public void Should_Not_Be_Possible_To_Execute_A_Registry_Collect_If_The_Host_is_Unavailable()
{
IConnectionManager connectionManagerWithInvalidCredentials = GetConnectionMangerWithUnavailableBehavior();
RegistryProber probe = new RegistryProber();
probe.ConnectionManager = connectionManagerWithInvalidCredentials;
IList <registry_object> registryObjects = new List <registry_object>();
oval_definitions fakeDefinitions = ProbeHelper.GetFakeOvalDefinitions("fdcc_xpfirewall_oval.xml");
ProbeResult probeResult = probe.Execute(
ProbeHelper.CreateFakeContext(), ProbeHelper.CreateFakeTarget(), new CollectInfo()
{
ObjectTypes = fakeDefinitions.objects
});
}
public void Should_be_possible_to_execute_a_registry_collect_with_Set_element()
{
var fakeDefinitions = ProbeHelper.GetFakeOvalDefinitions("definitionsWithSet.xml");
var fakeObjects = fakeDefinitions.objects.OfType <registry_object>().ToArray();
oval_system_characteristics fakeSystemCharacteristics = new LoadOvalDocument().GetFakeOvalSystemCharacteristics("system_characteristics_with_sets.xml");
CollectInfo fakeCollectedInfo = ProbeHelper.CreateFakeCollectInfo(fakeObjects, null, fakeSystemCharacteristics);
registry_item fakeRegistryItem = this.GetFakeRegistryItem(@"Software\Microsoft\Windows NT\CurrentVersion", "CurrentVersion", eValueTypes.STRING, "6.0");
RegistryProber registryProber = this.GetMockedRegistryProber(fakeRegistryItem);
IEnumerable <CollectedObject> result = registryProber.Execute(fakeContext, fakeTarget, fakeCollectedInfo).CollectedObjects;
Assert.IsNotNull(result, "the result is not expected");
CollectedObject collectedObject = result.Where <CollectedObject>(obj => obj.ObjectType.id == "oval:org.mitre.oval:obj:6000").SingleOrDefault();
Assert.IsNotNull(collectedObject, "the element was not found");
Assert.AreEqual(collectedObject.ObjectType.reference.Count(), 3, "the quantity of object referenced is not expected");
}
public void Should_Be_Possible_To_Execute_A_Default_Registry_Collect()
{
// Arrange
oval_definitions fakeDefinitions = ProbeHelper.GetFakeOvalDefinitions("fdcc_xpfirewall_oval.xml");
CollectInfo fakeCollectInfo = ProbeHelper.CreateFakeCollectInfo(fakeDefinitions.objects.OfType <registry_object>().ToArray(), null, null);
registry_item fakeItem = this.GetFakeRegistryItem("Software\\Modulo", "NG", eValueTypes.STRING, "Secret");
List <registry_item> expectedRegistryItems = new List <registry_item>(new registry_item[] { fakeItem });
RegistryProber registryProber = this.GetMockedRegistryProber(fakeItem);
// Act
IEnumerable <CollectedObject> result = registryProber.Execute(this.fakeContext, this.fakeTarget, fakeCollectInfo).CollectedObjects;
// Assert
Assert.AreEqual(46, result.Count());
this.AssertProbeResultItem(result.ElementAt(0), fakeDefinitions.objects[1].id, null, expectedRegistryItems);
this.AssertProbeResultItem(result.ElementAt(10), fakeDefinitions.objects[11].id, null, expectedRegistryItems);
this.AssertProbeResultItem(result.ElementAt(45), fakeDefinitions.objects[46].id, null, expectedRegistryItems);
}
public void Should_be_possible_to_execute_a_registry_collect_with_variables()
{
// Arrange
string[] fakeVarValues = new string[] { @"Software\Microsoft\Windows NT\CurrentVersion" };
oval_definitions fakeDefinitions = ProbeHelper.GetFakeOvalDefinitions("definitionsWithConstantVariable.xml");
var fakeObjects = fakeDefinitions.objects.OfType <registry_object>().ToArray();
VariablesEvaluated variables = VariableHelper.CreateVariableWithMultiplesValue(OBJ_3000_ID, VAR_3000_ID, fakeVarValues);
CollectInfo fakeCollectInfo = ProbeHelper.CreateFakeCollectInfo(fakeObjects, variables, null);
registry_item fakeRegistryItem = this.GetFakeRegistryItem(@"Software\Microsoft\Windows NT\CurrentVersion", "CurrentVersion", eValueTypes.STRING, "6.0");
RegistryProber registryProber = this.GetMockedRegistryProber(fakeRegistryItem);
// Act
IEnumerable <CollectedObject> result = registryProber.Execute(fakeContext, fakeTarget, fakeCollectInfo).CollectedObjects;
// Assert
Assert.AreEqual(1, result.Count(), "the quantity is not expected");
this.AssertProbeResultItem(result.ElementAt(0), fakeDefinitions.objects[1].id, fakeVarValues, new List <registry_item>()
{
fakeRegistryItem
});
}
