Install the command-line tool from Homebrew, the install scripts or crates.io

README.md

@@ -0,0 +1,83 @@
+# Strix Firewall
+
+Stops malicious packages before they install. When a package manager downloads a package, the firewall checks its name and version against Strix's denylist and [OSV](https://osv.dev) malware advisories, and fails the download if either flags it.
+
+It covers npm, pnpm, bun, pip, uv, pipenv, pdm, cargo, gem and go.
+
+## Install
+
+**Command-line tool**, with any of:
+
+```sh
+brew install usestrix/tap/strix-firewall
+curl -LsSf https://github.com/usestrix/firewall/releases/latest/download/strix-firewall-installer.sh | sh
+cargo install strix-firewall
+```
+
+On Windows:
+
+```powershell
+powershell -c "irm https://github.com/usestrix/firewall/releases/latest/download/strix-firewall-installer.ps1 | iex"
+```
+
+From a clone, `cargo install --path core`.
+
+**Whole-machine firewall** (macOS 13 or later on Apple Silicon):
+
+1. Build `Firewall.pkg` (see [Building the macOS app](#building-the-macos-app)) and open it.
+2. Open **StrixFirewall** from Applications and click **Install**.
+3. Approve the system extension, the network configuration and the certificate when macOS asks, then restart.
+
+It then lives in the menu bar. To remove it, choose **Setup** from the menu and click **Uninstall**.
+
+## Use
+
+Put `firewall` in front of a package manager command:
+
+```sh
+firewall npm install left-pad
+```
+
+Or alias the manager so every install is checked:
+
+```sh
+alias npm='firewall npm'
+```
+
+The whole-machine firewall needs no setup: it checks downloads from every process.
+
+## Configure
+
+Settings come from an optional `config.json`; a file only needs the keys it changes:
+
+```json
+{
+  "min_age_hours": 24,
+  "allow": { "npm": [{ "name": "left-pad", "version": "1.3.0" }] }
+}
+```
+
+| Key | Default | |
+| --- | --- | --- |
+| `fail_open` | `true` | Allow a package when it could not be checked |
+| `min_age_hours` | `0` | Hold back versions newer than this; 0 turns it off |
+| `allow` | `{}` | Packages never screened, by ecosystem (`npm`, `pypi`, `cargo`, `gem`, `go`); every version when `version` is absent |
+| `telemetry` | `true` | Send screening events, errors and a heartbeat to Strix |
+| `port` | `8080` | Port for `firewall serve` |
+
+The command-line tool reads `~/Library/Application Support/com.usestrix.firewall/config.json` on macOS and `~/.config/firewall/config.json` on Linux. On macOS, `/Library/Application Support/Firewall/config.json` overrides it key by key (allow lists add up), and is the only file the whole-machine firewall reads.
+
+## Building the macOS app
+
+It needs [XcodeGen](https://github.com/yonaskolb/XcodeGen), a Developer ID certificate, and Developer ID profiles for `com.usestrix.firewall` and `com.usestrix.firewall.extension`:
+
+```sh
+echo TEAM=<Apple team ID> > macos/.env
+echo NOTARY_PROFILE=<notarytool keychain profile> >> macos/.env
+macos/build.sh         # builds and notarizes macos/build/Firewall.pkg
+macos/build.sh debug   # signs with Apple Development and skips notarization
+```
+
+## License
+
+Apache 2.0. See [LICENSE](LICENSE).

core/Cargo.lock

@@ -935,7 +935,7 @@ checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
 dependencies = [
  "cfg-if",
  "libc",
- "wasi 0.11.1+wasi-snapshot-preview1",
+ "wasi",
 ]
 
 [[package]]
@@ -1331,9 +1331,9 @@ dependencies = [
 
 [[package]]
 name = "js-sys"
-version = "0.3.106"
+version = "0.3.105"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7883d941dae510fb2d978fc3fe018c71c9e2892fd38854de3e8b92c2e5ad9cc5"
+checksum = "ce57d20d1ea864ce2ac172ab472d409214f4fd359f0b2a2775abdf522e2af99e"
 dependencies = [
  "cfg-if",
  "futures-util",
@@ -1500,7 +1500,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4b18443e9c262bfe8fa82f51666e2642c53393f7e5c27b3e1aeab922cff5b9d8"
 dependencies = [
  "libc",
- "wasi 0.11.1+wasi-snapshot-preview1",
+ "wasi",
  "windows-sys 0.61.2",
 ]
 
@@ -1630,24 +1630,6 @@ dependencies = [
  "autocfg",
 ]
 
-[[package]]
-name = "objc2-core-foundation"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a180dd8642fa45cdb7dd721cd4c11b1cadd4929ce112ebd8b9f5803cc79d536"
-dependencies = [
- "bitflags 2.13.2",
-]
-
-[[package]]
-name = "objc2-system-configuration"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7216bd11cbda54ccabcab84d523dc93b858ec75ecfb3a7d89513fa22464da396"
-dependencies = [
- "objc2-core-foundation",
-]
-
 [[package]]
 name = "oid-registry"
 version = "0.8.1"
@@ -3129,7 +3111,6 @@ dependencies = [
  "tracing",
  "tracing-subscriber",
  "which",
- "whoami",
 ]
 
 [[package]]
@@ -3607,15 +3588,6 @@ version = "0.11.1+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
-[[package]]
-name = "wasi"
-version = "0.14.7+wasi-0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "883478de20367e224c0090af9cf5f9fa85bed63a95c1abf3afc5c083ebc06e8c"
-dependencies = [
- "wasip2",
-]
-
 [[package]]
 name = "wasip2"
 version = "1.0.4+wasi-0.2.12"
@@ -3625,20 +3597,11 @@ dependencies = [
  "wit-bindgen",
 ]
 
-[[package]]
-name = "wasite"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "66fe902b4a6b8028a753d5424909b764ccf79b7a209eac9bf97e59cda9f71a42"
-dependencies = [
- "wasi 0.14.7+wasi-0.2.4",
-]
-
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.129"
+version = "0.2.128"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9bb54f33acc68fd454578d9820b0bde1a1a3d17aa17bb7b6595806d02886d409"
+checksum = "aecb87a33d3b0c5e3b7aa46336eaf486cffafbd281b195e4c8b80d50df2351bf"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -3649,9 +3612,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.129"
+version = "0.2.128"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e29d0c35b16e224a7eeb5cd2d25e3e1968fbd65604117b44d3b789d00ee8535"
+checksum = "a690d511e3c1a8b3a55e33511e3c2c00c78415cd23650f32b808627f5696b9ed"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -3659,9 +3622,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.129"
+version = "0.2.128"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f501a8bc3719dba86ef8ae4728879c08001bea749eb1333ac5b91e040e2a6b7"
+checksum = "411e4887f0071ef2d2164a9d5fdf2d20efbef78fccd3a78b0c10a1dc5295e48a"
 dependencies = [
  "bumpalo",
  "proc-macro2",
@@ -3672,23 +3635,13 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.129"
+version = "0.2.128"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23f0c9c52aa7cd7d77769a4cfe2a9adb1b331f489a41d912ce14513d5ab995c6"
+checksum = "81941cd78d0c92026c33e5e01312845a4cb1e9af3407f9134b100dd03144103e"
 dependencies = [
  "unicode-ident",
 ]
 
-[[package]]
-name = "web-sys"
-version = "0.3.106"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88261b9deccee56594c11a3460c462c41f58d148598fe70ad77070126a68aba4"
-dependencies = [
- "js-sys",
- "wasm-bindgen",
-]
-
 [[package]]
 name = "webpki-root-certs"
 version = "1.0.9"
@@ -3716,19 +3669,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "whoami"
-version = "2.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "626c4bac6755d76ffc12cb01b2eac751db1996b9e0041de9aa02c8c211ddc82c"
-dependencies = [
- "libc",
- "libredox",
- "objc2-system-configuration",
- "wasite",
- "web-sys",
-]
-
 [[package]]
 name = "wildcard"
 version = "0.3.0"

core/Cargo.toml

@@ -72,7 +72,6 @@ tokio = { version = "1.53.1", features = ["io-util", "rt", "sync", "time"] }
 tracing = "0.1.44"
 tracing-subscriber = { version = "0.3.23", features = ["env-filter"] }
 which = "8"
-whoami = "2.1.3"
 
 [target.'cfg(target_vendor = "apple")'.dependencies]
 core-foundation = "0.10.1"

core/src/config/mod.rs

@@ -18,35 +18,21 @@ pub struct FirewallConfig {
     pub min_age_hours: u64,
     pub denylist: DenylistSource,
     /// Packages never screened, by ecosystem: `{"npm": [{"name": "left-pad"}]}`.
-    pub allow: PackageList,
+    pub allow: HashMap<String, Vec<AllowedPackage>>,
     pub telemetry: bool,
-    /// Reports installs to, and takes blocks from, a Strix workspace.
-    pub platform: Option<PlatformConfig>,
     /// Not describable in the file yet, so this is always the built-in table.
     #[serde(skip)]
     pub registries: Vec<&'static Registry>,
 }
 
-/// Packages by ecosystem, as the allow list and organization blocks name them.
-pub type PackageList = HashMap<String, Vec<ListedPackage>>;
-
 #[derive(Debug, Deserialize)]
 #[serde(deny_unknown_fields)]
-pub struct ListedPackage {
+pub struct AllowedPackage {
     pub name: String,
     /// Every version when absent.
     pub version: Option<String>,
 }
 
-#[derive(Debug, Clone, Deserialize)]
-#[serde(deny_unknown_fields)]
-pub struct PlatformConfig {
-    pub api_key: String,
-    /// Where a self-hosted Strix lives.
-    #[serde(default = "hosted")]
-    pub url: String,
-}
-
 #[derive(Debug, Clone, Deserialize)]
 #[serde(default, deny_unknown_fields)]
 pub struct DenylistSource {
@@ -66,7 +52,6 @@ impl Default for FirewallConfig {
             denylist: DenylistSource::default(),
             allow: HashMap::new(),
             telemetry: true,
-            platform: None,
             registries: BUILT_IN.to_vec(),
         }
     }
@@ -128,10 +113,6 @@ impl FirewallConfig {
     }
 }
 
-fn hosted() -> String {
-    "https://app.usestrix.com".into()
-}
-
 pub fn path() -> Option<PathBuf> {
     let dirs = ProjectDirs::from("com", "usestrix", "firewall")?;
     Some(dirs.config_dir().join("config.json"))

core/src/firewall.rs

@@ -1,7 +1,6 @@
 use crate::config::FirewallConfig;
 use crate::policies::filters::age::Age;
 use crate::policies::filters::denylist::Denylist;
-use crate::policies::filters::organization::OrganizationBlocks;
 use crate::policies::filters::osv::Osv;
 use crate::policies::filters::Filter;
 use crate::policies::registries::*;
@@ -29,12 +28,7 @@ impl Firewall {
         }
         let ecosystems = config.registries.iter().map(|r| r.osv_name);
         let denylist = Denylist::new(config.denylist.clone(), ecosystems);
-        let mut filters: Vec<Box<dyn Filter>> = Vec::new();
-        if let Some(platform) = &config.platform {
-            filters.push(Box::new(OrganizationBlocks::new(platform.clone())));
-        }
-        filters.push(Box::new(denylist));
-        filters.push(Box::new(Osv));
+        let mut filters: Vec<Box<dyn Filter>> = vec![Box::new(denylist), Box::new(Osv)];
         if config.min_age_hours > 0 {
             filters.push(Box::new(Age::new(config.min_age_hours)));
         }

core/src/lib.rs

@@ -4,7 +4,6 @@ pub mod firewall;
 pub mod http;
 pub mod mitm;
 pub mod os;
-mod platform;
 pub mod policies;
 pub mod proxy;
 pub mod telemetry;

core/src/platform.rs

@@ -1,73 +0,0 @@
-use crate::config::PlatformConfig;
-use crate::policies::Package;
-use crate::FirewallConfig;
-use rama::http::client::EasyHttpWebClient;
-use rama::http::header::{AUTHORIZATION, CONTENT_TYPE};
-use rama::http::service::client::HttpClientExt;
-use serde_json::{json, Value};
-use std::sync::{LazyLock, Mutex};
-use std::time::Duration;
-use time::format_description::well_known::Rfc3339;
-use time::OffsetDateTime;
-use tracing::{debug, warn};
-
-const TIMEOUT: Duration = Duration::from_secs(10);
-/// The most events the platform takes in one request.
-const BATCH: usize = 500;
-
-/// On when a readable config names a Strix API key.
-static PLATFORM: LazyLock<Option<Platform>> = LazyLock::new(|| {
-    let config = FirewallConfig::load().ok()?.platform?;
-    Some(Platform { config, events: Mutex::default() })
-});
-
-struct Platform {
-    config: PlatformConfig,
-    events: Mutex<Vec<Value>>,
-}
-
-pub fn on() -> bool {
-    PLATFORM.is_some()
-}
-
-pub fn record(eco: &str, pkg: &Package, reason: Option<&str>) {
-    let Some(platform) = &*PLATFORM else { return };
-    let event = json!({
-        "ecosystem": eco,
-        "name": pkg.name,
-        "version": pkg.version,
-        "blocked": reason.is_some(),
-        "reason": reason,
-        "occurred_at": OffsetDateTime::now_utc().format(&Rfc3339).ok(),
-    });
-    platform.events.lock().expect("platform lock").push(event);
-}
-
-/// Events in a batch the platform did not take are dropped, not retried.
-pub async fn send() {
-    let Some(platform) = &*PLATFORM else { return };
-    let events = std::mem::take(&mut *platform.events.lock().expect("platform lock"));
-    let url = format!("{}/api/v1/firewall/events", platform.config.url);
-    let client = EasyHttpWebClient::default();
-    for batch in events.chunks(BATCH) {
-        let body = json!({
-            "device": whoami::hostname().ok(),
-            "user": whoami::username().ok(),
-            "os": std::env::consts::OS,
-            "firewall_version": env!("CARGO_PKG_VERSION"),
-            "events": batch,
-        });
-        let request = client
-            .post(&url)
-            .header(CONTENT_TYPE, "application/json")
-            .header(AUTHORIZATION, format!("Bearer {}", platform.config.api_key));
-        match tokio::time::timeout(TIMEOUT, request.body(body.to_string()).send()).await {
-            Ok(Ok(response)) if response.status().is_success() => {
-                debug!(events = batch.len(), "installs reported")
-            }
-            Ok(Ok(response)) => warn!(status = %response.status(), %url, "platform refused installs"),
-            Ok(Err(error)) => warn!(%error, %url, "could not report installs"),
-            Err(_) => warn!(%url, "reporting installs timed out"),
-        }
-    }
-}

core/src/policies/filters/mod.rs

@@ -1,10 +1,8 @@
 pub mod age;
 pub mod denylist;
-pub mod organization;
 pub mod osv;
 
 use super::registries::{Package, Registry};
-use crate::config::PackageList;
 use crate::Firewall;
 use std::future::Future;
 use std::pin::Pin;
@@ -32,7 +30,7 @@ pub async fn consult(
     registry: &'static Registry,
     pkg: &Package,
 ) -> Option<(&'static str, Verdict)> {
-    if listed(&firewall.config.allow, registry, pkg) {
+    if allowed(firewall, registry, pkg) {
         return None;
     }
     let mut unsure = None;
@@ -47,9 +45,8 @@ pub async fn consult(
     unsure
 }
 
-/// Whether `list` names `pkg`.
-fn listed(list: &PackageList, registry: &Registry, pkg: &Package) -> bool {
-    let Some(entries) = list.get(registry.eco) else {
+fn allowed(firewall: &Firewall, registry: &Registry, pkg: &Package) -> bool {
+    let Some(entries) = firewall.config.allow.get(registry.eco) else {
         return false;
     };
     entries.iter().any(|entry| {

core/src/policies/filters/organization.rs

@@ -1,94 +0,0 @@
-use super::{listed, Filter, Verdict, VerdictFuture, AGENT};
-use crate::config::{PackageList, PlatformConfig};
-use crate::policies::registries::Registry;
-use crate::policies::Package;
-use rama::http::client::EasyHttpWebClient;
-use rama::http::header::{AUTHORIZATION, USER_AGENT};
-use rama::http::service::client::HttpClientExt;
-use rama::http::{BodyExtractExt, StatusCode};
-use std::sync::{Arc, RwLock};
-use std::time::Duration;
-use tokio::sync::OnceCell;
-use tokio::task::JoinHandle;
-use tracing::{info, warn};
-
-const POLL: Duration = Duration::from_secs(60);
-
-type Blocks = Arc<OnceCell<RwLock<Arc<Result<PackageList, String>>>>>;
-
-/// Packages a Strix admin blocked, downloaded when the first package is screened.
-pub struct OrganizationBlocks {
-    platform: PlatformConfig,
-    blocks: Blocks,
-    watch: JoinHandle<()>,
-}
-
-impl OrganizationBlocks {
-    pub fn new(platform: PlatformConfig) -> Self {
-        let blocks = Arc::new(OnceCell::new());
-        let watch = tokio::spawn(watch(platform.clone(), Arc::clone(&blocks)));
-        OrganizationBlocks { platform, blocks, watch }
-    }
-}
-
-impl Drop for OrganizationBlocks {
-    fn drop(&mut self) {
-        self.watch.abort();
-    }
-}
-
-impl Filter for OrganizationBlocks {
-    fn name(&self) -> &'static str {
-        "organization"
-    }
-
-    fn check<'a>(&'a self, registry: &'static Registry, pkg: &'a Package) -> VerdictFuture<'a> {
-        Box::pin(async move {
-            let load = || async { RwLock::new(Arc::new(load(&self.platform).await)) };
-            let blocks = self.blocks.get_or_init(load).await;
-            let blocks = Arc::clone(&blocks.read().expect("blocks lock"));
-            match &*blocks {
-                Err(e) => Verdict::Unknown(e.clone()),
-                Ok(blocks) if listed(blocks, registry, pkg) => {
-                    Verdict::Deny("is blocked by your organization".into())
-                }
-                Ok(_) => Verdict::Allow,
-            }
-        })
-    }
-}
-
-/// A failed fetch leaves the last good list in place.
-async fn watch(platform: PlatformConfig, blocks: Blocks) {
-    loop {
-        tokio::time::sleep(POLL).await;
-        let Some(current) = blocks.get() else { continue };
-        if let Ok(fresh) = load(&platform).await {
-            *current.write().expect("blocks lock") = Arc::new(Ok(fresh));
-        }
-    }
-}
-
-async fn load(platform: &PlatformConfig) -> Result<PackageList, String> {
-    let blocks = fetch(platform).await;
-    match &blocks {
-        Ok(_) => info!("organization blocks loaded"),
-        Err(error) => warn!(%error, "organization blocks unavailable"),
-    }
-    blocks
-}
-
-async fn fetch(platform: &PlatformConfig) -> Result<PackageList, String> {
-    let url = format!("{}/api/v1/firewall/blocklist", platform.url);
-    let client = EasyHttpWebClient::default();
-    let request = client
-        .get(&url)
-        .header(USER_AGENT, AGENT)
-        .header(AUTHORIZATION, format!("Bearer {}", platform.api_key));
-    let response = request.send().await.map_err(|e| e.to_string())?;
-    if response.status() != StatusCode::OK {
-        return Err(format!("{url} replied {}", response.status()));
-    }
-    let text = response.try_into_string().await.map_err(|e| e.to_string())?;
-    serde_json::from_str(&text).map_err(|e| e.to_string())
-}

core/src/telemetry.rs

@@ -1,4 +1,3 @@
-use crate::platform;
 use crate::policies::Package;
 use crate::{Firewall, FirewallConfig};
 use rama::http::client::EasyHttpWebClient;
@@ -41,7 +40,7 @@ struct Telemetry {
 }
 
 pub fn screened(firewall: &Firewall, url: &str, reason: Option<&str>) {
-    if !on() {
+    if TELEMETRY.is_none() {
         return;
     }
     let Some((registry, rest)) = firewall.match_on(url, |r| r.upstream) else {
@@ -53,7 +52,6 @@ pub fn screened(firewall: &Firewall, url: &str, reason: Option<&str>) {
 }
 
 pub fn screened_package(eco: &str, pkg: &Package, reason: Option<&str>) {
-    platform::record(eco, pkg, reason);
     let mut properties = json!({ "eco": eco, "blocked": reason.is_some() });
     if let Some(reason) = reason {
         properties["package"] = pkg.label().into();
@@ -71,7 +69,7 @@ pub fn error(kind: &'static str) {
 }
 
 pub fn heartbeat() {
-    if !on() {
+    if TELEMETRY.is_none() {
         return;
     }
     tokio::spawn(async {
@@ -83,7 +81,7 @@ pub fn heartbeat() {
 }
 
 pub fn flush() {
-    if !on() {
+    if TELEMETRY.is_none() {
         return;
     }
     match Runtime::try_new() {
@@ -92,11 +90,6 @@ pub fn flush() {
     }
 }
 
-/// PostHog, or the Strix platform when the config names one.
-fn on() -> bool {
-    TELEMETRY.is_some() || platform::on()
-}
-
 fn record(event: &str, mut properties: Value) {
     let Some(telemetry) = &*TELEMETRY else { return };
     properties["distinct_id"] = telemetry.session.clone().into();
@@ -110,7 +103,6 @@ fn record(event: &str, mut properties: Value) {
 }
 
 pub async fn send() {
-    platform::send().await;
     let Some(telemetry) = &*TELEMETRY else { return };
     let batch = std::mem::take(&mut *telemetry.events.lock().expect("telemetry lock"));
     if batch.is_empty() {