feat: harden UDS probe for Contact Search Authentication (9443 + auth flag) - #30
Merged
Conversation
…error The startup version probe hit the UDS port (8443) for every -H host, even for --brute-mac and plain config/phone scans that never touch UDS. Against a host where UDS is firewalled or not listening, those runs paid a full read timeout and printed a misleading "Could not retrieve CUCM version" error unrelated to what the user asked for. Gate the probe to the features that actually use UDS (--servers, --directory, --userenum, --spray). Separately, --brute-mac with -H and no seeded prefixes printed "You must specify at least one phone with -p (or a CUCM server with -H)", implying -H was missing when it was in fact supplied. --brute-mac never queries the server; it replays MAC prefixes already harvested by --userenum/--spray or a phone scan. The message now names the host and points at the seeding steps. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
… flag) Contact Search Authentication (CLI `utils contactsearchauthentication enable`) moves UDS off 8443 to 9443 and makes the /users resource require Basic auth. Both are cluster config, not tied to the CUCM major version (identical behaviour 11.5 through 15), so this is handled at runtime rather than version-gated. - get_version now parses <usersResourceAuthEnabled> and records the port it answered on. - New probe_uds() tries the requested port, then falls back to the other standard UDS port (8443<->9443) unless the user pinned --uds-port. The resolved port is threaded through every UDS feature call. - main() warns when the cluster requires auth for /users, so an empty --userenum/--directory/--spray reads as "auth required" instead of "no users", and notes when UDS was found on the alternate port. Confirmed against a live CUCM 14.0.1 target that the version endpoint is reachable unauthenticated on 8443; the fallback/auth paths are unit-tested. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Targets
dev(new integration branch). Stacked on the two fixes from #29 (cherry-picked here sodevcarries a complete set).Background
A
--brute-mac -H 10.45.200.3run reported a UDS failure that looked like a possible CUCM 14 incompatibility. It isn't: per Cisco DevNet the anonymous UDS endpoints (version,servers,clusterUser) are unchanged through 14/15, and/usersauth is the per-cluster Contact Search Authentication toggle (usersResourceAuthEnabled, defaultfalse), which has existed since 11.5. A live run against the target confirmed it is CUCM 14.0.1 and answers UDS unauthenticated on 8443. So no version gating — but two real, version-independent gaps were worth hardening.Changes
<usersResourceAuthEnabled>parsing.get_version()now reads this flag. When a cluster requires auth for/users, unauthenticated--userenum/--directory/--spraycome back empty even though the probe succeeds —main()now prints a clear warning so that doesn't read as "no users."8443↔9443 fallback (
probe_uds()). Enabling Contact Search Authentication moves UDS to 9443.probe_uds()tries the requested port, then the other standard UDS port, unless the user pinned--uds-port. The resolved port is threaded through every UDS feature call.Also included (from #29)
--brute-mac).--brute-mac -Hempty-database message.Testing
tests/test_uds_hardening.py(8 tests): auth-flag parsing, 9443 fallback,--uds-portpin respected, no redundant second probe,main()auth warning, resolved-port threading.Note on #29
#29 currently targets
main. If you want everything to flow throughdev, close #29 in favour of this branch (it contains those commits); otherwise merge #29 tomainand this todevand they'll reconcile.🤖 Generated with Claude Code