Skip to content

v3.2.0

Choose a tag to compare

View all tags
@32bitx64bit 32bitx64bit released this 12 Sep 08:25
· 7 commits to master since this release
v3.2.0
9f39cb7
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v3.2.0

Upgrade both the server and every agent together. 3.1.x peers cannot complete the new identity handshake or authenticated UDP register path.

New Features

  • Multiple agents on one server
    • Each agent keeps a persistent Ed25519 identity (trust-on-first-use on the server)
    • Routes, domains, and the mail service are owned/addressed per agent
    • Dashboard shows agent IDs and lets you assign a route’s owning agent
    • Server APIs to rename, forget, and toggle domain/email per agent
  • Stronger tunnel crypto and UDP data plane
    • Mutual challenge-response auth, then per-session AES-GCM keys
    • UDP registers are identity-bound, replay-protected, and source-filtered
    • Encrypted UDP uses per-session keys, counter nonces, AAD, and a replay window
  • GET /api/v1/server / SDK ServerInfo() for the tunnel server’s public IP or hostname
    • Set PublicAddr in server.json (no port); otherwise the agent uses the configured server host
  • Windows auto-updater (experimental Windows client was already in 3.1.x)
    • Update zips are verified with Ed25519 signatures
  • Shared dashboard UI (agent + server) with a dark/light theme

Changes

  • Encrypted routes require aes-256. Legacy aes-128 configs still derive a 256-bit key so old peers can talk, but new config must be aes-256 or none
  • UDP is send-and-forget: datagrams are written immediately. Congestion shows up as loss, not queue delay
  • Agent /api/v1/events is Server-Sent Events, not WebSocket
  • Agent POST/PATCH APIs require Content-Type: application/json (blocks browser CSRF; the Go SDK already sends this)
  • Agent dashboard only accepts localhost Host headers (DNS-rebinding protection)
  • Agents refuse to tunnel to public, link-local, or multicast local_host values
  • Protocol compatibility is major-version only. This release’s wire protocol is 3.0.0; mixed 3.1.x / 3.2.0 still will not connect
  • SDK mail helpers are grouped under MailClient (client.Mail()); the old Client methods still work
  • Dashboard traffic history is capped (about 1 hour / 50 route events) so the stats page stays lighter

Bug fixes

  • Fixed rare TCP hangs / dead-peer stalls (idle-timeout half-close and Linux TCP_USER_TIMEOUT)
  • Fixed domain-gateway 502s in the browser when a backend attach raced the pair timeout
  • Cleared leftover write deadlines on keep-alive domain connections
  • Signed auto-update zips are rejected if the signature does not verify

This is a MINOR release, but the wire handshake is not compatible with 3.1.1. Backup configs, then upgrade the server and all agents at the same time.

Upgrading is recommended.

Assets 5
Loading