anti/DECNET
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
c50448995b114609e0a30272b16f4a2e951e582a
DECNET/tests
History
anti c50448995b feat(smtp): capture full messages + attachments to disk 
SMTP template now writes each accepted DATA body as a .eml file into a
bind-mounted per-decky quarantine dir and emits a `message_stored` log
with sha256, size, decoded headers, and an attachment manifest
(filename + sha256 + size + content-type). Attachment hashing uses the
*decoded* payload so operators can match against VT / MalwareBazaar
directly. Body accumulator is capped at SMTP_MAX_BODY_BYTES (default
10 MB, matching the EHLO SIZE advert) so a streaming client can't OOM
the container.

The existing /api/v1/artifacts/{decky}/{stored_as} endpoint now takes
an optional ?service= query param (defaults to ssh for back-compat)
and can serve .eml files out of the smtp subdir. Forensic metadata
rides the normal log pipeline, same as SSH file_captured.
2026-04-22 22:17:50 -04:00
..
api
feat(smtp): capture full messages + attachments to disk
2026-04-22 22:17:50 -04:00
bus
feat(workers): bus-backed Workers panel (registry, control, installed flag)
2026-04-22 14:10:39 -04:00
cli
feat(cli): add decnet init --deinit to undo a previous bootstrap
2026-04-22 14:31:56 -04:00
collector
feat(collector): publish system.log per ingested event (DEBT-031 worker 5)
2026-04-21 16:57:21 -04:00
correlation
feat(correlation,profiler): publish attacker.observed on first sighting (DEBT-031 worker 3)
2026-04-21 16:53:03 -04:00
docker
test: fix templates paths, CLI gating, and stress-suite harness
2026-04-19 23:50:53 -04:00
live
fix(ci): skip live service isolation
2026-04-20 13:14:48 -04:00
perf
added: scripts/profile/view.sh — auto-pick newest artifact and open viewer
2026-04-17 13:20:05 -04:00
prober
feat(prober): publish attacker.fingerprinted on the bus (DEBT-031)
2026-04-21 16:47:55 -04:00
profiler
feat(profiler): publish attacker.scored per profile upsert (DEBT-031 worker 4)
2026-04-21 16:54:40 -04:00
service_testing
feat(smtp): capture full messages + attachments to disk
2026-04-22 22:17:50 -04:00
sniffer
feat(prober): publish attacker.fingerprinted on the bus (DEBT-031)
2026-04-21 16:47:55 -04:00
stress
fix(tests): fixed locust fixtures and rampups, since >100 generally isn't very well managed
2026-04-20 01:26:56 -04:00
swarm
feat(swarm): expose needs_resync on TopologySummary + upsert record_error
2026-04-21 01:41:30 -04:00
topology
fix(topology): delete topology_mutations in delete-cascade
2026-04-22 17:50:30 -04:00
updater
feat(updater): sync systemd unit files and daemon-reload on update
2026-04-19 19:07:24 -04:00
web
feat(web): add systemd_control helper for worker unit management
2026-04-22 14:08:35 -04:00
__init__.py
Add 20 honeypot services: email, DB, ICS, cloud, IoT, network protocols
2026-04-03 23:07:44 -03:00
conftest.py
fix: dynamic TracedRepository proxy + disable tracing in test suite
2026-04-15 23:46:46 -04:00
mysql_spinup.sh
test: fix templates paths, CLI gating, and stress-suite harness
2026-04-19 23:50:53 -04:00
test_admin_seed.py
fix: re-seed admin password when still unfinalized (must_change_password=True)
2026-04-17 14:49:13 -04:00
test_api_attackers.py
test(web): transcripts API + attacker-transcripts router coverage
2026-04-21 23:11:40 -04:00
test_archetypes.py
refactor: separate engine, collector, mutator, and fleet into independent subpackages
2026-04-12 00:26:22 -04:00
test_attacker_worker.py
fix: persist ingester position and profiler cursor across restarts
2026-04-15 13:58:12 -04:00
test_auth_async.py
perf: run bcrypt on a thread so it doesn't block the event loop
2026-04-17 14:52:22 -04:00
test_auto_spawn.py
test: fix templates paths, CLI gating, and stress-suite harness
2026-04-19 23:50:53 -04:00
test_base_repo.py
feat(db): add session_profile table for keystroke-dynamics fingerprints
2026-04-22 21:39:17 -04:00
test_bounty_dedup.py
feat: deduplicate bounties on (bounty_type, attacker_ip, payload)
2026-04-15 18:02:52 -04:00
test_build.py
refactor: separate engine, collector, mutator, and fleet into independent subpackages
2026-04-12 00:26:22 -04:00
test_cli_db_reset.py
refactor(cli): split decnet/cli.py monolith into decnet/cli/ package
2026-04-19 22:42:52 -04:00
test_cli_service_pool.py
feat: fleet-wide MACVLAN sniffer microservice
2026-04-14 15:02:34 -04:00
test_cli.py
test: fix templates paths, CLI gating, and stress-suite harness
2026-04-19 23:50:53 -04:00
test_collector_thread_pool.py
fix: use dedicated thread pools for collector and sniffer workers
2026-04-15 22:57:03 -04:00
test_collector.py
feat(agent/collector): topology-label discovery and master-authoritative supersede
2026-04-21 10:23:10 -04:00
test_composer.py
fix(telnet): replace Cowrie with real busybox telnetd + rsyslog logging
2026-04-12 00:34:45 -04:00
test_config_ini.py
feat(enroll): systemd units for agent/forwarder/engine + log-directory INI key
2026-04-19 05:46:08 -04:00
test_config.py
fix: align tests with model validation and API error reporting
2026-04-13 01:43:52 -04:00
test_correlation.py
feat(correlation): interleave mutation markers into attacker traversals
2026-04-21 19:37:35 -04:00
test_custom_service.py
Implement ICS/SCADA and IMAP Bait features
2026-04-10 01:50:08 -04:00
test_decnet.db-shm
fix: stabilize test suite by ensuring proper test DB isolation and initialization
2026-04-09 02:31:14 -04:00
test_decnet.db-wal
fix: stabilize test suite by ensuring proper test DB isolation and initialization
2026-04-09 02:31:14 -04:00
test_deployer.py
feat(engine): emit creation/retirement mutation events on deploy/teardown
2026-04-21 19:35:05 -04:00
test_embedded_workers.py
fix: gate embedded sniffer behind DECNET_EMBED_SNIFFER (default off)
2026-04-17 13:35:43 -04:00
test_env_lazy_jwt.py
fixed(tests): jwt_lazy
2026-04-20 02:26:54 -04:00
test_factory.py
fix(tests): clean up two pre-existing failures before config work
2026-04-19 03:17:17 -04:00
test_file_handler.py
Add RFC 5424 syslog logging to all service templates
2026-04-04 04:31:00 -03:00
test_fingerprinting.py
feat: JA4/JA4S/JA4L fingerprints, TLS session resumption, certificate extraction
2026-04-13 23:20:37 -04:00
test_fleet_singleton.py
feat: fleet-wide MACVLAN sniffer microservice
2026-04-14 15:02:34 -04:00
test_fleet.py
fix: align tests with model validation and API error reporting
2026-04-13 01:43:52 -04:00
test_health_config_cache.py
perf: 1s TTL cache for /health DB probe and /config state reads
2026-04-17 15:05:18 -04:00
test_ingester.py
perf(ingester): batch log writes into bulk commits
2026-04-17 16:37:34 -04:00
test_ini_loader.py
Fix all ruff lint errors across decnet/, templates/, and tests/
2026-04-04 17:36:16 -03:00
test_ini_spaces.py
fix: stabilize test suite by ensuring proper test DB isolation and initialization
2026-04-09 02:31:14 -04:00
test_ini_validation.py
feat: add server-side validation for web-based INI deployments
2026-04-08 01:04:59 -04:00
test_inode_aware_handler.py
fix: logging handler must not crash its caller on reopen failure
2026-04-17 14:01:36 -04:00
test_log_file_mount.py
feat: replace bind-mount log pipeline with Docker log streaming
2026-04-10 00:14:14 -04:00
test_logging_forwarder.py
Implement ICS/SCADA and IMAP Bait features
2026-04-10 01:50:08 -04:00
test_logging.py
feat: add component-aware RFC 5424 application logging system
2026-04-13 07:39:01 -04:00
test_mode_gating.py
fixed(tests): mode_gating
2026-04-20 02:18:11 -04:00
test_mutator.py
feat(mutator): route mutate_decky through emit_decky_mutated with trigger
2026-04-21 19:31:31 -04:00
test_mysql_histogram_sql.py
test: add MySQL backend integration tests
2026-04-15 12:51:33 -04:00
test_mysql_migration.py
fix: migrate TEXT→MEDIUMTEXT for attacker/state columns on MySQL
2026-04-15 12:59:54 -04:00
test_mysql_url_builder.py
fix: mysql url builder tests expect asyncmy, not aiomysql
2026-04-17 13:13:36 -04:00
test_network.py
fix(deploy): prevent 'Address already in use' from stale IPAM and half-torn-down containers
2026-04-19 19:59:06 -04:00
test_os_fingerprint.py
refactor: separate engine, collector, mutator, and fleet into independent subpackages
2026-04-12 00:26:22 -04:00
test_privdrop.py
fix: chown log files to sudo-invoking user so non-root API can append
2026-04-17 13:39:09 -04:00
test_prober_bounty.py
feat: add HASSHServer and TCP/IP stack fingerprinting to DECNET-PROBER
2026-04-14 12:53:55 -04:00
test_prober_hassh.py
feat: add HASSHServer and TCP/IP stack fingerprinting to DECNET-PROBER
2026-04-14 12:53:55 -04:00
test_prober_jarm.py
refactor: prober auto-discovers attackers from log stream
2026-04-14 12:22:20 -04:00
test_prober_tcpfp.py
feat: add HASSHServer and TCP/IP stack fingerprinting to DECNET-PROBER
2026-04-14 12:53:55 -04:00
test_prober_worker.py
refactor: strip DECNET tokens from container-visible surface
2026-04-17 22:57:53 -04:00
test_profiler_behavioral.py
feat(sniffer): capture SSH client banner from TCP stream
2026-04-22 21:37:01 -04:00
test_router_cache.py
perf(api): TTL-cache /stats + unfiltered pagination counts
2026-04-17 19:09:15 -04:00
test_service_isolation.py
perf(ingester): batch log writes into bulk commits
2026-04-17 16:37:34 -04:00
test_services.py
feat(web): attacker artifacts endpoint + UI drawer
2026-04-18 05:36:48 -04:00
test_session_profile.py
feat(db): add session_profile table for keystroke-dynamics fingerprints
2026-04-22 21:39:17 -04:00
test_smtp_relay.py
feat(smtp): capture full messages + attachments to disk
2026-04-22 22:17:50 -04:00
test_sniffer_ja3.py
test: fix templates paths, CLI gating, and stress-suite harness
2026-04-19 23:50:53 -04:00
test_sniffer_p0f.py
test: add fingerprinting and TCP analysis tests
2026-04-15 12:51:35 -04:00
test_sniffer_retransmit.py
test: add fingerprinting and TCP analysis tests
2026-04-15 12:51:35 -04:00
test_sniffer_tcp_fingerprint.py
refactor: strip DECNET tokens from container-visible surface
2026-04-17 22:57:53 -04:00
test_sniffer_worker.py
feat(sniffer): capture SSH client banner from TCP stream
2026-04-22 21:37:01 -04:00
test_ssh_capture_emit.py
test: fix templates paths, CLI gating, and stress-suite harness
2026-04-19 23:50:53 -04:00
test_ssh_stealth.py
feat(ssh-stealth): hide capture artifacts via XOR+gzip entrypoint blob
2026-04-18 05:34:50 -04:00
test_ssh.py
feat(ssh-stealth): hide capture artifacts via XOR+gzip entrypoint blob
2026-04-18 05:34:50 -04:00
test_syslog_formatter.py
refactor: strip DECNET tokens from container-visible surface
2026-04-17 22:57:53 -04:00
test_telemetry.py
feat: add OpenTelemetry distributed tracing across all DECNET services
2026-04-15 23:23:13 -04:00
test_web_api.py
feat: Phase 1 — JA3/JA3S sniffer, Attacker model, profile worker
2026-04-13 20:22:08 -04:00