NetTunnel v4.5.0

Full Changelog: https://github.com/NTDLS/NetTunnel/compare/4.4.3...4.5.0

New 🎉

• HTTPS support (TLS termination). An inbound endpoint can now terminate HTTPS using a PFX certificate (path and password on the new TLS tab). Outbound endpoints can re-encrypt to an HTTPS destination, optionally ignoring the destination's certificate errors.
• HTTP header rules now work on HTTPS and on every request on a keep-alive connection. This uses a new HTTP/1.x stream parser that follows Content-Length and chunked bodies, trailers, and upgrades.
• HTTP/2 (optional, per endpoint). A new Offer HTTP/2 to clients option on the TLS tab. Header rules work on HTTP/2 requests and responses. The destination must also support HTTP/2.
• IPv6. Inbound endpoints listen on IPv6 and IPv4 with one listener, outbound endpoints can connect to IPv6 addresses, and the service port accepts IPv6. It is controlled by a new Use IPv6 as well as IPv4 setting on the Management tab, on by default.
• Localization. The UI can be translated, with a language picker in the Settings menu and on the login form.
• Encrypted secrets in the configuration files. Certificate passwords and password hashes are stored encrypted. Plain-text files from older versions are read and re-encrypted automatically.
• New logging. Messages are written on a background thread to a rolling log file (size and kept-files settings), the Windows Application event log, and the console when run interactively. Log settings take effect without a restart.
• Added automatic dark mode.
• Configuration guide (Documents/Configuration.md) covering Raw, HTTP and HTTPS setup, header rules, service settings, security and troubleshooting.

Changes 😎

• Breaking: an endpoint's single traffic type is now two settings, an inbound traffic type and an outbound traffic type. Existing endpoints need them set again. Older files with a single TrafficType are not read.
• Breaking: ConsoleLogger was replaced by a queued logger with separate outputs, and ILogger has a new LogLevel property.
• Exceptions are now logged with their full detail, including stack trace and inner exceptions, and with millisecond timestamps and thread ids.
• Log lines forwarded to the UI no longer hold up the threads that log them.
• TLS handshake failures from browsers (an abandoned connection, or a rejected certificate) are logged as one short Verbose or Warning line instead of an error with a stack trace.
• Rules can now use the PATCH and TRACE verbs.
• Linux builds are self-contained.
• The service port now follows the IPv6 setting.

Fixes 🐛

• Header rules: Insert and Upsert now add a header that isn't there, and Delete removes the whole line.
• Response rules now apply to the right end.
• Rules can no longer corrupt bodies, use the wrong packet sequence, or miss headers on keep-alive connections.
• Saving the service configuration no longer generates a new service id or resets the log settings.
• Fixes from an audit of the tunnel engine:
  • Races in how endpoints and tunnels start and stop.
  • Tunnel and endpoint lists are now read and changed safely.
  • Tunnel connection failures now disconnect cleanly, so the tunnel retries.
  • Connection counts can no longer go below zero.
  • Adding or deleting a user now saves to disk.
  • The remote address is read correctly for display.
• A tooltip on the endpoint dialog (termination port) had the wrong text.