Tags: 4nt11/DECNET
Tags
DECNET 1.2.1 — OS fingerprint cloak
OS fingerprint **cloak** — make a decky read as its claimed OS under *active*
fingerprinting (`nmap -O`), not just passively. sysctl profiles only reach global
packet fields; the cloak owns the SYN-ACK *shape* and stack *behaviours* sysctl
can't reach. Verified live against real `nmap -O`: a `windows` decky reads as
**Windows 10 (95%)** and a `windows_server` decky as **Windows Server 2012/2016
(94%)** — up from a Linux 2.6 classification — with client handshakes intact.
- `decnet.cloak` — egress TCP/IP masquerading library, run inside the decky base
container (`python -m decnet.cloak`, `CAP_NET_ADMIN`/`CAP_NET_RAW`):
- **NFQUEUE mangler** — rewrites the egress packet shape sysctl cannot set
per-container: SYN-ACK (TCP option order, window, IP-ID; preserves the
kernel's live timestamp; recomputes `dataofs`/checksums), RST (IP-ID + a
nonzero ack on bare RSTs → nmap `CI`, `T4`/`T6` `A=O`), and ICMP echo-reply
(`code=0` → `IE.CD=Z`). One shared IP-ID counter across all three reads as a
shared sequence (`SS=S`).
- **T2/T3 probe-response synthesizer** — answers the nmap probes Linux drops
but Windows replies to (null-flags / SYN+FIN+PSH+URG to an open port).
Injects at L2 (reflecting the probe's MACs) so its replies bypass the OUTPUT
chain and coexist with the mangler's RST rule.
- Profiles live in `os_fingerprint.OS_MANGLE`, keyed by the same `nmap_os`
slug; pure packet-shaping logic is unit-tested offline (scapy/netfilterqueue
lazy-imported, Linux-only).
- `windows_server` nmap_os family — Windows Server stack deltas (ECN negotiated
`CC=Y`, randomized IP-ID `TI=RD`); the `windows-server` and `domain-controller`
archetypes now use it (workstation stays `windows`).
- Cloak base image (`templates/_shared/cloak/Dockerfile`, `FROM` the per-decky
distro) and `deployer._sync_cloak_sources`, which ships the light `decnet`
subtree into the build context. Base containers stay netns-safe — the cloak runs
best-effort behind `exec sleep infinity`, so a cloak crash never tears down the
decky or the netns its service containers share.
- **OS fingerprint timestamps bug**: the `windows` sysctl profile disabled TCP
timestamps, fingerprinting as an ancient stack. Modern Windows 10/11 run
timestamps **on** (`nmap SEQ.TS=A`) — corrected, and the single
highest-weighted field in the nmap match.
DECNET v1.2.0 — Prefork Worker Consolidation Adds a prefork deployment mode: a master imports the shared import floor once, then forks one child per worker. Children share the floor via copy-on-write (own process + GIL, full crash isolation) — complementing the in-process supervisor groups from 1.1. Highlights - decnet.prefork: prefork supervisor primitive (fork, reap, backoff-restart, graceful shutdown). CoW validated on CPython 3.14 — idle child ~1MB private, ~71MB shared; gc.freeze() unnecessary (PEP 683 immortal objects). - decnet fleet heavy: forks profiler + ttp. Verified live ~412MB Pss vs 661MB standalone (profiler RSS 353->110MB via shared floor). - MITRE ATT&CK bundle bumped 19.0 -> 19.1, relocated to decnet/data/ (hash-pinned, fetched on demand, not committed). - Removed 10 per-worker systemd unit templates superseded by the 1.1 supervisor groups (batch, cpu) and this release's heavy fleet; decnet.target rewired. Lesson learned: prefork pays for base-floor-bound workers (profiler), not state-bound ones (ttp, dominated by its private ATT&CK object graph).