14 lines
2.6 KiB
JavaScript
14 lines
2.6 KiB
JavaScript
import test from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import {createRequire} from 'node:module';
|
|
const require=createRequire(import.meta.url);
|
|
const {GUIDS}=require('../apps/network-broker/windows-wfp-plan.cjs');
|
|
const {validateTopology,createTopologyGuard,planServiceReceiver}=require('../apps/network-broker/wfp-topology.cjs');
|
|
const snapshot=()=>({ownedSublayer:'ours',enumerationComplete:true,allObjectsReadable:true,sublayers:[{key:'ours',weight:65535},{key:'corp',weight:100}],filters:[...Array.from({length:8},(_,i)=>({key:String(i),sublayer:'ours',layer:GUIDS.connectV4,ownedVerified:true})),{sublayer:'corp',layer:GUIDS.recvV4,action:'BLOCK'}]});
|
|
test('complete highest owned topology admits while corporate block stays present',()=>{assert.equal(validateTopology(snapshot()).safe,true);assert.equal(validateTopology(snapshot()).zeroChangeWindowProven,false);});
|
|
test('equal priority hard permit/callout ambiguity cannot be admitted',()=>{for(const action of ['PERMIT','CALLOUT','BLOCK']){const s=snapshot();s.sublayers[1].weight=65535;s.filters.at(-1).action=action;assert.equal(validateTopology(s).reason,'priority-collision');}});
|
|
test('partial visibility and unverified own filters fail closed',()=>{const s=snapshot();s.allObjectsReadable=false;assert.equal(validateTopology(s).safe,false);s.allObjectsReadable=true;s.filters[0].ownedVerified=false;assert.equal(validateTopology(s).safe,false);});
|
|
test('malformed filter rows cannot silently vanish from a snapshot',()=>{for(const row of [null,{}, {layer:3,sublayer:'corp'}, {layer:GUIDS.recvV4}]){const s=snapshot();s.filters.push(row);assert.equal(validateTopology(s).reason,'snapshot-invalid');}});
|
|
test('change during initial enumeration cannot be undone by later successful snapshot',()=>{const reasons=[];const g=createTopologyGuard({quarantine:r=>reasons.push(r)});g.changed();assert.equal(g.admit(snapshot()),false);assert.equal(g.current(),false);g.changed();assert.deepEqual(reasons,['wfp-topology-changed']);});
|
|
test('service receiver soft permit and lower block match only exact service tuple',()=>{const p=planServiceReceiver({appId:Buffer.from('\\device\\harddiskvolume3\\safetynet\\node.exe\0','utf16le'),brokerPort:43120,serviceSid:'S-1-5-80-1-2-3-4-5'});assert.equal(p.filters[0].action,'FWP_ACTION_PERMIT');assert.equal(p.filters[0].clearActionRight,false);assert.ok(p.filters[0].weight>p.filters[1].weight);assert.equal(p.filters[0].conditions.at(-1).type,'FWP_SECURITY_DESCRIPTOR_TYPE');assert.equal(p.completeBoundary,false);assert.throws(()=>planServiceReceiver({appId:Buffer.alloc(8),brokerPort:3,serviceSid:'S-1-5-19'}));});
|