Repository navigation
SupiVPN v0.8.0
SupiVPN v0.8.0
Commit: e780fec55347a34ca25a48d8476e897ce1b34881.
Go Supi! This release adds reusable VPN profiles bound to their verified SAML
owner, profile administration and browser-assisted OpenVPN Connect import.
OpenVPN remains an unmodified upstream component.
Changes
Profile ownership and import
- Bound profiles carry an opaque identifier and a random 256-bit proof, never
a SAML username or IdP password. Issuance requires verified SAML and group
authorization. Admission checks the proof, active state and matching SAML
owner. PostgreSQL stores only the proof digest and owner hash. - Profiles can be blocked or reactivated with revision checks. Blocking denies
new admission; it does not terminate an established tunnel, ban an account,
prevent a fresh authorized download or revoke old-format profiles. - OpenVPN Connect Server URL discovery opens an SP-initiated SAML flow and
produces a 60-second, one-use HTTPS import grant. Linux users sign in through
the browser, download the .ovpn file and import it with OpenVPN 3 Linux. - Browser confirmation, success and error pages use lightweight embedded styles,
system fonts and restrictive CSP. No JavaScript or external assets are needed. - Tunnel logs can correlate an opaque profile ID with a supplied Device ID.
Device IDs are untrusted diagnostics and never authorize access.
Local administration
The new supivpn-cli Debian package is included in the supivpn metapackage. It
requires root on a combined node/controller Debian host; PostgreSQL may be
external. Commands cover service status, bounded profile inventory/status,
revision-checked block/activate and local session status/drop. The CLI has no
remote administration endpoint and accepts no arbitrary SQL or configuration path.
Lambda and split deployments do not support this CLI. Use the documented
restricted recovery operator path, or the temporary least-privilege SQL procedure
for profile state. Keep all operational credentials outside command history/logs.
Compatibility
Upgrade and two-minor transition
Profile binding and Server URL require schema 11. All three isolated Lambda
components require exactly schema 11, even with the new profile options disabled.
The combined VM runtime retains its existing legacy-mode compatibility with
schemas 7 through 10; those schemas cannot enable the new profile features.
Use a coordinated controller/agent upgrade. Back up the database and verify
restoration before migration. Reapply the documented restricted grants for
separate component roles. Plan a maintenance window for Lambda migration and
deploy matching public, agent and recovery versions before resuming admission;
do not assume mixed aliases or warm environments can span the schema/grant change.
Arbitrary mixed binary/schema versions and database downgrades are unsupported.
Rollback requires a consistent, tested database backup and matching binaries;
old binaries do not gain support for newly issued bound profiles.
Legacy profile support remains available throughout 0.8.x and 0.9.x, including
patch releases. Removal or default enforcement may begin no earlier than 0.10,
with separate release notes. An omitted agent profile_binding remains legacy
during this transition; required is an explicit operator choice. No timer closes
the legacy port automatically.
Run separate legacy and required OpenVPN/agent pairs with distinct trusted node
identities, sockets and nonoverlapping address pools. Install the authenticated
tls-crypt-v2 metadata gate on every legacy listener before issuing bound profiles.
New profiles must be refused on the old port, and old profiles on the new port.
Missing, malformed, blocked or mismatched new credentials must never fall back.
Operators can enforce ownership sooner by closing the legacy listener.
The setup helper does not automatically convert an existing deployment to two
listeners. Debian systemd templates support the explicit migration. For Lambda
and EC2, use separate node instances/IAM identities and appropriate port/target
group routing; two agents sharing one EC2 fencing identity are unsupported.
Public Lambda uses the same controller for binding and browser pages. For Server
URL, expose exact GET/HEAD /openvpn-api/profile, GET /profile/connect and GET
/profile/import/{token} routes alongside existing SAML routes. Preserve response
security headers and cookie handling, disable authentication/profile caching, and
redact import tokens and SAML data from gateway, proxy, WAF and analytics logs.
Existing Secrets Manager key loading remains supported.
Keep browser login confirmation enabled unless accepting its documented relay
risk. A legacy listener retains the old security behavior. A copied bound
profile together with its owner's SAML session can still authenticate: this is
account binding, not hardware attestation. Bound profiles require an exact VPN
server certificate common-name match; plan certificate renewal accordingly.
Security corrections
- Import expiry is checked against fresh database time after acquiring the row
lock. Waiting for a lock no longer extends a one-use grant's validity. - An undispatched or definitively rejected registration is no longer cancelled
as though a database login existed, avoiding listener-wide failure. Uncertain
requests and active sessions retain fail-closed cancellation. - Combined-host profile operations use their existing runtime permissions;
isolated component roles retain narrow functions without expanded grants.
Both reported findings have deterministic regression coverage and passed after
correction. The generic early-disconnect cancellation path also exists in
v0.7.1 source; exploitability on a released deployment and the complete affected
release range have not been independently established.
Validation and limitations
PR head 494f30d passed Checks and CodeQL,
including Go/race/PostgreSQL tests, XML/SAML fuzzing, dependency scans, native
OpenVPN and Linux-client checks, Debian packages and all three Lambda ZIP builds
and binary scans on arm64/amd64. A clean arm64 Debian VM with external PostgreSQL
passed both listeners, owner/proof/cross-port denial, CLI block/reactivate,
process continuity, reboot and package lifecycle. Later presentation-only changes
passed full integration and browser checks separately.
Native Connect 3.9.0 (6050) on macOS arm64 passed Server URL import with trusted
HTTPS and a signed synthetic IdP. Native Connect tunnels, other native platforms,
prefixed Server URL and the new bound-import flow with real Okta remain unverified.
The live AWS deployment of these new changes has not been tested. Main Checks
(40100246134), CodeQL (40100246378), main Real Okta (40100246127) and the explicit
pre-release Real Okta run (40105202433) passed on the release commit. Both Okta
runs verified the existing six-download plaintext/encrypted matrix and cleanup;
they do not establish acceptance of the new bound-import flow. Tag CI and release
provenance are separate mandatory publication gates.
Blocking is not an atomic disconnect. If it races with applied but unacknowledged
authorization, existing fail-closed acknowledgement behavior can stop that
listener. Keep independent administrative access. The profile registry grows per
issued profile; this release adds no automatic retention policy or device binding.
Operator guides
Packages
Commit: e780fec55347a34ca25a48d8476e897ce1b34881. License: AGPL-3.0-only.
Verified native ARM64 and AMD64 builds from Checks for this signed tag. Both bundles use format 3.
Debian 13 packages for ARM64 and AMD64, a shared metapackage and native Debian source are included. Install verified matching packages with apt install ./supivpn*.deb; see DEPLOYMENT.md.
GitHub build provenance was verified for all binary archives, Debian assets and Corresponding Source, including the tag commit and Checks run attempt 1.
Database schema: 11; compatible VM schemas: 7, 8, 9, 10, 11.
Isolated Lambda required schema: 11.
Corresponding Source accompanies the binaries. Verify SHA256SUMS.asc with the pinned SupiVPN release key, then verify the downloaded files against SHA256SUMS before use.