- Introduce PortalService API and daemon, a network service that
orchestrates a cluster of remote processes instrumented by Frida.
Implements both a frida-server compatible control interface, as well
as a cluster interface that agents and gadgets in target processes can
talk to. Connected controllers can enumerate processes as if they were
local to the system where the portal is running, and are able to
attach() and also enable spawn-gating to apply early instrumentation.
- Add Session.join_portal(), making it easy to share control of a
process with a remote PortalService, joining its cluster together with
other nodes.
- Add “connect” interaction to frida-gadget, so it can join a
PortalService cluster as well.
- Add PortalClient, used to implement Session.join_portal() and
frida-gadget's “connect” interaction. Connects to the PortalService
and joins its cluster. Implements automatic reconnect in case of
transient failures. Also supports specifying an ACL, which is a list
of tags that the PortalService must require connected controllers to
possess at least one of. It's up to the application to implement
tagging of controllers based on e.g. authentication.
- Add Device.bus API to allow clients connected to a PortalService to
exchange application-specific messages with it. Requires instantiating
the service using the API in order to wire up message handlers and
protocol logic.
- Add Session persistence support, enabled by specifying a non-zero
“persist_timeout” option when attach()ing to a process. When the
server subsequently detects that the client owning the session got
disconnected, it will allow scripts to stay loaded until the timeout
(in seconds) is reached. Any script and debugger messages emitted in
the meantime are queued, and may later be delivered if the client
returns before the timeout is reached.
- Add TLS support, enabled by specifying a certificate. On the server
end this is a PEM with a public and private key, where the server
will accept any certificate from the client's side. However for the
client this is a PEM with the public key of a trusted CA, which the
server's certificate must match or be derived from.
- Add authentication support, enabled by specifying a token. The daemons
allow specifying a static token through a CLI option, and the APIs
allow plugging in a custom authentication backend -- which means the
token can be interpreted as desired.
- Add protocol-level keepalives.
- Add WebGatewayService API and daemon, allowing browsers to talk to a
control service such as frida-server.
- Implement WebRTC Data Channel compatible peer-to-peer support, enabled
by calling setup_peer_connection() on Session. This allows a direct
connection to be established between the client and the remote
process, which is useful when talking to it through e.g. a portal.
- Optimize protocol by skipping the DBus authentication handshake and
telling GDBus not to fetch properties, saving an additional roundtrip.
- Drop deprecated protocol bits, such as Session.enable_jit().
- Bump protocol version to v15.
Kudos to @dweinstein for suggesting and helping shape the portal
feature, and @asabil, @meme, and @mrmacete, for reviewing and helping
shape and name things.
