Repository navigation
Release 3.0.3: run all diagnostic modules from the main entrypoint - #97
netanelcyber wants to merge 2 commits into
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f6208bace3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| for name in diagnostics.DIAGNOSTIC_TOOLS: | ||
| diagnostics.build_diagnostic_command(name, target, domain=domain, timeout=timeout) | ||
| servers = [str(ipaddress.ip_address(server)) for server in (dns_servers or [])] | ||
| cache = _file_cache(ticket_cache) |
There was a problem hiding this comment.
When --ticket-cache is omitted but KRB5CCNAME is set, this validates None and later consumes the environment value only after the eight diagnostics and WinRM check have run. An unsupported cache such as KEYRING:persistent:1000, or a missing/oversized FILE cache, therefore permits active network operations before producing an unsupported/unavailable ticket result, contrary to the whole-run preflight guarantee. Pass the selected environment value through _file_cache here as well.
Useful? React with 👍 / 👎.
| if args.html_report: | ||
| from .report_generator import generate_html_report | ||
| generate_html_report(report, str(Path(args.html_report).expanduser())) |
There was a problem hiding this comment.
For every --html-report combined run, the supplied results record elapsed time as duration_sec, while the existing report template renders duration_s; consequently every diagnostic is displayed as taking 0.00s, including long active operations. Normalize the combined records for the report generator or update the renderer before exposing this output path.
Useful? React with 👍 / 👎.
| if len(outputs) != len(set(outputs)) or set(outputs).intersection(inputs): | ||
| raise ValueError("Report/database outputs must be distinct from each other and all input files") |
There was a problem hiding this comment.
When an existing report or database path is a hard link to a selected cache, LDAP export, CA file, or another output, the resolved path strings remain different and this check accepts them even though they reference the same inode. Subsequent report writes can therefore overwrite credential/input data, or the HTML write can replace the JSON output, despite the collision guarantee. Compare existing paths with samefile in addition to comparing their resolved names.
Useful? React with 👍 / 👎.
1 participant
The main module previously dispatched diagnostic, WinRM and offline commands separately, so
--diagnostic-tools allselected only the eight fixed profiles.python -m adpentest --run-all, also spelled--all-options, now selects all 11 fixed diagnostic checks: the eight profiles, WinRM discovery/local identity and KDC diagnostics, local FILE Kerberos cache metadata, and offline LDAP/SPN export analysis.--list-all-checkslists the catalogue and required inputs.The combined run validates the complete selection before execution, defaults to dry-run, records missing optional inputs as explicit skips, and saves every check under one shared SQLAlchemy/SQLite run ID. JSON, table and HTML output preserve the check statuses. Skips no longer inflate failure counts in ORM history; execution/persistence failures and interruption retain nonzero exit codes and terminal records. Report outputs cannot overwrite selected input/cache/database files.
Normal ticket acquisition, authenticated WinRM checks, legacy scans, history and replay retain their existing standalone entrypoints. Core functionality is preserved; its only change relative to the published 3.0.2 source is the version assignment.
Aligns package/project/core and release tests at 3.0.3, adds
docs/MAIN_MODULE.md, updates the README and guides, and moves the guarded PyPI branch trigger to the exactrelease/pypi-3.0.3branch.Validation:
--all-options, catalogue/help, JSON/HTML output and 11 linked SQLite records passed.f6208bace31638103911256d5e5d6fd5341cfd43.release/pypi-3.0.3.all_checks.py), main routing, ORM storage and regression tests to the tested Git tree. Release-branch Windows/Linux CI also passed.Active integration tests use mocked transports and synthetic local files; no live AD/KDC was contacted.