@clear-capabilities/agentic-security-scanner 0.157.2 → 0.158.0

package/src/language/nixos-hardening.js

@@ -37,6 +37,7 @@ export const HARDENING_RULES = Object.freeze({
   'ssh-empty-passwords': { family: 'ssh-access', cwe: 'CWE-258', severity: 'high', ruleVersion: 1, vuln: 'SSH permits empty passwords', why: 'An account with an empty password becomes a login with no secret at all.', fix: 'Remove services.openssh.settings.PermitEmptyPasswords or set it to false.' },
   'firewall-disabled': { family: 'firewall-exposure', cwe: 'CWE-284', severity: 'high', ruleVersion: 1, vuln: 'Host firewall is disabled', why: 'With the NixOS firewall off every listening service is open on every interface, and the only barrier left is whatever network sits in front of the host.', fix: 'Remove networking.firewall.enable = false and open only the ports each service needs.' },
   'firewall-sensitive-port': { family: 'firewall-exposure', cwe: 'CWE-668', severity: 'high', ruleVersion: 1, vuln: 'Firewall opens a database or administration port on every interface', why: 'Database, cache and container-control ports are not designed to face untrusted networks; a global allow rule exposes them wherever the host is routable.', fix: 'Remove the port from networking.firewall.allowedTCPPorts/allowedUDPPorts, or scope it with networking.firewall.interfaces.<name>.allowedTCPPorts to a private interface.' },
+  'firewall-wide-port-range': { family: 'firewall-exposure', cwe: 'CWE-668', severity: 'high', ruleVersion: 1, vuln: 'Firewall opens a very wide port range on every interface', why: 'A range that spans every port (or ten thousand or more) is a firewall that is off in everything but name: whatever listens inside it, now or after the next package change, is reachable.', fix: 'Replace the range with the specific ports the services need in networking.firewall.allowedTCPPorts, or scope a genuinely needed range with networking.firewall.interfaces.<name>.allowedTCPPortRanges to a private interface.' },
   'listener-all-interfaces': { family: 'firewall-exposure', cwe: 'CWE-668', severity: 'medium', ruleVersion: 1, vuln: 'Service is configured to listen on every interface', why: 'Binding all interfaces widens the set of networks that can reach the service beyond the host itself.', fix: 'Leave the listener on localhost, or restrict listen addresses and the firewall to the interface that needs access.' },
   'listener-trust-auth': { family: 'firewall-exposure', cwe: 'CWE-306', severity: 'high', ruleVersion: 1, vuln: 'Database authentication is "trust" for a network-wide address range', why: 'A trust rule for 0.0.0.0/0 lets any client that reaches the port in as any user without a password.', fix: 'Use scram-sha-256 in services.postgresql.authentication and limit the address range.' },
   'service-runs-as-root': { family: 'service-identity', cwe: 'CWE-250', severity: 'medium', ruleVersion: 1, vuln: 'systemd service runs as root', why: 'A compromise of a root service is a compromise of the host; a dedicated or dynamic user confines it.', fix: 'Set serviceConfig.DynamicUser = true or serviceConfig.User to a dedicated account, and add NoNewPrivileges and ProtectSystem.' },
@@ -189,14 +190,31 @@ export function analyzeNixosHardening(opts, extra = {}) {
   const allowedUdp = view(note(nixos('networking.firewall.allowedUDPPorts'), 'firewall'));
   const globalPorts = (v) => (v.state === 'known' ? asList(v.value) : v.state === 'conditional' ? asList(v.definiteItems) : []);
   const allowedAll = new Set([...globalPorts(allowedTcp), ...globalPorts(allowedUdp)]);
-  const allowedKnown = allowedTcp.state === 'known' && allowedUdp.state === 'known';
+  // Port RANGES open ports exactly like single ports do. A range option that cannot be evaluated makes every firewall conclusion
+  // `unknown` (never "closed"), and a range that cannot be read as {from, to} integers is disclosed, not skipped.
+  const tcpRangesRes = note(nixos('networking.firewall.allowedTCPPortRanges'), 'firewall');
+  const udpRangesRes = note(nixos('networking.firewall.allowedUDPPortRanges'), 'firewall');
+  const readRanges = (res) => {
+    const v = view(res);
+    if (v.state !== 'known') return { state: v.state === 'conditional' ? 'conditional' : 'unknown', ranges: [] };
+    const ranges = [];
+    for (const it of asList(v.value)) {
+      if (!it || !Number.isInteger(it.from) || !Number.isInteger(it.to) || it.to < it.from) return { state: 'unknown', ranges: [] };
+      ranges.push({ from: it.from, to: it.to });
+    }
+    return { state: 'known', ranges, definite: v.definite };
+  };
+  const tcpRanges = readRanges(tcpRangesRes);
+  const udpRanges = readRanges(udpRangesRes);
+  const inTcpRange = (port) => tcpRanges.ranges.some((r) => port >= r.from && port <= r.to);
+  const allowedKnown = allowedTcp.state === 'known' && allowedUdp.state === 'known' && tcpRanges.state === 'known' && udpRanges.state === 'known';
   const interfaceScoped = cfg.options.filter((o) => o.namespace === 'nixos' && /^networking\.firewall\.interfaces\.[^.]+\.allowedTCPPorts$/.test(o.path));
 
   /** Host-firewall ingress for a TCP port; internet reachability itself is never decided. */
   function ingressFor(port, { openFirewallRes } = {}) {
     if (fwOff === 'yes') return 'firewall-disabled';
     if (fwOn !== 'yes') return 'unknown';
-    if (allowedAll.has(port)) return 'open-in-firewall';
+    if (allowedAll.has(port) || inTcpRange(port)) return 'open-in-firewall';
     if (openFirewallRes) {
       const o = judge(openFirewallRes, (x) => x === true);
       if (o === 'yes') return 'open-in-firewall';
@@ -412,6 +430,23 @@ export function analyzeNixosHardening(opts, extra = {}) {
       addFinding('firewall-sensitive-port', { anchor: anchorOf(res), scope: `${res.path}:${port}`, state: v.state === 'known' ? 'active' : 'conditional', uncertain: !v.definite, evidence: [evidenceOf(res)], extra: { port, portService: SENSITIVE_PORTS.get(port), exposure: { enabled: 'unknown', listening: 'unknown', ingress: fwOff === 'yes' ? 'firewall-disabled' : 'open-in-firewall', reachable: 'unknown' } } });
     }
   }
+  // Port ranges opened on every interface.
+  for (const [res, rg, proto] of [[tcpRangesRes, tcpRanges, 'tcp'], [udpRangesRes, udpRanges, 'udp']]) {
+    if (!res) continue;
+    if (rg.state !== 'known') {
+      if (res.status === 'set' || res.status === 'conditional') gaps.push({ kind: 'firewall-port-ranges-unevaluated', option: res.path, purpose: 'firewall', reason: `the ${proto} port ranges could not be evaluated to {from, to} integers, so no conclusion about them is drawn (this is not a clean result)` });
+      continue;
+    }
+    for (const r of rg.ranges) {
+      const span = r.to - r.from + 1;
+      const full = r.from <= 1 && r.to >= 65535;
+      if (full || span >= 10000) {
+        addFinding('firewall-wide-port-range', { severity: full ? 'high' : 'medium', anchor: anchorOf(res), scope: `${res.path}:${r.from}-${r.to}`, state: 'active', uncertain: !rg.definite, evidence: [evidenceOf(res)], extra: { portRange: { from: r.from, to: r.to, span, protocol: proto, everyPort: full }, exposure: { enabled: 'unknown', listening: 'unknown', ingress: fwOff === 'yes' ? 'firewall-disabled' : 'open-in-firewall', reachable: 'unknown' } } });
+      } else if (proto === 'tcp') {
+        for (const [port, svc] of SENSITIVE_PORTS) if (port >= r.from && port <= r.to) addFinding('firewall-sensitive-port', { anchor: anchorOf(res), scope: `${res.path}:${port}`, state: 'active', uncertain: !rg.definite, evidence: [evidenceOf(res)], extra: { port, portService: svc, viaRange: { from: r.from, to: r.to }, exposure: { enabled: 'unknown', listening: 'unknown', ingress: fwOff === 'yes' ? 'firewall-disabled' : 'open-in-firewall', reachable: 'unknown' } } });
+      }
+    }
+  }
   for (const o of interfaceScoped) {
     const iface = o.path.split('.')[3];
     controls.push({ control: 'interface-scoped-ingress', option: o.path, interface: iface, ports: asList(view(o).value), applies: true });

package/src/language/nixos-module-resolver.js

@@ -306,6 +306,27 @@ class Resolver {
         return v.known && typeof v.value === 'boolean' ? known(!v.value) : UNK;
       }
       case 'binop': return this.evalBinop(n, env);
+      // A list or attribute set is known only when EVERY element is statically known (so `[ { from = 1; to = 65535; } ]` is, and a list
+      // containing `config.x` or an interpolated string is not). Bounded; recursive sets and dynamic attribute names stay unknown.
+      case 'list': {
+        if (n.items.length > 256) return UNK;
+        const out = [];
+        for (const it of n.items) { const v = this.evalExpr(it, env); if (!v.known) return UNK; out.push(v.value); }
+        return known(out);
+      }
+      case 'attrset': {
+        if (n.rec || n.errors || n.bindings.length > 256) return UNK;
+        const out = {};
+        for (const b of n.bindings) {
+          if (b.kind !== 'attr' || !b.path.length || !b.path.every((seg) => seg.kind === 'static' && typeof seg.name === 'string')) return UNK;
+          const v = this.evalExpr(b.value, env);
+          if (!v.known) return UNK;
+          let at = out;
+          for (const seg of b.path.slice(0, -1)) { if (typeof at[seg.name] !== 'object' || at[seg.name] === null) at[seg.name] = {}; at = at[seg.name]; }
+          at[b.path[b.path.length - 1].name] = v.value;
+        }
+        return known(out);
+      }
       case 'select': {
         const flags = platformFlags(this.target.system);
         const b = unparen(n.base);
@@ -360,7 +381,11 @@ class Resolver {
         const out = [];
         for (const it of s.items) {
           const v = it.type === 'string' && !it.interpolated ? known(it.literal) : it.type === 'number' || it.type === 'bool' ? known(it.value) : UNK;
-          if (!v.known) return UNK;
+          if (!v.known) {
+            // Not a list of scalars (for example a list of attribute sets): evaluate the whole expression from its source instead.
+            const ast = this.parseAt(def.file, def.valueSpan);
+            return ast ? this.evalExpr(ast, { file: def.file, namespace: def.namespace, scope: def.scope }) : UNK;
+          }
           out.push(v.value);
         }
         return known(out);

package/src/language/nixos-option-catalog.js

@@ -37,6 +37,7 @@ const NIXOS_OPTIONS = {
   'security.sudo.extraConfig': { type: 'lines', default: same('') },
   'security.sudo.execWheelOnly': { type: 'bool', default: same(false) },
   'networking.firewall.allowedTCPPortRanges': { type: 'listOf', default: same([]) },
+  'networking.firewall.allowedUDPPortRanges': { type: 'listOf', default: same([]) },
   'users.mutableUsers': { type: 'bool', default: same(true) },
   'nix.settings.sandbox': { type: 'bool', default: same(true) },
   'nix.settings.trusted-users': { type: 'listOf', default: same(['root']) },

package/src/language/resolved-pass.js

@@ -16,7 +16,7 @@ import { resolveOperatorSnapshot, IGNORED_NOTE } from './trusted-inputs.js';
 import { analyzeHaskellManifests } from './haskell-manifests.js';
 import { buildResolvedGraph } from './haskell-resolved-graph.js';
 import { importNixClosure } from './nix-closure.js';
-import { NixAdvisoryData, matchNixVulnerabilities, overlayEvidence } from './nix-sca.js';
+import { NixAdvisoryData, matchNixVulnerabilities, overlayEvidence, HASKELL_ENV_HINTS } from './nix-sca.js';
 import { configuredAdvisoryDb, collectUsage, manifestFiles } from './haskell-supply.js';
 import { runIsolatedEval, mergeEvaluationHealth, _which } from './nix-eval-isolation.js';
 
@@ -107,6 +107,14 @@ function loadNixExports(files, env = process.env) {
   return { exports, sources, problems, expected, trust: [...trust] };
 }
 
+/** Names of the Haskell packages inside an imported Nix closure (derivations whose env carries Haskell build attributes). */
+export function nixHaskellPackageNames(files, opts = {}) {
+  const c = nixClosureOf(files, opts);
+  if (!c || (c.refused && c.refused.length)) return [];
+  const nodes = (c.closure && c.closure.nodes) || [];
+  return [...new Set(nodes.filter((n) => n.pname && n.deriver && c.drvEnv[n.deriver] && HASKELL_ENV_HINTS.some((k) => k in c.drvEnv[n.deriver])).map((n) => n.pname))];
+}
+
 /** The imported closure (and each derivation's env block) for a file set, or null when there is no export. Cached per file set. */
 export function nixClosureOf(files, { now = Date.now() } = {}) {
   return memoized(files, 'nix-closure', () => {