anti
916b21b652
Replace _jarm_phase / _hassh_phase / _tcpfp_phase boilerplate (3×~50
lines of identical port-iteration logic) with a metaclass-registered ABC.
Adding a new port-iterating active probe is now one class + three methods.
- decnet/prober/base.py: ActiveProbeMeta auto-registers subclasses by
probe_name; ActiveProbe ABC enforces run/syslog_fields/publish_payload
with env-driven DECNET_PROBE_PORTS_<NAME> port override.
- decnet/prober/probes/{jarm,hassh,tcpfp}.py: concrete probe classes.
- decnet/prober/worker.py: single _run_probe driver replaces the three
phase functions; _probe_cycle iterates ActiveProbeMeta.all(); drops
the ports=/ssh_ports=/tcpfp_ports= kwargs from prober_worker.
- IPv6 leak and TLS cert capture stay as special cases (different call
shapes; intentionally outside the registry).
- tests/prober/test_active_probe_registry.py: registry contents, sort
order, priority-10 override, ABC contract per probe class.
- tests/prober/test_run_probe_driver.py: dedup, success, None-skip,
exception, rotation, publish paths for _run_probe.
- tests/prober/test_prober_worker.py: updated patch targets and
_probe_cycle call sites; port control via monkeypatch.setattr.
42 lines
1.4 KiB
Python
42 lines
1.4 KiB
Python
from __future__ import annotations
|
|
|
|
from typing import Any
|
|
|
|
from decnet.prober.base import ActiveProbe
|
|
from decnet.prober.hassh import hassh_server
|
|
from decnet.telemetry import traced as _traced
|
|
|
|
DEFAULT_PORTS: list[int] = [22, 2222, 22222, 2022]
|
|
|
|
|
|
class HasshProbe(ActiveProbe):
|
|
probe_name = "hassh"
|
|
default_ports = DEFAULT_PORTS
|
|
event_type = "hassh_fingerprint"
|
|
rotation_type = "hassh"
|
|
rotation_hash_key = "hassh_server"
|
|
priority = 100
|
|
|
|
@_traced("prober.hassh_probe")
|
|
def run(self, ip: str, port: int, timeout: float) -> dict[str, Any] | None:
|
|
return hassh_server(ip, port, timeout=timeout)
|
|
|
|
def syslog_fields(self, ip: str, port: int, result: dict[str, Any]) -> tuple[dict[str, Any], str]:
|
|
fields = {
|
|
"hassh_server_hash": result["hassh_server"],
|
|
"ssh_banner": result["banner"],
|
|
"kex_algorithms": result["kex_algorithms"],
|
|
"encryption_s2c": result["encryption_s2c"],
|
|
"mac_s2c": result["mac_s2c"],
|
|
"compression_s2c": result["compression_s2c"],
|
|
}
|
|
return fields, f"HASSH {ip}:{port} = {result['hassh_server']}"
|
|
|
|
def publish_payload(self, ip: str, port: int, result: dict[str, Any]) -> dict[str, Any]:
|
|
return {
|
|
"attacker_ip": ip,
|
|
"port": port,
|
|
"hassh_server": result["hassh_server"],
|
|
"ssh_banner": result["banner"],
|
|
}
|