Revert "v0.3.1: IP-literal destinations -> plain TCP passthrough (always)"

This reverts commit eed64caf87.

Cargo.lock

@@ -365,7 +365,7 @@ checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
 
 [[package]]
 name = "mhrv-rs"
-version = "0.3.1"
+version = "0.3.0"
 dependencies = [
  "base64",
  "bytes",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "mhrv-rs"
-version = "0.3.1"
+version = "0.3.0"
 edition = "2021"
 description = "Rust port of MasterHttpRelayVPN -- DPI bypass via Google Apps Script relay with domain fronting"
 license = "MIT"

src/domain_fronter.rs

@@ -318,15 +318,12 @@ impl DomainFronter {
             Ok(Ok(bytes)) => bytes,
             Ok(Err(e)) => {
                 self.relay_failures.fetch_add(1, Ordering::Relaxed);
-                // Most upstream errors (self-signed certs, unreachable hosts,
+                tracing::error!("Relay failed: {}", e);
-                // non-HTTP endpoints) are normal for misrouted traffic. Log
-                // at warn so they don't spam error channels.
-                tracing::warn!("relay failed: {}", e);
                 return error_response(502, &format!("Relay error: {}", e));
             }
             Err(_) => {
                 self.relay_failures.fetch_add(1, Ordering::Relaxed);
-                tracing::warn!("relay timeout");
+                tracing::error!("Relay timeout");
                 return error_response(504, "Relay timeout");
             }
         };

src/proxy_server.rs

@@ -308,17 +308,7 @@ async fn dispatch_tunnel(
         return do_sni_rewrite_tunnel_from_tcp(sock, &host, port, mitm, rewrite_ctx).await;
     }
 
-    // 2. IP-literal destinations are almost always app-level custom protocols
+    // 2. Peek at the first byte to detect TLS vs plain. Time-bounded — if the
-    //    (xray/VLESS, torrent, SSH, VPN, raw TCP). Browsers never use raw IPs
-    //    in CONNECT. MITMing these would break the app's own TLS/auth, and
-    //    trying to relay opaque bytes through Apps Script always fails.
-    //    Always plain TCP passthrough for IP literals.
-    if is_ip_literal(&host) {
-        plain_tcp_passthrough(sock, &host, port).await;
-        return Ok(());
-    }
-
-    // 3. Peek at the first byte to detect TLS vs plain. Time-bounded — if the
     //    client doesn't send anything within 300ms, assume server-first
     //    protocol (SMTP, POP3, FTP banner) and jump straight to plain TCP.
     let mut peek_buf = [0u8; 8];
@@ -355,13 +345,6 @@ async fn dispatch_tunnel(
     Ok(())
 }
 
-// ---------- IP literal detection ----------
-
-fn is_ip_literal(host: &str) -> bool {
-    let h = host.trim_start_matches('[').trim_end_matches(']');
-    h.parse::<std::net::IpAddr>().is_ok()
-}
-
 // ---------- Plain TCP passthrough ----------
 
 async fn plain_tcp_passthrough(mut sock: TcpStream, host: &str, port: u16) {