[dependabot]

Bumps the test-e2e-minor-patch group in /test/e2e with 1 update: github.com/gopacket/gopacket.

Updates github.com/gopacket/gopacket from 1.7.4 to 1.7.7

Release notes

Sourced from github.com/gopacket/gopacket's releases.

v1.7.7

Security release. Upgrade if you decode untrusted traffic or reassemble TCP streams from it.

Security fixes

The last seven fixes from Anthropic's automated vulnerability scanner batch. Each one let a sender hide traffic from a monitor that a receiving host would act on.

• TCP: a segment with a bad option length (zero, short, past the option area, or a multipath option of the wrong size) now decodes like a host reads it: options stop there, the segment and its payload stay. It used to fail the layer, so reassembly never saw the segment.
• sFlow: the cursor moves to each sample's and record's declared end when that lies further on inside the datagram, so bytes padded into a sample no longer read as the next sample and hide the ones behind it. Lengths that disagree with the content, which real agents send, are still tolerated.
• EthernetCTP: a skip count past the end of the data is an error instead of a wrong layer.
• DNS over TCP: the two-byte message length in front of each message is stripped when decoding a packet; a pipelined second message is the layer's payload. The layer's own DecodeFromBytes is unchanged, so a DecodingLayerParser behaves as before.
• TLS: a ClientHello split over several handshake records in the same data is reassembled and decoded, so the server name is reported. A hello continued in another segment is still skipped.
• Modbus: every ADU in a segment gets its own layer; an ADU cut short by segmentation stays the last layer's payload, as before.
• DHCPv4: options continued in the file and sname fields (option overload) are decoded and appended to Options. Serializing the layer writes them with those fields, not twice.

Behaviour changes

• A TCP segment with a bad option length no longer carries a decode failure or the truncated flag.
• gopacket.NewPacket on a TCP port 53 segment yields the DNS message behind its length prefix; before, it decoded from the first byte.

v1.7.6

Security release. Upgrade if you decode untrusted traffic, reassemble TCP streams or IP fragments from untrusted traffic, or read capture files from untrusted sources.

Security fixes

One hundred and thirty-six Medium and Low reports from Anthropic's automated vulnerability scanner, plus two from independent reporters. Advisories follow.

Crashes and resource exhaustion in packet decoding

• CDP: address entries, IP prefixes, power TLVs and EnergyWise sub-TLVs are bounds-checked. Crafted lengths used to panic, dereference nil or allocate quadratically, also on 32-bit builds.
• RadioTap: every field is bounds-checked before it is read; the present bitmap, vendor namespaces and the driver padding of short 802.11 frames no longer panic, and headers over 64 KiB decode.
• OSPF, LLDP, BFD, USB, Prism, DHCPv6 and TLS ClientHello: declared lengths that exceed the data or wrap a 16-bit sum return an error instead of panicking.
• DHCPv4: serializing a message over 64 KiB no longer panics. DHCPv6: String() on a large option request is linear.
• SIP: folded headers are unfolded before parsing, which was quadratic; a Content-Length near the 32-bit limit no longer panics on 32-bit builds.
• VerifyChecksums is bounded on deeply nested tunnels and decodes a lazy packet before checking it. ComputeChecksum no longer overflows on jumbograms.
• An empty raw IP record and a pooled packet whose decoder reads past its length no longer panic or read the previous packet.

Bytes leaking between packets

• DHCPv4, DHCPv6, DNS and GRE: SerializeTo zeroes every fixed-width field, so a reused buffer no longer carries the previous packet's bytes.
• TLS: a reused layer no longer keeps earlier packets' records, and with them their buffers, alive.
• NextPacket copies ancillary data, so packets no longer report the latest packet's VLAN.

Misdecoded or hidden traffic

• Tunnels and link layers: GUE (header length in words, variants other than 0 rejected, control messages kept as payload), GRE (Ack bit only in version 1, ERSPAN Type I), GTPv1-U (extension header flag), GTPv2 (version check, message length), Geneve version, VXLAN group policy flag, PPPoE session frames with a non-zero code, 802.1Q tags followed by an 802.3 length, Linux cooked captures of LLC frames, 802.11 vendor information elements.
• IPv4: options of length 2, source-routed checksums, TSO packets over 64 KiB, padding on serialize, IPv6 extension protocol numbers no longer decoded as IPv6 headers.
• IPv6: Hop-by-Hop bounded by the payload length, options bounded by their header, routing headers of every type, jumbograms, Pad1 on serialize and at the end of a header, tunnelled hop-by-hop headers.
• Application protocols: SIP (compact headers, tabs around colons, lower-case versions, GetHeader across both forms), DNS (A and AAAA record lengths), Diameter (unpadded last AVP, several messages per segment), CIP (request path, 16-bit and 32-bit segments), EtherNet/IP (item walk, message length), RADIUS, EAP and EAPOL lengths, SCTP (chunk padding, unknown chunks, bad heartbeat parameters), TCP multipath options on serialize, MLDv2 query codes and short queries, IGMPv3 auxiliary data, ICMPv6 echo payload, BFD trailing bytes, DHCPv6 DUIDs.

IP defragmentation

• IPv4: fragment lists are keyed on the protocol, DF-flagged fragments are reassembled, fragments beyond the final one, overlaps and contradictory ends are refused like a receiver does, repeats are ignored, the overrun check no longer wraps, offsets up to 8189 are accepted, fragments shorter than their length are refused, and the reassembled length includes the header.
• IPv6: lists are keyed on the address pair, atomic fragments are returned at once, overlaps and oversized or unaligned fragments are dropped, the Next Header comes from the first fragment, completed packets are removed, and duplicates no longer reset the age.

... (truncated)

Commits

• dc050b6 layers: honour DHCPv4 Option Overload
• d245cf4 layers: decode every Modbus ADU of a segment
• 029a9e8 layers: decode a ClientHello split over TLS records
• ed582fd layers: strip the length prefix of DNS over TCP
• cf3e4bc layers: reject an EthernetCTP skip count past the data
• 8e603b4 layers: step over sFlow sample and record padding
• 65b2660 layers: keep a TCP segment with a bad option length
• 1b0470b layers: let a parser stop at an IPv6 fragment
• 47fd395 pcapgo: cover truncated snoop and short drop count
• 47b5e55 gopacket: copy ancillary data in NextPacket
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: GameplanePanel/Gameplane
• Branch: master
• File: .coderabbit.yaml
• Commit: 13dd86f
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 56ecf4ee-a36e-4211-81da-b2a272df3083

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[github-actions]

CI Report - a7481dd

run 42736108768 - attempt 2

0 failed - 33 passed - 0 skipped - unknown elapsed

Test selection: full (selection-rule change) - per-suite table

Coverage

Module	Measured	Gate	Margin
web	L95.84 S94.2 B88.51 F91.73	L92 S92 B82 F76	+2.20

Changed

Area	Files	+/-
test/	2	+7/-11
(root)	1	+5/-3

Slowest jobs

no job duration data available

e2e buckets run

bot-fast