Version 1.0.0-rc.79

Stratum v1.0.0-rc.79

Release candidate. Continues the Stratum 1.0 preview. It is recommended for evaluation and staging. Hold production rollouts for the stable v1.0.0 release.

This release focuses on correctness and security. Every firewall setting is now either enforced exactly as written or refused. BGP works with standard routers and keeps its configuration across restarts. Alert webhooks are protected and signed.

Before you upgrade

• Connections through address translation reset once. The first start after the upgrade resets the node's connection-tracking and address-translation state. Established connections through NAT may need to reconnect. Later restarts are unaffected.
• Check your firewall rules after upgrading. Run cenvero-str-ctl firewall list. Any rule that uses a setting Stratum does not enforce is flagged, with the setting named (see Security).
• Alert webhooks must point at a public address. Receivers on private or internal networks no longer get deliveries. Webhook actions created before this release keep delivering unsigned and are flagged; add them again to get a signing secret. See Security.

Security

• Firewall rules are enforced exactly as written:

- Source ports: a rule's source port is now enforced. Before, an allow rule limited to a source port allowed every source port. - Unenforced settings are refused: a chain other than prerouting, a stateless rule, and reject. Existing rules that use them are flagged in firewall list. Allow rules that were never about arriving traffic are no longer applied, and a stored reject works as a drop. - Unreadable values: a rule with an unreadable address, hardware address or protocol is refused. Before, it could match all traffic. - Strict checks: the rules API now rejects fields it does not recognise. The command line refuses a rule whose action contradicts the command, such as firewall allow with a drop action. - Port ranges: a destination port range is now enforced as a whole range. Before, only its first port was.

• Alert webhooks:

- Public addresses only: they are delivered only to public addresses, never follow redirects, and are signed. The X-Stratum-Signature header carries an HMAC of the body, using a secret shown once when you add the action. - No proxy: webhooks never go through a proxy set in the environment.

Improvements

• BGP:

- Configuration survives restarts and updates: neighbours, announcements, prefix lists, route maps, policies, RPKI and EVPN settings. - Standard routers: sessions with standard BGP routers now establish (tested with BIRD 2). - Correct route attributes: announced routes carry the correct AS path, and eBGP peers no longer receive local preference.

• Alerts:

- Duration: a condition's duration is honoured before an alert fires. - Resolution: alerts resolve when the condition clears, when their target stops reporting, or when the condition is removed. The resolution is announced to every action. - One alert per episode: an alert fires once for each episode, instead of again after every cooldown. - Bounded history: it keeps 30 days of alerts, at most 10,000. - Unsupported conditions: conditions that can never fire are refused. - Condition id: creating a condition through the API returns its id.

• Firewall default: the new firewall default command and API set the firewall's default action.
• Backups:

- Contents: configuration backups now contain the firewall rules and the default action. Before, they were always missing. - Restore: restoring a configuration backup is refused with a clear message, because it is an export for your records. Full backups restore as before. - Errors: a failed read now fails the backup, instead of being skipped silently.

• Storage (early access):

- Snapshot delete: a snapshot delete is reported finished only once all its work is done. - Concurrent jobs: a rare case where two jobs on one volume could interfere is fixed.

• Self-repair: a missing network bridge is re-created. The health report now shows each bridge separately.

Documentation

• Firewall page: it says exactly what each rule setting does, and how to use a default-deny policy safely.
• Monitoring page: it covers how alerts fire and resolve, and how to verify a webhook signature.
• Clustering and high-availability pages: they now say plainly that these cannot be set up yet. They arrive with the multi-server release.

Feedback on this release candidate is welcome. Report issues through your account before the stable v1.0.0 cut.