NetProxy v2.5.0

Full Changelog: https://github.com/NTDLS/NetProxy/compare/2.4.1...2.5.0

New 🎉

• Encrypted management connection. The console and the service now agree on a key (NTDLS.SecureKeyExchange) when they connect, and everything after that, including the login and every setting, is encrypted with NTDLS.Permafrost. The service refuses a login over a connection that is not encrypted.
• TLS for the listener. Choose the HTTPS traffic type and give the proxy a PFX certificate; header rules then apply to HTTPS too. The certificate password is stored encrypted.
• TLS to endpoints. Each endpoint has its own traffic type (Raw, HTTP or HTTPS, starting as the listener’s) and a Validate Certificate option.
• HTTP/2 and gRPC with header rules. Tick Allow HTTP/2. It is negotiated on HTTPS listeners, and plain HTTP/2 (h2c) clients are detected on HTTP listeners. HTTP/1.1 clients keep working.
• Connection limits and idle timeouts. Each proxy can limit its total connections and the connections per client address, and close connections that carry no data. The default of 0 means no limit.
• IPv6. Listen on IPv4, IPv6 or both, bind to IPv6 addresses, and use IPv6 addresses or host names as endpoints. The management port can listen on IPv6 too.
• Localization. The console is translated, with Settings > Language... and a Language button on the connect window.
• Dark mode. The console follows the Windows light/dark setting.
• A new home-page chart. It shows sent, received and connections over time, for all proxies or the selected one, plus a status bar with totals.
• Logging. The service has a rolling log file with a size limit and retained count, writes warnings and exceptions to the Windows event log, and logs to the console when run by hand. All of it is configured in Server Settings.
• Linux builds. The service is published self-contained for x64 and arm64 as zips, with a systemd install guide.
• Tool tips on every input and grid column, and a new application icon.

Changes 😎

• The HTTP/1.x header handling was rewritten as a streaming parser, and HTTP header rules now also apply to PATCH and TRACE.
• User and certificate passwords in the configuration files are encrypted with a key kept beside them (secret.key). Older plain-text files are converted on first load.
• Load balancing was reworked. Balanced picks the endpoint with the fewest connections, fail-over and round-robin skip endpoints that are down, and an endpoint that fails is tried last for a short while.
• The accept backlog setting is now applied (values below 128 are raised to 128), and buffer sizes are validated.
• The console connects once, encrypted, and ChangeConnection() receives that live connection. The connect window no longer connects twice.
• The console and the service must now be the same version.

Fixes 🐛

• Fixed several connection-handling bugs in the proxy engine, including a balancer that could retry a dead endpoint forever, a listener that stopped accepting after a failed accept, and connections that were not always released.
• A client that finishes its request now still receives the whole response (half-close is passed on).
• Sticky sessions now expire correctly and fall back to another endpoint when theirs is down.
• Passwords are compared in constant time, and failed logins are slowed down.
• A proxy that cannot start (for example, its port is in use) now tells the console why.
• Deselecting a proxy in the list (Escape, a click on empty space or Ctrl+click) returns the chart to all proxies.