RFC Gateway Service + Python 3 Migration

.github/workflows/build_and_test.yml

@@ -8,105 +8,109 @@ on: [push, pull_request]
 jobs:
   health:
     name: Check code health
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: [2.7]
+        python-version: ["3.9", "3.11"]
     steps:
       - name: Checkout HoneySAP
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
       - name: Setup Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install dependencies
         run: |
-          python2 -m pip install --upgrade pip wheel
-          python2 -m pip install flake8 six
-          python2 -m pip install -r requirements.txt
-      - name: Run flake8 tests
+          python -m pip install --upgrade pip wheel
+          python -m pip install flake8
+      - name: Run flake8 (syntax errors only)
         run: |
           flake8 . --count --select=E901,E999,F821,F822,F823 --show-source --statistics
+      - name: Run flake8 (style warnings)
+        run: |
           flake8 . --count --ignore=E501 --exit-zero --max-complexity=10 --max-line-length=127 --statistics
 
   test:
     name: Run unit tests and build wheel
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: [2.7]
+        python-version: ["3.9", "3.11"]
     steps:
       - name: Checkout HoneySAP
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
       - name: Setup Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
-
+      - name: Install pysap
+        run: |
+          python -m pip install "git+https://github.com/OWASP/pysap.git"
       - name: Install Python dependencies
         run: |
-          python2 -m pip install --upgrade pip wheel
-          python2 -m pip install -r requirements.txt
+          python -m pip install --upgrade pip wheel
+          python -m pip install -r requirements.txt
       - name: Run unit tests
         run: |
-          python setup.py test
+          python -m pytest tests/ -v || python setup.py test
       - name: Build source artifact
         run: |
           python setup.py sdist
       - name: Build wheel artifact
         run: |
           python setup.py bdist_wheel
       - name: Upload wheel artifact
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v4
         with:
-          name: packages
+          name: packages-${{ matrix.python-version }}
           path: dist/*.whl
 
   docs:
-    name: Build documentation and source package
-    runs-on: ubuntu-18.04
+    name: Build documentation
+    runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: [2.7]
+        python-version: ["3.9"]
     steps:
       - name: Checkout HoneySAP
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
       - name: Setup Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install Linux dependencies
         run: |
-          sudo apt-get install pandoc texlive-latex-base
+          sudo apt-get install -y pandoc texlive-latex-base
+      - name: Install pysap
+        run: |
+          python -m pip install "git+https://github.com/OWASP/pysap.git"
       - name: Install Python dependencies
         run: |
-          python2 -m pip install --upgrade pip wheel
-          python2 -m pip install -r requirements-docs.txt
+          python -m pip install --upgrade pip
+          python -m pip install -r requirements-docs.txt
       - name: Install the library
         run: |
-          python2 setup.py install
+          python setup.py install
       - name: Build documentation
         run: |
-          python2 setup.py doc
+          python setup.py doc
 
   release:
     name: Release
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
     needs: [test, docs]
     env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    if: ${{ github.event_name == 'push' && startsWith(github.ref, 'v') }}
+    if: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') }}
     steps:
        - name: Download artifacts
-         uses: actions/download-artifact@v2
+         uses: actions/download-artifact@v4
          with:
-            name: packages
+            pattern: packages-*
+            merge-multiple: true
             path: dist
        - name: Create release and upload assets
-         uses: meeDamian/github-release@2.0
+         uses: softprops/action-gh-release@v2
          with:
-            token: ${{ secrets.GITHUB_TOKEN }}
-            name: HoneySAP ${{ github.ref }}
             draft: true
-            files: dist/
-            gzip: folders
+            files: dist/*.whl

.github/workflows/docker_build.yml

@@ -9,12 +9,12 @@ env:
    DOCKER_TAG: honeysap:development
 
 jobs:
-  test:
+  build:
     name: Build docker image
     runs-on: ubuntu-latest
     steps:
       - name: Checkout HoneySAP
-        uses: actions/checkout@v2
-      - name: Builds docker image
+        uses: actions/checkout@v4
+      - name: Build docker image
         run: |
           docker build -t ${DOCKER_TAG} -f deployment/Dockerfile .

.gitignore

@@ -7,6 +7,7 @@ __pycache__/
 
 # Distribution / packaging
 .Python
+.venv/
 env/
 build/
 develop-eggs/
@@ -63,3 +64,8 @@ target/
 .project
 .pydevproject
 .settings
+.claude
+.DS_Store
+
+# Other files
+*.trc

ChangeLog.md

@@ -1,6 +1,30 @@
 Changelog
 =========
 
+v0.1.3 - 2026-XX-XX
+-------------------
+
+- `honeysap/services/gateway/`: Significantly enhanced SAP RFC Gateway service.
+  - Full NWRFC SDK handshake: responds to `RFC_SYSTEM_INFO`, `RFC_GET_FUNCTION_INTERFACE`,
+    and `DDIF_FIELDINFO_GET` with catalog-driven or synthetic responses.
+  - RFM catalog support: `rfm_catalog` CSV (exported via `Z_HONEYSAP_EXPORT`) drives
+    accurate parameter-interface responses for any known function module.
+  - DDIC catalog support: `ddic_catalog` CSV provides exact field layouts for
+    `DDIF_FIELDINFO_GET`, including nested internal table types (TTYP), correct
+    NUC/UC size arithmetic, and LINES_DESCR XML generation.
+  - Credential capture: SAP logon user, client, XOR-descrambled password, client IP,
+    hostname, OS username (CPI-C field; 12-byte limit flagged in events).
+  - XML parameter logging: NWRFC SDK wire-encoded XML for table/structure parameters
+    is extracted and logged inline for all business function calls.
+  - CVE-2025-42957 detection: calls to `/SLOAE/DEPLOY` are recognised and the
+    injected ABAP code is extracted from `IT_MODULE` and recorded line-by-line.
+- `honeysap/services/gateway/rfm_catalog.py`: New module to load RFC function module
+  catalog from CSV.
+- `honeysap/services/gateway/ddic_catalog.py`: New module to load DDIC structure
+  field definitions from CSV, including NUC/UC length normalisation.
+- `tools/Z_HONEYSAP_EXPORT.abap`: ABAP report to export both RFM and DDIC catalogs
+  from a reference SAP system.
+
 v0.1.2 - 2022-XX-XX
 -------------------
 

README.md

@@ -24,6 +24,11 @@ Features
 - modular services system
 - modular feeds system
 - console logging
+- SAP RFC Gateway emulation with full NWRFC SDK handshake support
+- RFM and DDIC catalog-driven responses for realistic function module interface replies
+- Credential capture (SAP logon user, client, descrambled password, OS user, IP)
+- XML parameter extraction and logging for all RFC business function calls
+- CVE-2025-42957 (`/SLOAE/DEPLOY`) exploit detection and ABAP code capture
 
 
 Installation

bin/honeysap

@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 # encoding: utf-8
 # HoneySAP - SAP low-interaction honeypot
 #

bin/honeysapeater

@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 # encoding: utf-8
 # HoneySAP - SAP low-interaction honeypot
 #