anti
916b21b652
Replace _jarm_phase / _hassh_phase / _tcpfp_phase boilerplate (3×~50
lines of identical port-iteration logic) with a metaclass-registered ABC.
Adding a new port-iterating active probe is now one class + three methods.
- decnet/prober/base.py: ActiveProbeMeta auto-registers subclasses by
probe_name; ActiveProbe ABC enforces run/syslog_fields/publish_payload
with env-driven DECNET_PROBE_PORTS_<NAME> port override.
- decnet/prober/probes/{jarm,hassh,tcpfp}.py: concrete probe classes.
- decnet/prober/worker.py: single _run_probe driver replaces the three
phase functions; _probe_cycle iterates ActiveProbeMeta.all(); drops
the ports=/ssh_ports=/tcpfp_ports= kwargs from prober_worker.
- IPv6 leak and TLS cert capture stay as special cases (different call
shapes; intentionally outside the registry).
- tests/prober/test_active_probe_registry.py: registry contents, sort
order, priority-10 override, ABC contract per probe class.
- tests/prober/test_run_probe_driver.py: dedup, success, None-skip,
exception, rotation, publish paths for _run_probe.
- tests/prober/test_prober_worker.py: updated patch targets and
_probe_cycle call sites; port control via monkeypatch.setattr.
33 lines
1.1 KiB
Python
33 lines
1.1 KiB
Python
from __future__ import annotations
|
|
|
|
from typing import Any
|
|
|
|
from decnet.prober.base import ActiveProbe
|
|
from decnet.prober.jarm import JARM_EMPTY_HASH, jarm_hash
|
|
from decnet.telemetry import traced as _traced
|
|
|
|
DEFAULT_PORTS: list[int] = [443, 8443, 8080, 4443, 50050, 2222, 993, 995, 8888, 9001]
|
|
|
|
|
|
class JarmProbe(ActiveProbe):
|
|
probe_name = "jarm"
|
|
default_ports = DEFAULT_PORTS
|
|
event_type = "jarm_fingerprint"
|
|
rotation_type = "jarm"
|
|
rotation_hash_key = "jarm_hash"
|
|
priority = 100
|
|
|
|
@_traced("prober.jarm_probe")
|
|
def run(self, ip: str, port: int, timeout: float) -> dict[str, Any] | None:
|
|
h = jarm_hash(ip, port, timeout=timeout)
|
|
if h == JARM_EMPTY_HASH:
|
|
return None
|
|
return {"jarm_hash": h}
|
|
|
|
def syslog_fields(self, ip: str, port: int, result: dict[str, Any]) -> tuple[dict[str, Any], str]:
|
|
h = result["jarm_hash"]
|
|
return {"jarm_hash": h}, f"JARM {ip}:{port} = {h}"
|
|
|
|
def publish_payload(self, ip: str, port: int, result: dict[str, Any]) -> dict[str, Any]:
|
|
return {"attacker_ip": ip, "port": port, "jarm_hash": result["jarm_hash"]}
|