Version 5.2.9 Release Notes
Key highlights include performance and memory optimizations, an enhanced conntrack and Netlink subsystem, introduction of the Intelligence plugin, modern C++ modernization, Python 3.13/3.14 support, mTLS bootstrap authentication, and extended build support for OpenWrt, Debian 13, and Ubuntu 26.04 LTS.
Changes
| Component | Type | Description |
|---|---|---|
| Agent | Enhancement | Multi-Engine DPI Subsystem: Introduced ndDetectionEngine and ndDetectionEngineFlowState base classes, enabling simultaneous, priority-ordered DPI engines. Decoupled nDPI-specific logic into ndDetectionEngineNDPI and implemented a native skeleton DPI engine. |
| Agent | Enhancement | Engine Registry Pattern: Added a centralized DPI engine registry to dynamically manage detection plugins and engine lifecycle. |
| Agent | Enhancement | Zero-Copy Flow Processing: Transitioned internal flow state transitions and dispatch to std::move() semantics and smart pointers (std::unique_ptr, std::shared_ptr). |
| Agent | Enhancement | xxHash64 Integration: Replaced legacy SHA1 hashing with xxHash64 across flow digest calculations, Flow Hash Caches (FHC), and Dynamic Host Caches (DHC), drastically reducing CPU usage. |
| Agent | Enhancement | O(E) Flow Expiration: Re-engineered flow expiration using bucket-based LRU lists, replacing full linear sweeps with constant-time expiration processing. |
| Agent | Bug | Immortal Flow Leak Fix: Fixed an issue during NFQUEUE conntrack sweeps where timestamps (ts_last_seen) were refreshed unconditionally, preventing idle flows from being collected. |
| Agent | Enhancement | Fast-Path Packet Processing: Implemented ProcessPacket fast-path protocol dispatch, eliminated redundant data-link type branching, and deferred ndAddr object creation until strictly required. |
| Agent | Enhancement | Cumulative Conntrack Metrics: Switched conntrack polling from auto-zeroing (IPCTNL_MSG_CT_GET_CTRZERO) to non-destructive cumulative delta counters, eliminating counter resets for external firewall utilities. |
| Agent | Enhancement | Dynamic Netlink Auto-Scaling: Implemented dynamic Netlink buffer expansion in 2KB increments upon receiving ENOBUFS, added configurable socket_buffer_size parameter (default 64 KiB), and background stale conntrack garbage collection. |
| Agent | Enhancement | TCP Metric Counters: Added TCP retransmission counters, improved TCP sequence anomaly detection, and unified lower/upper byte and packet metrics. |
| Agent | Enhancement | 56 New Flow Expression Keywords: Expanded filter keywords to cover network details, detection flags, protocol metadata, conntrack status, and threat intelligence criteria. |
| Agent | Enhancement | Advanced Expressions & Regex: Added regex inequality matchers (!= VALUE_REGEX), backslash escape character support, and custom category rules. |
| Agent | Enhancement | Epoch Time-of-Day Rules (JOB-291): Added epoch timestamp support to time-of-day policies, permitting absolute start/end epoch constraints alongside recurring Day-of-Week schedules. |
| Agent | Enhancement | Comprehensive Documentation: Added dedicated netify-flow-expressions.7 man page. |
| Agent | Security Fix | mTLS Bootstrap Authentication: Added Mutual TLS (mTLS) authentication for agent provisioning and bootstrap communication with support for custom CA certificates. |
| Agent | Enhancement | Bootstrap Schema Overlays: Added overlay tags and automated license.json upload payloads during bootstrap. |
| Agent | Enhancement | Network Interface Metadata: Added Netlink bridge PVID extraction and context-aware VLAN parsing, wireless SSID discovery via ubus integration (ndUbus), and interface mark-to-ifindex mapping. |
| Agent | Enhancement | Signal Handlers & Control API: Added SIGUSR1 signal to force immediate Netify API / cloud synchronization and Unix socket control commands for instance reload and restart. |
| Processor Intel | Enhancement | Refactored monolithic flow enrichment into standalone, pluggable indicator modules (IP/Domain reputation, VPN detection, active DoH scanner, Geo indicators). |
| Processor Intel | Enhancement | Cloud Intel API HTTP 429 rate-limiting backoff handling with exponential retry and configurable request queue. |
| Processor Intel | Enhancement | Multi-Tier persistent CSV cache indexed across multiple keys with per-indicator score overrides and obfuscated .dat configuration payload support. |
| Processor Intel | Bug | Resolved duplicate attribute generation. |
| Processor Flow Actions | Enhancement | Direct Nftables (nftset) target updates via libmnl and libnfnl, eliminating userland script invocation overhead. |
| Processor Flow Actions | Enhancement | Enabled flow action triggering directly from FLOW_INTEL threat/reputation events across all sinks. |
| Processor Flow Actions | Enhancement | Added application + protocol automapping with graceful protocol fallback. |
| Processor Flow Actions | Enhancement | Added top-level descriptive action tagging for enhanced observability. |
| Processor Flow Actions | Enhancement | Added NFQUEUE interface matching and mark-with-mask application on inspected packets. |
| Processor Flow Actions | Enhancement | Integrated epoch matching for action activation windows. |
| Processor Dev Discovery | Enhancement | Converted host IP tracking from static arrays to dynamic std::vector lists, supporting multi-IP hosts. |
| Processor Dev Discovery | Enhancement | Added address group support for MAC address ignore lists. |
| Processor Dev Discovery | Bug | Prevented agent crash on malformed JSON cache files and suppressed writing empty device caches to disk. |
| Processor Dev Discovery | Enhancement | Integrated with Netify Agent bootstrap metadata pipeline. |
| Processor Aggregator | Enhancement | Implemented Aggregator Type #7 for fine-grained multi-dimensional traffic summaries. |
| Processor Aggregator | Enhancement | Replaced hardcoded NAT checks with dynamic flow criteria in JSON configs. |
| Processor Aggregator | Enhancement | Preserved translated NAT64 port addresses and attached mandatory MAC addresses on aggregated flow records. |
| Processor Aggregator | Enhancement | Converted internal aggregation sample structures to std::shared_ptr to fix memory leaks. |
| Processor Aggregator | Enhancement | Added overlay tag support into Type 6 aggregation records. |
| Processor Lua | Enhancement | Completely replaced legacy C Lua bindings with modern C++ sol2 framework for enhanced execution safety and capabilities. |
| Processor Lua | Enhancement | Synchronized Lua flow object models directly with internal ndFlow fields. |
| Processor Lua | Enhancement | Added support for consuming flow events containing nested JSON payloads (such as FLOW_INTEL). |
| Processor Lua | Enhancement | Replaced deep copies with std::move() zero-copy event dispatch and guaranteed flow table cleanup on errors. |
| Processor Lua | Enhancement | Added dynamic fallback support for Lua 5.3 runtime environments. |
| Processor Python | Enhancement | Added compatibility and build support for Python 3.13 and Python 3.14. |
| Processor Python | Bug | Fixed Python virtual environment (venv) isolation and module discovery paths. |
| Processor Core | Enhancement | Standardized status output metadata (library and name attributes) for UI/UX integration. |
| Processor Core | Enhancement | Upgraded to PLM 1.2+ lifecycle interfaces and modern line break conventions (ADD_LF). |
| Sink UBUS | Enhancement | Added support for Custom Header 2 formatting, including dedicated UCI serialization and payload encoding. |
| Sink UBUS | Enhancement | Added Buildroot packaging definitions and OpenWrt 25.12.x compatibility. |
| Sink UBUS | Enhancement | Decoupled direct libubus link dependencies where dynamic runtime loading is preferred. |
| Sink SQLite | Enhancement | Implemented transaction rollback routines to guarantee database integrity during interrupted write operations. |
| Sink SQLite | Enhancement | Added automatic /db storage directory provisioning in packaging scripts. |
| Sink SQLite | Bug | Fixed prepared statements to properly exclude autoincrement ID keys on insert. |
| Sink SQLite | Enhancement | Added support for storing overlay tags alongside flow records. |
| Sink MQTT | Enhancement | Implemented library and name attributes in runtime status output, migrated to PLM 1.2, and standardized ADD_LF JSON formatting. |
| Sink HTTP | Enhancement | Implemented library and name attributes in runtime status output, migrated to PLM 1.2, and standardized ADD_LF JSON formatting. |
| Sink Socket | Enhancement | Implemented library and name attributes in runtime status output, migrated to PLM 1.2, and standardized ADD_LF JSON formatting. |
| Sink Log | Enhancement | Implemented library and name attributes in runtime status output, migrated to PLM 1.2, and standardized ADD_LF JSON formatting. |
| Build System | Enhancement | OpenWrt: Added full build support and release prefixes for OpenWrt 25.12.x and 24.10, PKG_MIRROR_HASH bypass options, and --enable-interface-metadata toggle. |
| Build System | Enhancement | Buildroot: Added initial Buildroot package definitions across agent core and plugins. |
| Build System | Enhancement | Packaging: Added official build targets for Debian 13 (Trixie) and Ubuntu 26.04 LTS; resolved systemd pkg-config and multi-target dependency issues. |
| Build System | Enhancement | Enterprise Linux: Maintained conditional systemd service definitions for Rocky Linux 9. |
| Build System | Bug | OpenSUSE: Added missing timezone package prerequisites. |
| Developer Tools | Enhancement | Integrated GoogleTest framework with unit tests for flow expressions, hash caches, and packet parsers; added GEMINI.md context files, man pages, and debug-env.sh scripts. |
ABI Version Compatability
The following plugin versions are ABI compatible with Netify Agent version 5.2.9.
| Plugin | Package | Version |
|---|---|---|
| Plugin License Manager | netify-plm | 1.2.2-5 |
| Sink HTTP | netify-sink-http | 1.2.3-3 |
| Sink MQTT | netify-sink-mqtt | 1.2.1-5 |
| Sink Socket | netify-sink-socket | 1.2.1-5 |
| Sink UBUS | netify-sink-ubus | 1.2.6-6 |
| Proc Aggregator | netify-proc-aggregator | 1.2.8-4 |
| Proc Core | netify-proc-core | 1.2.3-4 |
| Proc Device Discovery | netify-proc-dev-discovery | 1.2.11-3 |
| Proc Flow Actions | netify-proc-flow-actions | 1.2.15-3 |
| Proc Intelligence | netify-proc-intel | 1.2.31-3 |
| Proc Lua | netify-proc-lua | 1.2.6-2 |
| Proc Python | netify-proc-python | 1.2.4-2 |