feat(scanner): service / application discovery (P2-01 / 26.12)#15
Merged
Conversation
Banner-grab on every persisted TCP port. Port.Service has been in the schema since the initial migration but was never written until now. New protocol decoders (internal/scanner/banner.go): - lineBanner — SMTP, FTP, POP3, IMAP, Telnet (server greets first). Bounded capReader defends against a peer that floods without EOL. - tlsHTTPSFingerprint — 443/8443. Completes TLS handshake (InsecureSkipVerify intentionally: scraping for ID, not trusting), peeks at cert CN/SAN, then reuses the same connection for HEAD to capture the Server header. Two IDs for one dial. - mysqlGreeting — 3306. Reads v10 handshake packet, extracts the server-version string. Passive — never writes to the socket. Wired into scanner.upsertPort via a new `service string` parameter. Three call sites (liveness, deepScan, udpScan) updated. UDP banner- grabbing is protocol-specific (DNS/SNMP/NTP each need a request packet) and out of scope for this sprint. Test coverage: - Valid SMTP/FTP greeting parses - Silent-server timeout returns "" (must not hang the scan loop) - Valid v10 MySQL handshake → parsed version string - Wrong-protover MySQL handshake → "" (guard against random services that happen to dial-clean on 3306) - HTTPS via httptest.NewUnstartedServer with a self-signed cert, asserts CN extraction and Server-header capture both flow through Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Turns `port 22 is open` into `SSH-2.0-OpenSSH_9.6p1 Ubuntu`. And similar for nine more protocols. `Port.Service` is now populated for every TCP port the scanner persists — the column has been in the schema since the initial migration but never had data flowing into it.
Protocols added
Test plan
Notes
🤖 Generated with Claude Code