113 lines
4.8 KiB
Python
113 lines
4.8 KiB
Python
from pathlib import Path
|
|
|
|
|
|
ROOT = Path(__file__).resolve().parents[3]
|
|
BASELINE = ROOT / "agent99-windows-control-baseline.ps1"
|
|
CONTROL_PLANE = ROOT / "agent99-control-plane.ps1"
|
|
|
|
|
|
def _source() -> str:
|
|
return BASELINE.read_text(encoding="utf-8")
|
|
|
|
|
|
def test_baseline_is_canonical_windows99_user_scoped_and_preserves_zh_tw() -> None:
|
|
source = _source()
|
|
|
|
assert '$CanonicalAsset = "host:192.168.0.99/windows-control-baseline"' in source
|
|
assert '$ExpectedComputerName = "WOOO-SUPER"' in source
|
|
assert '$ExpectedUserName = "Administrator"' in source
|
|
assert '$PreservedCulture = "zh-TW"' in source
|
|
assert '$PreservedChineseLanguage = "zh-Hant-TW"' in source
|
|
assert '$FallbackLanguage = "en-US"' in source
|
|
assert '$FallbackInputTip = "0409:00000409"' in source
|
|
assert "priorInputMethodsPreserved" in source
|
|
assert "missingPreservedLanguageSignatures" in source
|
|
|
|
|
|
def test_baseline_supports_check_apply_independent_verify_and_rollback() -> None:
|
|
source = _source()
|
|
|
|
assert '[ValidateSet("Check", "Apply")]' in source
|
|
assert "TraceId" in source
|
|
assert "RunId" in source
|
|
assert "WorkItemId" in source
|
|
assert "SourceRevision" in source
|
|
assert "Invoke-IndependentSnapshot" in source
|
|
assert '"-EncodedCommand", $encoded' in source
|
|
assert "Test-WindowsControlSnapshot" in source
|
|
assert "Restore-WindowsControlBaseline" in source
|
|
assert '"verified_check_no_write"' in source
|
|
assert '"runtime_verified_controlled_apply"' in source
|
|
assert '"rolled_back_verified"' in source
|
|
assert '"degraded_with_safe_next_action"' in source
|
|
|
|
|
|
def test_baseline_accepts_transport_run_ids_but_hashes_the_evidence_filename() -> None:
|
|
source = _source()
|
|
|
|
safe_identity_pattern = "^[A-Za-z0-9][A-Za-z0-9._:@+-]{0,127}$"
|
|
assert source.count(f'[ValidatePattern("{safe_identity_pattern}")]') == 3
|
|
assert "function Get-AgentRunEvidenceToken" in source
|
|
assert "$EvidenceRunToken = Get-AgentRunEvidenceToken -Value $RunId" in source
|
|
assert '"agent99-WindowsControlBaseline-$EvidenceRunToken.json"' in source
|
|
assert '"agent99-WindowsControlBaseline-$RunId.json"' not in source
|
|
assert 'algorithm = "sha256_utf8"' in source
|
|
assert "runToken = $EvidenceRunToken" in source
|
|
assert "rawIdentityInFileName = $false" in source
|
|
|
|
|
|
def test_control_plane_reads_the_same_hashed_baseline_receipt() -> None:
|
|
source = CONTROL_PLANE.read_text(encoding="utf-8")
|
|
|
|
assert "function Get-AgentSha256Hex" in source
|
|
assert "$evidenceRunToken = Get-AgentSha256Hex $runId" in source
|
|
assert '"agent99-WindowsControlBaseline-$evidenceRunToken.json"' in source
|
|
assert '"agent99-WindowsControlBaseline-$runId.json"' not in source
|
|
assert '[string]$receipt.evidenceIdentity.algorithm -eq "sha256_utf8"' in source
|
|
assert '[string]$receipt.evidenceIdentity.runToken -eq $evidenceRunToken' in source
|
|
assert "$receipt.evidenceIdentity.rawIdentityInFileName -eq $false" in source
|
|
|
|
|
|
def test_baseline_sets_only_the_bounded_control_settings() -> None:
|
|
source = _source()
|
|
|
|
assert "Set-WinUserLanguageList" in source
|
|
assert "Set-WinDefaultInputMethodOverride" in source
|
|
assert 'New-ItemProperty -Path $ConsoleRegistryPath -Name "CodePage"' in source
|
|
assert 'Set-Service -Name "sshd" -StartupType Automatic' in source
|
|
assert 'Start-Service -Name "sshd"' in source
|
|
assert "Invoke-Expression" not in source
|
|
assert "Set-WinSystemLocale" not in source
|
|
assert "Set-Culture" not in source
|
|
assert "Restart-Computer" not in source
|
|
assert "Stop-Computer" not in source
|
|
assert "shutdown.exe" not in source
|
|
assert "logoff.exe" not in source
|
|
|
|
|
|
def test_baseline_receipt_marks_noninteractive_utf8_boundaries() -> None:
|
|
source = _source()
|
|
|
|
assert "[Console]::InputEncoding = [System.Text.UTF8Encoding]::new($false)" in source
|
|
assert "[Console]::OutputEncoding = [System.Text.UTF8Encoding]::new($false)" in source
|
|
assert 'guiInteraction = $false' in source
|
|
assert 'clipboardUsed = $false' in source
|
|
assert 'secretValueRead = $false' in source
|
|
assert 'encodedCommandCompatible = $true' in source
|
|
assert 'interactiveInputRequired = $false' in source
|
|
assert 'inputMethodIndependent = $true' in source
|
|
assert 'utf8Output = $true' in source
|
|
assert 'telegramNotificationSent = $false' in source
|
|
assert 'kmRagWritebackPerformed = $false' in source
|
|
|
|
|
|
def test_baseline_normalizes_windows_collection_and_keyboard_objects() -> None:
|
|
source = _source()
|
|
|
|
assert "foreach ($language in $languageList)" in source
|
|
assert '$override.PSObject.Properties["InputMethodTip"]' in source
|
|
assert "Get-DefaultInputMethodTip" in source
|
|
assert "Test-WindowsControlSnapshot $independentReadback.snapshot $before -IndependentProcess" in source
|
|
assert "uiCulture = [string]$Snapshot.uiCulture" not in source
|
|
assert "([string]$Snapshot.userName).ToLowerInvariant()" in source
|