argus-clients-5.0.4

Argus-clients v5.0.4 is a significant update since v5.0.0, bringing new client tools (ratrace, radns, rabehave), GeoIP labeling improvements, and — the headline of this release — a comprehensive, multi-phase security review and a full CodeQL/fuzz-harness hardening of the project's build and release process, matching the work already completed in the companion sensor repository (openargus/argus v5.0.4).

Security review and CI/CD hardening

This release includes the results of an extensive, two-phase security review of the client codebase (common/, clients/, and all of examples/, including the GeoIP-labeling subsystem), combining static analysis (cppcheck, flawfinder, semgrep) with deep manual verification, followed by an ArgusHandleRecord() AFL++ fuzzing harness and a full GitHub CodeQL static-analysis sweep of main. In total, 48 distinct defects were found, root-caused, fixed, and verified — including several directly network-reachable memory-safety bugs (an uninitialized-pointer use-after-free triggerable by a single crafted DNS MX record in radns; a heap-buffer-overflow read serializing tunnel-encapsulated ARGUS_ENCAPS records; widespread unbounded buffer-append operations across radump's 37 protocol decoders), a Critical strncat off-by-one affecting ~37 call sites, a Critical use-after-free pattern in label-merge code, several TOCTOU (check-then-act) races in config-file and write-file handling, and a remotely-triggerable denial-of-service in the syslog decoder. Every fix was verified against a clean rebuild and the project's functional regression suite before merging, with zero remaining CodeQL alerts.

Argus-clients now also has:

• CodeQL code scanning (Advanced Setup) enabled on every push and pull request.
• A dedicated AFL++/libFuzzer-compatible fuzz harness targeting ArgusHandleRecord() — the common choke point every client tool's record-reading path calls — plus a CI job that replays the seed corpus and saved crash reproducers under AddressSanitizer/UndefinedBehaviorSanitizer on every push/PR.
• A GitHub Actions CI pipeline building on both Ubuntu and macOS.
• Branch protection on main, requiring passing CI checks before any change can be merged.

New tools

• radns — a DNS-monitoring tool with its own MySQL export and an interactive search/control-command interface for querying observed DNS traffic.
• ratrace — an active address-tracing facility based on observed traffic.
• rabehave — an anomaly-visualization variant of ratop, retained alongside the original ratop.

GeoIP labeling

common/argus_label_geoip.c (GeoLite2 City/ASN/coordinate labeling, used by rapath, ratrace, and ralabel) received its first-ever compiled and functionally-tested review pass in this project's history, surfacing and fixing a swapped source/destination ASN-direction guard, a missing ArgusLog() format argument, several unchecked allocations, and an incorrect direction qualifier on inode-address coordinate records.

Other fixes since v5.0.0

• Fixed -w <file> output correctness (byte-level regression-tested against a known-good baseline for new-file writes, append, and -w - stdout streaming).
• Fixed JSON output parsing/formatting for fractional-second time values.
• Fixed an ICMPv6 "Packet Too Big" status-field NULL-variable-use bug (reported in #17).
• Fixed perllib/pythonlib build-configuration handling, including a dead-code typo (with_pythonllib) in the SWIG+numpy auto-detection path (related to #15).
• Numerous format-string, integer-precision, and buffer-bounds correctness fixes across common/ and every examples/ tool, found via static analysis and manual review.

Issues closed in this release: #15, #17

We continue to be grateful to the Argus community for detailed bug reports and reproduction steps — several of the fixes in this release trace directly back to issues and discussion threads from the community. Thank you!