Rebex TLS Proxy - Changelog

Version history

This version introduces support for post-quantum (PQC) algorithms in TLS 1.3.

Added post-quantum hybrid ECDHE-MLKEM key agreements to TLS 1.3: X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024.
Added post-quantum ML-DSA signature schemes to TLS 1.3: mldsa44, mldsa65, mldsa87.
Added support for ML-DSA certificates in TLS 1.3.
Added support for ML-DSA curves into certgen command.
Added support for OCSP stapling to outbound tunnels.
Updated predefined cipher suite groups in TLS 1.2 to match modern security standards. Run tlsproxy tlsinfo to see current assignments.
Using Rebex Jumble Obfuscator.
Improved logging.
Upgraded internal TLS library. Main changes:
- Hardened TLS 1.2 state machine.
- Improved TLS 1.3 closure.
- Improved CNG keys handling.
- Performance improvements in modular Diffie-Hellman.

This version contains breaking changes in syntax for locating certificates.
Run tlsproxy.exe certinfo --help for syntax details and examples.

Upgraded software framework to .NET 8.0.
Upgraded all third-party libraries (see license-notices.txt for complete list).
Deprecated old syntax to locate certificates (the certificate key).
Changed escaping in quoted text (applies to certificate key).
Deprecated certificatePath, certificateKeyPath and certificatePassword keys (use certificate key instead).
Added support for infinite idle timeout (--idle-timeout 0).
Improved TLS 1.3 connection closure.
Improved logging.

Added tlsinfo command.
Added --in-tls-cipher-suites and --out-tls-cipher-suites options (see tlsinfo command).
Improved logging.

Added support for dynamic targets, selected by SNI (address: "*").
Improved certgen command to include CN into SAN by default.
Improved config serialization.
Upgraded internal TLS library. Main changes:
- Improved X.509 certificates parser.
- Improved errors during TLS negotiation.

Enabled FFDHE named groups and Ed25519 certificates in TLS 1.3.
Enabled Brainpool curves in TLS 1.2.
Added support for ECDSA with Brainpool curves and EDDSA with Ed25519 curve into certgen command.
Improved logging: tunnel duration is logged in access log, and more.
Upgraded internal TLS library. Main changes:
- Fixed signature scheme selection and curve selection in TLS 1.3.
- Fixed rare wrong final calculation of Poly1305 hash when temporary storage for remaining data is bigger than input block size.
- Fixed potential repeated clean-up of TLS 1.3 extensions that might cause strange exceptions in the following TLS connection.

When running in interactive mode (tlsproxy.exe run) the proxy is stopped when input stream is closed. This is useful when starting the proxy remotely using SSH command in the background, for example like this: ssh user@host "tlsproxy run" > tlsproxy.log &
Improved certificate loading and hot reloading (proxy ensures that the certificate is usable before using it for TLS handshake).
Improved logging.

Using new syntax to locate certificates. Run tlsproxy.exe certinfo --help for syntax details and examples.

Deprecating old syntax of the certificate key. If a certificate cannot be located using new syntax a WARN is logged and old syntax is used to locate the certificate.
Deprecating certificatePath, certificateKeyPath and certificatePassword keys. If used a WARN is logged.
Added certificatesReloadMinutes config value to enable certificates hot reload (see config-sample.yaml for details).
Added tlsproxy certinfo command to display info about certificates (and to validate certificate URI syntax).
Added --out-client-certificate option to support client certificate authentication on outbound tunnels using TLS.
Improved SMTPE handler to support multi-line welcome messages.
Improved logging.
Upgraded internal TLS library. Main changes:
- Fixed possible deadlock.
- Reduced memory footprint of CNG API interop layer.

Upgraded internal TLS library. Main changes:
- Fixed memory leak for inbound tunnels using TLS.
- Fixed TLS cipher suite and TLS curve selection.
- Disabled client-initiated TLS renegotiation.
- Enabled Ed25519 and ChaCha20/Poly1305 ciphers.
Added support for client certificates:
- Added --http-x-ssl-cert option to control value of the X-SSL-CERT HTTP request header sent on the outbound tunnel.
- Added --request-client-certificate option to request client certificate on inbound tunnels using TLS.
- Added --client-certificates-file option to configure rules for accepting/rejecting connections based on the provided client certificate.
Improved tlsproxy certgen command:
- Added support for MD-5 and SHA-1 signature hashes.
- The .key file is generated as well.
Proxy is automatically stopped, if no listener could be started.
Improved HTTP parser: speeded up async core.
Improved logging.

Added --http-host-override option to fully control value of the Host HTTP request header sent on the outbound tunnel.

Upgraded internal TLS library.
Improved HTTP parser: request and response parsers are better synchronized.
Improved tunnel closure routine: waiting for remote end to close the connection politely.
Improved logging: common errors moved to Warning level, errors during closure moved to Debug level, and more.

Upgraded software framework to .NET 6.0.
Upgraded internal TLS library.
Fixed key usage in certificates generated using the certgen command: the issued certificate cannot be used as a Certificate Authority to issue other certificates now.
Added HTTP capability:
- Added HTTP and HTTPS protocols to instruct the TLS Proxy to monitor HTTP traffic.
- Added --http-x-real-ip and --http-x-forwarded-for options to insert corresponding HTTP headers into the communication.
- The 'HTTP request' (method line) and 'HTTP response' (status line) are logged into Access log in Debug level.
Added intermediateCertificates configuration value to fully control certificate chain construction on the inbound tunnel.
Added --certificate-key-path option as an alternative to .pfx files: certificate can now be specified by .cer file + .key file.
Added --sni-override option to fully control SNI used on the outbound tunnel.
Added --debug option and changed behavior of --verbose option: the options determine verbosity of the console logging. File logging verbosity is now determined by the values specified in the config.yaml file only (file logging is now unrelated to --verbose and --debug options).
Minor improvements in logging: location of the executable and the config.yaml file is printed to console upon start, details about loaded certificates is logged upon start, better tunnel error reporting, and more.

Improved tunnel closure routine to use less resources.
Certificate chain sent to the client during TLS negotiation does not include Root certificate now.
Changed behavior of certificate config value to: Thumbprint or Subject Alternative Name (SAN) or Common Name (CN).

Fixed bug causing infinite loop when a TLS error occurred.
Fixed bug causing tunnel closure when client attempted to resume TLS 1.3 session on inbound channel.
Using Rebex components 2020 R2.

Added support for TLS virtual hosting via Server Name Indication extension (SNI).
Improved configuration file validation.
Improved logging.