## stamparm/maltrail — 3.3…3.4

_91 commits._

### Fixes
- **Fix the http fuzz target, which had not compiled since request_line changed** (f0fee9d)

### Backend
- **The release gate could not build the thing it gates** (9f9c521)
- **Version 3.4, and docs/compat leads with what Windows does** (10963ce)
- **The released Linux sensor could not capture at all** (8534c77)
- **The matrix can now tell whether the sensor ever sees a packet** (4609f4b)
- **A compat job could publish a row it never recorded** (26644cb)
- **Minor update of copyright header** (00b5576)
- **Minor update of props** (c3d3708)
- **Minor update** (c6121e0)
- **'any' is a Linux device; substitute the real ones everywhere else** (6e2244b)
- **Say which Windows the Windows build needs** (5ec85d2)
- **Run the Windows sensor, on Linux, in CI** (fd2f502)
- **Four Windows bugs, found by running the sensor under Wine** (eac6dda)
- **README names the platforms that were actually tested** (77d4e5a)
- **Ask the right privilege question on each platform, and say what Windows can do** (00c9c11)
- **Windows gets a CI build and a release binary** (04a2327)
- **The sensor compiles for Windows** (f51d907)
- **The Windows job reported zero errors against twenty-four** (e24d1e3)
- **Measure the distance to Windows instead of guessing at it** (44e662f)
- **Ship what the documentation claims: FreeBSD and macOS releases** (cac880d)
- **Publish the platform matrix: 19 platforms, 152 capabilities, none failing** (543f8c0)
- **The install and the checks were looking at different unit directories** (1f014c5)
- **The sensor could not read memory off Linux, and nobody looked at BSD service files** (faf12f9)
- **FreeBSD needed sqlite3, macOS needed a group that actually exists** (ec5eec0)
- **Four Linux assumptions that stopped the installer on FreeBSD and macOS** (89a6158)
- **The native rows uploaded nothing, and nothing said so** (0500418)
- **Close the platform gaps: BSD and macOS get an installer, services and a CI row** (d5129b9)
- **The sensor was three symbols away from compiling on FreeBSD** (b4d8d67)
- **Stop publishing the host's kernel on every platform row** (1e69e4f)
- **The harness supplies a musl sensor to musl environments** (8d24432)
- **Ship a musl sensor: Alpine had a packaging gap dressed up as a platform limit** (a167837)
- **Each compat job uploads only the row it recorded** (c9dcbd2)
- **A row is per platform AND architecture, and CI stops checking itself** (c04cd53)
- **Publish where Maltrail is known to run, from rows nobody types** (b7442b5)
- **install.sh died on the whole RHEL 9 family, and nobody had run it there** (ed471d2)
- **server.py called update_drop() without importing it** (44523af)
- **Spamhaus DROP as a /check_ip verdict (#19598)** (37a26be)
- **Drop cleantalk, unmerge the CIDR scanner list, stop calling Googlebot an attacker** (adcf3cd)
- **Drop two frozen feeds, expand DShield's subnets, and watch for the next one** (7256e45)
- **Keep the from-disk dashboard working, and prove it** (70272a6)
- **The dashboard ranks with the server's policy, not a copy of it** (6e42309)
- **One severity policy, not two (#19622)** (0b0b657)
- **Show the threat class for feed infos that never carried one (#19621)** (71f0e1c)
- **Whitelist 1rpc.io, and honour the whitelist in the derived blocklist** (4a36276)
- **Derive a domain-only malware list for the DNS filters (#19620)** (896b363)
- **Heuristics rank below feeds, and the IoT dropper needs OUR host (#19621, #19622)** (b216302)
- **Derive the demo's day instead of hardcoding it** (bac7314)
- **Demo must not offer what it has no server for** (5b6dc57)
- **Compute the demo's country codes instead of hashing the IP** (0dc4cdb)
- **Demo is a monitored LAN, not an ISP backbone** (e0d51a9)
- **Demo must never name a real address as malicious** (75c2812)
- **Drop the last backdrop-filter, and stop animating box-shadow** (c6617cf)
- **Fixing the Reference** (49f7566)
- **The dashboard silently dropped every JA3 and JA4 detection** (a44867c)
- **demo.js: cover every detection class, and halve the old noise** (48abdc2)
- **Remove stamparm/aux, which no longer exists** (ed997d0)
- **Top up demo.js with the shapes it never had** (703b395)
- **--detect-test --keep DIR [--serve]: keep the events and show them** (29cbe56)
- **DISABLED_HEURISTICS: document all eight, warn on a name that is not one** (5b366ab)
- **Remove the cargo-fuzz crate; nothing ever ran it** (d5fcd9f)
- **Guard every doctor check against being unregistered** (91edc4a)
- **Remove core/parallel.py, the retired mmap ring** (334f8ea)
- **/geo skipped JSON lines and misread a quoted sensor name** (2b349ed)
- **Scope the source-tree guard to the source tree** (289d9d6)
- **cleared.txt did nothing on a JSON log** (eeb74e2)
- **/fail2ban published a field fragment instead of the attacker** (7e012a1)
- **Scope must not match an address inside a domain name** (b074212)
- **Restore the wildcard trail vectors** (cf8a13b)
- **Reap event-index sidecars whose log is gone** (e43985f)
- **Mask (custom) on the reference field, not anywhere in the line** (d9467ae)
- **Extend the parser fuzzing, and make parse_tcp/parse_udp total** (8482524)
- **Remove core/fastfilter.py and its test** (15f7bff)
- **Reorder the /live comments to match the code** (d75f2a1)
- **Ignore the coverage data file** (34aa6df)
- **Fetch ipcat to a temp file instead of truncating the cache first** (1b1c65a)
- **Guard the two unguarded strptime calls** (3f26d1a)
- **str.isdigit() is not a guard for int()** (f4daaa6)
- **Stop run.sh hiding a whole test file when pcapy is missing** (252d58e)
- **Make /hunt fail closed on netfilters that do not parse** (4da55f1)
- **Pin the cases where the scope shortcut must decline** (63ebdaa)
- **Test that an event reaching the scope from outside is still counted** (0bc6187)
- **Accept a scoped line on its source field before the full scan** (afce73a)
- **Ignore LOOP.md, the improvement-loop working document** (2aa807a)
- **Regenerate settings_gen.rs and open a PR when an input changes** (b6dd621)
- **Say in ua.txt that editing it means regenerating the sensor's copy** (d3f812e)
- **Regenerate settings_gen.rs after the ua.txt updates** (da9869c)
- **Make the replay window configurable, and say what it is actually for** (aca3a67)
- **Authenticate LOG_SERVER event datagrams (LOG_SERVER_SECRET)** (2357bb4)
- **Update ua.txt** (7a53685)
- **Update ua.txt** (947c310)
- **Update worst_asns.txt** (214be23)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/stamparm/maltrail?utm_source=github-action)._