From 44a334911883738ac91cc72c58acb897841f177d Mon Sep 17 00:00:00 2001 From: Jayson Grace Date: Thu, 30 Jul 2026 12:34:03 -0600 Subject: [PATCH] docs: clarify ares fork-only behavior in scoreboard transport comments **Changed:** - Updated code comments in `transport_ares.go` to use canonical `l50/ares#366` and `l50/ares#367` issue references instead of ambiguous `ares-cli` naming - Expanded `aresTokenBucket` and `uncreditableCategories` documentation to explain that the exploited-count fix and category promotions are fork-only, warning that stock `dreadnode/ares` builds will over-credit or silently stop crediting techniques - Updated test case names in `transport_ares_test.go` to match the new `l50/ares#366` and `l50/ares#367` issue references --- cli/internal/scoreboard/transport_ares.go | 27 ++++++++++++++----- .../scoreboard/transport_ares_test.go | 6 ++--- 2 files changed, 23 insertions(+), 10 deletions(-) diff --git a/cli/internal/scoreboard/transport_ares.go b/cli/internal/scoreboard/transport_ares.go index 7219f265..a50826fe 100644 --- a/cli/internal/scoreboard/transport_ares.go +++ b/cli/internal/scoreboard/transport_ares.go @@ -62,9 +62,15 @@ type aresLoot struct { } // aresTokenBucket is one entry in the ares loot JSON's `token_coverage` map, -// keyed by ares's own scoreboard-category name. Exploited counts only proven -// techniques as of ares-cli #366, which made it the technique credit source -// (see writeTokenCoverageEntries). +// keyed by ares's own scoreboard-category name. +// +// Exploited counts only proven techniques as of l50/ares#366, which is what +// makes it usable as the technique credit source (see writeTokenCoverageEntries). +// That fix is fork-only: it taught `build_token_coverage_json` to subtract the +// superseded set and `state/reader.rs` to load `:superseded` alongside +// `:exploited`. dreadnode/ares has neither, and no KEY_SUPERSEDED at all, so +// against a stock build these counts include back-credited techniques ares +// never walked and this transport will over-credit. type aresTokenBucket struct { Discovered int `json:"discovered"` Exploited int `json:"exploited"` @@ -213,16 +219,23 @@ var creditableCategories = map[string]string{ // which carries the domain the flat category drops. // - "zerologon" is uncreditable by design: ares only ever runs the nxc // zerologon check module, never the password reset, so the category counts -// detections and crediting it would score a scan as an exploit. ares-cli -// #366 promoted it out of "other", so without an explicit refusal it would -// start crediting scans. +// detections and crediting it would score a scan as an exploit. l50/ares#366 +// promoted it out of "other", so without an explicit refusal it would start +// crediting scans. // -// "printnightmare" was refused here on the same grounds until ares-cli #367. +// "printnightmare" was refused here on the same grounds until l50/ares#367. // The rationale was wrong about the mechanism: its gate matched five markers // cube0x0/CVE-2021-1675 never prints, so it could not fire at all and the // technique scored zero rather than over-crediting. #367 rebuilt the gate on a // single "exploit completed" match taken from the PoC's real output, so the // category now means what it says and is credited like any other. +// +// The promotion itself is fork-only. l50/ares#366 lifted printnightmare, +// zerologon and nopac out of "other" into categories of their own; dreadnode/ares +// has not, and still asserts token_category("nopac_…") == "other". Against a +// stock build all three collapse back: zerologon's refusal is merely redundant +// (it lands in "other", refused anyway), but nopac and printnightmare silently +// stop crediting. See aresTokenBucket for the matching caveat on exploited counts. var uncreditableCategories = map[string]bool{ "other": true, "golden_ticket": true, diff --git a/cli/internal/scoreboard/transport_ares_test.go b/cli/internal/scoreboard/transport_ares_test.go index c928192c..1a9400d9 100644 --- a/cli/internal/scoreboard/transport_ares_test.go +++ b/cli/internal/scoreboard/transport_ares_test.go @@ -63,8 +63,8 @@ func TestAresCategoryToTechniqueID(t *testing.T) { {"ares normalises its own alias", "gpo_abuse", "gpo_abuse"}, {"esc8 credits", "adcs_esc8", "adcs_esc8"}, {"long esc form is distinct", "adcs_esc10_case1", "adcs_esc10_case1"}, - {"nopac credits after ares #366", "nopac", "nopac"}, - {"printnightmare credits after ares #367", "printnightmare", "printnightmare"}, + {"nopac credits after l50/ares#366", "nopac", "nopac"}, + {"printnightmare credits after l50/ares#367", "printnightmare", "printnightmare"}, // The one name that differs between the two vocabularies. {"forest_trust aliases to cross_forest_trust", "forest_trust", "cross_forest_trust"}, @@ -274,7 +274,7 @@ func TestWriteTokenCoverageEntries(t *testing.T) { absent: []string{"tech:zerologon", "tech:golden_ticket", "tech:other"}, }, { - // Refused alongside zerologon until ares-cli #367 rebuilt its gate + // Refused alongside zerologon until l50/ares#367 rebuilt its gate // on a marker the PoC actually prints. name: "printnightmare credits after ares gate fix", coverage: map[string]aresTokenBucket{