Start the tray when the install finishes

The MSI's exit dialog starts it from the unelevated UI process, so it runs
as the signed-in user.

core/Cargo.toml

@@ -38,17 +38,14 @@ path = "src/main.rs"
 [[bin]]
 name = "firewall-service"
 path = "src/bin/firewall-service.rs"
-required-features = ["machine-wide"]
 
 [[bin]]
 name = "firewall-tray"
 path = "src/bin/firewall-tray.rs"
-required-features = ["machine-wide"]
 
 [[bin]]
 name = "firewall-uninstall"
 path = "src/bin/firewall-uninstall.rs"
-required-features = ["machine-wide"]
 
 [[example]]
 name = "proxy-test"
@@ -90,10 +87,6 @@ path = "tests/tpm.rs"
 name = "managers"
 path = "tests/managers.rs"
 
-[features]
-# Builds the machine-wide binaries: the Windows service and tray, and the macOS uninstaller.
-machine-wide = []
-
 [dependencies]
 clap = "4.6.6"
 directories = "6.0.0"

core/src/aliasing/forward.rs

@@ -89,16 +89,12 @@ async fn handle(req: Request, firewall: &Firewall) -> Result<Response, Infallibl
     }
 
     info!(method = %req.method(), %url, "forwarding");
-    // Only an HTTPS registry was downgraded to reach us, so only it is upgraded back and rewritten.
-    let tls = firewall.is_https_url(&url);
-    let index = tls && firewall.is_index_url(&url);
+    let index = firewall.is_index_url(&url);
     let (mut parts, body) = req.into_parts();
-    if tls {
-        let Ok(uri) = url.parse() else {
-            return Ok(text(400, "firewall: expected an absolute URL\n"));
-        };
-        parts.uri = uri;
-    }
+    let Ok(uri) = url.parse() else {
+        return Ok(text(400, "firewall: expected an absolute URL\n"));
+    };
+    parts.uri = uri;
 
     let client = DecompressionLayer::new().into_layer(EasyHttpWebClient::default());
     let response = match client.serve(Request::from_parts(parts, body)).await {

core/src/blocks.rs

@@ -1,36 +0,0 @@
-use crate::policies::Package;
-use serde::Serialize;
-use std::sync::Mutex;
-
-/// Bounded, so blocks pile up harmlessly while nothing collects them.
-const KEPT: usize = 50;
-
-static RECENT: Mutex<Vec<BlockedPackage>> = Mutex::new(Vec::new());
-
-#[derive(Serialize)]
-pub struct BlockedPackage {
-    pub eco: &'static str,
-    pub name: String,
-    pub version: Option<String>,
-    pub filter: &'static str,
-    pub reason: String,
-}
-
-pub fn record(eco: &'static str, pkg: &Package, filter: &'static str, reason: &str) {
-    let mut recent = RECENT.lock().unwrap_or_else(|e| e.into_inner());
-    if recent.len() == KEPT {
-        recent.remove(0);
-    }
-    recent.push(BlockedPackage {
-        eco,
-        name: pkg.name.clone(),
-        version: pkg.version.clone(),
-        filter,
-        reason: reason.to_owned(),
-    });
-}
-
-/// Hands each block over once.
-pub fn take() -> Vec<BlockedPackage> {
-    std::mem::take(&mut *RECENT.lock().unwrap_or_else(|e| e.into_inner()))
-}

core/src/config/mod.rs

@@ -48,7 +48,7 @@ impl Default for FirewallConfig {
         FirewallConfig {
             port: DEFAULT_PORT,
             fail_open: true,
-            min_age_hours: 24,
+            min_age_hours: 0,
             denylist: DenylistSource::default(),
             allow: HashMap::new(),
             telemetry: true,

core/src/firewall.rs

@@ -47,11 +47,6 @@ impl Firewall {
         self.config.hosts()
     }
 
-    pub fn is_https_url(&self, url: &str) -> bool {
-        let host = host_of(url);
-        self.config.registries.iter().any(|r| r.upstream.starts_with("https://") && r.host() == host)
-    }
-
     pub fn is_index_url(&self, url: &str) -> bool {
         self.config.registries.iter().any(|r| r.index && r.host() == host_of(url))
     }

core/src/lib.rs

@@ -1,5 +1,4 @@
 pub mod aliasing;
-pub mod blocks;
 pub mod config;
 pub mod firewall;
 pub mod http;

core/src/os/macos/mod.rs

@@ -5,7 +5,7 @@ mod uninstall;
 pub use uninstall::uninstall;
 
 use crate::config::FirewallConfig;
-use crate::{blocks, mitm, telemetry};
+use crate::{mitm, telemetry};
 use crate::Firewall;
 use rama::bytes::Bytes;
 use rama::error::BoxError;
@@ -58,7 +58,6 @@ impl TransparentProxyHandler for Handler {
         let message = String::from_utf8_lossy(&message).into_owned();
         Some(Bytes::from(match message.as_str() {
             "ca" => self.ca.pem.clone(),
-            "blocks" => serde_json::to_string(&blocks::take()).expect("blocks serialize"),
             other => format!("error: unknown message {other}"),
         }))
     }

core/src/os/windows/service.rs

@@ -26,7 +26,6 @@ use std::net::{IpAddr, Ipv4Addr};
 use std::sync::Arc;
 use std::time::Duration;
 use tracing_appender::rolling::{RollingFileAppender, Rotation};
-use windows::Win32::Foundation::ERROR_GEN_FAILURE;
 use windows_service::service::*;
 use windows_service::service_control_handler::{
     self, ServiceControlHandlerResult, ServiceStatusHandle,
@@ -74,12 +73,8 @@ fn run_until_stopped() -> Result<(), BoxError> {
         | ServiceControl::Shutdown
         | ServiceControl::Pause
         | ServiceControl::Continue => {
-            // Answered once handled, so a failed pause fails the caller's ControlService.
-            let (reply, handled) = tokio::sync::oneshot::channel();
-            let _ = control_sender.send((control, reply));
-            handled
-                .blocking_recv()
-                .unwrap_or(ServiceControlHandlerResult::NoError)
+            let _ = control_sender.send(control);
+            ServiceControlHandlerResult::NoError
         }
         ServiceControl::Interrogate => ServiceControlHandlerResult::NoError,
         _ => ServiceControlHandlerResult::NotImplemented,
@@ -94,26 +89,16 @@ fn run_until_stopped() -> Result<(), BoxError> {
             }
         };
         // Only pausing removes our hosts entries; a stop or crash keeps them, failing closed.
-        while let Some((control, reply)) = control_receiver.recv().await {
+        while let Some(control) = control_receiver.recv().await {
             let (hosts, state) = match control {
                 ServiceControl::Pause => (&[][..], ServiceState::Paused),
                 ServiceControl::Continue => (&hosts[..], ServiceState::Running),
                 _ => break,
             };
-            let result = match write_hosts_entries(hosts) {
-                Ok(()) => {
-                    set_status(&status, state, false)?;
-                    ServiceControlHandlerResult::NoError
-                }
-                Err(error) => {
-                    tracing::error!(%error, "could not rewrite the hosts file");
-                    let code = error
-                        .raw_os_error()
-                        .map_or(ERROR_GEN_FAILURE.0, |code| code as u32);
-                    ServiceControlHandlerResult::Other(code)
-                }
-            };
-            let _ = reply.send(result);
+            match write_hosts_entries(hosts) {
+                Ok(()) => set_status(&status, state, false)?,
+                Err(error) => tracing::error!(%error, "could not rewrite the hosts file"),
+            }
         }
         Ok::<_, BoxError>(())
     });
@@ -162,7 +147,7 @@ async fn start_screening(status: &ServiceStatusHandle) -> Result<Vec<&'static st
                 resolver: resolver.clone(),
                 service: service.clone(),
             };
-            let upstream = ConsumeErrLayer::trace_as_warning().into_layer(upstream);
+            let upstream = ConsumeErrLayer::trace_as_debug().into_layer(upstream);
             tokio::spawn(listen_on(address, port, &exec)?.serve(upstream));
         }
     }

core/src/os/windows/tray.rs

@@ -3,7 +3,6 @@
 use super::*;
 use muda::{Menu, MenuEvent, MenuItem, PredefinedMenuItem};
 use std::io::Cursor;
-use std::time::Duration;
 use tray_icon::{Icon, MouseButtonState, TrayIcon, TrayIconBuilder, TrayIconEvent};
 use windows::core::{w, PCWSTR};
 use windows::Win32::Foundation::*;
@@ -15,7 +14,6 @@ use windows_service::service::{Service, ServiceAccess, ServiceState};
 use windows_service::service_manager::{ServiceManager, ServiceManagerAccess};
 
 const MENU_PAUSE: &str = "pause";
-const MENU_RESTART: &str = "restart";
 const MENU_LOG: &str = "log";
 const MENU_QUIT: &str = "quit";
 const LOGO: &[u8] = include_bytes!("tray.png");
@@ -33,7 +31,6 @@ pub fn run() -> Result<(), BoxError> {
         &status,
         &PredefinedMenuItem::separator(),
         &pause,
-        &MenuItem::with_id(MENU_RESTART, "Restart", true, None),
         &MenuItem::with_id(MENU_LOG, "Open logs", true, None),
         &PredefinedMenuItem::separator(),
         &MenuItem::with_id(MENU_QUIT, "Quit", true, None),
@@ -126,11 +123,6 @@ impl Tray {
                 || Ok(open_service()?.resume().map(drop)?)
             }
             MENU_PAUSE => || Ok(open_service()?.start::<&str>(&[])?),
-            MENU_RESTART => {
-                // Off the UI thread, since stopping takes a while.
-                std::thread::spawn(|| restart().unwrap_or_else(show_error));
-                return;
-            }
             MENU_LOG => {
                 let log = HSTRING::from(data_dir().as_path());
                 let none = PCWSTR::null();
@@ -139,19 +131,13 @@ impl Tray {
             }
             _ => return,
         };
-        action().unwrap_or_else(show_error);
+        if let Err(error) = action() {
+            let text = HSTRING::from(error.to_string());
+            unsafe { MessageBoxW(None, &text, w!("Strix Firewall"), MB_ICONERROR) };
+        }
     }
 }
 
-fn show_error(error: BoxError) {
-    let text = match error.source() {
-        Some(source) => format!("{error}: {source}"),
-        None => error.to_string(),
-    };
-    let text = HSTRING::from(text);
-    unsafe { MessageBoxW(None, &text, w!("Strix Firewall"), MB_ICONERROR) };
-}
-
 /// `None` when the service is not installed.
 fn service_state() -> Option<ServiceState> {
     let manager =
@@ -180,28 +166,10 @@ fn status_text(state: Option<ServiceState>) -> &'static str {
 
 fn open_service() -> Result<Service, BoxError> {
     let manager = ServiceManager::local_computer(None::<&str>, ServiceManagerAccess::CONNECT)?;
-    let access = ServiceAccess::QUERY_STATUS
-        | ServiceAccess::START
-        | ServiceAccess::STOP
-        | ServiceAccess::PAUSE_CONTINUE;
+    let access = ServiceAccess::START | ServiceAccess::PAUSE_CONTINUE;
     Ok(manager.open_service(SERVICE_NAME, access)?)
 }
 
-/// Starting again re-reads the config.
-fn restart() -> Result<(), BoxError> {
-    let service = open_service()?;
-    if service.query_status()?.current_state != ServiceState::Stopped {
-        service.stop()?;
-    }
-    for _ in 0..60 {
-        if service.query_status()?.current_state == ServiceState::Stopped {
-            return Ok(service.start::<&str>(&[])?);
-        }
-        std::thread::sleep(Duration::from_millis(500));
-    }
-    Err("The service did not stop.".into())
-}
-
 /// The alpha channel of the RGBA logo, and its width.
 fn logo_mask() -> Result<(Vec<u8>, u32), BoxError> {
     let mut reader = png::Decoder::new(Cursor::new(LOGO)).read_info()?;

core/src/policies/mod.rs

@@ -69,8 +69,7 @@ pub async fn screen(url: &str, firewall: &Firewall) -> Option<String> {
     };
     info!(eco = registry.eco, pkg = %pkg.label(), %url, "screening");
     match consult(firewall, registry, &pkg).await {
-        Some((filter, Verdict::Deny(reason))) => {
-            crate::blocks::record(registry.eco, &pkg, filter, &reason);
+        Some((_, Verdict::Deny(reason))) => {
             Some(format!("{} {reason}", pkg.label()))
         }
         Some((filter, Verdict::Unknown(e))) if !firewall.config.fail_open => {

core/tests/forward.rs

@@ -1,9 +1,7 @@
 use firewall::aliasing::forward::downgrade;
 use firewall::http::https_url;
-use firewall::{aliasing, Firewall, FirewallConfig};
+use firewall::Firewall;
 use rama::http::{Body, Request};
-use std::io::{Read, Write};
-use std::net::{TcpListener, TcpStream};
 
 fn request(target: &str, host: Option<&str>) -> Request {
     let mut builder = Request::builder().method("GET").uri(target);
@@ -37,25 +35,6 @@ fn requests_always_go_out_over_tls() {
     assert_eq!(https_url(&request("/six", None)), None);
 }
 
-#[test]
-fn a_plain_http_upstream_is_not_upgraded() {
-    let upstream = TcpListener::bind("127.0.0.1:0").expect("bind");
-    let addr = upstream.local_addr().expect("address");
-    std::thread::spawn(move || {
-        let (mut stream, _) = upstream.accept().expect("accept");
-        let _ = stream.read(&mut [0; 4096]);
-        let _ = stream.write_all(b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\nok");
-    });
-
-    let port = aliasing::spawn(0, FirewallConfig::default()).expect("spawn");
-    let mut proxy = TcpStream::connect(("127.0.0.1", port)).expect("connect");
-    let request = format!("GET http://{addr}/x HTTP/1.1\r\nHost: {addr}\r\nConnection: close\r\n\r\n");
-    proxy.write_all(request.as_bytes()).expect("write");
-    let mut response = String::new();
-    proxy.read_to_string(&mut response).expect("read");
-    assert!(response.starts_with("HTTP/1.1 200") && response.ends_with("ok"), "{response}");
-}
-
 #[tokio::test]
 async fn downgrade_touches_known_hosts_in_text_only() {
     let text = b"https://pypi.org/x https://example.com/y".to_vec();

dist-workspace.toml

@@ -7,7 +7,6 @@ ci = "github"
 installers = ["shell", "powershell", "homebrew", "msi"]
 # core/wix/main.wxs is edited to install the service.
 allow-dirty = ["msi"]
-features = ["machine-wide"]
 tap = "usestrix/homebrew-tap"
 publish-jobs = ["homebrew", "./publish-crates"]
 targets = ["aarch64-apple-darwin", "x86_64-apple-darwin", "aarch64-unknown-linux-gnu", "x86_64-unknown-linux-gnu", "x86_64-pc-windows-msvc"]

macos/App/BlockAlerts.swift

@@ -1,32 +0,0 @@
-import AppKit
-
-struct BlockedPackage: Codable, Hashable, Identifiable {
-    let eco: String
-    let name: String
-    let version: String?
-    let filter: String
-    let reason: String
-
-    var id: String { "\(eco)/\(name)@\(version ?? "")" }
-    var label: String { version.map { "\(name) \($0)" } ?? name }
-    /// The denylist and OSV only flag packages known to be malicious; the age check only holds back new ones.
-    var malicious: Bool { filter != "age" }
-}
-
-@MainActor
-enum BlockAlert {
-    static func show(_ package: BlockedPackage) {
-        let alert = NSAlert()
-        alert.addButton(withTitle: "OK")
-        if package.malicious {
-            alert.alertStyle = .critical
-            alert.messageText = "Blocked a malicious package"
-            alert.informativeText = "\(package.label) (\(package.eco)) \(package.reason). Do not install it."
-        } else {
-            alert.messageText = "Held back a new package"
-            alert.informativeText = "\(package.label) (\(package.eco)) \(package.reason)."
-        }
-        NSApp.activate(ignoringOtherApps: true)
-        alert.runModal()
-    }
-}

macos/App/FirewallModel.swift

@@ -2,7 +2,6 @@ import AppKit
 import NetworkExtension
 import OSLog
 import Security
-import ServiceManagement
 import SystemExtensions
 
 enum StepStatus: Equatable {
@@ -52,7 +51,6 @@ final class FirewallModel: NSObject, ObservableObject {
     @Published private(set) var completed = false
     @Published private(set) var removed = false
     @Published private(set) var screening = false
-    @Published private(set) var blocked: [BlockedPackage] = []
 
     private let logger = Logger(subsystem: FirewallIDs.appBundleID, category: "installer")
     private var pendingRequest: (request: OSSystemExtensionRequest, continuation: CheckedContinuation<Void, Error>)?
@@ -74,7 +72,6 @@ final class FirewallModel: NSObject, ObservableObject {
             await refresh()
             if CommandLine.arguments.contains("--install") { await install() }
         }
-        Task { await watchBlocks() }
     }
 
     // MARK: - Flows
@@ -115,11 +112,6 @@ final class FirewallModel: NSObject, ObservableObject {
                           work: trustCertificateAuthority)
         else { return }
 
-        do {
-            try SMAppService.mainApp.register()
-        } catch {
-            log("Could not open the app at login: \(error.localizedDescription)")
-        }
         completed = true
         log("Setup complete")
         offerRestart()
@@ -160,7 +152,6 @@ final class FirewallModel: NSObject, ObservableObject {
         await removeConfiguration()
         let strandedKey = removeStoredCA()
         await deactivate()
-        try? await SMAppService.mainApp.unregister()
         if let strandedKey { trustStep = .failed(strandedKey) }
 
         let failed = [extensionStep, screeningStep, trustStep].contains(where: \.isFailed)
@@ -208,21 +199,6 @@ final class FirewallModel: NSObject, ObservableObject {
         if let url = URL(string: pane) { NSWorkspace.shared.open(url) }
     }
 
-    /// The extension cannot message the app, so the app asks it for blocks.
-    private func watchBlocks() async {
-        while true {
-            if screening, let reply = try? await providerMessage("blocks"),
-               let packages = try? JSONDecoder().decode([BlockedPackage].self, from: Data(reply.utf8)) {
-                for package in packages where !blocked.contains(package) {
-                    blocked.append(package)
-                    BlockAlert.show(package)
-                }
-                blocked = Array(blocked.suffix(10))
-            }
-            try? await Task.sleep(nanoseconds: 2_000_000_000)
-        }
-    }
-
     private func stage(_ step: ReferenceWritableKeyPath<FirewallModel, StepStatus>,
                        running: String,
                        work: @MainActor () async throws -> String) async -> Bool {

macos/App/MenuBarView.swift

@@ -22,20 +22,5 @@ struct MenuBarView: View {
             Task { await model.restart() }
         }
         .disabled(model.busy)
-
-        if !model.blocked.isEmpty {
-            Divider()
-            ForEach(model.blocked) { package in
-                if !package.malicious {
-                    Menu("Held back \(package.label) (\(package.eco))") {
-                        Text(package.reason)
-                    }
-                } else {
-                    Menu("Blocked \(package.label) (\(package.eco))") {
-                        Text("Malicious: \(package.reason)")
-                    }
-                }
-            }
-        }
     }
 }

macos/build.sh

@@ -47,7 +47,6 @@ build() {
   echo "==> Building"
   xcodegen generate >/dev/null
   xcodebuild -project Firewall.xcodeproj -scheme StrixFirewall -configuration $CONFIGURATION \
-    -destination generic/platform=macOS \
     -derivedDataPath build CODE_SIGNING_ALLOWED=NO CODE_SIGNING_REQUIRED=NO \
     CODE_SIGN_IDENTITY="" CODE_SIGN_ENTITLEMENTS="" build >/dev/null
 }

macos/project.yml

@@ -10,7 +10,7 @@ settings:
     "CARGO_PROFILE[config=Debug]": debug
     "LIBRARY_SEARCH_PATHS[arch=arm64]": $(SRCROOT)/../core/target/aarch64-apple-darwin/$(CARGO_PROFILE)
     "LIBRARY_SEARCH_PATHS[arch=x86_64]": $(SRCROOT)/../core/target/x86_64-apple-darwin/$(CARGO_PROFILE)
-    ARCHS: arm64 x86_64
+    ARCHS: arm64
     "ONLY_ACTIVE_ARCH[config=Debug]": "YES"
     SWIFT_VERSION: "5.0"
     DEVELOPMENT_TEAM: ${TEAM}
@@ -127,13 +127,5 @@ targets:
           unset CC CXX CFLAGS CXXFLAGS
           export SDKROOT="$(xcrun --sdk macosx --show-sdk-path)"
           cd "$SRCROOT/../core"
-          bins=
-          for arch in $ARCHS; do
-            case $arch in
-              arm64|arm64e) triple=aarch64-apple-darwin ;;
-              x86_64)       triple=x86_64-apple-darwin ;;
-            esac
-            cargo build --bin firewall-uninstall --features machine-wide --target $triple $([ "$CONFIGURATION" = Debug ] || echo --release)
-            bins="$bins target/$triple/$CARGO_PROFILE/firewall-uninstall"
-          done
-          lipo -create $bins -output "$TARGET_BUILD_DIR/$EXECUTABLE_FOLDER_PATH/firewall-uninstall"
+          cargo build --bin firewall-uninstall --target aarch64-apple-darwin $([ "$CONFIGURATION" = Debug ] || echo --release)
+          cp "target/aarch64-apple-darwin/$CARGO_PROFILE/firewall-uninstall" "$TARGET_BUILD_DIR/$EXECUTABLE_FOLDER_PATH/"