anti
4c37ece39e
Adds a new decnet orchestrate worker whose job is to keep the honeypot
ecosystem from looking suspiciously static — a frozen LAN with no
inter-host traffic and no filesystem aging is its own honeypot tell.
MVP scope:
- New OrchestratorEvent table + repo methods (purpose-built sibling
to Log so synthetic events stay separable from attacker-driven ones).
- New orchestrator.{activity,file}.<decky_id> bus topics +
system.orchestrator.health heartbeat.
- SSH-only driver. Traffic action runs python3 inside src container
to TCP-connect dst:22 and read the SSH banner — real on-the-wire
SSH-protocol traffic without shipping creds. File action drops or
refreshes a small file via docker exec on the destination.
- Random scheduler (50/50 traffic/file when >=2 SSH-capable deckies
are running). Diurnal shaping, role-aware pairing, and session-aware
backoff are explicit non-goals for MVP.
- CLI registration, systemd unit (SupplementaryGroups=docker),
worker-registry entry so the dashboard shows orchestrator health.
- 11 tests: scheduler policy, driver argv shape + injection-safety,
end-to-end one-tick integration with FakeBus + SQLite.
54 lines
1.8 KiB
Python
54 lines
1.8 KiB
Python
"""DB-row + bus-topic helpers for the orchestrator."""
|
|
from __future__ import annotations
|
|
|
|
from datetime import datetime, timezone
|
|
from typing import Any
|
|
|
|
from decnet.bus import topics as _topics
|
|
from decnet.orchestrator.drivers.base import ActivityResult
|
|
from decnet.orchestrator.scheduler import Action, FileAction, TrafficAction
|
|
|
|
|
|
def to_row(action: Action, result: ActivityResult) -> dict[str, Any]:
|
|
"""Build the kwargs dict for ``OrchestratorEvent(**...)``."""
|
|
base: dict[str, Any] = {
|
|
"ts": datetime.now(timezone.utc),
|
|
"protocol": "ssh",
|
|
"success": result.success,
|
|
"payload": result.payload, # repo serialises dict→json
|
|
}
|
|
if isinstance(action, TrafficAction):
|
|
base.update(
|
|
kind="traffic",
|
|
action=f"exec:{action.description}",
|
|
src_decky_uuid=action.src_uuid,
|
|
dst_decky_uuid=action.dst_uuid,
|
|
)
|
|
elif isinstance(action, FileAction):
|
|
base.update(
|
|
kind="file",
|
|
action=action.description,
|
|
src_decky_uuid=None,
|
|
dst_decky_uuid=action.dst_uuid,
|
|
)
|
|
else:
|
|
raise TypeError(f"unsupported action type: {type(action)!r}")
|
|
return base
|
|
|
|
|
|
def topic_for(action: Action) -> str:
|
|
"""Map an action to its bus topic."""
|
|
if isinstance(action, TrafficAction):
|
|
return _topics.orchestrator(_topics.ORCHESTRATOR_ACTIVITY, action.dst_uuid)
|
|
if isinstance(action, FileAction):
|
|
return _topics.orchestrator(_topics.ORCHESTRATOR_FILE, action.dst_uuid)
|
|
raise TypeError(f"unsupported action type: {type(action)!r}")
|
|
|
|
|
|
def event_type_for(action: Action) -> str:
|
|
if isinstance(action, TrafficAction):
|
|
return _topics.ORCHESTRATOR_ACTIVITY
|
|
if isinstance(action, FileAction):
|
|
return _topics.ORCHESTRATOR_FILE
|
|
raise TypeError(f"unsupported action type: {type(action)!r}")
|