<filename>zgrab2_schemas/zgrab2/ipp.py
# zschema sub-schema for zgrab2's ipp module
# Registers zgrab2-ipp globally, and ipp with the main zgrab2 schema.
from zschema.leaves import *
from zschema.compounds import *
import zschema.registry

import zcrypto_schemas.zcrypto as zcrypto
from . import zgrab2

# TODO: Eventually re-introduce (non-cicular) dependency on HTTP zgrab2 schema
# lib/http/header.go: knownHeaders
http_known_headers = [
    "access_control_allow_origin",
    "accept_patch",
    "accept_ranges",
    "age",
    "allow",
    "alt_svc",
    "alternate_protocol",
    "cache_control",
    "connection",
    "content_disposition",
    "content_encoding",
    "content_language",
    "content_length",
    "content_location",
    "content_md5",
    "content_range",
    "content_type",
    "expires",
    "last_modified",
    "link",
    "location",
    "p3p",
    "pragma",
    "proxy_agent",
    "proxy_authenticate",
    "public_key_pins",
    "referer",
    "refresh",
    "retry_after",
    "server",
    "set_cookie",
    "status",
    "strict_transport_security",
    "trailer",
    "transfer_encoding",
    "upgrade",
    "vary",
    "via",
    "warning",
    "www_authenticate",
    "x_frame_options",
    "x_xss_protection",
    "content_security_policy",
    "x_content_security_policy",
    "x_webkit_csp",
    "x_content_type_options",
    "x_powered_by",
    "x_ua_compatible",
    "x_content_duration",
    "x_real_ip",
    "x_forwarded_for",
]

http_unknown_headers = ListOf(SubRecord({
    "key": String(),
    "value": ListOf(String())
}))

_http_headers = dict(
    (header_name, ListOf(String()))
    for header_name in http_known_headers
)
_http_headers["unknown"] = http_unknown_headers

# Format from the custom JSON Marshaller in lib/http/header.go
http_headers = SubRecord(_http_headers)

# net.url: type Values map[string][]string
http_form_values = SubRecord({})  # TODO FIXME: unconstrained dict

# lib/http/request.go: URLWrapper
http_url_wrapper = SubRecord({
    "scheme": String(),
    "opaque": String(),
    "host": String(),
    "path": String(),
    "raw_path": String(),
    "raw_query": String(),
    "fragment": String()
})

# modules/http.go: HTTPRequest
http_request = SubRecord({
    "method": String(),
    "endpoint": String(),
    "user_agent": String(),
    "body": String()
})

# modules/http.go: HTTPResponse
http_response = SubRecord({
    "version_major": Signed32BitInteger(),
    "version_minor": Signed32BitInteger(),
    "status_code": Signed32BitInteger(),
    "status_line": String(),
    "headers": http_headers,
    "body": String(),
    "body_sha256": String()
})

# lib/http/request.go: http.Request
http_request_full = SubRecord({
    "url": http_url_wrapper,
    "method": String(),
    "headers":  http_headers,
    "body": String(),
    "content_length": Signed64BitInteger(),
    "transfer_encoding": ListOf(String()),
    "close": Boolean(),
    "host": String(),
    "form": http_form_values,
    "post_form": http_form_values,
    "multipart_form": http_form_values,
    "trailers": http_headers,
    # The new field tls_log contains the zgrab2 TLS logs.
    "tls_log": zgrab2.tls_log
})

# lib/http/response.go: http.Response
http_response_full = SubRecord({
    "status_line": String(),
    "status_code": Unsigned32BitInteger(),
    # lib/http/protocol.go: http.Protocol
    "protocol": SubRecord({
        "name": String(),
        "major": Unsigned32BitInteger(),
        "minor": Unsigned32BitInteger(),
    }),
    "headers": http_headers,
    "body": String(),
    "body_sha256": Binary(),
    "content_length": Signed64BitInteger(),
    "transfer_encoding": ListOf(String()),
    "trailers": http_headers,
    "request": http_request_full
})

# TODO: Determine whether value-tag types with same underlying form should have a different name in this mapping
# TODO: Add method to decode these values appropriately. Encoding of different tag's attribute values specified
# in Table 7 of RFC 8010 Section 3.9 (https://tools.ietf.org/html/rfc8010#section-3.9)
# "value-tag" values which specify the interpretation of an attribute's value:
# From RFC 8010 Section 3.5.2 (https://tools.ietf.org/html/rfc8010#section-3.5.2)
# Note: value-tag values are camelCase because the names are specified that way in RFC
ipp_attribute_value = SubRecord({
    "raw": IndexedBinary(),
    "integer": Signed32BitInteger(),
    "boolean": Boolean(),
    "enum": String(),
    "octetString": IndexedBinary(),
    "dateTime": DateTime(),
    # TODO: Determine appropriate type for resolution
    "resolution": IndexedBinary(),
    # TODO: Determine appropriate type for range of Integers (probably {min, max} pair)
    "rangeOfInteger": IndexedBinary(),
    # TODO: Determine appropriate type for beginning of attribute collection
    "bagCollection": IndexedBinary(),
    "textWithLanguage": String(),
    "nameWithLanguage": String(),
    # TODO: Determine appropriate type for end of attribute collection
    "endCollection": IndexedBinary(),
    "textWithoutLanguage": String(),
    "nameWithoutLanguage": String(),
    "keyword": String(),
    "uri": String(),
    "uriScheme": String(),
    "charset": String(),
    "naturalLanguage": String(),
    "mimeMediaType": String(),
    "memberAttrName": String(),
})

ipp_attribute = SubRecord({
    "name": String(),
    "values": ListOf(ipp_attribute_value),
    "tag": Unsigned8BitInteger(),
})

ipp_scan_response = SubRecord({
    "result": SubRecord({
        "version_major": Signed8BitInteger(doc="Major component of IPP version listed in the Server header of a response to an IPP get-printer-attributes request."),
        "version_minor": Signed8BitInteger(doc="Minor component of IPP version listed in the Server header of a response to an IPP get-printer-attributes request."),
        "version_string": String(doc="The specific IPP version returned in response to an IPP get-printer-attributes request. Always in the form 'IPP/x.y'", examples=["IPP/1.0", "IPP/2.1"]),
        "cups_version": String(doc="The CUPS version, if any, specified in the Server header of an IPP get-attributes response.", examples=["CUPS/1.7", "CUPS/2.2"]),
        "attributes": ListOf(ipp_attribute, doc="All IPP attributes included in any contentful responses obtained. Each has a name, list of values (potentially only one), and a tag denoting how the value should be interpreted."),
        "attr_cups_version": String(doc="The CUPS version, if any, specified in the list of attributes returned in a get-printer-attributes response or CUPS-get-printers response. Generally in the form 'x.y.z'.", examples=["1.7.5", "2.2.7"]),
        "attr_ipp_versions": ListOf(String(), doc="Each IPP version, if any, specified in the list of attributes returned in a get-printer-attributes response or CUPS-get-printers response. Always in the form 'x.y'.", examples=["1.0", "1.1", "2.0", "2.1"]),
        "attr_printer_uris": ListOf(String(), doc="Each printer URI, if any, specified in the list of attributes returned in a get-printer-attributes response or CUPS-get-printers response. Uses ipp(s) or http(s) scheme, followed by a hostname or IP, and then the path to a particular printer.", examples=["ipp://192.168.3.11:631/printers/Etiqueta", "http://16172.16.58.3/ipp", "ipp://BRNB8763F84DD6A.local./ipp/port1"]),
        "response": http_response_full,
        "cups_response": http_response_full,
        "tls": zgrab2.tls_log,
        "redirect_response_chain": ListOf(http_response_full, doc="Each response returned while following a series of redirects."),
    })
}, extends=zgrab2.base_scan_response)

zschema.registry.register_schema("zgrab2-ipp", ipp_scan_response)

zgrab2.register_scan_response_type("ipp", ipp_scan_response)
