製造業・金属加工・金型向け：
2026年SCS評価制度（★3）取得実践ガイド：3D CAD図面保護とNC工作機械のネットワーク分離

#![forbid(unsafe_code)]

use std::fmt::Write;

/// Allowed CAD / CAM file formats in the manufacturing vault and DNC relay.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum ManufacturingAssetKind {
    StepIso10303,
    IgesAscii,
    ParasolidBinary,
    FanucGCode,
}

/// Result of inspecting a CAD or NC file write operation before committing to ZFS.
#[derive(Debug, Clone, PartialEq)]
pub struct WriteInspectionVerdict {
    pub shannon_entropy_bits: f64,
    pub chi_square_uniformity: f64,
    pub is_ransomware_suspect: bool,
    pub gcode_syntax_valid: bool,
    pub fnv1a_64_digest: u64,
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub enum MfgGuardError {
    EmptyPayload,
    ForbiddenControlByte { offset: usize, byte: u8 },
    RansomwareEntropySpike { entropy_milli: u32 },
    SmbEncryptionNotEnforced,
}

/// Computes Shannon entropy H(X) in [0.0, 8.0] and Chi-Square uniformity statistic
/// in a single zero-allocation pass over the byte slice.
pub fn analyze_byte_distribution(payload: &[u8]) -> Result<(f64, f64, u64), MfgGuardError> {
    if payload.is_empty() {
        return Err(MfgGuardError::EmptyPayload);
    }

    let mut counts = [0u32; 256];
    let mut fnv_hash: u64 = 0xcbf29ce484222325;
    for &b in payload {
        counts[b as usize] += 1;
        fnv_hash ^= u64::from(b);
        fnv_hash = fnv_hash.wrapping_mul(0x00000100000001B3);
    }

    let len_f = payload.len() as f64;
    let expected = len_f / 256.0;
    let mut entropy = 0.0_f64;
    let mut chi_sq = 0.0_f64;

    for &c in &counts {
        if c > 0 {
            let p = f64::from(c) / len_f;
            entropy -= p * p.log2();
        }
        let diff = f64::from(c) - expected;
        chi_sq += (diff * diff) / expected;
    }

    Ok((entropy, chi_sq, fnv_hash))
}

/// Validates that an incoming DNC program contains strictly safe RS-274D G-code ASCII
/// characters and no shell/binary injection sequences before exposing it to VLAN 30.
pub fn verify_nc_gcode_safety(payload: &[u8]) -> Result<(), MfgGuardError> {
    for (idx, &b) in payload.iter().enumerate() {
        let allowed = b.is_ascii_alphanumeric()
            || matches!(
                b,
                b'\r' | b'\n' | b'\t' | b' ' | b'%' | b'(' | b')' | b'.' | b'-'
                    | b'+' | b'/' | b'=' | b'#' | b'[' | b']' | b';' | b':'
            );
        if !allowed {
            return Err(MfgGuardError::ForbiddenControlByte { offset: idx, byte: b });
        }
    }
    Ok(())
}

/// Evaluates a CAD/CAM file write and emits a deterministic SCS ★3 audit attestation line.
pub fn inspect_and_attest_mfg_write(
    client_vlan: u16,
    smb_encrypted: bool,
    kind: ManufacturingAssetKind,
    payload: &[u8],
) -> Result<(WriteInspectionVerdict, String), MfgGuardError> {
    if !smb_encrypted {
        return Err(MfgGuardError::SmbEncryptionNotEnforced);
    }

    let (entropy, chi_sq, digest) = analyze_byte_distribution(payload)?;
    let gcode_ok = match kind {
        ManufacturingAssetKind::FanucGCode => verify_nc_gcode_safety(payload).is_ok(),
        _ => true,
    };

    // Uncompressed ASCII STEP/G-code has entropy < 6.0; encrypted ransomware approaches 8.0
    // with low chi-square deviation (< 310.0 across 255 degrees of freedom).
    let is_suspect = entropy > 7.93 && chi_sq < 310.0;
    if is_suspect {
        return Err(MfgGuardError::RansomwareEntropySpike {
            entropy_milli: (entropy * 1000.0) as u32,
        });
    }

    let verdict = WriteInspectionVerdict {
        shannon_entropy_bits: entropy,
        chi_square_uniformity: chi_sq,
        is_ransomware_suspect: is_suspect,
        gcode_syntax_valid: gcode_ok,
        fnv1a_64_digest: digest,
    };

    let mut audit_line = String::with_capacity(160);
    let _ = write!(
        &mut audit_line,
        "SCS★3-MFG-AUDIT|vlan={}|smb3_enc=true|kind={:?}|H={:.4}|chi2={:.1}|fnv64={:016x}|gcode_ok={}",
        client_vlan, kind, entropy, chi_sq, digest, gcode_ok
    );

    Ok((verdict, audit_line))
}