Tests/Unit/MSFT_xFirewall.Tests.ps1

$script:DSCModuleName      = 'xNetworking'
$script:DSCResourceName    = 'MSFT_xFirewall'

#region HEADER
# Unit Test Template Version: 1.1.0
[String] $script:moduleRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
if ( (-not (Test-Path -Path (Join-Path -Path $script:moduleRoot -ChildPath 'DSCResource.Tests'))) -or `
     (-not (Test-Path -Path (Join-Path -Path $script:moduleRoot -ChildPath 'DSCResource.Tests\TestHelper.psm1'))) )
{
    & git @('clone','https://github.com/PowerShell/DscResource.Tests.git',(Join-Path -Path $script:moduleRoot -ChildPath '\DSCResource.Tests\'))
}

Import-Module (Join-Path -Path $script:moduleRoot -ChildPath 'DSCResource.Tests\TestHelper.psm1') -Force
$TestEnvironment = Initialize-TestEnvironment `
    -DSCModuleName $script:DSCModuleName `
    -DSCResourceName $script:DSCResourceName `
    -TestType Unit
#endregion HEADER

# Begin Testing
try
{
    #region Pester Tests
    InModuleScope $script:DSCResourceName {

        #region Pester Test Initialization
        # Get the rule that will be used for testing
        $FirewallRuleName = (Get-NetFirewallRule | `
            Sort-Object Name | `
            Where-Object {$_.DisplayGroup -ne $null} | `
            Select-Object -first 1).Name
        $FirewallRule = Get-FirewallRule -Name $FirewallRuleName
        $Properties = Get-FirewallRuleProperty -FirewallRule $FirewallRule
        # Pull two rules to use testing that error is thrown when this occurs
        $FirewallRules = (Get-NetFirewallRule | `
            Sort-Object Name | `
            Where-Object {$_.DisplayGroup -ne $null} | `
            Select-Object -first 2)
        #endregion

        #region Function Get-TargetResource
        Describe "MSFT_xFirewall\Get-TargetResource" {
            Context 'Absent should return correctly' {
                Mock Get-NetFirewallRule

                It "Should return absent on firewall rule $($FirewallRule.Name)" {
                    $result = Get-TargetResource -Name 'FirewallRule'
                    $result.Name | Should Be 'FirewallRule'
                    $result.Ensure | Should Be 'Absent'
                }
            }

            Context 'Present should return correctly' {
                $result = Get-TargetResource -Name $FirewallRule.Name

                # Looping these tests
                foreach ($parameter in $ParameterList)
                {
                    $ParameterSource = (Invoke-Expression -Command "`$($($parameter.source))")
                    $ParameterNew = (Invoke-Expression -Command "`$result.$($parameter.name)")
                    It "should have the correct $($parameter.Name) on firewall rule $($FirewallRule.Name)" {
                        $ParameterSource | Should Be $ParameterNew
                    }
                }
            }
        }
        #endregion


        #region Function Test-TargetResource
        Describe "MSFT_xFirewall\Test-TargetResource" {
            Context 'Ensure is Absent and the Firewall is not Present' {
                Mock Get-FirewallRule

                It "should return $true on firewall rule $($FirewallRule.Name)" {
                    $result = Test-TargetResource -Name 'FirewallRule' -Ensure 'Absent'
                    $result | Should Be $true
                }
            }
            Context 'Ensure is Absent and the Firewall is Present' {
                Mock Test-RuleProperties

                It "should return $false on firewall rule $($FirewallRule.Name)" {
                    $result = Test-TargetResource -Name $FirewallRule.Name -Ensure 'Absent'
                    $result | Should Be $false
                }
            }
            Context 'Ensure is Present and the Firewall is Present and properties match' {
                Mock Test-RuleProperties -MockWith { return $true }

                It "should return $true on firewall rule $($FirewallRule.Name)" {
                    $result = Test-TargetResource -Name $FirewallRule.Name
                    $result | Should Be $true
                }
            }
            Context 'Ensure is Present and the Firewall is Present and properties are different' {
                Mock Test-RuleProperties -MockWith { return $false }

                It "should return $false on firewall rule $($FirewallRule.Name)" {
                    $result = Test-TargetResource -Name $FirewallRule.Name
                    $result | Should Be $false
                }
            }
            Context 'Ensure is Present and the Firewall is Absent' {
                Mock Get-FirewallRule
                It "should return $false on firewall rule $($FirewallRule.Name)" {
                    $result = Test-TargetResource -Name $FirewallRule.Name
                    $result | Should Be $false
                }
            }
        }
        #endregion


        #region Function Set-TargetResource
        Describe "MSFT_xFirewall\Set-TargetResource" {
            # To speed up all these tests create Mocks so that these functions are not repeatedly called
            Mock Get-FirewallRule -MockWith { $FirewallRule }
            Mock Get-FirewallRuleProperty -MockWith { $Properties }

            Context 'Ensure is Absent and Firewall Exist' {
                It "should call expected mocks on firewall rule $($FirewallRule.Name)" {
                    Mock Remove-NetFirewallRule
                    $result = Set-TargetResource -Name $FirewallRule.Name -Ensure 'Absent'

                    Assert-MockCalled Remove-NetFirewallRule -Exactly 1
                }
            }
            Context 'Ensure is Absent and the Firewall Does Not Exist' {
                It "should call expected mocks on firewall rule $($FirewallRule.Name)" {
                    Mock Get-FirewallRule
                    Mock Remove-NetFirewallRule
                    $result = Set-TargetResource -Name $FirewallRule.Name -Ensure 'Absent'

                    Assert-MockCalled Remove-NetFirewallRule -Exactly 0
                }
            }
            Context 'Ensure is Present and the Firewall Does Not Exist' {
                It "should call expected mocks on firewall rule $($FirewallRule.Name)" {
                    Mock Get-FirewallRule
                    Mock New-NetFirewallRule
                    $result = Set-TargetResource -Name $FirewallRule.Name -Ensure 'Present'

                    Assert-MockCalled New-NetFirewallRule -Exactly 1
                    Assert-MockCalled Get-FirewallRule -Exactly 1
                }
            }
            Context 'Ensure is Present and the Firewall Does Exist but has a different DisplayName' {
                It "should call expected mocks on firewall rule $($FirewallRule.Name)" {
                    Mock Set-NetFirewallRule
                    Mock Test-RuleProperties {return $false}
                    $result = Set-TargetResource `
                        -Name $FirewallRule.Name `
                        -DisplayName 'Different' `
                        -Ensure 'Present'

                    Assert-MockCalled Set-NetFirewallRule -Exactly 1
                    Assert-MockCalled Test-RuleProperties -Exactly 1
                }
            }
            Context 'Ensure is Present and the Firewall Does Exist but has a different Group' {
                It "should call expected mocks on firewall rule $($FirewallRule.Name)" {
                    Mock New-NetFirewallRule
                    Mock Remove-NetFirewallRule
                    Mock Test-RuleProperties {return $false}
                    $result = Set-TargetResource `
                        -Name $FirewallRule.Name `
                        -DisplayName $FirewallRule.DisplayName `
                        -Group 'Different' `
                        -Ensure 'Present'

                    Assert-MockCalled New-NetFirewallRule -Exactly 1
                    Assert-MockCalled Remove-NetFirewallRule -Exactly 1
                    Assert-MockCalled Test-RuleProperties -Exactly 1
                }
            }
            Context 'Ensure is Present and the Firewall Does Exist but has a different Enabled' {
                It "should call expected mocks on firewall rule $($FirewallRule.Name)" {
                    Mock Set-NetFirewallRule
                    Mock Test-RuleProperties {return $false}
                    if( $FirewallRule.Enabled -eq 'True' ) {
                        $NewEnabled = 'False'
                    }
                    else
                    {
                        $NewEnabled = 'True'
                    }
                    $result = Set-TargetResource `
                        -Name $FirewallRule.Name `
                        -Enabled $NewEnabled `
                        -Ensure 'Present'

                    Assert-MockCalled Set-NetFirewallRule -Exactly 1
                    Assert-MockCalled Test-RuleProperties -Exactly 1
                }
            }
            Context 'Ensure is Present and the Firewall Does Exist but has a different Action' {
                It "should call expected mocks on firewall rule $($FirewallRule.Name)" {
                    Mock Set-NetFirewallRule
                    Mock Test-RuleProperties {return $false}
                    if ( $FirewallRule.Action -eq 'Allow') {
                        $NewAction = 'Block'
                    }
                    else
                    {
                        $NewAction = 'Allow'
                    }
                    $result = Set-TargetResource `
                        -Name $FirewallRule.Name `
                        -Action $NewAction `
                        -Ensure 'Present'

                    Assert-MockCalled Set-NetFirewallRule -Exactly 1
                    Assert-MockCalled Test-RuleProperties -Exactly 1
                }
            }
            Context 'Ensure is Present and the Firewall Does Exist but has a different Profile' {
                It "should call expected mocks on firewall rule $($FirewallRule.Name)" {
                    Mock Set-NetFirewallRule
                    Mock Test-RuleProperties {return $false}
                    if ( $FirewallRule.Profile -ccontains 'Domain') {
                        $NewProfile = @('Public','Private')
                    }
                    else
                    {
                        $NewProfile = @('Domain','Public')
                    }
                    $result = Set-TargetResource `
                        -Name $FirewallRule.Name `
                        -Profile $NewProfile `
                        -Ensure 'Present'

                    Assert-MockCalled Set-NetFirewallRule -Exactly 1
                    Assert-MockCalled Test-RuleProperties -Exactly 1
                }
            }
            Context 'Ensure is Present and the Firewall Does Exist but has a different Direction' {
                It "should call expected mocks on firewall rule $($FirewallRule.Name)" {
                    Mock Set-NetFirewallRule
                    Mock Test-RuleProperties {return $false}
                    if ( $FirewallRule.Direction -eq 'Inbound') {
                        $NewDirection = 'Outbound'
                    }
                        else
                    {
                        $NewDirection = 'Inbound'
                    }
                    $result = Set-TargetResource `
                        -Name $FirewallRule.Name `
                        -Direction $NewDirection `
                        -Ensure 'Present'

                    Assert-MockCalled Set-NetFirewallRule -Exactly 1
                    Assert-MockCalled Test-RuleProperties -Exactly 1
                }
            }
            Context 'Ensure is Present and the Firewall Does Exist but has a different RemotePort' {
                It "should call expected mocks on firewall rule $($FirewallRule.Name)" {
                    Mock Set-NetFirewallRule
                    Mock Test-RuleProperties {return $false}
                    $result = Set-TargetResource `
                        -Name $FirewallRule.Name `
                        -RemotePort 9999 `
                        -Ensure 'Present'

                    Assert-MockCalled Set-NetFirewallRule -Exactly 1
                    Assert-MockCalled Test-RuleProperties -Exactly 1
                }
            }
            Context 'Ensure is Present and the Firewall Does Exist but has a different LocalPort' {
                It "should call expected mocks on firewall rule $($FirewallRule.Name)" {
                    Mock Set-NetFirewallRule
                    Mock Test-RuleProperties {return $false}
                    $result = Set-TargetResource `
                        -Name $FirewallRule.Name `
                        -LocalPort 9999 `
                        -Ensure 'Present'

                    Assert-MockCalled Set-NetFirewallRule -Exactly 1
                    Assert-MockCalled Test-RuleProperties -Exactly 1
                }
            }
            Context 'Ensure is Present and the Firewall Does Exist but has a different Protocol' {
                It "should call expected mocks on firewall rule $($FirewallRule.Name)" {
                    Mock Set-NetFirewallRule
                    Mock Test-RuleProperties {return $false}
                    if ( $FirewallRule.Protocol -eq 'TCP') {
                        $NewProtocol = 'UDP'
                    }
                    else
                    {
                        $NewProtocol = 'TCP'
                    }
                    $result = Set-TargetResource `
                        -Name $FirewallRule.Name `
                        -Protocol $NewProtocol `
                        -Ensure 'Present'

                    Assert-MockCalled Set-NetFirewallRule -Exactly 1
                    Assert-MockCalled Test-RuleProperties -Exactly 1
                }
            }
            Context 'Ensure is Present and the Firewall Does Exist but has a different Description' {
                It "should call expected mocks on firewall rule $($FirewallRule.Name)" {
                    Mock Set-NetFirewallRule
                    Mock Test-RuleProperties {return $false}
                    $result = Set-TargetResource `
                        -Name $FirewallRule.Name `
                        -Description 'Different' `
                        -Ensure 'Present'

                    Assert-MockCalled Set-NetFirewallRule -Exactly 1
                    Assert-MockCalled Test-RuleProperties -Exactly 1
                }
            }
            Context 'Ensure is Present and the Firewall Does Exist but has a different Program' {
                It "should call expected mocks on firewall rule $($FirewallRule.Name)" {
                    Mock Set-NetFirewallRule
                    Mock Test-RuleProperties {return $false}
                    $result = Set-TargetResource `
                        -Name $FirewallRule.Name `
                        -Program 'Different' `
                        -Ensure 'Present'

                    Assert-MockCalled Set-NetFirewallRule -Exactly 1
                    Assert-MockCalled Test-RuleProperties -Exactly 1
                }
            }
            Context 'Ensure is Present and the Firewall Does Exist but has a different Service' {
                It "should call expected mocks on firewall rule $($FirewallRule.Name)" {
                    Mock Set-NetFirewallRule
                    Mock Test-RuleProperties {return $false}
                    $result = Set-TargetResource `
                        -Name $FirewallRule.Name `
                        -Service 'Different' `
                        -Ensure 'Present'

                    Assert-MockCalled Set-NetFirewallRule -Exactly 1
                    Assert-MockCalled Test-RuleProperties -Exactly 1
                }
            }
            Context 'Ensure is Present and the Firewall Does Exist but has a different Authentication' {
                It "should call expected mocks on firewall rule $($FirewallRule.Name)" {
                    Mock Set-NetFirewallRule
                    Mock Test-RuleProperties {return $false}
                    if ( $properties.SecurityFilters.Authentication -eq 'Required') {
                        $NewAuthentication = 'NotRequired'
                    }
                    else
                    {
                        $NewAuthentication = 'Required'
                    }
                    $result = Set-TargetResource `
                        -Name $FirewallRule.Name `
                        -Authentication $NewAuthentication `
                        -Ensure 'Present'

                    Assert-MockCalled Set-NetFirewallRule -Exactly 1
                    Assert-MockCalled Test-RuleProperties -Exactly 1
                }
            }
            Context 'Ensure is Present and the Firewall Does Exist but has a different Encryption' {
                It "should call expected mocks on firewall rule $($FirewallRule.Name)" {
                    Mock Set-NetFirewallRule
                    Mock Test-RuleProperties {return $false}
                    if ( $properties.SecurityFilters.Encryption -eq 'Required') {
                        $NewEncryption = 'NotRequired'
                    }
                    else
                    {
                        $NewEncryption = 'Required'
                    }
                    $result = Set-TargetResource `
                        -Name $FirewallRule.Name `
                        -Encryption $NewEncryption `
                        -Ensure 'Present'

                    Assert-MockCalled Set-NetFirewallRule -Exactly 1
                    Assert-MockCalled Test-RuleProperties -Exactly 1
                }
            }
            Context 'Ensure is Present and the Firewall Does Exist but has a different InterfaceAlias' {
                It "should call expected mocks on firewall rule $($FirewallRule.Name)" {
                    Mock Set-NetFirewallRule
                    Mock Test-RuleProperties {return $false}
                    $result = Set-TargetResource `
                        -Name $FirewallRule.Name `
                        -InterfaceAlias 'Different' `
                        -Ensure 'Present'

                    Assert-MockCalled Set-NetFirewallRule -Exactly 1
                    Assert-MockCalled Test-RuleProperties -Exactly 1
                }
            }
            Context 'Ensure is Present and the Firewall Does Exist but has a different InterfaceType' {
                It "should call expected mocks on firewall rule $($FirewallRule.Name)" {
                    Mock Set-NetFirewallRule
                    Mock Test-RuleProperties {return $false}
                    if ( $properties.InterfaceTypeFilters.InterfaceType -eq 'Wired') {
                        $NewInterfaceType = 'Wireless'
                    }
                    else
                    {
                        $NewInterfaceType = 'Wired'
                    }
                    $result = Set-TargetResource `
                        -Name $FirewallRule.Name `
                        -InterfaceType $NewInterfaceType `
                        -Ensure 'Present'

                    Assert-MockCalled Set-NetFirewallRule -Exactly 1
                    Assert-MockCalled Test-RuleProperties -Exactly 1
                }
            }
            Context 'Ensure is Present and the Firewall Does Exist but has a different LocalAddress' {
                It "should call expected mocks on firewall rule $($FirewallRule.Name)" {
                    Mock Set-NetFirewallRule
                    Mock Test-RuleProperties {return $false}
                    $result = Set-TargetResource `
                        -Name $FirewallRule.Name `
                        -LocalAddress @('10.0.0.1/255.0.0.0','10.1.1.0-10.1.2.0') `
                        -Ensure 'Present'

                    Assert-MockCalled Set-NetFirewallRule -Exactly 1
                    Assert-MockCalled Test-RuleProperties -Exactly 1
                }
            }
            Context 'Ensure is Present and the Firewall Does Exist but has a different LocalUser' {
                It "should call expected mocks on firewall rule $($FirewallRule.Name)" {
                    Mock Set-NetFirewallRule
                    Mock Test-RuleProperties {return $false}
                    $result = Set-TargetResource `
                        -Name $FirewallRule.Name `
                        -LocalUser 'Different' `
                        -Ensure 'Present'

                    Assert-MockCalled Set-NetFirewallRule -Exactly 1
                    Assert-MockCalled Test-RuleProperties -Exactly 1
                }
            }
            Context 'Ensure is Present and the Firewall Does Exist but has a different Package' {
                It "should call expected mocks on firewall rule $($FirewallRule.Name)" {
                    Mock Set-NetFirewallRule
                    Mock Test-RuleProperties {return $false}
                    $result = Set-TargetResource `
                        -Name $FirewallRule.Name `
                        -Package 'Different' `
                        -Ensure 'Present'

                    Assert-MockCalled Set-NetFirewallRule -Exactly 1
                    Assert-MockCalled Test-RuleProperties -Exactly 1
                }
            }
            Context 'Ensure is Present and the Firewall Does Exist but has a different Platform' {
                It "should call expected mocks on firewall rule $($FirewallRule.Name)" {
                    Mock Set-NetFirewallRule
                    Mock Test-RuleProperties {return $false}
                    $result = Set-TargetResource `
                        -Name $FirewallRule.Name `
                        -Platform @('6.1') `
                        -Ensure 'Present'

                    Assert-MockCalled Set-NetFirewallRule -Exactly 1
                    Assert-MockCalled Test-RuleProperties -Exactly 1
                }
            }
            Context 'Ensure is Present and the Firewall Does Exist but has a different RemoteAddress' {
                It "should call expected mocks on firewall rule $($FirewallRule.Name)" {
                    Mock Set-NetFirewallRule
                    Mock Test-RuleProperties {return $false}
                    $result = Set-TargetResource `
                        -Name $FirewallRule.Name `
                        -RemoteAddress @('10.0.0.1/255.0.0.0','10.1.1.0-10.1.2.0') `
                        -Ensure 'Present'

                    Assert-MockCalled Set-NetFirewallRule -Exactly 1
                    Assert-MockCalled Test-RuleProperties -Exactly 1
                }
            }
            Context 'Ensure is Present and the Firewall Does Exist but has a different RemoteMachine' {
                It "should call expected mocks on firewall rule $($FirewallRule.Name)" {
                    Mock Set-NetFirewallRule
                    Mock Test-RuleProperties {return $false}
                    $result = Set-TargetResource `
                        -Name $FirewallRule.Name `
                        -RemoteMachine 'Different' `
                        -Ensure 'Present'

                    Assert-MockCalled Set-NetFirewallRule -Exactly 1
                    Assert-MockCalled Test-RuleProperties -Exactly 1
                }
            }
            Context 'Ensure is Present and the Firewall Does Exist but has a different RemoteUser' {
                It "should call expected mocks on firewall rule $($FirewallRule.Name)" {
                    Mock Set-NetFirewallRule
                    Mock Test-RuleProperties {return $false}
                    $result = Set-TargetResource `
                        -Name $FirewallRule.Name `
                        -RemoteUser 'Different' `
                        -Ensure 'Present'

                    Assert-MockCalled Set-NetFirewallRule -Exactly 1
                    Assert-MockCalled Test-RuleProperties -Exactly 1
                }
            }
            Context 'Ensure is Present and the Firewall Does Exist but has a different DynamicTransport' {
                It "should call expected mocks on firewall rule $($FirewallRule.Name)" {
                    Mock Set-NetFirewallRule
                    Mock Test-RuleProperties {return $false}
                    $result = Set-TargetResource `
                        -Name $FirewallRule.Name `
                        -DynamicTransport 'WifiDirectDisplay' `
                        -Ensure 'Present'

                    Assert-MockCalled Set-NetFirewallRule -Exactly 1
                    Assert-MockCalled Test-RuleProperties -Exactly 1
                }
            }
            Context 'Ensure is Present and the Firewall Does Exist but has a different EdgeTraversalPolicy' {
                It "should call expected mocks on firewall rule $($FirewallRule.Name)" {
                    Mock Set-NetFirewallRule
                    Mock Test-RuleProperties {return $false}
                    $result = Set-TargetResource `
                        -Name $FirewallRule.Name `
                        -EdgeTraversalPolicy 'Allow' `
                        -Ensure 'Present'

                    Assert-MockCalled Set-NetFirewallRule -Exactly 1
                    Assert-MockCalled Test-RuleProperties -Exactly 1
                }
            }
            Context 'Ensure is Present and the Firewall Does Exist but has a different IcmpType' {
                It "should call expected mocks on firewall rule $($FirewallRule.Name)" {
                    Mock Set-NetFirewallRule
                    Mock Test-RuleProperties {return $false}
                    $result = Set-TargetResource `
                        -Name $FirewallRule.Name `
                        -IcmpType @('52','53') `
                        -Ensure 'Present'

                    Assert-MockCalled Set-NetFirewallRule -Exactly 1
                    Assert-MockCalled Test-RuleProperties -Exactly 1
                }
            }
            Context 'Ensure is Present and the Firewall Does Exist but has a different LocalOnlyMapping' {
                It "should call expected mocks on firewall rule $($FirewallRule.Name)" {
                    Mock Set-NetFirewallRule
                    Mock Test-RuleProperties {return $false}
                    $result = Set-TargetResource `
                        -Name $FirewallRule.Name `
                        -LocalOnlyMapping $true `
                        -Ensure 'Present'

                    Assert-MockCalled Set-NetFirewallRule -Exactly 1
                    Assert-MockCalled Test-RuleProperties -Exactly 1
                }
            }
            Context 'Ensure is Present and the Firewall Does Exist but has a different LooseSourceMapping' {
                It "should call expected mocks on firewall rule $($FirewallRule.Name)" {
                    Mock Set-NetFirewallRule
                    Mock Test-RuleProperties {return $false}
                    $result = Set-TargetResource `
                        -Name $FirewallRule.Name `
                        -LooseSourceMapping $true `
                        -Ensure 'Present'

                    Assert-MockCalled Set-NetFirewallRule -Exactly 1
                    Assert-MockCalled Test-RuleProperties -Exactly 1
                }
            }
            Context 'Ensure is Present and the Firewall Does Exist but has a different OverrideBlockRules' {
                It "should call expected mocks on firewall rule $($FirewallRule.Name)" {
                    Mock Set-NetFirewallRule
                    Mock Test-RuleProperties {return $false}
                    $result = Set-TargetResource `
                        -Name $FirewallRule.Name `
                        -OverrideBlockRules $true `
                        -Ensure 'Present'

                    Assert-MockCalled Set-NetFirewallRule -Exactly 1
                    Assert-MockCalled Test-RuleProperties -Exactly 1
                }
            }
            Context 'Ensure is Present and the Firewall Does Exist but has a different Owner' {
                It "should call expected mocks on firewall rule $($FirewallRule.Name)" {
                    Mock Set-NetFirewallRule
                    Mock Test-RuleProperties {return $false}
                    $result = Set-TargetResource `
                        -Name $FirewallRule.Name `
                        -Owner (Get-CimInstance win32_useraccount | Select-Object -First 1).Sid `
                        -Ensure 'Present'

                    Assert-MockCalled Set-NetFirewallRule -Exactly 1
                    Assert-MockCalled Test-RuleProperties -Exactly 1
                }
            }

            Context 'Ensure is Present and the Firewall Does Exist and is the same' {
                It "should call expected mocks on firewall rule $($FirewallRule.Name)" {
                    Mock Set-NetFirewallRule
                    Mock Test-RuleProperties {return $true}
                    $result = Set-TargetResource -Name $FirewallRule.Name -Ensure 'Present'

                    Assert-MockCalled Set-NetFirewallRule -Exactly 0
                    Assert-MockCalled Test-RuleProperties -Exactly 1
                }
            }
        }
        #endregion


        #region Function Test-RuleProperties
        Describe 'MSFT_xFirewall\Test-RuleProperties' {
            # Make an object that can be splatted onto the function
            $Splat = @{
                Name                = $FirewallRule.Name
                DisplayGroup        = $FirewallRule.DisplayGroup
                Group               = $FirewallRule.Group
                Enabled             = $FirewallRule.Enabled
                Profile             = $FirewallRule.Profile -split ', '
                Direction           = $FirewallRule.Direction
                Action              = $FirewallRule.Action
                RemotePort          = $Properties.PortFilters.RemotePort
                LocalPort           = $Properties.PortFilters.LocalPort
                Protocol            = $Properties.PortFilters.Protocol
                Description         = $FirewallRule.Description
                Program             = $Properties.ApplicationFilters.Program
                Service             = $Properties.ServiceFilters.Service
                Authentication      = $properties.SecurityFilters.Authentication
                Encryption          = $properties.SecurityFilters.Encryption
                InterfaceAlias      = $properties.InterfaceFilters.InterfaceAlias
                InterfaceType       = $properties.InterfaceTypeFilters.InterfaceType
                LocalAddress        = $properties.AddressFilters.LocalAddress
                LocalUser           = $properties.SecurityFilters.LocalUser
                Package             = $properties.ApplicationFilters.Package
                Platform            = $firewallRule.Platform
                RemoteAddress       = $properties.AddressFilters.RemoteAddress
                RemoteMachine       = $properties.SecurityFilters.RemoteMachine
                RemoteUser          = $properties.SecurityFilters.RemoteUser
                DynamicTransport    = $properties.PortFilters.DynamicTransport
                EdgeTraversalPolicy = $FirewallRule.EdgeTraversalPolicy
                IcmpType            = $properties.PortFilters.IcmpType
                LocalOnlyMapping    = $FirewallRule.LocalOnlyMapping
                LooseSourceMapping  = $FirewallRule.LooseSourceMapping
                OverrideBlockRules  = $properties.SecurityFilters.OverrideBlockRules
                Owner               = $FirewallRule.Owner
            }

            # To speed up all these tests create Mocks so that these functions are not repeatedly called
            Mock Get-FirewallRule -MockWith { $FirewallRule }
            Mock Get-FirewallRuleProperty -MockWith { $Properties }

            Context 'testing with a rule with no property differences' {
                $CompareRule = $Splat.Clone()
                It "should return True on firewall rule $($FirewallRule.Name)" {
                    $Result = Test-RuleProperties -FirewallRule $FirewallRule @CompareRule
                    $Result | Should be $True
                }
            }
            Context 'testing with a rule with a different name' {
                $CompareRule = $Splat.Clone()
                $CompareRule.Name = 'Different'
                It "should return False on firewall rule $($FirewallRule.Name)" {
                    $Result = Test-RuleProperties -FirewallRule $FirewallRule @CompareRule
                    $Result | Should be $False
                }
            }
            Context 'testing with a rule with a different displayname' {
                $CompareRule = $Splat.Clone()
                $CompareRule.DisplayName = 'Different'
                It "should return False on firewall rule $($FirewallRule.Name)" {
                    $Result = Test-RuleProperties -FirewallRule $FirewallRule @CompareRule
                    $Result | Should be $False
                }
            }
            Context 'testing with a rule with a different group' {
                $CompareRule = $Splat.Clone()
                $CompareRule.Group = 'Different'
                It "should return False on firewall rule $($FirewallRule.Name)" {
                    $Result = Test-RuleProperties -FirewallRule $FirewallRule @CompareRule
                    $Result | Should be $False
                }
            }
            Context 'testing with a rule with a different enabled' {
                $CompareRule = $Splat.Clone()
                if( $CompareRule.Enabled -eq 'True' ) {
                    $CompareRule.Enabled = 'False'
                }
                else
                {
                    $CompareRule.Enabled = 'True'
                }
                It "should return False on firewall rule $($FirewallRule.Name)" {
                    $Result = Test-RuleProperties -FirewallRule $FirewallRule @CompareRule
                    $Result | Should be $False
                }
            }
            Context 'testing with a rule with a different action' {
                $CompareRule = $Splat.Clone()
                if ($CompareRule.Action -eq 'Allow') {
                    $CompareRule.Action = 'Block'
                }
                else
                {
                    $CompareRule.Action = 'Allow'
                }
                It "should return False on firewall rule $($FirewallRule.Name)" {
                    $Result = Test-RuleProperties -FirewallRule $FirewallRule @CompareRule
                    $Result | Should be $False
                }
            }
            Context 'testing with a rule with a different profile' {
                $CompareRule = $Splat.Clone()
                if ( $CompareRule.Profile -ccontains 'Domain') {
                    $CompareRule.Profile = @('Public','Private')
                }
                else
                {
                    $CompareRule.Profile = @('Domain','Public')
                }
                It "should return False on firewall rule $($FirewallRule.Name)" {
                    $Result = Test-RuleProperties -FirewallRule $FirewallRule @CompareRule
                    $Result | Should be $False
                }
            }
            Context 'testing with a rule with a different direction' {
                $CompareRule = $Splat.Clone()
                if ($CompareRule.Direction -eq 'Inbound') {
                    $CompareRule.Direction = 'Outbound'
                }
                else
                {
                    $CompareRule.Direction = 'Inbound'
                }
                It "should return False on firewall rule $($FirewallRule.Name)" {
                    $Result = Test-RuleProperties -FirewallRule $FirewallRule @CompareRule
                    $Result | Should be $False
                }
            }
            Context 'testing with a rule with a different remote port' {
                $CompareRule = $Splat.Clone()
                $CompareRule.RemotePort = 1
                It "should return False on firewall rule $($FirewallRule.Name)" {
                    $Result = Test-RuleProperties -FirewallRule $FirewallRule @CompareRule
                    $Result | Should be $False
                }
            }
            Context 'testing with a rule with a different local port' {
                $CompareRule = $Splat.Clone()
                $CompareRule.LocalPort = 1
                It "should return False on firewall rule $($FirewallRule.Name)" {
                    $Result = Test-RuleProperties -FirewallRule $FirewallRule @CompareRule
                    $Result | Should be $False
                }
            }
            Context 'testing with a rule with a different protocol' {
                $CompareRule = $Splat.Clone()
                if ( $CompareRule.Protocol -eq 'TCP') {
                    $CompareRule.Protocol = 'UDP'
                }
                else
                {
                    $CompareRule.Protocol = 'TCP'
                }
                It "should return False on firewall rule $($FirewallRule.Name)" {
                    $Result = Test-RuleProperties -FirewallRule $FirewallRule @CompareRule
                    $Result | Should be $False
                }
            }
            Context 'testing with a rule with a different description' {
                $CompareRule = $Splat.Clone()
                $CompareRule.Description = 'Different'
                It "should return False on firewall rule $($FirewallRule.Name)" {
                    $Result = Test-RuleProperties -FirewallRule $FirewallRule @CompareRule
                    $Result | Should be $False
                }
            }
            Context 'testing with a rule with a different program' {
                $CompareRule = $Splat.Clone()
                $CompareRule.Program = 'Different'
                It "should return False on firewall rule $($FirewallRule.Name)" {
                    $Result = Test-RuleProperties -FirewallRule $FirewallRule @CompareRule
                    $Result | Should be $False
                }
            }
            Context 'testing with a rule with a different service' {
                $CompareRule = $Splat.Clone()
                $CompareRule.Service = 'Different'
                It "should return False on firewall rule $($FirewallRule.Name)" {
                    $Result = Test-RuleProperties -FirewallRule $FirewallRule @CompareRule
                    $Result | Should be $False
                }
            }
            Context 'testing with a rule with a different Authentication' {
                $CompareRule = $Splat.Clone()
                if ( $CompareRule.Authentication -eq 'Required') {
                    $CompareRule.Authentication = 'NotRequired'
                }
                else
                {
                    $CompareRule.Authentication = 'Required'
                }
                It "should return False on firewall rule $($FirewallRule.Name)" {
                    $Result = Test-RuleProperties -FirewallRule $FirewallRule @CompareRule
                    $Result | Should be $False
                }
            }
            Context 'testing with a rule with a different Encryption' {
                $CompareRule = $Splat.Clone()
                if ( $CompareRule.Encryption -eq 'Required') {
                    $CompareRule.Encryption = 'NotRequired'
                }
                else
                {
                    $CompareRule.Encryption = 'Required'
                }
                It "should return False on firewall rule $($FirewallRule.Name)" {
                    $Result = Test-RuleProperties -FirewallRule $FirewallRule @CompareRule
                    $Result | Should be $False
                }
            }
            Context 'testing with a rule with a different InterfaceAlias' {
                $CompareRule = $Splat.Clone()
                $CompareRule.InterfaceAlias = 'Different'
                It "should return False on firewall rule $($FirewallRule.Name)" {
                    $Result = Test-RuleProperties -FirewallRule $FirewallRule @CompareRule
                    $Result | Should be $False
                }
            }
            Context 'testing with a rule with a different InterfaceType' {
                $CompareRule = $Splat.Clone()
                if ( $CompareRule.InterfaceType -eq 'Wired') {
                    $CompareRule.InterfaceType = 'Wireless'
                }
                else
                {
                    $CompareRule.InterfaceType = 'Wired'
                }
                It "should return False on firewall rule $($FirewallRule.Name)" {
                    $Result = Test-RuleProperties -FirewallRule $FirewallRule @CompareRule
                    $Result | Should be $False
                }
            }
            Context 'testing with a rule with a different LocalAddress' {
                $CompareRule = $Splat.Clone()
                $CompareRule.LocalAddress = @('10.0.0.1/255.0.0.0','10.1.1.0-10.1.2.0')
                It "should return False on firewall rule $($FirewallRule.Name)" {
                    $Result = Test-RuleProperties -FirewallRule $FirewallRule @CompareRule
                    $Result | Should be $False
                }
            }
            Context 'testing with a rule with a different LocalUser' {
                $CompareRule = $Splat.Clone()
                $CompareRule.LocalUser = 'Different'
                It "should return False on firewall rule $($FirewallRule.Name)" {
                    $Result = Test-RuleProperties -FirewallRule $FirewallRule @CompareRule
                    $Result | Should be $False
                }
            }
            Context 'testing with a rule with a different Package' {
                $CompareRule = $Splat.Clone()
                $CompareRule.Package = 'Different'
                It "should return False on firewall rule $($FirewallRule.Name)" {
                    $Result = Test-RuleProperties -FirewallRule $FirewallRule @CompareRule
                    $Result | Should be $False
                }
            }
            Context 'testing with a rule with a different Platform' {
                $CompareRule = $Splat.Clone()
                $CompareRule.Platform = @('6.2')
                It "should return False on firewall rule $($FirewallRule.Name)" {
                    $Result = Test-RuleProperties -FirewallRule $FirewallRule @CompareRule
                    $Result | Should be $False
                }
            }
            Context 'testing with a rule with a different RemoteAddress' {
                $CompareRule = $Splat.Clone()
                $CompareRule.RemoteAddress = @('10.0.0.1/255.0.0.0','10.1.1.0-10.1.2.0')
                It "should return False on firewall rule $($FirewallRule.Name)" {
                    $Result = Test-RuleProperties -FirewallRule $FirewallRule @CompareRule
                    $Result | Should be $False
                }
            }
            Context 'testing with a rule with a different RemoteMachine' {
                $CompareRule = $Splat.Clone()
                $CompareRule.RemoteMachine = 'Different'
                It "should return False on firewall rule $($FirewallRule.Name)" {
                    $Result = Test-RuleProperties -FirewallRule $FirewallRule @CompareRule
                    $Result | Should be $False
                }
            }
            Context 'testing with a rule with a different RemoteUser' {
                $CompareRule = $Splat.Clone()
                $CompareRule.RemoteUser = 'Different'
                It "should return False on firewall rule $($FirewallRule.Name)" {
                    $Result = Test-RuleProperties -FirewallRule $FirewallRule @CompareRule
                    $Result | Should be $False
                }
            }
            Context 'testing with a rule with a different DynamicTransport' {
                $CompareRule = $Splat.Clone()
                $CompareRule.DynamicTransport = 'WifiDirectDevices'
                It "should return False on firewall rule $($FirewallRule.Name)" {
                    $Result = Test-RuleProperties -FirewallRule $FirewallRule @CompareRule
                    $Result | Should be $False
                }
            }
            Context 'testing with a rule with a different EdgeTraversalPolicy' {
                $CompareRule = $Splat.Clone()
                $CompareRule.EdgeTraversalPolicy = 'DeferToApp'
                It "should return False on firewall rule $($FirewallRule.Name)" {
                    $Result = Test-RuleProperties -FirewallRule $FirewallRule @CompareRule
                    $Result | Should be $False
                }
            }
            Context 'testing with a rule with a different IcmpType' {
                $CompareRule = $Splat.Clone()
                $CompareRule.IcmpType = @('53','54')
                It "should return False on firewall rule $($FirewallRule.Name)" {
                    $Result = Test-RuleProperties -FirewallRule $FirewallRule @CompareRule
                    $Result | Should be $False
                }
            }
            Context 'testing with a rule with a different LocalOnlyMapping' {
                $CompareRule = $Splat.Clone()
                $CompareRule.LocalOnlyMapping = ! $CompareRule.LocalOnlyMapping
                It "should return False on firewall rule $($FirewallRule.Name)" {
                    $Result = Test-RuleProperties -FirewallRule $FirewallRule @CompareRule
                    $Result | Should be $False
                }
            }
            Context 'testing with a rule with a different LooseSourceMapping' {
                $CompareRule = $Splat.Clone()
                $CompareRule.LooseSourceMapping = ! $CompareRule.LooseSourceMapping
                It "should return False on firewall rule $($FirewallRule.Name)" {
                    $Result = Test-RuleProperties -FirewallRule $FirewallRule @CompareRule
                    $Result | Should be $False
                }
            }
            Context 'testing with a rule with a different OverrideBlockRules' {
                $CompareRule = $Splat.Clone()
                $CompareRule.OverrideBlockRules = ! $CompareRule.OverrideBlockRules
                It "should return False on firewall rule $($FirewallRule.Name)" {
                    $Result = Test-RuleProperties -FirewallRule $FirewallRule @CompareRule
                    $Result | Should be $False
                }
            }
            Context 'testing with a rule with a different Owner' {
                $CompareRule = $Splat.Clone()
                $CompareRule.Owner = (Get-CimInstance win32_useraccount | Select-Object -First 1).Sid
                It "should return False on firewall rule $($FirewallRule.Name)" {
                    $Result = Test-RuleProperties -FirewallRule $FirewallRule @CompareRule
                    $Result | Should be $False
                }
            }
        }
        #endregion


        #region Function Get-FirewallRule
        Describe "MSFT_xFirewall\Get-FirewallRule" {
            Context 'testing with firewall that exists' {
                It "should return a firewall rule when name is passed on firewall rule $($FirewallRule.Name)" {
                    $Result = Get-FirewallRule -Name $FirewallRule.Name
                    $Result | Should Not BeNullOrEmpty
                }
            }
            Context 'testing with firewall that does not exist' {
                It "should not return anything on firewall rule $($FirewallRule.Name)" {
                    $Result = Get-FirewallRule -Name 'Does not exist'
                    $Result | Should BeNullOrEmpty
                }
            }
            Context 'testing with firewall that somehow occurs more than once' {
                Mock Get-NetFirewallRule -MockWith { $FirewallRules }

                $errorId = 'RuleNotUnique'
                $errorCategory = [System.Management.Automation.ErrorCategory]::InvalidOperation
                $errorMessage = $($LocalizedData.RuleNotUniqueError) -f 2,$FirewallRule.Name
                $exception = New-Object -TypeName System.InvalidOperationException `
                    -ArgumentList $errorMessage
                $errorRecord = New-Object -TypeName System.Management.Automation.ErrorRecord `
                    -ArgumentList $exception, $errorId, $errorCategory, $null

                It "should throw RuleNotUnique exception on firewall rule $($FirewallRule.Name)" {
                    { $Result = Get-FirewallRule -Name $FirewallRule.Name } | Should Throw $errorRecord
                }
            }
        }
        #endregion


        #region Function Get-FirewallRuleProperty
        Describe "MSFT_xFirewall\Get-FirewallRuleProperty" {
            Context 'All Properties' {
                $result = Get-FirewallRuleProperty -FirewallRule $FirewallRule
                It "Should return the right address filter on firewall rule $($FirewallRule.Name)" {
                    $expected = Get-NetFirewallAddressFilter -AssociatedNetFirewallRule $FirewallRule

                    $($result.AddressFilters | Out-String -Stream) |
                        Should Be $($expected | Out-String -Stream)
                }

                It "Should return the right application filter on firewall rule $($FirewallRule.Name)" {
                    $expected = Get-NetFirewallApplicationFilter -AssociatedNetFirewallRule $FirewallRule

                    $($result.ApplicationFilters | Out-String -Stream) |
                        Should Be $($expected | Out-String -Stream)
                }

                It "Should return the right interface filter on firewall rule $($FirewallRule.Name)" {
                    $expected = Get-NetFirewallInterfaceFilter -AssociatedNetFirewallRule $FirewallRule

                    $($result.InterfaceFilters | Out-String -Stream) |
                        Should Be $($expected | Out-String -Stream)
                }

                It "Should return the right interface type filter on firewall rule $($FirewallRule.Name)" {
                    $expected = Get-NetFirewallInterfaceTypeFilter -AssociatedNetFirewallRule $FirewallRule
                    $($result.InterfaceTypeFilters | Out-String -Stream) |
                        Should Be $($expected | Out-String -Stream)
                }

                It "Should return the right port filter on firewall rule $($FirewallRule.Name)" {
                    $expected = Get-NetFirewallPortFilter -AssociatedNetFirewallRule $FirewallRule
                    $($result.PortFilters | Out-String -Stream) |
                        Should Be $($expected | Out-String -Stream)
                }

                It "Should return the right Profile on firewall rule $($FirewallRule.Name)" {
                    $expected = Get-NetFirewallProfile -AssociatedNetFirewallRule $FirewallRule
                    $($result.Profile | Out-String -Stream) |
                        Should Be $($expected | Out-String -Stream)
                }

                It "Should return the right Profile on firewall rule $($FirewallRule.Name)" {
                    $expected = Get-NetFirewallProfile -AssociatedNetFirewallRule $FirewallRule
                    $($result.Profile | Out-String -Stream) |
                        Should Be $($expected | Out-String -Stream)
                }

                It "Should return the right Security Filters on firewall rule $($FirewallRule.Name)" {
                    $expected = Get-NetFirewallSecurityFilter -AssociatedNetFirewallRule $FirewallRule
                    $($result.SecurityFilters | Out-String -Stream) |
                        Should Be $($expected | Out-String -Stream)
                }

                It "Should return the right Service Filters on firewall rule $($FirewallRule.Name)" {
                    $expected = Get-NetFirewallServiceFilter -AssociatedNetFirewallRule $FirewallRule
                    $($result.ServiceFilters | Out-String -Stream) |
                        Should Be $($expected | Out-String -Stream)
                }
            }
        }
        #endregion

    } #end InModuleScope $DSCResourceName
    #endregion
}
finally
{
    #region FOOTER
    Restore-TestEnvironment -TestEnvironment $TestEnvironment
    #endregion
}