SupiVPN v0.9.1

SupiVPN v0.9.1

Changes

• Restore explicit acceptance of existing unbound profiles for the rest of v0.9.x, correcting their premature removal in v0.9.0. The original transition introduced in v0.8.0 is restored; final removal is v0.10.0.
• Require a separate legacy UDP listener, profile_binding: "legacy" on its agent, the authenticated legacy metadata gate, and an exact legacy_profile_nodes allowlist on the controller. Isolated public and agent Lambdas must configure the same allowlist.
• Keep bound-profile secret, owner and active/blocked verification on UDP and optional TCP. New downloads remain bound-only. A bound key cannot pass the legacy gate even if its embedded proof is removed.
• Emit profile.legacy_enabled and profile.legacy_login warnings so operators can identify the migration path and its use without logging secrets or assertions.

Compatibility

Legacy admission is opt-in. Omitted agent profile_binding still means required; an omitted or empty legacy_profile_nodes list allows no legacy nodes. New installations and the setup helper remain bound-only. v0.9.0 binaries and their published tag are unchanged; use v0.9.1 or later in the v0.9.x series for this exception.

Existing unbound profiles can reconnect without immediate reissue when their historical UDP endpoint, wrapping key and TLS trust are preserved and the migration path is explicitly configured. Their users must download and verify bound replacements before upgrading to v0.10.0. Existing bound UDP-only and dual-transport profiles need no new keys or secrets.

Schema remains 12 and database grants are unchanged. Installations already on v0.8.1 or later need no database migration for this patch. Upgrade the controller and VPN-host agents together in a maintenance window. For Lambda deployments, update both public and agent Lambdas as well as the host agent; changing Lambda alone does not configure an OpenVPN listener or its metadata gate. Arbitrary mixed agent/controller versions and database downgrades are not supported. The old embedded controller remains unsupported.

Configure the temporary migration path

1. Preserve the working configuration, keys, existing listener ports and database backup. Follow the migration procedure; do not rerun first-time setup over a working installation.
2. Retain separate legacy and bound listeners with distinct authenticated node identities, agents, management sockets, generation state, TUN devices and nonoverlapping VPN pools. This separation is for the security policies: bound UDP/TCP still shares one agent and address pool. Legacy mode supports only the old UDP transport.
3. Set the old agent to profile_binding: "legacy" and install tls-crypt-v2-verify "/usr/sbin/supivpn -verify-profile-metadata legacy" on that listener before exposing it. Keep required on the bound listener. Preserve all other OpenVPN security settings.
4. Add only the old authenticated node ID to top-level legacy_profile_nodes. On a combined VM configure its controller; with isolated Lambdas apply the same list to both public and agent components and all serving replicas/aliases. Omitted entries fail closed. Recovery needs no change.
5. Verify SAML login, group denial, session limits, reconnect and the bound-profile negative checks. Monitor migration warnings and finish moving users before v0.10.0. Drain and disable the old listener, remove its allowlist entries, and close its firewall/load-balancer route before the final upgrade.

For EC2, legacy and bound agents require distinct instances and authenticated IAM/fencing identities. Two agents sharing one EC2 identity are unsupported. HA replicas must agree on policy and route each profile format to the intended nodes. Removing an allowlist entry prevents new/incomplete admission; it does not terminate an established tunnel.

Security and validation limits

Legacy profiles still require verified SAML, current group authorization, replay prevention, node leases and global per-user connection limits. They do not bind their holder to a specific SAML owner. Keep browser login confirmation enabled. Blocking a bound profile does not revoke an old unbound key held by that user. Do not describe a mixed deployment as enforcing profile ownership everywhere.

Missing or incorrect new-format proofs, unknown or blocked profiles, owner mismatches and controller/database failures never select legacy admission. Historical authenticated metadata and bound metadata remain disjoint. Cross-format registration is refused rather than downgraded.

Local validation passed Go/race, PostgreSQL integration, signed synthetic SAML admission and group denial, policy removal before completion/fetch/ACK, combined and isolated database roles, and shared session limits. Unmodified upstream OpenVPN accepted historical Go/native-issued keys and refused cross-format keys, including a stripped bound profile. Debian package lifecycle/unit checks and Lambda ZIP builds passed for arm64 and amd64.

Native OpenVPN Connect, a live AWS deployment and a full Debian VM acceptance run were not repeated for this patch. Package checks do not establish running-systemd or reboot acceptance. The real Okta checks exercise signed/encrypted SAML and bound-profile issuance; they do not establish a legacy VPN tunnel or live AWS behavior.

The release commit 9677c3bb0f98ba6b01ea41a2fa399ae2d81ea23e passed main Checks, CodeQL, automatic Real Okta and a separate pre-release Real Okta run. Main checks include native arm64/amd64 unit/race/PostgreSQL/XMLSec, OpenVPN and OpenVPN 3 Linux, Debian packages/TLS setup, binary builds and bounded fuzzing. The first security-source attempt failed while downloading the vulnerability database after a connection reset; the failed jobs passed on retry without source or policy changes. Release attestation is intentionally skipped for main and must pass on the subsequent tag run before publication.

Both Okta summaries confirm plaintext/encrypted policy, wrong-recipient-key and group refusal, six browser profile downloads, cookie/one-use protections and fixture cleanup.

Packages

Commit: 9677c3bb0f98ba6b01ea41a2fa399ae2d81ea23e. License: AGPL-3.0-only.

Verified native ARM64 and AMD64 builds from Checks for this signed tag. Both bundles use format 3.

Debian 13 packages for ARM64 and AMD64, a shared metapackage and native Debian source are included. Install verified matching packages with apt install ./supivpn*.deb; see DEPLOYMENT.md.

GitHub build provenance was verified for all binary archives, Debian assets and Corresponding Source, including the tag commit and Checks run attempt 1.

Database schema: 12; compatible VM schemas: 7, 8, 9, 10, 11, 12.
Isolated Lambda required schema: 12.

Corresponding Source accompanies the binaries. Verify SHA256SUMS.asc with the pinned SupiVPN release key, then verify the downloaded files against SHA256SUMS before use.