Configure private IPv4 during Windows enrollment

tests/BootstrapNetwork.Tests.ps1

@@ -25,6 +25,22 @@ $networkFunctions = $serverAst.FindAll({
     }, $true)
 Invoke-Expression (($networkFunctions | ForEach-Object { $_.Extent.Text }) -join [Environment]::NewLine)
 
+$clientTokens = $null
+$clientParseErrors = $null
+$clientAst = [Management.Automation.Language.Parser]::ParseFile(
+    $clientBootstrapPath,
+    [ref]$clientTokens,
+    [ref]$clientParseErrors)
+if ($clientParseErrors.Count -gt 0) {
+    throw ($clientParseErrors -join [Environment]::NewLine)
+}
+$clientNetworkFunctions = $clientAst.FindAll({
+        param($node)
+        $node -is [Management.Automation.Language.FunctionDefinitionAst] -and
+            $node.Name -eq 'Test-IPv4AddressesSharePrefix'
+    }, $true)
+Invoke-Expression (($clientNetworkFunctions | ForEach-Object { $_.Extent.Text }) -join [Environment]::NewLine)
+
 Describe 'SGU public-cloud network safety' {
     It 'canonicalizes a host address to its IPv4 network' {
         ConvertTo-NetworkCidr -Address ([ipaddress]'10.77.0.4') `
@@ -58,6 +74,31 @@ Describe 'SGU public-cloud network safety' {
             'VpnProfilePackagePath') | Should Be $true
     }
 
+    It 'accepts an explicit static IPv4 address for a private Windows adapter' {
+        ((Get-Command $clientBootstrapPath).Parameters.Keys -contains
+            'ClientIPv4Address') | Should Be $true
+        ((Get-Command $clientBootstrapPath).Parameters.Keys -contains
+            'ClientPrefixLength') | Should Be $true
+    }
+
+    It 'matches a client and domain controller within the requested prefix' {
+        Test-IPv4AddressesSharePrefix -FirstAddress ([ipaddress]'192.168.50.11') `
+            -SecondAddress ([ipaddress]'192.168.50.10') -PrefixLength 24 |
+            Should Be $true
+        Test-IPv4AddressesSharePrefix -FirstAddress ([ipaddress]'192.168.51.11') `
+            -SecondAddress ([ipaddress]'192.168.50.10') -PrefixLength 24 |
+            Should Be $false
+        Test-IPv4AddressesSharePrefix -FirstAddress ([ipaddress]'10.77.15.20') `
+            -SecondAddress ([ipaddress]'10.77.0.4') -PrefixLength 16 |
+            Should Be $true
+    }
+
+    It 'prefers the private adapter instead of the Internet default route' {
+        $source = Get-Content -LiteralPath $clientBootstrapPath -Raw
+        $source | Should Match '\$withoutDefaultGateway\.Count -eq 1'
+        $source | Should Not Match "Get-NetRoute -AddressFamily IPv4 -DestinationPrefix '0\.0\.0\.0/0'"
+    }
+
     It 'uses an all-user machine-certificate VPN profile' {
         $source = Get-Content -LiteralPath $azureClientPath -Raw
         $source | Should Match '-AuthenticationMethod MachineCertificate'