82 lines
2.6 KiB
Rust
82 lines
2.6 KiB
Rust
use std::path::PathBuf;
|
|
|
|
#[cfg(windows)]
|
|
use proxywarden_lib::process::AuthenticodePublisher;
|
|
use proxywarden_lib::process::{verify_authenticode, AuthenticodeError};
|
|
|
|
#[cfg(windows)]
|
|
#[test]
|
|
fn bundled_windows_packet_filter_has_expected_trusted_publisher() {
|
|
let path = PathBuf::from(env!("CARGO_MANIFEST_DIR"))
|
|
.join("bundled/components/windows-packet-filter/Windows.Packet.Filter.3.6.2.1.x64.msi");
|
|
|
|
let verification = verify_authenticode(path).expect("bundled MSI should be verifiable");
|
|
|
|
assert!(verification.is_trusted);
|
|
assert_eq!(
|
|
verification.publisher,
|
|
Some(AuthenticodePublisher {
|
|
common_name: "The Anti-Cloud Corporation".to_owned(),
|
|
organization: "The Anti-Cloud Corporation".to_owned(),
|
|
})
|
|
);
|
|
assert_eq!(verification.status_code, 0);
|
|
}
|
|
|
|
#[cfg(windows)]
|
|
#[test]
|
|
fn unsigned_regular_file_is_not_trusted() {
|
|
let path = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("Cargo.toml");
|
|
|
|
let verification = verify_authenticode(path).expect("regular file should be inspectable");
|
|
|
|
assert!(!verification.is_trusted);
|
|
assert_eq!(verification.publisher, None);
|
|
assert_ne!(verification.status_code, 0);
|
|
}
|
|
|
|
#[cfg(windows)]
|
|
#[test]
|
|
fn reparse_target_is_rejected_when_symlink_creation_is_available() {
|
|
use std::{fs, os::windows::fs::symlink_file};
|
|
|
|
let root = std::env::temp_dir().join(format!(
|
|
"proxywarden-authenticode-test-{}",
|
|
uuid::Uuid::new_v4().simple()
|
|
));
|
|
fs::create_dir(&root).expect("test root should be creatable");
|
|
let link = root.join("linked-target.exe");
|
|
let target = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("Cargo.toml");
|
|
if let Err(error) = symlink_file(target, &link) {
|
|
fs::remove_dir(&root).expect("test root should be removable");
|
|
if error.raw_os_error() == Some(1314) {
|
|
eprintln!("skipping reparse probe because this process lacks symlink privilege");
|
|
return;
|
|
}
|
|
panic!("test symlink creation failed: {error}");
|
|
}
|
|
|
|
let result = verify_authenticode(&link);
|
|
fs::remove_file(&link).expect("test symlink should be removable");
|
|
fs::remove_dir(&root).expect("test root should be removable");
|
|
|
|
assert_eq!(result, Err(AuthenticodeError::UnsafeTarget));
|
|
}
|
|
|
|
#[test]
|
|
fn missing_target_fails_closed() {
|
|
let path = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("missing-signature-target.exe");
|
|
|
|
#[cfg(windows)]
|
|
assert_eq!(
|
|
verify_authenticode(path),
|
|
Err(AuthenticodeError::InvalidTarget)
|
|
);
|
|
|
|
#[cfg(not(windows))]
|
|
assert_eq!(
|
|
verify_authenticode(path),
|
|
Err(AuthenticodeError::UnsupportedPlatform)
|
|
);
|
|
}
|