diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md index c3a5b75..3b6a007 100644 --- a/RELEASE_NOTES.md +++ b/RELEASE_NOTES.md @@ -1,90 +1,13 @@ -# LOGAR Release v3.0.0 +# LOGAR Release v3.0.1 -Major architectural release introducing the centralized **Master Licensing Authority** (logar.eibl.tech), Subordinate CA hierarchy, live seat synchronization over mTLS, authenticated Hermes AI Bearer token integrations, and streamlined WebUI dashboard controls. - -### Key Highlights & Changes in v3.0.0: - -- **Enterprise Master Licensing Authority (`LOGAR-LICENSING`)**: - - Implemented standalone hierarchical PKI Authority issuing and signing subordinate CA certificates with custom X.509 OID seat quotas (`1.3.6.1.4.1.59999.1.1`). - - Automated mTLS renewal and synchronization (`renew_ca_cert_mtls`) connecting Hub servers to upstream authority. - - Dedicated multi-tenant licensing dashboard with 2FA TOTP authentication, user RBAC, and WebSocket real-time seat synchronization. - - Dedicated Docker container publishing workflow on release tags and portainer GitOps redeployment webhooks. - -- **Real-Time Active Seat Quota Synchronization**: - - Hub automatically tracks and reports active node seat quotas (`seats_taken`, `active_seats`, `hostname`, `server_fingerprint`) to the upstream authority upon client enrollment, approval, revocation, and removal. - - Non-blocking asynchronous thread dispatch ensures instantaneous client responses while keeping central licensing metrics synchronized. - -- **Hermes AI Integration & Token Authentication**: - - Dedicated `/api/hermes/report` ingestion endpoint delivering verified anomalies within a 12-hour evaluation window. - - Bearer token administration (`/api/hermes/tokens`) with dedicated generation, copying, revocation, and deletion in the Hub WebUI. - -- **Streamlined WebUI Dashboard**: - - Cleaned up top summary KPI cards to focus strictly on operational status and fleet health. - - Centralized full cryptographic inspection (Master Authority URL, Server Hub Fingerprint, CA Fingerprint) into the dedicated *Sub-CA & Licensing* tab. - -- **Standalone CI & Modular Testing**: - - Decoupled LOGAR and LOGAR-LICENSING CI pipelines so each repository tests independently without submodule dependencies. - - 100% test coverage across 35 LOGAR unit tests and 14 Licensing Authority unit tests. - ---- - -# LOGAR Release v2.0.1 - -Maintenance and deployment release consolidating Gitea Actions release automation into a unified single workflow file, standardizing release dispatching across platforms, and bumping version definitions across server hub and Windows installers. - -### Key Highlights & Changes in v2.0.1: - -- **Consolidated Single Release Automation Workflow (`.gitea/workflows/release.yml`)**: - - Unified separate platform release files into a single, cohesive workflow (`release.yml`) running parallel jobs (`release-linux` on `ubuntu-latest` and `release-windows` on `windows-latest`). - - Standardized tag matching for Gitea Actions on `push: tags: ['v*']`. - - Added streamlined manual `workflow_dispatch` triggers with automated release tag defaulting (`v2.0.1`). - - Retired deprecated `release-linux.yml` and `release-windows.yml` files. - -- **Installer & Engine Version Bump**: - - Updated FastAPI Hub engine version to `2.0.1` in `src/Server.py`. - - Bumped Inno Setup Windows Client Installer (`compilation/installer_client.iss`) `AppVersion` to `2.0.1`. - - Bumped Inno Setup Windows Server Installer (`compilation/installer_server.iss`) `AppVersion` to `2.0.1`. - -- **Distribution & Release Documentation**: - - Updated root and distribution documentation across all 5 deployment targets to reflect the 25 passing unit tests and tripartite release options. - ---- - -# LOGAR Release v2.0.0 - -Major architectural release introducing Mutual TLS 1.3 (mTLS) transport security, built-in dynamic PKI & license accounting, in-flight certificate validity monitoring and auto-renewal, and automated Windows and Linux service installers. - -### Key Highlights & Changes in v2.0.0: - -- **mTLS 1.3 Transport Security & Runtime Licensing**: - - Replaced legacy plain TCP sockets with mutual TLS 1.3 authentication (`ssl.CERT_REQUIRED`, TLS 1.3 minimum version). - - Hub dynamically validates incoming client Common Name (`client_id`) against active license seats in SQLite during the TLS handshake. - - Drops unauthorized, un-enrolled, or revoked clients at the transport layer before payload reading. - -- **Dynamic Hub PKI Engine (`src/server_enrollment.py`)**: - - Automatically initializes an internal RSA-4096 Root CA (`ca.crt` / `ca.key`). - - Generates RSA-2048 Server TLS certificates with SANs for localhost, loopback, and server hostnames. - - Full OpenSSL 3.x and Python 3.12–3.14 compatibility via `SubjectKeyIdentifier` and `AuthorityKeyIdentifier` certificate extensions. - - Generates and signs client certificates on demand via `POST /api/client/enroll`. - -- **In-Flight Certificate Validity Watchdog & Dynamic SSLContext Reloading**: - - Server hub runs a continuous background watchdog coroutine (`cert_validity_watchdog`, evaluated every 12 hours) alongside startup checks. - - Automatically checks Root CA and server TLS certificate expiration against a 30-day threshold. - - Generates renewed certificates on disk with timestamped backups (`.bak`), and reloads active `ssl.SSLContext` in memory dynamically without dropping socket listeners or restarting the background service. - -- **Client Proactive Expiry Check & Reactive Self-Healing Auto-Renewal**: - - **Proactive**: Forwarders (`Win_Client.py` and `Linux_Client.py`) evaluate `client.crt` validity before each run, auto-renewing via `/api/client/enroll` if expiring within 30 days. - - **Reactive**: If the hub rotates its Root CA or a TLS verification error (`ssl.SSLError` / `SSLCertVerificationError`) occurs, clients automatically catch the error, re-enroll with the hub using their enrollment secret, and reconnect cleanly. - -- **Database Schema & License Quota Accounting**: - - SQLite tables `license_config` (`max_seats`, `enrollment_secret`) and `clients` (`client_id`, `hostname`, `os_type`, `cert_fingerprint`, `status`, timestamps). - - Enforces seat limits on enrollment (`HTTP 403 License seat limit reached`) while allowing active registered nodes to re-enroll/renew indefinitely. - - Added `GET /api/clients` endpoint for license auditing and telemetry tracking. - -- **Automated Service Installers**: - - **Windows**: Self-contained Inno Setup installers (`LOGAR-Client-Setup.exe` and `LOGAR-Server-Setup.exe`) bundling `nssm.exe` to register, configure, and start Windows services automatically. - - **Linux**: Automated installer scripts (`compilation/install_linux_client.sh` and `install_linux_server.sh`) deploying systemd service units with auto-restart policies. - -- **CI/CD Release Workflows**: - - Windows workflow (`.gitea/workflows/release-windows.yml`) and Linux workflow (`.gitea/workflows/release-linux.yml`) automated to build native executables, installers, and upload release assets on tag push. +### 🛡️ Security Fixes & Defensive Hardening +- **Mandatory Admin Authentication**: Enforced strict administrator authentication across all fleet management endpoints (`/api/clients`, `/api/clients/approve`, `/api/clients/revoke`, `/api/clients/delete`, `/api/client/export-profile`) and license management APIs. +- **Brute-Force Mitigation & Rate Limiting**: Implemented thread-safe sliding-window IP rate limiting on `/login` (10 attempts/min) and `/api/client/enroll` (15 attempts/min) with progressive delays and `HTTP 429` throttling. +- **Cookie Security Flags**: Session cookies now enforce `HttpOnly=True`, `SameSite="Lax"`, and dynamic `Secure=True` for HTTPS connections and reverse-proxy deployments (`X-Forwarded-Proto`). +- **Cryptographic Random Secrets**: Server Hub and License Authority session secrets are now generated with 256-bit CSPRNG (`secrets.token_hex(32)`) on initialization. +- **License Renewal Validation**: Hardened `/api/license/renew` with explicit PEM structure and database validation, preventing unhandled exceptions. +### ⚡ Operational Improvements & Modernization +- **FastAPI Lifespan Handlers**: Migrated legacy startup events to modern ASGI lifespan context managers. +- **OpenPGP Compression Preferences**: Aligned Server public key compression algorithms (`ZIP`, `ZLIB`, `BZ2`, `Uncompressed`) with client preferences. +- **Cross-Platform Compilation**: Unified automated packaging for standalone Windows and Linux binaries.