v0.7.0

What's New in 0.7.0

This release introduces major improvements to traffic routing, leak protection, DPI-evasion capabilities, and anti-probing resilience.

Added

• Advanced Split-Tunneling: Introduced --include-routes and --exclude-routes CLI flags for fine-grained per-CIDR routing control on Linux, macOS, and Windows. Routes are automatically cleaned up on disconnect.
• Kill-Switch & Leak Protection: The new --kill-switch flag installs robust firewall rules (nftables on Linux, pfctl on macOS, Windows Firewall on Windows) blocking all non-VPN traffic. Rules survive unexpected process termination to prevent leaks, persisting until explicitly cleared with aivpn-client kill-switch clear.
• IPv6 Dual-Stack: Full NAT66/NPTv6 support added to aivpn-server. Clients now receive an IPv6 address during the ServerHello handshake via the new ipv6_enabled and ipv6_prefix network configurations.
• MTU Auto-Detection: Setting mtu: "auto" in the server config now triggers PMTUD-based MTU discovery, replacing previous hardcoded defaults.
• Mask Validator: Added the --validate-mask <path> server subcommand to validate custom mask JSON files (checks structure, confidence score, FSM reachability, and IAT distribution consistency).
• Six New DPI-Evasion Masks: Added avito, sber, vk, sberjazz, whatsapp, and yandex profiles to mask-assets/ (each achieving a confidence score ≥ 0.90) for highly effective DPI bypass.
• Neural Anti-Probing Improvements: The Neural Resonance Module now tracks 64 traffic features (including burst patterns, direction ratio, IAT periodicity, and entropy variance). A 60-second rotation cooldown prevents mask oscillation under sustained active probing by censors.
• Linux Desktop GUI: Released a native Linux GUI application (aivpn-linux) built with the Iced framework, distributed as an AppImage with system tray integration.
• eBPF/XDP Early Packet Filter: The aivpn-linux-kernel module now provides an XDP BPF program (xdp_prog.o). It attaches to the default-route NIC upon connection, dropping malformed or replayed UDP packets at the NIC level (before socket buffer allocation) for strong volumetric DDoS protection.
• Threat Model Document: Added a comprehensive THREAT_MODEL.md detailing the adversary model, cryptographic design, traffic-analysis resistance, and known limitations.

Changed

• record_traffic API: Added an is_rx: bool parameter for more accurate directional traffic analysis (differentiating upload vs. download).
• macOS build: CFBundleVersion bumped to 5.
• iOS build: CFBundleVersion bumped to 3.

Fixed

• resolve_config_path crash: The server no longer crashes if /etc/aivpn/server.json exists but is not readable (e.g., due to root-only permissions). Auto-discovery now safely falls back to standard config paths.
• Test fixture API alignment: Synchronized VpnNetworkConfig, ClientNetworkConfig, and ServerArgs test literals across the codebase to match 0.7.0 struct fields.

---

Note: To use the new Kill-Switch on Linux, ensure nftables or iptables is installed. On macOS, the kill-switch leverages pfctl with robust protection against symlink attacks.