anti/DECNET
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

0 Releases 7 Tags

RSS Feed
  • 1.2.1 a9a86c94ad
    Compare

    DECNET 1.2.1 — OS fingerprint cloak

    anti released this 2026-06-20 06:41:13 +02:00 | 0 commits to main since this release

    OS fingerprint cloak — make a decky read as its claimed OS under active
    fingerprinting (nmap -O), not just passively. sysctl profiles only reach global
    packet fields; the cloak owns the SYN-ACK shape and stack behaviours sysctl
    can't reach. Verified live against real nmap -O: a windows decky reads as
    Windows 10 (95%) and a windows_server decky as Windows Server 2012/2016
    (94%)     — up from a Linux 2.6 classification — with client handshakes intact.

    • decnet.cloak — egress TCP/IP masquerading library, run inside the decky base
      container (python -m decnet.cloak, CAP_NET_ADMIN/CAP_NET_RAW):

      • NFQUEUE mangler — rewrites the egress packet shape sysctl cannot set
        per-container: SYN-ACK (TCP option order, window, IP-ID; preserves the
        kernel's live timestamp; recomputes dataofs/checksums), RST (IP-ID + a
        nonzero ack on bare RSTs → nmap CI, T4/T6 A=O), and ICMP echo-reply
        (code=0 → IE.CD=Z). One shared IP-ID counter across all three reads as a
        shared sequence (SS=S).
      • T2/T3 probe-response synthesizer — answers the nmap probes Linux drops
        but Windows replies to (null-flags / SYN+FIN+PSH+URG to an open port).
        Injects at L2 (reflecting the probe's MACs) so its replies bypass the OUTPUT
        chain and coexist with the mangler's RST rule.
      • Profiles live in os_fingerprint.OS_MANGLE, keyed by the same nmap_os
        slug; pure packet-shaping logic is unit-tested offline (scapy/netfilterqueue
        lazy-imported, Linux-only).

    • windows_server nmap_os family — Windows Server stack deltas (ECN negotiated
      CC=Y, randomized IP-ID TI=RD); the windows-server and domain-controller
      archetypes now use it (workstation stays windows).

    • Cloak base image (templates/_shared/cloak/Dockerfile, FROM the per-decky
      distro) and deployer._sync_cloak_sources, which ships the light decnet
      subtree into the build context. Base containers stay netns-safe — the cloak runs
      best-effort behind exec sleep infinity, so a cloak crash never tears down the
      decky or the netns its service containers share.

    • OS fingerprint timestamps bug: the windows sysctl profile disabled TCP
      timestamps, fingerprinting as an ancient stack. Modern Windows 10/11 run
      timestamps on (nmap SEQ.TS=A) — corrected, and the single
      highest-weighted field in the nmap match.

    Downloads