merge: testing → main (reconcile 2-week divergence)
This commit is contained in:
24
decnet/templates/mssql/Dockerfile
Normal file
24
decnet/templates/mssql/Dockerfile
Normal file
@@ -0,0 +1,24 @@
|
||||
ARG BASE_IMAGE=debian:bookworm-slim
|
||||
FROM ${BASE_IMAGE}
|
||||
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
python3 \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
COPY syslog_bridge.py /opt/syslog_bridge.py
|
||||
COPY instance_seed.py /opt/instance_seed.py
|
||||
COPY server.py /opt/server.py
|
||||
COPY entrypoint.sh /entrypoint.sh
|
||||
RUN chmod +x /entrypoint.sh
|
||||
|
||||
EXPOSE 1433
|
||||
RUN useradd -r -s /bin/false -d /opt logrelay \
|
||||
&& apt-get update && apt-get install -y --no-install-recommends libcap2-bin \
|
||||
&& rm -rf /var/lib/apt/lists/* \
|
||||
&& (find /usr/bin/ -maxdepth 1 -name 'python3*' -type f -exec setcap 'cap_net_bind_service+eip' {} \; 2>/dev/null || true)
|
||||
|
||||
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
|
||||
CMD kill -0 1 || exit 1
|
||||
|
||||
USER logrelay
|
||||
ENTRYPOINT ["/entrypoint.sh"]
|
||||
3
decnet/templates/mssql/entrypoint.sh
Normal file
3
decnet/templates/mssql/entrypoint.sh
Normal file
@@ -0,0 +1,3 @@
|
||||
#!/bin/bash
|
||||
set -e
|
||||
exec python3 /opt/server.py
|
||||
120
decnet/templates/mssql/instance_seed.py
Normal file
120
decnet/templates/mssql/instance_seed.py
Normal file
@@ -0,0 +1,120 @@
|
||||
#!/usr/bin/env python3
|
||||
"""
|
||||
Per-instance stealth seeding for honeypot service templates.
|
||||
|
||||
The whole decoy fleet looks identical to a scanner unless each decky
|
||||
diverges on the boring details: cluster UUIDs, auth salts, uptime, minor
|
||||
version strings, etc. This module derives a stable per-instance seed
|
||||
from NODE_NAME (+ optional INSTANCE_ID) and exposes helpers that return
|
||||
deterministic-per-decky-but-different-across-the-fleet values.
|
||||
|
||||
Connection-time jitter is intentionally NOT seeded — two hits to the same
|
||||
decky should not replay the same latency curve.
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import asyncio
|
||||
import hashlib
|
||||
import os
|
||||
import random
|
||||
import time
|
||||
import uuid
|
||||
from typing import Sequence, TypeVar
|
||||
|
||||
T = TypeVar("T")
|
||||
|
||||
_HOSTNAME = (
|
||||
os.environ.get("NODE_NAME")
|
||||
or os.environ.get("HOSTNAME")
|
||||
or "decky"
|
||||
)
|
||||
_INSTANCE_ID = os.environ.get("INSTANCE_ID", "")
|
||||
_SEED_MATERIAL = f"{_HOSTNAME}:{_INSTANCE_ID}".encode()
|
||||
_SEED_INT = int.from_bytes(hashlib.sha256(_SEED_MATERIAL).digest()[:8], "big")
|
||||
|
||||
#: Deterministic RNG seeded per decky — use for *persistent* choices
|
||||
#: (versions, UUIDs, stored credentials). Never use for timing.
|
||||
rng = random.Random(_SEED_INT)
|
||||
|
||||
#: Process boot time — real uptime elapsed since container start.
|
||||
_PROCESS_START = time.time()
|
||||
|
||||
#: Deterministic per-instance fake "has been up for this long at boot"
|
||||
#: offset, so every decky pretends to have a different history.
|
||||
_BOOT_OFFSET = rng.randint(3600, 45 * 86400)
|
||||
|
||||
|
||||
def hostname() -> str:
|
||||
return _HOSTNAME
|
||||
|
||||
|
||||
def uptime_seconds() -> int:
|
||||
"""Monotonically increasing, unique per instance."""
|
||||
return int(_BOOT_OFFSET + (time.time() - _PROCESS_START))
|
||||
|
||||
|
||||
def boot_epoch() -> int:
|
||||
"""Fake wall-clock boot time for this instance (seconds since epoch)."""
|
||||
return int(time.time() - uptime_seconds())
|
||||
|
||||
|
||||
def instance_uuid(namespace: str = "") -> str:
|
||||
"""Deterministic UUID4-looking value for this instance+namespace."""
|
||||
ns = uuid.UUID("00000000-0000-0000-0000-000000000000")
|
||||
return str(uuid.uuid5(ns, f"{_HOSTNAME}:{namespace}"))
|
||||
|
||||
|
||||
def instance_hex(nbytes: int, namespace: str = "") -> str:
|
||||
"""Deterministic hex token of given byte length."""
|
||||
material = f"{_HOSTNAME}:{namespace}".encode()
|
||||
digest = hashlib.sha256(material).digest()
|
||||
while len(digest) < nbytes:
|
||||
digest += hashlib.sha256(digest).digest()
|
||||
return digest[:nbytes].hex()
|
||||
|
||||
|
||||
def pick(choices: Sequence[T]) -> T:
|
||||
"""Deterministic choice from a sequence."""
|
||||
return rng.choice(list(choices))
|
||||
|
||||
|
||||
def pick_weighted(choices: Sequence[tuple[T, float]]) -> T:
|
||||
"""Deterministic weighted choice. Input: [(item, weight), ...]."""
|
||||
total = sum(w for _, w in choices)
|
||||
r = rng.uniform(0, total)
|
||||
acc = 0.0
|
||||
for item, w in choices:
|
||||
acc += w
|
||||
if r <= acc:
|
||||
return item
|
||||
return choices[-1][0]
|
||||
|
||||
|
||||
def random_bytes(n: int, namespace: str = "") -> bytes:
|
||||
"""Deterministic per-instance byte string of length n."""
|
||||
out = bytearray()
|
||||
i = 0
|
||||
while len(out) < n:
|
||||
out.extend(
|
||||
hashlib.sha256(f"{_HOSTNAME}:{namespace}:{i}".encode()).digest()
|
||||
)
|
||||
i += 1
|
||||
return bytes(out[:n])
|
||||
|
||||
|
||||
def fresh_bytes(n: int) -> bytes:
|
||||
"""Non-deterministic random bytes — for per-connection nonces/salts."""
|
||||
return os.urandom(n)
|
||||
|
||||
|
||||
async def jitter(min_ms: int = 5, max_ms: int = 120) -> None:
|
||||
"""Async response-time jitter. Uses unseeded RNG so timing varies
|
||||
across connections to the same decky — seeded jitter would leak
|
||||
predictability."""
|
||||
await asyncio.sleep(random.uniform(min_ms, max_ms) / 1000.0)
|
||||
|
||||
|
||||
def jitter_sync(min_ms: int = 5, max_ms: int = 120) -> None:
|
||||
"""Blocking jitter for non-asyncio servers."""
|
||||
time.sleep(random.uniform(min_ms, max_ms) / 1000.0)
|
||||
217
decnet/templates/mssql/server.py
Normal file
217
decnet/templates/mssql/server.py
Normal file
@@ -0,0 +1,217 @@
|
||||
#!/usr/bin/env python3
|
||||
"""
|
||||
MSSQL (TDS)server.
|
||||
Reads TDS pre-login and login7 packets, extracts username, responds with
|
||||
a login failed error. Logs auth attempts as JSON.
|
||||
"""
|
||||
|
||||
import asyncio
|
||||
import base64
|
||||
import os
|
||||
import struct
|
||||
|
||||
import instance_seed as _seed
|
||||
from syslog_bridge import syslog_line, write_syslog_file, forward_syslog
|
||||
|
||||
NODE_NAME = os.environ.get("NODE_NAME", "dbserver")
|
||||
SERVICE_NAME = "mssql"
|
||||
LOG_TARGET = os.environ.get("LOG_TARGET", "")
|
||||
|
||||
# Real SQL Server release families. Pairing (major, minor, build) makes a
|
||||
# subsequent OSQL/sqlcmd version probe line up with what MS published.
|
||||
# Builds are taken from publicly documented latest-CU numbers.
|
||||
_MSSQL_RELEASES = [
|
||||
# (name, major, minor, build, subbuild)
|
||||
("SQL Server 2016", 13, 0, 6419, 0),
|
||||
("SQL Server 2017", 14, 0, 2000, 0),
|
||||
("SQL Server 2017", 14, 0, 3460, 0),
|
||||
("SQL Server 2019", 15, 0, 2000, 0),
|
||||
("SQL Server 2019", 15, 0, 4335, 1),
|
||||
("SQL Server 2022", 16, 0, 1000, 0),
|
||||
("SQL Server 2022", 16, 0, 4115, 2),
|
||||
]
|
||||
_MSSQL_NAME, _VER_MAJ, _VER_MIN, _VER_BUILD, _VER_SUB = _seed.pick(_MSSQL_RELEASES)
|
||||
|
||||
|
||||
def _build_prelogin_response() -> bytes:
|
||||
"""TDS PRELOGIN response. Version option carries
|
||||
major(1) minor(1) build(2, network order) subbuild(2, network order)."""
|
||||
version_data = (
|
||||
bytes([_VER_MAJ & 0xff, _VER_MIN & 0xff])
|
||||
+ struct.pack(">H", _VER_BUILD & 0xffff)
|
||||
+ struct.pack(">H", _VER_SUB & 0xffff)
|
||||
)
|
||||
# Option directory + data. Offsets are from start of directory.
|
||||
# Five options: VERSION, ENCRYPTION, INSTOPT, THREADID, MARS.
|
||||
# Data fields, in order:
|
||||
encryption = b"\x02" # NOT_SUP
|
||||
instopt = b"\x00"
|
||||
threadid = struct.pack("<I", _seed.rng.randint(100, 9000))
|
||||
mars = b"\x00"
|
||||
|
||||
directory = b""
|
||||
data = b""
|
||||
# Directory header is 5 bytes per option + 1 terminator; compute offsets
|
||||
# from end of terminator.
|
||||
dir_size = 5 * 5 + 1
|
||||
running_offset = dir_size
|
||||
|
||||
def add_option(token: int, chunk: bytes) -> None:
|
||||
nonlocal directory, data, running_offset
|
||||
directory += bytes([token]) + struct.pack(">H", running_offset) + struct.pack(">H", len(chunk))
|
||||
data += chunk
|
||||
running_offset += len(chunk)
|
||||
|
||||
add_option(0x00, version_data)
|
||||
add_option(0x01, encryption)
|
||||
add_option(0x02, instopt)
|
||||
add_option(0x03, threadid)
|
||||
add_option(0x04, mars)
|
||||
directory += b"\xff"
|
||||
|
||||
payload = directory + data
|
||||
total_len = 8 + len(payload)
|
||||
header = struct.pack(">BBHBBBB", 0x04, 0x01, total_len, 0x00, 0x00, 0x01, 0x00)
|
||||
return header + payload
|
||||
|
||||
|
||||
_PRELOGIN_RESP = _build_prelogin_response()
|
||||
|
||||
|
||||
|
||||
|
||||
def _log(event_type: str, severity: int = 6, **kwargs) -> None:
|
||||
line = syslog_line(SERVICE_NAME, NODE_NAME, event_type, severity, **kwargs)
|
||||
write_syslog_file(line)
|
||||
forward_syslog(line, LOG_TARGET)
|
||||
|
||||
|
||||
def _tds_error_packet(message: str) -> bytes:
|
||||
msg_enc = message.encode("utf-16-le")
|
||||
# Token type 0xAA = ERROR, followed by length, error number, state, class, msg_len, msg
|
||||
token = (
|
||||
b"\xaa"
|
||||
+ struct.pack("<H", 4 + 1 + 1 + 2 + len(msg_enc) + 1 + 1 + 1 + 1 + 4)
|
||||
+ struct.pack("<I", 18456) # SQL error number: login failed
|
||||
+ b"\x01" # state
|
||||
+ b"\x0e" # class
|
||||
+ struct.pack("<H", len(message))
|
||||
+ msg_enc
|
||||
+ b"\x00" # server name length
|
||||
+ b"\x00" # proc name length
|
||||
+ struct.pack("<I", 1) # line number
|
||||
)
|
||||
done = b"\xfd\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||
payload = token + done
|
||||
header = struct.pack(">BBHBBBB", 0x04, 0x01, len(payload) + 8, 0x00, 0x00, 0x01, 0x00)
|
||||
return header + payload
|
||||
|
||||
|
||||
class MSSQLProtocol(asyncio.Protocol):
|
||||
def __init__(self):
|
||||
self._transport = None
|
||||
self._peer = None
|
||||
self._buf = b""
|
||||
self._prelogin_done = False
|
||||
|
||||
def connection_made(self, transport):
|
||||
self._transport = transport
|
||||
self._peer = transport.get_extra_info("peername", ("?", 0))
|
||||
_log("connect", src=self._peer[0], src_port=self._peer[1])
|
||||
|
||||
def data_received(self, data):
|
||||
self._buf += data
|
||||
while len(self._buf) >= 8:
|
||||
pkt_type = self._buf[0]
|
||||
pkt_len = struct.unpack(">H", self._buf[2:4])[0]
|
||||
if pkt_len < 8:
|
||||
_log("unknown_packet", src=self._peer[0], pkt_type=hex(pkt_type))
|
||||
self._transport.close()
|
||||
self._buf = b""
|
||||
return
|
||||
if len(self._buf) < pkt_len:
|
||||
break
|
||||
payload = self._buf[8:pkt_len]
|
||||
self._buf = self._buf[pkt_len:]
|
||||
self._handle_packet(pkt_type, payload)
|
||||
if self._transport.is_closing():
|
||||
self._buf = b""
|
||||
break
|
||||
|
||||
def _handle_packet(self, pkt_type: int, payload: bytes):
|
||||
if pkt_type == 0x12: # Pre-login
|
||||
self._transport.write(_PRELOGIN_RESP)
|
||||
self._prelogin_done = True
|
||||
elif pkt_type == 0x10: # Login7
|
||||
username, password = self._parse_login7_creds(payload)
|
||||
extra: dict = {}
|
||||
if password:
|
||||
pw_bytes = password.encode("utf-8")
|
||||
extra = {
|
||||
"principal": username,
|
||||
"secret_kind": "plaintext",
|
||||
"secret_printable": password,
|
||||
"secret_b64": base64.b64encode(pw_bytes).decode("ascii"),
|
||||
}
|
||||
_log("auth", src=self._peer[0], username=username, **extra)
|
||||
self._transport.write(_tds_error_packet("Login failed for user."))
|
||||
self._transport.close()
|
||||
else:
|
||||
_log("unknown_packet", src=self._peer[0], pkt_type=hex(pkt_type))
|
||||
self._transport.close()
|
||||
|
||||
@staticmethod
|
||||
def _deobfuscate_login7_password(blob: bytes) -> str:
|
||||
"""MS-TDS Login7 password obfuscation: each byte was rotated-right
|
||||
4 bits then XOR'd with 0xa5. Inverse is XOR 0xa5 then rotate-left
|
||||
4 bits (== nibble swap). Plaintext-recoverable.
|
||||
|
||||
After deobfuscation the bytes are UTF-16-LE encoded characters."""
|
||||
out = bytearray(len(blob))
|
||||
for i, b in enumerate(blob):
|
||||
x = b ^ 0xa5
|
||||
out[i] = ((x & 0x0f) << 4) | ((x & 0xf0) >> 4)
|
||||
return bytes(out).decode("utf-16-le", errors="replace")
|
||||
|
||||
def _parse_login7_creds(self, payload: bytes) -> tuple[str, str]:
|
||||
"""Login7 offset table starts at payload offset 36:
|
||||
|
||||
36-37 ibHostName 38-39 cchHostName
|
||||
40-41 ibUserName 42-43 cchUserName
|
||||
44-45 ibPassword 46-47 cchPassword
|
||||
|
||||
Both lengths are CHARACTER counts; multiply by 2 for byte length.
|
||||
The password field is XOR/swap-obfuscated — see
|
||||
:meth:`_deobfuscate_login7_password`. Plaintext-recoverable.
|
||||
"""
|
||||
try:
|
||||
if len(payload) < 48:
|
||||
return "<short_packet>", ""
|
||||
user_off, user_len = struct.unpack("<HH", payload[40:44])
|
||||
pw_off, pw_len = struct.unpack("<HH", payload[44:48])
|
||||
username = payload[user_off:user_off + user_len * 2].decode(
|
||||
"utf-16-le", errors="replace"
|
||||
)
|
||||
password = ""
|
||||
if pw_len:
|
||||
password = self._deobfuscate_login7_password(
|
||||
payload[pw_off:pw_off + pw_len * 2]
|
||||
)
|
||||
return username, password
|
||||
except Exception:
|
||||
return "<parse_error>", ""
|
||||
|
||||
def connection_lost(self, exc):
|
||||
_log("disconnect", src=self._peer[0] if self._peer else "?")
|
||||
|
||||
|
||||
async def main():
|
||||
_log("startup", msg=f"MSSQL server starting as {NODE_NAME}")
|
||||
loop = asyncio.get_running_loop()
|
||||
server = await loop.create_server(MSSQLProtocol, "0.0.0.0", 1433) # nosec B104
|
||||
async with server:
|
||||
await server.serve_forever()
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
asyncio.run(main())
|
||||
261
decnet/templates/mssql/syslog_bridge.py
Normal file
261
decnet/templates/mssql/syslog_bridge.py
Normal file
@@ -0,0 +1,261 @@
|
||||
#!/usr/bin/env python3
|
||||
"""
|
||||
Shared RFC 5424 syslog helper used by service containers.
|
||||
|
||||
Services call syslog_line() to format an RFC 5424 message, then
|
||||
write_syslog_file() to emit it to stdout — the container runtime
|
||||
captures it, and the host-side collector streams it into the log file.
|
||||
|
||||
RFC 5424 structure:
|
||||
<PRI>1 TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SD-ELEMENT] MSG
|
||||
|
||||
Facility: local0 (16). SD element ID uses PEN 55555.
|
||||
"""
|
||||
|
||||
import base64
|
||||
import re
|
||||
from datetime import datetime, timezone
|
||||
from typing import Any, Optional
|
||||
|
||||
# ─── Constants ────────────────────────────────────────────────────────────────
|
||||
|
||||
_FACILITY_LOCAL0 = 16
|
||||
_SD_ID = "relay@55555"
|
||||
_NILVALUE = "-"
|
||||
|
||||
SEVERITY_EMERG = 0
|
||||
SEVERITY_ALERT = 1
|
||||
SEVERITY_CRIT = 2
|
||||
SEVERITY_ERROR = 3
|
||||
SEVERITY_WARNING = 4
|
||||
SEVERITY_NOTICE = 5
|
||||
SEVERITY_INFO = 6
|
||||
SEVERITY_DEBUG = 7
|
||||
|
||||
_MAX_HOSTNAME = 255
|
||||
_MAX_APPNAME = 48
|
||||
_MAX_MSGID = 32
|
||||
|
||||
# ─── Formatter ────────────────────────────────────────────────────────────────
|
||||
|
||||
def _sd_escape(value: str) -> str:
|
||||
"""Escape SD-PARAM-VALUE per RFC 5424 §6.3.3."""
|
||||
return value.replace("\\", "\\\\").replace('"', '\\"').replace("]", "\\]")
|
||||
|
||||
|
||||
def _sd_element(fields: dict[str, Any]) -> str:
|
||||
if not fields:
|
||||
return _NILVALUE
|
||||
params = " ".join(f'{k}="{_sd_escape(str(v))}"' for k, v in fields.items())
|
||||
return f"[{_SD_ID} {params}]"
|
||||
|
||||
|
||||
def syslog_line(
|
||||
service: str,
|
||||
hostname: str,
|
||||
event_type: str,
|
||||
severity: int = SEVERITY_INFO,
|
||||
timestamp: datetime | None = None,
|
||||
msg: str | None = None,
|
||||
**fields: Any,
|
||||
) -> str:
|
||||
"""
|
||||
Return a single RFC 5424-compliant syslog line (no trailing newline).
|
||||
|
||||
Args:
|
||||
service: APP-NAME (e.g. "http", "mysql")
|
||||
hostname: HOSTNAME (node name)
|
||||
event_type: MSGID (e.g. "request", "login_attempt")
|
||||
severity: Syslog severity integer (default: INFO=6)
|
||||
timestamp: UTC datetime; defaults to now
|
||||
msg: Optional free-text MSG
|
||||
**fields: Encoded as structured data params
|
||||
"""
|
||||
pri = f"<{_FACILITY_LOCAL0 * 8 + severity}>"
|
||||
ts = (timestamp or datetime.now(timezone.utc)).isoformat()
|
||||
host = (hostname or _NILVALUE)[:_MAX_HOSTNAME]
|
||||
appname = (service or _NILVALUE)[:_MAX_APPNAME]
|
||||
msgid = (event_type or _NILVALUE)[:_MAX_MSGID]
|
||||
sd = _sd_element(fields)
|
||||
message = f" {msg}" if msg else ""
|
||||
return f"{pri}1 {ts} {host} {appname} {_NILVALUE} {msgid} {sd}{message}"
|
||||
|
||||
|
||||
def encode_secret(secret: str) -> dict[str, str]:
|
||||
"""Standardized credential-secret encoding for the universal SD-block shape.
|
||||
|
||||
Returns ``{'secret_printable': ..., 'secret_b64': ...}`` ready to spread
|
||||
into a :func:`syslog_line` / ``_log`` call::
|
||||
|
||||
_log("auth_attempt", principal=user, **encode_secret(password))
|
||||
|
||||
``secret_printable`` mirrors auth-helper.c's sd_escape: bytes outside
|
||||
``[0x20, 0x7f)`` collapse to ``'?'`` so the field is always parser-safe
|
||||
RFC 5424 ASCII. ``secret_b64`` preserves the *original* utf-8 bytes —
|
||||
NUL/0xff/control/non-utf8 sequences all survive losslessly, useful as
|
||||
a fingerprinting signal even when the printable form sanitizes them.
|
||||
|
||||
The decnet web ingester's native-shape branch keys off ``secret_b64``
|
||||
being present, so any service emitter calling this helper lands its
|
||||
cred attempt directly in the :class:`Credential` table.
|
||||
"""
|
||||
raw = secret.encode("utf-8", errors="replace")
|
||||
printable = "".join(chr(b) if 0x20 <= b < 0x7f else "?" for b in raw)
|
||||
return {
|
||||
"secret_printable": printable,
|
||||
"secret_b64": base64.b64encode(raw).decode("ascii"),
|
||||
}
|
||||
|
||||
|
||||
_DIGEST_PARAM_RE = re.compile(r'(\w+)\s*=\s*"([^"]*)"|(\w+)\s*=\s*([^,\s]+)')
|
||||
|
||||
|
||||
def classify_authorization(header_value: Optional[str]) -> Optional[dict[str, Any]]:
|
||||
"""Parse an HTTP Authorization header value into Credential SD fields.
|
||||
|
||||
Returns a dict with the universal cred shape ready to spread into a
|
||||
``_log(...)`` call::
|
||||
|
||||
auth = request.headers.get("Authorization")
|
||||
cred = classify_authorization(auth)
|
||||
if cred:
|
||||
_log("auth_attempt", **cred)
|
||||
|
||||
Recognised schemes:
|
||||
* Basic — base64(user:pw); decoded → ``principal=user`` +
|
||||
``secret_kind="plaintext"`` + ``encode_secret(pw)``.
|
||||
* Bearer / Token — opaque token; ``principal=None`` +
|
||||
``secret_kind="http_bearer"`` + ``encode_secret(token)``.
|
||||
* Digest — ``principal=username`` from header +
|
||||
``secret_kind="http_digest_md5"`` + ``encode_secret(response)``.
|
||||
|
||||
Returns ``None`` for anything unrecognized (AWS4-HMAC-SHA256, NTLM,
|
||||
Negotiate, …) — callers can still log the raw header value in the
|
||||
ambient SD-block; we just don't know how to extract a hashable
|
||||
secret from it.
|
||||
"""
|
||||
if not header_value or not isinstance(header_value, str):
|
||||
return None
|
||||
parts = header_value.strip().split(None, 1)
|
||||
if len(parts) < 2:
|
||||
return None
|
||||
scheme, rest = parts[0].lower(), parts[1].strip()
|
||||
|
||||
if scheme == "basic":
|
||||
try:
|
||||
decoded = base64.b64decode(rest, validate=True).decode("utf-8", errors="replace")
|
||||
except (ValueError, base64.binascii.Error):
|
||||
return None
|
||||
if ":" not in decoded:
|
||||
return None
|
||||
user, _, pw = decoded.partition(":")
|
||||
return {
|
||||
"principal": user,
|
||||
"secret_kind": "plaintext",
|
||||
**encode_secret(pw),
|
||||
}
|
||||
|
||||
if scheme in ("bearer", "token"):
|
||||
return {
|
||||
"principal": None,
|
||||
"secret_kind": "http_bearer",
|
||||
**encode_secret(rest),
|
||||
}
|
||||
|
||||
if scheme == "digest":
|
||||
params: dict[str, str] = {}
|
||||
for m in _DIGEST_PARAM_RE.finditer(rest):
|
||||
k = m.group(1) or m.group(3)
|
||||
v = m.group(2) if m.group(2) is not None else m.group(4)
|
||||
if k:
|
||||
params[k.lower()] = v
|
||||
response = params.get("response")
|
||||
if not response:
|
||||
return None
|
||||
return {
|
||||
"principal": params.get("username"),
|
||||
"secret_kind": "http_digest_md5",
|
||||
**encode_secret(response),
|
||||
}
|
||||
|
||||
return None
|
||||
|
||||
|
||||
_FORM_PRINCIPAL_KEYS = (
|
||||
"username", "user", "email", "login", "userid", "account",
|
||||
"log", # wp-login.php
|
||||
"user_login", # WordPress alt
|
||||
"uname", # phpMyAdmin
|
||||
"pma_username",
|
||||
)
|
||||
_FORM_SECRET_KEYS = (
|
||||
"password", "pass", "pwd", "passwd", "passwort", "mot_de_passe",
|
||||
"user_password", # WordPress alt
|
||||
"pma_password", # phpMyAdmin
|
||||
)
|
||||
|
||||
|
||||
def extract_form_credentials(
|
||||
body: Optional[str],
|
||||
content_type: Optional[str],
|
||||
) -> Optional[dict[str, Any]]:
|
||||
"""Parse an `application/x-www-form-urlencoded` body for credentials.
|
||||
|
||||
Returns the universal cred SD shape ready to spread into a
|
||||
``_log(...)`` call when both a principal-shaped key and a secret-
|
||||
shaped key are present in the body. Otherwise returns ``None``.
|
||||
|
||||
Field-name detection is case-insensitive and covers the most common
|
||||
login-form variants (WordPress wp-login.php, phpMyAdmin, Joomla,
|
||||
etc.). Add more entries to ``_FORM_PRINCIPAL_KEYS`` /
|
||||
``_FORM_SECRET_KEYS`` as new templates surface them.
|
||||
"""
|
||||
if not body or not isinstance(content_type, str):
|
||||
return None
|
||||
if not content_type.lower().startswith("application/x-www-form-urlencoded"):
|
||||
return None
|
||||
|
||||
fields: dict[str, str] = {}
|
||||
for pair in body.split("&"):
|
||||
if "=" not in pair:
|
||||
continue
|
||||
k, _, v = pair.partition("=")
|
||||
# urllib decode without importing urllib at module scope (the
|
||||
# template emitters are import-cost-sensitive). Inline the
|
||||
# tiny percent-decode + plus-decode.
|
||||
try:
|
||||
from urllib.parse import unquote_plus
|
||||
key = unquote_plus(k).lower()
|
||||
val = unquote_plus(v)
|
||||
except Exception:
|
||||
continue
|
||||
# First-wins so duplicate-key forms don't get clobbered.
|
||||
fields.setdefault(key, val)
|
||||
|
||||
principal: Optional[str] = None
|
||||
for k in _FORM_PRINCIPAL_KEYS:
|
||||
if k in fields:
|
||||
principal = fields[k]
|
||||
break
|
||||
secret: Optional[str] = None
|
||||
for k in _FORM_SECRET_KEYS:
|
||||
if k in fields:
|
||||
secret = fields[k]
|
||||
break
|
||||
if secret is None:
|
||||
return None
|
||||
return {
|
||||
"principal": principal,
|
||||
"secret_kind": "plaintext",
|
||||
**encode_secret(secret),
|
||||
}
|
||||
|
||||
|
||||
def write_syslog_file(line: str) -> None:
|
||||
"""Emit a syslog line to stdout for container log capture."""
|
||||
print(line, flush=True)
|
||||
|
||||
|
||||
def forward_syslog(line: str, log_target: str) -> None:
|
||||
"""No-op stub. TCP forwarding is handled by rsyslog, not by service containers."""
|
||||
pass
|
||||
Reference in New Issue
Block a user