@panguard-ai/panguard-trap 0.1.0

package/dist/services/rdp-trap.js

@@ -0,0 +1,299 @@
+/**
+ * RDP (X.224 + CredSSP) Protocol Honeypot
+ * RDP (X.224 + CredSSP) 協議蜜罐
+ *
+ * Speaks real RDP initial negotiation:
+ * - Parses X.224 Connection Request (CR) with cookie/username
+ * - Sends X.224 Connection Confirm (CC) with NLA/CredSSP
+ * - Captures TLS ClientHello / CredSSP auth attempts
+ *
+ * @module @panguard-ai/panguard-trap/services/rdp-trap
+ */
+import { createLogger } from '@panguard-ai/core';
+import { BaseTrapService } from './base-service.js';
+const logger = createLogger('panguard-trap:service:rdp');
+// TPKT header (RFC 1006)
+const TPKT_VERSION = 3;
+// X.224 types
+const X224_CONNECTION_REQUEST = 0xe0;
+const X224_CONNECTION_CONFIRM = 0xd0;
+// RDP Negotiation types
+const TYPE_RDP_NEG_REQ = 0x01;
+const TYPE_RDP_NEG_RSP = 0x02;
+const TYPE_RDP_NEG_FAILURE = 0x03;
+// Negotiation protocols
+const PROTOCOL_RDP = 0x00000000;
+const PROTOCOL_SSL = 0x00000001;
+const PROTOCOL_HYBRID = 0x00000002; // CredSSP (NLA)
+// Failure codes
+const SSL_REQUIRED_BY_SERVER = 0x00000001;
+// ---------------------------------------------------------------------------
+// Packet Builders
+// ---------------------------------------------------------------------------
+/**
+ * Build TPKT + X.224 Connection Confirm with RDP Negotiation Response.
+ *
+ * The response tells the client which security protocol the server wants.
+ * We respond with CredSSP/NLA to force the client to attempt authentication,
+ * which reveals credentials in the TLS/CredSSP handshake.
+ */
+function buildConnectionConfirm(requestedProtocol) {
+    // X.224 CC payload (without TPKT header)
+    // X.224 header: length indicator (1), CC (1), DST-REF (2), SRC-REF (2), class (1) = 7 bytes
+    // RDP Neg Response: type (1), flags (1), length (2), selectedProtocol (4) = 8 bytes
+    const useNLA = (requestedProtocol & PROTOCOL_HYBRID) !== 0;
+    const useSSL = (requestedProtocol & PROTOCOL_SSL) !== 0;
+    let selectedProtocol;
+    if (useNLA) {
+        selectedProtocol = PROTOCOL_HYBRID;
+    }
+    else if (useSSL) {
+        selectedProtocol = PROTOCOL_SSL;
+    }
+    else {
+        selectedProtocol = PROTOCOL_RDP;
+    }
+    // Build X.224 CC + RDP Neg RSP
+    const x224Len = 7 + 8; // 15 bytes
+    const x224 = Buffer.alloc(x224Len);
+    let pos = 0;
+    // X.224 Connection Confirm
+    x224[pos++] = x224Len - 1; // Length indicator (excluding itself)
+    x224[pos++] = X224_CONNECTION_CONFIRM; // CC
+    x224[pos++] = 0x00;
+    x224[pos++] = 0x00; // DST-REF
+    x224[pos++] = 0x00;
+    x224[pos++] = 0x00; // SRC-REF
+    x224[pos++] = 0x00; // Class/Options
+    // RDP Negotiation Response
+    x224[pos++] = TYPE_RDP_NEG_RSP;
+    x224[pos++] = 0x00; // Flags
+    x224[pos++] = 0x08;
+    x224[pos++] = 0x00; // Length (8)
+    x224[pos++] = selectedProtocol & 0xff;
+    x224[pos++] = (selectedProtocol >> 8) & 0xff;
+    x224[pos++] = (selectedProtocol >> 16) & 0xff;
+    x224[pos++] = (selectedProtocol >> 24) & 0xff;
+    // TPKT header
+    const tpktLen = 4 + x224Len;
+    const tpkt = Buffer.alloc(4);
+    tpkt[0] = TPKT_VERSION;
+    tpkt[1] = 0x00; // Reserved
+    tpkt[2] = (tpktLen >> 8) & 0xff;
+    tpkt[3] = tpktLen & 0xff;
+    return Buffer.concat([tpkt, x224]);
+}
+/** Build RDP Negotiation Failure response */
+function buildNegFailure(failureCode) {
+    const x224Len = 7 + 8;
+    const x224 = Buffer.alloc(x224Len);
+    let pos = 0;
+    x224[pos++] = x224Len - 1;
+    x224[pos++] = X224_CONNECTION_CONFIRM;
+    x224[pos++] = 0x00;
+    x224[pos++] = 0x00;
+    x224[pos++] = 0x00;
+    x224[pos++] = 0x00;
+    x224[pos++] = 0x00;
+    x224[pos++] = TYPE_RDP_NEG_FAILURE;
+    x224[pos++] = 0x00;
+    x224[pos++] = 0x08;
+    x224[pos++] = 0x00;
+    x224[pos++] = failureCode & 0xff;
+    x224[pos++] = (failureCode >> 8) & 0xff;
+    x224[pos++] = (failureCode >> 16) & 0xff;
+    x224[pos++] = (failureCode >> 24) & 0xff;
+    const tpktLen = 4 + x224Len;
+    const tpkt = Buffer.alloc(4);
+    tpkt[0] = TPKT_VERSION;
+    tpkt[1] = 0x00;
+    tpkt[2] = (tpktLen >> 8) & 0xff;
+    tpkt[3] = tpktLen & 0xff;
+    return Buffer.concat([tpkt, x224]);
+}
+/**
+ * Parse X.224 Connection Request to extract:
+ * - Cookie (mstshash=username)
+ * - Requested security protocols
+ */
+function parseConnectionRequest(data) {
+    const result = {
+        cookie: null,
+        username: null,
+        requestedProtocol: 0,
+    };
+    if (data.length < 11)
+        return result;
+    // Skip TPKT (4 bytes) + X.224 length indicator (1) + CR code (1) + DST-REF (2) + SRC-REF (2) + class (1)
+    const pos = 4 + 1 + 1 + 2 + 2 + 1; // = 11
+    // Look for cookie and RDP Neg Req in the remaining data
+    const remaining = data.subarray(pos);
+    const str = remaining.toString('ascii');
+    // Extract cookie (Cookie: mstshash=username\r\n)
+    const cookieMatch = str.match(/Cookie:\s*mstshash=([^\r\n]+)/i);
+    if (cookieMatch) {
+        result.cookie = cookieMatch[1].trim();
+        result.username = result.cookie;
+    }
+    // Look for RDP Negotiation Request at the end
+    // Find TYPE_RDP_NEG_REQ byte
+    for (let i = remaining.length - 8; i >= 0; i--) {
+        if (remaining[i] === TYPE_RDP_NEG_REQ &&
+            remaining[i + 2] === 0x08 &&
+            remaining[i + 3] === 0x00) {
+            result.requestedProtocol = remaining.readUInt32LE(i + 4);
+            break;
+        }
+    }
+    return result;
+}
+// ---------------------------------------------------------------------------
+// RDP Trap Service
+// ---------------------------------------------------------------------------
+export class RDPTrapService extends BaseTrapService {
+    server = null;
+    constructor(config) {
+        super({ ...config, type: 'rdp' });
+    }
+    async doStart() {
+        const net = await import('node:net');
+        this.server = net.createServer((socket) => this.handleConnection(socket));
+        return new Promise((resolve, reject) => {
+            this.server.listen(this.config.port, () => resolve());
+            this.server.on('error', reject);
+        });
+    }
+    async doStop() {
+        return new Promise((resolve) => {
+            if (this.server) {
+                this.server.close(() => resolve());
+            }
+            else {
+                resolve();
+            }
+        });
+    }
+    handleConnection(socket) {
+        const remoteIP = socket.remoteAddress ?? 'unknown';
+        const remotePort = socket.remotePort ?? 0;
+        const session = this.createSession(remoteIP, remotePort);
+        this.addMitreTechnique(session.sessionId, 'T1021.001'); // RDP
+        let phase = 'x224';
+        let dataCount = 0;
+        const timeout = this.config.sessionTimeoutMs ?? 60_000;
+        socket.setTimeout(timeout);
+        socket.on('data', (data) => {
+            dataCount++;
+            if (phase === 'x224') {
+                // Expect X.224 Connection Request
+                if (data.length < 11)
+                    return;
+                // Check TPKT header
+                if (data[0] !== TPKT_VERSION) {
+                    // Not a valid TPKT, might be a scanner sending garbage
+                    this.recordEvent(session.sessionId, 'exploit_attempt', 'Non-TPKT data received', {
+                        rawHex: data.subarray(0, 32).toString('hex'),
+                    });
+                    return;
+                }
+                // Check X.224 CR
+                const x224Type = data[5];
+                if (x224Type !== X224_CONNECTION_REQUEST) {
+                    return;
+                }
+                const parsed = parseConnectionRequest(data);
+                if (parsed.username) {
+                    this.recordCredential(session.sessionId, parsed.username, '***RDP_COOKIE***', false);
+                    this.recordEvent(session.sessionId, 'authentication_attempt', `RDP cookie: ${parsed.username}`, {
+                        cookie: parsed.cookie,
+                    });
+                }
+                this.recordCommand(session.sessionId, `X224_CR protocol=${parsed.requestedProtocol}`);
+                // Send Connection Confirm
+                const delay = this.config.responseDelayMs ?? 200;
+                setTimeout(() => {
+                    try {
+                        if (parsed.requestedProtocol & PROTOCOL_HYBRID) {
+                            // Client supports NLA - send confirm, they'll attempt CredSSP/TLS
+                            socket.write(buildConnectionConfirm(parsed.requestedProtocol));
+                            phase = 'tls';
+                        }
+                        else if (parsed.requestedProtocol & PROTOCOL_SSL) {
+                            // Client wants SSL only - send confirm
+                            socket.write(buildConnectionConfirm(parsed.requestedProtocol));
+                            phase = 'tls';
+                        }
+                        else {
+                            // Plain RDP - send failure requiring SSL
+                            socket.write(buildNegFailure(SSL_REQUIRED_BY_SERVER));
+                            socket.end();
+                        }
+                    }
+                    catch {
+                        // socket closed
+                    }
+                }, delay);
+                return;
+            }
+            if (phase === 'tls') {
+                // Client will send TLS ClientHello or CredSSP NTLM
+                this.recordEvent(session.sessionId, 'authentication_attempt', 'TLS/CredSSP handshake data', {
+                    dataLength: data.length,
+                    firstBytes: data.subarray(0, 16).toString('hex'),
+                });
+                // Check for NTLMSSP in CredSSP
+                const ntlmIdx = data.indexOf(Buffer.from('NTLMSSP\0', 'ascii'));
+                if (ntlmIdx >= 0) {
+                    this.addMitreTechnique(session.sessionId, 'T1110');
+                    // Try to extract username from NTLMSSP Auth (type 3)
+                    const msgType = data.readUInt32LE(ntlmIdx + 8);
+                    if (msgType === 3) {
+                        // NTLMSSP Auth message
+                        try {
+                            const userLen = data.readUInt16LE(ntlmIdx + 36);
+                            const userOff = data.readUInt32LE(ntlmIdx + 40);
+                            const username = data
+                                .subarray(ntlmIdx + userOff, ntlmIdx + userOff + userLen)
+                                .toString('utf16le');
+                            const domainLen = data.readUInt16LE(ntlmIdx + 28);
+                            const domainOff = data.readUInt32LE(ntlmIdx + 32);
+                            const domain = data
+                                .subarray(ntlmIdx + domainOff, ntlmIdx + domainOff + domainLen)
+                                .toString('utf16le');
+                            const fullUser = domain ? `${domain}\\${username}` : username;
+                            this.recordCredential(session.sessionId, fullUser, '***NTLM_RDP***', false);
+                        }
+                        catch {
+                            // Malformed NTLMSSP
+                        }
+                    }
+                }
+                // After a few data exchanges, close with auth failure
+                if (dataCount > 5) {
+                    phase = 'post_tls';
+                    setTimeout(() => {
+                        try {
+                            socket.end();
+                        }
+                        catch {
+                            /* */
+                        }
+                    }, 500);
+                }
+                return;
+            }
+            // post_tls - just record and close
+            this.recordCommand(session.sessionId, `post_tls_data_len=${data.length}`);
+        });
+        socket.on('timeout', () => {
+            logger.info(`RDP session timeout: ${session.sessionId}`);
+            socket.end();
+        });
+        socket.on('close', () => this.endSession(session.sessionId));
+        socket.on('error', (err) => {
+            logger.debug(`RDP socket error: ${err.message}`);
+            this.endSession(session.sessionId);
+        });
+    }
+}
+//# sourceMappingURL=rdp-trap.js.map

package/dist/services/rdp-trap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rdp-trap.js","sourceRoot":"","sources":["../../src/services/rdp-trap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,MAAM,GAAG,YAAY,CAAC,2BAA2B,CAAC,CAAC;AAEzD,yBAAyB;AACzB,MAAM,YAAY,GAAG,CAAC,CAAC;AAEvB,cAAc;AACd,MAAM,uBAAuB,GAAG,IAAI,CAAC;AACrC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAErC,wBAAwB;AACxB,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAElC,wBAAwB;AACxB,MAAM,YAAY,GAAG,UAAU,CAAC;AAChC,MAAM,YAAY,GAAG,UAAU,CAAC;AAChC,MAAM,eAAe,GAAG,UAAU,CAAC,CAAC,gBAAgB;AAEpD,gBAAgB;AAChB,MAAM,sBAAsB,GAAG,UAAU,CAAC;AAE1C,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E;;;;;;GAMG;AACH,SAAS,sBAAsB,CAAC,iBAAyB;IACvD,yCAAyC;IACzC,4FAA4F;IAC5F,oFAAoF;IAEpF,MAAM,MAAM,GAAG,CAAC,iBAAiB,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,CAAC,iBAAiB,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAExD,IAAI,gBAAwB,CAAC;IAC7B,IAAI,MAAM,EAAE,CAAC;QACX,gBAAgB,GAAG,eAAe,CAAC;IACrC,CAAC;SAAM,IAAI,MAAM,EAAE,CAAC;QAClB,gBAAgB,GAAG,YAAY,CAAC;IAClC,CAAC;SAAM,CAAC;QACN,gBAAgB,GAAG,YAAY,CAAC;IAClC,CAAC;IAED,+BAA+B;IAC/B,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,GAAG,GAAG,CAAC,CAAC;IAEZ,2BAA2B;IAC3B,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC,CAAC,sCAAsC;IACjE,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,uBAAuB,CAAC,CAAC,KAAK;IAC5C,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;IACnB,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,UAAU;IAC9B,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;IACnB,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,UAAU;IAC9B,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,gBAAgB;IAEpC,2BAA2B;IAC3B,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,gBAAgB,CAAC;IAC/B,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ;IAC5B,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;IACnB,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,aAAa;IACjC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,gBAAgB,GAAG,IAAI,CAAC;IACtC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAC7C,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;IAC9C,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;IAE9C,cAAc;IACd,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC;IACvB,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,WAAW;IAC3B,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAChC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,IAAI,CAAC;IAEzB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,6CAA6C;AAC7C,SAAS,eAAe,CAAC,WAAmB;IAC1C,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;IACtB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,GAAG,GAAG,CAAC,CAAC;IAEZ,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC;IAC1B,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,uBAAuB,CAAC;IACtC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;IACnB,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;IACnB,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;IACnB,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;IACnB,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;IAEnB,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,oBAAoB,CAAC;IACnC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;IACnB,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;IACnB,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;IACnB,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,WAAW,GAAG,IAAI,CAAC;IACjC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IACxC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;IACzC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;IAEzC,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC;IACvB,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IACf,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAChC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,IAAI,CAAC;IAEzB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,IAAY;IAK1C,MAAM,MAAM,GAAG;QACb,MAAM,EAAE,IAAqB;QAC7B,QAAQ,EAAE,IAAqB;QAC/B,iBAAiB,EAAE,CAAC;KACrB,CAAC;IAEF,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC;IAEpC,yGAAyG;IACzG,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO;IAE1C,wDAAwD;IACxD,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAExC,iDAAiD;IACjD,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAChE,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;IAClC,CAAC;IAED,8CAA8C;IAC9C,6BAA6B;IAC7B,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/C,IACE,SAAS,CAAC,CAAC,CAAC,KAAK,gBAAgB;YACjC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI;YACzB,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EACzB,CAAC;YACD,MAAM,CAAC,iBAAiB,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzD,MAAM;QACR,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,MAAM,OAAO,cAAe,SAAQ,eAAe;IACzC,MAAM,GAA8D,IAAI,CAAC;IAEjF,YAAY,MAAyB;QACnC,KAAK,CAAC,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpC,CAAC;IAES,KAAK,CAAC,OAAO;QACrB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;QAE1E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,MAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACvD,IAAI,CAAC,MAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;IAES,KAAK,CAAC,MAAM;QACpB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACN,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,gBAAgB,CAAC,MAAiC;QACxD,MAAM,QAAQ,GAAG,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;QACnD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEzD,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM;QAE9D,IAAI,KAAK,GAAgC,MAAM,CAAC;QAChD,IAAI,SAAS,GAAG,CAAC,CAAC;QAElB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC;QACvD,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE3B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;YACjC,SAAS,EAAE,CAAC;YAEZ,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;gBACrB,kCAAkC;gBAClC,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE;oBAAE,OAAO;gBAE7B,oBAAoB;gBACpB,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,YAAY,EAAE,CAAC;oBAC7B,uDAAuD;oBACvD,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,iBAAiB,EAAE,wBAAwB,EAAE;wBAC/E,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;qBAC7C,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBAED,iBAAiB;gBACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACzB,IAAI,QAAQ,KAAK,uBAAuB,EAAE,CAAC;oBACzC,OAAO;gBACT,CAAC;gBAED,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;gBAE5C,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;oBACpB,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC;oBACrF,IAAI,CAAC,WAAW,CACd,OAAO,CAAC,SAAS,EACjB,wBAAwB,EACxB,eAAe,MAAM,CAAC,QAAQ,EAAE,EAChC;wBACE,MAAM,EAAE,MAAM,CAAC,MAAM;qBACtB,CACF,CAAC;gBACJ,CAAC;gBAED,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,oBAAoB,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC;gBAEtF,0BAA0B;gBAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,GAAG,CAAC;gBACjD,UAAU,CAAC,GAAG,EAAE;oBACd,IAAI,CAAC;wBACH,IAAI,MAAM,CAAC,iBAAiB,GAAG,eAAe,EAAE,CAAC;4BAC/C,kEAAkE;4BAClE,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;4BAC/D,KAAK,GAAG,KAAK,CAAC;wBAChB,CAAC;6BAAM,IAAI,MAAM,CAAC,iBAAiB,GAAG,YAAY,EAAE,CAAC;4BACnD,uCAAuC;4BACvC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;4BAC/D,KAAK,GAAG,KAAK,CAAC;wBAChB,CAAC;6BAAM,CAAC;4BACN,yCAAyC;4BACzC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,sBAAsB,CAAC,CAAC,CAAC;4BACtD,MAAM,CAAC,GAAG,EAAE,CAAC;wBACf,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,gBAAgB;oBAClB,CAAC;gBACH,CAAC,EAAE,KAAK,CAAC,CAAC;gBACV,OAAO;YACT,CAAC;YAED,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;gBACpB,mDAAmD;gBACnD,IAAI,CAAC,WAAW,CACd,OAAO,CAAC,SAAS,EACjB,wBAAwB,EACxB,4BAA4B,EAC5B;oBACE,UAAU,EAAE,IAAI,CAAC,MAAM;oBACvB,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;iBACjD,CACF,CAAC;gBAEF,+BAA+B;gBAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;gBAChE,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;oBACjB,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;oBAEnD,qDAAqD;oBACrD,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;oBAC/C,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;wBAClB,uBAAuB;wBACvB,IAAI,CAAC;4BACH,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;4BAChD,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;4BAChD,MAAM,QAAQ,GAAG,IAAI;iCAClB,QAAQ,CAAC,OAAO,GAAG,OAAO,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;iCACxD,QAAQ,CAAC,SAAS,CAAC,CAAC;4BAEvB,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;4BAClD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;4BAClD,MAAM,MAAM,GAAG,IAAI;iCAChB,QAAQ,CAAC,OAAO,GAAG,SAAS,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;iCAC9D,QAAQ,CAAC,SAAS,CAAC,CAAC;4BAEvB,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,KAAK,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;4BAC9D,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;wBAC9E,CAAC;wBAAC,MAAM,CAAC;4BACP,oBAAoB;wBACtB,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,sDAAsD;gBACtD,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;oBAClB,KAAK,GAAG,UAAU,CAAC;oBACnB,UAAU,CAAC,GAAG,EAAE;wBACd,IAAI,CAAC;4BACH,MAAM,CAAC,GAAG,EAAE,CAAC;wBACf,CAAC;wBAAC,MAAM,CAAC;4BACP,KAAK;wBACP,CAAC;oBACH,CAAC,EAAE,GAAG,CAAC,CAAC;gBACV,CAAC;gBACD,OAAO;YACT,CAAC;YAED,mCAAmC;YACnC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,qBAAqB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACxB,MAAM,CAAC,IAAI,CAAC,wBAAwB,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;YACzD,MAAM,CAAC,GAAG,EAAE,CAAC;QACf,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAC7D,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,MAAM,CAAC,KAAK,CAAC,qBAAqB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACjD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/services/redis-trap.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Redis RESP Protocol Honeypot
+ * Redis RESP 協議蜜罐
+ *
+ * Speaks the real Redis Serialization Protocol (RESP):
+ * - Parses inline commands and RESP bulk strings
+ * - Handles AUTH, CONFIG, EVAL, SLAVEOF with realistic responses
+ * - Detects exploit patterns (CVE-2022-0543, rogue server, etc.)
+ *
+ * @module @panguard-ai/panguard-trap/services/redis-trap
+ */
+import type { TrapServiceConfig } from '../types.js';
+import { BaseTrapService } from './base-service.js';
+export declare class RedisTrapService extends BaseTrapService {
+    private server;
+    constructor(config: TrapServiceConfig);
+    protected doStart(): Promise<void>;
+    protected doStop(): Promise<void>;
+    private handleConnection;
+}
+//# sourceMappingURL=redis-trap.d.ts.map

package/dist/services/redis-trap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-trap.d.ts","sourceRoot":"","sources":["../../src/services/redis-trap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAsIpD,qBAAa,gBAAiB,SAAQ,eAAe;IACnD,OAAO,CAAC,MAAM,CAAmE;gBAErE,MAAM,EAAE,iBAAiB;cAIrB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;cAUxB,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAUvC,OAAO,CAAC,gBAAgB;CAgMzB"}

package/dist/services/redis-trap.js

@@ -0,0 +1,321 @@
+/**
+ * Redis RESP Protocol Honeypot
+ * Redis RESP 協議蜜罐
+ *
+ * Speaks the real Redis Serialization Protocol (RESP):
+ * - Parses inline commands and RESP bulk strings
+ * - Handles AUTH, CONFIG, EVAL, SLAVEOF with realistic responses
+ * - Detects exploit patterns (CVE-2022-0543, rogue server, etc.)
+ *
+ * @module @panguard-ai/panguard-trap/services/redis-trap
+ */
+import { createLogger } from '@panguard-ai/core';
+import { BaseTrapService } from './base-service.js';
+const logger = createLogger('panguard-trap:service:redis');
+// ---------------------------------------------------------------------------
+// RESP builder helpers
+// ---------------------------------------------------------------------------
+function respSimple(msg) {
+    return `+${msg}\r\n`;
+}
+function respError(msg) {
+    return `-${msg}\r\n`;
+}
+function respInt(n) {
+    return `:${n}\r\n`;
+}
+function respBulk(s) {
+    return `$${Buffer.byteLength(s)}\r\n${s}\r\n`;
+}
+function respNullBulk() {
+    return '$-1\r\n';
+}
+function respArray(items) {
+    let out = `*${items.length}\r\n`;
+    for (const item of items) {
+        out += respBulk(item);
+    }
+    return out;
+}
+// ---------------------------------------------------------------------------
+// RESP parser - handles both inline and multibulk commands
+// ---------------------------------------------------------------------------
+function parseRESP(buf) {
+    const commands = [];
+    const lines = buf.split('\r\n');
+    let i = 0;
+    while (i < lines.length) {
+        const line = lines[i];
+        if (line.length === 0) {
+            i++;
+            continue;
+        }
+        if (line.startsWith('*')) {
+            // Multibulk
+            const count = parseInt(line.slice(1), 10);
+            if (isNaN(count) || count < 0) {
+                i++;
+                continue;
+            }
+            const args = [];
+            i++;
+            for (let j = 0; j < count && i < lines.length; j++) {
+                const header = lines[i];
+                if (header.startsWith('$')) {
+                    i++;
+                    if (i < lines.length) {
+                        args.push(lines[i]);
+                        i++;
+                    }
+                }
+                else {
+                    args.push(header);
+                    i++;
+                }
+            }
+            if (args.length > 0)
+                commands.push(args);
+        }
+        else {
+            // Inline command
+            const parts = line.trim().split(/\s+/);
+            if (parts.length > 0 && parts[0]) {
+                commands.push(parts);
+            }
+            i++;
+        }
+    }
+    return commands;
+}
+// ---------------------------------------------------------------------------
+// MITRE patterns for Redis exploitation
+// ---------------------------------------------------------------------------
+const REDIS_MITRE_PATTERNS = [
+    [/CONFIG\s+SET\s+dir/i, 'T1059'], // Arbitrary file write
+    [/CONFIG\s+SET\s+dbfilename/i, 'T1059'],
+    [/SLAVEOF|REPLICAOF/i, 'T1219'], // Rogue server / C2
+    [/MODULE\s+LOAD/i, 'T1129'], // Shared modules
+    [/EVAL.*os\.execute/i, 'T1059'], // Lua RCE (CVE-2022-0543)
+    [/EVAL.*io\.popen/i, 'T1059'],
+    [/EVAL.*loadlib/i, 'T1059'],
+    [/DEBUG\s+SET-ACTIVE-EXPIRE/i, 'T1499'], // DoS
+    [/FLUSHALL|FLUSHDB/i, 'T1485'], // Data destruction
+    [/BGSAVE|SAVE/i, 'T1005'], // Data access
+];
+// ---------------------------------------------------------------------------
+// Fake INFO response
+// ---------------------------------------------------------------------------
+const FAKE_INFO = [
+    '# Server',
+    'redis_version:6.2.14',
+    'redis_git_sha1:00000000',
+    'redis_mode:standalone',
+    'os:Linux 5.15.0-91-generic x86_64',
+    'arch_bits:64',
+    'tcp_port:6379',
+    'uptime_in_seconds:172800',
+    'uptime_in_days:2',
+    '',
+    '# Clients',
+    'connected_clients:1',
+    'blocked_clients:0',
+    '',
+    '# Memory',
+    'used_memory:1024000',
+    'used_memory_human:1000.00K',
+    'used_memory_peak:2048000',
+    '',
+    '# Keyspace',
+    'db0:keys=42,expires=5,avg_ttl=86400000',
+].join('\r\n');
+// ---------------------------------------------------------------------------
+// Redis Trap Service
+// ---------------------------------------------------------------------------
+export class RedisTrapService extends BaseTrapService {
+    server = null;
+    constructor(config) {
+        super({ ...config, type: 'redis' });
+    }
+    async doStart() {
+        const net = await import('node:net');
+        this.server = net.createServer((socket) => this.handleConnection(socket));
+        return new Promise((resolve, reject) => {
+            this.server.listen(this.config.port, () => resolve());
+            this.server.on('error', reject);
+        });
+    }
+    async doStop() {
+        return new Promise((resolve) => {
+            if (this.server) {
+                this.server.close(() => resolve());
+            }
+            else {
+                resolve();
+            }
+        });
+    }
+    handleConnection(socket) {
+        const remoteIP = socket.remoteAddress ?? 'unknown';
+        const remotePort = socket.remotePort ?? 0;
+        const session = this.createSession(remoteIP, remotePort);
+        this.addMitreTechnique(session.sessionId, 'T1190'); // Exploit public-facing
+        let authAttempts = 0;
+        const timeout = this.config.sessionTimeoutMs ?? 30_000;
+        socket.setTimeout(timeout);
+        // Redis has no banner - waits for client command
+        socket.on('data', (data) => {
+            const raw = data.toString('utf-8');
+            const commands = parseRESP(raw);
+            for (const args of commands) {
+                if (args.length === 0)
+                    continue;
+                const cmd = args[0].toUpperCase();
+                const fullCmd = args.join(' ');
+                this.recordCommand(session.sessionId, fullCmd);
+                // MITRE detection
+                for (const [pattern, technique] of REDIS_MITRE_PATTERNS) {
+                    if (pattern.test(fullCmd)) {
+                        this.addMitreTechnique(session.sessionId, technique);
+                        this.recordEvent(session.sessionId, 'exploit_attempt', fullCmd, { technique });
+                    }
+                }
+                const delay = this.config.responseDelayMs ?? 30;
+                const respond = (resp) => {
+                    setTimeout(() => {
+                        try {
+                            socket.write(resp);
+                        }
+                        catch {
+                            /* closed */
+                        }
+                    }, delay);
+                };
+                // Handle AUTH
+                if (cmd === 'AUTH') {
+                    authAttempts++;
+                    const password = args[1] ?? '';
+                    this.recordCredential(session.sessionId, 'default', password, authAttempts >= 3);
+                    if (authAttempts >= 3) {
+                        this.addMitreTechnique(session.sessionId, 'T1078');
+                        respond(respSimple('OK'));
+                    }
+                    else {
+                        respond(respError('WRONGPASS invalid username-password pair'));
+                    }
+                    continue;
+                }
+                if (cmd === 'QUIT') {
+                    try {
+                        socket.write(respSimple('OK'));
+                    }
+                    catch {
+                        /* */
+                    }
+                    socket.end();
+                    return;
+                }
+                if (cmd === 'PING') {
+                    respond(args[1] ? respBulk(args[1]) : respSimple('PONG'));
+                    continue;
+                }
+                if (cmd === 'ECHO' && args[1]) {
+                    respond(respBulk(args[1]));
+                    continue;
+                }
+                if (cmd === 'INFO') {
+                    respond(respBulk(FAKE_INFO));
+                    continue;
+                }
+                if (cmd === 'DBSIZE') {
+                    respond(respInt(42));
+                    continue;
+                }
+                if (cmd === 'CONFIG') {
+                    const sub = args[1]?.toUpperCase();
+                    if (sub === 'SET') {
+                        respond(respError('ERR Insufficient permissions to modify config'));
+                    }
+                    else if (sub === 'GET') {
+                        const key = args[2] ?? '*';
+                        respond(respArray([key, '']));
+                    }
+                    else {
+                        respond(respSimple('OK'));
+                    }
+                    continue;
+                }
+                if (cmd === 'KEYS') {
+                    respond(respArray(['session:abc123', 'cache:homepage', 'user:1001', 'token:jwt_xyz']));
+                    continue;
+                }
+                if (cmd === 'GET') {
+                    respond(respNullBulk());
+                    continue;
+                }
+                if (cmd === 'SET' || cmd === 'DEL' || cmd === 'MSET' || cmd === 'HSET') {
+                    respond(respError("READONLY You can't write against a read only replica."));
+                    continue;
+                }
+                if (cmd === 'SLAVEOF' || cmd === 'REPLICAOF') {
+                    respond(respError('ERR SLAVEOF not allowed'));
+                    continue;
+                }
+                if (cmd === 'MODULE') {
+                    respond(respError('ERR MODULE command not allowed'));
+                    continue;
+                }
+                if (cmd === 'EVAL' || cmd === 'EVALSHA' || cmd === 'SCRIPT') {
+                    respond(respError('NOSCRIPT No matching script. Are you sure the script is loaded?'));
+                    continue;
+                }
+                if (cmd === 'FLUSHALL' || cmd === 'FLUSHDB') {
+                    respond(respError('ERR operation not permitted'));
+                    continue;
+                }
+                if (cmd === 'CLIENT') {
+                    const sub = args[1]?.toUpperCase();
+                    if (sub === 'SETNAME') {
+                        respond(respSimple('OK'));
+                    }
+                    else if (sub === 'GETNAME') {
+                        respond(respNullBulk());
+                    }
+                    else if (sub === 'LIST') {
+                        respond(respBulk(`id=1 addr=${remoteIP}:${remotePort} fd=8 name= age=0 idle=0 flags=N db=0 sub=0 psub=0 multi=-1 qbuf=0 qbuf-free=0 obl=0 oll=0 omem=0 events=r cmd=client`));
+                    }
+                    else {
+                        respond(respSimple('OK'));
+                    }
+                    continue;
+                }
+                if (cmd === 'SELECT') {
+                    respond(respSimple('OK'));
+                    continue;
+                }
+                if (cmd === 'TYPE') {
+                    respond(respSimple('string'));
+                    continue;
+                }
+                if (cmd === 'TTL' || cmd === 'PTTL') {
+                    respond(respInt(-1));
+                    continue;
+                }
+                if (cmd === 'SCAN') {
+                    respond(`*2\r\n$1\r\n0\r\n${respArray(['session:abc123', 'cache:homepage', 'user:1001'])}`);
+                    continue;
+                }
+                respond(respError(`ERR unknown command '${cmd}'`));
+            }
+        });
+        socket.on('timeout', () => {
+            logger.info(`Redis session timeout: ${session.sessionId}`);
+            socket.end();
+        });
+        socket.on('close', () => this.endSession(session.sessionId));
+        socket.on('error', (err) => {
+            logger.debug(`Redis socket error: ${err.message}`);
+            this.endSession(session.sessionId);
+        });
+    }
+}
+//# sourceMappingURL=redis-trap.js.map