Repository navigation
test: add disposable active-discovery network acceptance (#212) - #264
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ef8df03c4f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| } | ||
| # Only a refusal confirms that the previously open port is closed. | ||
| # A missing, filtered, or unreachable retest cannot prove remediation. | ||
| if curr_a and curr_a.port_state == PortState.CLOSED.value: |
There was a problem hiding this comment.
When a retest comes through import_nmap_xml, states such as closed|filtered fall through the branch at cops/discovery/importer.py:191-193 and are stored as PortState.CLOSED; this condition therefore reports an inconclusive retest as confirmed remediation and can produce a 100% remediation rate. Preserve ambiguous imported states or require evidence of a definitive closed result before adding the exposure to remediated_exposures.
AGENTS.md reference: AGENTS.md:L95-L99
Useful? React with 👍 / 👎.
| ) | ||
| continue | ||
|
|
||
| if prior_ip is not None and resolved_ip != prior_ip: |
There was a problem hiding this comment.
This commit changes live network trust decisions by pinning DNS resolutions across probes and resumes, quarantining ambiguous checkpoints, and changing socket-error classifications, but it neither updates docs/THREAT_MODEL.md nor records a specific no-impact rationale. Document the control, abuse cases, limitations, ownership, and validation evidence before handoff, as required for changed security-relevant code.
AGENTS.md reference: AGENTS.md:L187-L191
Useful? React with 👍 / 👎.
1 participant
Summary
Closes #212 when merged.
closed; filtered, missing, and otherwise unverified retests remain unverified.Evidence
The Docker run used a cached
python:3.12-slimimage with--network none, no host ports, and loopback-only destinations. All five cases passed: rate limiting (210.3 ms between probe starts against a 200 ms minimum), unreachable versus closed, DNS shift quarantine after one scanner probe, checkpoint/resume after partial results, and remediated exposure (one closed and one still open). The observed record and exact command are indocs/ACTIVE_DISCOVERY_NETWORK_ACCEPTANCE.md.Focused simulated tests: 33 passed. The independent issue review found that filtered retests were incorrectly counted as remediated; the final commit corrects that behavior and adds a regression case.
make checkpassed in the final checkout. The local pre-push gate passed issue coverage, Ruff lint and format, full pytest branch coverage, andpip_auditwith no known vulnerabilities.git diff --check origin/main...HEADandgitleaksalso passed.Limits and review
The contained run exercises Linux loopback TCP connections and a local DNS responder. It does not establish behavior for external networks, production DNS caches, TLS, or a live engagement. Human review of this exact revision is required before merge.