rosemary1.2.0

Rosemary v1.2.0

• Fixed DNS resolution over pivoted subnets.
• Faster, more reliable DNS resolution through the tunnel.
• DNS servers on new subnets are now detected automatically, no manual setup needed in most cases.
• Improved shutdown handling on BSD and other platforms.

Note: Update both the server and agent to this version together for the DNS fixes to work correctly.

v 1.1.0

This release moves Rosemary outbound agents to QUIC/UDP, keeps encrypted TCP bind mode, updates the PowerShell agent behavior.
Existing WebSocket/smux agents must be replaced with the new agents.

Rosemary v1.0.4

v1.0.4

Change Log

• Connection concurrency throttling per agent and per target endpoint
• Agent listener start confirmation (end-to-end ACK)
• Write and read deadlines on all WebSocket and yamux paths
• WebSocket pong timeout increased from 30s to 90s
• Server-side WebSocket ping handler
• Canceled connection tracking to avoid orphaned dials
• Windows agent: SO_EXCLUSIVEADDRUSE on TCP listeners
• Pre-connection pool disabled and stale pre-conn cleanup on disconnect
• Fixed SOCKS5 tunnel goroutine leak
• Fixed pending UDP session cleanup on agent disconnect
• Yamux frame length validation
• Agent forward open includes client address for logging

Rosemary v1.0.3

Changelog

Fixed

• Agent connection stability improvements

Rosemary v1.0.2

Bug Fix

• Fixed DNS proxy on Linux causing SERVFAIL for domains agents could not resolve

Rosemary v1.0.1

● What's Changed

• Renamed server binary to rosemary, the server can now be installed directly via:

go install github.com/blue0x1/rosemary/rosemary@latest

• Pre-built server binaries in dist/ are now named rosemary-- instead of server--

Rosemary v1.0.0

Rosemary v1.0.0 - First Release

Cross-platform transparent tunneling platform. No TUN. No proxychains.

Core Features

• Transparent TCP/UDP/ICMP/DNS - Kernel-level interception, zero app config
• Auto DNS Resolution - Internal domains just work, no /etc/hosts editing
• Egress Mode - Route isolated server's internet through any agent
• Multi-hop Pivoting - Visual graph, auto route propagation
• Built-in SOCKS5 - Per-agent proxy with optional auth
• Port Forwarding - TCP/UDP, local and reverse
• Web Dashboard - Real-time agent graph, routing table, CLI panel
• REST API - Full control with token auth (read/write/admin)
• Chrome Extension - Per-tab browser routing
• Agent Discovery - Ping sweep, port scan via agent

Supported Platforms

OS	Architectures
Linux	amd64, arm64, arm, 386
Windows	amd64, arm64, 386
macOS	amd64, arm64
FreeBSD	amd64, arm64, arm, 386
OpenBSD	amd64, arm64, arm, 386

Quick Start

# Server (your machine, requires root/admin)
sudo ./server-linux-amd64

# Agent (target machine, no root needed)
./agent-linux-amd64 -s server-ip:1024 -k YOUR_KEY

# Done. Internal network accessible.
curl http://internal.corp.local
ssh user@10.0.0.50

Agent Modes

• Standard - Agent connects outbound to server
• Bind - Agent listens, server connects (NAT traversal)
• Background - Detach from terminal

Key Commands

agents                    List connected agents
routes                    Show routing table
egress <agent-id>         Route all internet through agent
socks <agent-id> <port>   Start SOCKS5 proxy
forward add <port> <agent> <host> <target-port>
discover <agent-id> <subnet>
portscan <agent-id> tcp <target>

Security

• AES-256-GCM encryption for all agent-server traffic
• Challenge-response authentication
• API tokens with granular permissions
• Agents require no root privileges

Installation

Download the appropriate binary for your platform from the releases page.

Documentation

Full documentation available in the GitHub Wiki.

License

GNU General Public License v3.0

---

Built by blue0x1