Merge pull request #26 from mathiscapart/prod

Prod

Author: mathiscapart

.github/workflows/ci.yml

@@ -26,27 +26,54 @@ jobs:
       - run: pip install bandit
       - run: bandit -r honeypots/ pipeline/ dashboard/ -ll -ii
 
+  # Tests unitaires PAR COMPOSANT. Les honeypots embarquent des modules à plat
+  # (config.py, events.py, server.py, detection.py) avec des noms IDENTIQUES
+  # entre ssh et ftp : les lancer dans le même process pytest provoque des
+  # collisions de modules top-level. On exécute donc chaque suite isolément,
+  # dans son propre dossier — exactement comme l'image Docker les importe
+  # (WORKDIR /app, `python server.py`). L'attacker tourne depuis la racine
+  # (son module local `logging.py` masquerait la stdlib autrement).
   test:
     needs: lint
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: honeypot-ssh
+            dir: honeypots/ssh
+            target: tests/
+          - name: honeypot-ftp
+            dir: honeypots/ftp
+            target: tests/
+          - name: honeypot-http
+            dir: honeypots/http
+            target: tests/
+          - name: analyzer
+            dir: analyzer
+            target: tests/
+          - name: attacker
+            dir: .
+            target: attacker/tests/
     steps:
       - uses: actions/checkout@v4
-
-      - name: Set up Python 3.12
-        uses: actions/setup-python@v5
+      - uses: actions/setup-python@v5
         with:
           python-version: "3.12"
-
-      - name: Install dependencies
+      - name: Install test deps (${{ matrix.name }})
+        working-directory: ${{ matrix.dir }}
         run: |
-          pip install --upgrade pip
-          pip install pytest
-          find . -name "requirements*.txt" \
-            -not -path "./.git/*" \
-            | xargs -I {} pip install -r {}
-
-      - name: Run all tests
-        run: pytest --tb=short -v
+          python -m pip install --upgrade pip
+          if [ -f requirements-dev.txt ]; then
+            pip install -r requirements-dev.txt
+          else
+            pip install pytest
+          fi
+      - name: pytest (${{ matrix.name }})
+        working-directory: ${{ matrix.dir }}
+        # `python -m pytest` met le cwd sur sys.path => imports à plat OK,
+        # comme en conteneur. Pas de pytest.ini racine (collecte globale = collisions).
+        run: python -m pytest ${{ matrix.target }} -q
 
   # Valide que les secrets d'enrichissement sont montes et fonctionnels
   # (AbuseIPDB, GreyNoise) sans monter la stack.

honeypots/ftp/server.py

@@ -23,18 +23,17 @@
 import uuid
 
 from config import Config, load_config
-from events import EventSink, build_event
-from filesystem import is_canary, materialize
-from pyftpdlib.authorizers import DummyAuthorizer
-from pyftpdlib.handlers import FTPHandler
-from pyftpdlib.servers import FTPServer
-
-from ftp.detection import (
+from detection import (
     SessionProfiler,
     classify_command,
     classify_credential_reuse,
     classify_download,
 )
+from events import EventSink, build_event
+from filesystem import is_canary, materialize
+from pyftpdlib.authorizers import DummyAuthorizer
+from pyftpdlib.handlers import FTPHandler
+from pyftpdlib.servers import FTPServer
 
 # Commandes d'authentification : journalisées via les callbacks on_login* (avec
 # le couple identifiant/mot de passe), jamais comme événement "command" — on

honeypots/ftp/tests/test_ftp_honeypot.py

@@ -14,15 +14,15 @@
 
 import pytest
 from config import Credential, load_config
-from events import build_event, normalize_ipv4
-from filesystem import DECOY_TREE, decoy_dirs, is_canary, materialize
-from ftp.detection import (
+from detection import (
     SessionProfiler,
     classify_command,
     classify_credential_reuse,
     classify_download,
     is_recon,
 )
+from events import build_event, normalize_ipv4
+from filesystem import DECOY_TREE, decoy_dirs, is_canary, materialize
 from jsonschema import Draft7Validator
 
 SCHEMA_PATH = Path(__file__).resolve().parents[3] / "docs" / "event.schema.json"

honeypots/http/requirements-dev.txt

@@ -2,3 +2,6 @@
 -r requirements.txt
 pytest==8.3.4
 jsonschema==4.23.0
+# Client HTTP requis par starlette.TestClient (fastapi.testclient) — absent
+# sinon en CI : "starlette.testclient requires the httpx package".
+httpx==0.28.1

honeypots/ssh/server.py

@@ -24,10 +24,9 @@
 import asyncssh
 from commands import ShellState, run_command
 from config import Config, load_config
+from detection import SessionProfiler, classify_command, is_escalation
 from events import EventSink, build_event
 
-from ssh.detection import SessionProfiler, classify_command, is_escalation
-
 # Version annoncée : OpenSSH Debian plausible plutôt que la bannière asyncssh
 # (réduit le fingerprinting trivial du honeypot).
 SERVER_VERSION = "OpenSSH_9.2p1 Debian-2+deb12u2"

honeypots/ssh/tests/test_ssh_honeypot.py

@@ -11,14 +11,14 @@
 import pytest
 from commands import ShellState, run_command
 from config import Credential, load_config
-from events import build_event, normalize_ipv4
-from jsonschema import Draft7Validator
-from ssh.detection import (
+from detection import (
     SessionProfiler,
     classify_command,
     detect_malware,
     is_escalation,
 )
+from events import build_event, normalize_ipv4
+from jsonschema import Draft7Validator
 
 SCHEMA_PATH = Path(__file__).resolve().parents[3] / "docs" / "event.schema.json"