argus-5.0.4

Argus v5.0.4 is a significant update since v5.0.2, bringing together several rounds of correctness fixes, new sflow packet-extraction support, TCP fallow-queue tracking, and — the headline of this release — a comprehensive security review and a full CI/CodeQL hardening of the project's build and release process.

Security review and CI/CD hardening

This release includes the results of an extensive, multi-phase security review of the sensor codebase, combining static analysis, deep path-sensitive review, and coverage-guided fuzzing, followed by a full GitHub CodeQL static-analysis sweep. In total, 36 distinct memory-safety and correctness defects were found, root-caused, fixed, and verified — including several confirmed-reproducible crashes (segfaults triggered by malformed configuration input and by unsigned-wraparound bugs in token-table string formatting) and a number of integer-overflow and format-string correctness bugs. Every fix was verified against a clean rebuild and a regression corpus of 716 fuzz-discovered crash inputs before merging, with zero remaining crashes.

Argus now also has:

• A GitHub Actions CI pipeline that builds on both Ubuntu and macOS and replays the full fuzz-crash corpus on every pull request, so future changes are automatically checked against previously-found crash conditions.
• CodeQL code scanning enabled on every push and pull request.
• Branch protection on main, requiring passing CI checks before any change can be merged.
• GitHub private vulnerability reporting and a SECURITY.md policy, so security issues can be reported responsibly instead of via public issues.
• Dependabot monitoring for GitHub Actions dependency updates.

sflow support

Added the ability for argus to extract packet data from sflow records, including using the sflow agent address as the flow source ID (with a dedicated sfl0 interface tag), plus related warning/declaration cleanup.

TCP fallow-queue tracking

Added tracking and MAR-record reporting for the TCP "fallow" queue — a new counter surfaced in status records (ArgusMarStruct) to give operators visibility into flows sitting in this state, along with several fixes to the associated queue-count and drift-reporting logic.

Other fixes since v5.0.2

• Fixed stack corruption processing large SSL_LINUX packets, and increased the SSL packet buffer size.
• Fixed a global-variable corruption issue and added an explicit stack-size setting to avoid related stability issues.
• Fixed TCP state-machine handling for out-of-order handshakes observed from multiple observation points.
• Fixed direction-detection confusion when a SYN-ACK is seen before the SYN in port-reuse conditions, and fixed related port-reuse flushing confusion under lossy packet-capture conditions.
• Fixed a DSR record-length bug affecting ARP flow types.
• Fixed a pthread_cond_timedwait() boundary bug (off-by-one in the nanosecond rollover check) that could cause EINVAL and thread termination on some platforms (reported in #20).
• Fixed a *** buffer overflow detected *** startup abort caused by unsafe buffer sizing in the debug/log-message helper (reported in #17).
• Added existing DLT_ definitions for the obsolete DLT_IPV4 (228) link type.
• argus no longer calls Backtrace when the input file simply can't be found.

Documentation

Added a comprehensive docs/data-model.md reference describing Argus's on-wire record format (DSR chain, TV/TLV encoding, version compatibility, and the sensor/client split), directly addressing questions raised in #15 about the file format. Also refreshed several other internal docs to reflect current behavior.

Issues closed in this release: #15, #17, #18, #20
Pull requests merged: #21 through #28

We continue to be grateful to the Argus community for detailed bug reports, reproduction steps, and patience — several of the fixes in this release trace directly back to issues and discussion threads from the community. Thank you!