Skip to content

Dev to main v1.6.0 - #63

Merged
r4ulcl merged 143 commits into
masterfrom
dev
Jul 8, 2026
Merged

Dev to main v1.6.0#63
r4ulcl merged 143 commits into
masterfrom
dev

Conversation

@r4ulcl

@r4ulcl r4ulcl commented Jun 30, 2026

Copy link
Copy Markdown
Owner

Changelog

v1.6.0

Added

  • Per-AP RSN/WPA security breakdown (WPA version, AKM suites, pairwise/group ciphers, enterprise flag, PMF) in a new SecurityAP view, with human-readable decodes of the wps_config_methods and rsn_capabilities bitmasks (e.g. 0x00c0MFPR, MFPC) stored beside the raw values; existing databases migrate automatically.
  • X.509 certificate extraction from enterprise (802.1X) EAP into the new Certificate table and CertificateAP view (based on the @x4v1l0k idea in PR Added certificates parsing, Python Flask web viewer and update requir… #57).
  • EAP enrichment on identities: realm and method-type lookup, plus EAP-MD5 challenge/response capture for offline cracking (EAPMD5 table, hashcat -m 4800).
  • Probe-request fingerprinting (fingerprint, ie_order) with randomized-MAC detection, and hidden (cloaked) SSID recovery from probe responses and (re)association requests.
  • AP management-capability detection from beacons/probe responses (802.11r/k/v fast roaming, Multiple BSSID, Channel Switch Announcement) in a new CapabilitiesAP view.

Fixed

  • Parsing/detection corrections: inflated WPS error count and SSID-dependent WPS 2.0 detection; MFP/PMF now read from RSN capability bits (capable vs required); cloaked and firstTimeSeen no longer clobbered when a later frame enriches an AP; EAP Success/Failure frames no longer counted as Identity errors.
  • asyncio child-watcher crash on Python 3.14.
  • Container fixes: in-container self-update (git now shipped) and non-root/podman writes to the bind-mounted db.SQLITE; plus Docker build, dependency CVEs and Codacy findings (including a SQL injection).

Updated

  • Merged the 1:1 Security, WPS and probe-fingerprint attributes onto the AP/Probe rows, and improved the SummaryAP view (grouped by SSID and encryption, showing WPA version, PMF, every manufacturer and client counts).
  • Slimmed the Docker image ~360 MB → ~220 MB (Alpine base, ship only hcxpcapngtool, drop build caches); amd64/arm64 builds, the full test suite and the built image now verified in CI.
  • Refactored internals with no behaviour change: split the oversized utils/wifi_db_aircrack.py into modules behind a re-export facade and cut parser/DB cyclomatic complexity below the Codacy limit (shared safe_insert/cap_runner, lookup tables); public parse_* API and callers unchanged.
  • Refreshed the bundled IEEE OUI / mac-vendors database (~16k new vendor prefixes).

r4ulcl and others added 30 commits October 13, 2023 17:38
Add verbose to get_vendor
Test with real data and unittest fixes
Bumps [ftfy]() from 6.1.1 to 6.1.3.

---
updated-dependencies:
- dependency-name: ftfy
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
r4ulcl and others added 7 commits July 1, 2026 15:16
test_docker.sh already writes a Cobertura coverage.xml, but nothing ever
sent it to Codacy -- the reporter was only ever run by hand (see the
comment in test_docker.sh). So the Codacy dashboard was frozen on an old
report and showed pre-test coverage (e.g. update.py 15%, wifi_db.py 34%)
even after the suite reached 88%.

Add a Codacy coverage-reporter step to both docker workflows, right after
the test step that produces coverage.xml, using the CODACY_PROJECT_TOKEN
secret. Both workflows run only on push to their branch/tags, so the
secret is always available. The action is SHA-pinned like the others.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
r4ulcl and others added 19 commits July 2, 2026 10:39
Codacy measures each file's total cyclomatic complexity; six files sat at
or above the ~40 limit the maintainer holds (unit_test.py is at 40). None
could be reduced by extracting in-file helpers, so cohesive function groups
were moved into new modules and re-imported so every public name still
resolves from its original location (the same approach used earlier for
asyncio_shim / test_safe_insert). No function behavior or signature changed.

  wifi_db.py        44 -> ~18  capture pipeline -> utils/capture_pipeline.py
  text_parsers.py   43 -> 20   kismet/log parsers -> utils/log_parsers.py
  database_utils.py 42 -> 30   file tracking/hash -> utils/db_files.py
  cert_fields.py    40 -> ~20  extension parsers -> utils/cert_extensions.py
  beacon_parsers.py 38 -> ~18  RSN/WPA security  -> utils/security_parsers.py

Tests mirror the split: capture-pipeline tests move to
test_capture_pipeline.py (patching utils.capture_pipeline where the moved
internals now call each other), test_realdata.py points at the new
Context/process_capture home, and the dead _rsn_pmf duplicate left in
beacon_parsers.py (its caller moved out) plus the imports it orphaned were
removed. All 158 tests pass.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The complexity split left re-import lines in text_parsers.py and
beacon_parsers.py purely to re-export the moved parsers under their old
module path. Codacy's unused-import check does not honor `# noqa: F401`
(unlike flake8), so it flagged parse_kismet_csv / parse_log_csv /
parse_security.

Point the actual importers at the new modules instead and delete the
shims:
- wifi_db_aircrack.py and cap_parsers.py import parse_security from
  utils.security_parsers, and parse_kismet_csv/parse_log_csv from
  utils.log_parsers.
- test_parsers.py imports _classify_wpa/_akm_ints from utils.security_parsers.

database_utils.py keeps its re-exports (callers use database_utils.<name>
attribute access); those are listed in __all__, which the check honors, so
they are not flagged. All 158 tests pass.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…pers

The sample test-01.cap capture never exercises many parser and error
branches, so coverage stalled below Codacy's target. Add focused "gap"
tests that drive the missing branches offline (no tshark / hcxpcapngtool):

- tests/fake_packets.py: synthetic pyshark FileCapture stand-ins so every
  .cap parser can be driven through run_cap_parse with hand-built packets.
- test_gaps_cap.py: WPS / MFP / capability / hidden-SSID frame types, EAP
  error handling, the cap_common defensive except-branches and the
  hcxpcapngtool 22000-hash extraction, at both verbosity levels.
- test_gaps_cert.py: cert_fields / cert_extensions features absent from the
  RSA sample (EC and Ed25519 keys, SAN, encipher/decipher-only key usage,
  OCSP) and the tshark-driven parse_certificates dispatch.
- test_gaps_db.py: the sqlite error paths, verbose logging and edge cases
  in the db_* helpers and database_utils.
- test_gaps_text.py: missing-file returns, outer exception handlers, the
  netxml truncation repair and the two decode() bitmask branches.
- test_gaps_cli.py: the remaining wifi_db.main() branch combinations and
  the capture_pipeline fallback path.
- test_runtime_utils.py: a stale-cache OUI re-download test for the
  "cache older than 2h" branch.

Full suite now reports 100% line and branch coverage on all utils modules
and wifi_db.py.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Codacy flagged duplicated blocks (7 clones in test_gaps_cert.py, plus
copies of the in-memory DB factory, the CLI runner and the setUp/tearDown
scaffolding spread across the suite) and correspondingly high per-file
complexity in the gap tests. Consolidate the shared scaffolding into
tests/test_base.py and have every test import it:

- mem_db(): the in-memory-schema database factory, previously copy-pasted
  as _mem_db() in test_gaps_cap/cert/db/text.py.
- colon_hex(): the ':'.join('%02x') helper used for cert DER and SSID hex.
- build_self_signed(): one certificate builder replacing the four repeated
  CertificateBuilder chains (test_base._make_cert_hex and the three cert
  builders in test_gaps_cert.py).
- run_main(): the wifi_db.main() offline runner shared by test_cli.py and
  test_gaps_cli.py.
- MemDBTempFile: a base TestCase (in-memory DB + a real throwaway file)
  that CapGapBase and DBGapBase now derive from instead of re-implementing
  setUp/tearDown; self.capture / self.file collapse to self.path.
- test_realdata.py now inherits DBTestBase, dropping its duplicated
  setUp/tearDown.

No behavioural change: pylint duplicate-code is clean at a 4-line
threshold, every gap file's complexity drops, and the suite still reports
100% line and branch coverage.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Bumps [requests](https://github.com/psf/requests) from 2.31.0 to 2.34.2.
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.31.0...v2.34.2)

---
updated-dependencies:
- dependency-name: requests
  dependency-version: 2.34.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [pytest](https://github.com/pytest-dev/pytest) from 7.4.2 to 9.1.1.
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@7.4.2...9.1.1)

---
updated-dependencies:
- dependency-name: pytest
  dependency-version: 9.1.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [nest-asyncio](https://github.com/erdewit/nest_asyncio) from 1.5.8 to 1.6.0.
- [Release notes](https://github.com/erdewit/nest_asyncio/releases)
- [Commits](erdewit/nest_asyncio@v1.5.8...v1.6.0)

---
updated-dependencies:
- dependency-name: nest-asyncio
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@r4ulcl r4ulcl self-assigned this Jul 8, 2026
@r4ulcl
r4ulcl merged commit 5473f67 into master Jul 8, 2026
6 checks passed
@r4ulcl
r4ulcl deleted the dev branch July 8, 2026 08:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant