mirror of
https://github.com/Yamato-Security/WELA.git
synced 2026-10-01 20:14:43 +02:00
71 lines
4.3 KiB
PowerShell
71 lines
4.3 KiB
PowerShell
# Public process-boundary regression: no mocked dispatcher or Windows writers.
|
|
$ErrorActionPreference = 'Stop'
|
|
$repo = Split-Path $PSScriptRoot -Parent
|
|
$engine = (Get-Process -Id $PID).Path
|
|
$count = 0
|
|
$root = Join-Path ([IO.Path]::GetTempPath()) ('wela-cli-arguments-' + [guid]::NewGuid().ToString('N'))
|
|
$null = New-Item -ItemType Directory -Path $root
|
|
function Assert($Value, $Message) { if (-not $Value) { throw $Message }; $script:count++ }
|
|
function Invoke-Case([string[]]$Arguments, [int]$Expected, [string]$Pattern) {
|
|
$prior = $ErrorActionPreference
|
|
try {
|
|
$ErrorActionPreference = 'Continue'
|
|
$output = & $engine -NoLogo -NoProfile -NonInteractive -File "$repo/WELA.ps1" @Arguments 2>&1 | Out-String
|
|
$code = $LASTEXITCODE
|
|
} finally { $ErrorActionPreference = $prior }
|
|
Assert ($code -eq $Expected -and $output -match $Pattern) "Unexpected public CLI exit/output [$code]: $output"
|
|
}
|
|
$isWindowsHost = [Environment]::OSVersion.Platform -eq [PlatformID]::Win32NT
|
|
function Read-NativeState {
|
|
$logs = @('Security','System','Application','ForwardedEvents','Microsoft-Windows-CAPI2/Operational')
|
|
$state = [ordered]@{ Audit = Get-WelaEffectiveAuditPolicy; Channels = @() }
|
|
foreach ($name in $logs) { $state.Channels += Get-WelaNativeChannel $name }
|
|
return ($state | ConvertTo-Json -Depth 12 -Compress)
|
|
}
|
|
try {
|
|
if ($isWindowsHost) {
|
|
Import-Module "$repo/modules/AuditProfiles.psm1" -Force
|
|
Import-Module "$repo/modules/NativeProviders.psm1" -Force
|
|
$before = Read-NativeState
|
|
}
|
|
# These previously reached legacy writers, including the profile fast path.
|
|
$commands = @(
|
|
@('configure','-Auto'),
|
|
@('configure','-Profile','wela-2.2.0','-Auto'),
|
|
@('configure-eventlogs','-LogProfile','asd-collector-archive-2021-10','-ApplyLogMode','-Auto'),
|
|
@('configure-sacl','-Auto'),
|
|
@('channel-settings','-ChannelAction','Configure','-GrantEventLogReaders','-Auto'),
|
|
@('powershell-transcription','-TranscriptionAction','Configure','-Auto'),
|
|
@('firewall-logging','-FirewallAction','Configure','-Auto'),
|
|
@('smb-auditing','-SmbAction','Configure','-Auto'),
|
|
@('audit-integrity','-IntegrityAction','Configure','-Auto'),
|
|
@('provider-packs','-ProviderAction','Configure','-Auto'),
|
|
@('wec-collector','-WefAction','Configure','-Auto'),
|
|
@('audit-settings','-Help')
|
|
)
|
|
foreach ($command in $commands) {
|
|
foreach ($unknown in @('-WhatIf','-DryRnu')) {
|
|
Invoke-Case ($command + @('-BackupPath',"$root/journal",'-ResultsPath',"$root/result.json",$unknown)) 1 'Unsupported trailing arguments'
|
|
Assert (-not (Test-Path "$root/journal") -and -not (Test-Path "$root/result.json")) 'Rejected arguments must not create journals/results'
|
|
}
|
|
}
|
|
# Unknown argument values are deliberately omitted from WELA's diagnostic.
|
|
Invoke-Case @('configure','-Auto','-UnrecognizedOption','opaque-value') 1 'Unsupported trailing arguments'
|
|
Invoke-Case @('configure','-Help','-WhatIf:$false') 1 'Unsupported trailing arguments'
|
|
Invoke-Case @('-WhatIf','configure','-Auto') 1 'Unsupported trailing arguments'
|
|
# Preserve documented named/positional binding, help, abbreviations and DryRun.
|
|
Invoke-Case @('configure','-Help','-Auto','-DryRun') 0 'Read live state'
|
|
Invoke-Case @('-Cmd','configure','-Help') 0 'Usage:'
|
|
Invoke-Case @('configure','std','-Help') 0 'Usage:'
|
|
Invoke-Case @('configure','-Hel') 0 'Usage:'
|
|
Invoke-Case @('profiles') 0 'wela-2.2.0'
|
|
Invoke-Case @('failed-logon-probe','-FailedLogonAction','Run','-WhatIf') 1 'only dedicated'
|
|
if ($isWindowsHost) {
|
|
Assert ((Read-NativeState) -ceq $before) 'Actual audit masks and native channel settings must remain unchanged'
|
|
$evidence = [ordered]@{ Status='Passed'; Engine=$PSVersionTable.PSVersion.ToString(); OS=[Environment]::OSVersion.Version.ToString(); StateUnchanged=$true; Before=($before|ConvertFrom-Json); After=((Read-NativeState)|ConvertFrom-Json) }
|
|
if ($env:RUNNER_TEMP) { $evidence | ConvertTo-Json -Depth 16 | Set-Content (Join-Path $env:RUNNER_TEMP 'wela-cli-arguments.json') -Encoding UTF8 }
|
|
}
|
|
Write-Host "PASS: $count public CLI argument assertions."
|
|
} finally { Remove-Item -LiteralPath $root -Recurse -Force }
|
|
$global:LASTEXITCODE = 0
|