Hold a held-back download open so allowing it lets it through

core/Cargo.lock

@@ -711,20 +711,6 @@ version = "1.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "252afb9ae5eaa683babdc6a068b3f5726eb19e05070c731f9b2a23a7c3e8ed34"
 
-[[package]]
-name = "embed-resource"
-version = "3.0.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6168487b5e7eb2673e6efe1200b1848016e436a6ca0b8031bf04bd9d493a249f"
-dependencies = [
- "cc",
- "memchr",
- "rustc_version",
- "toml",
- "vswhom",
- "winreg",
-]
-
 [[package]]
 name = "encoding_rs"
 version = "0.8.42"
@@ -3257,15 +3243,6 @@ dependencies = [
  "zmij",
 ]
 
-[[package]]
-name = "serde_spanned"
-version = "1.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e7523beb55eece201a2356bee0bbca0d1ab466c14c07703b2e0ee6d42cb0c2c"
-dependencies = [
- "serde_core",
-]
-
 [[package]]
 name = "sha1"
 version = "0.11.0"
@@ -3398,7 +3375,6 @@ dependencies = [
  "clap",
  "core-foundation 0.10.1",
  "directories",
- "embed-resource",
  "muda",
  "percent-encoding",
  "png",
@@ -3694,26 +3670,11 @@ dependencies = [
  "tokio",
 ]
 
-[[package]]
-name = "toml"
-version = "1.1.8+spec-1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20489e00e4d8741d6be680764cc12e270655e375a20d1011e844a9c3379e678d"
-dependencies = [
- "indexmap",
- "serde_core",
- "serde_spanned",
- "toml_datetime",
- "toml_parser",
- "toml_writer",
- "winnow",
-]
-
 [[package]]
 name = "toml_datetime"
-version = "1.1.2+spec-1.1.0"
+version = "1.1.1+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b86d767906c6c42421dcba507eb9d203e779497710a47782a224bb871653053"
+checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
 dependencies = [
  "serde_core",
 ]
@@ -3732,19 +3693,13 @@ dependencies = [
 
 [[package]]
 name = "toml_parser"
-version = "1.1.5+spec-1.1.0"
+version = "1.1.3+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baa693a8032d7e1cada7d0041e96126df243179ff061456783ac7f12bda4744c"
+checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56"
 dependencies = [
  "winnow",
 ]
 
-[[package]]
-name = "toml_writer"
-version = "1.1.3+spec-1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06bdbd8cfc056b8d2e2e85f29b56a3bdbecb527cef81eb39e3e7b98af4652770"
-
 [[package]]
 name = "tower-layer"
 version = "0.3.3"
@@ -3954,26 +3909,6 @@ version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
 
-[[package]]
-name = "vswhom"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be979b7f07507105799e854203b470ff7c78a1639e330a58f183b5fea574608b"
-dependencies = [
- "libc",
- "vswhom-sys",
-]
-
-[[package]]
-name = "vswhom-sys"
-version = "0.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb067e4cbd1ff067d1df46c9194b5de0e98efd2810bbc95c5d5e5f25a3231150"
-dependencies = [
- "cc",
- "libc",
-]
-
 [[package]]
 name = "walkdir"
 version = "2.5.0"
@@ -4349,16 +4284,6 @@ dependencies = [
  "memchr",
 ]
 
-[[package]]
-name = "winreg"
-version = "0.56.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d6f32a0ff4a9f6f01231eb2059cc85479330739333e0e58cadf03b6af2cca10"
-dependencies = [
- "cfg-if",
- "windows-sys 0.61.2",
-]
-
 [[package]]
 name = "wit-bindgen"
 version = "0.57.1"

core/Cargo.toml

@@ -129,7 +129,7 @@ schannel = "0.1.29"
 tokio = { version = "1.53.1", features = ["net"] }
 tracing-appender = "0.2.5"
 tray-icon = { version = "0.26.1", default-features = false }
-windows = { version = "0.62", features = ["Win32_Foundation", "Win32_Security", "Win32_Security_Authorization", "Win32_Security_Cryptography", "Win32_Storage_FileSystem", "Win32_System_Com", "Win32_System_Console", "Win32_System_Environment", "Win32_System_JobObjects", "Win32_System_LibraryLoader", "Win32_System_Pipes", "Win32_System_Registry", "Win32_System_Threading", "Win32_UI_Controls", "Win32_UI_Shell", "Win32_UI_WindowsAndMessaging"] }
+windows = { version = "0.62", features = ["Win32_Foundation", "Win32_Security", "Win32_Security_Authorization", "Win32_Security_Cryptography", "Win32_Storage_FileSystem", "Win32_System_Com", "Win32_System_Console", "Win32_System_Environment", "Win32_System_JobObjects", "Win32_System_Threading", "Win32_UI_Shell", "Win32_UI_WindowsAndMessaging"] }
 windows-registry = "0.6.1"
 windows-service = "0.8.0"
 
@@ -139,7 +139,3 @@ tokio = { version = "1.53.1", features = ["macros", "rt-multi-thread"] }
 [profile.dist]
 inherits = "release"
 lto = "thin"
-
-# Only on Windows hosts, where the tray and service are built.
-[target.'cfg(windows)'.build-dependencies]
-embed-resource = "3.0.12"

core/build.rs

@@ -1,16 +0,0 @@
-//! The tray's task dialogs exist only in version 6 of the common controls, which takes a manifest.
-//! Both machine-wide binaries also get the Strix icon.
-fn main() {
-    println!("cargo:rerun-if-changed=src/bin/firewall-tray.manifest");
-    let msvc = std::env::var("CARGO_CFG_TARGET_ENV").as_deref() == Ok("msvc");
-    if msvc && std::env::var_os("CARGO_FEATURE_MACHINE_WIDE").is_some() {
-        let manifest = concat!(env!("CARGO_MANIFEST_DIR"), "/src/bin/firewall-tray.manifest");
-        println!("cargo:rustc-link-arg-bin=firewall-tray=/MANIFEST:EMBED");
-        println!("cargo:rustc-link-arg-bin=firewall-tray=/MANIFESTINPUT:{manifest}");
-        #[cfg(windows)]
-        embed_resource::compile_for("src/bin/firewall.rc", ["firewall-tray", "firewall-service"], embed_resource::NONE)
-            // Fails the build, rather than ship without the icon.
-            .manifest_required()
-            .unwrap();
-    }
-}

core/src/bin/firewall-tray.manifest

@@ -1,9 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
-<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
-  <dependency>
-    <dependentAssembly>
-      <assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0"
-        processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"/>
-    </dependentAssembly>
-  </dependency>
-</assembly>

core/src/bin/firewall.rc

@@ -1,2 +0,0 @@
-// The icon Explorer, UAC and the tray's popups show.
-1 ICON "strix.ico"

core/src/os/windows/mod.rs

@@ -2,7 +2,6 @@
 //! LocalSystem service screens it as the macOS extension does.
 
 mod ca;
-mod pipe;
 mod service;
 mod tpm;
 mod tray;

core/src/os/windows/pipe.rs

@@ -1,102 +0,0 @@
-//! How the tray asks the service what it blocked, and allows a new package, as the macOS app
-//! messages its extension.
-
-use super::{config_file, security_descriptor};
-use crate::{blocks, Firewall};
-use rama::error::BoxError;
-use std::os::windows::io::AsRawHandle;
-use std::sync::Arc;
-use std::time::Duration;
-use tokio::io::{AsyncBufReadExt, AsyncReadExt, AsyncWriteExt, BufReader};
-use tokio::net::windows::named_pipe::{NamedPipeServer, ServerOptions};
-use windows::core::{Owned, PWSTR};
-use windows::Win32::Foundation::HANDLE;
-use windows::Win32::Security::*;
-use windows::Win32::System::Pipes::{GetNamedPipeClientProcessId, ImpersonateNamedPipeClient};
-use windows::Win32::System::Threading::*;
-
-pub(super) const PIPE: &str = r"\\.\pipe\StrixFirewall";
-/// Signed-in users can connect, as the tray runs as them.
-const PIPE_ACL: &str = "D:P(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW;;;IU)";
-
-pub(super) async fn serve(firewall: Arc<Firewall>) -> Result<(), BoxError> {
-    let mut server = create(true)?;
-    loop {
-        server.connect().await?;
-        let client = std::mem::replace(&mut server, create(false)?);
-        let firewall = Arc::clone(&firewall);
-        tokio::spawn(async move {
-            if let Err(error) = answer(client, &firewall).await {
-                tracing::debug!(%error, "could not answer the tray");
-            }
-        });
-    }
-}
-
-fn create(first: bool) -> Result<NamedPipeServer, BoxError> {
-    let acl = security_descriptor(PIPE_ACL)?;
-    let mut attributes = SECURITY_ATTRIBUTES {
-        nLength: size_of::<SECURITY_ATTRIBUTES>() as u32,
-        lpSecurityDescriptor: acl.0,
-        bInheritHandle: false.into(),
-    };
-    let attributes = (&raw mut attributes).cast();
-    let mut options = ServerOptions::new();
-    // Fails if anyone else made the pipe first.
-    options.first_pipe_instance(first);
-    Ok(unsafe { options.create_with_security_attributes_raw(PIPE, attributes)? })
-}
-
-/// A line each way.
-async fn answer(client: NamedPipeServer, firewall: &Firewall) -> Result<(), BoxError> {
-    let mut client = BufReader::new(client);
-    let mut request = String::new();
-    (&mut client)
-        .take(64 * 1024)
-        .read_line(&mut request)
-        .await?;
-    let request = request.trim_end();
-    // Only the app can message the macOS extension; here any program could connect.
-    let reply = if !client_is_tray(client.get_ref())? {
-        "error: only the tray can ask".to_owned()
-    } else if request.starts_with("allow ") && !client_is_admin(client.get_ref())? {
-        "error: trusting a package takes an administrator".to_owned()
-    } else {
-        blocks::answer(firewall, &config_file(), request)
-    };
-    client.write_all(format!("{reply}\n").as_bytes()).await?;
-    // Closing before the tray hangs up could discard the reply.
-    let _ = tokio::time::timeout(Duration::from_secs(5), client.read(&mut [0])).await;
-    Ok(())
-}
-
-fn client_is_tray(client: &NamedPipeServer) -> Result<bool, BoxError> {
-    let mut id = 0;
-    unsafe { GetNamedPipeClientProcessId(HANDLE(client.as_raw_handle()), &mut id)? };
-    let process = unsafe { Owned::new(OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, false, id)?) };
-    let mut path = [0u16; 1024];
-    let mut len = path.len() as u32;
-    let flags = PROCESS_NAME_WIN32;
-    unsafe { QueryFullProcessImageNameW(*process, flags, PWSTR(path.as_mut_ptr()), &mut len)? };
-    let path = String::from_utf16(&path[..len as usize])?;
-    let tray = std::env::current_exe()?.with_file_name("firewall-tray.exe");
-    // Windows paths ignore case.
-    Ok(path.to_lowercase() == tray.to_string_lossy().to_lowercase())
-}
-
-/// Elevated, as only an elevated token has the Administrators group enabled.
-fn client_is_admin(client: &NamedPipeServer) -> windows::core::Result<bool> {
-    let mut sid = [0u32; SECURITY_MAX_SID_SIZE as usize / 4];
-    let admins = PSID(sid.as_mut_ptr().cast());
-    let mut size = SECURITY_MAX_SID_SIZE;
-    unsafe { CreateWellKnownSid(WinBuiltinAdministratorsSid, None, Some(admins), &mut size)? };
-    unsafe { ImpersonateNamedPipeClient(HANDLE(client.as_raw_handle()))? };
-    let mut member = false.into();
-    let checked = unsafe { CheckTokenMembership(None, admins, &mut member) };
-    // Carrying on as the client would be worse than stopping.
-    if unsafe { RevertToSelf() }.is_err() {
-        std::process::abort();
-    }
-    checked?;
-    Ok(member.as_bool())
-}

core/src/os/windows/service.rs

@@ -1,8 +1,6 @@
 use super::ca::{load_or_create_ca, secure_data_dir};
 use super::tpm::CaKey;
-use super::{
-    config_file, loopback_addresses, pipe, write_hosts_entries, CRL_ADDRESS, SERVICE_NAME,
-};
+use super::{config_file, loopback_addresses, write_hosts_entries, CRL_ADDRESS, SERVICE_NAME};
 use crate::config::FirewallConfig;
 use crate::http::{reply, text};
 use crate::{mitm, telemetry, Firewall};
@@ -155,13 +153,6 @@ async fn start_screening(status: &ServiceStatusHandle) -> Result<Vec<&'static st
     let crl = HttpServer::auto(exec.clone()).service(crl);
     tokio::spawn(listen_on(CRL_ADDRESS, 80, &exec)?.serve(crl));
 
-    let tray_firewall = Arc::clone(&firewall);
-    tokio::spawn(async move {
-        if let Err(error) = pipe::serve(tray_firewall).await {
-            tracing::error!(%error, "the tray cannot reach the service");
-        }
-    });
-
     let service = mitm::mitm_service(firewall, &ca, signer, Some(crl_url), exec.clone());
     for (address, host) in loopback_addresses(&hosts) {
         for port in [80, 443] {

core/src/os/windows/tray.rs

@@ -1,53 +1,27 @@
 //! The notification-area icon, started at sign-in as the menu bar app is on macOS.
 
-use super::pipe::PIPE;
 use super::*;
-use muda::{IsMenuItem, Menu, MenuEvent, MenuItem, PredefinedMenuItem, Submenu};
-use serde::Deserialize;
-use std::io::{BufRead, BufReader, Cursor, Write};
-use std::os::windows::io::AsRawHandle;
-use std::sync::mpsc::{channel, Receiver, Sender};
+use muda::{Menu, MenuEvent, MenuItem, PredefinedMenuItem};
+use std::io::Cursor;
 use std::time::Duration;
 use tray_icon::{Icon, MouseButtonState, TrayIcon, TrayIconBuilder, TrayIconEvent};
-use windows::core::{w, HRESULT, PCWSTR};
+use windows::core::{w, PCWSTR};
 use windows::Win32::Foundation::*;
-use windows::Win32::System::LibraryLoader::GetModuleHandleW;
-use windows::Win32::System::Pipes::GetNamedPipeServerProcessId;
-use windows::Win32::System::Threading::*;
-use windows::Win32::UI::Controls::*;
+use windows::Win32::System::Threading::CreateMutexW;
 use windows::Win32::UI::Shell::*;
 use windows::Win32::UI::WindowsAndMessaging::*;
 use windows_registry::CURRENT_USER;
-use windows_service::service::{Service, ServiceAccess, ServiceState, ServiceStatus};
+use windows_service::service::{Service, ServiceAccess, ServiceState};
 use windows_service::service_manager::{ServiceManager, ServiceManagerAccess};
 
 const MENU_PAUSE: &str = "pause";
 const MENU_RESTART: &str = "restart";
 const MENU_LOG: &str = "log";
 const MENU_QUIT: &str = "quit";
-/// Also the service's requests, and `allow` the elevated `firewall-tray` command.
-const ALLOW: &str = "allow";
-const ALLOW_ONCE: &str = "allow-once";
 const LOGO: &[u8] = include_bytes!("tray.png");
-/// Where blocked packages are listed, below Open logs.
-const BLOCKED_AT: usize = 5;
-const BLOCKED_KEPT: usize = 10;
 
 /// Runs until Quit, once per session.
 pub fn run() -> Result<(), BoxError> {
-    let args: Vec<String> = std::env::args().skip(1).collect();
-    if let [verb, id, label @ ..] = &args[..] {
-        if verb == ALLOW {
-            // Run by `run_elevated`, so the service can tell an admin asked.
-            let trusted = ask_service(&format!("{ALLOW} {id}"))
-                .and_then(|reply| answered(&format!("Trusted {}", label.join(" ")), &reply));
-            if let Err(error) = trusted {
-                show_error(error);
-                std::process::exit(1);
-            }
-            return Ok(());
-        }
-    }
     // Held until we exit.
     let _mutex = unsafe { CreateMutexW(None, false, w!(r"Local\StrixFirewallTray"))? };
     if unsafe { GetLastError() } == ERROR_ALREADY_EXISTS {
@@ -55,7 +29,6 @@ pub fn run() -> Result<(), BoxError> {
     }
     let status = MenuItem::new("", false, None);
     let pause = MenuItem::with_id(MENU_PAUSE, "", false, None);
-    let blocked_separator = PredefinedMenuItem::separator();
     let menu = Menu::with_items(&[
         &status,
         &PredefinedMenuItem::separator(),
@@ -66,9 +39,7 @@ pub fn run() -> Result<(), BoxError> {
         &MenuItem::with_id(MENU_QUIT, "Quit", true, None),
     ])?;
     let (logo, logo_size) = logo_mask()?;
-    let icon = TrayIconBuilder::new()
-        .with_menu(Box::new(menu.clone()))
-        .build()?;
+    let icon = TrayIconBuilder::new().with_menu(Box::new(menu)).build()?;
     let window = HWND(icon.window_handle());
     let mut tray = Tray {
         icon,
@@ -78,14 +49,9 @@ pub fn run() -> Result<(), BoxError> {
         status,
         pause,
         state: None,
-        menu,
-        blocked_separator,
-        blocked: Vec::new(),
-        allowed: channel(),
     };
     tray.update();
-    // The service holds a new package's download only while it is asked this often.
-    unsafe { SetTimer(None, 0, 500, None) };
+    unsafe { SetTimer(None, 0, 2000, None) };
     let mut message = MSG::default();
     while unsafe { GetMessageW(&mut message, None, 0, 0) }.0 > 0 {
         unsafe { DispatchMessageW(&message) };
@@ -96,7 +62,6 @@ pub fn run() -> Result<(), BoxError> {
         // Ours, not the icon window's own hover timer.
         if message.message == WM_TIMER && message.hwnd.is_invalid() {
             tray.update();
-            tray.collect_blocks();
         }
         while let Ok(event) = TrayIconEvent::receiver().try_recv() {
             // The menu opens on release, so this keeps it current.
@@ -129,47 +94,11 @@ struct Tray {
     pause: MenuItem,
     /// As the menu last showed it.
     state: Option<ServiceState>,
-    menu: Menu,
-    blocked_separator: PredefinedMenuItem,
-    /// The most recent, as the menu lists them.
-    blocked: Vec<BlockedPackage>,
-    /// Allowed from another thread, so no longer listed.
-    allowed: (Sender<BlockedPackage>, Receiver<BlockedPackage>),
-}
-
-#[derive(Clone, PartialEq, Deserialize)]
-struct BlockedPackage {
-    id: u64,
-    eco: String,
-    name: String,
-    version: Option<String>,
-    filter: String,
-    reason: String,
-}
-
-impl BlockedPackage {
-    fn label(&self) -> String {
-        match &self.version {
-            Some(version) => format!("{} {version} ({})", self.name, self.eco),
-            None => format!("{} ({})", self.name, self.eco),
-        }
-    }
-
-    /// The denylist and OSV only flag packages known to be malicious; the age check only holds
-    /// back new ones.
-    fn malicious(&self) -> bool {
-        self.filter != "age"
-    }
-
-    /// Malware is never allowed, and a new package only by version.
-    fn trustable(&self) -> bool {
-        !self.malicious() && self.version.is_some()
-    }
 }
 
 impl Tray {
     fn update(&mut self) {
-        self.state = service_status().map(|status| status.current_state);
+        self.state = service_state();
         let screening = self.state == Some(ServiceState::Running);
         let light = light_taskbar();
         if self.drawn != Some((light, screening)) {
@@ -188,88 +117,7 @@ impl Tray {
         self.pause.set_enabled(self.state.is_some());
     }
 
-    /// The service hands each block over once, so whichever tray asks first shows it.
-    fn collect_blocks(&mut self) {
-        let allowed: Vec<_> = self.allowed.1.try_iter().collect();
-        if !allowed.is_empty() {
-            self.blocked.retain(|blocked| !allowed.contains(blocked));
-            self.list_blocked();
-        }
-        if self.state != Some(ServiceState::Running) {
-            return;
-        }
-        let Ok(reply) = ask_service("blocks") else {
-            return;
-        };
-        let Ok(packages) = serde_json::from_str::<Vec<BlockedPackage>>(&reply) else {
-            return;
-        };
-        let mut new = Vec::new();
-        for package in packages {
-            if !self.blocked.contains(&package) {
-                self.blocked.push(package.clone());
-                new.push(package);
-            }
-        }
-        if new.is_empty() {
-            return;
-        }
-        let excess = self.blocked.len().saturating_sub(BLOCKED_KEPT);
-        self.blocked.drain(..excess);
-        self.list_blocked();
-        // Off the UI thread, so the menu keeps working while they are open.
-        let allowed = self.allowed.0.clone();
-        std::thread::spawn(move || {
-            for package in new {
-                if let Some(trust) = alert(&package) {
-                    allow(package, trust, &allowed);
-                }
-            }
-        });
-    }
-
-    fn list_blocked(&self) {
-        while self.menu.items().len() > BLOCKED_AT + 2 {
-            self.menu.remove_at(BLOCKED_AT);
-        }
-        let _ = self.menu.insert(&self.blocked_separator, BLOCKED_AT);
-        for (i, package) in self.blocked.iter().enumerate() {
-            let verb = if package.malicious() {
-                "Blocked"
-            } else {
-                "Held back"
-            };
-            let reason = if package.malicious() {
-                format!("Malicious: {}", package.reason)
-            } else {
-                package.reason.clone()
-            };
-            let reason = MenuItem::new(reason, false, None);
-            let trustable = package.trustable();
-            let once = MenuItem::with_id(format!("{ALLOW_ONCE}:{i}"), "Allow Once", trustable, None);
-            let always = MenuItem::with_id(format!("{ALLOW}:{i}"), "Trust this version", trustable, None);
-            let items: &[&dyn IsMenuItem] = if package.malicious() {
-                &[&reason]
-            } else {
-                &[&reason, &once, &always]
-            };
-            let label = format!("{verb} {}", package.label());
-            if let Ok(item) = Submenu::with_items(label, true, items) {
-                let _ = self.menu.insert(&item, BLOCKED_AT + 1 + i);
-            }
-        }
-    }
-
     fn on_menu(&self, id: &str) {
-        if let Some((verb @ (ALLOW | ALLOW_ONCE), i)) = id.split_once(':') {
-            let trust = verb == ALLOW;
-            let package = i.parse().ok().and_then(|i: usize| self.blocked.get(i));
-            if let Some(package) = package.cloned() {
-                let allowed = self.allowed.0.clone();
-                std::thread::spawn(move || allow(package, trust, &allowed));
-            }
-            return;
-        }
         let state = self.state;
         let screening = state == Some(ServiceState::Running);
         let action: fn() -> Result<(), BoxError> = match id {
@@ -295,144 +143,6 @@ impl Tray {
     }
 }
 
-const ALLOW_ONCE_BUTTON: i32 = 100;
-const TRUST_BUTTON: i32 = 101;
-/// `firewall.rc`'s icon, embedded by `build.rs`.
-const STRIX_ICON: PCWSTR = PCWSTR(1 as _);
-
-/// `Some(true)` if the user chose to trust it, `Some(false)` to allow it once.
-/// A task dialog, as a message box can't have both buttons.
-fn alert(package: &BlockedPackage) -> Option<bool> {
-    let text = format!("{} {}.", package.label(), package.reason);
-    let (title, text, icon) = if package.malicious() {
-        let title = format!("Blocked malware: {}", package.label());
-        let text = text
-            + "\n\nIt was not installed. Don't install it from another source. If you didn't expect this "
-            + "package, a dependency may be compromised; tell your security team.";
-        (title, text, TD_ERROR_ICON)
-    } else {
-        ("Held back a new package".to_owned(), text, STRIX_ICON)
-    };
-    let button = |id, text| TASKDIALOG_BUTTON { nButtonID: id, pszButtonText: text };
-    let allow = [button(ALLOW_ONCE_BUTTON, w!("Allow Once")), button(TRUST_BUTTON, w!("Trust this version"))];
-    let buttons: &[_] = if package.trustable() { &allow } else { &[] };
-    let (title, text) = (HSTRING::from(title), HSTRING::from(text));
-    let dialog = TASKDIALOGCONFIG {
-        cbSize: size_of::<TASKDIALOGCONFIG>() as u32,
-        // Where `STRIX_ICON` is loaded from; the `TD_` icons are Windows'.
-        hInstance: unsafe { GetModuleHandleW(None) }.ok()?.into(),
-        dwCommonButtons: TDCBF_CLOSE_BUTTON,
-        pszWindowTitle: w!("Strix Firewall"),
-        Anonymous1: TASKDIALOGCONFIG_0 { pszMainIcon: icon },
-        pszMainInstruction: PCWSTR(title.as_ptr()),
-        pszContent: PCWSTR(text.as_ptr()),
-        cButtons: buttons.len() as u32,
-        pButtons: buttons.as_ptr(),
-        pfCallback: Some(on_dialog),
-        ..Default::default()
-    };
-    let mut chosen = 0;
-    unsafe { TaskDialogIndirect(&dialog, Some(&raw mut chosen), None, None) }.ok()?;
-    match chosen {
-        ALLOW_ONCE_BUTTON => Some(false),
-        TRUST_BUTTON => Some(true),
-        _ => None,
-    }
-}
-
-/// Asks for the foreground, as `MB_SETFOREGROUND` did; Windows may still leave it behind.
-unsafe extern "system" fn on_dialog(
-    window: HWND,
-    event: TASKDIALOG_NOTIFICATIONS,
-    _: WPARAM,
-    _: LPARAM,
-    _: isize,
-) -> HRESULT {
-    if event == TDN_CREATED {
-        let _ = unsafe { SetForegroundWindow(window) };
-    }
-    S_OK
-}
-
-/// Trusting writes the config for every user, so it goes through a UAC prompt.
-/// The elevated process shows its own errors and late replies.
-fn allow(package: BlockedPackage, trust: bool, allowed: &Sender<BlockedPackage>) {
-    let allowed_it = if trust {
-        run_elevated(&[ALLOW, &package.id.to_string(), &package.label()])
-            .map(|code| code == Some(0))
-    } else {
-        let title = format!("Allowed {} for the next minute", package.label());
-        ask_service(&format!("{ALLOW_ONCE} {}", package.id))
-            .and_then(|reply| answered(&title, &reply))
-            .map(|()| true)
-    };
-    match allowed_it {
-        Ok(true) => {
-            let _ = allowed.send(package);
-        }
-        Ok(false) => {}
-        Err(error) => show_error(error),
-    }
-}
-
-/// Tells the user, under `title`, when the install had already stopped waiting.
-fn answered(title: &str, reply: &str) -> Result<(), BoxError> {
-    match reply {
-        "ok" => Ok(()),
-        "late" => {
-            let text = "The install had already stopped waiting for it. Run it again to finish.";
-            let (title, text) = (HSTRING::from(title), HSTRING::from(text));
-            unsafe { MessageBoxW(None, &text, &title, MB_ICONINFORMATION | MB_SETFOREGROUND) };
-            Ok(())
-        }
-        other => Err(other.into()),
-    }
-}
-
-/// This program as an admin, waiting for its exit code; `None` if the user said no.
-fn run_elevated(args: &[&str]) -> Result<Option<u32>, BoxError> {
-    let exe = HSTRING::from(std::env::current_exe()?.as_path());
-    let parameters = HSTRING::from(args.join(" "));
-    let mut info = SHELLEXECUTEINFOW {
-        cbSize: size_of::<SHELLEXECUTEINFOW>() as u32,
-        fMask: SEE_MASK_NOCLOSEPROCESS,
-        lpVerb: w!("runas"),
-        lpFile: PCWSTR(exe.as_ptr()),
-        lpParameters: PCWSTR(parameters.as_ptr()),
-        nShow: SW_HIDE.0,
-        ..Default::default()
-    };
-    if let Err(error) = unsafe { ShellExecuteExW(&mut info) } {
-        if error.code() == ERROR_CANCELLED.to_hresult() {
-            return Ok(None);
-        }
-        return Err(error.into());
-    }
-    let process = unsafe { Owned::new(info.hProcess) };
-    unsafe { WaitForSingleObject(*process, INFINITE) };
-    let mut code = 1;
-    unsafe { GetExitCodeProcess(*process, &mut code)? };
-    Ok(Some(code))
-}
-
-/// One request per connection, as the service answers.
-fn ask_service(request: &str) -> Result<String, BoxError> {
-    let mut pipe = std::fs::OpenOptions::new()
-        .read(true)
-        .write(true)
-        .open(PIPE)?;
-    // Any program can create the pipe if it gets there before the service.
-    let mut server = 0;
-    unsafe { GetNamedPipeServerProcessId(HANDLE(pipe.as_raw_handle()), &mut server)? };
-    if service_status().and_then(|status| status.process_id) != Some(server) {
-        return Err("Another program is posing as the firewall service.".into());
-    }
-    pipe.write_all(format!("{request}\n").as_bytes())?;
-    let mut reply = String::new();
-    BufReader::new(pipe).read_line(&mut reply)?;
-    Ok(reply.trim_end().to_owned())
-}
-
 fn show_error(error: BoxError) {
     let text = match error.source() {
         Some(source) => format!("{error}: {source}"),
@@ -443,13 +153,13 @@ fn show_error(error: BoxError) {
 }
 
 /// `None` when the service is not installed.
-fn service_status() -> Option<ServiceStatus> {
+fn service_state() -> Option<ServiceState> {
     let manager =
         ServiceManager::local_computer(None::<&str>, ServiceManagerAccess::CONNECT).ok()?;
     let service = manager
         .open_service(SERVICE_NAME, ServiceAccess::QUERY_STATUS)
         .ok()?;
-    service.query_status().ok()
+    Some(service.query_status().ok()?.current_state)
 }
 
 fn light_taskbar() -> bool {
@@ -457,8 +167,7 @@ fn light_taskbar() -> bool {
     let Ok(key) = CURRENT_USER.open(personalize) else {
         return false;
     };
-    key.get_u32("SystemUsesLightTheme")
-        .is_ok_and(|light| light == 1)
+    key.get_u32("SystemUsesLightTheme").is_ok_and(|light| light == 1)
 }
 
 fn status_text(state: Option<ServiceState>) -> &'static str {

macos/App/BlockAlerts.swift

@@ -2,13 +2,13 @@ import AppKit
 import Security
 
 struct BlockedPackage: Codable, Hashable, Identifiable {
-    let id: UInt64
     let eco: String
     let name: String
     let version: String?
     let filter: String
     let reason: String
 
+    var id: String { "\(eco)/\(name)@\(version ?? "")" }
     var label: String { version.map { "\(name) \($0)" } ?? name }
     /// The denylist and OSV only flag packages known to be malicious; the age check only holds back new ones.
     var malicious: Bool { filter != "age" }
@@ -16,61 +16,25 @@ struct BlockedPackage: Codable, Hashable, Identifiable {
     var trustable: Bool { !malicious && version != nil }
 }
 
-enum Allowance {
-    /// For a minute, so the rest of that install can fetch it too.
-    case once
-    case always
-}
-
 @MainActor
 enum BlockAlert {
-    static func show(_ package: BlockedPackage) -> Allowance? {
+    /// Returns whether the user chose to trust the package.
+    static func show(_ package: BlockedPackage) -> Bool {
         let alert = NSAlert()
         alert.addButton(withTitle: "OK")
         if package.malicious {
             alert.alertStyle = .critical
             alert.messageText = "Blocked malware: \(package.label) (\(package.eco))"
-            setText(alert, "\(package.label) \(package.reason).\n\n"
+            alert.informativeText = "\(package.label) \(package.reason).\n\n"
                 + "It was not installed. Don't install it from another source. "
-                + "If you didn't expect this package, a dependency may be compromised; tell your security team.")
+                + "If you didn't expect this package, a dependency may be compromised; tell your security team."
         } else {
             alert.messageText = "Held back a new package"
-            setText(alert, "\(package.label) (\(package.eco)) \(package.reason).")
-            if package.trustable {
-                alert.addButton(withTitle: "Allow Once")
-                alert.addButton(withTitle: "Trust this version")
-            }
+            alert.informativeText = "\(package.label) (\(package.eco)) \(package.reason)."
+            if package.trustable { alert.addButton(withTitle: "Trust this version") }
         }
         NSApp.activate(ignoringOtherApps: true)
-        switch alert.runModal() {
-        case .alertSecondButtonReturn: return .once
-        case .alertThirdButtonReturn: return .always
-        default: return nil
-        }
-    }
-
-    static func late(_ package: BlockedPackage, _ allowance: Allowance) {
-        let alert = NSAlert()
-        alert.messageText = allowance == .once ? "Allowed \(package.label) for the next minute" : "Trusted \(package.label)"
-        alert.informativeText = "The install had already stopped waiting for it. Run it again to finish."
-        NSApp.activate(ignoringOtherApps: true)
-        alert.runModal()
-    }
-
-    /// An alert's own text is plain, so this text goes in a selectable field, where its links open on click.
-    private static func setText(_ alert: NSAlert, _ text: String) {
-        let linked = NSMutableAttributedString(string: text, attributes: [.font: NSFont.systemFont(ofSize: NSFont.smallSystemFontSize)])
-        let detector = try! NSDataDetector(types: NSTextCheckingResult.CheckingType.link.rawValue)
-        for match in detector.matches(in: text, range: NSRange(text.startIndex..., in: text)) {
-            if let url = match.url { linked.addAttribute(.link, value: url, range: match.range) }
-        }
-        let field = NSTextField(wrappingLabelWithString: "")
-        field.allowsEditingTextAttributes = true
-        field.isSelectable = true
-        field.attributedStringValue = linked
-        field.preferredMaxLayoutWidth = 300
-        field.frame.size = field.fittingSize
-        alert.accessoryView = field
+        return alert.runModal() == .alertSecondButtonReturn
     }
 }
 

macos/App/FirewallModel.swift

@@ -203,22 +203,26 @@ final class FirewallModel: NSObject, ObservableObject {
         if let url = URL(string: pane) { NSWorkspace.shared.open(url) }
     }
 
-    /// Trusting changes the config for every user, so it takes an admin.
-    func allow(_ package: BlockedPackage, _ allowance: Allowance) async {
+    /// Allowing a version writes it into the extension's config, which a restart then loads.
+    func trust(_ package: BlockedPackage) async {
         guard package.trustable else { return }
-        if allowance == .always, !AdminAuthorization.confirm() {
+        guard AdminAuthorization.confirm() else {
             log("Trust cancelled for \(package.label)")
             return
         }
         do {
-            let reply = try await providerMessage("\(allowance == .once ? "allow-once" : "allow") \(package.id)")
-            guard reply == "ok" || reply == "late" else { throw FirewallError.extensionRefused(reply) }
+            var request = ["eco": package.eco, "name": package.name]
+            request["version"] = package.version
+            let json = String(decoding: try JSONSerialization.data(withJSONObject: request), as: UTF8.self)
+            let reply = try await providerMessage("allow \(json)")
+            guard reply == "ok" else { throw FirewallError.extensionRefused(reply) }
             blocked.removeAll { $0 == package }
-            log("Allowed \(package.label) (\(package.eco)) \(allowance)")
-            if reply == "late" { BlockAlert.late(package, allowance) }
+            log("Trusted \(package.label) (\(package.eco))")
         } catch {
-            log("Could not allow \(package.label): \(error.localizedDescription)")
+            log("Could not trust \(package.label): \(error.localizedDescription)")
+            return
         }
+        await restart()
     }
 
     /// The extension cannot message the app, so the app asks it for blocks.
@@ -228,11 +232,11 @@ final class FirewallModel: NSObject, ObservableObject {
                let packages = try? JSONDecoder().decode([BlockedPackage].self, from: Data(reply.utf8)) {
                 for package in packages where !blocked.contains(package) {
                     blocked.append(package)
-                    if let allowance = BlockAlert.show(package) { await allow(package, allowance) }
+                    if BlockAlert.show(package) { await trust(package) }
                 }
                 blocked = Array(blocked.suffix(10))
             }
-            try? await Task.sleep(nanoseconds: 500_000_000)
+            try? await Task.sleep(nanoseconds: 2_000_000_000)
         }
     }
 

macos/App/MenuBarView.swift

@@ -29,12 +29,8 @@ struct MenuBarView: View {
                 if !package.malicious {
                     Menu("Held back \(package.label) (\(package.eco))") {
                         Text(package.reason)
-                        Button("Allow Once") {
-                            Task { await model.allow(package, .once) }
-                        }
-                        .disabled(model.busy || !package.trustable)
                         Button("Trust this version") {
-                            Task { await model.allow(package, .always) }
+                            Task { await model.trust(package) }
                         }
                         .disabled(model.busy || !package.trustable)
                     }