X-Git-Url: https://ruderich.org/simon/gitweb/?p=tlsproxy%2Ftlsproxy.git;a=blobdiff_plain;f=NEWS;h=3078a208bb2529cb4f210d879438d26a40d5ffad;hp=c865bc6a39313ba14c3b57ff49420b6c9f5e8119;hb=HEAD;hpb=bd9cf8a34561bc99951494fe2c6a8f052df413e5

diff --git a/NEWS b/NEWS
index c865bc6..3078a20 100644
--- a/NEWS
+++ b/NEWS
@@ -3,20 +3,41 @@ NEWS
 
 0.X
 ---
+
+- Important: The file proxy-dh.pem is now required. tlsproxy-setup creates it,
+  but running it will overwrite the existing proxy-*.pem files (which will
+  invalidate all certificate-*-proxy.pem files). To create only proxy-dh.pem
+  use:
+
+    certtool --generate-dh-params --sec-param high --outfile proxy-dh.pem
+
+- Use "SECURE" (replacing "NORMAL") as GnuTLS priority string which disallows
+  insecure algorithms.
 - Add -a option, authentication for tlsproxy via basic digest authentication.
+- Add new debug level (-d 3) for even more debug output, including information
+  about the current TLS session.
+- Allow rehandshakes for server connections (%SAFE_RENEGOTIATION is forced to
+  prevent security issues).
+- Use pre-generated Diffie-Hellman parameters in proxy-dh.pem.
 - Code cleanup.
 - Better error handling.
 - Fix compile with recent GnuTLS (e.g. 3.2.3).
 - Improve (error) logging; log to stderr.
+- Add (basic) man pages.
 - Improve test suite.
-- tlsproxy-setup: Increase expiry-date and use larger private key.
+- tlsproxy-setup: Increase expiry-date and use larger private key, generate
+                  proxy-dh.pem.
+
 
 0.2
 ---
+
 - Add -u option, passthrough TLS connections to unknown hostnames.
 - Add ./configure --disable-ipv6 for IPv4 only machines.
 - Send HTML with error messages (not only headers).
 
+
 0.1
 ---
+
 - First release.