Fix: Fixes an issue where the connection drain time was not being honored when a Gateway instance was replaced
Fix: Fixes a stability issue where the Gateway datapath could self-heal when proxied sessions are actively terminated during policy change or Gateway instance replacement
Fix: Fixes an issue where the Gateway could not retrieve the SNI from a TLS Client Hello message causing the Gateway to close the connection with a TCP RST. This is caused by a change made in Chrome in April 2024 to shift to Post-Quantum Cryptography. With this change, the Client Hello is larger than 1415 bytes, which can result in an inability to retrieve the Server Name Indication (SNI), which is used by the proxy to determine what certificate to issue. The fix ensures the proxy can support Client Hello sizes greater than 1415 bytes.
Enhancement: Continued enhancements to the Gateway to accommodate FedRAMP CIS Level-2 hardening
Fix: Fixes and issue where the Gateway will self-heal if an empty FQDN/URL Filtering Profile is assigned to the Policy Rule Set Rule
Fix: Fixes a deny Rule Action issue related to the use of domains as a 6-tuple match. If the first Rule match is a 6-tuple match (includes an assigned FQDN Match Profile) and the Policy Action is set to Deny, the Deny action will be based on the 5-tuple match and will not include the domain for match consideration. This fix ensures that all 6-tuples are considered when evaluating the Rule and its action. If the traffic does not match the Rule based on the 6-tuple match, then it will refine its match to a subsequent Rule and take action based on the matched Rule's configuration.
Fix: Fixes an issue where an Azure Ingress Gateway will get stuck in Health Checking Pending state after a policy update is applied. This issue also includes new Gateway deployments
Fix: Fixes an allow Rule match issue related to the use of domains as a 6-tuple match. If the first Rule match is a 6-tuple match (includes an assigned FQDN Match Profile), the Policy Action is set to Allow and there are no subsequent Rules that are consistent with the 5-tuple match of the first Rule, then all domains will be allowed and domains will be denied. This fix ensures that only the domains that are matched in the Rule will be allowed and all other domains will be denied.
Fix: Fixes an issue where a Egress Policy Rule Set that uses an decryption-based Forward Proxy (TLS, HTTPS, WebsocketS) is initially matching on 5-tuple and retrieving the domain from the SNI, but not performing a match refinement based on the 6th tuple resulting in a TLS error. The fix ensures that 6-tuple match refinement occurs such that the traffic can be successfully processed by the proper decryption Rule.
Fix: Fixes an issue where sessions with TLS negotiation errors where not recording the SNI as a Traffic Summary -> Event
Fix: Fixes an issue where multiple SNI events were being recorded for each Forward Proxy full decrypted session
Fix: Fixes an issue where the Address Group size could be exceeded, causing all IPs/CIDRs in excess of the size to not be included in the Address Group. The Address Group size has been increased to 20k IPs/CIDRs.
Fix: Adds a System Log message if the GeoIP limitations of the Gateway are exceeded
Fix: Fixes an issue where the wrong action would be taken for URL Filtering Category matching if a timeout occurs when attempting to retrieve the URL Filtering Category if the URL is not found in the cache
Fix: Ensures that an user with administrator access to configure a URL Filtering Profile cannot use the custom URL response to inject Javascript. The fix enforces HTML encoding in the custom URL response.
Enhancement: Adds support for inspecting content within a GRE tunnel that passes through the Gateway. The Gateway will decapsulate the traffic, perform inspection on the encapsulated traffic to apply proper policy and protection, then re-encapsulate that traffic back into the GRE tunnel.
Enhancement: Adds support for active connection resets during Gateway upgrade, scale-in and connection timeout scenarios. When these scenarios occur and the Gateway is processing long running connections that are not closed by the client or server, the Gateway will take action by sending a TCP RST to active close the connection when reaping the old instance or a connection timeout is exceeded.
Enhancement: Support ability to specify a custom banner when logging into a Gateway instance through Teleport (SSH access). This is a requirement for Gateways deployed into FedRamp environments where any method of SSH access requires a customer-defined banner to be displayed.
Fix: Fixes an issue where specifying an Validate Certificate action other than "Default" in a Decryption Profile will cause the Gateway to become unhealthy
Fix: Fixes an issue for user-generate diagnostic bundles where the Gateway would fail to generate the diagnostic bundle and send to the Controller
Fix: Fixes an issue related to the use of GeoIP. Countries with many providers have a very large number of advertised prefixes. When those country codes are used in a GeoIP Address Group, the Address Group will contain a large number of CIDR blocks. The GeoIP Address Group was restricted to 64k CIDRs where exceeding this limit would result in a partial set of CIDRs applied to the policy. This fix relaxes the limit to ensure the full set of CIDRs will be applied to the policy. It is recommended to use an 8-core instance type due to the additional memory requirements imposed by GeoIP.
Fix: Fixes an issue where the Gateway could issue the wrong certificate when a Chrome browser is connecting to the Gateway using TLS 1.3. This is caused by a change made in Chrome in April 2024 to shift to Post-Quantum Cryptography. With this change, the Client Hello is larger than 1415 bytes, which can result in an inability to retrieve the Server Name Indication (SNI), which is used by the proxy to determine what certificate to issue. The fix ensures the proxy can support Client Hello sizes greater than 1415 bytes.
Fix: Fixes an issue where the Gateway was producing the correct statistics for display in the Investigate -> Network Analytics -> Stats page
Fix: Fixes various stability issues
Fix: Fixes an issue related to blue/green policy change. When the policy change occurs and the new datapath becomes active, the Gateway begins draining current sessions off the old datapath. If the datapath cannot properly drain the sessions, it treats the datapath as unhealthy and will employ a datapath restart. This will terminate both old and new datapaths, which could cause disruption to old and new sessions. The fix ensures that the session draining completes properly and eliminates the situation where the datapath is seen as unhealthy.
Fix: Fixes an issue where a VPN tunnel state transition was not generating a System Log message to provide troubleshooting and debugging information on the tunnel setup and negotiation
Fix: Fixes a slow memory leak for an Ingress Gateway that eventually results in a datapath self heal. The memory leak is related to traffic that contains files that are gzip compressed.
Fix: Fixes an issue where an Ingress Gateway could drop a connection when back-to-back POST commands contain a payload greater than 160k