feat: UDS Contact Search Authentication support (9443 fallback + auth detection) - #31
Merged
Conversation
…error The startup version probe hit the UDS port (8443) for every -H host, even for --brute-mac and plain config/phone scans that never touch UDS. Against a host where UDS is firewalled or not listening, those runs paid a full read timeout and printed a misleading "Could not retrieve CUCM version" error unrelated to what the user asked for. Gate the probe to the features that actually use UDS (--servers, --directory, --userenum, --spray). Separately, --brute-mac with -H and no seeded prefixes printed "You must specify at least one phone with -p (or a CUCM server with -H)", implying -H was missing when it was in fact supplied. --brute-mac never queries the server; it replays MAC prefixes already harvested by --userenum/--spray or a phone scan. The message now names the host and points at the seeding steps. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
… flag) Contact Search Authentication (CLI `utils contactsearchauthentication enable`) moves UDS off 8443 to 9443 and makes the /users resource require Basic auth. Both are cluster config, not tied to the CUCM major version (identical behaviour 11.5 through 15), so this is handled at runtime rather than version-gated. - get_version now parses <usersResourceAuthEnabled> and records the port it answered on. - New probe_uds() tries the requested port, then falls back to the other standard UDS port (8443<->9443) unless the user pinned --uds-port. The resolved port is threaded through every UDS feature call. - main() warns when the cluster requires auth for /users, so an empty --userenum/--directory/--spray reads as "auth required" instead of "no users", and notes when UDS was found on the alternate port. Confirmed against a live CUCM 14.0.1 target that the version endpoint is reachable unauthenticated on 8443; the fallback/auth paths are unit-tested. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
dev is now an integration branch; without this it merged untested. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
feat: harden UDS probe for Contact Search Authentication (9443 + auth flag)
…ch-auth # Conflicts: # src/seeyoucm_thief/thief.py
A -p value that already names the device (SEPC064E4D83AAF, optionally with a DNS suffix like SEPC064E4D83AAF.mason.ad) carries its 12-hex MAC directly, but --brute-mac always tried to HTTP-scrape the MAC off the phone's NetworkConfiguration page. An unreachable phone therefore reported "could not detect MAC" even though the MAC was in the argument. - New mac_from_phone_arg(): extracts the MAC from a SEP<MAC> value; the detect worker uses it and skips the HTTP lookup for such values. - New get_cucm_for_mac_from_db(): when no -H is given and the phone is unreachable, resolve the device's CUCM from mac_prefixes/uds_devices recorded on an earlier scan, so a SEP name already known in the database just works. Otherwise the error now tells the operator to supply -H. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promotes
devtomain. Cuts a minor release (feature work): the head branch isfeat/*so version-bump computes a minor bump.What ships
probe_uds), unless--uds-portis pinned.usersResourceAuthEnableddetection — warns when a cluster requires auth for/users, so an empty--userenum/--directory/--sprayreads as "auth required," not "no users."dev— PyTest now gatesdevpushes/PRs.(The two
--brute-mac/version-probe fixes already reachedmainvia #29 as v0.12.3; they're present here too and reconcile cleanly.)Testing
Full suite 235 passed, 2 skipped; both #29 and #30 were green on 3.13/3.14. Validated against a live CUCM 14.0.1 target.
🤖 Generated with Claude Code