nfdump-1.7.9
This is primarily a security, stability and hardening release, based on an extensive code-scanning and manual security review of all collectors (nfcapd, nfpcapd, sfcapd) and file parsers. It is also the last “Unicorn” 1.7.x release, before the new 1.8.x "Colibri" tree takes over.
Security fixes
- Fixed several use-after-free and DoS issues in IPFIX options template handling (remote-triggerable in nfcapd)
- Fixed integer overflows / NULL-deref in NetFlow v9 option template processing
- Fixed stack/heap out-of-bounds reads in legacy v1 file headers and malformed NBAR/VRF records
- Fixed multiple integer overflows and OOB reads in the sFlow decoder (MPLS/VLAN, extended gateway, L4, 802.11 MAC)
- Hardened MaxMind and Tor lookup parsers
Bug fixes
- Fixed crash and a race condition with multiple dynamic flow sources
- Fixed nfanon single-output-file and IPv6 anonymization bugs
- Fixed icmp handling when data is absent
- Fixed a memory leak in sgregex
Improvements
- Maxmind and Tor-DB loading up to 40% faster
- New %gra geo-enriched router/exporter address tag and geo info added to output_raw
- Added missing srcasn/dstasn/ext aggregation
- Added IPFIX nsec time elements 156/157 (VPP 17.07 compatible)
- Multi-stage Docker builds + updated Docker docs
- Improved *BSD/NetBSD/Alpine build portability and CI