tcpflow v1.7.0

tcpflow 1.7.0

This release fixes security vulnerabilities, improves packet processing and portability, and introduces automated releases with a signed Windows executable and Linux Snap packages.

New release and tag structure

Release tags now use vMAJOR.MINOR.PATCH, beginning with v1.7.0, replacing the previous tcpflow-<version> format.

Pushing an annotated release tag for a commit already merged into main automatically runs correctness and packaging checks, builds the artifacts, signs the Windows executable, and publishes the complete GitHub release after verifying its downloads.

The automated release produces:

• tcpflow64.exe — standalone x64 Windows executable with a publicly trusted, timestamped Authenticode signature. No additional application DLLs are required.
• tcpflow_1.7.0_amd64.snap and tcpflow_1.7.0_arm64.snap — Linux Snap packages for both architectures.
• tcpflow-1.7.0.tar.gz — source distribution.
• SHA256SUMS — checksums for the final artifacts, calculated after signing.

The Windows executable supports offline PCAP processing and DFXML output. This configuration does not include live capture, BPF filters, Wi-Fi decoding, or PDF reports. Unsupported BPF filters now produce an explicit diagnostic. The Snap packages retain native packet-capture and PDF-report support, include their required fonts, and are distributed through GitHub Releases.

Security fixes

• Resolves CVE-2026-119600: fixes out-of-bounds reads when IPv4 or IPv6 packets declare payload lengths greater than the captured data. IPv4 header lengths are also validated before processing. See #280.
• Fixes the Wi-Fi TIM bitmap bounds-checking vulnerability tracked as GHSA-q5q6-frrv-9rj6. See #274.
• Hardens radiotap parsing against malformed header lengths and truncated extension bitmaps.
• Hardens the bundled offline PCAP reader against invalid snapshot lengths, oversized packet records, and truncated input.
• Adds a documented security reporting policy.

Packet processing and correctness

• Adds PPPoE packet decoding and fixes OpenBSD loopback capture handling.
• Stops creating report.xml when using -c console-output mode.
• Fixes unaligned packet-field access, invalid shifts, and zero-length copies involving null pointers.
• Fixes the lifetime of HTTP decompression buffers between parser callbacks.
• Repairs memory ownership and cleanup in report histograms, scanner registration, packet handling, and error paths.
• Handles empty plots without invalid logarithm calculations.
• Correctly reads CRLF-terminated regular-expression and banner files.
• Adds flow addresses to detailed TCP debugging output.
• Uses Windows-compatible filenames for IPv6 addresses, MAC addresses, and timestamps while preserving normal address formatting in reports.

Build and platform compatibility

• Fixes make ci in configured in-tree builds by building and testing the current directory, with serial regression tests. Configured out-of-tree builds use the same target.
• Fixes GCC 13 compilation and applies -fno-new-ttp-matching only when supported.
• Improves FreeBSD and OpenBSD compatibility, including libpcap headers and struct bpf_timeval detection.
• Fixes format-security compilation errors in packet diagnostics.
• Removes obsolete Python 2.7 configuration checks.
• Updates the HTTP parser submodule URL to the upstream Node.js repository.
• Simplifies bootstrapping and documents the supported Autotools build and release procedure.

Testing and continuous integration

• Adds AddressSanitizer, ThreadSanitizer, and UndefinedBehaviorSanitizer checks.
• Adds Clang Static Analyzer, clang-tidy, and cppcheck checks; GitHub CodeQL continues through the repository's default setup.
• Expands native and source-distribution checks across Ubuntu and macOS, retains FreeBSD/OpenBSD testing, and adds a Debian compatibility build.
• Adds Windows runtime tests and installed-Snap tests that verify reconstructed packet data, DFXML, and rendered PDF text where supported. Windows tests also verify the unsupported-filter diagnostic.
• Adds regressions for concurrent containers, malformed captures, radiotap boundaries, CRLF patterns, report memory ownership, and release validation.
• Tests Autoconf and CMake version mismatches independently on clean, committed, tagged fixtures, ensuring the tests exercise the actual version checks.
• Improves out-of-tree test portability, includes the additional HTTP/image packet corpus in source distributions, and reports unavailable external-corpus tests as skips.
• Modernizes coverage collection and Codecov integration.

Full changelog: tcpflow-1.6.1…v1.7.0