Hotfix 04

Issues resolved

This hotfix resolves the following issues:

• Significant latency occurred in certain DNS queries, including potential dropped requests.
• If the customer had previously joined a domain with an edited hostname using the original SMBAdmin and a rejoin was attempted with the new script, the script assumed the hostname had already been set and skipped a procedure.
• When only TLSv1.3 was enabled (outbound), browsing often failed with an invalid common name error.
• Data Loss Prevention (DLP) incorrectly blocked certain requests under the "Security: Files containing passwords" category, even when the files contained no passwords.
• Fragmentation of TLS Client Hello messages caused issues between the client, proxy, and origin server connections.

New features

DLP scan behavior when web policy blocks a request

This hotfix changes how DLP incidents are marked as Permitted Monitor mode when the web policy has already blocked a transaction.

A new configuration parameter has been added in records.config:

proxy.config.dlp_scanning.bypass_on_blocked_by_web

This parameter controls DLP scan behavior when web policy blocks a request:

• 0: Skip DLP scan when web policy blocks a request.
• 1: Perform DLP scan without the setbypassblock API call. (The DLP block page is displayed if DLP blocks the request.)
• 2: Perform DLP scan with the setbypassblock API call. (The transaction is allowed with Permitted Monitor mode. This is the previous behavior.)

This hotfix upgrades PolicyEngine from version 10.3.0 to 10.4.0.