v0.9.5

What's Changed

• Operability: what stops a person running this on their own machine and server by @xen0bit in #81

Full Changelog: v0.9.4...v0.9.5

v0.9.4

What's Changed

• feat(mgmt): harden the management and profile plane by @xen0bit in #78
• test(mgmt): Playwright browser tests for the management panel by @xen0bit in #79
• fix(mgmt): remediate the management plane, and wake the guards that were asleep by @xen0bit in #80

Full Changelog: v0.9.3...v0.9.4

v0.9.3

What's Changed

• feat(mgmt): client-config generation, profile CRUD and an audit log by @xen0bit in #77

Full Changelog: v0.9.2...v0.9.3

v0.9.2

What's Changed

• feat(mgmt): auto-defaults and key-material generation for web panel by @xen0bit in #76

Full Changelog: v0.9.1...v0.9.2

v0.9.1

Changelog

Bug fixes

• e76fe9a: fix(client): add JSON tags to OptSpec so web panel renders option fields (#75) (@xen0bit)
• cade14e: fix(dataplane): make a blocked TUN read interruptible (#74) (@xen0bit)

---

Built with GoReleaser. See the README for setup, -setcap/CAP_NET_ADMIN
requirements, and OS-client configuration.

v0.9.0

Changelog

Features

• 3ace194: feat(amneziawg): interop against amneziawg-go, both directions (@xen0bit)
• 78a0a77: feat(client): add Layer2 field to Result, fix Validate for layer-2 tunnels (@xen0bit)
• 77e9665: feat(ikev2): RFC 8229 TCP framing codec for IKE and ESP (#70) (@xen0bit)
• 1f5b099: feat(iptfs): AGGFRAG codec (RFC 9347) — Pack, Reassembler, tests (@xen0bit)
• 61be189: feat(iptfs): IKEv2 integration — notify constant, client/server options, CLI flags (@xen0bit)
• f925ad9: feat(l2tpv3): CLI wiring, doc.go, README, and docs_test mechanical guards (@xen0bit)
• ae68976: feat(l2tpv3): NM module wiring for L2TPv3 (@xen0bit)
• eecb23f: feat(l2tpv3): facade package with Dial, NewServer, and registry registration (@xen0bit)
• 853196d: feat(l2tpv3): internal codecs, session, pump, and data-path tests (@xen0bit)
• 5eadf1f: feat(l2tpv3): the quiescent control connection (RFC 3931 HELLO keepalives) (#69) (@xen0bit)
• b172834: feat(supervisor): management plane for multi-listener server fleets (@xen0bit)
• 9b84a93: feat: implement remaining protocol phases — Juniper NC, F5, Array, IP-TFS, Rosenpass (@xen0bit)
• 43c2ae6: feat: post-quantum IKEv2, AmneziaWG and SoftEther, and fix what they broke (@xen0bit)

Bug fixes

• 10b5d57: fix(interop): restore the SoftEther SSTP peer's init script (@xen0bit)
• 8bf7b6b: fix(interop): skip the L2TPv3 kernel cells where the kernel has no L2TP (#71) (@xen0bit)
• 5638feb: fix(l2tpv3): address golangci-lint errcheck warnings (@xen0bit)
• a7c6fbb: fix(nm): field tables for AmneziaWG and SoftEther in the editor plugin (@xen0bit)
• 8f0f9d0: fix: remove fabricated protocols, and finish L2TPv3 and IP-TFS properly (@xen0bit)

---

Built with GoReleaser. See the README for setup, -setcap/CAP_NET_ADMIN
requirements, and OS-client configuration.

v0.8.0

Changelog

Features

• ee7d16c: feat(cisco): Cisco IPsec remote access, both roles (#64) (@xen0bit)
• 35e815c: feat(gp): Palo Alto GlobalProtect, both roles (#63) (@xen0bit)
• 0f03575: feat(pulse): Ivanti Connect Secure, both roles (#65) (@xen0bit)

Bug fixes

• 88e602e: fix(release): exclude scoped commit types from the changelog (#56) (@xen0bit)
• 5c41106: fix: guard the fuzz target list, pin the DTLS precondition, correct the MASQUE fuzz citation (#61) (@xen0bit)

---

Built with GoReleaser. See the README for setup, -setcap/CAP_NET_ADMIN
requirements, and OS-client configuration.

v0.7.0

Changelog

Features

• 52afb40: feat(dataplane): downstream flow shaping against the encapsulated-TLS fingerprint (#49) (@xen0bit)
• 861b7f1: feat(dataplane): downstream flow shaping for OpenVPN and L2TP/IPsec (#53) (@xen0bit)
• dea5e58: feat(dataplane): downstream flow shaping for the stream-carried protocols (#52) (@xen0bit)
• 6078640: feat(nm): one NetworkManager VPN type per protocol (#55) (@xen0bit)
• f016a8d: feat(openvpn): accept tls-auth / tls-crypt on the server (#50) (@xen0bit)

Bug fixes

• 3a89e5c: fix(dataplane): charge the shaping budget what a packet emits, not what it carries (#54) (@xen0bit)

Others

• b53b0c2: docs(readme): refresh benchmark table from CI [skip ci] (@github-actions[bot])
• be66343: docs(readme): refresh benchmark table from CI [skip ci] (@github-actions[bot])
• 96f48da: docs(readme): refresh benchmark table from CI [skip ci] (@github-actions[bot])
• 3c7bce0: docs(readme): refresh benchmark table from CI [skip ci] (@github-actions[bot])
• 3f2ca51: docs(readme): refresh benchmark table from CI [skip ci] (@github-actions[bot])
• 01d0a93: docs(readme): refresh interop results from CI [skip ci] (@github-actions[bot])
• de676c8: docs(readme): refresh interop results from CI [skip ci] (@github-actions[bot])
• d2bd85c: docs(readme): refresh interop results from CI [skip ci] (@github-actions[bot])
• 1ebc047: docs(readme): refresh interop results from CI [skip ci] (@github-actions[bot])
• 89ed1f6: docs(readme): refresh interop results from CI [skip ci] (@github-actions[bot])

---

Built with GoReleaser. See the README for setup, -setcap/CAP_NET_ADMIN
requirements, and OS-client configuration.

v0.6.0

Changelog

Features

• 5b497b8: feat(client): unified peer-liveness monitor; IKEv2 DPD, WireGuard & TOY probes (@xen0bit)
• 7641991: feat(ikev2): IKE fragmentation (RFC 7383) — reassemble a force-fragmenting peer (@xen0bit)
• 0b7bdc8: feat(ikev2): IPv6 underlay for ESP/IKE (outer transport over v6) (#48) (@xen0bit)
• 2491c99: feat(ikev2): MOBIKE (RFC 4555) — survive a roaming peer without re-handshaking (@xen0bit)
• 37b0fb7: feat(ikev2): X.509 certificate authentication (RFC 7427) (@xen0bit)
• 6b8c2c5: feat(ikev2): dual-stack IPv6 inner traffic over the ESP tunnel (#47) (@xen0bit)
• e063895: feat(ikev2): proactive Child SA rekey before expiry (@xen0bit)
• 7206d54: feat(ikev2): proactive IKE SA rekey (RFC 7296 §2.18) (@xen0bit)
• 94bc6cb: feat(ikev2): wire ChaCha20-Poly1305 into the IKE/ESP suites (RFC 7634) (#46) (@xen0bit)

Bug fixes

• 37f27df: fix(dataplane): retire a tunnel's routes by identity, not by prefix (@xen0bit)

Others

• 61fe9f1: docs(readme): refresh benchmark table from CI [skip ci] (@github-actions[bot])
• 6932fbe: docs(readme): refresh benchmark table from CI [skip ci] (@github-actions[bot])
• 3724f6d: docs(readme): refresh benchmark table from CI [skip ci] (@github-actions[bot])
• 4bab975: docs(readme): refresh benchmark table from CI [skip ci] (@github-actions[bot])
• 48c0e31: docs(readme): refresh benchmark table from CI [skip ci] (@github-actions[bot])
• 552645a: docs(readme): refresh benchmark table from CI [skip ci] (@github-actions[bot])
• 1812c91: docs(readme): refresh benchmark table from CI [skip ci] (@github-actions[bot])
• ea1307c: docs(readme): refresh benchmark table from CI [skip ci] (@github-actions[bot])
• 1d99690: docs(readme): refresh benchmark table from CI [skip ci] (@github-actions[bot])
• 8e2c0c3: docs(readme): refresh interop results from CI [skip ci] (@github-actions[bot])
• 44be504: docs(readme): refresh interop results from CI [skip ci] (@github-actions[bot])
• a5e3d35: docs(readme): refresh interop results from CI [skip ci] (@github-actions[bot])
• e5e8ea3: docs(readme): refresh interop results from CI [skip ci] (@github-actions[bot])
• 2c598fb: docs(readme): refresh interop results from CI [skip ci] (@github-actions[bot])
• 42516e7: docs(readme): refresh interop results from CI [skip ci] (@github-actions[bot])
• 9d416ff: test(interop): assert Child SA rekey on the server log, not the client's (@xen0bit)

---

Built with GoReleaser. See the README for setup, -setcap/CAP_NET_ADMIN
requirements, and OS-client configuration.

v0.5.0

Changelog

Features

• 2098320: feat(packaging): build for every Debian release architecture (@xen0bit)
• a00e595: feat(packaging): veepin-nm packages for every Debian release architecture (@xen0bit)

Bug fixes

• 9aa4e58: fix(ci): disable VCS stamping in the cross-build containers (@xen0bit)

Others

• 37eea45: chore(packaging): rotate the APT repository signing key (@xen0bit)
• d053a13: chore(packaging): use the GitHub noreply address in Maintainer fields (@xen0bit)
• f38c857: docs(readme): refresh benchmark table from CI [skip ci] (@github-actions[bot])
• 8b9675c: perf(dataplane): GRO — coalesce inbound TCP into one TUN write per batch (@xen0bit)

---

Built with GoReleaser. See the README for setup, -setcap/CAP_NET_ADMIN
requirements, and OS-client configuration.