# frozen_string_literal: true

windows_smbv1 = input('windows_smbv1', value: true, description: 'Should we check that SMBv1 is disabled')
windows_smbv1feature = input('windows_smbv1feature', value: true, description: 'Should we check that SMBv1 feature is removed')

if windows_smbv1
  title 'Windows SMB configuration'

  control 'smb-101' do
    impact 1.0
    title 'Disable Old SMBv1'
    desc 'Ensure SMBv1 is disabled both as feature and through registry'
    ref url: 'https://www.us-cert.gov/ncas/current-activity/2017/01/16/SMB-Security-Best-Practices'
    ref url: 'https://support.microsoft.com/en-ca/help/2696547/how-to-enable-and-disable-smbv1,-smbv2,-and-smbv3-in-windows-vista,-windows-server-2008,-windows-7,-windows-server-2008-r2,-windows-8,-and-windows-server-2012'
    describe registry_key('HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters') do
      it { should exist }
      its('SMB1') { should eq 0 }
    end
    # no DSIM on default win10?
    # describe command('DSIM /online /get-feature /format-table | findstr /i SMB1Protocol | findstr Disabled') do
    #   its('stdout') { should_not eq '' }
    # end
    if windows_smbv1feature
      describe powershell('Get-WindowsOptionalFeature -Online | where FeatureName -eq SMB1Protocol') do
        # Disabled or DisablePending
        its('stdout') { should include 'Disable' }
      end
    end
  end
end
