nx_printer_security.nx
buildroot/runtime/nx_printer_security.nx
about
nx_printer_security.nx -- honest printer security posture auditor (the #1 measurable exceed axis).
WHY: the worst real-world printing failure isn't paper jams -- it's security. Sept 2024 cups-browsed
(CVE-2024-47176, CVSS 9.9): bind UDP *:631, trust any packet, fetch attacker IPP, install malicious PPD,
shell-out via foomatic -> unauthenticated RCE; 75k+ exposed, 42k unauthenticated. IPP also defaults to
CLEARTEXT on 631 (no TLS) and printers frequently ship with NO authentication -- so anyone on the LAN
can read your documents and submit jobs. NO vendor UI tells you this. This organ does.
It reads the printer's own IPP-reported security companions to printer-uri-supported (RFC 8011
ยง5.4.2/5.4.3, verified in knowledge/fetched/ipp_rfc8011.raw):
uri-security-supported (1setOf keyword) values incl 'none','tls','ssl3'
uri-authentication-supported (1setOf keyword) values incl 'none','requesting-user-name','basic',
'digest','certificate','negotiate'
and classifies the posture into a sealed verdict + a findings bitmask.
NEVER-BRICK (#26): pure read-only model; no syscalls, no writes. We do NOT auto-install PPDs and NEVER
shell out -- so this whole stack is structurally immune to the cups-browsed RCE class by construction.
Sovereign: imports only nx_ipp_codec.nx; nx_cc -> nxasm.
genealogy_id: project-printer-management-ipp-sclass-2026-06-20 ; license_tier: ORIGINAL
dependencies 1 imports · 3 importers
imports: nx_ipp_codec.nx
imported by: nx_printer_query.nxnx_printer_security_test.nxnx_printers_render.nx
structs
| none |
consts
| 24 | const NX_PSEC_SECURE: i64 = 1 // TLS available AND real auth AND no cleartext/no-auth offered |
| 25 | const NX_PSEC_WEAK: i64 = 2 // partial: downgrade possible / ssl3 / auth-but-also-none, etc. |
| 26 | const NX_PSEC_EXPOSED: i64 = 3 // cleartext + no auth, no TLS -> anyone reads & submits (the Brother) |
| 27 | const NX_PSEC_UNKNOWN: i64 = 4 // printer reported no security attributes |
| 28 | const NX_PSEC_VERDICT_N: i64 = 5 |
| 31 | const PSEC_F_CLEARTEXT: i64 = 1 |
| 32 | const PSEC_F_NOAUTH: i64 = 2 |
| 33 | const PSEC_F_TLS: i64 = 4 |
| 34 | const PSEC_F_SSL3: i64 = 8 |
| 35 | const PSEC_F_AUTH: i64 = 16 |
functions
| 37 | func nx_psec_verdict_is_valid(v: i64) -> i64 |
| 45 | func nx_psec_set_contains(body: *u8, n: i64, name: *u8, target: *u8) -> i64 |
| 96 | func nx_psec_has(body: *u8, n: i64, name: *u8, scratch3: *i64) -> i64 |
| 105 | func nx_printer_security(body: *u8, n: i64, scratch3: *i64, out_flags: *i64) -> i64 |