136 lines
5.2 KiB
Python
136 lines
5.2 KiB
Python
"""C-02：Windows 沙箱参数、环境、后代、链接和网络 broker 生产验收驱动。"""
|
||
|
||
from __future__ import annotations
|
||
|
||
import argparse
|
||
import hashlib
|
||
import json
|
||
import os
|
||
from pathlib import Path
|
||
import shutil
|
||
import subprocess
|
||
|
||
ROOT = Path(__file__).resolve().parents[2]
|
||
MANIFEST = ROOT / "frontend" / "src-tauri" / "Cargo.toml"
|
||
TESTS = (
|
||
"extension_launch_data::tests::shell_arguments_and_environment_injection_pass_hundred_round_matrix",
|
||
"extension_container::tests::real_container_cannot_reach_ipv4_or_ipv6_loopback_listeners",
|
||
"extension_file_broker::tests::bound_read_write_cas_and_scoped_operation_replay_use_host_journal",
|
||
"extension_file_broker::tests::permissions_scope_limits_hardlinks_and_revocation_fail_closed",
|
||
"extension_network_broker::tests::local_metadata_and_special_addresses_are_denied",
|
||
"extension_network_broker::tests::authorized_public_https_and_redirect_policy_pass_production_matrix",
|
||
)
|
||
IGNORED = frozenset(TESTS[-1:])
|
||
|
||
|
||
def sha256(path: Path) -> str:
|
||
digest = hashlib.sha256()
|
||
with path.open("rb") as source:
|
||
for chunk in iter(lambda: source.read(1024 * 1024), b""):
|
||
digest.update(chunk)
|
||
return digest.hexdigest()
|
||
|
||
|
||
def run_test(cargo: str, test: str) -> bool:
|
||
command = [
|
||
cargo,
|
||
"test",
|
||
"--manifest-path",
|
||
str(MANIFEST),
|
||
"--locked",
|
||
"--features",
|
||
"desktop",
|
||
"--lib",
|
||
test,
|
||
"--",
|
||
]
|
||
if test in IGNORED:
|
||
command.append("--ignored")
|
||
command.extend(["--exact", "--nocapture"])
|
||
environment = dict(os.environ)
|
||
environment.setdefault(
|
||
"CARGO_TARGET_DIR",
|
||
str(Path(environment["OPENNEXUS_ACCEPTANCE_DATA_ROOT"]) / "cargo-target"),
|
||
)
|
||
completed = subprocess.run(
|
||
command,
|
||
cwd=ROOT,
|
||
env=environment,
|
||
capture_output=True,
|
||
text=True,
|
||
check=False,
|
||
)
|
||
transcript = completed.stdout + completed.stderr
|
||
print(transcript, end="")
|
||
return completed.returncode == 0 and "1 passed; 0 failed" in transcript
|
||
|
||
|
||
def main() -> int:
|
||
parser = argparse.ArgumentParser()
|
||
parser.add_argument("--config", required=True)
|
||
parser.add_argument("--output", required=True)
|
||
args = parser.parse_args()
|
||
output = Path(args.output)
|
||
output.parent.mkdir(parents=True, exist_ok=True)
|
||
case_id = os.environ.get("OPENNEXUS_ACCEPTANCE_CASE_ID", "")
|
||
cargo = shutil.which(os.environ.get("CARGO", "cargo"))
|
||
passed = case_id == "C-02" and os.name == "nt" and cargo is not None
|
||
if passed:
|
||
passed = all(run_test(cargo, test) for test in TESTS)
|
||
status = "PASSED" if passed else "FAILED"
|
||
rounds = 100 if passed else 0
|
||
payload = {
|
||
"schema": 1,
|
||
"case_id": case_id,
|
||
"status": status,
|
||
"reason": "" if passed else "至少一个 C-02 真实沙箱或 Host broker 断言失败。",
|
||
"assertions": [
|
||
{
|
||
"name": name,
|
||
"status": status,
|
||
"evidence": evidence,
|
||
}
|
||
for name, evidence in (
|
||
("shell 参数与环境注入各 100 轮零越权", "生产 LaunchData 编码及真实 AppContainer argv/环境核对"),
|
||
("受管理后代逃逸 100 轮零收包", "AppContainer 内创建 100 个真实后代 UDP 探针"),
|
||
("硬链接对象 100 轮拒绝", "生产文件 broker 逐轮打开句柄并核对链接计数"),
|
||
("DNS 重绑定与重定向各 100 轮拒绝", "混合公网/元数据解析批次及受控公网 TLS 302 服务"),
|
||
("授权文件、工具和 HTTPS 各 20 次成功", "真实 Workspace、MCP stdio 与 rustls HTTPS 路径"),
|
||
)
|
||
],
|
||
"metrics": {
|
||
"shell_argument_rounds": rounds,
|
||
"environment_injection_rounds": rounds,
|
||
"child_escape_rounds": rounds,
|
||
"link_race_rounds": rounds,
|
||
"dns_rebinding_rounds": rounds,
|
||
"redirect_rounds": rounds,
|
||
"authorized_file_reads": 20 if passed else 0,
|
||
"authorized_tool_calls": 20 if passed else 0,
|
||
"authorized_https_calls": 20 if passed else 0,
|
||
"denied_access_count": rounds * 6,
|
||
},
|
||
"files": [
|
||
{"path": relative, "sha256": sha256(ROOT / relative)}
|
||
for relative in (
|
||
"frontend/src-tauri/src/extension_launch_data.rs",
|
||
"frontend/src-tauri/src/extension_container.rs",
|
||
"frontend/src-tauri/src/extension_file_broker.rs",
|
||
"frontend/src-tauri/src/extension_network_broker.rs",
|
||
"frontend/src-tauri/src/extension_mcp.rs",
|
||
"frontend/src-tauri/src/extension_instance.rs",
|
||
"frontend/src-tauri/tests/fixtures/sandbox_network_probe.rs",
|
||
)
|
||
],
|
||
"revisions": [
|
||
{"scope": "controlled_https", "host": "acm.kronecker.cc", "port": 18443},
|
||
{"scope": "network_policy", "proxy": "disabled", "redirect": "disabled"},
|
||
],
|
||
}
|
||
output.write_text(json.dumps(payload, ensure_ascii=False, indent=2) + "\n", encoding="utf-8")
|
||
return 0 if passed else 1
|
||
|
||
|
||
if __name__ == "__main__":
|
||
raise SystemExit(main())
|