Skip to content

Release 1.0.0

Latest
Latest

Choose a tag to compare

View all tags
@glaslos glaslos released this 20 Sep 14:20
· 18 commits to main since this release
v1.0.0
c9245e6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Conpot 1.0.0

Conpot 1.0.0 is a platform rewrite, not a point release on 0.5.2 (2018). The honeypot still emulates ICS/SCADA services to collect attacker intelligence, but the runtime, templates, logging sinks, and several protocol libraries are new. Treat this as a breaking upgrade: migrate templates and log consumers, then re-validate Docker ports and deployment scripts.

Runtime and packaging

The gevent stack is gone. Protocol servers run on asyncio (asyncio.start_server / datagram endpoints, one task per connection). The CLI is a normal asyncio entrypoint (python -m conpot / conpot.cli).

Supported Python moved forward (the 3.12 upgrade landed in-tree; current packaging expects a current CPython). Dependencies were replaced rather than patched in place: cryptography instead of PyCrypto, pymodbus, bacpypes3, aiohttp, cm-ethernetip, and the community fs fork. Custom SNMP MIB compilation was removed.

CI is GitHub Actions instead of Travis, with Black on push. Docker was rebuilt several times (base image, published ports, build reliability). Use the current Dockerfile and docs as the source of truth; older compose snippets will be wrong.

Startup is less rigid: fewer hard restrictions at launch, clearer operator UX. MAC-address spoofing was removed.

Templates and databus (breaking)

Templates moved from XML to TOML, with a flatter layout: templates/<name>/template.toml (metadata + databus) plus per-protocol *.toml. Auxiliary files stay in subdirectories only when needed (for example HTTP htdocs). Template descriptions and databus documentation were rewritten for that model.

The databus is decoupled from SessionManager. get_value() evaluates a mapping once. Random/generated value functions, extra SNMP-oriented emulators, and a simulated PLC-style emulator sit on that bus. IEC 104 station address is a databus key rather than a one-off protocol constant.

Proxy mode is unchanged in intent: it can still bridge to a real backend. Misconfiguration still exposes live systems. Emulated credentials in templates remain deception only.

Protocol changes

  • S7: parameter-length calculation, read/write, PLC-stop.
  • Modbus: pymodbus, recv-path fixes, and a DoS fix for unbounded byte-at-a-time oversized reads.
  • IEC 104: IOA and float endianness, types 100–103, friendlier I-frame logs.
  • ENIP/CIP: exception/crash fixes, device-info handling, cm-ethernetip.
  • BACnet: bacpypes3 plus BACnet/IP encode/decode.
  • HTTP: aiohttp; template substitution no longer uses HTMLParser.
  • SNMP: richer emulators, default listen port 16100, no custom MIB compile path.
  • FTP / IPMI / TFTP: FTP handler exception-loop fix, RFC 959 greeting expectations, IPMI IPv6/test and JSON logging fixes, FakeSession timeout before pyghmi init, TFTP test cleanup.

Kamstrup’s prober was refactored as a standalone tool; it is not a new protocol server.

Logging and sessions (breaking for sinks)

Attack logging is structured (schema version 1) across JSON, SQLite, syslog, HPFriends, and TAXII. Events carry event_time distinct from session start. Remote IP and port, and destination from the socket, are first-class fields. Syslog gets attack JSON explicitly.

HPFriends/JSON payloads use session_id / protocol / flat endpoints instead of the old id / data_type / remote tuples. Sessions can be deleted. Log levels outside exception handlers are errors rather than spurious exceptions.

What this release does not highlight

Dozens of PRs were test, CI, docs, and Docker churn (ENIP/IPMI/TFTP tests, cwd-sensitive docs tests, scapy/freezegun pins, Black formatting). They make 1.0.0 shippable; they are not operator-facing features.

Upgrade checklist

  1. Convert XML templates to TOML; flatten protocol files next to template.toml.
  2. Point log pipelines at the new event schema (especially HPFriends/JSON).
  3. Confirm Docker/host ports (SNMP 16100 unless you override it).
  4. Drop MAC spoofing and any MIB-compile workflow.
  5. Run against asyncio + current Python; gevent monkey-patching is not supported.

New Contributors

Full Changelog: Release_0.6.0...v1.0.0

Contributors

Jc2k, danperrout, and 21 other contributors
Assets 2
Loading