## Version history

### 2.1.0

This version introduces support for post-quantum (PQC) algorithms in TLS 1.3.

- Added post-quantum hybrid ECDHE-MLKEM key agreements to TLS 1.3: X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024.
- Added post-quantum ML-DSA signature schemes to TLS 1.3: mldsa44, mldsa65, mldsa87.
- Added support for ML-DSA certificates in TLS 1.3.
- Added support for ML-DSA curves into `certgen` command.
- Added support for OCSP stapling to outbound tunnels.
- Updated predefined cipher suite groups in TLS 1.2 to match modern security standards. Run `tlsproxy tlsinfo` to see current assignments.
- Using Rebex Jumble Obfuscator.
- Improved logging.
- Upgraded internal TLS library. Main changes:
  - Hardened TLS 1.2 state machine.
  - Improved TLS 1.3 closure.
  - Improved CNG keys handling.
  - Performance improvements in modular Diffie-Hellman.

### 2.0.0

This version contains breaking changes in syntax for locating certificates.
Run `tlsproxy.exe certinfo --help` for syntax details and examples.

- Upgraded software framework to `.NET 8.0`.
- Upgraded all third-party libraries (see `license-notices.txt` for complete list).
- Deprecated old syntax to locate certificates (the `certificate` key).
- Changed escaping in quoted text (applies to `certificate` key).
- Deprecated `certificatePath`, `certificateKeyPath` and `certificatePassword` keys (use `certificate` key instead).
- Added support for infinite idle timeout (`--idle-timeout 0`).
- Improved TLS 1.3 connection closure.
- Improved logging.

### 1.11.0

- Added `tlsinfo` command.
- Added `--in-tls-cipher-suites` and `--out-tls-cipher-suites` options (see `tlsinfo` command).
- Improved logging.

### 1.10.0

- Added support for dynamic targets, selected by SNI (`address: "*"`).
- Improved `certgen` command to include CN into SAN by default.
- Improved config serialization.
- Upgraded internal TLS library. Main changes:
  - Improved X.509 certificates parser.
  - Improved errors during TLS negotiation.

### 1.9.1

- Enabled Brainpool curves in TLS 1.3.
- Fixed possible error in HTTP logging.

### 1.9.0

- Enabled FFDHE named groups and Ed25519 certificates in TLS 1.3.
- Enabled Brainpool curves in TLS 1.2.
- Added support for ECDSA with Brainpool curves and EDDSA with Ed25519 curve into `certgen` command.
- Improved logging: tunnel duration is logged in access log, and more.
- Upgraded internal TLS library. Main changes:
  - Fixed signature scheme selection and curve selection in TLS 1.3.
  - Fixed rare wrong final calculation of Poly1305 hash when temporary storage for remaining data is bigger than input block size.
  - Fixed potential repeated clean-up of TLS 1.3 extensions that might cause strange exceptions in the following TLS connection.

### 1.8.1

- When running in interactive mode (`tlsproxy.exe run`) the proxy is stopped when input stream is closed. This is useful when starting the proxy remotely using SSH command in the background, for example like this: `ssh user@host "tlsproxy run" > tlsproxy.log &`
- Improved certificate loading and hot reloading (proxy ensures that the certificate is usable before using it for TLS handshake).
- Improved logging.

### 1.8.0

Using new syntax to locate certificates. Run `tlsproxy.exe certinfo --help` for syntax details and examples.

- Deprecating old syntax of the `certificate` key. If a certificate cannot be located using new syntax a `WARN` is logged and old syntax is used to locate the certificate.
- Deprecating `certificatePath`, `certificateKeyPath` and `certificatePassword` keys. If used a `WARN` is logged.
- Added `certificatesReloadMinutes` config value to enable certificates hot reload (see `config-sample.yaml` for details).
- Added `tlsproxy certinfo` command to display info about certificates (and to validate certificate URI syntax).
- Added `--out-client-certificate` option to support client certificate authentication on outbound tunnels using TLS.
- Improved `SMTPE` handler to support multi-line welcome messages.
- Improved logging.
- Upgraded internal TLS library. Main changes:
  - Fixed possible deadlock.
  - Reduced memory footprint of CNG API interop layer.

### 1.7.0

- Upgraded internal TLS library. Main changes:
  - Fixed memory leak for inbound tunnels using TLS.
  - Fixed TLS cipher suite and TLS curve selection.
  - Disabled client-initiated TLS renegotiation.
  - Enabled `Ed25519` and `ChaCha20/Poly1305` ciphers.
- Added support for client certificates:
  - Added `--http-x-ssl-cert` option to control value of the `X-SSL-CERT` HTTP request header sent on the outbound tunnel.
  - Added `--request-client-certificate` option to request client certificate on inbound tunnels using TLS.
  - Added `--client-certificates-file` option to configure rules for accepting/rejecting connections based on the provided client certificate.
- Improved `tlsproxy certgen` command:
  - Added support for `MD-5` and `SHA-1` signature hashes.
  - The `.key` file is generated as well.
- Proxy is automatically stopped, if no listener could be started.
- Improved HTTP parser: speeded up async core.
- Improved logging.

### 1.6.1

- Added `--http-host-override` option to fully control value of the `Host` HTTP request header sent on the outbound tunnel.

### 1.6.0

- Upgraded internal TLS library.
- Improved HTTP parser: request and response parsers are better synchronized.
- Improved tunnel closure routine: waiting for remote end to close the connection politely.
- Improved logging: common errors moved to Warning level, errors during closure moved to Debug level, and more.

### 1.5.0

- Upgraded software framework to `.NET 6.0`.
- Upgraded internal TLS library.
- Fixed key usage in certificates generated using the `certgen` command: the issued certificate cannot be used as a Certificate Authority to issue other certificates now.
- Added HTTP capability:
  - Added `HTTP` and `HTTPS` protocols to instruct the TLS Proxy to monitor HTTP traffic.
  - Added `--http-x-real-ip` and `--http-x-forwarded-for` options to insert corresponding HTTP headers into the communication.
  - The 'HTTP request' (method line) and 'HTTP response' (status line) are logged into Access log in `Debug` level.
- Added `intermediateCertificates` configuration value to fully control certificate chain construction on the inbound tunnel.
- Added `--certificate-key-path` option as an alternative to `.pfx` files: certificate can now be specified by `.cer` file + `.key` file.
- Added `--sni-override` option to fully control SNI used on the outbound tunnel.
- Added `--debug` option and changed behavior of `--verbose` option: the options determine verbosity of the console logging. File logging verbosity is now determined by the values specified in the `config.yaml` file only (file logging is now unrelated to `--verbose` and `--debug` options).
- Minor improvements in logging: location of the executable and the `config.yaml` file is printed to console upon start, details about loaded certificates is logged upon start, better tunnel error reporting, and more.

### 1.4.0

- Upgraded software framework to `.NET Core 3.1`.
- Upgraded internal TLS library.

### 1.3.0

- Improved tunnel closure routine to use less resources.
- Certificate chain sent to the client during TLS negotiation does not include Root certificate now.
- Changed behavior of `certificate` config value to: Thumbprint or Subject Alternative Name (SAN) or Common Name (CN).

### 1.2.0

- Fixed bug causing infinite loop when a TLS error occurred.
- Fixed bug causing tunnel closure when client attempted to resume TLS 1.3 session on inbound channel.
- Using Rebex components 2020 R2.

### 1.1.0

- Added support for TLS virtual hosting via Server Name Indication extension (SNI).
- Improved configuration file validation.
- Improved logging.

### 1.0.0

- Initial public release.