anti 9e3473b370 feat(dns): full-subdomain entropy check catches short-label exfil ...

_is_tunneling now returns str|None (the detection method) instead of bool.
Two new tunables _QNAME_TOTAL_LEN_THRESHOLD=50 and _QNAME_ENTROPY_THRESHOLD=3.5
catch attackers who split a high-entropy payload across multiple short labels.
tunnel_method field added to tunneling_suspect events for downstream correlation.

2026-05-21 22:06:14 -04:00

..

agent

fix(types): T7 — eliminate all remaining 38 mypy errors; fix DeckyRow subscript in engine tests

2026-05-01 02:07:53 -04:00

artifacts

refactor(artifacts): extract shard-finder out of transcripts router

2026-05-08 18:49:11 -04:00

asn

feat(asn): expose BGP prefix in AsnInfo and enrich_ip

2026-05-21 16:07:57 -04:00

bus

docs(bus): document ipv6_leak payload kind on ATTACKER_FINGERPRINTED

2026-05-17 20:22:55 -04:00

canary

fix(types): T7 — eliminate all remaining 38 mypy errors; fix DeckyRow subscript in engine tests

2026-05-01 02:07:53 -04:00

cli

feat(deploy): wire attribution worker — CLI + systemd unit + registry

2026-05-09 02:31:59 -04:00

clustering

fix(clustering): filter extra fp keys before splatting into update_identity_fingerprints

2026-05-10 04:51:49 -04:00

collector

fix(collector): strip port from remote_addr before attacker identity resolution

2026-05-10 04:06:42 -04:00

correlation

perf(pytest): 194s → 4s collection — lazy heavy imports + norecursedirs

2026-05-10 06:41:25 -04:00

decky_io

feat(deckies): generic file drops on fleet + MazeNET deckies

2026-04-28 22:43:34 -04:00

engine

fix(deployer): chown synced _caddy_modules back to source owner after root copy

2026-05-10 01:26:13 -04:00

fleet

fix(types): T3 — narrow str|None at 12 sites; fix LANRow/DeckyRow subscript in mutator tests

2026-05-01 02:18:53 -04:00

geoip

fix(types): P1 — annotate ranges: list[Range] in geoip/rir and asn/iptoasn providers

2026-05-01 00:21:44 -04:00

intel

refactor(intel): migrate AttackerIntel JSON-string columns to native SQLAlchemy JSON

2026-05-10 09:17:15 -04:00

logging

fix(types): P2 — wire _MixinBase + col() across sqlmodel_repo; suppress pydantic/SQLModel column typing false positives

2026-05-01 00:49:18 -04:00

mutator

fix(types): T7 — eliminate all remaining 38 mypy errors; fix DeckyRow subscript in engine tests

2026-05-01 02:07:53 -04:00

net

feat(net): stealth-egress httpx client factory

2026-04-26 04:59:34 -04:00

orchestrator

fix(orchestrator/tests): attribute access on TopologySummary, not dict

2026-05-10 07:11:14 -04:00

prober

feat(prober): add Icmp6ErrorProbe — ICMPv6 error-leakage fingerprint

2026-05-21 15:03:10 -04:00

profiler

feat(profiler): wire enrich_rpki into _build_record

2026-05-21 16:14:51 -04:00

realism

feat(realism/llm): GET/PUT /api/v1/realism/llm + worker hot-reload tick

2026-05-09 23:12:29 -04:00

rpki

feat(rpki): ripestat validator + sqlite cache

2026-05-21 16:13:01 -04:00

services

feat(dns): global upstream forward rate limit with sinkhole fallback

2026-05-21 20:50:20 -04:00

sniffer

feat(sniffer): passive IPv6 link-local leak detection

2026-05-17 20:16:29 -04:00

swarm

fix(bundle): prune node_modules during agent tarball walk

2026-05-10 05:17:32 -04:00

tarpit

fix(types): T7 — eliminate all remaining 38 mypy errors; fix DeckyRow subscript in engine tests

2026-05-01 02:07:53 -04:00

templates

feat(dns): full-subdomain entropy check catches short-label exfil

2026-05-21 22:06:14 -04:00

topology

fix(topology): publish UDP/443 on gateway base when https service has http/3 enabled

2026-05-10 01:33:01 -04:00

ttp

feat(ttp/ipv6_leak): wire Ipv6LeakLifter into composite tagger and worker

2026-05-17 20:41:55 -04:00

updater

sec(updater): harden tarball extraction and verify sha256 before extract

2026-04-27 21:14:48 -04:00

vectorstore

fix(types): T1 — remove 15 stale type: ignore comments confirmed unused by mypy

2026-05-01 02:18:40 -04:00

web

feat(web): surface bgp_prefix and rpki_status in AttackerDetail and export

2026-05-21 16:17:38 -04:00

webhook

fix(types): T5 — narrow AsyncClient|None with inline if; rename loop variable t→task to avoid no-redef

2026-05-01 02:18:57 -04:00

__init__.py

merge: testing → main (reconcile 2-week divergence)

2026-04-28 18:36:00 -04:00

archetypes.py

refactor(ssh): consolidate real_ssh into ssh, remove duplication

2026-04-11 19:51:41 -04:00

composer.py

merge: testing → main (reconcile 2-week divergence)

2026-04-28 18:36:00 -04:00

config_ini.py

feat(config): add swarmctl-host to INI, env, CLI; drop hardcoded bind from systemd unit

2026-04-30 22:16:00 -04:00

config.py

merge: testing → main (reconcile 2-week divergence)

2026-04-28 18:36:00 -04:00

custom_service.py

Add per-service customization, stealth hardening, and BYOS support

2026-04-04 04:08:27 -03:00

distros.py

chore(infra): pin Docker base images by digest (DEBT-023)

2026-05-03 04:38:39 -04:00

env.py

fix(types): T3 — narrow str|None at 12 sites; fix LANRow/DeckyRow subscript in mutator tests

2026-05-01 02:18:53 -04:00

ini_loader.py

fix: align tests with model validation and API error reporting

2026-04-13 01:43:52 -04:00

models.py

chore(infra): pin Docker base images by digest (DEBT-023)

2026-05-03 04:38:39 -04:00

network.py

feat(prober): active IPv6 link-local solicitation phase

2026-05-17 20:20:19 -04:00

os_fingerprint.py

feat(os_fingerprint): Phase 2 — add icmp_ratelimit + icmp_ratemask sysctls

2026-04-10 16:41:23 -04:00

privdrop.py

merge: testing → main (reconcile 2-week divergence)

2026-04-28 18:36:00 -04:00

telemetry.py

fix(types): P2 — wire _MixinBase + col() across sqlmodel_repo; suppress pydantic/SQLModel column typing false positives

2026-05-01 00:49:18 -04:00