<!DOCTYPE html>
<html lang="en">
    <head>
        <meta charset="utf-8" />
        <meta name="viewport" content="width=device-width, initial-scale=1.0">
        <title>Rebex TLS Proxy - Changelog - Rebex.NET</title>
    </head>
    <body>

        <h2>Version history</h2>

        <h3>2.1.0</h3>
        <div>
            This version introduces support for post-quantum (PQC) algorithms in TLS 1.3.
        </div>
        <ul>
            <li>Added post-quantum hybrid ECDHE-MLKEM key agreements to TLS 1.3: X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024.</li>
            <li>Added post-quantum ML-DSA signature schemes to TLS 1.3: mldsa44, mldsa65, mldsa87.</li>
            <li>Added support for ML-DSA certificates in TLS 1.3.</li>
            <li>Added support for ML-DSA curves into <code>certgen</code> command.</li>
            <li>Added support for OCSP stapling to outbound tunnels.</li>
            <li>Updated predefined cipher suite groups in TLS 1.2 to match modern security standards. Run <code>tlsproxy tlsinfo</code> to see current assignments.</li>
            <li>Using <a href="https://www.rebex.net/jumble/">Rebex Jumble Obfuscator</a>.</li>
            <li>Improved logging.</li>
            <li>
                Upgraded internal <a href="https://www.rebex.net/tls/history.aspx#8.0.9673">TLS library</a>.
                <b>Main changes:</b>
                <ul>
                    <li>Hardened TLS 1.2 state machine.</li>
                    <li>Improved TLS 1.3 closure.</li>
                    <li>Improved CNG keys handling.</li>
                    <li>Performance improvements in modular Diffie-Hellman.</li>
                </ul>
            </li>
        </ul>

        <h3>2.0.0</h3>
        <div>
            This version contains <strong>breaking changes</strong> in syntax for locating certificates.<br />
            Run <code>tlsproxy.exe certinfo --help</code> for syntax details and examples.
        </div>
        <ul>
            <li>Upgraded software framework to <code>.NET 8.0</code>.</li>
            <li>Upgraded all third-party libraries (see <code>license-notices.txt</code> for complete list).</li>
            <li><strong>Deprecated</strong> old syntax to locate certificates (the <code>certificate</code> key).</li>
            <li><strong>Changed</strong> escaping in quoted text (applies to <code>certificate</code> key).</li>
            <li>
                <strong>Deprecated</strong> <code>certificatePath</code>, <code>certificateKeyPath</code> and <code>certificatePassword</code> keys
                (use <code>certificate</code> key instead).
            </li>
            <li>Added support for infinite idle timeout (<code>--idle-timeout 0</code>).</li>
            <li>Improved TLS 1.3 connection closure.</li>
            <li>Improved logging.</li>
        </ul>

        <h3>1.11.0</h3>
        <ul>
            <li>Added <code>tlsinfo</code> command.</li>
            <li>Added <code>--in-tls-cipher-suites</code> and <code>--out-tls-cipher-suites</code> options (see <code>tlsinfo</code> command).</li>
            <li>Improved logging.</li>
        </ul>

        <h3>1.10.0</h3>
        <ul>
            <li>Added support for dynamic targets, selected by SNI (<code>address: "*"</code>).</li>
            <li>Improved <code>certgen</code> command to include CN into SAN by default.</li>
            <li>Improved config serialization.</li>
            <li>
                Upgraded internal <a href="https://www.rebex.net/tls/history.aspx#7.0.9147">TLS library</a>.
                <b>Main changes:</b>
                <ul>
                    <li>Improved X.509 certificates parser.</li>
                    <li>Improved errors during TLS negotiation.</li>
                </ul>
            </li>
        </ul>

        <h3>1.9.1</h3>
        <ul>
            <li>Enabled Brainpool curves in TLS 1.3.</li>
            <li>Fixed possible error in HTTP logging.</li>
        </ul>

        <h3>1.9.0</h3>
        <ul>
            <li>Enabled FFDHE named groups and Ed25519 certificates in TLS 1.3.</li>
            <li>Enabled Brainpool curves in TLS 1.2.</li>
            <li>Added support for ECDSA with Brainpool curves and EDDSA with Ed25519 curve into <code>certgen</code> command.</li>
            <li>Improved logging: tunnel duration is logged in access log, and more.</li>
            <li>
                Upgraded internal <a href="https://www.rebex.net/tls/history.aspx#7.0.8943">TLS library</a>.
                <b>Main changes:</b>
                <ul>
                    <li>Fixed signature scheme selection and curve selection in TLS 1.3.</li>
                    <li>Fixed rare wrong final calculation of Poly1305 hash when temporary storage for remaining data is bigger than input block size.</li>
                    <li>Fixed potential repeated clean-up of TLS 1.3 extensions that might cause strange exceptions in the following TLS connection.</li>
                </ul>
            </li>
        </ul>

        <h3>1.8.1</h3>
        <ul>
            <li>
                When running in interactive mode (<code>tlsproxy.exe run</code>) the proxy is stopped when input stream is closed.
                This is useful when starting the proxy remotely using SSH command in the background, for example like this: <code style="white-space: nowrap;">ssh user@host "tlsproxy run" > tlsproxy.log &amp;</code>
            </li>
            <li>Improved certificate loading and hot reloading (proxy ensures that the certificate is usable before using it for TLS handshake).</li>
            <li>Improved logging.</li>
        </ul>

        <h3>1.8.0</h3>
        <div>
            <strong>Using new syntax to locate certificates.</strong>
            Run <code>tlsproxy.exe certinfo --help</code> for syntax details and examples.
        </div>
        <ul>
            <li>
                <strong>Deprecating</strong> old syntax of the <code>certificate</code> key.
                If a certificate cannot be located using new syntax a <code>WARN</code> is logged and old syntax is used to locate the certificate.
            </li>
            <li>
                <strong>Deprecating</strong> <code>certificatePath</code>, <code>certificateKeyPath</code> and <code>certificatePassword</code> keys.
                If used a <code>WARN</code> is logged.
            </li>
            <li>Added <code>certificatesReloadMinutes</code> config value to enable certificates hot reload (see <code>config-sample.yaml</code> for details).</li>
            <li>Added <code>tlsproxy certinfo</code> command to display info about certificates (and to validate certificate URI syntax).</li>
            <li>Added <code>--out-client-certificate</code> option to support client certificate authentication on outbound tunnels using TLS.</li>
            <li>Improved <code>SMTPE</code> handler to support multi-line welcome messages.</li>
            <li>Improved logging.</li>
            <li>
                Upgraded internal <a href="https://www.rebex.net/tls/history.aspx#7.0.8816">TLS library</a>.
                <b>Main changes:</b>
                <ul>
                    <li>Fixed possible deadlock.</li>
                    <li>Reduced memory footprint of CNG API interop layer.</li>
                </ul>
            </li>
        </ul>

        <h3>1.7.0</h3>
        <ul>
            <li>
                Upgraded internal <a href="https://www.rebex.net/tls/history.aspx#7.0.8657">TLS library</a>.
                <b>Main changes:</b>
                <ul>
                    <li>Fixed memory leak for inbound tunnels using TLS.</li>
                    <li>Fixed TLS cipher suite and TLS curve selection.</li>
                    <li>Disabled client-initiated TLS renegotiation.</li>
                    <li>Enabled <code>Ed25519</code> and <code>ChaCha20/Poly1305</code> ciphers.</li>
                </ul>
            </li>
            <li>
                <b>Added support for client certificates:</b>
                <ul>
                    <li>Added <code>--http-x-ssl-cert</code> option to control value of the <code>X-SSL-CERT</code> HTTP request header sent on the outbound tunnel.</li>
                    <li>Added <code>--request-client-certificate</code> option to request client certificate on inbound tunnels using TLS.</li>
                    <li>Added <code>--client-certificates-file</code> option to configure rules for accepting/rejecting connections based on the provided client certificate.</li>
                </ul>
            </li>
            <li>
                <b>Improved <code>tlsproxy certgen</code> command:</b>
                <ul>
                    <li>Added support for <code>MD-5</code> and <code>SHA-1</code> signature hashes.</li>
                    <li>The <code>.key</code> file is generated as well.</li>
                </ul>
            </li>
            <li>Proxy is automatically stopped, if no listener could be started.</li>
            <li>Improved HTTP parser: speeded up async core.</li>
            <li>Improved logging.</li>
        </ul>

        <h3>1.6.1</h3>
        <ul>
            <li>Added <code>--http-host-override</code> option to fully control value of the <code>Host</code> HTTP request header sent on the outbound tunnel.</li>
        </ul>

        <h3>1.6.0</h3>
        <ul>
            <li>Upgraded internal <a href="https://www.rebex.net/tls/history.aspx#R6.8">TLS library</a>.</li>
            <li>Improved HTTP parser: request and response parsers are better synchronized.</li>
            <li>Improved tunnel closure routine: waiting for remote end to close the connection politely.</li>
            <li>Improved logging: common errors moved to Warning level, errors during closure moved to Debug level, and more.</li>
        </ul>

        <h3>1.5.0</h3>
        <ul>
            <li>Upgraded software framework to <code>.NET 6.0</code>.</li>
            <li>Upgraded internal <a href="https://www.rebex.net/tls/history.aspx#R6.5">TLS library</a>.</li>
            <li>
                Fixed key usage in certificates generated using the <code>certgen</code> command:
                the issued certificate cannot be used as a Certificate Authority to issue other certificates now.
            </li>
            <li>
                <b>Added HTTP capability:</b>
                <ul>
                    <li>Added <code>HTTP</code> and <code>HTTPS</code> protocols to instruct the TLS Proxy to monitor HTTP traffic.</li>
                    <li>Added <code>--http-x-real-ip</code> and <code>--http-x-forwarded-for</code> options to insert corresponding HTTP headers into the communication.</li>
                    <li>The 'HTTP request' (method line) and 'HTTP response' (status line) are logged into Access log in <code>Debug</code> level.</li>
                </ul>
            </li>
            <li>Added <code>intermediateCertificates</code> configuration value to fully control certificate chain construction on the inbound tunnel.</li>
            <li>
                Added <code>--certificate-key-path</code> option as an alternative to <code>.pfx</code> files:
                certificate can now be specified by <code>.cer</code> file + <code>.key</code> file.
            </li>
            <li>Added <code>--sni-override</code> option to fully control SNI used on the outbound tunnel.</li>
            <li>
                Added <code>--debug</code> option and changed behavior of <code>--verbose</code> option: the options determine verbosity of the console logging.
                File logging verbosity is now determined by the values specified in the <code>config.yaml</code> file only
                (file logging is now unrelated to <code>--verbose</code> and <code>--debug</code> options).
            </li>
            <li>
                Minor improvements in logging:
                location of the executable and the <code>config.yaml</code> file is printed to console upon start,
                details about loaded certificates is logged upon start,
                better tunnel error reporting,
                and more.
            </li>
        </ul>

        <h3>1.4.0</h3>
        <ul>
            <li>Upgraded software framework to <code>.NET Core 3.1</code>.</li>
            <li>Upgraded internal <a href="https://www.rebex.net/tls/history.aspx#R5.3">TLS library</a>.</li>
        </ul>

        <h3>1.3.0</h3>
        <ul>
            <li>Improved tunnel closure routine to use less resources.</li>
            <li>Certificate chain sent to the client during TLS negotiation does not include Root certificate now.</li>
            <li>Changed behavior of <code>certificate</code> config value to: Thumbprint or Subject Alternative Name (SAN) or Common Name (CN).</li>
        </ul>

        <h3>1.2.0</h3>
        <ul>
            <li>Fixed bug causing infinite loop when a TLS error occurred.</li>
            <li>Fixed bug causing tunnel closure when client attempted to resume TLS 1.3 session on inbound channel.</li>
            <li>Using Rebex components 2020 R2.</li>
        </ul>

        <h3>1.1.0</h3>
        <ul>
            <li>Added support for TLS virtual hosting via Server Name Indication extension (SNI).</li>
            <li>Improved configuration file validation.</li>
            <li>Improved logging.</li>
        </ul>

        <h3>1.0.0</h3>
        <ul>
            <li>Initial public release.</li>
        </ul>

    </body>
</html>