@clear-capabilities/agentic-security-scanner 0.157.2 → 0.159.0

package/src/language/nixos-eval-forms.js

@@ -0,0 +1,162 @@
+// Pure pieces of the bounded NixOS option evaluator (NIX-002): value classes, equality, and the
+// closed table of library functions the evaluator is willing to run.
+//
+// The evaluator (nixos-module-resolver.js) is a SOUNDNESS-first subset: a value is either fully known
+// or unknown, and any unknown part makes the whole value unknown. This file is the allow-list. A
+// function that is not in these tables is never run, so `import`, `fetch*`, `readFile`, `toFile`,
+// `currentSystem`, `getEnv`, derivations and every other effectful or environment-dependent primitive
+// are unknown by construction (there is no deny-list to forget an entry in).
+
+/** Thrown by a table function (and caught by the resolver) when its arguments are not statically usable. */
+export const NOT_STATIC = Object.freeze({ notStatic: true });
+
+/** A lambda captured with its definition environment. Never a final option value. */
+export class Closure {
+  constructor(param, body, env) { this.param = param; this.body = body; this.env = env; }
+}
+
+/** A table function, possibly partially applied. Never a final option value. */
+export class Builtin {
+  constructor(name, def, args = []) { this.name = name; this.def = def; this.args = args; }
+}
+
+/** A namespace value (`lib`, `builtins`, `lib.strings`, `lib.lists`). Never a final option value. */
+export class Ns {
+  constructor(kind) { this.kind = kind; }
+}
+
+export const isAttrs = (v) => v !== null && typeof v === 'object' && !Array.isArray(v) && Object.getPrototypeOf(v) === Object.prototype;
+export const hasOwn = (o, k) => Object.prototype.hasOwnProperty.call(o, k);
+const isInt = (v) => typeof v === 'number' && Number.isSafeInteger(v);
+
+/** Own-property assignment that is safe for the attribute name `__proto__`. */
+export function setAttr(obj, key, value) {
+  Object.defineProperty(obj, key, { value, enumerable: true, writable: true, configurable: true });
+}
+
+/** True when a value contains only data (no closure, partial application or namespace). Bounded. */
+export function isPlain(v, budget = { n: 20_000 }, depth = 0) {
+  if (--budget.n < 0 || depth > 48) return false;
+  if (v === null || typeof v === 'string' || typeof v === 'boolean' || typeof v === 'number') return true;
+  if (Array.isArray(v)) return v.every((x) => isPlain(x, budget, depth + 1));
+  if (isAttrs(v)) return Object.keys(v).every((k) => isPlain(v[k], budget, depth + 1));
+  return false;
+}
+
+/** Nix `==`: true, false, or null when it cannot be decided statically (functions are never compared). */
+export function deepEq(a, b, depth = 0) {
+  if (depth > 48) return null;
+  const fnA = a instanceof Closure || a instanceof Builtin || a instanceof Ns;
+  const fnB = b instanceof Closure || b instanceof Builtin || b instanceof Ns;
+  if (fnA || fnB) return null;
+  if (Array.isArray(a) || Array.isArray(b)) {
+    if (!Array.isArray(a) || !Array.isArray(b)) return false;
+    if (a.length !== b.length) return false;
+    let unknown = false;
+    for (let i = 0; i < a.length; i++) { const r = deepEq(a[i], b[i], depth + 1); if (r === false) return false; if (r === null) unknown = true; }
+    return unknown ? null : true;
+  }
+  if (isAttrs(a) || isAttrs(b)) {
+    if (!isAttrs(a) || !isAttrs(b)) return false;
+    const ka = Object.keys(a); const kb = Object.keys(b);
+    if (ka.length !== kb.length || !ka.every((k) => hasOwn(b, k))) return false;
+    let unknown = false;
+    for (const k of ka) { const r = deepEq(a[k], b[k], depth + 1); if (r === false) return false; if (r === null) unknown = true; }
+    return unknown ? null : true;
+  }
+  return a === b;
+}
+
+const need = (cond) => { if (!cond) throw NOT_STATIC; };
+const MAX_STRING = 65_536;
+
+function toStr(v) {
+  if (typeof v === 'string') return v;
+  if (v === null || v === false) return '';
+  if (v === true) return '1';
+  if (isInt(v)) return String(v);
+  throw NOT_STATIC;
+}
+
+// Each entry: arity and a function over the evaluated arguments. `c.apply(f, x)` runs a closure or table
+// function and throws NOT_STATIC if it is not statically known; `c.size(n)` enforces the size cap.
+const DEFS = {
+  map: { arity: 2, call: ([f, xs], c) => { need(Array.isArray(xs)); c.size(xs.length); return xs.map((x) => c.apply(f, x)); } },
+  filter: {
+    arity: 2,
+    call: ([f, xs], c) => { need(Array.isArray(xs)); c.size(xs.length); return xs.filter((x) => { const r = c.apply(f, x); need(typeof r === 'boolean'); return r; }); },
+  },
+  elem: {
+    arity: 2,
+    call: ([x, xs]) => {
+      need(Array.isArray(xs));
+      let unknown = false;
+      for (const y of xs) { const r = deepEq(x, y); if (r === true) return true; if (r === null) unknown = true; }
+      need(!unknown);
+      return false;
+    },
+  },
+  length: { arity: 1, call: ([xs]) => { need(Array.isArray(xs)); return xs.length; } },
+  concatLists: {
+    arity: 1,
+    call: ([xss], c) => { need(Array.isArray(xss) && xss.every(Array.isArray)); const out = [].concat(...xss); c.size(out.length); return out; },
+  },
+  concatMap: {
+    arity: 2,
+    call: ([f, xs], c) => {
+      need(Array.isArray(xs)); c.size(xs.length);
+      const parts = xs.map((x) => { const r = c.apply(f, x); need(Array.isArray(r)); return r; });
+      const out = [].concat(...parts); c.size(out.length); return out;
+    },
+  },
+  hasAttr: { arity: 2, call: ([name, set]) => { need(typeof name === 'string' && isAttrs(set)); return hasOwn(set, name); } },
+  toString: { arity: 1, call: ([v]) => toStr(v) },
+  optionals: { arity: 2, call: ([cond, xs]) => { need(typeof cond === 'boolean' && Array.isArray(xs)); return cond ? xs : []; } },
+  optional: { arity: 2, call: ([cond, x]) => { need(typeof cond === 'boolean'); return cond ? [x] : []; } },
+  optionalAttrs: { arity: 2, call: ([cond, set]) => { need(typeof cond === 'boolean' && isAttrs(set)); return cond ? set : {}; } },
+  optionalString: { arity: 2, call: ([cond, s]) => { need(typeof cond === 'boolean' && typeof s === 'string'); return cond ? s : ''; } },
+  concatStringsSep: {
+    arity: 2,
+    call: ([sep, xs], c) => {
+      need(typeof sep === 'string' && Array.isArray(xs) && xs.every((x) => typeof x === 'string')); c.size(xs.length);
+      const out = xs.join(sep); need(out.length <= MAX_STRING); return out;
+    },
+  },
+  concatMapStringsSep: {
+    arity: 3,
+    call: ([sep, f, xs], c) => {
+      need(typeof sep === 'string' && Array.isArray(xs)); c.size(xs.length);
+      const parts = xs.map((x) => { const r = c.apply(f, x); need(typeof r === 'string'); return r; });
+      const out = parts.join(sep); need(out.length <= MAX_STRING); return out;
+    },
+  },
+  hasPrefix: { arity: 2, call: ([p, s]) => { need(typeof p === 'string' && typeof s === 'string'); return s.startsWith(p); } },
+  hasSuffix: { arity: 2, call: ([p, s]) => { need(typeof p === 'string' && typeof s === 'string'); return s.endsWith(p); } },
+  boolToString: { arity: 1, call: ([b]) => { need(typeof b === 'boolean'); return b ? 'true' : 'false'; } },
+  // Only a merge of plain lists is a plain list; any other element (an attribute set, a priority or condition
+  // wrapper, an unknown) cannot be merged without the option's type, so it is not static.
+  mkMerge: { arity: 1, call: ([xss], c) => { need(Array.isArray(xss) && xss.every(Array.isArray)); const out = [].concat(...xss); c.size(out.length); return out; } },
+};
+
+const LIB_NAMES = new Set(['map', 'filter', 'elem', 'length', 'concatLists', 'concatMap', 'optionals', 'optional', 'optionalAttrs', 'optionalString',
+  'concatStringsSep', 'concatMapStringsSep', 'hasPrefix', 'hasSuffix', 'boolToString', 'mkMerge']);
+const LIB_STRINGS = new Set(['concatStringsSep', 'concatMapStringsSep', 'hasPrefix', 'hasSuffix', 'optionalString']);
+const LIB_LISTS = new Set(['map', 'filter', 'elem', 'length', 'concatLists', 'concatMap', 'optionals', 'optional']);
+const BUILTIN_NAMES = new Set(['map', 'filter', 'elem', 'length', 'concatLists', 'concatMap', 'hasAttr', 'toString']);
+/** Names a Nix program has without any import (the ones we model). */
+const GLOBAL_NAMES = new Set(['map', 'toString']);
+
+const SETS = { lib: LIB_NAMES, builtins: BUILTIN_NAMES, 'lib.strings': LIB_STRINGS, 'lib.lists': LIB_LISTS };
+
+/** Resolves `<ns>.<name>`: a table function, a sub-namespace, or undefined (not modelled). */
+export function nsLookup(kind, name) {
+  if (kind === 'lib' && name === 'strings') return new Ns('lib.strings');
+  if (kind === 'lib' && name === 'lists') return new Ns('lib.lists');
+  const set = SETS[kind];
+  if (!set || !set.has(name)) return undefined;
+  return new Builtin(name, DEFS[name]);
+}
+
+export const isGlobalName = (name) => GLOBAL_NAMES.has(name);
+export const globalValue = (name) => (name === 'builtins' ? new Ns('builtins') : nsLookup('builtins', name));
+export const MODELLED = Object.freeze({ lib: [...LIB_NAMES].sort(), builtins: [...BUILTIN_NAMES].sort() });

package/src/language/nixos-hardening.js

@@ -37,6 +37,7 @@ export const HARDENING_RULES = Object.freeze({
   'ssh-empty-passwords': { family: 'ssh-access', cwe: 'CWE-258', severity: 'high', ruleVersion: 1, vuln: 'SSH permits empty passwords', why: 'An account with an empty password becomes a login with no secret at all.', fix: 'Remove services.openssh.settings.PermitEmptyPasswords or set it to false.' },
   'firewall-disabled': { family: 'firewall-exposure', cwe: 'CWE-284', severity: 'high', ruleVersion: 1, vuln: 'Host firewall is disabled', why: 'With the NixOS firewall off every listening service is open on every interface, and the only barrier left is whatever network sits in front of the host.', fix: 'Remove networking.firewall.enable = false and open only the ports each service needs.' },
   'firewall-sensitive-port': { family: 'firewall-exposure', cwe: 'CWE-668', severity: 'high', ruleVersion: 1, vuln: 'Firewall opens a database or administration port on every interface', why: 'Database, cache and container-control ports are not designed to face untrusted networks; a global allow rule exposes them wherever the host is routable.', fix: 'Remove the port from networking.firewall.allowedTCPPorts/allowedUDPPorts, or scope it with networking.firewall.interfaces.<name>.allowedTCPPorts to a private interface.' },
+  'firewall-wide-port-range': { family: 'firewall-exposure', cwe: 'CWE-668', severity: 'high', ruleVersion: 1, vuln: 'Firewall opens a very wide port range on every interface', why: 'A range that spans every port (or ten thousand or more) is a firewall that is off in everything but name: whatever listens inside it, now or after the next package change, is reachable.', fix: 'Replace the range with the specific ports the services need in networking.firewall.allowedTCPPorts, or scope a genuinely needed range with networking.firewall.interfaces.<name>.allowedTCPPortRanges to a private interface.' },
   'listener-all-interfaces': { family: 'firewall-exposure', cwe: 'CWE-668', severity: 'medium', ruleVersion: 1, vuln: 'Service is configured to listen on every interface', why: 'Binding all interfaces widens the set of networks that can reach the service beyond the host itself.', fix: 'Leave the listener on localhost, or restrict listen addresses and the firewall to the interface that needs access.' },
   'listener-trust-auth': { family: 'firewall-exposure', cwe: 'CWE-306', severity: 'high', ruleVersion: 1, vuln: 'Database authentication is "trust" for a network-wide address range', why: 'A trust rule for 0.0.0.0/0 lets any client that reaches the port in as any user without a password.', fix: 'Use scram-sha-256 in services.postgresql.authentication and limit the address range.' },
   'service-runs-as-root': { family: 'service-identity', cwe: 'CWE-250', severity: 'medium', ruleVersion: 1, vuln: 'systemd service runs as root', why: 'A compromise of a root service is a compromise of the host; a dedicated or dynamic user confines it.', fix: 'Set serviceConfig.DynamicUser = true or serviceConfig.User to a dedicated account, and add NoNewPrivileges and ProtectSystem.' },
@@ -189,14 +190,31 @@ export function analyzeNixosHardening(opts, extra = {}) {
   const allowedUdp = view(note(nixos('networking.firewall.allowedUDPPorts'), 'firewall'));
   const globalPorts = (v) => (v.state === 'known' ? asList(v.value) : v.state === 'conditional' ? asList(v.definiteItems) : []);
   const allowedAll = new Set([...globalPorts(allowedTcp), ...globalPorts(allowedUdp)]);
-  const allowedKnown = allowedTcp.state === 'known' && allowedUdp.state === 'known';
+  // Port RANGES open ports exactly like single ports do. A range option that cannot be evaluated makes every firewall conclusion
+  // `unknown` (never "closed"), and a range that cannot be read as {from, to} integers is disclosed, not skipped.
+  const tcpRangesRes = note(nixos('networking.firewall.allowedTCPPortRanges'), 'firewall');
+  const udpRangesRes = note(nixos('networking.firewall.allowedUDPPortRanges'), 'firewall');
+  const readRanges = (res) => {
+    const v = view(res);
+    if (v.state !== 'known') return { state: v.state === 'conditional' ? 'conditional' : 'unknown', ranges: [] };
+    const ranges = [];
+    for (const it of asList(v.value)) {
+      if (!it || !Number.isInteger(it.from) || !Number.isInteger(it.to) || it.to < it.from) return { state: 'unknown', ranges: [] };
+      ranges.push({ from: it.from, to: it.to });
+    }
+    return { state: 'known', ranges, definite: v.definite };
+  };
+  const tcpRanges = readRanges(tcpRangesRes);
+  const udpRanges = readRanges(udpRangesRes);
+  const inTcpRange = (port) => tcpRanges.ranges.some((r) => port >= r.from && port <= r.to);
+  const allowedKnown = allowedTcp.state === 'known' && allowedUdp.state === 'known' && tcpRanges.state === 'known' && udpRanges.state === 'known';
   const interfaceScoped = cfg.options.filter((o) => o.namespace === 'nixos' && /^networking\.firewall\.interfaces\.[^.]+\.allowedTCPPorts$/.test(o.path));
 
   /** Host-firewall ingress for a TCP port; internet reachability itself is never decided. */
   function ingressFor(port, { openFirewallRes } = {}) {
     if (fwOff === 'yes') return 'firewall-disabled';
     if (fwOn !== 'yes') return 'unknown';
-    if (allowedAll.has(port)) return 'open-in-firewall';
+    if (allowedAll.has(port) || inTcpRange(port)) return 'open-in-firewall';
     if (openFirewallRes) {
       const o = judge(openFirewallRes, (x) => x === true);
       if (o === 'yes') return 'open-in-firewall';
@@ -412,6 +430,23 @@ export function analyzeNixosHardening(opts, extra = {}) {
       addFinding('firewall-sensitive-port', { anchor: anchorOf(res), scope: `${res.path}:${port}`, state: v.state === 'known' ? 'active' : 'conditional', uncertain: !v.definite, evidence: [evidenceOf(res)], extra: { port, portService: SENSITIVE_PORTS.get(port), exposure: { enabled: 'unknown', listening: 'unknown', ingress: fwOff === 'yes' ? 'firewall-disabled' : 'open-in-firewall', reachable: 'unknown' } } });
     }
   }
+  // Port ranges opened on every interface.
+  for (const [res, rg, proto] of [[tcpRangesRes, tcpRanges, 'tcp'], [udpRangesRes, udpRanges, 'udp']]) {
+    if (!res) continue;
+    if (rg.state !== 'known') {
+      if (res.status === 'set' || res.status === 'conditional') gaps.push({ kind: 'firewall-port-ranges-unevaluated', option: res.path, purpose: 'firewall', reason: `the ${proto} port ranges could not be evaluated to {from, to} integers, so no conclusion about them is drawn (this is not a clean result)` });
+      continue;
+    }
+    for (const r of rg.ranges) {
+      const span = r.to - r.from + 1;
+      const full = r.from <= 1 && r.to >= 65535;
+      if (full || span >= 10000) {
+        addFinding('firewall-wide-port-range', { severity: full ? 'high' : 'medium', anchor: anchorOf(res), scope: `${res.path}:${r.from}-${r.to}`, state: 'active', uncertain: !rg.definite, evidence: [evidenceOf(res)], extra: { portRange: { from: r.from, to: r.to, span, protocol: proto, everyPort: full }, exposure: { enabled: 'unknown', listening: 'unknown', ingress: fwOff === 'yes' ? 'firewall-disabled' : 'open-in-firewall', reachable: 'unknown' } } });
+      } else if (proto === 'tcp') {
+        for (const [port, svc] of SENSITIVE_PORTS) if (port >= r.from && port <= r.to) addFinding('firewall-sensitive-port', { anchor: anchorOf(res), scope: `${res.path}:${port}`, state: 'active', uncertain: !rg.definite, evidence: [evidenceOf(res)], extra: { port, portService: svc, viaRange: { from: r.from, to: r.to }, exposure: { enabled: 'unknown', listening: 'unknown', ingress: fwOff === 'yes' ? 'firewall-disabled' : 'open-in-firewall', reachable: 'unknown' } } });
+      }
+    }
+  }
   for (const o of interfaceScoped) {
     const iface = o.path.split('.')[3];
     controls.push({ control: 'interface-scoped-ingress', option: o.path, interface: iface, ports: asList(view(o).value), applies: true });