VNC Viewer Tests

Validate RealVNC and TigerVNC network and clipboard behaviors under the Secure Sandbox.

Objectives

• Enforce network controls for VNC connections (RFB protocol).
• Verify clipboard sharing isolation between viewer and host.

Preconditions

• Windows target with Turbo Launcher and Secure Sandbox.
• RealVNC Viewer or TigerVNC available.
• Network policy denying direct IP access.

Controls Under Test

• runtime.networking.egressDefaultAction.
• runtime.dataMotion.rules[] for clipboard.

Test Scenarios

ID	Canonical ID	Scenario	Procedure	Expected Outcome
SCEN-REMOTE-VNC-01	NET-EGRESS-01	Connect to Disallowed IP	Open VNC Viewer; connect to <IP>.	Connection fails (timeout or proxy deny).
SCEN-REMOTE-VNC-02	NET-EGRESS-10	Connect via Designated Proxy	Connect to allowlisted VNC server via configured proxy.	Connection succeeds only when proxy identity/pinning is valid; traffic traverses the proxy; on mismatch, TLS handshake fails. Audit includes proxyEnforced: true and reason when denied.
SCEN-REMOTE-VNC-03	DM-CLIP-01	Clipboard Outbound	Copy text inside VNC session (remote side); attempt paste on host.	Boundary check: Denied or processed per policy.
SCEN-REMOTE-VNC-04	DM-CLIP-06	Clipboard Inbound	Copy text on host; paste into VNC session.	Denied or processed per policy.

Evidence Requirements

• network events: protocol (tcp/5900+), destination, action.
• dataMotion events: channel: "clipboard".