OpenWAF Egress 0.2.1

OpenWAF Egress 0.2.0 and 0.2.1 are out (ghcr.io/openwaf-dev/egress:0.2.1, linux/amd64 and linux/arm64). The static config.json mode is unchanged; what is new:

• OpenWAF Cloud data-plane mode. With -control-plane, -node-id and -node-key the gateway takes agents, targets and policies from OpenWAF Cloud and reports every refused request. egress keygen creates the node key.
• token_sha256 in an agent instead of token, so the configuration file holds no token; tokens are compared in constant time.
• SSRF: the address actually dialed is checked too, and ssrf_blocked and upstream_error answers no longer carry addresses or connection errors (they are logged).
• -trusted-proxies: behind a reverse proxy, its X-Real-IP is the caller address of block events.
• /health reports the build version instead of a fixed 0.1.0.

See the configuration reference and the release notes (external link).