homelab-runtime-publisher
39 lines
8.8 KiB
JSON
39 lines
8.8 KiB
JSON
{
|
|
"schema_version": 1,
|
|
"channel": "homelab-runtime",
|
|
"command_id": "SUPPORT-261007-WINDOWS-DACHA-WATCHDOG-SANITIZED-SOURCE-99758R1",
|
|
"status": "OK",
|
|
"rc": 0,
|
|
"host": "pve01",
|
|
"mode": "read-only",
|
|
"component": "windows-dacha-watchdog-sanitized-source",
|
|
"started_at_utc": "2026-10-07T04:30:48Z",
|
|
"finished_at_utc": "2026-10-07T04:30:49Z",
|
|
"reference_register_checked": true,
|
|
"reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66",
|
|
"error_register_checked": true,
|
|
"error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0",
|
|
"command_sha256": "82372359d1dfece3cca84734e47b1a82a17c43fb88ef3c8c418ee0f99f500497",
|
|
"duplicate_failed_command_blocked": false,
|
|
"block_reason": null,
|
|
"execution_started": true,
|
|
"change_declared": false,
|
|
"result_contract_valid": true,
|
|
"result_contract_status": null,
|
|
"result_contract_error": null,
|
|
"command_rc": 0,
|
|
"changes_made": false,
|
|
"rollback_started": false,
|
|
"rollback_restored": null,
|
|
"mutation_outcome": "NO_MUTATION",
|
|
"sanitized": true,
|
|
"secrets_included": false,
|
|
"private_addresses_included": false,
|
|
"raw_evidence_retained_locally": true,
|
|
"raw_evidence_sha256": "07576991b3bcf03a1f05666fc4f906e8ce3bab611b76ac9d0e0cd4f2ff28da02",
|
|
"sanitized_output_sha256": "07576991b3bcf03a1f05666fc4f906e8ce3bab611b76ac9d0e0cd4f2ff28da02",
|
|
"output_truncated_in_json": false,
|
|
"full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
|
|
"output": "WINDOWS_DACHA_WATCHDOG_SANITIZED_SOURCE=V1\nMODE=read-only\nNO_MUTATION=true\nWINDOWS_LOCAL_INSPECT_RC=0\nWINDOWS_EVIDENCE_PRESENT=true\nWATCHDOG_SHORTCUT_MATCH_COUNT=1\nWATCHDOG_PS1_RESOLVED=true\nWATCHDOG_PS1_BASENAME=watchdog.ps1\nWATCHDOG_PS1_SIZE=5001\nWATCHDOG_LINE_COUNT=169\nSANITIZED_SOURCE_BEGIN\nSRC|001|$ErrorActionPreference='SilentlyContinue'\nSRC|003|$HostKey='<HOSTKEY>'\nSRC|004|$PlinkPath='<PATH> Files\\PuTTY\\plink.exe'\nSRC|005|$Target='<IP>'\nSRC|006|$FailureStreak=0\nSRC|008|function Get-Listeners {\nSRC|009| try {\nSRC|010| return @(Get-NetTCPConnection -State Listen -LocalPort 64020 -ErrorAction SilentlyContinue)\nSRC|011| } catch {\nSRC|012| return @()\nSRC|013| }\nSRC|014|}\nSRC|016|function Get-ProcessCommandLine([int]$processId) {\nSRC|017| try {\nSRC|018| $proc = Get-CimInstance Win32_Process -Filter \"ProcessId=$processId\"\nSRC|019| if ($proc) { return [string]$proc.CommandLine }\nSRC|020| } catch {}\nSRC|021| return ''\nSRC|022|}\nSRC|024|function Test-ExactOwner([int]$processId) {\nSRC|025| $commandLine = Get-ProcessCommandLine $processId\nSRC|026| if ([string]::IsNullOrWhiteSpace($commandLine)) { return $false }\nSRC|028| return (\nSRC|029| $commandLine -match '(?i)\\bplink(\\.exe)?\\b' -and\nSRC|030| $commandLine -match '(?i)-L\\s+127\\.0\\.0\\.1:64020:127\\.0\\.0\\.1:64020' -and\nSRC|031| $commandLine -match '(?i)root@192\\.168\\.50\\.11' -and\nSRC|032| $commandLine -match [regex]::Escape($HostKey)\nSRC|033| )\nSRC|034|}\nSRC|036|function Test-Tcp22 {\nSRC|037| $client = $null\nSRC|038| try {\nSRC|039| $client = New-Object Net.Sockets.TcpClient\nSRC|040| $task = $client.ConnectAsync($Target, 22)\nSRC|041| if (-not $task.Wait(1800)) { return $false }\nSRC|042| return $client.Connected\nSRC|043| } catch {\nSRC|044| return $false\nSRC|045| } finally {\nSRC|046| try { if ($client) { $client.Close() } } catch {}\nSRC|047| }\nSRC|048|}\nSRC|050|function Test-Tcp64020 {\nSRC|051| $client = $null\nSRC|052| try {\nSRC|053| $client = New-Object Net.Sockets.TcpClient\nSRC|054| $task = $client.ConnectAsync('<IP>', 64020)\nSRC|055| if (-not $task.Wait(1200)) { return $false }\nSRC|056| return $client.Connected\nSRC|057| } catch {\nSRC|058| return $false\nSRC|059| } finally {\nSRC|060| try { if ($client) { $client.Close() } } catch {}\nSRC|061| }\nSRC|062|}\nSRC|064|function Test-Socks {\nSRC|065| $curl = (Get-Command curl.exe -ErrorAction SilentlyContinue).Source\nSRC|066| if (-not $curl) { return $false }\nSRC|068| try {\nSRC|069| $code = ((& $curl '-sS' '-o' 'NUL' '--connect-timeout' '4' '--max-time' '10' '-w' '%{http_code}' '--socks5-hostname' '<IP>:64020' 'https://api.telegram.org' 2>$null) | Out-String).Trim()\nSRC|070| return ($LASTEXITCODE -eq 0 -and $code -match '^[1-5][0-9][0-9]$' -and $code -ne '000')\nSRC|071| } catch {\nSRC|072| return $false\nSRC|073| }\nSRC|074|}\nSRC|076|function Get-ExactPlinkPids {\nSRC|077| $result = New-Object 'System.Collections.Generic.List[int]'\nSRC|078| try {\nSRC|079| foreach ($proc in (Get-CimInstance Win32_Process -Filter \"Name='plink.exe'\" -ErrorAction SilentlyContinue)) {\nSRC|080| if (Test-ExactOwner ([int]$proc.ProcessId)) {\nSRC|081| $result.Add([int]$proc.ProcessId)\nSRC|082| }\nSRC|083| }\nSRC|084| } catch {}\nSRC|085| return @($result | Sort-Object -Unique)\nSRC|086|}\nSRC|088|function Start-Route {\nSRC|089| if (-not (Test-Path -LiteralPath $PlinkPath -PathType Leaf)) { return $false }\nSRC|090| if (-not (Test-Tcp22)) { return $false }\nSRC|092| $proc = $null\nSRC|093| try {\nSRC|094| $psi = New-Object Diagnostics.ProcessStartInfo\nSRC|095| $psi.FileName = $PlinkPath\nSRC|096| $psi.UseShellExecute = $false\nSRC|097| $psi.CreateNoWindow = $true\nSRC|098| $psi.Arguments = \"-batch -agent -noshare -no-antispoof -ssh -4 -P 22 -hostkey <HOSTKEY_OR_VAR> -N -L <IP>:64020:<IP>:64020 <USER>@<IP>\"\nSRC|099| $proc = [Diagnostics.Process]::Start($psi)\nSRC|100| } catch {\nSRC|101| return $false\nSRC|102| }\nSRC|104| if ($null -eq $proc) { return $false }\nSRC|106| for ($i = 1; $i -le 30; $i++) {\nSRC|107| Start-Sleep -Milliseconds 500\nSRC|108| $rows = Get-Listeners\nSRC|109| $owners = @($rows | ForEach-Object { $_.OwningProcess } | Where-Object { $_ -gt 0 } | Sort-Object -Unique)\nSRC|111| if ($owners.Count -eq 1 -and $owners[0] -eq $proc.Id -and (Test-Tcp64020)) {\nSRC|112| return $true\nSRC|113| }\nSRC|115| try {\nSRC|116| if ($proc.HasExited) { break }\nSRC|117| } catch {}\nSRC|118| }\nSRC|120| try {\nSRC|121| if (-not $proc.HasExited) {\nSRC|122| Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue\nSRC|123| }\nSRC|124| } catch {}\nSRC|126| return $false\nSRC|127|}\nSRC|129|while ($true) {\nSRC|130| $rows = Get-Listeners\nSRC|131| $owners = @($rows | ForEach-Object { $_.OwningProcess } | Where-Object { $_ -gt 0 } | Sort-Object -Unique)\nSRC|133| if ($rows.Count -eq 0) {\nSRC|134| $FailureStreak = 0\nSRC|136| foreach ($staleProcessId in (Get-ExactPlinkPids)) {\nSRC|137| try {\nSRC|138| Stop-Process -Id $staleProcessId -Force -ErrorAction SilentlyContinue\nSRC|139| } catch {}\nSRC|140| }\nSRC|142| Start-Route | Out-Null\nSRC|143| }\nSRC|144| elseif ($owners.Count -eq 1 -and (Test-ExactOwner ([int]$owners[0]))) {\nSRC|145| if (Test-Socks) {\nSRC|146| $FailureStreak = 0\nSRC|147| }\nSRC|148| else {\nSRC|149| $FailureStreak++\nSRC|151| if ($FailureStreak -ge 3) {\nSRC|152| try {\nSRC|153| Stop-Process -Id ([int]$owners[0]) -Force -ErrorAction SilentlyContinue\nSRC|154| } catch {}\nSRC|156| $FailureStreak = 0\nSRC|157| Start-Sleep -Seconds 1\nSRC|158| Start-Route | Out-Null\nSRC|159| }\nSRC|160| }\nSRC|161| }\nSRC|162| else {\nSRC|163| # Safety hold: never terminate an unknown or competing owner.\nSRC|164| $FailureStreak = 0\nSRC|165| }\nSRC|167| Start-Sleep -Seconds 12\nSRC|168|}\nSANITIZED_SOURCE_END\nRUNNING_WATCHDOG_PS_COUNT=2\nRUNNING_BRIDGE_PS_COUNT=2\nREC|CURRENT_PLINK|IDX=1|HAS_R=false|HAS_L=true|HAS_D=false|HAS_64020=true|HAS_64022=false|HAS_AGENT=true|HAS_BATCH=true|HAS_N=true\nCURRENT_PLINK_COUNT=1\nWATCHDOG_PS1_SHA256=7738599c1d229c105f1073f04b420063bd776f3444b3f6fcf7d09bd320cce0e3\nWATCHDOG_PS1_SHA_MATCH=true\nPVE64020_LISTENER_COUNT=0\nPVE64020_SSHD_OWNER_COUNT=0\nCLUSTER_QUORATE=true\nNETBIRD_LAZY=false\nNETBIRD_MANAGEMENT=true\nNETBIRD_SIGNAL=true\nNETBIRD_CONNECTED=5\nDECISION=PASS_WINDOWS_DACHA_WATCHDOG_SANITIZED_SOURCE\nNEXT_GATE=EXACT_WATCHDOG_LOGIC_REPAIR\nTASK_RESULT=WINDOWS_DACHA_WATCHDOG_SANITIZED_SOURCE\nCHANGES_MADE=false\nROLLBACK_STARTED=false\nROLLBACK_RESTORED=null\nMUTATION_OUTCOME=NO_MUTATION\nHOMELAB_RESULT_CONTRACT={\"version\":1,\"command_id\":\"SUPPORT-261007-WINDOWS-DACHA-WATCHDOG-SANITIZED-SOURCE-99758R1\",\"status\":\"OK\",\"changes_made\":false,\"rollback_started\":false,\"rollback_restored\":null}\n"
|
|
}
|