code wiki / (root) / nx_printer_security_test.nx

nx_printer_security_test.nx source

↩ module page · 79 lines · 3695 B

1// nx_printer_security_test.nx -- offline gate for the printer security auditor. 2// Unique exit codes per invariant: 3// 1x none/none -> EXPOSED (+ CLEARTEXT,NOAUTH flags; no TLS/AUTH) [the real Brother case] 4// 1x* tls/digest -> SECURE (+ TLS,AUTH; no CLEARTEXT/NOAUTH) 5// 2x tls,none / digest,none -> WEAK (downgrade offered) + set_contains spot-checks 6// 3x no security attrs -> UNKNOWN (flags 0; never a false "SECURE") 7// expect_exit: 0 license_tier: ORIGINAL 8 9import "nx_syscalls.nx" 10import "nx_ipp_codec.nx" 11import "nx_printer_security.nx" 12 13func t_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } 14 15func base(buf: *u8) -> i64 { 16 var o: i64 = nx_ipp_begin(buf, 1, 1, NX_IPP_STATUS_OK, 1) 17 o = nx_ipp_group(buf, o, NX_IPP_GRP_PRINTER) 18 o = nx_ipp_attr_int(buf, o, NX_IPP_VT_ENUM, "printer-state", 13, NX_IPP_PSTATE_IDLE) 19 return o 20} 21 22func main() -> i64 { 23 let sc: *i64 = sys_mmap(64) as *i64 24 let fl: *i64 = sys_mmap(16) as *i64 25 let SEC: *u8 = "uri-security-supported" 26 let AUTH: *u8 = "uri-authentication-supported" 27 28 // ===== EXPOSED: none / none (the real Brother) ===== 29 let e: *u8 = sys_mmap(2048) 30 var oe: i64 = base(e) 31 oe = nx_ipp_attr(e, oe, NX_IPP_VT_KEYWORD, SEC, nx_ipp_strlen(SEC), "none", 4) 32 oe = nx_ipp_attr(e, oe, NX_IPP_VT_KEYWORD, AUTH, nx_ipp_strlen(AUTH), "none", 4) 33 oe = nx_ipp_end(e, oe) 34 if nx_printer_security(e, oe, sc, fl) != NX_PSEC_EXPOSED { return 1 } 35 if (fl[0] & PSEC_F_CLEARTEXT) == 0 { return 2 } 36 if (fl[0] & PSEC_F_NOAUTH) == 0 { return 3 } 37 if (fl[0] & PSEC_F_TLS) != 0 { return 4 } 38 if (fl[0] & PSEC_F_AUTH) != 0 { return 5 } 39 40 // ===== SECURE: tls / digest ===== 41 let s: *u8 = sys_mmap(2048) 42 var os: i64 = base(s) 43 os = nx_ipp_attr(s, os, NX_IPP_VT_KEYWORD, SEC, nx_ipp_strlen(SEC), "tls", 3) 44 os = nx_ipp_attr(s, os, NX_IPP_VT_KEYWORD, AUTH, nx_ipp_strlen(AUTH), "digest", 6) 45 os = nx_ipp_end(s, os) 46 if nx_printer_security(s, os, sc, fl) != NX_PSEC_SECURE { return 10 } 47 if (fl[0] & PSEC_F_TLS) == 0 { return 11 } 48 if (fl[0] & PSEC_F_AUTH) == 0 { return 12 } 49 if (fl[0] & PSEC_F_CLEARTEXT) != 0 { return 13 } 50 if (fl[0] & PSEC_F_NOAUTH) != 0 { return 14 } 51 52 // ===== WEAK: tls,none / digest,none (downgrade offered) ===== 53 let w: *u8 = sys_mmap(2048) 54 var ow: i64 = base(w) 55 ow = nx_ipp_attr(w, ow, NX_IPP_VT_KEYWORD, SEC, nx_ipp_strlen(SEC), "tls", 3) 56 ow = nx_ipp_attr_add(w, ow, NX_IPP_VT_KEYWORD, "none", 4) 57 ow = nx_ipp_attr(w, ow, NX_IPP_VT_KEYWORD, AUTH, nx_ipp_strlen(AUTH), "digest", 6) 58 ow = nx_ipp_attr_add(w, ow, NX_IPP_VT_KEYWORD, "none", 4) 59 ow = nx_ipp_end(w, ow) 60 if nx_printer_security(w, ow, sc, fl) != NX_PSEC_WEAK { return 20 } 61 if (fl[0] & PSEC_F_TLS) == 0 { return 21 } 62 if (fl[0] & PSEC_F_CLEARTEXT) == 0 { return 22 } 63 if (fl[0] & PSEC_F_NOAUTH) == 0 { return 23 } 64 if (fl[0] & PSEC_F_AUTH) == 0 { return 24 } 65 if nx_psec_set_contains(w, ow, SEC, "tls") != 1 { return 25 } 66 if nx_psec_set_contains(w, ow, SEC, "none") != 1 { return 26 } 67 if nx_psec_set_contains(w, ow, SEC, "ssl3") != 0 { return 27 } 68 if nx_psec_set_contains(w, ow, AUTH, "digest") != 1 { return 28 } 69 70 // ===== UNKNOWN: no security attributes -> never a false SECURE ===== 71 let u: *u8 = sys_mmap(2048) 72 var ou: i64 = base(u) 73 ou = nx_ipp_end(u, ou) 74 if nx_printer_security(u, ou, sc, fl) != NX_PSEC_UNKNOWN { return 30 } 75 if fl[0] != 0 { return 31 } 76 77 t_puts("nx_printer_security: 4/4 KAT groups PASS (exposed/secure/weak + set-contains + unknown-not-false-secure)\n") 78 return 0 79}