anti
3404e3b3a6
Closes the cred-coverage gap for 7 services that already had the data
on the wire but never landed it in the Credential table:
- SNMP — community string lands as secret_kind="snmp_community",
principal=None (v1/v2c has no per-user identity, the community IS
the auth).
- SIP — Digest response hash, previously buried in the auth= header
dump, now classify_authorization()-extracted.
- HTTP / HTTPS — Authorization header was in the headers JSON but
never extracted. Now Basic decodes to plaintext, Bearer →
http_bearer (principal=None), Digest → http_digest_md5.
- K8s — already extracted Authorization but didn't normalize. Service-
account JWTs flow through as Bearer.
- Docker API — headers absent entirely. Adds the headers JSON dump
and runs Authorization through the classifier.
- Elasticsearch — five distinct request handlers; each gains a
per-handler _cred_fields() helper.
Adds canonical templates/syslog_bridge.py:classify_authorization().
Recognised: Basic / Bearer / Token / Digest. Unknown schemes (NTLM,
AWS4-HMAC, Negotiate) return None; the header still rides in the
ambient SD-block but isn't normalized as a credential. The SD shape
on the wire collapses sip_digest_md5 into http_digest_md5 — same
algorithm, so cross-protocol reuse correlates correctly when (rare)
nonce collisions allow.
Drive-by repair of tests/core/test_fingerprinting.py:
- The pre-existing `test_http_useragent_extracted` asserted both that
add_bounty was called exactly once AND that the UA payload carried
`path` and `method` fields. Both wrong since this session opened:
the http_quirks fingerprint added later fires too, and the UA
payload never actually included path/method despite the assertion.
- Adds `path`/`method` to the UA fingerprint payload (real operator
value: "Nikto hit /admin" beats "Nikto seen on this decky").
- Replaces `assert_awaited_once` with a `_find_ua_bounty()` helper
that filters add_bounty calls by `fingerprint_type`. New fingerprint
families landing later won't retroactively break old tests.
- Updates the two credential-bearing tests to use the post-DEBT-039
native shape (`secret_b64` / `principal`) and `upsert_credential`,
not the deleted legacy `username+password` adapter.
Also rebuilds the per-service fake `syslog_bridge` modules in
tests/service_testing/{conftest,test_imap,test_pop3,test_snmp,test_mqtt,test_smtp}.py
to expose `encode_secret` + `classify_authorization`. Service templates
that import either now no longer fail at test collection.
173 tests pass in the touched scope. Phases 2-7 still pending.
125 lines
3.1 KiB
Python
125 lines
3.1 KiB
Python
#!/usr/bin/env python3
|
|
"""
|
|
Docker APIserver.
|
|
Serves a fake Docker REST API on port 2375. Responds to common recon
|
|
endpoints (/version, /info, /containers/json, /images/json) with plausible
|
|
but fake data. Logs all requests as JSON.
|
|
"""
|
|
|
|
import json
|
|
import os
|
|
|
|
from flask import Flask, request
|
|
from syslog_bridge import (
|
|
classify_authorization,
|
|
forward_syslog,
|
|
syslog_line,
|
|
write_syslog_file,
|
|
)
|
|
|
|
NODE_NAME = os.environ.get("NODE_NAME", "docker-host")
|
|
SERVICE_NAME = "docker_api"
|
|
LOG_TARGET = os.environ.get("LOG_TARGET", "")
|
|
|
|
app = Flask(__name__)
|
|
|
|
_VERSION = {
|
|
"Version": "24.0.5",
|
|
"ApiVersion": "1.43",
|
|
"MinAPIVersion": "1.12",
|
|
"GitCommit": "ced0996",
|
|
"GoVersion": "go1.20.6",
|
|
"Os": "linux",
|
|
"Arch": "amd64",
|
|
"KernelVersion": "5.15.0-76-generic",
|
|
}
|
|
|
|
_INFO = {
|
|
"ID": "FAKE:FAKE:FAKE:FAKE",
|
|
"Containers": 3,
|
|
"ContainersRunning": 3,
|
|
"Images": 7,
|
|
"Driver": "overlay2",
|
|
"MemoryLimit": True,
|
|
"SwapLimit": True,
|
|
"KernelMemory": False,
|
|
"Name": NODE_NAME,
|
|
"DockerRootDir": "/var/lib/docker",
|
|
"HttpProxy": "",
|
|
"HttpsProxy": "",
|
|
"NoProxy": "",
|
|
"ServerVersion": "24.0.5",
|
|
}
|
|
|
|
_CONTAINERS = [
|
|
{
|
|
"Id": "a1b2c3d4e5f6",
|
|
"Names": ["/webapp"],
|
|
"Image": "nginx:latest",
|
|
"State": "running",
|
|
"Status": "Up 3 days",
|
|
"Ports": [{"IP": "0.0.0.0", "PrivatePort": 80, "PublicPort": 8080, "Type": "tcp"}], # nosec B104
|
|
}
|
|
]
|
|
|
|
|
|
|
|
|
|
def _log(event_type: str, severity: int = 6, **kwargs) -> None:
|
|
line = syslog_line(SERVICE_NAME, NODE_NAME, event_type, severity, **kwargs)
|
|
write_syslog_file(line)
|
|
forward_syslog(line, LOG_TARGET)
|
|
|
|
|
|
@app.before_request
|
|
def log_request():
|
|
cred = classify_authorization(request.headers.get("Authorization"))
|
|
_log(
|
|
"request",
|
|
method=request.method,
|
|
path=request.path,
|
|
remote_addr=request.remote_addr,
|
|
headers=json.dumps(dict(request.headers)),
|
|
body=request.get_data(as_text=True)[:512],
|
|
**(cred or {}),
|
|
)
|
|
|
|
|
|
@app.route("/version")
|
|
@app.route("/<ver>/version")
|
|
def version(ver=None):
|
|
return app.response_class(json.dumps(_VERSION), mimetype="application/json")
|
|
|
|
|
|
@app.route("/info")
|
|
@app.route("/<ver>/info")
|
|
def info(ver=None):
|
|
return app.response_class(json.dumps(_INFO), mimetype="application/json")
|
|
|
|
|
|
@app.route("/containers/json")
|
|
@app.route("/<ver>/containers/json")
|
|
def containers(ver=None):
|
|
return app.response_class(json.dumps(_CONTAINERS), mimetype="application/json")
|
|
|
|
|
|
@app.route("/images/json")
|
|
@app.route("/<ver>/images/json")
|
|
def images(ver=None):
|
|
return app.response_class(json.dumps([]), mimetype="application/json")
|
|
|
|
|
|
@app.route("/", defaults={"path": ""})
|
|
@app.route("/<path:path>", methods=["GET", "POST", "PUT", "DELETE"])
|
|
def catch_all(path):
|
|
return app.response_class(
|
|
json.dumps({"message": "page not found", "response": 404}),
|
|
status=404,
|
|
mimetype="application/json",
|
|
)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
_log("startup", msg=f"Docker API server starting as {NODE_NAME}")
|
|
app.run(host="0.0.0.0", port=2375, debug=False) # nosec B104
|