nx_printer_security_test.nx source
↩ module page · 79 lines · 3695 B
1// nx_printer_security_test.nx -- offline gate for the printer security auditor.
2// Unique exit codes per invariant:
3// 1x none/none -> EXPOSED (+ CLEARTEXT,NOAUTH flags; no TLS/AUTH) [the real Brother case]
4// 1x* tls/digest -> SECURE (+ TLS,AUTH; no CLEARTEXT/NOAUTH)
5// 2x tls,none / digest,none -> WEAK (downgrade offered) + set_contains spot-checks
6// 3x no security attrs -> UNKNOWN (flags 0; never a false "SECURE")
7// expect_exit: 0 license_tier: ORIGINAL
8
9import "nx_syscalls.nx"
10import "nx_ipp_codec.nx"
11import "nx_printer_security.nx"
12
13func t_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
14
15func base(buf: *u8) -> i64 {
16 var o: i64 = nx_ipp_begin(buf, 1, 1, NX_IPP_STATUS_OK, 1)
17 o = nx_ipp_group(buf, o, NX_IPP_GRP_PRINTER)
18 o = nx_ipp_attr_int(buf, o, NX_IPP_VT_ENUM, "printer-state", 13, NX_IPP_PSTATE_IDLE)
19 return o
20}
21
22func main() -> i64 {
23 let sc: *i64 = sys_mmap(64) as *i64
24 let fl: *i64 = sys_mmap(16) as *i64
25 let SEC: *u8 = "uri-security-supported"
26 let AUTH: *u8 = "uri-authentication-supported"
27
28 // ===== EXPOSED: none / none (the real Brother) =====
29 let e: *u8 = sys_mmap(2048)
30 var oe: i64 = base(e)
31 oe = nx_ipp_attr(e, oe, NX_IPP_VT_KEYWORD, SEC, nx_ipp_strlen(SEC), "none", 4)
32 oe = nx_ipp_attr(e, oe, NX_IPP_VT_KEYWORD, AUTH, nx_ipp_strlen(AUTH), "none", 4)
33 oe = nx_ipp_end(e, oe)
34 if nx_printer_security(e, oe, sc, fl) != NX_PSEC_EXPOSED { return 1 }
35 if (fl[0] & PSEC_F_CLEARTEXT) == 0 { return 2 }
36 if (fl[0] & PSEC_F_NOAUTH) == 0 { return 3 }
37 if (fl[0] & PSEC_F_TLS) != 0 { return 4 }
38 if (fl[0] & PSEC_F_AUTH) != 0 { return 5 }
39
40 // ===== SECURE: tls / digest =====
41 let s: *u8 = sys_mmap(2048)
42 var os: i64 = base(s)
43 os = nx_ipp_attr(s, os, NX_IPP_VT_KEYWORD, SEC, nx_ipp_strlen(SEC), "tls", 3)
44 os = nx_ipp_attr(s, os, NX_IPP_VT_KEYWORD, AUTH, nx_ipp_strlen(AUTH), "digest", 6)
45 os = nx_ipp_end(s, os)
46 if nx_printer_security(s, os, sc, fl) != NX_PSEC_SECURE { return 10 }
47 if (fl[0] & PSEC_F_TLS) == 0 { return 11 }
48 if (fl[0] & PSEC_F_AUTH) == 0 { return 12 }
49 if (fl[0] & PSEC_F_CLEARTEXT) != 0 { return 13 }
50 if (fl[0] & PSEC_F_NOAUTH) != 0 { return 14 }
51
52 // ===== WEAK: tls,none / digest,none (downgrade offered) =====
53 let w: *u8 = sys_mmap(2048)
54 var ow: i64 = base(w)
55 ow = nx_ipp_attr(w, ow, NX_IPP_VT_KEYWORD, SEC, nx_ipp_strlen(SEC), "tls", 3)
56 ow = nx_ipp_attr_add(w, ow, NX_IPP_VT_KEYWORD, "none", 4)
57 ow = nx_ipp_attr(w, ow, NX_IPP_VT_KEYWORD, AUTH, nx_ipp_strlen(AUTH), "digest", 6)
58 ow = nx_ipp_attr_add(w, ow, NX_IPP_VT_KEYWORD, "none", 4)
59 ow = nx_ipp_end(w, ow)
60 if nx_printer_security(w, ow, sc, fl) != NX_PSEC_WEAK { return 20 }
61 if (fl[0] & PSEC_F_TLS) == 0 { return 21 }
62 if (fl[0] & PSEC_F_CLEARTEXT) == 0 { return 22 }
63 if (fl[0] & PSEC_F_NOAUTH) == 0 { return 23 }
64 if (fl[0] & PSEC_F_AUTH) == 0 { return 24 }
65 if nx_psec_set_contains(w, ow, SEC, "tls") != 1 { return 25 }
66 if nx_psec_set_contains(w, ow, SEC, "none") != 1 { return 26 }
67 if nx_psec_set_contains(w, ow, SEC, "ssl3") != 0 { return 27 }
68 if nx_psec_set_contains(w, ow, AUTH, "digest") != 1 { return 28 }
69
70 // ===== UNKNOWN: no security attributes -> never a false SECURE =====
71 let u: *u8 = sys_mmap(2048)
72 var ou: i64 = base(u)
73 ou = nx_ipp_end(u, ou)
74 if nx_printer_security(u, ou, sc, fl) != NX_PSEC_UNKNOWN { return 30 }
75 if fl[0] != 0 { return 31 }
76
77 t_puts("nx_printer_security: 4/4 KAT groups PASS (exposed/secure/weak + set-contains + unknown-not-false-secure)\n")
78 return 0
79}