ impl HttpProxyService {
         io: TokioIo<BackendStream>,
         parts: hyper::http::request::Parts,
         body: Incoming,
-        upstream_headers: hyper::HeaderMap,
+        mut upstream_headers: hyper::HeaderMap,
         upstream_path: &str,
         upstream: &crate::upstream_selector::UpstreamSelection,
         route: &rustproxy_config::RouteConfig,
@@ -1090,15 +1151,62 @@ impl HttpProxyService {
         source_ip: &str,
         pool_key: &crate::connection_pool::PoolKey,
         requested_host: Option<String>,
+        domain: &str,
     ) -> Result<Response<BoxBody<Bytes, hyper::Error>>, hyper::Error> {
         let exec = hyper_util::rt::TokioExecutor::new();
-        let handshake_result: Result<(
-            hyper::client::conn::http2::SendRequest<BoxBody<Bytes, hyper::Error>>,
-            hyper::client::conn::http2::Connection<TokioIo<BackendStream>, BoxBody<Bytes, hyper::Error>, hyper_util::rt::TokioExecutor>,
-        ), hyper::Error> = hyper::client::conn::http2::handshake(exec, io).await;
+        let mut h2_builder = hyper::client::conn::http2::Builder::new(exec);
+        h2_builder
+            .timer(hyper_util::rt::TokioTimer::new())
+            .keep_alive_interval(std::time::Duration::from_secs(10))
+            .keep_alive_timeout(std::time::Duration::from_secs(5))
+            .adaptive_window(true)
+            .initial_stream_window_size(2 * 1024 * 1024);
+        let handshake_result = tokio::time::timeout(
+            self.connect_timeout,
+            h2_builder.handshake(io),
+        ).await;
 
         match handshake_result {
-            Ok((mut sender, conn)) => {
+            Err(_) => {
+                // H2 handshake timed out — fall back to H1
+                let bk = format!("{}:{}", upstream.host, upstream.port);
+                warn!(
+                    backend = %bk,
+                    domain = %domain,
+                    "H2 handshake timeout, falling back to H1"
+                );
+                self.metrics.backend_h2_failure(&bk);
+                self.metrics.backend_handshake_error(&bk);
+
+                let cache_key = crate::protocol_cache::ProtocolCacheKey {
+                    host: upstream.host.clone(),
+                    port: upstream.port,
+                    requested_host: requested_host.clone(),
+                };
+                self.protocol_cache.insert(cache_key, crate::protocol_cache::DetectedProtocol::H1);
+
+                match self.reconnect_backend(upstream, domain).await {
+                    Some(fallback_backend) => {
+                        let h1_pool_key = crate::connection_pool::PoolKey {
+                            host: upstream.host.clone(),
+                            port: upstream.port,
+                            use_tls: upstream.use_tls,
+                            h2: false,
+                        };
+                        let fallback_io = TokioIo::new(fallback_backend);
+                        let result = self.forward_h1(
+                            fallback_io, parts, body, upstream_headers, upstream_path,
+                            upstream, route, route_id, source_ip, &h1_pool_key, domain,
+                        ).await;
+                        self.metrics.backend_connection_closed(&bk);
+                        result
+                    }
+                    None => {
+                        Ok(error_response(StatusCode::BAD_GATEWAY, "Backend unavailable after H2 timeout fallback"))
+                    }
+                }
+            }
+            Ok(Ok((mut sender, conn))) => {
                 tokio::spawn(async move {
                     if let Err(e) = conn.await {
                         debug!("HTTP/2 upstream connection error: {}", e);
@@ -1106,18 +1214,25 @@ impl HttpProxyService {
                 });
 
                 // Save retry state before consuming parts/body (for bodyless requests like GET)
+                // Clone BEFORE removing Host — H1 fallback needs Host header
                 let retry_state = if body.is_end_stream() {
                     Some((parts.method.clone(), upstream_headers.clone()))
                 } else {
                     None
                 };
 
+                // Remove Host header for H2 — :authority pseudo-header (from URI) is sufficient
+                upstream_headers.remove("host");
+
                 // Build and send the h2 request inline (don't register in pool yet —
                 // we need to verify the request actually succeeds first, because some
                 // backends advertise h2 via ALPN but don't speak the h2 binary protocol).
+                let scheme = if upstream.use_tls { "https" } else { "http" };
+                let authority = if domain != "-" { domain } else { upstream.host.as_str() };
+                let h2_uri = format!("{}://{}{}", scheme, authority, upstream_path);
                 let mut upstream_req = Request::builder()
                     .method(parts.method)
-                    .uri(upstream_path);
+                    .uri(&h2_uri);
 
                 if let Some(headers) = upstream_req.headers_mut() {
                     *headers = upstream_headers;
@@ -1145,6 +1260,7 @@ impl HttpProxyService {
                         let bk = format!("{}:{}", upstream.host, upstream.port);
                         warn!(
                             backend = %bk,
+                            domain = %domain,
                             error = %e,
                             "Auto-detect: H2 request failed, falling back to H1"
                         );
@@ -1158,7 +1274,7 @@ impl HttpProxyService {
 
                         // Retry as H1 for bodyless requests; return 502 for requests with bodies
                         if let Some((method, headers)) = retry_state {
-                            match self.reconnect_backend(upstream).await {
+                            match self.reconnect_backend(upstream, domain).await {
                                 Some(fallback_backend) => {
                                     let h1_pool_key = crate::connection_pool::PoolKey {
                                         host: upstream.host.clone(),
@@ -1169,7 +1285,7 @@ impl HttpProxyService {
                                     let fallback_io = TokioIo::new(fallback_backend);
                                     let result = self.forward_h1_empty_body(
                                         fallback_io, method, headers, upstream_path,
-                                        route, route_id, source_ip, &h1_pool_key,
+                                        route, route_id, source_ip, &h1_pool_key, domain,
                                     ).await;
                                     // Close the reconnected backend connection (opened in reconnect_backend)
                                     self.metrics.backend_connection_closed(&bk);
@@ -1185,12 +1301,13 @@ impl HttpProxyService {
                     }
                 }
             }
-            Err(e) => {
+            Ok(Err(e)) => {
                 // H2 handshake truly failed — fall back to H1
                 // Body is NOT consumed yet, so we can retry the full request.
                 let bk = format!("{}:{}", upstream.host, upstream.port);
                 warn!(
                     backend = %bk,
+                    domain = %domain,
                     error = %e,
                     "H2 handshake failed, falling back to H1"
                 );
@@ -1206,7 +1323,7 @@ impl HttpProxyService {
                 self.protocol_cache.insert(cache_key, crate::protocol_cache::DetectedProtocol::H1);
 
                 // Reconnect for H1 (the original io was consumed by the failed h2 handshake)
-                match self.reconnect_backend(upstream).await {
+                match self.reconnect_backend(upstream, domain).await {
                     Some(fallback_backend) => {
                         let h1_pool_key = crate::connection_pool::PoolKey {
                             host: upstream.host.clone(),
@@ -1217,7 +1334,7 @@ impl HttpProxyService {
                         let fallback_io = TokioIo::new(fallback_backend);
                         let result = self.forward_h1(
                             fallback_io, parts, body, upstream_headers, upstream_path,
-                            upstream, route, route_id, source_ip, &h1_pool_key,
+                            upstream, route, route_id, source_ip, &h1_pool_key, domain,
                         ).await;
                         // Close the reconnected backend connection (opened in reconnect_backend)
                         self.metrics.backend_connection_closed(&bk);
@@ -1243,6 +1360,7 @@ impl HttpProxyService {
         route_id: Option<&str>,
         source_ip: &str,
         pool_key: &crate::connection_pool::PoolKey,
+        domain: &str,
     ) -> Result<Response<BoxBody<Bytes, hyper::Error>>, hyper::Error> {
         let backend_key = format!("{}:{}", pool_key.host, pool_key.port);
         let (mut sender, conn): (
@@ -1251,7 +1369,7 @@ impl HttpProxyService {
         ) = match hyper::client::conn::http1::handshake(io).await {
             Ok(h) => h,
             Err(e) => {
-                error!(backend = %backend_key, error = %e, "H1 fallback: handshake failed");
+                error!(backend = %backend_key, domain = %domain, error = %e, "H1 fallback: handshake failed");
                 self.metrics.backend_handshake_error(&backend_key);
                 return Ok(error_response(StatusCode::BAD_GATEWAY, "Backend H1 fallback handshake failed"));
             }
@@ -1280,7 +1398,7 @@ impl HttpProxyService {
         let upstream_response = match sender.send_request(upstream_req).await {
             Ok(resp) => resp,
             Err(e) => {
-                error!(backend = %backend_key, error = %e, "H1 fallback: request failed");
+                error!(backend = %backend_key, domain = %domain, error = %e, "H1 fallback: request failed");
                 self.metrics.backend_request_error(&backend_key);
                 return Ok(error_response(StatusCode::BAD_GATEWAY, "Backend H1 fallback request failed"));
             }
@@ -1296,6 +1414,7 @@ impl HttpProxyService {
     async fn reconnect_backend(
         &self,
         upstream: &crate::upstream_selector::UpstreamSelection,
+        domain: &str,
     ) -> Option<BackendStream> {
         let backend_key = format!("{}:{}", upstream.host, upstream.port);
         let reconnect_start = std::time::Instant::now();
@@ -1309,12 +1428,12 @@ impl HttpProxyService {
                     Some(BackendStream::Tls(tls))
                 }
                 Ok(Err(e)) => {
-                    error!(backend = %backend_key, error = %e, "H1 fallback: TLS reconnect failed");
+                    error!(backend = %backend_key, domain = %domain, error = %e, "H1 fallback: TLS reconnect failed");
                     self.metrics.backend_connect_error(&backend_key);
                     None
                 }
                 Err(_) => {
-                    error!(backend = %backend_key, "H1 fallback: TLS reconnect timeout");
+                    error!(backend = %backend_key, domain = %domain, "H1 fallback: TLS reconnect timeout");
                     self.metrics.backend_connect_error(&backend_key);
                     None
                 }
@@ -1333,12 +1452,12 @@ impl HttpProxyService {
                     Some(BackendStream::Plain(s))
                 }
                 Ok(Err(e)) => {
-                    error!(backend = %backend_key, error = %e, "H1 fallback: TCP reconnect failed");
+                    error!(backend = %backend_key, domain = %domain, error = %e, "H1 fallback: TCP reconnect failed");
                     self.metrics.backend_connect_error(&backend_key);
                     None
                 }
                 Err(_) => {
-                    error!(backend = %backend_key, "H1 fallback: TCP reconnect timeout");
+                    error!(backend = %backend_key, domain = %domain, "H1 fallback: TCP reconnect timeout");
                     self.metrics.backend_connect_error(&backend_key);
                     None
                 }
@@ -1358,10 +1477,23 @@ impl HttpProxyService {
         route_id: Option<&str>,
         source_ip: &str,
         pool_key: Option<&crate::connection_pool::PoolKey>,
+        domain: &str,
     ) -> Result<Response<BoxBody<Bytes, hyper::Error>>, hyper::Error> {
+        // Build absolute URI for H2 pseudo-headers (:scheme, :authority)
+        // Use the requested domain as authority (not backend address) so :authority matches Host header
+        let scheme = if pool_key.map(|pk| pk.use_tls).unwrap_or(false) { "https" } else { "http" };
+        let authority = if domain != "-" { domain } else {
+            pool_key.map(|pk| pk.host.as_str()).unwrap_or("localhost")
+        };
+        let h2_uri = format!("{}://{}{}", scheme, authority, upstream_path);
         let mut upstream_req = Request::builder()
             .method(parts.method)
-            .uri(upstream_path);
+            .uri(&h2_uri);
+
+        // Remove Host header for H2 — :authority pseudo-header (from URI) is sufficient
+        // Having both Host and :authority causes nginx to return 400
+        let mut upstream_headers = upstream_headers;
+        upstream_headers.remove("host");
 
         if let Some(headers) = upstream_req.headers_mut() {
             *headers = upstream_headers;
@@ -1385,11 +1517,11 @@ impl HttpProxyService {
                 // Evict the dead sender so subsequent requests get fresh connections
                 if let Some(key) = pool_key {
                     let bk = format!("{}:{}", key.host, key.port);
-                    error!(backend = %bk, error = %e, "Backend H2 request failed");
+                    error!(backend = %bk, domain = %domain, error = %e, "Backend H2 request failed");
                     self.metrics.backend_request_error(&bk);
                     self.connection_pool.remove_h2(key);
                 } else {
-                    error!(error = %e, "Backend H2 request failed");
+                    error!(domain = %domain, error = %e, "Backend H2 request failed");
                 }
                 return Ok(error_response(StatusCode::BAD_GATEWAY, "Backend H2 request failed"));
             }
@@ -1435,7 +1567,7 @@ impl HttpProxyService {
         Ok(response.body(body).unwrap())
     }
 
-    /// Handle a WebSocket upgrade request.
+    /// Handle a WebSocket upgrade request (H1 Upgrade or H2 Extended CONNECT per RFC 8441).
     async fn handle_websocket_upgrade(
         &self,
         req: Request<Incoming>,
@@ -1446,6 +1578,7 @@ impl HttpProxyService {
         upstream_key: &str,
         cancel: CancellationToken,
         source_ip: &str,
+        is_h2: bool,
     ) -> Result<Response<BoxBody<Bytes, hyper::Error>>, hyper::Error> {
         use tokio::io::{AsyncReadExt, AsyncWriteExt};
 
@@ -1531,9 +1664,11 @@ impl HttpProxyService {
 
         let (parts, _body) = req.into_parts();
 
+        // H2 Extended CONNECT uses method=CONNECT, but the H1.1 backend expects GET
+        let backend_method = if is_h2 { "GET" } else { parts.method.as_str() };
         let mut raw_request = format!(
             "{} {} HTTP/1.1\r\n",
-            parts.method, upstream_path
+            backend_method, upstream_path
         );
 
         // Copy all original headers (preserving the client's Host header).
@@ -1561,6 +1696,23 @@ impl HttpProxyService {
             }
         }
 
+        // H2 Extended CONNECT doesn't carry H1 WebSocket handshake headers;
+        // inject them so the H1.1 backend can complete the upgrade.
+        if is_h2 {
+            if !parts.headers.contains_key("upgrade") {
+                raw_request.push_str("upgrade: websocket\r\n");
+            }
+            if !parts.headers.contains_key("connection") {
+                raw_request.push_str("connection: Upgrade\r\n");
+            }
+            if !parts.headers.contains_key("sec-websocket-version") {
+                raw_request.push_str("sec-websocket-version: 13\r\n");
+            }
+            if !parts.headers.contains_key("sec-websocket-key") {
+                raw_request.push_str("sec-websocket-key: dGhlIHNhbXBsZSBub25jZQ==\r\n");
+            }
+        }
+
         // Add standard reverse-proxy headers (X-Forwarded-*)
         {
             let original_host = parts.headers.get("host")
@@ -1663,8 +1815,12 @@ impl HttpProxyService {
             ));
         }
 
-        let mut client_resp = Response::builder()
-            .status(StatusCode::SWITCHING_PROTOCOLS);
+        // H1: 101 Switching Protocols; H2: 200 OK (RFC 8441 — hyper requires 2xx for Extended CONNECT upgrade)
+        let mut client_resp = if is_h2 {
+            Response::builder().status(StatusCode::OK)
+        } else {
+            Response::builder().status(StatusCode::SWITCHING_PROTOCOLS)
+        };
 
         if let Some(resp_headers) = client_resp.headers_mut() {
             for line in response_str.lines().skip(1) {
@@ -1675,6 +1831,17 @@ impl HttpProxyService {
                 if let Some((name, value)) = line.split_once(':') {
                     let name = name.trim();
                     let value = value.trim();
+                    // Skip hop-by-hop headers for H2 (forbidden by RFC 9113 §8.2.2)
+                    if is_h2 {
+                        let name_lower = name.to_lowercase();
+                        if name_lower == "upgrade" || name_lower == "connection"
+                            || name_lower == "sec-websocket-accept"
+                            || name_lower == "transfer-encoding"
+                            || name_lower == "keep-alive"
+                        {
+                            continue;
+                        }
+                    }
                     if let Ok(header_name) = hyper::header::HeaderName::from_bytes(name.as_bytes()) {
                         if let Ok(header_value) = hyper::header::HeaderValue::from_str(value) {
                             resp_headers.insert(header_name, header_value);

ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartproxy',
-  version: '25.10.2',
+  version: '25.11.0',
   description: 'A powerful proxy package with unified route-based configuration for high traffic management. Features include SSL/TLS support, flexible routing patterns, WebSocket handling, advanced security options, and automatic ACME certificate management.'
 }