Add packaged DLP broker and protected Windows service foundation

tests/test_windows_wfp_receiver.py

@@ -0,0 +1,59 @@
+import ctypes as C
+import os
+import json
+import subprocess
+import sys
+import unittest
+from pathlib import Path
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / 'apps/network-broker'))
+from windows_wfp_receiver import service_sddl, service_descriptor
+from windows_wfp_install import NativeBackend
+from windows_wfp_probe import Filter, Blob
+
+class ReceiverTests(unittest.TestCase):
+    def test_service_sid_only_and_minimum_match_right(self):
+        self.assertEqual(service_sddl('S-1-5-80-1-2-3-4-5'), 'D:(A;;CC;;;S-1-5-80-1-2-3-4-5)')
+        for sid in ['S-1-5-19', 'S-1-5-80-01-2-3-4-5', 'S-1-5-80-4294967296-2-3-4-5']:
+            with self.assertRaises(Exception): service_sddl(sid)
+
+    @unittest.skipUnless(os.name == 'nt', 'Native Windows SD validation')
+    def test_actual_native_self_relative_sd_and_exact_ace_mask(self):
+        api = C.WinDLL('advapi32')
+        api.IsValidSecurityDescriptor.argtypes = [C.c_void_p]
+        api.IsValidSecurityDescriptor.restype = C.c_int
+        with service_descriptor('S-1-5-80-1-2-3-4-5') as blob:
+            self.assertTrue(api.IsValidSecurityDescriptor(blob.data))
+            raw = C.string_at(blob.data, blob.size)
+            self.assertTrue(int.from_bytes(raw[2:4], 'little') & 0x8000)
+            dacl = int.from_bytes(raw[16:20], 'little')
+            self.assertEqual(int.from_bytes(raw[dacl+4:dacl+6], 'little'), 1)
+            self.assertEqual(int.from_bytes(raw[dacl+12:dacl+16], 'little'), 1)
+
+    @unittest.skipUnless(os.name == 'nt', 'Native Windows SD marshalling')
+    def test_actual_sd_lifetime_and_uint64_soft_permit_marshalling_without_add(self):
+        backend = NativeBackend.__new__(NativeBackend)
+        backend.engine = C.c_void_p(1)
+        captured = []
+        def capture(name, _engine, pointer, _security, _id):
+            self.assertEqual(name, 'FwpmFilterAdd0')
+            value = C.cast(pointer, C.POINTER(Filter)).contents
+            self.assertEqual(value.flags, 1)  # PERSISTENT only; no clear-action.
+            self.assertEqual(value.action.type, 0x1002)
+            self.assertEqual(value.weight.type, 4)
+            self.assertEqual(C.cast(value.weight.pointer, C.POINTER(C.c_uint64)).contents.value, 2)
+            self.assertEqual(value.count, 5)
+            condition = value.conditions[4]
+            self.assertEqual(condition.value.type, 14)
+            blob = C.cast(condition.value.pointer, C.POINTER(Blob)).contents
+            captured.append(C.string_at(blob.data, blob.size))
+        backend._call = capture
+        script = "const {planServiceReceiver}=require('./apps/network-broker/wfp-topology.cjs');console.log(JSON.stringify(planServiceReceiver({appId:Buffer.from(process.argv[1],'hex'),brokerPort:43120,serviceSid:'S-1-5-80-1-2-3-4-5'}).filters[0]));"
+        identity = '\\device\\harddiskvolume3\\safetynet\\node.exe\0'.encode('utf-16le').hex()
+        result = subprocess.run(['node','-e',script,identity],cwd=Path(__file__).resolve().parents[1],capture_output=True,text=True,check=True,timeout=10)
+        rule = json.loads(result.stdout)
+        backend.add_filter(rule)
+        rule['conditions'] = rule['conditions'][-1:]
+        with self.assertRaises(Exception): backend.add_filter(rule)
+        self.assertEqual(len(captured), 1)
+
+if __name__ == '__main__': unittest.main()