Milestone 2: Deception engine #22

Merged

vxfemboy merged 14 commits from milestone-2-deception-engine into main

2026-06-25 03:51:31 +00:00

vxfemboy commented

2026-06-25 03:12:05 +00:00

(Migrated from github.com)

Milestone 2 — Deception Engine

Makes closed ports across the managed prefixes behave like live services: a userspace engine terminates deception traffic via the M1 nftables data plane and answers it with interactive protocol emulators, while real client traffic stays on the kernel fast path.

What's included

blackwall-deception crate
- ServiceEmulator trait + port-keyed EmulatorRegistry dispatch
- BannerStore (port→banner, escape parsing) + arc-swap SharedBanners (hot-reload primitive)
- Emulators: HTTP (full well-formed response) and a generic banner/tarpit fallback
- TPROXY transport — transparent listener that terminates deception TCP into emulators (serve accept loop, SessionRecord)
- NFQUEUE transport — answers ICMP/ICMPv6 echo (pure, unit-tested packet builders + a thin root-bound loop)
blackwall-state — deception_sessions table + record_session / session_count
blackwall-nft — real classifier rules replacing M1's inert placeholder: real→accept, deception TCP→tproxy :61000, deception ICMP/UDP→queue 0, default Closed→drop. Bumped the nftables crate 0.4.1→0.6.3 for a typed TProxy statement (migrated render/apply to the 0.6 Cow API).
blackwalld run — wires apply → store → engine (dual-stack TPROXY v4+v6 + NFQUEUE), draining sessions to the audit log.

Quality

75 tests; coverage 96.60% on testable code (kernel/root-bound transports, nft apply, and daemon glue excluded from the gate via a documented --ignore-filename-regex); --deny warnings clippy + rustfmt clean.
Per-task spec+quality reviews and a final whole-branch review. The review's one blocker (IPv6 deception TCP black-holed because the daemon bound only IPv4) is fixed in this branch.

Deferred (tracked)

Follow-ups #19 (transport task supervision), #20 (wire runtime banner hot-reload), #21 (emulator idle-timeout + connection cap).
By design for later milestones: SSH/SMTP/DB emulators (M2.1), DNAT-to-Incus (M3), Prometheus metrics (M4), XDP/SYN-cookie (sub-project B).

Closes #2.

## Milestone 2 — Deception Engine Makes closed ports across the managed prefixes behave like live services: a userspace engine terminates deception traffic via the M1 nftables data plane and answers it with interactive protocol emulators, while real client traffic stays on the kernel fast path. ### What's included - **`blackwall-deception` crate** - `ServiceEmulator` trait + port-keyed `EmulatorRegistry` dispatch - `BannerStore` (port→banner, escape parsing) + `arc-swap` `SharedBanners` (hot-reload primitive) - Emulators: HTTP (full well-formed response) and a generic banner/tarpit fallback - **TPROXY** transport — transparent listener that terminates deception TCP into emulators (`serve` accept loop, `SessionRecord`) - **NFQUEUE** transport — answers ICMP/ICMPv6 echo (pure, unit-tested packet builders + a thin root-bound loop) - **`blackwall-state`** — `deception_sessions` table + `record_session` / `session_count` - **`blackwall-nft`** — real classifier rules replacing M1's inert placeholder: real→`accept`, deception TCP→`tproxy :61000`, deception ICMP/UDP→`queue 0`, default Closed→`drop`. Bumped the `nftables` crate 0.4.1→0.6.3 for a typed `TProxy` statement (migrated render/apply to the 0.6 `Cow` API). - **`blackwalld run`** — wires apply → store → engine (dual-stack TPROXY v4+v6 + NFQUEUE), draining sessions to the audit log. ### Quality - 75 tests; coverage **96.60%** on testable code (kernel/root-bound transports, nft apply, and daemon glue excluded from the gate via a documented `--ignore-filename-regex`); `--deny warnings` clippy + rustfmt clean. - Per-task spec+quality reviews and a final whole-branch review. The review's one blocker (IPv6 deception TCP black-holed because the daemon bound only IPv4) is fixed in this branch. ### Deferred (tracked) - Follow-ups #19 (transport task supervision), #20 (wire runtime banner hot-reload), #21 (emulator idle-timeout + connection cap). - By design for later milestones: SSH/SMTP/DB emulators (M2.1), DNAT-to-Incus (M3), Prometheus metrics (M4), XDP/SYN-cookie (sub-project B). Closes #2.