Netagent Changelog

  • Updated on May 10, 2023
This article describes features that are only available in the Banyan Enterprise edition and Banyan Unlimited edition.
2.6.0 (May-10-2023)
  • Download v2.6.0
  • ICMP admin prohibited packets are returned for rejected traffic.
  • Efficiency improvements in Service Tunnel L4 policy changes.
2.5.1 (Apr-28-2023)
2.5.0 (Apr-12-2023)
2.4.2 (Apr-05-2023)
  • Download v2.4.2
  • [Resolved] FQDNs used in Tunnel-based policies were failing to resolve in some cases.
2.4.1 (Mar-16-2023)
  • Download v2.4.1
  • [Resolved] Domain-based policies weren’t working as expected when FQDNs’ IP addresses were changed.
2.4.0 (Mar-08-2023)
  • Support for new Domain-based Tunnel Policies.
  • Performance and stability improvements.
2.3.0 (Feb-08-2023)
  • Download v2.3.0
  • [Resolved] When using intermediate CA certificates, the CA certificate format was incorrectly written, causing the Netagent to fail on start.
  • [Resolved] WireGuard kernel module, required for running kernel version in Amazon Linux 2, was missing.
  • Browser-based Error messages have been updated.
2.2.0 (Jan-11-2023)
  • Download v2.2.0
  • [Resolved] Private domains (ipv6) were not resolving over Service Tunnel.
2.1.1 (Dec-14-2022)
2.1.0 (Dec-13-2022)
  • Download v2.1.0
  • Service Tunnel for Public Domains
  • Service Tunnel Discovery
2.0.0 (Nov-09-2022)
  • Download v2.0.0
  • Simplified the Access Tier installation process
  • Local configs (i.e., advanced configs) are done via API/UI instead of the config.yaml file
1.49.0 (Oct-13-2022)
  • Download v1.49.0
  • Netagent logs will now report the TLS ciphers and versions for every connection.
  • Access type Event Logs will now report Access Tier name along with its public address for every connection.
1.48.0 (Sept-14-2022)
1.47.0 (Aug-25-2022)
  • Download v1.47.0
  • [Resolved] Netagent was unable to correctly handle websocket connections in case of OIDC exempt requests.
1.46.0 (July-28-2022)
  • Download v1.46.0
  • [Resolved] Websocket connections were not being closed in certain conditions.
  • [Resolved] Netagent logs were not being collected through Netagent Support Bundle.
1.45.1 (July-1-2022)
  • Download v1.45.1
  • [Resolved] Banyan’s Private DNS resolution was case-sensitive; DNS resolution is no longer case-sensitive.
  • [Resolved] Enhanced DNS routing was not resolving correctly for Windows.
1.45.0 (Jun-30-2022)
  • Download v1.45.0
  • [Resolved] Updating the Access Tier tunnel configuration in Banyan’s Cloud Command Center was causing Netagent to bring down the WireGuard (wg) interface.
  • [Resolved] In some scenarios, enhanced DNS routing was not resolving correctly.
1.44.0 (May-12-2022)
  • Download v1.44.0
  • Option to disable Strict-Transport-Security HTTP Response Header within Netagent configuration.
1.43.0 (Mar-24-2022)
  • Download v1.43.0
  • Support for Service Accounts in the Cloud Command Center.
  • Admins can customize the SameSite cookie property of the bnn_trust cookie used by Hosted Websites.
  • [Resolved] Service Tunnel iptables rules were not deleting after the Access Tier was removed from the Service Tunnel.
1.42.2 (Feb-3-2022)
  • Download v1.42.2
  • [Resolved] Service Tunnel issues that were causing select TrustScores to be ignored.
1.42.1 (Feb-3-2022)
  • Download v1.42.1
  • When users were added or removed, Service Tunnel users were experiencing packet loss. This has been resolved.
1.42.0 (Jan-27-2022)
  • Download v1.42.0
  • Admins can now easily define L7 rules within web policies through the Banyan console.
  • Admins can now create network-level (L4) Service Tunnel policies.
1.41.0 (Jan-06-2022)
  • Download v1.41.0
  • [Resolved] Netagent was stripping out invalid HTTP cookies. Now, it forwards invalid cookies.
  • [Resolved] macOS users now receive the correct IP address when they use Service Tunnel.
1.40.0 (Oct-31-2021)
1.39.0 (Sep-30-2021)
  • Download v1.39.0
  • Netagent now returns a connection test response when it receives a request from shield with "*" in the site name.
  • The REST API server now reports for all access-tiers in a cluster.
1.38.0 (Sep-02-2021)
  • Download v1.38.0
  • Restored “Netagent Details” for hosted websites and infrastructure
  • Removed enforcement of “Site Domain Names” configuration parameter
1.37.0 (Jul-07-2021)
  • Download v1.37.0
  • Metrics collection using statsd to send metrics to Datadog via Dogstatsd
  • Use Let’s Encrypt certificates for hosted websites
  • Frontend domain with upper case letters
1.36.1 (May-12-2021)
1.36.0 (Apr-28-2021)
  • Download v1.36.0
  • Various improvements to Access events.
    • User and Device info for TCP service connection-level events.
    • Added reported_by field to display the specific Netagent sending the event.
    • For Access events, the correlation_id identifies the TCP connection.
  • Added Headers field under HTTP Settings in the Service Spec.
1.35.0 (Mar-31-2021)
  • Download v1.35.0
  • Optimized standard config parameters down to only four values and updated defaults for many parameters to simplify common Netagent configurations. The following defaults have changed:
    • Shield Connectivity - secure_bootstrap = true
    • Access Tier - access_tier = true, site_domain_names = "*"
    • OIDC Services - code_flow = true, groups_by_userinfo = true, redirect_to_https = true
  • Miscellaneous Access event improvements.
    • Service Name shows Service ID.
    • HTTP_CONNECT mode now indicates backend address.
    • Increased the time interval for periodic events to 1 hour from 10 minutes.
  • (Bug fix) If a request had two Trust cookies – one that is valid and a second one which is not valid – then depending on the order in which they are getting processed by Netagent, the valid one could end up getting deleted, which would make the user have to re-authenticate. Now, in that scenario the valid cookie will not be deleted.
1.34.1 (Mar-12-2021)
  • Download v1.34.1
  • (Bug fix) Netagent v1.34.0 did not properly handle expired cookies, which caused end users’ browsers to get stuck in an endless redirect loop when attempting to access a web service.
1.34.0 (Mar-03-2021)
1.33.0 (Jan-27-2021)
  • Download v1.33.0
  • (Bug Fix) Valid short-lived certificates that were older than 24 hours were rejected. Now, short-lived certificates can be up to 72-hours old.
1.32.0 (Jan-06-2021)
1.31.0 (Oct-02-2020)
1.30.0 (Oct-28-2020)
  • Download v1.30.0
  • OIDC Services - Added ability to exempt specific Source IPs from Policies
1.29.1 (Oct-01-2020)
  • Download v1.29.1
  • OIDC Services - Add ability for Netagent to query TrustProvider’s userinfo endpoint to obtain a user’s group membership. This is especially useful for organizations where the end users belong to a large number of groups, which increases group information included in the TrustCookie and triggers browser limitations on cookie size.
  • (Bug Fix) OIDC Services - the bnn_return cookie logic used to return the end user to the original path they were attempting to access (for example, /foo) now also supports query parameters (such as, foo?bar=123).
1.28.0 (Aug-26-2020)
  • Download v1.28.0
  • Enriched information collected about a Netagent when generating a one-click support bundle. The bundle now collects additional Netagent configuration files and CIDR ranges as well as common commands support staff needs to better understand the Netagent environment.
  • Ability to create allow list of backends and ports (including CIDR ranges) when configuring services.
  • (Bug Fix) OIDC Services - Previously, when configuring CORS, the target parameter only supported a wildcard (*). Now, the target parameter supports actual domains.
1.27.1 (Jul-30-2020)
  • Download v1.27.1
  • Updated a shared-library dependency involving default values for the allow_user_override metadata tag, which (in some scenarios) reset admin-configurations and led to erroneous blocking of end user access.
1.27.0 (Jul-29-2020)
  • Download v1.27.0
  • Added HTTP_CONNECT mode for Backend routing; when set, Netagent will rely on an HTTP Connect request to derive the backend target address (i.e., ipaddress:port or fqdn:port).
  • (Bug Fix) Successful WebSocket closure statuses were returning incorrectly.
  • (Bug Fix) Netagent Service configurations were not properly updating.
1.25.1 (Jun-19-2020)
  • Download v1.25.1
  • (Bug Fix) Netagent v.1.25.0 introduced a regression for Cognito that passed an OAuth “scope” called “groups”, which Cognito does not support.
1.25.0 (Jun-17-2020)
1.23.0 (May-20-2020)
1.22.0 (May-06-2020)
  • Download v1.22.0
  • Fixed cookie logic for WebSockets and Multi-domain Services so that Banyan TrustCookies are removed from HTTP requests that are forwarded to upstream servers.

The Banyan TrustCookie still can be forwarded by setting the forward_trust_cookie parameter to true. Banyan TrustCookie removal is performed both with and without the domain parameter to avoid a browser redirect loop scenario.

1.21.1 (Apr-22-2020)
  • Download v1.21.1
  • Added a configuration option redirect_to_https to redirect traffic from Port 80 (HTTP) to Port 443 (HTTPS).
  • Added a configuration option https_proxy to use an HTTP Connect Proxy to make outbound connections to Shield and TrustProvider
  • Added a configuration option forward_trust_cookie to not strip out the bnn_trust cookie before sending an HTTP request to the backend application
  • (Bug Fix) OIDC Services - Strip out the bnn_ cookies, that are used in OIDC authentication flows, before sending an HTTP request to the backend application. This enables Netagent to proxy traffic to applications that cannot tolerate additional cookies due to their max-http-header-size parameter.
1.20.0 (Apr-08-2020)
  • Download v1.20.0
  • Service configuration details are now reported from Netagent and displayed in the Banyan Command Center.
  • The service spec has a new exempted_paths field which allows specifying a list of HTTP paths that will be accessible without OpenID Connect authentication.
  • In the Service Spec, the oidc_settings.service_domain_name URL value can include a wildcard (*) in the first component of the domain name. Including the wildcard enables one Banyan service to permit a dynamic, non-fixed set of OpenID Connect redirect URLs. Please note: The OpenID Connect standard does not support wildcard redirect URLs, and so this feature should be used with care.
  • Added a configuration option code_flow for opt-in support for OpenID Connect Authorization Code flow. The default mechanism for OIDC authentication remains OpenID Connect Implicit Code flow.
  • Changed wildcard support in site_domain_names parameter in the config.yaml settings file, used when Netagent is run in Access Tier mode. Now, the wildcard (*) will match any prefix, not just the first component, of the SNI name. Previously, "*.example.com" in the service_domain_names parameter would match SNI “www.example.com” but not “alpha.beta.example.com”; now, it will match both.
1.19.0 (Mar-25-2020)
  • Download v1.19.0
  • (Bug Fix) OIDC Services - Fixed a race condition at the token validation stage that was causing sporadic hanging of connections to applications.
  • (Bug Fix) Fixed issue where Netagent stopped working if the underlying host was upgraded.
1.18.0 (Mar-12-2020)
  • Download v1.18.0
  • Performance and stability improvements.
  • Disconnect existing TCP connections (SSH, RDP, etc.) automatically if the device’s TrustScore drops below the level specified in the Policy condition.
1.17.0 (Feb-26-2020)
  • Download v1.17.0
  • Added name_delimiter field to backend target in Service spec
  • Performance and stability improvements
1.16.0 (Feb-12-2020)
  • Download v1.16.0
  • Configuration guardrails - Require site name, site address, or site domain name
  • (Bug Fix) Proxy WebSocket - Passing all headers for WebSocket request
1.15.0 (Jan-29-2020)
1.13.0 (Dec-18-2019)
  • Download v1.13.0
  • (Bug Fix) Workload identification - Improved handling when process or parent process has exited
  • (Bug Fix) Workload identification - Client cert issued to Unidentified container even if it has no roles
  • (Bug Fix) OIDC Services - robust deep-linking
1.11.1 (Nov-25-2019)
  • Download v1.11.1
  • Support for Services with mixed (user and workload) client types
  • OIDC Services - Trust cookie is a session cookie (auto-removed on browser shutdown)
  • (Bug Fix) OIDC Services - Obey Source IP Exceptions as long as Service is non-SNI
  • (Bug Fix) Workload Roles - Affix Roles even if workload is “Unidentified”
1.9.0 (Oct-23-2019)
  • Download v1.9.0
  • Inactivity & max session timeouts
  • “BadActor” module for DoS prevention
  • Connection IDs in events & log files for easier troubleshooting
  • OIDC Services - deep-linking, HTTP Strict Transport Security (HSTS)
1.7.0 (Sep-25-2019)
  • Download v1.7.0
  • Support for proxying Websocket
  • Send complete cert chain on TLS handshake
  • Uninstall script
1.5.0 (Jul-19-2019)
0.7.1 (Feb-04-2019)
  • Download v0.7.1
  • Service definition via Web Console
  • CIDRs automatically installed from Service definition
  • OIDC workflows
  • HTTP authorization policies
0.6.13 (Sep-10-2018)

Can’t find what you’re looking for?

We’re happy to help. Contact our team .