v0.2.0 — sweep, hardening audit, close-out

Surveys can now sweep an address range, check a configuration against vendor hardening guidance, and be closed out properly. Both new capabilities are gated the way the read-only promise always was: in code, with tests, and with no override flag.

Added

Authorised subnet sweep and port scan (netwalk_sweep.py) — the crawl finds what announces itself; the sweep finds the static-address server, the forgotten printer and the second firewall nobody remembers. A refused connection counts as a host found. ~68 well-known TCP ports by default, and the ones that are a finding on their own carry a stated reason.

Third promise: netwalk never sweeps a range nobody authorised. A range must be in the site's scope with the name of the person who authorised it, which then appears in the report. Outside the scope: refused. A supernet of an authorised range: refused. Public address space without a second explicit flag: refused. Larger than a /16: refused. There is no --force, and a test asserts there never will be.

Hardening catalogue (netwalk_audit.py) — 38 checks as data, so the same checks run on every site instead of depending on anyone remembering them. It reads configuration exports off the disk, so a config full of PSKs never passes through a model. NOT CHECKED is part of the output: anything that could not be decided is listed by name and written into the report's coverage section.

Closing a survey out — forget --with-configs shreds the configuration exports as well as the credential store; without the flag it tells you how many are still there. The full report now names where the survey left its sensitive files.

Fixed

• A community string reached a delivered report. The renderer refuses to build a report from a record holding credential material — except its pattern was anchored on the word snmp, so trap-community: <value> walked past it. Fixed, tested in both directions, and the test was verified by reinstating the old pattern and watching it fail.
• The audit reported one host twice and dropped findings silently — findings were emitted per sweep rather than per host, and shared a fixed id that the writer then deduplicated away.
• MikroTik checks matched only one of two RouterOS output shapes, so telnet, ftp, www, api and the default admin account silently passed on every real site.
• A hardening check that reads one setting no longer overrules a conclusion someone verified against the firewall.

Tests

651 cases, up from 341.

Full detail in CHANGELOG.md · compare v0.1.0...v0.2.0