Px v0.9.0

[genotrance]

Version 0.9.0 has finally been published after almost a year of development. It felt like forever but everyone can finally enjoy the fruit of the efforts.

The primary goal was to implement all feature requests and bug fixes but as part of the test journey, --auth=NONE chaining was added which allowed testing Px on OSX without direct access to an NTLM proxy. Finally, client authentication was added to allow testing Px without having to depend on a separate NTLM proxy altogether. These two features greatly improved the robustness and feature set but took a long time to get right and time will tell if they were worth it.

Here are the new features added in this version:

• Client authentication is now supported with NEGOTIATE, NTLM, DIGEST and BASIC auth methods and SSPI when available. This allows Px to serve as an authenticating proxy for smaller organizations
  • Feature Request: Add Basic Auth to protect px itself #117
• Px can now listen on multiple network interfaces instead of having to use gateway or hostonly along with allow rules, greatly improving security
  • Allow for multiple listen interfaces #195
• Configuration can now be set from environment variables and dotenv files, which can make life easier in many different scenarios. This includes setting PX_PASSWORD for scenarios where getting keyring working is non-trivial
• Domains are now supported in the noproxy option which now works in any proxy mode
  • Is there "no proxy" configuration support? #2
  • feat: process noproxy rules even with MODE_CONFIG_PAC #177
• The logging destination can now be chosen, either to the working directory or to the Px directory
  • Logging Directory <> Working Directory #189
• The new --auth=NONE option defers all authentication to the client, effectively making Px a dumb proxy that can be chained across hosts to access an upstream proxy that is not directly connected
• Improved --quit to communicate with running instances instead of killing python processes
• The --restart flag is now available to quit the current instance and start a new one
  • Is there a way to restart the proxy (Windows)? #185
• The configuration can now be tested with the --test flag to verify functionality
• Px now supports Python 3.11 and 3.12 and the Windows binary is built with embeddable Python to avoid being flagged by virus scanners
  • px.exe 18 security vendors and no sandboxes flagged this file as malicious #182
  • libcrypto-1_1.dll version 1.1.1q with vulnerabilites #197

There are also multiple modifications and bug fixes:

• Removed the support for Python 2.7 and the dependency on keyring_jeepney, which is deprecated, with improved documentation for using third party keyring backends
  • keyring_jeepney broken #187
  • Support for keyrings.cryptfile #188
• The order of how configuration loads has changed, giving priority to the CLI flags, environment variables, then px.ini in the working directory, and finally the Px directory
• Fixed multiple open issues
  • [WinError10053] An established connection was aborted by the software in your host machine #152
  • Support for macOS Ventura 13.4? #183
  • Spaces in PAC proxy list cause blank proxies to be added #184
  • HTTP POST and PUT not working since data rewind is not supported #199
  • Unclear listen setting #200

At this point, it is unclear what comes next but any near term releases will focus on resolving issues found by the community. I'm sure there will be some given the magnitude of changes since v0.8.4.

[genotrance]

v0.9.1 was just posted with a few bug fixes:

• Issue with logging not working when set from px.ini
  • px 0.9.0 - Windows: logging configuration inside px.ini file is ignored and no logging is produced #204
• Issue with quickjs crashing in PAC mode with multiple threads
  • px 0.8.4: PAC configuration seems to cause unstable behaviour #198
  • Thread safety of quickjs #206
• Documented how to install binary version of Px on Windows without running in a console window
  • px 0.9.0 - Windows: does not start as a background service anymore (openes a required console window) #203
• Fixed issue with environment variables not propagating to all processes in Linux

More exciting is the first release of Docker images for Px. Two images are posted - the default includes keyring and associated dependencies whereas the mini version is smaller but will have to depend on environment variables for credentials.