REQ 053

REQ-053: Restrict firewall and migrate only recognized legacy rules

Requirement

The NSIS bootstrap shall restrict its WinRM firewall exception to the explicitly verified provisioning path.

Rationale

A broad inbound rule defeats the intended isolation even when the host forward listens on loopback.

Fit Criterion

One owned rule permits TCP 5985 only on the selected guest adapter and verified NAT source. Exact recognized legacy engine rules may be narrowed or replaced on an authorized run; ambiguous or unmanaged broad rules are not silently changed, and an unprovable restriction fails closed.

Verification

Planned, TEST-053; the existing installer and verifier disagree on rule name and the installer uses all profiles.

Source

Software-Requirements-Specification

Priority

High

TestID

TEST-053

TestArtifact

Planned rule-scope, collision, and legacy-fingerprint tests

CodeRef

vm/windows-labview/winrm-setup-installer.nsi, WinRM verifier

Status

Planned