Show the Windows service's blocks from the tray

The service answers the tray's requests on a named pipe, as the macOS extension answers the app's messages. The tray asks for blocks every two seconds, pops each new one up and lists the last ten in its menu.

core/Cargo.toml

@@ -38,14 +38,17 @@ path = "src/main.rs"
 [[bin]]
 name = "firewall-service"
 path = "src/bin/firewall-service.rs"
+required-features = ["machine-wide"]
 
 [[bin]]
 name = "firewall-tray"
 path = "src/bin/firewall-tray.rs"
+required-features = ["machine-wide"]
 
 [[bin]]
 name = "firewall-uninstall"
 path = "src/bin/firewall-uninstall.rs"
+required-features = ["machine-wide"]
 
 [[example]]
 name = "proxy-test"
@@ -87,6 +90,10 @@ path = "tests/tpm.rs"
 name = "managers"
 path = "tests/managers.rs"
 
+[features]
+# Builds the machine-wide binaries: the Windows service and tray, and the macOS uninstaller.
+machine-wide = []
+
 [dependencies]
 clap = "4.6.6"
 directories = "6.0.0"
@@ -118,7 +125,7 @@ schannel = "0.1.29"
 tokio = { version = "1.53.1", features = ["net"] }
 tracing-appender = "0.2.5"
 tray-icon = { version = "0.26.1", default-features = false }
-windows = { version = "0.62", features = ["Win32_Foundation", "Win32_Security", "Win32_Security_Authorization", "Win32_Security_Cryptography", "Win32_System_Com", "Win32_System_Environment", "Win32_System_Threading", "Win32_UI_Shell", "Win32_UI_WindowsAndMessaging"] }
+windows = { version = "0.62", features = ["Win32_Foundation", "Win32_Security", "Win32_Security_Authorization", "Win32_Security_Cryptography", "Win32_Storage_FileSystem", "Win32_System_Com", "Win32_System_Console", "Win32_System_Environment", "Win32_System_JobObjects", "Win32_System_Pipes", "Win32_System_Threading", "Win32_UI_Shell", "Win32_UI_WindowsAndMessaging"] }
 windows-registry = "0.6.1"
 windows-service = "0.8.0"
 

core/src/aliasing/mod.rs

@@ -1,5 +1,7 @@
 pub mod forward;
 pub mod managers;
+#[cfg(windows)]
+mod windows;
 
 pub use forward::spawn;
 pub use managers::*;
@@ -34,7 +36,8 @@ impl Invocation {
 
 pub fn run(port: u16, invocation: &Invocation, dir: Option<&Path>) -> std::io::Result<i32> {
     let proxy = crate::local_url(port, "");
-    let mut command = Command::new(resolve(&invocation.program)?);
+    let program = resolve(&invocation.program)?;
+    let mut command = Command::new(&program);
     command.args(invocation.arguments(&proxy));
     if let Some(dir) = dir {
         command.current_dir(dir);
@@ -42,7 +45,12 @@ pub fn run(port: u16, invocation: &Invocation, dir: Option<&Path>) -> std::io::R
     for (key, value) in managers::variables(&proxy) {
         command.env(key, value);
     }
-    Ok(command.status()?.code().unwrap_or(1))
+    #[cfg(windows)]
+    windows::prepare();
+    let status = command.status();
+    #[cfg(windows)]
+    let status = status.map_err(|error| windows::explain(error, &program));
+    Ok(status?.code().unwrap_or(1))
 }
 
 // Command::new only finds .exe on Windows; npm, pnpm and gem are .cmd shims found via PATHEXT.

core/src/aliasing/windows.rs

@@ -0,0 +1,64 @@
+use std::io::{Error, ErrorKind};
+use std::path::Path;
+use std::sync::Once;
+use tracing::debug;
+use windows::core::{BOOL, PCWSTR};
+use windows::Win32::System::Console::{SetConsoleCtrlHandler, CTRL_BREAK_EVENT, CTRL_C_EVENT};
+use windows::Win32::System::JobObjects::{
+    AssignProcessToJobObject, CreateJobObjectW, JobObjectExtendedLimitInformation,
+    SetInformationJobObject, JOBOBJECT_EXTENDED_LIMIT_INFORMATION,
+    JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE,
+};
+use windows::Win32::System::Threading::GetCurrentProcess;
+
+/// Called before spawning, so the manager behaves as it would run from the shell directly.
+/// Once per process: a caller may run several managers.
+pub fn prepare() {
+    static PREPARED: Once = Once::new();
+    PREPARED.call_once(|| {
+        // The console sends Ctrl+C to the manager too. Exiting first would hand the prompt back
+        // while a .cmd shim still asks "Terminate batch job (Y/N)?", so wait for its exit instead.
+        // A handler, unlike ignoring the signal outright, is not inherited by the manager.
+        let _ = unsafe { SetConsoleCtrlHandler(Some(ignore_interrupt), true) };
+        if let Err(error) = kill_children_on_exit() {
+            debug!(%error, "the manager may outlive the firewall");
+        }
+    });
+}
+
+unsafe extern "system" fn ignore_interrupt(event: u32) -> BOOL {
+    (event == CTRL_C_EVENT || event == CTRL_BREAK_EVENT).into()
+}
+
+/// Joins a job that kills what is left in it once the firewall exits, even if killed itself.
+/// The manager inherits the job when spawned, as do its own children.
+fn kill_children_on_exit() -> windows::core::Result<()> {
+    let mut limits = JOBOBJECT_EXTENDED_LIMIT_INFORMATION::default();
+    limits.BasicLimitInformation.LimitFlags = JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE;
+    // Never closed: the handle closing as the firewall exits is what kills the rest.
+    let job = unsafe { CreateJobObjectW(None, PCWSTR::null())? };
+    unsafe {
+        SetInformationJobObject(
+            job,
+            JobObjectExtendedLimitInformation,
+            (&raw const limits).cast(),
+            size_of_val(&limits) as u32,
+        )?
+    };
+    unsafe { AssignProcessToJobObject(job, GetCurrentProcess()) }
+}
+
+/// Rust refuses to pass a line break to a batch file, where it would cut the command short.
+pub fn explain(error: Error, program: &Path) -> Error {
+    let batch = program
+        .extension()
+        .is_some_and(|ext| ext.eq_ignore_ascii_case("cmd") || ext.eq_ignore_ascii_case("bat"));
+    if !batch || error.kind() != ErrorKind::InvalidInput {
+        return error;
+    }
+    let name = program.file_name().unwrap_or(program.as_os_str()).to_string_lossy();
+    Error::new(
+        ErrorKind::InvalidInput,
+        format!("{name} is a batch file, which cannot be passed an argument with a line break"),
+    )
+}

core/src/blocks.rs

@@ -0,0 +1,36 @@
+use crate::policies::Package;
+use serde::Serialize;
+use std::sync::Mutex;
+
+/// Bounded, so blocks pile up harmlessly while nothing collects them.
+const KEPT: usize = 50;
+
+static RECENT: Mutex<Vec<BlockedPackage>> = Mutex::new(Vec::new());
+
+#[derive(Serialize)]
+pub struct BlockedPackage {
+    pub eco: &'static str,
+    pub name: String,
+    pub version: Option<String>,
+    pub filter: &'static str,
+    pub reason: String,
+}
+
+pub fn record(eco: &'static str, pkg: &Package, filter: &'static str, reason: &str) {
+    let mut recent = RECENT.lock().unwrap_or_else(|e| e.into_inner());
+    if recent.len() == KEPT {
+        recent.remove(0);
+    }
+    recent.push(BlockedPackage {
+        eco,
+        name: pkg.name.clone(),
+        version: pkg.version.clone(),
+        filter,
+        reason: reason.to_owned(),
+    });
+}
+
+/// Hands each block over once.
+pub fn take() -> Vec<BlockedPackage> {
+    std::mem::take(&mut *RECENT.lock().unwrap_or_else(|e| e.into_inner()))
+}

core/src/config/mod.rs

@@ -2,11 +2,11 @@ use crate::policies::registries::{host_of, BUILT_IN};
 use directories::ProjectDirs;
 use rama::net::uri::Uri;
 use serde::Deserialize;
-use serde_json::{Map, Value};
+use serde_json::{json, Map, Value};
 use std::collections::HashMap;
 use std::io::{Error, ErrorKind};
 use std::num::{NonZeroU16, NonZeroU64};
-use std::path::PathBuf;
+use std::path::{Path, PathBuf};
 
 pub const DEFAULT_PORT: u16 = 8080;
 
@@ -19,7 +19,7 @@ pub struct FirewallConfig {
     /// 0 turns the age check off.
     pub min_age_hours: u64,
     pub denylist: DenylistSource,
-    /// Packages never screened, by ecosystem: `{"npm": [{"name": "left-pad"}]}`.
+    /// Packages exempt from the age check, by ecosystem: `{"npm": [{"name": "left-pad"}]}`.
     pub allow: HashMap<String, Vec<AllowedPackage>>,
     pub telemetry: bool,
     /// Mirrors laid out like a built-in registry, by its name: `{"npm": ["https://npm.example.com/"]}`.
@@ -49,7 +49,7 @@ impl Default for FirewallConfig {
         FirewallConfig {
             port: NonZeroU16::new(DEFAULT_PORT).unwrap(),
             fail_open: true,
-            min_age_hours: 0,
+            min_age_hours: 24,
             denylist: DenylistSource::default(),
             allow: HashMap::new(),
             telemetry: true,
@@ -120,6 +120,34 @@ fn merge(base: &mut Map<String, Value>, top: Map<String, Value>) {
     }
 }
 
+/// Adds an `allow` entry to the file, leaving the rest of it as written.
+pub fn allow(path: &Path, eco: &str, name: &str, version: Option<&str>) -> std::io::Result<()> {
+    let invalid = |e: String| Error::new(ErrorKind::InvalidData, format!("{}: {e}", path.display()));
+    let mut config = match std::fs::read_to_string(path) {
+        Ok(text) => serde_json::from_str(&text).map_err(|e| invalid(e.to_string()))?,
+        Err(e) if e.kind() == ErrorKind::NotFound => json!({}),
+        Err(e) => return Err(e),
+    };
+    if !config.is_object() {
+        return Err(invalid("not an object".into()));
+    }
+    let entry = json!({ "name": name, "version": version });
+    let entries = &mut config["allow"][eco];
+    if entries.is_null() {
+        *entries = Value::Array(Vec::new());
+    }
+    let Some(entries) = entries.as_array_mut() else {
+        return Err(invalid(format!("allow.{eco} is not a list")));
+    };
+    if !entries.contains(&entry) {
+        entries.push(entry);
+    }
+    if let Some(dir) = path.parent() {
+        std::fs::create_dir_all(dir)?;
+    }
+    std::fs::write(path, serde_json::to_string_pretty(&config)?)
+}
+
 /// What serde's types cannot say.
 fn check(config: &FirewallConfig) -> Result<(), String> {
     // `Duration::hours` panics past this.

core/src/lib.rs

@@ -1,4 +1,5 @@
 pub mod aliasing;
+pub mod blocks;
 pub mod config;
 pub mod firewall;
 pub mod http;

core/src/os/macos/mod.rs

@@ -4,8 +4,8 @@ mod uninstall;
 
 pub use uninstall::uninstall;
 
-use crate::config::FirewallConfig;
-use crate::{mitm, telemetry};
+use crate::config::{self, FirewallConfig};
+use crate::{blocks, mitm, telemetry};
 use crate::Firewall;
 use rama::bytes::Bytes;
 use rama::error::BoxError;
@@ -22,6 +22,7 @@ use rama::net::apple::networkextension::{transparent_proxy_ffi, NwTcpStream, Tcp
 use rama::rt::Executor;
 use rama::telemetry::tracing::apple::oslog::{OsLogLayer, Privacy};
 use rama::{Layer, Service};
+use serde::Deserialize;
 use std::convert::Infallible;
 use std::path::PathBuf;
 use std::sync::Arc;
@@ -58,7 +59,12 @@ impl TransparentProxyHandler for Handler {
         let message = String::from_utf8_lossy(&message).into_owned();
         Some(Bytes::from(match message.as_str() {
             "ca" => self.ca.pem.clone(),
-            other => format!("error: unknown message {other}"),
+            "blocks" => serde_json::to_string(&blocks::take()).expect("blocks serialize"),
+            other => match other.strip_prefix("allow ").map(allow) {
+                Some(Ok(())) => "ok".to_owned(),
+                Some(Err(error)) => format!("error: {error}"),
+                None => format!("error: unknown message {other}"),
+            },
         }))
     }
 
@@ -117,6 +123,20 @@ fn handler(exec: Executor) -> Result<Handler, BoxError> {
     Ok(Handler { ca, hosts, service })
 }
 
+#[derive(Deserialize)]
+struct AllowRequest {
+    eco: String,
+    name: String,
+    version: Option<String>,
+}
+
+/// Takes effect when the provider restarts, which rebuilds it from the config.
+fn allow(request: &str) -> Result<(), BoxError> {
+    let request: AllowRequest = serde_json::from_str(request)?;
+    config::allow(CONFIG_FILE.as_ref(), &request.eco, &request.name, request.version.as_deref())?;
+    Ok(())
+}
+
 /// stderr is invisible in a system extension, so events go to the unified log:
 /// `log stream --predicate 'subsystem == "com.usestrix.firewall"'`.
 fn init(_config: Option<&TransparentProxyInitConfig>) -> bool {

core/src/os/windows/ca.rs

@@ -11,6 +11,7 @@ use std::time::{SystemTime, UNIX_EPOCH};
 use tracing::warn;
 use windows::Win32::Security::Authorization::{GetNamedSecurityInfoW, SE_FILE_OBJECT};
 use windows::Win32::Security::*;
+use windows::Win32::Storage::FileSystem::CreateDirectoryW;
 use windows_registry::Type;
 
 /// SYSTEM and admins write, users only read, so no one else can plant a CA for node.
@@ -65,25 +66,39 @@ pub fn load_or_create_ca(
     Ok(ca)
 }
 
-/// Created on first use, its owner and ACL reset every time. One a user made first, or a link,
+/// Created on first use with its ACL, which is reset every time. One a user made first, or a link,
 /// is replaced: its owner could grant itself access again, and a link would redirect our writes.
 pub(super) fn secure_data_dir() -> io::Result<PathBuf> {
     let dir = data_dir();
-    match std::fs::symlink_metadata(&dir) {
-        Ok(meta) if meta.file_type().is_symlink() => std::fs::remove_dir(&dir)?,
+    let exists = match std::fs::symlink_metadata(&dir) {
+        Ok(meta) if meta.file_type().is_symlink() => {
+            std::fs::remove_dir(&dir)?;
+            false
+        }
         Ok(_) if !owned_by_admins(&dir)? => {
             warn!(dir = %dir.display(), "replacing a data folder not created by an admin");
-            std::fs::remove_dir_all(&dir)?
+            std::fs::remove_dir_all(&dir)?;
+            false
         }
-        _ => {}
-    }
-    std::fs::create_dir_all(&dir)?;
+        Ok(_) => true,
+        Err(_) => false,
+    };
     let info = OWNER_SECURITY_INFORMATION
         | DACL_SECURITY_INFORMATION
         | PROTECTED_DACL_SECURITY_INFORMATION;
     let path = HSTRING::from(dir.as_path());
     let acl = security_descriptor(DATA_DIR_ACL)?;
-    unsafe { SetFileSecurityW(&path, info, PSECURITY_DESCRIPTOR(acl.0)).ok()? };
+    if exists {
+        unsafe { SetFileSecurityW(&path, info, PSECURITY_DESCRIPTOR(acl.0)).ok()? };
+    } else {
+        let attributes = SECURITY_ATTRIBUTES {
+            nLength: size_of::<SECURITY_ATTRIBUTES>() as u32,
+            lpSecurityDescriptor: acl.0,
+            bInheritHandle: false.into(),
+        };
+        // Never inherits ProgramData's ACL, which lets users add files; fails if it was recreated.
+        unsafe { CreateDirectoryW(&path, Some(&attributes))? };
+    }
     Ok(dir)
 }
 

core/src/os/windows/mod.rs

@@ -2,6 +2,7 @@
 //! LocalSystem service screens it as the macOS extension does.
 
 mod ca;
+mod pipe;
 mod service;
 mod tpm;
 mod tray;

core/src/os/windows/pipe.rs

@@ -0,0 +1,58 @@
+//! How the tray asks the service what it blocked, as the macOS app messages its extension.
+
+use super::security_descriptor;
+use crate::blocks;
+use rama::error::BoxError;
+use std::time::Duration;
+use tokio::io::{AsyncBufReadExt, AsyncReadExt, AsyncWriteExt, BufReader};
+use tokio::net::windows::named_pipe::{NamedPipeServer, ServerOptions};
+use windows::Win32::Security::SECURITY_ATTRIBUTES;
+
+pub(super) const PIPE: &str = r"\\.\pipe\StrixFirewall";
+/// Signed-in users can connect, as the tray runs as them.
+const PIPE_ACL: &str = "D:P(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW;;;IU)";
+
+pub(super) async fn serve() -> Result<(), BoxError> {
+    let mut server = create(true)?;
+    loop {
+        server.connect().await?;
+        let client = std::mem::replace(&mut server, create(false)?);
+        tokio::spawn(async move {
+            if let Err(error) = answer(client).await {
+                tracing::debug!(%error, "could not answer the tray");
+            }
+        });
+    }
+}
+
+fn create(first: bool) -> Result<NamedPipeServer, BoxError> {
+    let acl = security_descriptor(PIPE_ACL)?;
+    let mut attributes = SECURITY_ATTRIBUTES {
+        nLength: size_of::<SECURITY_ATTRIBUTES>() as u32,
+        lpSecurityDescriptor: acl.0,
+        bInheritHandle: false.into(),
+    };
+    let attributes = (&raw mut attributes).cast();
+    let mut options = ServerOptions::new();
+    // Fails if anyone else made the pipe first.
+    options.first_pipe_instance(first);
+    Ok(unsafe { options.create_with_security_attributes_raw(PIPE, attributes)? })
+}
+
+/// A line each way.
+async fn answer(client: NamedPipeServer) -> Result<(), BoxError> {
+    let mut client = BufReader::new(client);
+    let mut request = String::new();
+    (&mut client)
+        .take(64 * 1024)
+        .read_line(&mut request)
+        .await?;
+    let reply = match request.trim_end() {
+        "blocks" => serde_json::to_string(&blocks::take())?,
+        other => format!("error: unknown request {other}"),
+    };
+    client.write_all(format!("{reply}\n").as_bytes()).await?;
+    // Closing before the tray hangs up could discard the reply.
+    let _ = tokio::time::timeout(Duration::from_secs(5), client.read(&mut [0])).await;
+    Ok(())
+}

core/src/os/windows/service.rs

@@ -1,6 +1,8 @@
 use super::ca::{load_or_create_ca, secure_data_dir};
 use super::tpm::CaKey;
-use super::{config_file, loopback_addresses, write_hosts_entries, CRL_ADDRESS, SERVICE_NAME};
+use super::{
+    config_file, loopback_addresses, pipe, write_hosts_entries, CRL_ADDRESS, SERVICE_NAME,
+};
 use crate::config::FirewallConfig;
 use crate::http::{reply, text};
 use crate::{mitm, telemetry, Firewall};
@@ -26,6 +28,7 @@ use std::net::{IpAddr, Ipv4Addr};
 use std::sync::Arc;
 use std::time::Duration;
 use tracing_appender::rolling::{RollingFileAppender, Rotation};
+use windows::Win32::Foundation::ERROR_GEN_FAILURE;
 use windows_service::service::*;
 use windows_service::service_control_handler::{
     self, ServiceControlHandlerResult, ServiceStatusHandle,
@@ -73,8 +76,12 @@ fn run_until_stopped() -> Result<(), BoxError> {
         | ServiceControl::Shutdown
         | ServiceControl::Pause
         | ServiceControl::Continue => {
-            let _ = control_sender.send(control);
-            ServiceControlHandlerResult::NoError
+            // Answered once handled, so a failed pause fails the caller's ControlService.
+            let (reply, handled) = tokio::sync::oneshot::channel();
+            let _ = control_sender.send((control, reply));
+            handled
+                .blocking_recv()
+                .unwrap_or(ServiceControlHandlerResult::NoError)
         }
         ServiceControl::Interrogate => ServiceControlHandlerResult::NoError,
         _ => ServiceControlHandlerResult::NotImplemented,
@@ -89,16 +96,26 @@ fn run_until_stopped() -> Result<(), BoxError> {
             }
         };
         // Only pausing removes our hosts entries; a stop or crash keeps them, failing closed.
-        while let Some(control) = control_receiver.recv().await {
+        while let Some((control, reply)) = control_receiver.recv().await {
             let (hosts, state) = match control {
                 ServiceControl::Pause => (&[][..], ServiceState::Paused),
                 ServiceControl::Continue => (&hosts[..], ServiceState::Running),
                 _ => break,
             };
-            match write_hosts_entries(hosts) {
-                Ok(()) => set_status(&status, state, false)?,
-                Err(error) => tracing::error!(%error, "could not rewrite the hosts file"),
-            }
+            let result = match write_hosts_entries(hosts) {
+                Ok(()) => {
+                    set_status(&status, state, false)?;
+                    ServiceControlHandlerResult::NoError
+                }
+                Err(error) => {
+                    tracing::error!(%error, "could not rewrite the hosts file");
+                    let code = error
+                        .raw_os_error()
+                        .map_or(ERROR_GEN_FAILURE.0, |code| code as u32);
+                    ServiceControlHandlerResult::Other(code)
+                }
+            };
+            let _ = reply.send(result);
         }
         Ok::<_, BoxError>(())
     });
@@ -138,6 +155,12 @@ async fn start_screening(status: &ServiceStatusHandle) -> Result<Vec<&'static st
     let crl = HttpServer::auto(exec.clone()).service(crl);
     tokio::spawn(listen_on(CRL_ADDRESS, 80, &exec)?.serve(crl));
 
+    tokio::spawn(async {
+        if let Err(error) = pipe::serve().await {
+            tracing::error!(%error, "the tray cannot reach the service");
+        }
+    });
+
     let service = mitm::mitm_service(firewall, &ca, signer, Some(crl_url), exec.clone());
     for (address, host) in loopback_addresses(&hosts) {
         for port in [80, 443] {
@@ -147,7 +170,7 @@ async fn start_screening(status: &ServiceStatusHandle) -> Result<Vec<&'static st
                 resolver: resolver.clone(),
                 service: service.clone(),
             };
-            let upstream = ConsumeErrLayer::trace_as_debug().into_layer(upstream);
+            let upstream = ConsumeErrLayer::trace_as_warning().into_layer(upstream);
             tokio::spawn(listen_on(address, port, &exec)?.serve(upstream));
         }
     }

core/src/os/windows/tray.rs

@@ -1,17 +1,21 @@
 //! The notification-area icon, started at sign-in as the menu bar app is on macOS.
 
+use super::pipe::PIPE;
 use super::*;
-use muda::{Menu, MenuEvent, MenuItem, PredefinedMenuItem};
-use std::io::Cursor;
+use muda::{Menu, MenuEvent, MenuItem, PredefinedMenuItem, Submenu};
+use serde::Deserialize;
+use std::io::{BufRead, BufReader, Cursor, Write};
+use std::os::windows::io::AsRawHandle;
 use std::time::Duration;
 use tray_icon::{Icon, MouseButtonState, TrayIcon, TrayIconBuilder, TrayIconEvent};
 use windows::core::{w, PCWSTR};
 use windows::Win32::Foundation::*;
+use windows::Win32::System::Pipes::GetNamedPipeServerProcessId;
 use windows::Win32::System::Threading::CreateMutexW;
 use windows::Win32::UI::Shell::*;
 use windows::Win32::UI::WindowsAndMessaging::*;
 use windows_registry::CURRENT_USER;
-use windows_service::service::{Service, ServiceAccess, ServiceState};
+use windows_service::service::{Service, ServiceAccess, ServiceState, ServiceStatus};
 use windows_service::service_manager::{ServiceManager, ServiceManagerAccess};
 
 const MENU_PAUSE: &str = "pause";
@@ -19,6 +23,9 @@ const MENU_RESTART: &str = "restart";
 const MENU_LOG: &str = "log";
 const MENU_QUIT: &str = "quit";
 const LOGO: &[u8] = include_bytes!("tray.png");
+/// Where blocked packages are listed, below Open logs.
+const BLOCKED_AT: usize = 5;
+const BLOCKED_KEPT: usize = 10;
 
 /// Runs until Quit, once per session.
 pub fn run() -> Result<(), BoxError> {
@@ -29,6 +36,7 @@ pub fn run() -> Result<(), BoxError> {
     }
     let status = MenuItem::new("", false, None);
     let pause = MenuItem::with_id(MENU_PAUSE, "", false, None);
+    let blocked_separator = PredefinedMenuItem::separator();
     let menu = Menu::with_items(&[
         &status,
         &PredefinedMenuItem::separator(),
@@ -39,7 +47,9 @@ pub fn run() -> Result<(), BoxError> {
         &MenuItem::with_id(MENU_QUIT, "Quit", true, None),
     ])?;
     let (logo, logo_size) = logo_mask()?;
-    let icon = TrayIconBuilder::new().with_menu(Box::new(menu)).build()?;
+    let icon = TrayIconBuilder::new()
+        .with_menu(Box::new(menu.clone()))
+        .build()?;
     let window = HWND(icon.window_handle());
     let mut tray = Tray {
         icon,
@@ -49,6 +59,9 @@ pub fn run() -> Result<(), BoxError> {
         status,
         pause,
         state: None,
+        menu,
+        blocked_separator,
+        blocked: Vec::new(),
     };
     tray.update();
     unsafe { SetTimer(None, 0, 2000, None) };
@@ -62,6 +75,7 @@ pub fn run() -> Result<(), BoxError> {
         // Ours, not the icon window's own hover timer.
         if message.message == WM_TIMER && message.hwnd.is_invalid() {
             tray.update();
+            tray.collect_blocks();
         }
         while let Ok(event) = TrayIconEvent::receiver().try_recv() {
             // The menu opens on release, so this keeps it current.
@@ -94,11 +108,39 @@ struct Tray {
     pause: MenuItem,
     /// As the menu last showed it.
     state: Option<ServiceState>,
+    menu: Menu,
+    blocked_separator: PredefinedMenuItem,
+    /// The most recent, as the menu lists them.
+    blocked: Vec<BlockedPackage>,
+}
+
+#[derive(Clone, PartialEq, Deserialize)]
+struct BlockedPackage {
+    eco: String,
+    name: String,
+    version: Option<String>,
+    filter: String,
+    reason: String,
+}
+
+impl BlockedPackage {
+    fn label(&self) -> String {
+        match &self.version {
+            Some(version) => format!("{} {version} ({})", self.name, self.eco),
+            None => format!("{} ({})", self.name, self.eco),
+        }
+    }
+
+    /// The denylist and OSV only flag packages known to be malicious; the age check only holds
+    /// back new ones.
+    fn malicious(&self) -> bool {
+        self.filter != "age"
+    }
 }
 
 impl Tray {
     fn update(&mut self) {
-        self.state = service_state();
+        self.state = service_status().map(|status| status.current_state);
         let screening = self.state == Some(ServiceState::Running);
         let light = light_taskbar();
         if self.drawn != Some((light, screening)) {
@@ -117,6 +159,58 @@ impl Tray {
         self.pause.set_enabled(self.state.is_some());
     }
 
+    /// The service hands each block over once, so whichever tray asks first shows it.
+    fn collect_blocks(&mut self) {
+        if self.state != Some(ServiceState::Running) {
+            return;
+        }
+        let Ok(reply) = ask_service("blocks") else {
+            return;
+        };
+        let Ok(packages) = serde_json::from_str::<Vec<BlockedPackage>>(&reply) else {
+            return;
+        };
+        let mut new = Vec::new();
+        for package in packages {
+            if !self.blocked.contains(&package) {
+                self.blocked.push(package.clone());
+                new.push(package);
+            }
+        }
+        if new.is_empty() {
+            return;
+        }
+        let excess = self.blocked.len().saturating_sub(BLOCKED_KEPT);
+        self.blocked.drain(..excess);
+        self.list_blocked();
+        // Off the UI thread, so the menu keeps working while they are open.
+        std::thread::spawn(move || new.iter().for_each(alert));
+    }
+
+    fn list_blocked(&self) {
+        while self.menu.items().len() > BLOCKED_AT + 2 {
+            self.menu.remove_at(BLOCKED_AT);
+        }
+        let _ = self.menu.insert(&self.blocked_separator, BLOCKED_AT);
+        for (i, package) in self.blocked.iter().enumerate() {
+            let verb = if package.malicious() {
+                "Blocked"
+            } else {
+                "Held back"
+            };
+            let reason = if package.malicious() {
+                format!("Malicious: {}", package.reason)
+            } else {
+                package.reason.clone()
+            };
+            let reason = MenuItem::new(reason, false, None);
+            let label = format!("{verb} {}", package.label());
+            if let Ok(item) = Submenu::with_items(label, true, &[&reason]) {
+                let _ = self.menu.insert(&item, BLOCKED_AT + 1 + i);
+            }
+        }
+    }
+
     fn on_menu(&self, id: &str) {
         let state = self.state;
         let screening = state == Some(ServiceState::Running);
@@ -143,19 +237,56 @@ impl Tray {
     }
 }
 
+fn alert(package: &BlockedPackage) {
+    let text = format!("{} {}.", package.label(), package.reason);
+    let (title, text, style) = if package.malicious() {
+        let title = format!("Blocked malware: {}", package.label());
+        let text = text
+            + "\n\nIt was not installed. Don't install it from another source. If you didn't expect this "
+            + "package, a dependency may be compromised; tell your security team.";
+        (title, text, MB_ICONERROR)
+    } else {
+        ("Held back a new package".to_owned(), text, MB_ICONINFORMATION)
+    };
+    let (title, text) = (HSTRING::from(title), HSTRING::from(text));
+    unsafe { MessageBoxW(None, &text, &title, style | MB_SETFOREGROUND) };
+}
+
+/// One request per connection, as the service answers.
+fn ask_service(request: &str) -> Result<String, BoxError> {
+    let mut pipe = std::fs::OpenOptions::new()
+        .read(true)
+        .write(true)
+        .open(PIPE)?;
+    // Any program can create the pipe if it gets there before the service.
+    let mut server = 0;
+    unsafe { GetNamedPipeServerProcessId(HANDLE(pipe.as_raw_handle()), &mut server)? };
+    if service_status().and_then(|status| status.process_id) != Some(server) {
+        return Err("Another program is posing as the firewall service.".into());
+    }
+    pipe.write_all(format!("{request}\n").as_bytes())?;
+    let mut reply = String::new();
+    BufReader::new(pipe).read_line(&mut reply)?;
+    Ok(reply.trim_end().to_owned())
+}
+
 fn show_error(error: BoxError) {
-    let text = HSTRING::from(error.to_string());
+    let text = match error.source() {
+        Some(source) => format!("{error}: {source}"),
+        None => error.to_string(),
+    };
+    let text = HSTRING::from(text);
     unsafe { MessageBoxW(None, &text, w!("Strix Firewall"), MB_ICONERROR) };
 }
 
 /// `None` when the service is not installed.
-fn service_state() -> Option<ServiceState> {
+fn service_status() -> Option<ServiceStatus> {
     let manager =
         ServiceManager::local_computer(None::<&str>, ServiceManagerAccess::CONNECT).ok()?;
     let service = manager
         .open_service(SERVICE_NAME, ServiceAccess::QUERY_STATUS)
         .ok()?;
-    Some(service.query_status().ok()?.current_state)
+    service.query_status().ok()
 }
 
 fn light_taskbar() -> bool {
@@ -163,7 +294,8 @@ fn light_taskbar() -> bool {
     let Ok(key) = CURRENT_USER.open(personalize) else {
         return false;
     };
-    key.get_u32("SystemUsesLightTheme").is_ok_and(|light| light == 1)
+    key.get_u32("SystemUsesLightTheme")
+        .is_ok_and(|light| light == 1)
 }
 
 fn status_text(state: Option<ServiceState>) -> &'static str {

core/src/policies/filters/mod.rs

@@ -25,16 +25,18 @@ pub trait Filter: Send + Sync {
 }
 
 /// Asks every filter. A `Deny` wins; failing that, the first filter that could not tell.
+/// An allowed package skips only the age check, so malware is never let through.
 pub async fn consult(
     firewall: &Firewall,
     registry: &'static Registry,
     pkg: &Package,
 ) -> Option<(&'static str, Verdict)> {
-    if allowed(firewall, registry, pkg) {
-        return None;
-    }
+    let allowed = allowed(firewall, registry, pkg);
     let mut unsure = None;
     for filter in firewall.filters() {
+        if allowed && filter.name() == "age" {
+            continue;
+        }
         match filter.check(registry, pkg).await {
             Verdict::Allow => continue,
             Verdict::Deny(reason) => return Some((filter.name(), Verdict::Deny(reason))),

core/src/policies/mod.rs

@@ -69,7 +69,8 @@ pub async fn screen(url: &str, firewall: &Firewall) -> Option<String> {
     };
     info!(eco = registry.eco, pkg = %pkg.label(), %url, "screening");
     match consult(firewall, registry, &pkg).await {
-        Some((_, Verdict::Deny(reason))) => {
+        Some((filter, Verdict::Deny(reason))) => {
+            crate::blocks::record(registry.eco, &pkg, filter, &reason);
             Some(format!("{} {reason}", pkg.label()))
         }
         Some((filter, Verdict::Unknown(e))) if !firewall.config.fail_open => {

core/tests/config.rs

@@ -76,14 +76,14 @@ async fn a_mirror_is_screened_like_the_registry_it_copies() {
 }
 
 #[tokio::test]
-async fn an_allowed_version_skips_the_filters() {
-    // An unreachable denylist would otherwise leave the package unchecked.
+async fn an_allowed_version_is_still_checked_for_malware() {
+    // The unreachable denylist shows that it still runs.
     let config = r#"{"allow": {"go": [{"name": "golang.org/x/net", "version": "v0.20.0"}]}, "denylist": {"base": "http://127.0.0.1:1"}}"#;
     let firewall = Firewall::new(serde_json::from_str(config).expect("parses"));
     let (registry, _) = firewall.match_on("/go/golang.org/x/net/@v/list", |r| r.prefix).expect("go");
-    let pkg = |version: &str| Package { name: "golang.org/x/net".into(), version: Some(version.into()) };
-    assert!(consult(&firewall, registry, &pkg("0.20.0")).await.is_none());
-    assert!(consult(&firewall, registry, &pkg("0.21.0")).await.is_some());
+    let pkg = Package { name: "golang.org/x/net".into(), version: Some("0.20.0".into()) };
+    let verdict = consult(&firewall, registry, &pkg).await;
+    assert_eq!(verdict.map(|(filter, _)| filter), Some("denylist"));
 }
 
 #[tokio::test]
@@ -94,3 +94,18 @@ async fn failing_closed_blocks_what_could_not_be_checked() {
     let blocked = screen(url, &firewall).await.unwrap_or_default();
     assert!(blocked.contains("could not be checked"), "{blocked:?}");
 }
+
+#[test]
+fn allowing_keeps_the_rest_of_the_file() {
+    let path = std::env::temp_dir().join(format!("firewall-allow-{}.json", std::process::id()));
+    std::fs::write(&path, r#"{"fail_open": false}"#).expect("write");
+    for _ in 0..2 {
+        firewall::config::allow(&path, "npm", "left-pad", Some("1.3.0")).expect("allow");
+    }
+    let text = std::fs::read_to_string(&path).expect("read");
+    std::fs::remove_file(&path).ok();
+    let config: FirewallConfig = serde_json::from_str(&text).expect("parses");
+    assert!(!config.fail_open);
+    assert_eq!(config.allow["npm"].len(), 1);
+    assert_eq!(config.allow["npm"][0].version.as_deref(), Some("1.3.0"));
+}

dist-workspace.toml

@@ -7,6 +7,7 @@ ci = "github"
 installers = ["shell", "powershell", "homebrew", "msi"]
 # core/wix/main.wxs is edited to install the service.
 allow-dirty = ["msi"]
+features = ["machine-wide"]
 tap = "usestrix/homebrew-tap"
 publish-jobs = ["homebrew", "./publish-crates"]
 targets = ["aarch64-apple-darwin", "x86_64-apple-darwin", "aarch64-unknown-linux-gnu", "x86_64-unknown-linux-gnu", "x86_64-pc-windows-msvc"]

docs/platforms.md

@@ -1,66 +0,0 @@
-# Platforms
-
-## Requirements
-
-| | Command prefix | Machine-wide |
-|---|---|---|
-| macOS | 13+, Apple silicon or Intel | Apple silicon, or an Intel Mac with a T2 chip |
-| Windows | 10 or 11, x86-64 | A TPM 2.0, and an admin to install |
-| Linux | glibc, x86-64 or arm64 | Not supported |
-
-There are no musl, 32-bit or Windows on Arm builds.
-
-`cargo install strix-firewall` installs only `firewall`. Add `--features machine-wide` for the
-machine-wide binaries, which otherwise come with the macOS app and the Windows MSI.
-
-## What is screened
-
-npm, pnpm, bun, pip, pip3, pipenv, pdm, uv, cargo, go and gem, downloading from:
-
-| Ecosystem | Hosts |
-|---|---|
-| npm | registry.npmjs.org |
-| PyPI | pypi.org, files.pythonhosted.org |
-| crates.io | index.crates.io, static.crates.io, crates.io |
-| RubyGems | rubygems.org |
-| Go | proxy.golang.org |
-
-Machine-wide screening also covers mirrors listed in the config file, under the registry they
-copy (`npm`, `pypi`, `pypi-files`, `cargo/index`, `cargo-dl`, `crates-api`, `gem` or `go`):
-`"registries": {"npm": ["https://npm.example.com/"]}`. A mirror must lay out its paths like that
-registry. `firewall <manager>` still sends managers to the public registries.
-
-## How machine-wide screening works
-
-Traffic to the hosts above is decrypted with a local CA that can only sign for those hosts. Its
-private key never leaves the Secure Enclave (macOS) or the TPM (Windows).
-
-- **macOS:** a system extension, which you approve in System Settings.
-- **Windows:** a service, with a hosts-file entry pointing each registry host at it.
-  - Without a TPM, the service can't start, so the install fails.
-  - Any signed-in user can pause screening from the notification-area icon, until they resume
-    it or the service restarts.
-  - Clients that use an HTTP proxy or their own DNS skip the hosts file and aren't screened.
-    Nor is WSL.
-  - Each client has to trust the CA:
-
-    | Client | Trusts it through |
-    |---|---|
-    | npm, pnpm, bun | `NODE_EXTRA_CA_CERTS`, set to `%ProgramData%\Strix Firewall\ca.pem` |
-    | uv | `UV_SYSTEM_CERTS`, which uses the Windows certificate store |
-    | pip, cargo | The Windows certificate store |
-    | gem, go | Untested |
-
-Tested on Windows 11 and Apple silicon only.
-
-## Changing settings
-
-Machine-wide screening reads an admin-only JSON file when it starts. After editing it, restart
-screening. An invalid file stops screening from starting.
-
-| OS | File | Restart from |
-|---|---|---|
-| macOS | `/Library/Application Support/Firewall/config.json` | The menu bar's Restart |
-| Windows | `%ProgramData%\Strix Firewall\config.json` | The notification-area icon's Restart |
-
-The `firewall` command reads `config.json` from the user's config folder instead.

macos/App/BlockAlerts.swift

@@ -0,0 +1,57 @@
+import AppKit
+import Security
+
+struct BlockedPackage: Codable, Hashable, Identifiable {
+    let eco: String
+    let name: String
+    let version: String?
+    let filter: String
+    let reason: String
+
+    var id: String { "\(eco)/\(name)@\(version ?? "")" }
+    var label: String { version.map { "\(name) \($0)" } ?? name }
+    /// The denylist and OSV only flag packages known to be malicious; the age check only holds back new ones.
+    var malicious: Bool { filter != "age" }
+    /// Malware is never allowed, and a new package only by version.
+    var trustable: Bool { !malicious && version != nil }
+}
+
+@MainActor
+enum BlockAlert {
+    /// Returns whether the user chose to trust the package.
+    static func show(_ package: BlockedPackage) -> Bool {
+        let alert = NSAlert()
+        alert.addButton(withTitle: "OK")
+        if package.malicious {
+            alert.alertStyle = .critical
+            alert.messageText = "Blocked malware: \(package.label) (\(package.eco))"
+            alert.informativeText = "\(package.label) \(package.reason).\n\n"
+                + "It was not installed. Don't install it from another source. "
+                + "If you didn't expect this package, a dependency may be compromised; tell your security team."
+        } else {
+            alert.messageText = "Held back a new package"
+            alert.informativeText = "\(package.label) (\(package.eco)) \(package.reason)."
+            if package.trustable { alert.addButton(withTitle: "Trust this version") }
+        }
+        NSApp.activate(ignoringOtherApps: true)
+        return alert.runModal() == .alertSecondButtonReturn
+    }
+}
+
+enum AdminAuthorization {
+    /// The allowlist applies to every user of the Mac, so changing it takes an admin, as `sudo` would.
+    static func confirm() -> Bool {
+        var authorization: AuthorizationRef?
+        guard AuthorizationCreate(nil, nil, [], &authorization) == errAuthorizationSuccess,
+              let authorization else { return false }
+        defer { AuthorizationFree(authorization, []) }
+        return "system.preferences".withCString { name in
+            var item = AuthorizationItem(name: name, valueLength: 0, value: nil, flags: 0)
+            return withUnsafeMutablePointer(to: &item) { item in
+                var rights = AuthorizationRights(count: 1, items: item)
+                let flags: AuthorizationFlags = [.interactionAllowed, .extendRights]
+                return AuthorizationCopyRights(authorization, &rights, nil, flags, nil) == errAuthorizationSuccess
+            }
+        }
+    }
+}

macos/App/FirewallModel.swift

@@ -29,11 +29,13 @@ enum FirewallError: Error, LocalizedError {
     case extensionUnavailable
     case screeningDidNotStart(NEVPNStatus)
     case extensionStopped(String)
+    case extensionRefused(String)
 
     var errorDescription: String? {
         switch self {
         case .extensionUnavailable: return "The extension is not running"
         case let .screeningDidNotStart(status): return "Screening did not start (\(status.label))"
+        case let .extensionRefused(reply): return "The extension replied \(reply)"
         case let .extensionStopped(reason):
             return "The extension stopped: \(reason). Its log: log show --last 5m --predicate 'subsystem BEGINSWITH \"\(FirewallIDs.appBundleID)\"'"
         }
@@ -51,6 +53,7 @@ final class FirewallModel: NSObject, ObservableObject {
     @Published private(set) var completed = false
     @Published private(set) var removed = false
     @Published private(set) var screening = false
+    @Published private(set) var blocked: [BlockedPackage] = []
 
     private let logger = Logger(subsystem: FirewallIDs.appBundleID, category: "installer")
     private var pendingRequest: (request: OSSystemExtensionRequest, continuation: CheckedContinuation<Void, Error>)?
@@ -72,6 +75,7 @@ final class FirewallModel: NSObject, ObservableObject {
             await refresh()
             if CommandLine.arguments.contains("--install") { await install() }
         }
+        Task { await watchBlocks() }
     }
 
     // MARK: - Flows
@@ -199,6 +203,43 @@ final class FirewallModel: NSObject, ObservableObject {
         if let url = URL(string: pane) { NSWorkspace.shared.open(url) }
     }
 
+    /// Allowing a version writes it into the extension's config, which a restart then loads.
+    func trust(_ package: BlockedPackage) async {
+        guard package.trustable else { return }
+        guard AdminAuthorization.confirm() else {
+            log("Trust cancelled for \(package.label)")
+            return
+        }
+        do {
+            var request = ["eco": package.eco, "name": package.name]
+            request["version"] = package.version
+            let json = String(decoding: try JSONSerialization.data(withJSONObject: request), as: UTF8.self)
+            let reply = try await providerMessage("allow \(json)")
+            guard reply == "ok" else { throw FirewallError.extensionRefused(reply) }
+            blocked.removeAll { $0 == package }
+            log("Trusted \(package.label) (\(package.eco))")
+        } catch {
+            log("Could not trust \(package.label): \(error.localizedDescription)")
+            return
+        }
+        await restart()
+    }
+
+    /// The extension cannot message the app, so the app asks it for blocks.
+    private func watchBlocks() async {
+        while true {
+            if screening, let reply = try? await providerMessage("blocks"),
+               let packages = try? JSONDecoder().decode([BlockedPackage].self, from: Data(reply.utf8)) {
+                for package in packages where !blocked.contains(package) {
+                    blocked.append(package)
+                    if BlockAlert.show(package) { await trust(package) }
+                }
+                blocked = Array(blocked.suffix(10))
+            }
+            try? await Task.sleep(nanoseconds: 2_000_000_000)
+        }
+    }
+
     private func stage(_ step: ReferenceWritableKeyPath<FirewallModel, StepStatus>,
                        running: String,
                        work: @MainActor () async throws -> String) async -> Bool {

macos/App/MenuBarView.swift

@@ -22,5 +22,24 @@ struct MenuBarView: View {
             Task { await model.restart() }
         }
         .disabled(model.busy)
+
+        if !model.blocked.isEmpty {
+            Divider()
+            ForEach(model.blocked) { package in
+                if !package.malicious {
+                    Menu("Held back \(package.label) (\(package.eco))") {
+                        Text(package.reason)
+                        Button("Trust this version") {
+                            Task { await model.trust(package) }
+                        }
+                        .disabled(model.busy || !package.trustable)
+                    }
+                } else {
+                    Menu("Blocked \(package.label) (\(package.eco))") {
+                        Text("Malicious: \(package.reason)")
+                    }
+                }
+            }
+        }
     }
 }

macos/project.yml

@@ -133,7 +133,7 @@ targets:
               arm64|arm64e) triple=aarch64-apple-darwin ;;
               x86_64)       triple=x86_64-apple-darwin ;;
             esac
-            cargo build --bin firewall-uninstall --target $triple $([ "$CONFIGURATION" = Debug ] || echo --release)
+            cargo build --bin firewall-uninstall --features machine-wide --target $triple $([ "$CONFIGURATION" = Debug ] || echo --release)
             bins="$bins target/$triple/$CARGO_PROFILE/firewall-uninstall"
           done
           lipo -create $bins -output "$TARGET_BUILD_DIR/$EXECUTABLE_FOLDER_PATH/firewall-uninstall"