Use a CA enrolled by MDM when one is installed

Managed Macs can enroll a CA over ACME with a Secure Enclave key, signed by a root the MDM trusts, so standard users never need to trust a CA. Leaves are now issued from the CA certificate itself, since a managed CA's subject is not ours.

core/Cargo.lock

@@ -3111,7 +3111,6 @@ dependencies = [
  "tracing",
  "tracing-subscriber",
  "which",
- "windows",
 ]
 
 [[package]]
@@ -3710,89 +3709,12 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
-[[package]]
-name = "windows"
-version = "0.62.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "527fadee13e0c05939a6a05d5bd6eec6cd2e3dbd648b9f8e447c6518133d8580"
-dependencies = [
- "windows-collections",
- "windows-core",
- "windows-future",
- "windows-numerics",
-]
-
-[[package]]
-name = "windows-collections"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23b2d95af1a8a14a3c7367e1ed4fc9c20e0a26e79551b1454d72583c97cc6610"
-dependencies = [
- "windows-core",
-]
-
-[[package]]
-name = "windows-core"
-version = "0.62.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
-dependencies = [
- "windows-implement",
- "windows-interface",
- "windows-link",
- "windows-result",
- "windows-strings",
-]
-
-[[package]]
-name = "windows-future"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e1d6f90251fe18a279739e78025bd6ddc52a7e22f921070ccdc67dde84c605cb"
-dependencies = [
- "windows-core",
- "windows-link",
- "windows-threading",
-]
-
-[[package]]
-name = "windows-implement"
-version = "0.60.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "windows-interface"
-version = "0.59.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
 [[package]]
 name = "windows-link"
 version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
 
-[[package]]
-name = "windows-numerics"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e2e40844ac143cdb44aead537bbf727de9b044e107a0f1220392177d15b0f26"
-dependencies = [
- "windows-core",
- "windows-link",
-]
-
 [[package]]
 name = "windows-result"
 version = "0.4.1"
@@ -3802,15 +3724,6 @@ dependencies = [
  "windows-link",
 ]
 
-[[package]]
-name = "windows-strings"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
-dependencies = [
- "windows-link",
-]
-
 [[package]]
 name = "windows-sys"
 version = "0.52.0"
@@ -3845,15 +3758,6 @@ dependencies = [
  "windows_x86_64_msvc",
 ]
 
-[[package]]
-name = "windows-threading"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3949bd5b99cafdf1c7ca86b43ca564028dfe27d66958f2470940f73d86d75b37"
-dependencies = [
- "windows-link",
-]
-
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.52.6"

core/Cargo.toml

@@ -52,10 +52,6 @@ path = "tests/age.rs"
 name = "mitm"
 path = "tests/mitm.rs"
 
-[[test]]
-name = "tpm"
-path = "tests/tpm.rs"
-
 [[test]]
 name = "managers"
 path = "tests/managers.rs"
@@ -66,7 +62,7 @@ directories = "6.0.0"
 percent-encoding = "2.3.2"
 rama = { version = "0.4.0", features = ["boring", "http-full", "ring", "rustls"] }
 rand = "0.10.2"
-rcgen = "0.14.10"
+rcgen = { version = "0.14.10", features = ["x509-parser"] }
 regex = "1.13.1"
 semver = "1.0.28"
 serde = { version = "1.0.229", features = ["derive"] }
@@ -80,12 +76,9 @@ which = "8"
 [target.'cfg(target_vendor = "apple")'.dependencies]
 core-foundation = "0.10.1"
 rama = { version = "0.4.0", features = ["net-apple-networkextension"] }
-security-framework = "3.7.0"
+security-framework = { version = "3.7.0", features = ["macos-12"] }
 security-framework-sys = "2.17.0"
 
-[target.'cfg(windows)'.dependencies]
-windows = { version = "0.62", features = ["Win32_Foundation", "Win32_Security_Cryptography"] }
-
 [dev-dependencies]
 tokio = { version = "1.53.1", features = ["macros", "rt-multi-thread"] }
 

core/src/aliasing/forward.rs

@@ -82,7 +82,7 @@ async fn handle(req: Request, firewall: &Firewall) -> Result<Response, Infallibl
     };
 
     let reason = policies::screen(&url, firewall).await;
-    telemetry::screened(firewall, &url, reason.as_deref());
+    telemetry::screened(firewall, &url, reason.is_some());
     if let Some(reason) = reason {
         warn!(method = %req.method(), %url, %reason, "blocked");
         return Ok(blocked(&reason));

core/src/config/mod.rs

@@ -1,7 +1,6 @@
 use crate::policies::registries::{Registry, BUILT_IN};
 use directories::ProjectDirs;
 use serde::Deserialize;
-use serde_json::{Map, Value};
 use std::collections::HashMap;
 use std::io::{Error, ErrorKind};
 use std::path::PathBuf;
@@ -69,31 +68,18 @@ impl Default for DenylistSource {
 }
 
 impl FirewallConfig {
+    /// A missing file means defaults; a bad one is an error, so the policy is never quietly relaxed.
     pub fn load() -> std::io::Result<Self> {
-        let mut paths: Vec<PathBuf> = path().into_iter().collect();
-        paths.extend(crate::os::system_config());
-        Self::load_from(&paths)
-    }
-
-    /// Later files win key by key, but allow lists add up.
-    /// A bad file is an error, so the policy is never quietly relaxed.
-    pub fn load_from(paths: &[PathBuf]) -> std::io::Result<Self> {
-        let mut merged = Map::new();
-        for path in paths {
-            let text = match std::fs::read_to_string(path) {
-                Ok(text) => text,
-                Err(e) if e.kind() == ErrorKind::NotFound => continue,
-                Err(e) => return Err(Error::new(e.kind(), format!("{}: {e}", path.display()))),
-            };
-            let invalid = |e| Error::new(ErrorKind::InvalidData, format!("{}: {e}", path.display()));
-            let layer: Value = serde_json::from_str(&text).map_err(invalid)?;
-            FirewallConfig::deserialize(&layer).map_err(invalid)?;
-            let Value::Object(layer) = layer else {
-                unreachable!("a config parses only from an object");
-            };
-            merge(&mut merged, layer);
-        }
-        Ok(serde_json::from_value(Value::Object(merged)).expect("each layer parsed on its own"))
+        let Some(path) = path() else {
+            return Ok(Self::default());
+        };
+        let text = match std::fs::read_to_string(&path) {
+            Ok(text) => text,
+            Err(e) if e.kind() == ErrorKind::NotFound => return Ok(Self::default()),
+            Err(e) => return Err(Error::new(e.kind(), format!("{}: {e}", path.display()))),
+        };
+        serde_json::from_str(&text)
+            .map_err(|e| Error::new(ErrorKind::InvalidData, format!("{}: {e}", path.display())))
     }
 
     pub fn local_url(&self, path: &str) -> String {
@@ -117,15 +103,3 @@ pub fn path() -> Option<PathBuf> {
     let dirs = ProjectDirs::from("com", "usestrix", "firewall")?;
     Some(dirs.config_dir().join("config.json"))
 }
-
-fn merge(base: &mut Map<String, Value>, top: Map<String, Value>) {
-    for (key, value) in top {
-        match (base.get_mut(&key), value) {
-            (Some(Value::Object(base)), Value::Object(top)) => merge(base, top),
-            (Some(Value::Array(base)), Value::Array(top)) => base.extend(top),
-            (_, value) => {
-                base.insert(key, value);
-            }
-        }
-    }
-}

core/src/main.rs

@@ -56,7 +56,6 @@ fn options() -> Command {
 }
 
 fn serve() -> ! {
-    telemetry::set_mode("proxy");
     let config = load();
     let port = config.port;
     print_setup(&config);
@@ -84,7 +83,6 @@ fn uninstall() -> ! {
 }
 
 fn run(invocation: Invocation) -> ! {
-    telemetry::set_mode("wrapper");
     let command = &invocation.program;
     let port = match aliasing::spawn(0, load()) {
         Ok(port) => port,

core/src/mitm/ca.rs

@@ -1,5 +1,4 @@
 use rama::error::BoxError;
-use rama::tls::boring::core::sha::sha256;
 use rama::tls::boring::core::x509::X509;
 use rcgen::{
     BasicConstraints, CertificateParams, CertificateRevocationListParams, DistinguishedName,
@@ -9,7 +8,7 @@ use rcgen::{
 use std::sync::Arc;
 use time::{Duration, OffsetDateTime};
 
-/// Held in the Secure Enclave on macOS, the TPM on Windows, in memory elsewhere.
+/// Held in the Secure Enclave on macOS, in memory elsewhere.
 pub type CaSigner = Arc<dyn SigningKey + Send + Sync>;
 
 pub struct CertificateAuthority {
@@ -40,13 +39,8 @@ impl CertificateAuthority {
         (held == signer.subject_public_key_info()).then_some(ca)
     }
 
-    /// Unique to this CA, so a verifier's cached CRL from an earlier one never applies to it.
-    pub fn crl_path(&self) -> String {
-        let digest = sha256(self.pem.as_bytes());
-        format!("/{}.crl", digest[..8].iter().map(|b| format!("{b:02x}")).collect::<String>())
-    }
-
-    fn new(pem: String) -> Result<Self, BoxError> {
+    /// The first certificate is the CA; any after it are its chain, for clients that read no keychain.
+    pub fn new(pem: String) -> Result<Self, BoxError> {
         Ok(Self { crt: X509::from_pem(pem.as_bytes())?, pem })
     }
 }
@@ -68,9 +62,10 @@ pub fn crl(hosts: &[&str], signer: &dyn SigningKey) -> Result<Vec<u8>, BoxError>
 }
 
 pub const COMMON_NAME: &str = "Strix Firewall";
+/// Of a CA an MDM enrolls instead, which must not match `COMMON_NAME`: uninstall deletes those.
+pub const MANAGED_COMMON_NAME: &str = "Strix Firewall Managed";
 
-/// Also used by the issuer, whose issuer name must match the CA's subject.
-pub fn params(hosts: &[&str]) -> CertificateParams {
+fn params(hosts: &[&str]) -> CertificateParams {
     let mut name = DistinguishedName::new();
     name.push(DnType::CommonName, COMMON_NAME);
     name.push(DnType::OrganizationName, "Strix");

core/src/mitm/issuer.rs

@@ -1,17 +1,15 @@
-use super::ca::{params, CaSigner};
+use super::ca::CaSigner;
 use rama::error::BoxError;
 use rama::tls::boring::core::pkey::PKey;
 use rama::tls::boring::core::x509::X509;
 use rama::tls::boring::proxy::cert_issuer::{BoringMitmCertIssuer, MitmIssuedCert};
 use rama::utils::collections::non_empty_vec;
 use rcgen::{CertificateParams, CrlDistributionPoint, DistinguishedName, DnType, Issuer, KeyPair};
-use std::sync::Arc;
 
 /// Leaves name only screened hosts; any other name falls outside the CA's constraint.
 #[derive(Clone)]
 pub struct ConstrainedCertIssuer {
     ca_crt: X509,
-    ca_params: Arc<CertificateParams>,
     signer: CaSigner,
     hosts: Vec<&'static str>,
     crl: Option<String>,
@@ -24,8 +22,7 @@ impl ConstrainedCertIssuer {
         hosts: Vec<&'static str>,
         crl: Option<String>,
     ) -> Self {
-        let ca_params = Arc::new(params(&hosts));
-        Self { ca_crt, ca_params, signer, hosts, crl }
+        Self { ca_crt, signer, hosts, crl }
     }
 }
 
@@ -54,7 +51,8 @@ impl BoringMitmCertIssuer for ConstrainedCertIssuer {
 
         // The TLS server needs the leaf key in memory, so it can't be the platform key.
         let leaf_key = KeyPair::generate()?;
-        let issuer = Issuer::from_params(&self.ca_params, &*self.signer);
+        let ca_der = self.ca_crt.to_der()?;
+        let issuer = Issuer::from_ca_cert_der(&ca_der.into(), &*self.signer)?;
         let crt = X509::from_der(leaf.signed_by(&leaf_key, &issuer)?.der())?;
         let key = PKey::private_key_from_pem(leaf_key.serialize_pem().as_bytes())?;
 

core/src/mitm/mod.rs

@@ -3,7 +3,7 @@ mod issuer;
 mod route;
 mod screen;
 
-pub use ca::{crl, CaSigner, CertificateAuthority, COMMON_NAME};
+pub use ca::{crl, CaSigner, CertificateAuthority, COMMON_NAME, MANAGED_COMMON_NAME};
 
 use crate::Firewall;
 use issuer::ConstrainedCertIssuer;

core/src/mitm/screen.rs

@@ -37,7 +37,7 @@ where
     async fn serve(&self, req: Request) -> Result<Response, Self::Error> {
         if let Some(url) = https_url(&req) {
             let reason = policies::screen(&url, &self.firewall).await;
-            telemetry::screened(&self.firewall, &url, reason.as_deref());
+            telemetry::screened(&self.firewall, &url, reason.is_some());
             if let Some(reason) = reason {
                 warn!(%url, "blocked by firewall: {reason}");
                 return Ok(blocked(&reason));

core/src/os/macos/enclave.rs

@@ -33,10 +33,17 @@ impl EnclaveKey {
             Some(blob) => load(&blob)?,
             None => create()?,
         };
+        Self::new(key)
+    }
+
+    pub fn new(key: SecKey) -> Result<Self, BoxError> {
         let public = key
             .public_key()
             .and_then(|public| public.external_representation())
             .ok_or("secure enclave key has no exportable public half")?;
+        if public.len() != 65 {
+            return Err("the CA key must be P-256".into());
+        }
         Ok(EnclaveKey { key, public: public.to_vec() })
     }
 

core/src/os/macos/install.rs

@@ -1,11 +1,53 @@
-use super::{CA_FILE, KEYCHAIN_ACCOUNT, KEYCHAIN_SERVICE};
-use crate::mitm::CertificateAuthority;
+use super::enclave::EnclaveKey;
+use super::{CA_FILE, KEYCHAIN_ACCOUNT, KEYCHAIN_SERVICE, SYSTEM_KEYCHAIN};
+use crate::mitm::{CertificateAuthority, MANAGED_COMMON_NAME};
 use rama::error::BoxError;
 use rama::net::apple::networkextension::system_keychain;
+use rama::tls::boring::core::x509::X509;
 use rcgen::SigningKey;
+use security_framework::item::{ItemClass, ItemSearchOptions, Limit, Reference, SearchResult};
+use security_framework::os::macos::keychain::SecKeychain;
+use security_framework::policy::SecPolicy;
+use security_framework::trust::SecTrust;
+use security_framework_sys::base::errSecItemNotFound;
 use std::path::Path;
 use tracing::{info, warn};
 
+/// A CA an MDM enrolled over ACME. The MDM trusts its issuer, so the user is never asked to.
+pub fn managed_certificate_authority(
+) -> Result<Option<(EnclaveKey, CertificateAuthority)>, BoxError> {
+    let found = ItemSearchOptions::new()
+        .class(ItemClass::identity())
+        .keychains(&[SecKeychain::open(SYSTEM_KEYCHAIN)?])
+        .load_refs(true)
+        .limit(Limit::All)
+        .search();
+    let results = match found {
+        Ok(results) => results,
+        Err(error) if error.code() == errSecItemNotFound => return Ok(None),
+        Err(error) => return Err(error.into()),
+    };
+    for result in results {
+        let SearchResult::Ref(Reference::Identity(identity)) = result else { continue };
+        let crt = identity.certificate()?;
+        if crt.subject_summary() != MANAGED_COMMON_NAME {
+            continue;
+        }
+        let key = EnclaveKey::new(identity.private_key()?)?;
+        let trust = SecTrust::create_with_certificates(&[crt], &[SecPolicy::create_x509()])?;
+        trust.evaluate_with_error().map_err(|e| format!("the managed CA is not trusted: {e}"))?;
+        let mut pem = String::new();
+        for crt in trust.chain() {
+            pem.push_str(std::str::from_utf8(&X509::from_der(&crt.to_der())?.to_pem()?)?);
+        }
+        let ca = CertificateAuthority::new(pem)?;
+        info!("using the CA enrolled by MDM");
+        export_pem(&ca);
+        return Ok(Some((key, ca)));
+    }
+    Ok(None)
+}
+
 /// Kept in the System keychain so trust survives restarts; replaced if the hosts change.
 pub fn certificate_authority(
     hosts: &[&str],

core/src/os/macos/mod.rs

@@ -23,7 +23,6 @@ use rama::rt::Executor;
 use rama::telemetry::tracing::apple::oslog::{OsLogLayer, Privacy};
 use rama::{Layer, Service};
 use std::convert::Infallible;
-use std::path::PathBuf;
 use std::sync::Arc;
 use tracing_subscriber::layer::SubscriberExt;
 use tracing_subscriber::util::SubscriberInitExt;
@@ -33,7 +32,7 @@ const KEYCHAIN_SERVICE: &str = BUNDLE_ID;
 const KEYCHAIN_ACCOUNT: &str = "ca";
 /// Must match `macos/LaunchAgents/com.usestrix.firewall.env.plist`, which points npm at it.
 const CA_FILE: &str = "/Library/Application Support/Firewall/ca.pem";
-const CONFIG_FILE: &str = "/Library/Application Support/Firewall/config.json";
+const SYSTEM_KEYCHAIN: &str = "/Library/Keychains/System.keychain";
 
 #[derive(Clone)]
 struct Handler {
@@ -99,20 +98,23 @@ impl TransparentProxyHandlerFactory for Factory {
     }
 }
 
-pub fn system_config() -> Option<PathBuf> {
-    Some(CONFIG_FILE.into())
-}
-
 fn handler(exec: Executor) -> Result<Handler, BoxError> {
-    telemetry::set_mode("extension");
     telemetry::heartbeat();
-    let config = FirewallConfig::load_from(&[CONFIG_FILE.into()]).inspect_err(|_| telemetry::error("config"))?;
+    let config = FirewallConfig::load().inspect_err(|_| telemetry::error("config"))?;
     let firewall = Arc::new(Firewall::new(config));
     let hosts = firewall.hosts();
-    let key = enclave::EnclaveKey::load_or_create().inspect_err(|_| telemetry::error("enclave"))?;
+    let managed = install::managed_certificate_authority().inspect_err(|_| telemetry::error("ca"))?;
+    let (key, ca) = match managed {
+        Some(managed) => managed,
+        None => {
+            let key = enclave::EnclaveKey::load_or_create()
+                .inspect_err(|_| telemetry::error("enclave"))?;
+            let ca = install::certificate_authority(&hosts, &key);
+            (key, ca.inspect_err(|_| telemetry::error("ca"))?)
+        }
+    };
     let signer: mitm::CaSigner = Arc::new(key);
-    let ca = install::certificate_authority(&hosts, &*signer);
-    let ca = Arc::new(ca.inspect_err(|_| telemetry::error("ca"))?);
+    let ca = Arc::new(ca);
     let service = mitm::mitm_service(firewall, &ca, signer, None, exec);
     Ok(Handler { ca, hosts, service })
 }

core/src/os/macos/uninstall.rs

@@ -1,5 +1,5 @@
 use super::enclave::EnclaveKey;
-use super::{CA_FILE, KEYCHAIN_ACCOUNT, KEYCHAIN_SERVICE};
+use super::{CA_FILE, KEYCHAIN_ACCOUNT, KEYCHAIN_SERVICE, SYSTEM_KEYCHAIN};
 use crate::mitm::COMMON_NAME;
 use rama::error::BoxError;
 use rama::net::apple::networkextension::system_keychain;
@@ -17,7 +17,7 @@ const ENV_AGENT: &str = "/Library/LaunchAgents/com.usestrix.firewall.env.plist";
 pub fn uninstall() -> Result<(), BoxError> {
     let deleted = ItemSearchOptions::new()
         .class(ItemClass::certificate())
-        .keychains(&[SecKeychain::open("/Library/Keychains/System.keychain")?])
+        .keychains(&[SecKeychain::open(SYSTEM_KEYCHAIN)?])
         .label(COMMON_NAME)
         .limit(Limit::All)
         .delete();

core/src/os/mod.rs

@@ -1,18 +1,11 @@
 #[cfg(target_os = "macos")]
 pub mod macos;
-#[cfg(windows)]
-pub mod windows;
 
 #[cfg(target_os = "macos")]
-pub use macos::{system_config, uninstall};
+pub use macos::uninstall;
 
 /// Elsewhere nothing is installed system-wide.
 #[cfg(not(target_os = "macos"))]
 pub fn uninstall() -> Result<(), rama::error::BoxError> {
     Ok(())
 }
-
-#[cfg(not(target_os = "macos"))]
-pub fn system_config() -> Option<std::path::PathBuf> {
-    None
-}

core/src/os/windows/mod.rs

@@ -1,3 +0,0 @@
-mod tpm;
-
-pub use tpm::CaKey;

core/src/os/windows/tpm.rs

@@ -1,153 +0,0 @@
-use rama::error::BoxError;
-use rama::tls::boring::core::bn::BigNum;
-use rama::tls::boring::core::ecdsa::EcdsaSig;
-use rama::tls::boring::core::sha::sha256;
-use rcgen::{Error, PublicKeyData, SignatureAlgorithm, SigningKey, PKCS_ECDSA_P256_SHA256};
-use windows::core::{Owned, Result as WinResult, HSTRING};
-use windows::Win32::Foundation::{NTE_BAD_KEY, NTE_BAD_KEYSET};
-use windows::Win32::Security::Cryptography::*;
-
-const KEY_NAME: &str = "Strix Firewall CA";
-
-/// A P-256 key held by the TPM. Signing asks the TPM to sign, so the private key never leaves it.
-pub struct CaKey {
-    // Fields drop in order, so the key handle closes before its provider's.
-    key_handle: Owned<NCRYPT_KEY_HANDLE>,
-    _provider_handle: Owned<NCRYPT_PROV_HANDLE>,
-    /// 0x04 || X || Y, the form rcgen writes into a certificate's SubjectPublicKeyInfo.
-    public_point: Vec<u8>,
-}
-
-impl CaKey {
-    /// A machine key, so the service and an elevated installer share it.
-    pub fn load_or_create() -> Result<Self, BoxError> {
-        match open_key(KEY_NAME, NCRYPT_MACHINE_KEY_FLAG)? {
-            Some(key) => Ok(key),
-            None => Ok(create_key(KEY_NAME, NCRYPT_MACHINE_KEY_FLAG)?),
-        }
-    }
-
-    /// A per-user key under a random name, which needs no elevation; `delete_from_tpm` it after.
-    pub fn create_test_key() -> WinResult<Self> {
-        let name = format!("Strix Firewall test {:016x}", rand::random::<u64>());
-        create_key(&name, NCRYPT_FLAGS(0))
-    }
-
-    /// Deletes the key from the TPM, not just this handle to it.
-    pub fn delete_from_tpm(mut self) -> WinResult<()> {
-        // NCryptDeleteKey also frees the handle, so the Owned mustn't free it again.
-        let key_handle = std::mem::take(&mut *self.key_handle);
-        unsafe { NCryptDeleteKey(key_handle, 0) }
-    }
-
-    /// Takes both handles and reads the key's public point once, for rcgen.
-    fn from_handles(
-        provider_handle: Owned<NCRYPT_PROV_HANDLE>,
-        key_handle: Owned<NCRYPT_KEY_HANDLE>,
-    ) -> WinResult<Self> {
-        // A BCRYPT_ECCKEY_BLOB header, then X and Y.
-        const HEADER_LEN: usize = size_of::<BCRYPT_ECCKEY_BLOB>();
-        let mut blob = [0u8; HEADER_LEN + 64];
-        let mut blob_len = 0;
-        unsafe {
-            NCryptExportKey(
-                *key_handle,
-                None,
-                BCRYPT_ECCPUBLIC_BLOB,
-                None,
-                Some(&mut blob),
-                &mut blob_len,
-                NCRYPT_FLAGS(0),
-            )?
-        };
-        let (header, x_and_y) = blob.split_at(HEADER_LEN);
-        let is_p256 = header[..4] == BCRYPT_ECDSA_PUBLIC_P256_MAGIC.to_le_bytes();
-        if !is_p256 || blob_len as usize != blob.len() {
-            return Err(windows::core::Error::new(NTE_BAD_KEY, "key is not an ECDSA P-256 key"));
-        }
-        let public_point = [&[0x04], x_and_y].concat();
-        Ok(CaKey { key_handle, _provider_handle: provider_handle, public_point })
-    }
-}
-
-impl PublicKeyData for CaKey {
-    fn der_bytes(&self) -> &[u8] {
-        &self.public_point
-    }
-
-    fn algorithm(&self) -> &'static SignatureAlgorithm {
-        &PKCS_ECDSA_P256_SHA256
-    }
-}
-
-impl SigningKey for CaKey {
-    fn sign(&self, msg: &[u8]) -> Result<Vec<u8>, Error> {
-        let mut r_and_s = [0u8; 64];
-        let mut signature_len = 0;
-        let signed = unsafe {
-            NCryptSignHash(
-                *self.key_handle,
-                None,
-                &sha256(msg),
-                Some(&mut r_and_s),
-                &mut signature_len,
-                NCRYPT_SILENT_FLAG,
-            )
-        };
-        signed.map_err(|_| Error::RemoteKeyError)?;
-        // NCrypt returns r || s, each half the length; X.509 wants DER SEQUENCE { r, s }.
-        let (r, s) = r_and_s[..signature_len as usize].split_at(signature_len as usize / 2);
-        let der = BigNum::from_slice(r)
-            .and_then(|r| EcdsaSig::from_private_components(r, BigNum::from_slice(s)?))
-            .and_then(|signature| signature.to_der());
-        der.map_err(|_| Error::RemoteKeyError)
-    }
-}
-
-/// `None` if the TPM holds no key by that name.
-/// `scope` is `NCRYPT_MACHINE_KEY_FLAG`, or empty for the current user's keys.
-fn open_key(name: &str, scope: NCRYPT_FLAGS) -> WinResult<Option<CaKey>> {
-    let provider_handle = open_tpm_provider()?;
-    let mut key_handle = NCRYPT_KEY_HANDLE::default();
-    let opened = unsafe {
-        NCryptOpenKey(
-            *provider_handle,
-            &mut key_handle,
-            &HSTRING::from(name),
-            CERT_KEY_SPEC::default(), // legacy, unused by the TPM provider
-            scope | NCRYPT_SILENT_FLAG,
-        )
-    };
-    match opened {
-        Err(error) if error.code() == NTE_BAD_KEYSET => Ok(None),
-        Err(error) => Err(error),
-        Ok(()) => CaKey::from_handles(provider_handle, unsafe { Owned::new(key_handle) }).map(Some),
-    }
-}
-
-/// Generates the key inside the TPM, which never lets it out.
-fn create_key(name: &str, scope: NCRYPT_FLAGS) -> WinResult<CaKey> {
-    let provider_handle = open_tpm_provider()?;
-    let mut key_handle = NCRYPT_KEY_HANDLE::default();
-    unsafe {
-        NCryptCreatePersistedKey(
-            *provider_handle,
-            &mut key_handle,
-            NCRYPT_ECDSA_P256_ALGORITHM,
-            &HSTRING::from(name),
-            CERT_KEY_SPEC::default(), // legacy, unused by the TPM provider
-            scope,
-        )?
-    };
-    let key_handle = unsafe { Owned::new(key_handle) };
-    // Until finalized the key is only a handle; this generates and stores it.
-    unsafe { NCryptFinalizeKey(*key_handle, NCRYPT_SILENT_FLAG)? };
-    CaKey::from_handles(provider_handle, key_handle)
-}
-
-/// The Microsoft Platform Crypto Provider, which keeps its keys in the TPM.
-fn open_tpm_provider() -> WinResult<Owned<NCRYPT_PROV_HANDLE>> {
-    let mut provider_handle = NCRYPT_PROV_HANDLE::default();
-    unsafe { NCryptOpenStorageProvider(&mut provider_handle, MS_PLATFORM_CRYPTO_PROVIDER, 0)? };
-    Ok(unsafe { Owned::new(provider_handle) })
-}

core/src/policies/mod.rs

@@ -72,9 +72,6 @@ pub async fn screen(url: &str, firewall: &Firewall) -> Option<String> {
         Some((_, Verdict::Deny(reason))) => {
             Some(format!("{} {reason}", pkg.label()))
         }
-        Some((filter, Verdict::Unknown(e))) if !firewall.config.fail_open => {
-            Some(format!("{} could not be checked by {filter} ({e})", pkg.label()))
-        }
         _ => None,
     }
 }

core/src/proxy/mod.rs

@@ -1,6 +1,6 @@
 use crate::http::{blocked, reply, text};
 use crate::policies::{self, Check, Decision};
-use crate::{telemetry, Firewall, FirewallConfig};
+use crate::{Firewall, FirewallConfig};
 use rama::http::body::util::BodyExt;
 use rama::http::client::EasyHttpWebClient;
 use rama::http::header::CONTENT_TYPE;
@@ -19,7 +19,6 @@ pub fn serve(config: FirewallConfig) -> std::io::Result<()> {
     bound.set_nonblocking(true)?;
     crate::runtime()?.block_on(async move {
         let firewall = Arc::new(Firewall::new(config));
-        telemetry::heartbeat();
         let exec = Executor::default();
         let listener = TcpListener::try_from_std_tcp_listener(bound, exec.clone())?;
         let server = HttpServer::auto(exec).service(service_fn(move |req: Request| {
@@ -45,7 +44,6 @@ async fn screen(target: String, firewall: &Firewall) -> Response {
         }
         Decision::Block { eco, pkg, filter, reason } => {
             let reason = format!("{} {reason}", pkg.label());
-            telemetry::screened_package(eco, &pkg, Some(&reason));
             warn!(%eco, %filter, "blocked by firewall: {reason}");
             blocked(&reason)
         }
@@ -53,11 +51,9 @@ async fn screen(target: String, firewall: &Firewall) -> Response {
             match &check {
                 Check::NoPackage => {}
                 Check::Allowed(pkg) => {
-                    telemetry::screened_package(target.eco, pkg, None);
                     info!(eco = %target.eco, pkg = %pkg.label(), "cleared by every filter")
                 }
                 Check::Unverified { pkg, filter, error } => {
-                    telemetry::screened_package(target.eco, pkg, None);
                     info!(pkg = %pkg.label(), %filter, %error, "filter could not check, allowing")
                 }
             }

core/src/telemetry.rs

@@ -1,11 +1,10 @@
-use crate::policies::Package;
 use crate::{Firewall, FirewallConfig};
 use rama::http::client::EasyHttpWebClient;
 use rama::http::header::CONTENT_TYPE;
 use rama::http::service::client::HttpClientExt;
 use rama::rt::blocking::Runtime;
 use serde_json::{json, Value};
-use std::sync::{LazyLock, Mutex, OnceLock};
+use std::sync::{LazyLock, Mutex};
 use std::time::Duration;
 use time::format_description::well_known::Rfc3339;
 use time::OffsetDateTime;
@@ -30,40 +29,29 @@ static TELEMETRY: LazyLock<Option<Telemetry>> = LazyLock::new(|| {
     })
 });
 
-/// How the firewall is running: "extension", "wrapper" or "proxy".
-static MODE: OnceLock<&'static str> = OnceLock::new();
-
 struct Telemetry {
     key: &'static str,
     session: String,
     events: Mutex<Vec<Value>>,
 }
 
-pub fn screened(firewall: &Firewall, url: &str, reason: Option<&str>) {
+pub fn screened(firewall: &Firewall, url: &str, blocked: bool) {
     if TELEMETRY.is_none() {
         return;
     }
     let Some((registry, rest)) = firewall.match_on(url, |r| r.upstream) else {
         return;
     };
-    if let Some(pkg) = firewall.resolve(registry, rest).pkg {
-        screened_package(registry.eco, &pkg, reason);
-    }
-}
-
-pub fn screened_package(eco: &str, pkg: &Package, reason: Option<&str>) {
-    let mut properties = json!({ "eco": eco, "blocked": reason.is_some() });
-    if let Some(reason) = reason {
+    let Some(pkg) = firewall.resolve(registry, rest).pkg else {
+        return;
+    };
+    let mut properties = json!({ "eco": registry.eco, "blocked": blocked });
+    if blocked {
         properties["package"] = pkg.label().into();
-        properties["reason"] = reason.into();
     }
     record("package_screened", properties);
 }
 
-pub fn set_mode(mode: &'static str) {
-    MODE.set(mode).ok();
-}
-
 pub fn error(kind: &'static str) {
     record("error", json!({ "kind": kind }));
 }
@@ -93,7 +81,6 @@ pub fn flush() {
 fn record(event: &str, mut properties: Value) {
     let Some(telemetry) = &*TELEMETRY else { return };
     properties["distinct_id"] = telemetry.session.clone().into();
-    properties["mode"] = MODE.get().copied().into();
     properties["os"] = std::env::consts::OS.into();
     properties["arch"] = std::env::consts::ARCH.into();
     properties["$process_person_profile"] = false.into();

core/tests/config.rs

@@ -1,6 +1,6 @@
 use firewall::config::path;
 use firewall::policies::filters::consult;
-use firewall::policies::{screen, Package};
+use firewall::policies::Package;
 use firewall::{Firewall, FirewallConfig};
 
 #[test]
@@ -21,23 +21,6 @@ fn the_config_lives_under_the_config_directory() {
     assert!(path.ends_with("config.json"), "{}", path.display());
 }
 
-#[test]
-fn a_later_file_wins_and_allow_lists_add_up() {
-    let dir = std::env::temp_dir().join(format!("firewall-layers-{}", std::process::id()));
-    std::fs::create_dir_all(&dir).expect("temp dir");
-    let user = dir.join("user.json");
-    let system = dir.join("system.json");
-    std::fs::write(&user, r#"{"min_age_hours": 1, "fail_open": false, "allow": {"npm": [{"name": "a"}]}}"#).expect("write");
-    std::fs::write(&system, r#"{"min_age_hours": 24, "allow": {"npm": [{"name": "b"}]}}"#).expect("write");
-    let missing = dir.join("missing.json");
-    let config = FirewallConfig::load_from(&[user, system, missing]).expect("loads");
-    std::fs::remove_dir_all(&dir).ok();
-    assert_eq!(config.min_age_hours, 24);
-    assert!(!config.fail_open);
-    let names: Vec<&str> = config.allow["npm"].iter().map(|p| p.name.as_str()).collect();
-    assert_eq!(names, ["a", "b"]);
-}
-
 #[tokio::test]
 async fn an_allowed_version_skips_the_filters() {
     // An unreachable denylist would otherwise leave the package unchecked.
@@ -48,12 +31,3 @@ async fn an_allowed_version_skips_the_filters() {
     assert!(consult(&firewall, registry, &pkg("0.20.0")).await.is_none());
     assert!(consult(&firewall, registry, &pkg("0.21.0")).await.is_some());
 }
-
-#[tokio::test]
-async fn failing_closed_blocks_what_could_not_be_checked() {
-    let config = r#"{"fail_open": false, "denylist": {"base": "http://127.0.0.1:1"}}"#;
-    let firewall = Firewall::new(serde_json::from_str(config).expect("parses"));
-    let url = "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz";
-    let blocked = screen(url, &firewall).await.unwrap_or_default();
-    assert!(blocked.contains("could not be checked"), "{blocked:?}");
-}

core/tests/mitm.rs

@@ -50,12 +50,3 @@ fn ca_signs_an_empty_crl() {
     let crl = mitm::crl(&["registry.npmjs.org", "pypi.org"], &signer()).expect("sign a crl");
     assert_eq!(crl[0], 0x30, "a DER SEQUENCE");
 }
-
-/// A re-minted CA must not inherit the old one's CRL from a verifier's cache.
-#[test]
-fn each_ca_names_its_own_crl() {
-    let signer = signer();
-    let npm = mitm::CertificateAuthority::generate(&["registry.npmjs.org"], &signer).expect("mint a ca");
-    let pypi = mitm::CertificateAuthority::generate(&["pypi.org"], &signer).expect("mint a ca");
-    assert_ne!(npm.crl_path(), pypi.crl_path());
-}

core/tests/tpm.rs

@@ -1,21 +0,0 @@
-#![cfg(windows)]
-
-use firewall::mitm::CertificateAuthority;
-use firewall::os::windows::CaKey;
-use rcgen::PublicKeyData;
-
-/// Skipped on machines without a TPM.
-#[test]
-fn key_signs_a_verifiable_ca() {
-    let key = match CaKey::create_test_key() {
-        Ok(key) => key,
-        Err(error) => return eprintln!("skipping, no TPM key: {error}"),
-    };
-    let ca = CertificateAuthority::generate(&["registry.npmjs.org"], &key);
-    let spki = key.subject_public_key_info();
-    key.delete_from_tpm().expect("delete the test key");
-    let ca = ca.expect("mint a ca");
-    let public = ca.crt.public_key().expect("ca public key");
-    assert!(ca.crt.verify(&public).expect("verify the ca"));
-    assert_eq!(public.public_key_to_der().unwrap(), spki);
-}

macos/App/AppIcon.icon/icon.json

@@ -1,24 +0,0 @@
-{
-  "fill" : {
-    "solid" : "srgb:0.07000,0.07000,0.07000,1.00000"
-  },
-  "groups" : [
-    {
-      "layers" : [
-        {
-          "image-name" : "logo.png",
-          "name" : "logo",
-          "position" : {
-            "scale" : 1.8,
-            "translation-in-points" : [0, 0]
-          }
-        }
-      ]
-    }
-  ],
-  "supported-platforms" : {
-    "squares" : [
-      "macOS"
-    ]
-  }
-}

macos/App/Assets.xcassets/AppIcon.appiconset/Contents.json

@@ -0,0 +1,68 @@
+{
+  "images": [
+    {
+      "idiom": "mac",
+      "size": "16x16",
+      "scale": "1x",
+      "filename": "icon_16.png"
+    },
+    {
+      "idiom": "mac",
+      "size": "16x16",
+      "scale": "2x",
+      "filename": "icon_32.png"
+    },
+    {
+      "idiom": "mac",
+      "size": "32x32",
+      "scale": "1x",
+      "filename": "icon_32.png"
+    },
+    {
+      "idiom": "mac",
+      "size": "32x32",
+      "scale": "2x",
+      "filename": "icon_64.png"
+    },
+    {
+      "idiom": "mac",
+      "size": "128x128",
+      "scale": "1x",
+      "filename": "icon_128.png"
+    },
+    {
+      "idiom": "mac",
+      "size": "128x128",
+      "scale": "2x",
+      "filename": "icon_256.png"
+    },
+    {
+      "idiom": "mac",
+      "size": "256x256",
+      "scale": "1x",
+      "filename": "icon_256.png"
+    },
+    {
+      "idiom": "mac",
+      "size": "256x256",
+      "scale": "2x",
+      "filename": "icon_512.png"
+    },
+    {
+      "idiom": "mac",
+      "size": "512x512",
+      "scale": "1x",
+      "filename": "icon_512.png"
+    },
+    {
+      "idiom": "mac",
+      "size": "512x512",
+      "scale": "2x",
+      "filename": "icon_1024.png"
+    }
+  ],
+  "info": {
+    "author": "xcode",
+    "version": 1
+  }
+}

macos/App/FirewallIDs.swift

@@ -4,4 +4,5 @@ enum FirewallIDs {
     static let appBundleID = "com.usestrix.firewall"
     static let extensionBundleID = "com.usestrix.firewall.extension"
     static let caCommonName = "Strix Firewall"
+    static let managedCaCommonName = "Strix Firewall Managed"
 }

macos/App/FirewallModel.swift

@@ -114,22 +114,6 @@ final class FirewallModel: NSObject, ObservableObject {
 
         completed = true
         log("Setup complete")
-        offerRestart()
-    }
-
-    /// Apps opened before setup, terminals included, only get the environment the env agent sets once reopened.
-    private func offerRestart() {
-        let alert = NSAlert()
-        alert.messageText = "Restart to finish setting up"
-        alert.informativeText = "Apps that were already open, such as terminals, can't install packages until they're reopened. Restarting reopens them all."
-        alert.addButton(withTitle: "Restart")
-        alert.addButton(withTitle: "Later")
-        NSApp.activate(ignoringOtherApps: true)
-        guard alert.runModal() == .alertFirstButtonReturn else { return }
-        let osascript = Process()
-        osascript.executableURL = URL(fileURLWithPath: "/usr/bin/osascript")
-        osascript.arguments = ["-e", "tell application \"loginwindow\" to «event aevtrest»"]
-        try? osascript.run()
     }
 
     /// After the admin gate, every stage runs even if an earlier one fails, so a partial uninstall never strands the rest.

macos/App/TrustStore.swift

@@ -34,7 +34,11 @@ enum TrustStore {
         return certificate
     }
 
+    /// The extension only uses a managed CA after checking that it chains to a root the MDM trusts.
     static func isTrusted(_ certificate: SecCertificate) -> Bool {
+        var name: CFString?
+        if SecCertificateCopyCommonName(certificate, &name) == errSecSuccess,
+           name as String? == FirewallIDs.managedCaCommonName { return true }
         var settings: CFArray?
         return SecTrustSettingsCopyTrustSettings(certificate, .admin, &settings) == errSecSuccess
     }

macos/MDM.md

@@ -0,0 +1,24 @@
+# Deploying with MDM
+
+On a managed Mac the firewall can use a CA your MDM enrolls instead of minting its own, so users
+need no admin rights and see no trust prompt. Each Mac still has its own key in its Secure Enclave;
+your PKI signs its certificate.
+
+Push one device-channel profile with:
+
+1. **Certificate** (`com.apple.security.root`): your root CA.
+2. **ACME Certificate** (`com.apple.security.acme`), macOS 14 or later:
+   - `KeyType` `ECSECPrimeRandom`, `KeySize` `256`, `HardwareBound` `true`, `Attest` `true`
+   - `Subject` `[[["CN", "Strix Firewall Managed"]]]`; the extension finds the identity by this name
+   - `AllowAllAppsAccess` `true`, so the extension can sign with the key
+3. **System Extensions**: allow `com.usestrix.firewall.extension` for the Strix team ID.
+
+Your ACME server must issue the enrolled certificate as a CA, not a leaf:
+
+- basic constraints `CA:TRUE, pathlen:0` and key usage `keyCertSign`
+- critical name constraints permitting only the screened hosts: `registry.npmjs.org`, `pypi.org`,
+  `files.pythonhosted.org`, `index.crates.io`, `static.crates.io`, `crates.io`,
+  `proxy.golang.org`, `rubygems.org`
+
+The extension checks the certificate chains to a trusted root before using it. Install the profile
+before the firewall: without a managed CA the extension mints its own, which needs an admin to trust.