Interstellio Lunar Release Notes
================================

The following document will have updated release notes for
every version stating enhancements and bug fixes.

Release 1.0.0 (2024-12-10)
--------------------------

Initial first version.

Release 1.0.1 (2025-02-17)
--------------------------

Fixed several issues related to updating virtual instances:

* The virtual instance will remain offline if RPC fails during an update.
* A RADIUS instance would fail if the RPC for an update occurred while
  processing a RADIUS request.
* Duplicate Update requests ignored.

Release 1.0.2 (2026-06-03)
--------------------------

* Allow UDP padding per RFC 2865 Section 3 instead of rejecting padded
  packets as corrupt.
* Use RADIUS Length field (not UDP payload size) when queuing packets to
  exclude padding from authenticator calculations.
* Fixed port display in warning logs to use ntohs() for correct byte order.
* Corrupt packet warning now includes RADIUS length vs received length for
  easier debugging.
* Added ``prefix`` option to the ``[logging]`` section of ``lunar.ini``. When
  set, the value is prepended to every syslog line ahead of the level marker
  (for example ``BLAH: <ERROR> ...``). Defaults to empty (no prefix); terminal
  output is unaffected.
* Security: updated bundled HTTP server library to the latest upstream release,
  picking up fixes for response header injection and a malformed query-string
  handling issue.

Release 2.0.0 (2026-07-10)
--------------------------

* More reliable startup error reporting.
* Improved log consistency: log messages now include structured context (such
  as client IP and virtual instance) in a consistent, easy-to-parse format
  across the service.
* Added remote logging: informational, warning, error and critical events are
  now reported to the backend platform in addition to local syslog, giving you
  centralised visibility of each Lunar server. Reporting happens in the
  background and never delays RADIUS or API processing, and is automatically
  rate-limited so a temporary connectivity issue can never affect server
  performance. Debug messages remain local only.
* Future-proofed the RADIUS implementation to support proxying, TCP, RadSec and
  EAP and more.
* Added dictionaries and full RADIUS packet processing support, including
  support for vendor-specific attributes, extended types, and proper handling
  of all standard RADIUS attributes.
* Improved performance of request handling: requests are now processed with
  greater concurrency, increasing throughput and reducing latency under heavy
  load.
* Added event streaming to external Kafka brokers.
* Lunar architecture now future-proofed to support multiple services, not only
  RADIUS.

Release 2.0.1 (2026-07-15)
--------------------------

* Performance: Lunar now ships with a modern, security-pinned HTTP client
  library built into the binary instead of using the operating system's copy.
  The OS-provided versions contain a connection-scheduling flaw that could
  drive API worker threads to 100% CPU under heavy RADIUS load; the bundled
  library resolves this and significantly improves API throughput under load.
  HTTP/2 and TLS system libraries continue to receive operating system
  security updates as before.

Release 2.0.2 (2026-07-23)
--------------------------

Performance:
~~~~~~~~~~~~

* Starting as root will allow Lunar to gather more resources. (please see
  security below)
* Additional performance tuning, and system resource management.
* Added kernel scheduling prioritisation for different workers.

Security:
~~~~~~~~~

* Starting as root user will automatically drop privileges to non-root user.
  (user lunar group lunar)

Features:
~~~~~~~~~

* Added ``radtest``, a built-in command-line tool for testing RADIUS servers.
  It sends authentication (Access-Request) tests over PAP, CHAP, MS-CHAPv1 and
  MS-CHAPv2 to Lunar or any other RADIUS server and reports the result, making
  it easy to verify connectivity, shared secrets and credentials while setting
  up or debugging. Run ``radtest`` with no arguments to see the available
  options.
* Added license enforcement: Lunar validates its license on startup and while
  running, and surfaces any licensing problem (missing, invalid or expired)
  through the status API and the logs.
* Added a ``GET /v1/status`` API endpoint that reports the instance's current
  health and vitals along with its license status, for use as a load-balancer
  or monitoring probe.
* Added a ``GET /v1/subscriber/radius/{virtual_id}/ping`` full round-trip test
  endpoint that sends a test RADIUS request to the specified virtual instance
  IP all the way through the normal inbound UDP thread, processing threads,
  async API workers, outbound processing, and UDP outbound workers and returns
  the result, for use as a health probe or to verify connectivity and
  configuration.
* Added
  ``POST /v1/subscriber/radius/virtual/<virtual_id>/client/<client_id>/test``
  API endpoint to send on-demand test RADIUS requests for a specific virtual
  and client.
* Added routes to check current configuration state of virtuals. For example
  GET ``/v1/subscriber/radius/virtuals`` returns the current list of those
  virtual instances.

Release 2.0.3 (2026-08-06)
--------------------------

* Improved resource checking in lunar and lunar_backend_sim to detect running
  out of file descriptors.
* Finalized backend API(s) to support future "Terra" future backend platform.

Release 2.0.4 (2026-08-20)
--------------------------

* Fixed Status-Server (RFC 5997) health probes, including Lunar's own
  self-ping, being shipped to Kafka as authentication or accounting events.
  Status-Server packets are still answered as before but no longer produce
  Kafka events.

Release 2.0.5 (2026-08-22)
--------------------------

* Updated the 5x9 vendor dictionary with corrected attribute types, changing
  the QoS profile, ACL, routing-instance, pool, vSG identifier, vSG service and
  vSG initial-URL attributes from bytes to text so they display as
  human-readable text in logs and events instead of raw hexadecimal.

Release 2.0.6 (2026-09-03)
--------------------------

* Added Kafka event shipping for CoA/Disconnect (PoD) requests triggered
  through the API. Enable with
  ``protocol.radius.kafka.api-triggered-coa-topic``; the event pairs the
  relayed request with the NAS reply (ACK/NAK) in the same envelope as
  authentication/accounting events and reuses the same producer, brokers and
  tuning.
