anti
58ca9075db
Outbound calls to 3rd-party services (threat-intel providers, future TI lookups) MUST NOT advertise 'DECNET' in their user-agent — operators running honeypots want their reconnaissance dependencies to look like generic infra. New decnet.net.http.stealth_client() returns a fresh httpx.AsyncClient with a curl-shaped UA (pinned to a single constant so future siblings — browser-shaped, Go-shaped — sit next to it cleanly). Internal egress (webhook → operator's own SIEM, swarm worker → master) keeps its DECNET-tagged UA; the docstring is explicit about not routing those through this client.
8 lines
277 B
Python
8 lines
277 B
Python
"""Shared network helpers.
|
|
|
|
Currently houses :mod:`decnet.net.http` — the canonical stealth-egress
|
|
``httpx.AsyncClient`` factory for outbound calls to 3rd-party services
|
|
that should NOT see "DECNET" in their access logs (threat-intel
|
|
providers, future TI lookups, etc.).
|
|
"""
|