75 lines
2.9 KiB
PowerShell
75 lines
2.9 KiB
PowerShell
$repositoryRoot = (Resolve-Path (Join-Path $PSScriptRoot '..')).Path
|
|
$serverBootstrapPath = Join-Path $repositoryRoot 'scripts\Initialize-SguDomainController.ps1'
|
|
$clientBootstrapPath = Join-Path $repositoryRoot 'scripts\Invoke-SguClientBootstrap.ps1'
|
|
$azureClientPath = Join-Path $repositoryRoot 'scripts\Install-SguAzureP2sClient.ps1'
|
|
$bicepPath = Join-Path $repositoryRoot 'infra\azure\main.bicep'
|
|
|
|
$tokens = $null
|
|
$parseErrors = $null
|
|
$serverAst = [Management.Automation.Language.Parser]::ParseFile(
|
|
$serverBootstrapPath,
|
|
[ref]$tokens,
|
|
[ref]$parseErrors)
|
|
if ($parseErrors.Count -gt 0) {
|
|
throw ($parseErrors -join [Environment]::NewLine)
|
|
}
|
|
$networkFunctionNames = @(
|
|
'Test-PrivateIPv4Address',
|
|
'ConvertTo-NetworkCidr',
|
|
'ConvertTo-PrivateNetworkCidr'
|
|
)
|
|
$networkFunctions = $serverAst.FindAll({
|
|
param($node)
|
|
$node -is [Management.Automation.Language.FunctionDefinitionAst] -and
|
|
$networkFunctionNames -contains $node.Name
|
|
}, $true)
|
|
Invoke-Expression (($networkFunctions | ForEach-Object { $_.Extent.Text }) -join [Environment]::NewLine)
|
|
|
|
Describe 'SGU public-cloud network safety' {
|
|
It 'canonicalizes a host address to its IPv4 network' {
|
|
ConvertTo-NetworkCidr -Address ([ipaddress]'10.77.0.4') `
|
|
-NetworkPrefixLength 24 | Should Be '10.77.0.0/24'
|
|
}
|
|
|
|
It 'canonicalizes the trusted P2S pool' {
|
|
ConvertTo-PrivateNetworkCidr -Cidr '172.30.4.19/16' |
|
|
Should Be '172.30.0.0/16'
|
|
}
|
|
|
|
It 'rejects a public trusted-client CIDR' {
|
|
$wasRejected = $false
|
|
try {
|
|
ConvertTo-PrivateNetworkCidr -Cidr '8.8.8.0/24' | Out-Null
|
|
}
|
|
catch {
|
|
$wasRejected = $true
|
|
}
|
|
$wasRejected | Should Be $true
|
|
}
|
|
|
|
It 'exposes explicit Azure modes on both bootstraps' {
|
|
((Get-Command $serverBootstrapPath).Parameters.Keys -contains
|
|
'NetworkConfigurationMode') | Should Be $true
|
|
((Get-Command $serverBootstrapPath).Parameters.Keys -contains
|
|
'TrustedClientNetworks') | Should Be $true
|
|
((Get-Command $clientBootstrapPath).Parameters.Keys -contains
|
|
'ConnectivityMode') | Should Be $true
|
|
((Get-Command $clientBootstrapPath).Parameters.Keys -contains
|
|
'VpnProfilePackagePath') | Should Be $true
|
|
}
|
|
|
|
It 'uses an all-user machine-certificate VPN profile' {
|
|
$source = Get-Content -LiteralPath $azureClientPath -Raw
|
|
$source | Should Match '-AuthenticationMethod MachineCertificate'
|
|
$source | Should Match '-AllUserConnection'
|
|
$source | Should Match 'Add-DnsClientNrptRule'
|
|
}
|
|
|
|
It 'limits optional public administration to RDP' {
|
|
$template = Get-Content -LiteralPath $bicepPath -Raw
|
|
$template | Should Match "name: 'Allow-RDP-from-administrator'"
|
|
$template | Should Match "destinationPortRange: '3389'"
|
|
$template | Should Not Match "sourceAddressPrefix: '0\.0\.0\.0/0'"
|
|
}
|
|
}
|