infosave2007/aivpn v1.2.0

AIVPN 1.2.0

on GitHub

Dual-stack networking, signed distribution and application hardening. 1.2.0 extends IPv6 across the tunnel, adds large management messages and new bootstrap and mask distribution channels, and fixes session, storage and platform security issues. Inter-server connections now use masked handshake sessions throughout.

Highlights

• IPv6 across the tunnel: the server assigns an IPv6 address, prefix and MTU through ServerHello; desktop and mobile clients apply it, with source validation, client isolation and QoS for both address families.
• InitialV2 handshake: separate KDF v2 and XChaCha20-Poly1305 with a random 24-byte nonce; data and management commands require confirmed PFS.
• QUIC and RTC masks: bidirectional QUIC v1/TLS 1.3 with HTTP/3 CONNECT-UDP; Zoom, Telemost, SberJazz, Telegram calls and WhatsApp masks over ICE/DTLS/SRTP and TURN.
• Adaptive data pacing: queues adapt to persistent delay instead of stalling the tunnel at a fixed packet rate; upload_shaping / downlink_shaping select adaptive, full or off.
• Signed distribution: release artifacts and mask archives are signed with Ed25519; passive mask delivery over DNS TXT, PNG, Bitcoin OP_RETURN and Ethereum calldata, and email bootstrap through JMAP.
• Platform clients: Android Material 3 interface and automatic network recovery, Linux Material/Breeze and Windows Fluent layouts, persistent Windows kill switch.
• Security: site peers no longer receive pool database or management rights, live revocation of inter-server nodes, enforced signatures in production-secure, and dependency fixes including RUSTSEC-2026-0381, -0382, -0385 and -0387.

Upgrade notes

1. Update all servers, pool/site/chain nodes and clients together.
2. Remove an explicit pool.transport=legacy; an omitted value now selects masked.
3. Configure the client database: server operation without one is removed.
4. Rotate previously used static keys and distribute trusted release and operator public keys before enabling signature enforcement.
5. Replace an explicit telegram_mtproto_v1 mask selection with telegram_calls_v1.

Settings and verification steps: docs/RELEASE_1.2.0.md.

Verifying downloads

Every asset ships with a detached Ed25519 signature (.sig). Server binaries also ship with a SHA256SUMS file:

sha256sum -c aivpn-server-linux-x86_64.SHA256SUMS

Contributors

Thanks to @vaminakov for the 1.2.0 work (#82).

Full changelog: CHANGELOG.md · v1.1.0...v1.2.0