mirror of
https://github.com/usestrix/firewall.git
synced 2026-11-09 05:19:35 -10:00
Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Ian Graham Martinez
|
9204017cf1 |
No files matched your search
Generated
+4
-377
@@ -172,17 +172,6 @@ dependencies = [
|
||||
"pin-project-lite",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "async-trait"
|
||||
version = "0.1.92"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
"syn 3.0.6",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "asynk-strim"
|
||||
version = "0.1.5"
|
||||
@@ -261,15 +250,6 @@ dependencies = [
|
||||
"hybrid-array",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "block2"
|
||||
version = "0.6.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "cdeb9d870516001442e364c5220d3574d2da8dc765554b4a617230d33fa58ef5"
|
||||
dependencies = [
|
||||
"objc2",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "borsh"
|
||||
version = "1.8.1"
|
||||
@@ -476,16 +456,6 @@ dependencies = [
|
||||
"unicode-xid",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "core-foundation"
|
||||
version = "0.9.4"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
|
||||
dependencies = [
|
||||
"core-foundation-sys",
|
||||
"libc",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "core-foundation"
|
||||
version = "0.10.1"
|
||||
@@ -526,12 +496,6 @@ dependencies = [
|
||||
"cfg-if",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "critical-section"
|
||||
version = "1.2.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "790eea4361631c5e7d22598ecd5723ff611904e3344ce8720784c93e3d83d40b"
|
||||
|
||||
[[package]]
|
||||
name = "crossbeam-channel"
|
||||
version = "0.5.17"
|
||||
@@ -678,16 +642,6 @@ dependencies = [
|
||||
"windows-sys 0.61.2",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "dispatch2"
|
||||
version = "0.3.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "1e0e367e4e7da84520dedcac1901e4da967309406d1e51017ae1abfb97adbd38"
|
||||
dependencies = [
|
||||
"bitflags 2.13.2",
|
||||
"objc2",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "displaydoc"
|
||||
version = "0.2.7"
|
||||
@@ -699,12 +653,6 @@ dependencies = [
|
||||
"syn 3.0.6",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "dpi"
|
||||
version = "0.1.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "d8b14ccef22fc6f5a8f4d7d768562a182c04ce9a3b3157b91390b52ddfdf1a76"
|
||||
|
||||
[[package]]
|
||||
name = "either"
|
||||
version = "1.18.0"
|
||||
@@ -776,15 +724,6 @@ dependencies = [
|
||||
"getrandom 0.4.3",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "fdeflate"
|
||||
version = "0.3.7"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "1e6853b52649d4ac5c0bd02320cddc5ba956bdb407c4b75a2c6b75bf51500f8c"
|
||||
dependencies = [
|
||||
"simd-adler32",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "find-msvc-tools"
|
||||
version = "0.1.13"
|
||||
@@ -805,7 +744,7 @@ checksum = "6e634e2e0ebac1ee034020da1ca582e17ffe4e0f5e985823721e168928136dcb"
|
||||
dependencies = [
|
||||
"crc32fast",
|
||||
"libz-sys",
|
||||
"miniz_oxide 0.9.1",
|
||||
"miniz_oxide",
|
||||
"zlib-rs",
|
||||
]
|
||||
|
||||
@@ -1058,78 +997,6 @@ version = "0.4.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
|
||||
|
||||
[[package]]
|
||||
name = "hickory-net"
|
||||
version = "0.26.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "c480823ed7c2c5d0f09c41020cb6b7c28029ce60ec42dc942158dcf22f8e0a4d"
|
||||
dependencies = [
|
||||
"async-trait",
|
||||
"cfg-if",
|
||||
"data-encoding",
|
||||
"futures-channel",
|
||||
"futures-io",
|
||||
"futures-util",
|
||||
"hickory-proto",
|
||||
"idna",
|
||||
"ipnet",
|
||||
"jni",
|
||||
"rand",
|
||||
"thiserror",
|
||||
"tinyvec",
|
||||
"tokio",
|
||||
"tracing",
|
||||
"url",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "hickory-proto"
|
||||
version = "0.26.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "12b92608f679a6fa515dd1d15c1ff89443026e391200a2c840c7afcba482893d"
|
||||
dependencies = [
|
||||
"data-encoding",
|
||||
"idna",
|
||||
"ipnet",
|
||||
"jni",
|
||||
"once_cell",
|
||||
"prefix-trie",
|
||||
"rand",
|
||||
"ring",
|
||||
"serde",
|
||||
"thiserror",
|
||||
"tinyvec",
|
||||
"tracing",
|
||||
"url",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "hickory-resolver"
|
||||
version = "0.26.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "3f3da5255c95d5a716857d54b5b8f4e8d67c3484d3beaaaae2ce25063b3ba981"
|
||||
dependencies = [
|
||||
"cfg-if",
|
||||
"futures-util",
|
||||
"hickory-net",
|
||||
"hickory-proto",
|
||||
"ipconfig",
|
||||
"ipnet",
|
||||
"jni",
|
||||
"moka",
|
||||
"ndk-context",
|
||||
"once_cell",
|
||||
"parking_lot",
|
||||
"rand",
|
||||
"resolv-conf",
|
||||
"serde",
|
||||
"smallvec",
|
||||
"system-configuration",
|
||||
"thiserror",
|
||||
"tokio",
|
||||
"tracing",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "http"
|
||||
version = "1.5.0"
|
||||
@@ -1291,19 +1158,6 @@ dependencies = [
|
||||
"hashbrown 0.17.1",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "ipconfig"
|
||||
version = "0.3.4"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "4d40460c0ce33d6ce4b0630ad68ff63d6661961c48b6dba35e5a4d81cfb48222"
|
||||
dependencies = [
|
||||
"socket2",
|
||||
"widestring",
|
||||
"windows-registry",
|
||||
"windows-result",
|
||||
"windows-sys 0.61.2",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "ipnet"
|
||||
version = "2.12.2"
|
||||
@@ -1486,16 +1340,6 @@ dependencies = [
|
||||
"wasm-bindgen",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "keyboard-types"
|
||||
version = "0.8.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "0fbe853b403ae61a04233030ae8a79d94975281ed9770a1f9e246732b534b28d"
|
||||
dependencies = [
|
||||
"bitflags 2.13.2",
|
||||
"serde",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "konst"
|
||||
version = "0.2.20"
|
||||
@@ -1639,16 +1483,6 @@ version = "0.2.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
|
||||
|
||||
[[package]]
|
||||
name = "miniz_oxide"
|
||||
version = "0.8.9"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
|
||||
dependencies = [
|
||||
"adler2",
|
||||
"simd-adler32",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "miniz_oxide"
|
||||
version = "0.9.1"
|
||||
@@ -1690,24 +1524,6 @@ dependencies = [
|
||||
"uuid",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "muda"
|
||||
version = "0.21.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "4340e89c178916e62879c5c36b7f699019369be413e496178a6983ce91b8bc03"
|
||||
dependencies = [
|
||||
"crossbeam-channel",
|
||||
"dpi",
|
||||
"keyboard-types",
|
||||
"objc2",
|
||||
"objc2-app-kit",
|
||||
"objc2-core-foundation",
|
||||
"objc2-foundation",
|
||||
"png",
|
||||
"thiserror",
|
||||
"windows-sys 0.61.2",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "multer"
|
||||
version = "3.1.0"
|
||||
@@ -1814,66 +1630,6 @@ dependencies = [
|
||||
"autocfg",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "objc2"
|
||||
version = "0.6.5"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "08849bbd4767dfae9457696856ae1c84fe4e0281bbe4a7abff2d0e06fb7981f8"
|
||||
dependencies = [
|
||||
"objc2-encode",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "objc2-app-kit"
|
||||
version = "0.3.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "d49e936b501e5c5bf01fda3a9452ff86dc3ea98ad5f283e1455153142d97518c"
|
||||
dependencies = [
|
||||
"bitflags 2.13.2",
|
||||
"objc2",
|
||||
"objc2-core-foundation",
|
||||
"objc2-foundation",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "objc2-core-foundation"
|
||||
version = "0.3.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "2a180dd8642fa45cdb7dd721cd4c11b1cadd4929ce112ebd8b9f5803cc79d536"
|
||||
dependencies = [
|
||||
"bitflags 2.13.2",
|
||||
"dispatch2",
|
||||
"objc2",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "objc2-core-graphics"
|
||||
version = "0.3.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "e022c9d066895efa1345f8e33e584b9f958da2fd4cd116792e15e07e4720a807"
|
||||
dependencies = [
|
||||
"bitflags 2.13.2",
|
||||
"objc2-core-foundation",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "objc2-encode"
|
||||
version = "4.1.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "ef25abbcd74fb2609453eb695bd2f860d389e457f67dc17cafc8b8cbc89d0c33"
|
||||
|
||||
[[package]]
|
||||
name = "objc2-foundation"
|
||||
version = "0.3.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "e3e0adef53c21f888deb4fa59fc59f7eb17404926ee8a6f59f5df0fd7f9f3272"
|
||||
dependencies = [
|
||||
"bitflags 2.13.2",
|
||||
"block2",
|
||||
"objc2",
|
||||
"objc2-core-foundation",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "oid-registry"
|
||||
version = "0.8.1"
|
||||
@@ -1888,10 +1644,6 @@ name = "once_cell"
|
||||
version = "1.21.4"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
|
||||
dependencies = [
|
||||
"critical-section",
|
||||
"portable-atomic",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "once_cell_polyfill"
|
||||
@@ -1996,19 +1748,6 @@ version = "0.3.34"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
|
||||
|
||||
[[package]]
|
||||
name = "png"
|
||||
version = "0.18.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "60769b8b31b2a9f263dae2776c37b1b28ae246943cf719eb6946a1db05128a61"
|
||||
dependencies = [
|
||||
"bitflags 2.13.2",
|
||||
"crc32fast",
|
||||
"fdeflate",
|
||||
"flate2",
|
||||
"miniz_oxide 0.8.9",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "portable-atomic"
|
||||
version = "1.15.0"
|
||||
@@ -2039,17 +1778,6 @@ version = "0.2.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
|
||||
|
||||
[[package]]
|
||||
name = "prefix-trie"
|
||||
version = "0.8.4"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "4cf6e3177f0684016a5c209b00882e15f8bdd3f3bb48f0491df10cd102d0c6e7"
|
||||
dependencies = [
|
||||
"either",
|
||||
"ipnet",
|
||||
"num-traits",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "prettyplease"
|
||||
version = "0.2.37"
|
||||
@@ -2393,7 +2121,6 @@ dependencies = [
|
||||
"arc-swap",
|
||||
"base64",
|
||||
"bindgen",
|
||||
"hickory-resolver",
|
||||
"libc",
|
||||
"moka",
|
||||
"parking_lot",
|
||||
@@ -2692,7 +2419,7 @@ dependencies = [
|
||||
"base64",
|
||||
"bitflags 2.13.2",
|
||||
"const_format",
|
||||
"core-foundation 0.10.1",
|
||||
"core-foundation",
|
||||
"csv",
|
||||
"idna",
|
||||
"ipnet",
|
||||
@@ -3024,12 +2751,6 @@ version = "0.8.11"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
|
||||
|
||||
[[package]]
|
||||
name = "resolv-conf"
|
||||
version = "0.7.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "1e061d1b48cb8d38042de4ae0a7a6401009d6143dc80d2e2d6f31f0bdd6470c7"
|
||||
|
||||
[[package]]
|
||||
name = "ring"
|
||||
version = "0.17.14"
|
||||
@@ -3165,7 +2886,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
|
||||
dependencies = [
|
||||
"bitflags 2.13.2",
|
||||
"core-foundation 0.10.1",
|
||||
"core-foundation",
|
||||
"core-foundation-sys",
|
||||
"libc",
|
||||
"security-framework-sys",
|
||||
@@ -3373,16 +3094,13 @@ name = "strix-firewall"
|
||||
version = "0.1.0"
|
||||
dependencies = [
|
||||
"clap",
|
||||
"core-foundation 0.10.1",
|
||||
"core-foundation",
|
||||
"directories",
|
||||
"muda",
|
||||
"percent-encoding",
|
||||
"png",
|
||||
"rama",
|
||||
"rand",
|
||||
"rcgen",
|
||||
"regex",
|
||||
"schannel",
|
||||
"security-framework",
|
||||
"security-framework-sys",
|
||||
"semver",
|
||||
@@ -3391,13 +3109,9 @@ dependencies = [
|
||||
"time",
|
||||
"tokio",
|
||||
"tracing",
|
||||
"tracing-appender",
|
||||
"tracing-subscriber",
|
||||
"tray-icon",
|
||||
"which",
|
||||
"windows",
|
||||
"windows-registry",
|
||||
"windows-service",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -3468,27 +3182,6 @@ dependencies = [
|
||||
"syn 3.0.6",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "system-configuration"
|
||||
version = "0.7.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b"
|
||||
dependencies = [
|
||||
"bitflags 2.13.2",
|
||||
"core-foundation 0.9.4",
|
||||
"system-configuration-sys",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "system-configuration-sys"
|
||||
version = "0.6.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "8e1d1b10ced5ca923a1fcb8d03e96b8d3268065d724548c0211415ff6ac6bac4"
|
||||
dependencies = [
|
||||
"core-foundation-sys",
|
||||
"libc",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "tagptr"
|
||||
version = "0.2.0"
|
||||
@@ -3577,12 +3270,6 @@ dependencies = [
|
||||
"zerovec",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "tinyvec"
|
||||
version = "1.13.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "fd3ca314f692efd6c868f8408f53fe444634a845f96c028b97d35f6a1f79f0ee"
|
||||
|
||||
[[package]]
|
||||
name = "tokio"
|
||||
version = "1.53.1"
|
||||
@@ -3800,25 +3487,6 @@ dependencies = [
|
||||
"tracing-serde",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "tray-icon"
|
||||
version = "0.26.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "4f5cc5858ecf9574ddd8f0032a2ff7ffd6f7724d2b81e48b9374984b3fd6ddc9"
|
||||
dependencies = [
|
||||
"crossbeam-channel",
|
||||
"muda",
|
||||
"objc2",
|
||||
"objc2-app-kit",
|
||||
"objc2-core-foundation",
|
||||
"objc2-core-graphics",
|
||||
"objc2-foundation",
|
||||
"once_cell",
|
||||
"png",
|
||||
"thiserror",
|
||||
"windows-sys 0.61.2",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "try-lock"
|
||||
version = "0.2.5"
|
||||
@@ -3855,19 +3523,6 @@ version = "0.9.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
|
||||
|
||||
[[package]]
|
||||
name = "url"
|
||||
version = "2.5.8"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
|
||||
dependencies = [
|
||||
"form_urlencoded",
|
||||
"idna",
|
||||
"percent-encoding",
|
||||
"serde",
|
||||
"serde_derive",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "utf8_iter"
|
||||
version = "1.0.4"
|
||||
@@ -4015,12 +3670,6 @@ dependencies = [
|
||||
"libc",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "widestring"
|
||||
version = "1.2.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "72069c3113ab32ab29e5584db3c6ec55d416895e60715417b5b883a357c3e471"
|
||||
|
||||
[[package]]
|
||||
name = "wildcard"
|
||||
version = "0.3.0"
|
||||
@@ -4144,17 +3793,6 @@ dependencies = [
|
||||
"windows-link",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "windows-registry"
|
||||
version = "0.6.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "02752bf7fbdcce7f2a27a742f798510f3e5ad88dbe84871e5168e2120c3d5720"
|
||||
dependencies = [
|
||||
"windows-link",
|
||||
"windows-result",
|
||||
"windows-strings",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "windows-result"
|
||||
version = "0.4.1"
|
||||
@@ -4164,17 +3802,6 @@ dependencies = [
|
||||
"windows-link",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "windows-service"
|
||||
version = "0.8.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "857224b3b211c6f3616921f081ee54721ee3ad2ace2fac6a6337e032f7b4dcf2"
|
||||
dependencies = [
|
||||
"bitflags 2.13.2",
|
||||
"widestring",
|
||||
"windows-sys 0.61.2",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "windows-strings"
|
||||
version = "0.5.1"
|
||||
|
||||
+1
-37
@@ -3,7 +3,6 @@ name = "strix-firewall"
|
||||
version = "0.1.0"
|
||||
edition = "2021"
|
||||
license = "Apache-2.0"
|
||||
authors = ["Strix"]
|
||||
description = "Screens package downloads for known malware before they reach your machine"
|
||||
repository = "https://github.com/usestrix/firewall"
|
||||
homepage = "https://github.com/usestrix/firewall"
|
||||
@@ -11,20 +10,6 @@ homepage = "https://github.com/usestrix/firewall"
|
||||
# as an integration test; new tests/*.rs need an explicit [[test]] entry.
|
||||
autotests = false
|
||||
|
||||
# Only Windows ships the service and tray.
|
||||
[package.metadata.dist.binaries]
|
||||
x86_64-pc-windows-msvc = ["firewall", "firewall-service", "firewall-tray"]
|
||||
aarch64-apple-darwin = ["firewall"]
|
||||
x86_64-apple-darwin = ["firewall"]
|
||||
aarch64-unknown-linux-gnu = ["firewall"]
|
||||
x86_64-unknown-linux-gnu = ["firewall"]
|
||||
|
||||
[package.metadata.wix]
|
||||
upgrade-guid = "D944C2F6-BF55-4B21-A60E-1BBDB1A66293"
|
||||
path-guid = "033B1050-23D0-4F5A-A0D3-F4757B4B67E0"
|
||||
license = false
|
||||
eula = false
|
||||
|
||||
[lib]
|
||||
name = "firewall"
|
||||
# The macOS extension links a staticlib, built on demand:
|
||||
@@ -35,18 +20,6 @@ crate-type = ["lib"]
|
||||
name = "firewall"
|
||||
path = "src/main.rs"
|
||||
|
||||
[[bin]]
|
||||
name = "firewall-service"
|
||||
path = "src/bin/firewall-service.rs"
|
||||
|
||||
[[bin]]
|
||||
name = "firewall-tray"
|
||||
path = "src/bin/firewall-tray.rs"
|
||||
|
||||
[[bin]]
|
||||
name = "firewall-uninstall"
|
||||
path = "src/bin/firewall-uninstall.rs"
|
||||
|
||||
[[example]]
|
||||
name = "proxy-test"
|
||||
path = "tests/proxy-test/main.rs"
|
||||
@@ -111,16 +84,7 @@ security-framework = "3.7.0"
|
||||
security-framework-sys = "2.17.0"
|
||||
|
||||
[target.'cfg(windows)'.dependencies]
|
||||
muda = { version = "0.21.2", default-features = false }
|
||||
png = "0.18.1"
|
||||
rama = { version = "0.4.0", features = ["dns-hickory"] }
|
||||
schannel = "0.1.29"
|
||||
tokio = { version = "1.53.1", features = ["net"] }
|
||||
tracing-appender = "0.2.5"
|
||||
tray-icon = { version = "0.26.1", default-features = false }
|
||||
windows = { version = "0.62", features = ["Win32_Foundation", "Win32_Security", "Win32_Security_Authorization", "Win32_Security_Cryptography", "Win32_System_Com", "Win32_System_Environment", "Win32_System_Threading", "Win32_UI_Shell", "Win32_UI_WindowsAndMessaging"] }
|
||||
windows-registry = "0.6.1"
|
||||
windows-service = "0.8.0"
|
||||
windows = { version = "0.62", features = ["Win32_Foundation", "Win32_Security_Cryptography"] }
|
||||
|
||||
[dev-dependencies]
|
||||
tokio = { version = "1.53.1", features = ["macros", "rt-multi-thread"] }
|
||||
|
||||
@@ -89,16 +89,12 @@ async fn handle(req: Request, firewall: &Firewall) -> Result<Response, Infallibl
|
||||
}
|
||||
|
||||
info!(method = %req.method(), %url, "forwarding");
|
||||
// Only an HTTPS registry was downgraded to reach us, so only it is upgraded back and rewritten.
|
||||
let tls = firewall.is_https_url(&url);
|
||||
let index = tls && firewall.is_index_url(&url);
|
||||
let index = firewall.is_index_url(&url);
|
||||
let (mut parts, body) = req.into_parts();
|
||||
if tls {
|
||||
let Ok(uri) = url.parse() else {
|
||||
return Ok(text(400, "firewall: expected an absolute URL\n"));
|
||||
};
|
||||
parts.uri = uri;
|
||||
}
|
||||
let Ok(uri) = url.parse() else {
|
||||
return Ok(text(400, "firewall: expected an absolute URL\n"));
|
||||
};
|
||||
parts.uri = uri;
|
||||
|
||||
let client = DecompressionLayer::new().into_layer(EasyHttpWebClient::default());
|
||||
let response = match client.serve(Request::from_parts(parts, body)).await {
|
||||
|
||||
@@ -1,26 +0,0 @@
|
||||
//! Started by the Windows service manager. It logs to a file, having no console.
|
||||
|
||||
#[cfg(windows)]
|
||||
fn main() {
|
||||
// Run by the MSI as it removes the firewall.
|
||||
if std::env::args().nth(1).as_deref() == Some("uninstall") {
|
||||
firewall::init_logging("info");
|
||||
if let Err(e) = firewall::os::windows::uninstall() {
|
||||
fail("uninstall", &format!("could not uninstall: {e}"))
|
||||
}
|
||||
} else if let Err(e) = firewall::os::windows::run_service() {
|
||||
fail("service", &format!("could not run the service: {e}"))
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(windows)]
|
||||
fn fail(kind: &'static str, message: &str) -> ! {
|
||||
tracing::error!("{message}");
|
||||
firewall::telemetry::error(kind);
|
||||
firewall::telemetry::flush();
|
||||
std::process::exit(1)
|
||||
}
|
||||
|
||||
/// The service is Windows-only.
|
||||
#[cfg(not(windows))]
|
||||
fn main() {}
|
||||
@@ -1,11 +0,0 @@
|
||||
//! The notification-area icon, started at sign-in. A GUI app, so no console opens with it.
|
||||
#![windows_subsystem = "windows"]
|
||||
|
||||
#[cfg(windows)]
|
||||
fn main() -> Result<(), rama::error::BoxError> {
|
||||
firewall::os::windows::run_tray()
|
||||
}
|
||||
|
||||
/// The tray is Windows-only.
|
||||
#[cfg(not(windows))]
|
||||
fn main() {}
|
||||
@@ -1,16 +0,0 @@
|
||||
//! Run as root by the macOS app's uninstall.
|
||||
|
||||
#[cfg(target_os = "macos")]
|
||||
fn main() {
|
||||
firewall::init_logging("info");
|
||||
if let Err(e) = firewall::os::macos::uninstall() {
|
||||
tracing::error!("could not uninstall: {e}");
|
||||
firewall::telemetry::error("uninstall");
|
||||
firewall::telemetry::flush();
|
||||
std::process::exit(1)
|
||||
}
|
||||
}
|
||||
|
||||
/// Only macOS installs anything system-wide.
|
||||
#[cfg(not(target_os = "macos"))]
|
||||
fn main() {}
|
||||
@@ -47,11 +47,6 @@ impl Firewall {
|
||||
self.config.hosts()
|
||||
}
|
||||
|
||||
pub fn is_https_url(&self, url: &str) -> bool {
|
||||
let host = host_of(url);
|
||||
self.config.registries.iter().any(|r| r.upstream.starts_with("https://") && r.host() == host)
|
||||
}
|
||||
|
||||
pub fn is_index_url(&self, url: &str) -> bool {
|
||||
self.config.registries.iter().any(|r| r.index && r.host() == host_of(url))
|
||||
}
|
||||
|
||||
@@ -12,6 +12,10 @@ fn main() {
|
||||
firewall::init_logging("info");
|
||||
serve()
|
||||
}
|
||||
if matches.subcommand_matches("uninstall").is_some() {
|
||||
firewall::init_logging("info");
|
||||
uninstall()
|
||||
}
|
||||
let mut command = matches.get_many::<String>("COMMAND").unwrap().cloned();
|
||||
let program = command.next().unwrap();
|
||||
firewall::init_logging("warn");
|
||||
@@ -40,6 +44,8 @@ fn options() -> Command {
|
||||
Command::new("serve")
|
||||
.about("Serve a local registry for package managers configured to use it"),
|
||||
)
|
||||
// Run as root by the macOS app's uninstall.
|
||||
.subcommand(Command::new("uninstall").hide(true))
|
||||
.arg(
|
||||
Arg::new("COMMAND")
|
||||
.help("A command to run with its package downloads screened")
|
||||
@@ -70,6 +76,13 @@ fn serve() -> ! {
|
||||
}
|
||||
}
|
||||
|
||||
fn uninstall() -> ! {
|
||||
match firewall::os::uninstall() {
|
||||
Ok(()) => exit(0),
|
||||
Err(e) => fail("uninstall", &format!("could not uninstall: {e}")),
|
||||
}
|
||||
}
|
||||
|
||||
fn run(invocation: Invocation) -> ! {
|
||||
telemetry::set_mode("wrapper");
|
||||
let command = &invocation.program;
|
||||
|
||||
+8
-3
@@ -1,4 +1,5 @@
|
||||
use rama::error::BoxError;
|
||||
use rama::tls::boring::core::sha::sha256;
|
||||
use rama::tls::boring::core::x509::X509;
|
||||
use rcgen::{
|
||||
BasicConstraints, CertificateParams, CertificateRevocationListParams, DistinguishedName,
|
||||
@@ -39,6 +40,12 @@ impl CertificateAuthority {
|
||||
(held == signer.subject_public_key_info()).then_some(ca)
|
||||
}
|
||||
|
||||
/// Unique to this CA, so a verifier's cached CRL from an earlier one never applies to it.
|
||||
pub fn crl_path(&self) -> String {
|
||||
let digest = sha256(self.pem.as_bytes());
|
||||
format!("/{}.crl", digest[..8].iter().map(|b| format!("{b:02x}")).collect::<String>())
|
||||
}
|
||||
|
||||
fn new(pem: String) -> Result<Self, BoxError> {
|
||||
Ok(Self { crt: X509::from_pem(pem.as_bytes())?, pem })
|
||||
}
|
||||
@@ -61,14 +68,12 @@ pub fn crl(hosts: &[&str], signer: &dyn SigningKey) -> Result<Vec<u8>, BoxError>
|
||||
}
|
||||
|
||||
pub const COMMON_NAME: &str = "Strix Firewall";
|
||||
/// With `COMMON_NAME`, how a trust store entry is recognized as ours.
|
||||
pub const ORGANIZATION: &str = "Strix";
|
||||
|
||||
/// Also used by the issuer, whose issuer name must match the CA's subject.
|
||||
pub fn params(hosts: &[&str]) -> CertificateParams {
|
||||
let mut name = DistinguishedName::new();
|
||||
name.push(DnType::CommonName, COMMON_NAME);
|
||||
name.push(DnType::OrganizationName, ORGANIZATION);
|
||||
name.push(DnType::OrganizationName, "Strix");
|
||||
|
||||
let mut params = CertificateParams::default();
|
||||
params.distinguished_name = name;
|
||||
|
||||
@@ -3,7 +3,7 @@ mod issuer;
|
||||
mod route;
|
||||
mod screen;
|
||||
|
||||
pub use ca::{crl, CaSigner, CertificateAuthority, COMMON_NAME, ORGANIZATION};
|
||||
pub use ca::{crl, CaSigner, CertificateAuthority, COMMON_NAME};
|
||||
|
||||
use crate::Firewall;
|
||||
use issuer::ConstrainedCertIssuer;
|
||||
|
||||
+8
-4
@@ -4,11 +4,15 @@ pub mod macos;
|
||||
pub mod windows;
|
||||
|
||||
#[cfg(target_os = "macos")]
|
||||
pub use macos::system_config;
|
||||
#[cfg(windows)]
|
||||
pub use windows::system_config;
|
||||
pub use macos::{system_config, uninstall};
|
||||
|
||||
#[cfg(not(any(target_os = "macos", windows)))]
|
||||
/// Elsewhere nothing is installed system-wide.
|
||||
#[cfg(not(target_os = "macos"))]
|
||||
pub fn uninstall() -> Result<(), rama::error::BoxError> {
|
||||
Ok(())
|
||||
}
|
||||
|
||||
#[cfg(not(target_os = "macos"))]
|
||||
pub fn system_config() -> Option<std::path::PathBuf> {
|
||||
None
|
||||
}
|
||||
@@ -1,135 +0,0 @@
|
||||
use super::*;
|
||||
use crate::mitm::{CertificateAuthority, COMMON_NAME, ORGANIZATION};
|
||||
use rama::tls::boring::core::nid::Nid;
|
||||
use rama::tls::boring::core::x509::X509;
|
||||
use rcgen::SigningKey;
|
||||
use schannel::cert_context::CertContext;
|
||||
use schannel::cert_store::{CertAdd, CertStore};
|
||||
use std::io;
|
||||
use std::path::Path;
|
||||
use std::time::{SystemTime, UNIX_EPOCH};
|
||||
use tracing::warn;
|
||||
use windows::Win32::Security::Authorization::{GetNamedSecurityInfoW, SE_FILE_OBJECT};
|
||||
use windows::Win32::Security::*;
|
||||
use windows_registry::Type;
|
||||
|
||||
/// SYSTEM and admins write, users only read, so no one else can plant a CA for node.
|
||||
const DATA_DIR_ACL: &str = concat!(
|
||||
"O:BA", // owner: Administrators
|
||||
"D:P", // protected: ignore ProgramData's rules, which let any user create files
|
||||
"(A;OICI;FA;;;SY)", // allow SYSTEM full control, inherited by files (OI) and subfolders (CI)
|
||||
"(A;OICI;FA;;;BA)", // allow Administrators full control
|
||||
"(A;OICI;FRFX;;;BU)", // allow Users read and execute only
|
||||
);
|
||||
|
||||
/// 1970 in FILETIME, which counts 100 ns from 1601.
|
||||
const FILETIME_UNIX_EPOCH: u128 = 116_444_736_000_000_000;
|
||||
|
||||
/// Trusted machine-wide so restarts keep it; replaced if the hosts change.
|
||||
pub fn load_or_create_ca(
|
||||
hosts: &[&str],
|
||||
signer: &dyn SigningKey,
|
||||
) -> Result<CertificateAuthority, BoxError> {
|
||||
let stored = read_registry_string(REGISTRY_KEY, "ca")?;
|
||||
let ca = match stored.and_then(|blob| CertificateAuthority::from_blob(&blob, hosts, signer)) {
|
||||
Some(ca) => ca,
|
||||
None => {
|
||||
warn!(?hosts, "minting a new CA");
|
||||
let ca = CertificateAuthority::generate(hosts, signer)?;
|
||||
LOCAL_MACHINE
|
||||
.create(REGISTRY_KEY)?
|
||||
.set_string("ca", ca.to_blob(hosts))?;
|
||||
// Windows discards CRLs it cached before now, in case an old CA's is cached at our URL.
|
||||
let now = SystemTime::now().duration_since(UNIX_EPOCH)?.as_nanos() / 100
|
||||
+ FILETIME_UNIX_EPOCH;
|
||||
let chain = r"SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config";
|
||||
let resync = (now as u64).to_le_bytes();
|
||||
LOCAL_MACHINE.create(chain)?.set_bytes(
|
||||
"ChainCacheResyncFiletime",
|
||||
Type::Bytes,
|
||||
&resync,
|
||||
)?;
|
||||
ca
|
||||
}
|
||||
};
|
||||
// Idempotent, and the registry value can outlive the certificate.
|
||||
let der = ca.crt.to_der()?;
|
||||
let mut store = CertStore::open_local_machine("Root")?;
|
||||
store.add_cert(&CertContext::new(&der)?, CertAdd::ReplaceExisting)?;
|
||||
remove_our_cas_except(Some(&der))?;
|
||||
// For clients that read no trust store; screening still works for the rest if this fails.
|
||||
let exported = secure_data_dir().and_then(|dir| std::fs::write(dir.join("ca.pem"), &ca.pem));
|
||||
if let Err(error) = exported {
|
||||
warn!(%error, "could not export the CA");
|
||||
}
|
||||
Ok(ca)
|
||||
}
|
||||
|
||||
/// Created on first use, its owner and ACL reset every time. One a user made first, or a link,
|
||||
/// is replaced: its owner could grant itself access again, and a link would redirect our writes.
|
||||
pub(super) fn secure_data_dir() -> io::Result<PathBuf> {
|
||||
let dir = data_dir();
|
||||
match std::fs::symlink_metadata(&dir) {
|
||||
Ok(meta) if meta.file_type().is_symlink() => std::fs::remove_dir(&dir)?,
|
||||
Ok(_) if !owned_by_admins(&dir)? => {
|
||||
warn!(dir = %dir.display(), "replacing a data folder not created by an admin");
|
||||
std::fs::remove_dir_all(&dir)?
|
||||
}
|
||||
_ => {}
|
||||
}
|
||||
std::fs::create_dir_all(&dir)?;
|
||||
let info = OWNER_SECURITY_INFORMATION
|
||||
| DACL_SECURITY_INFORMATION
|
||||
| PROTECTED_DACL_SECURITY_INFORMATION;
|
||||
let path = HSTRING::from(dir.as_path());
|
||||
let acl = security_descriptor(DATA_DIR_ACL)?;
|
||||
unsafe { SetFileSecurityW(&path, info, PSECURITY_DESCRIPTOR(acl.0)).ok()? };
|
||||
Ok(dir)
|
||||
}
|
||||
|
||||
/// By SYSTEM or the Administrators group, as what an elevated process creates is.
|
||||
fn owned_by_admins(path: &Path) -> windows::core::Result<bool> {
|
||||
let (mut owner, mut descriptor) = (PSID::default(), PSECURITY_DESCRIPTOR::default());
|
||||
unsafe {
|
||||
GetNamedSecurityInfoW(
|
||||
&HSTRING::from(path),
|
||||
SE_FILE_OBJECT,
|
||||
OWNER_SECURITY_INFORMATION,
|
||||
Some(&mut owner),
|
||||
None,
|
||||
None,
|
||||
None,
|
||||
&mut descriptor,
|
||||
)
|
||||
.ok()?
|
||||
};
|
||||
let admins = [WinBuiltinAdministratorsSid, WinLocalSystemSid];
|
||||
let owned = admins
|
||||
.into_iter()
|
||||
.any(|sid| unsafe { IsWellKnownSid(owner, sid) }.as_bool());
|
||||
// `owner` points into the descriptor, so it is freed last.
|
||||
unsafe { LocalFree(Some(HLOCAL(descriptor.0))) };
|
||||
Ok(owned)
|
||||
}
|
||||
|
||||
/// Drops every CA of ours from LocalMachine\Root but `keep`.
|
||||
pub(super) fn remove_our_cas_except(keep: Option<&[u8]>) -> Result<(), BoxError> {
|
||||
for cert in CertStore::open_local_machine("Root")?.certs() {
|
||||
if keep != Some(cert.to_der()) && is_our_ca(cert.to_der()) {
|
||||
cert.delete()?;
|
||||
}
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn is_our_ca(der: &[u8]) -> bool {
|
||||
let Ok(crt) = X509::from_der(der) else {
|
||||
return false;
|
||||
};
|
||||
let name = |nid| {
|
||||
let entry = crt.subject_name().entries_by_nid(nid).next()?;
|
||||
Some(entry.data().as_utf8().ok()?.to_string())
|
||||
};
|
||||
name(Nid::COMMONNAME).as_deref() == Some(COMMON_NAME)
|
||||
&& name(Nid::ORGANIZATIONNAME).as_deref() == Some(ORGANIZATION)
|
||||
}
|
||||
@@ -1,135 +1,3 @@
|
||||
//! The hosts file sends each registry host to its own loopback address, where a
|
||||
//! LocalSystem service screens it as the macOS extension does.
|
||||
|
||||
mod ca;
|
||||
mod service;
|
||||
mod tpm;
|
||||
mod tray;
|
||||
mod uninstall;
|
||||
|
||||
pub use service::run as run_service;
|
||||
pub use tpm::CaKey;
|
||||
pub use tray::run as run_tray;
|
||||
pub use uninstall::uninstall;
|
||||
|
||||
use rama::error::BoxError;
|
||||
use std::net::Ipv4Addr;
|
||||
use std::path::PathBuf;
|
||||
use windows::core::{Owned, GUID, HSTRING};
|
||||
use windows::Win32::Foundation::{LocalFree, ERROR_FILE_NOT_FOUND, HLOCAL};
|
||||
use windows::Win32::Security::Authorization::*;
|
||||
use windows::Win32::Security::PSECURITY_DESCRIPTOR;
|
||||
use windows::Win32::System::Com::CoTaskMemFree;
|
||||
use windows::Win32::System::Environment::ExpandEnvironmentStringsW;
|
||||
use windows::Win32::UI::Shell::*;
|
||||
use windows_registry::LOCAL_MACHINE;
|
||||
|
||||
const SERVICE_NAME: &str = "StrixFirewall";
|
||||
/// Admin-only, so it holds the CA as the System keychain does on macOS.
|
||||
const REGISTRY_KEY: &str = r"SOFTWARE\Strix Firewall";
|
||||
/// Serves the CRL our leaves point at; schannel fails closed without one.
|
||||
const CRL_ADDRESS: Ipv4Addr = Ipv4Addr::new(127, 0, 0, 2);
|
||||
|
||||
/// Admin-only; holds the exported CA, the service log and the config.
|
||||
fn data_dir() -> PathBuf {
|
||||
known_folder(&FOLDERID_ProgramData).join("Strix Firewall")
|
||||
}
|
||||
|
||||
/// Admin-only, so users cannot relax what the service screens.
|
||||
fn config_file() -> PathBuf {
|
||||
data_dir().join("config.json")
|
||||
}
|
||||
|
||||
pub fn system_config() -> Option<PathBuf> {
|
||||
Some(config_file())
|
||||
}
|
||||
|
||||
/// In the folder Windows reads it from, normally %SystemRoot%\System32\drivers\etc.
|
||||
fn hosts_file() -> PathBuf {
|
||||
let key = r"SYSTEM\CurrentControlSet\Services\Tcpip\Parameters";
|
||||
let configured = LOCAL_MACHINE
|
||||
.open(key)
|
||||
.and_then(|key| key.get_hstring("DataBasePath"));
|
||||
let dir = match configured {
|
||||
Ok(dir) => expand_environment(&dir),
|
||||
Err(_) => known_folder(&FOLDERID_System).join(r"drivers\etc"),
|
||||
};
|
||||
dir.join("hosts")
|
||||
}
|
||||
|
||||
/// Windows always has its known folders.
|
||||
fn known_folder(id: &GUID) -> PathBuf {
|
||||
let path = unsafe { SHGetKnownFolderPath(id, KF_FLAG_DEFAULT, None) }.expect("a known folder");
|
||||
let dir = PathBuf::from(unsafe { path.to_hstring() }.to_os_string());
|
||||
unsafe { CoTaskMemFree(Some(path.0 as *const _)) };
|
||||
dir
|
||||
}
|
||||
|
||||
fn expand_environment(path: &HSTRING) -> PathBuf {
|
||||
let len = unsafe { ExpandEnvironmentStringsW(path, None) };
|
||||
let mut expanded = vec![0; len as usize];
|
||||
let len = unsafe { ExpandEnvironmentStringsW(path, Some(&mut expanded)) };
|
||||
// Less the terminating null.
|
||||
PathBuf::from(String::from_utf16_lossy(
|
||||
&expanded[..(len as usize).saturating_sub(1)],
|
||||
))
|
||||
}
|
||||
|
||||
/// From 127.0.0.3, leaving 127.0.0.1 to whatever else serves locally.
|
||||
fn loopback_addresses(hosts: &[&'static str]) -> Vec<(Ipv4Addr, &'static str)> {
|
||||
(3..)
|
||||
.zip(hosts)
|
||||
.map(|(i, host)| (Ipv4Addr::new(127, 0, 0, i), *host))
|
||||
.collect()
|
||||
}
|
||||
|
||||
/// Points each host at its listener, replacing the lines we wrote before; with none, only removes
|
||||
/// them. Bytes, as the file needn't be UTF-8, and every other line is kept as it was.
|
||||
fn write_hosts_entries(hosts: &[&'static str]) -> std::io::Result<()> {
|
||||
const TAG: &str = " # Strix Firewall";
|
||||
let old = std::fs::read(hosts_file())?;
|
||||
let ours = |line: &&[u8]| line.trim_ascii_end().ends_with(TAG.as_bytes());
|
||||
let lines = old.split_inclusive(|&byte| byte == b'\n');
|
||||
let mut new: Vec<u8> = lines
|
||||
.filter(|line| !ours(line))
|
||||
.flatten()
|
||||
.copied()
|
||||
.collect();
|
||||
if !new.is_empty() && !new.ends_with(b"\n") {
|
||||
new.extend_from_slice(b"\r\n");
|
||||
}
|
||||
for (address, host) in loopback_addresses(hosts) {
|
||||
new.extend_from_slice(format!("{address} {host}{TAG}\r\n").as_bytes());
|
||||
}
|
||||
std::fs::write(hosts_file(), new)
|
||||
}
|
||||
|
||||
/// Parses `sddl`; freed on drop.
|
||||
fn security_descriptor(sddl: &str) -> windows::core::Result<Owned<HLOCAL>> {
|
||||
let mut descriptor = PSECURITY_DESCRIPTOR::default();
|
||||
unsafe {
|
||||
ConvertStringSecurityDescriptorToSecurityDescriptorW(
|
||||
&HSTRING::from(sddl),
|
||||
SDDL_REVISION_1,
|
||||
&mut descriptor,
|
||||
None,
|
||||
)?
|
||||
};
|
||||
Ok(unsafe { Owned::new(HLOCAL(descriptor.0)) })
|
||||
}
|
||||
|
||||
fn read_registry_string(key: &str, value: &str) -> Result<Option<String>, BoxError> {
|
||||
none_if_missing(
|
||||
LOCAL_MACHINE
|
||||
.open(key)
|
||||
.and_then(|key| key.get_string(value)),
|
||||
)
|
||||
}
|
||||
|
||||
/// `None` for a missing key or value.
|
||||
fn none_if_missing<T>(result: windows_registry::Result<T>) -> Result<Option<T>, BoxError> {
|
||||
match result {
|
||||
Err(error) if error.code() == ERROR_FILE_NOT_FOUND.to_hresult() => Ok(None),
|
||||
result => Ok(Some(result?)),
|
||||
}
|
||||
}
|
||||
@@ -1,249 +0,0 @@
|
||||
use super::ca::{load_or_create_ca, secure_data_dir};
|
||||
use super::tpm::CaKey;
|
||||
use super::{config_file, loopback_addresses, write_hosts_entries, CRL_ADDRESS, SERVICE_NAME};
|
||||
use crate::config::FirewallConfig;
|
||||
use crate::http::{reply, text};
|
||||
use crate::{mitm, telemetry, Firewall};
|
||||
use rama::dns::client::hickory::resolver::config::ResolveHosts;
|
||||
use rama::dns::client::hickory::{default_resolver_opts, HickoryDnsResolver};
|
||||
use rama::dns::client::resolver::DnsAddressResolver;
|
||||
use rama::dns::client::try_init_global_dns_resolver;
|
||||
use rama::error::BoxError;
|
||||
use rama::http::server::HttpServer;
|
||||
use rama::http::{Request, Response};
|
||||
use rama::io::BridgeIo;
|
||||
use rama::layer::ConsumeErrLayer;
|
||||
use rama::net::address::Domain;
|
||||
use rama::rt::Executor;
|
||||
use rama::service::service_fn;
|
||||
use rama::tcp::server::TcpListener;
|
||||
use rama::tcp::TcpStream;
|
||||
use rama::{Layer, Service};
|
||||
use rcgen::SigningKey;
|
||||
use std::convert::Infallible;
|
||||
use std::ffi::OsString;
|
||||
use std::net::{IpAddr, Ipv4Addr};
|
||||
use std::sync::Arc;
|
||||
use std::time::Duration;
|
||||
use tracing_appender::rolling::{RollingFileAppender, Rotation};
|
||||
use windows::Win32::Foundation::ERROR_GEN_FAILURE;
|
||||
use windows_service::service::*;
|
||||
use windows_service::service_control_handler::{
|
||||
self, ServiceControlHandlerResult, ServiceStatusHandle,
|
||||
};
|
||||
use windows_service::{define_windows_service, service_dispatcher};
|
||||
|
||||
const CRL_PATH: &str = "/ca.crl";
|
||||
|
||||
define_windows_service!(ffi_service_main, service_main);
|
||||
|
||||
/// Called by the service control manager, never by hand.
|
||||
pub fn run() -> windows_service::Result<()> {
|
||||
service_dispatcher::start(SERVICE_NAME, ffi_service_main)
|
||||
}
|
||||
|
||||
/// stderr goes nowhere in a service, so events go to a file beside the CA.
|
||||
fn service_main(_arguments: Vec<OsString>) {
|
||||
let log = secure_data_dir().ok().and_then(|dir| {
|
||||
RollingFileAppender::builder()
|
||||
.rotation(Rotation::DAILY)
|
||||
.filename_prefix("firewall")
|
||||
.filename_suffix("log")
|
||||
.max_log_files(7)
|
||||
.build(dir)
|
||||
.ok()
|
||||
});
|
||||
if let Some(appender) = log {
|
||||
let filter = crate::log_filter("info");
|
||||
let _ = tracing_subscriber::fmt()
|
||||
.with_env_filter(filter)
|
||||
.with_ansi(false)
|
||||
.with_writer(appender)
|
||||
.try_init();
|
||||
}
|
||||
std::panic::set_hook(Box::new(|panic| tracing::error!("{panic}")));
|
||||
if let Err(error) = run_until_stopped() {
|
||||
tracing::error!(%error, "the service stopped");
|
||||
}
|
||||
}
|
||||
|
||||
fn run_until_stopped() -> Result<(), BoxError> {
|
||||
let (control_sender, mut control_receiver) = tokio::sync::mpsc::unbounded_channel();
|
||||
let status = service_control_handler::register(SERVICE_NAME, move |control| match control {
|
||||
ServiceControl::Stop
|
||||
| ServiceControl::Shutdown
|
||||
| ServiceControl::Pause
|
||||
| ServiceControl::Continue => {
|
||||
// Answered once handled, so a failed pause fails the caller's ControlService.
|
||||
let (reply, handled) = tokio::sync::oneshot::channel();
|
||||
let _ = control_sender.send((control, reply));
|
||||
handled
|
||||
.blocking_recv()
|
||||
.unwrap_or(ServiceControlHandlerResult::NoError)
|
||||
}
|
||||
ServiceControl::Interrogate => ServiceControlHandlerResult::NoError,
|
||||
_ => ServiceControlHandlerResult::NotImplemented,
|
||||
})?;
|
||||
set_status(&status, ServiceState::StartPending, false)?;
|
||||
let served = crate::runtime()?.block_on(async {
|
||||
let hosts = match start_screening(&status).await {
|
||||
Ok(hosts) => hosts,
|
||||
Err(error) => {
|
||||
telemetry::send().await;
|
||||
return Err(error);
|
||||
}
|
||||
};
|
||||
// Only pausing removes our hosts entries; a stop or crash keeps them, failing closed.
|
||||
while let Some((control, reply)) = control_receiver.recv().await {
|
||||
let (hosts, state) = match control {
|
||||
ServiceControl::Pause => (&[][..], ServiceState::Paused),
|
||||
ServiceControl::Continue => (&hosts[..], ServiceState::Running),
|
||||
_ => break,
|
||||
};
|
||||
let result = match write_hosts_entries(hosts) {
|
||||
Ok(()) => {
|
||||
set_status(&status, state, false)?;
|
||||
ServiceControlHandlerResult::NoError
|
||||
}
|
||||
Err(error) => {
|
||||
tracing::error!(%error, "could not rewrite the hosts file");
|
||||
let code = error
|
||||
.raw_os_error()
|
||||
.map_or(ERROR_GEN_FAILURE.0, |code| code as u32);
|
||||
ServiceControlHandlerResult::Other(code)
|
||||
}
|
||||
};
|
||||
let _ = reply.send(result);
|
||||
}
|
||||
Ok::<_, BoxError>(())
|
||||
});
|
||||
// A failed stop is what makes the service manager restart it.
|
||||
set_status(&status, ServiceState::Stopped, served.is_err())?;
|
||||
served
|
||||
}
|
||||
|
||||
async fn start_screening(status: &ServiceStatusHandle) -> Result<Vec<&'static str>, BoxError> {
|
||||
telemetry::set_mode("service");
|
||||
telemetry::heartbeat();
|
||||
// Never the hosts file, which points back at us; the Firewall's lookups included.
|
||||
let mut options = default_resolver_opts();
|
||||
options.use_hosts_file = ResolveHosts::Never;
|
||||
let resolver = HickoryDnsResolver::try_new_system_with_options(options)?;
|
||||
let _ = try_init_global_dns_resolver(resolver.clone());
|
||||
let config =
|
||||
FirewallConfig::load_from(&[config_file()]).inspect_err(|_| telemetry::error("config"))?;
|
||||
let firewall = Arc::new(Firewall::new(config));
|
||||
let hosts = firewall.hosts();
|
||||
let key = CaKey::load_or_create().inspect_err(|_| telemetry::error("tpm"))?;
|
||||
let signer: mitm::CaSigner = Arc::new(key);
|
||||
let ca = load_or_create_ca(&hosts, &*signer).inspect_err(|_| telemetry::error("ca"))?;
|
||||
let exec = Executor::default();
|
||||
|
||||
// An empty CRL for the leaves to point at, signed fresh for each fetch.
|
||||
let crl_url = format!("http://{CRL_ADDRESS}{CRL_PATH}");
|
||||
let (crl_hosts, crl_signer) = (hosts.clone(), Arc::clone(&signer));
|
||||
let crl = service_fn(move |req: Request| {
|
||||
let response = if req.uri().request_target() == CRL_PATH {
|
||||
crl_response(&crl_hosts, &*crl_signer)
|
||||
} else {
|
||||
text(404, "No route.\n")
|
||||
};
|
||||
async move { Ok::<_, Infallible>(response) }
|
||||
});
|
||||
let crl = HttpServer::auto(exec.clone()).service(crl);
|
||||
tokio::spawn(listen_on(CRL_ADDRESS, 80, &exec)?.serve(crl));
|
||||
|
||||
let service = mitm::mitm_service(firewall, &ca, signer, Some(crl_url), exec.clone());
|
||||
for (address, host) in loopback_addresses(&hosts) {
|
||||
for port in [80, 443] {
|
||||
let upstream = RedirectedHost {
|
||||
host,
|
||||
port,
|
||||
resolver: resolver.clone(),
|
||||
service: service.clone(),
|
||||
};
|
||||
let upstream = ConsumeErrLayer::trace_as_debug().into_layer(upstream);
|
||||
tokio::spawn(listen_on(address, port, &exec)?.serve(upstream));
|
||||
}
|
||||
}
|
||||
// Rewritten on every start, so a restart picks up a changed host list.
|
||||
write_hosts_entries(&hosts)?;
|
||||
tracing::info!(?hosts, "screening redirected registry traffic");
|
||||
set_status(status, ServiceState::Running, false)?;
|
||||
Ok(hosts)
|
||||
}
|
||||
|
||||
fn crl_response(hosts: &[&str], signer: &dyn SigningKey) -> Response {
|
||||
match mitm::crl(hosts, signer) {
|
||||
Ok(der) => reply(200, "application/pkix-crl", der),
|
||||
Err(error) => text(503, &format!("{error}\n")),
|
||||
}
|
||||
}
|
||||
|
||||
fn listen_on(address: Ipv4Addr, port: u16, exec: &Executor) -> std::io::Result<TcpListener> {
|
||||
let bound = std::net::TcpListener::bind((address, port))?;
|
||||
bound.set_nonblocking(true)?;
|
||||
TcpListener::try_from_std_tcp_listener(bound, exec.clone())
|
||||
}
|
||||
|
||||
/// Each listener is bound to one host's address, which is how it knows where to connect.
|
||||
#[derive(Clone)]
|
||||
struct RedirectedHost {
|
||||
host: &'static str,
|
||||
port: u16,
|
||||
resolver: HickoryDnsResolver,
|
||||
service: mitm::MitmService,
|
||||
}
|
||||
|
||||
impl Service<TcpStream> for RedirectedHost {
|
||||
type Output = ();
|
||||
type Error = BoxError;
|
||||
|
||||
async fn serve(&self, ingress: TcpStream) -> Result<(), BoxError> {
|
||||
let address = self.resolve().await?;
|
||||
let egress = tokio::net::TcpStream::connect((address, self.port)).await?;
|
||||
let streams = BridgeIo(ingress, TcpStream::from(egress));
|
||||
self.service.serve(streams).await
|
||||
}
|
||||
}
|
||||
|
||||
impl RedirectedHost {
|
||||
/// IPv4 if it has one, else IPv6.
|
||||
async fn resolve(&self) -> Result<IpAddr, BoxError> {
|
||||
let domain = Domain::from_static(self.host);
|
||||
if let Some(Ok(v4)) = self.resolver.lookup_ipv4_first(domain.clone()).await {
|
||||
return Ok(v4.into());
|
||||
}
|
||||
match self.resolver.lookup_ipv6_first(domain).await {
|
||||
Some(v6) => Ok(v6?.into()),
|
||||
None => Err(format!("{} has no address", self.host).into()),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fn set_status(
|
||||
status: &ServiceStatusHandle,
|
||||
state: ServiceState,
|
||||
failed: bool,
|
||||
) -> windows_service::Result<()> {
|
||||
status.set_service_status(ServiceStatus {
|
||||
service_type: ServiceType::OWN_PROCESS,
|
||||
current_state: state,
|
||||
controls_accepted: match state {
|
||||
ServiceState::Running | ServiceState::Paused => {
|
||||
ServiceControlAccept::STOP
|
||||
| ServiceControlAccept::SHUTDOWN
|
||||
| ServiceControlAccept::PAUSE_CONTINUE
|
||||
}
|
||||
_ => ServiceControlAccept::empty(),
|
||||
},
|
||||
exit_code: if failed {
|
||||
ServiceExitCode::ServiceSpecific(1)
|
||||
} else {
|
||||
ServiceExitCode::Win32(0)
|
||||
},
|
||||
checkpoint: 0,
|
||||
wait_hint: Duration::from_secs(30),
|
||||
process_id: None,
|
||||
})
|
||||
}
|
||||
@@ -27,13 +27,6 @@ impl CaKey {
|
||||
}
|
||||
}
|
||||
|
||||
pub(super) fn delete_machine_key() -> Result<(), BoxError> {
|
||||
if let Some(key) = open_key(KEY_NAME, NCRYPT_MACHINE_KEY_FLAG)? {
|
||||
key.delete_from_tpm()?;
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// A per-user key under a random name, which needs no elevation; `delete_from_tpm` it after.
|
||||
pub fn create_test_key() -> WinResult<Self> {
|
||||
let name = format!("Strix Firewall test {:016x}", rand::random::<u64>());
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 1.5 KiB |
@@ -1,227 +0,0 @@
|
||||
//! The notification-area icon, started at sign-in as the menu bar app is on macOS.
|
||||
|
||||
use super::*;
|
||||
use muda::{Menu, MenuEvent, MenuItem, PredefinedMenuItem};
|
||||
use std::io::Cursor;
|
||||
use std::time::Duration;
|
||||
use tray_icon::{Icon, MouseButtonState, TrayIcon, TrayIconBuilder, TrayIconEvent};
|
||||
use windows::core::{w, PCWSTR};
|
||||
use windows::Win32::Foundation::*;
|
||||
use windows::Win32::System::Threading::CreateMutexW;
|
||||
use windows::Win32::UI::Shell::*;
|
||||
use windows::Win32::UI::WindowsAndMessaging::*;
|
||||
use windows_registry::CURRENT_USER;
|
||||
use windows_service::service::{Service, ServiceAccess, ServiceState};
|
||||
use windows_service::service_manager::{ServiceManager, ServiceManagerAccess};
|
||||
|
||||
const MENU_PAUSE: &str = "pause";
|
||||
const MENU_RESTART: &str = "restart";
|
||||
const MENU_LOG: &str = "log";
|
||||
const MENU_QUIT: &str = "quit";
|
||||
const LOGO: &[u8] = include_bytes!("tray.png");
|
||||
|
||||
/// Runs until Quit, once per session.
|
||||
pub fn run() -> Result<(), BoxError> {
|
||||
// Held until we exit.
|
||||
let _mutex = unsafe { CreateMutexW(None, false, w!(r"Local\StrixFirewallTray"))? };
|
||||
if unsafe { GetLastError() } == ERROR_ALREADY_EXISTS {
|
||||
return Ok(());
|
||||
}
|
||||
let status = MenuItem::new("", false, None);
|
||||
let pause = MenuItem::with_id(MENU_PAUSE, "", false, None);
|
||||
let menu = Menu::with_items(&[
|
||||
&status,
|
||||
&PredefinedMenuItem::separator(),
|
||||
&pause,
|
||||
&MenuItem::with_id(MENU_RESTART, "Restart", true, None),
|
||||
&MenuItem::with_id(MENU_LOG, "Open logs", true, None),
|
||||
&PredefinedMenuItem::separator(),
|
||||
&MenuItem::with_id(MENU_QUIT, "Quit", true, None),
|
||||
])?;
|
||||
let (logo, logo_size) = logo_mask()?;
|
||||
let icon = TrayIconBuilder::new().with_menu(Box::new(menu)).build()?;
|
||||
let window = HWND(icon.window_handle());
|
||||
let mut tray = Tray {
|
||||
icon,
|
||||
logo,
|
||||
logo_size,
|
||||
drawn: None,
|
||||
status,
|
||||
pause,
|
||||
state: None,
|
||||
};
|
||||
tray.update();
|
||||
unsafe { SetTimer(None, 0, 2000, None) };
|
||||
let mut message = MSG::default();
|
||||
while unsafe { GetMessageW(&mut message, None, 0, 0) }.0 > 0 {
|
||||
unsafe { DispatchMessageW(&message) };
|
||||
// WM_CLOSE, as the MSI sends, destroys the icon's window.
|
||||
if !unsafe { IsWindow(Some(window)) }.as_bool() {
|
||||
break;
|
||||
}
|
||||
// Ours, not the icon window's own hover timer.
|
||||
if message.message == WM_TIMER && message.hwnd.is_invalid() {
|
||||
tray.update();
|
||||
}
|
||||
while let Ok(event) = TrayIconEvent::receiver().try_recv() {
|
||||
// The menu opens on release, so this keeps it current.
|
||||
if let TrayIconEvent::Click {
|
||||
button_state: MouseButtonState::Down,
|
||||
..
|
||||
} = event
|
||||
{
|
||||
tray.update();
|
||||
}
|
||||
}
|
||||
while let Ok(event) = MenuEvent::receiver().try_recv() {
|
||||
if event.id == MENU_QUIT {
|
||||
return Ok(());
|
||||
}
|
||||
tray.on_menu(event.id.as_ref());
|
||||
}
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
struct Tray {
|
||||
icon: TrayIcon,
|
||||
/// The logo's alpha channel; it is square.
|
||||
logo: Vec<u8>,
|
||||
logo_size: u32,
|
||||
/// Whether the taskbar was light and the service screening when the icon was last set.
|
||||
drawn: Option<(bool, bool)>,
|
||||
status: MenuItem,
|
||||
pause: MenuItem,
|
||||
/// As the menu last showed it.
|
||||
state: Option<ServiceState>,
|
||||
}
|
||||
|
||||
impl Tray {
|
||||
fn update(&mut self) {
|
||||
self.state = service_state();
|
||||
let screening = self.state == Some(ServiceState::Running);
|
||||
let light = light_taskbar();
|
||||
if self.drawn != Some((light, screening)) {
|
||||
let rgba = logo_rgba(&self.logo, light, screening);
|
||||
if let Ok(icon) = Icon::from_rgba(rgba, self.logo_size, self.logo_size) {
|
||||
let _ = self.icon.set_icon(Some(icon));
|
||||
}
|
||||
self.drawn = Some((light, screening));
|
||||
}
|
||||
let text = status_text(self.state);
|
||||
let tip = format!("Strix Firewall: {text}");
|
||||
let _ = self.icon.set_tooltip(Some(tip));
|
||||
self.status.set_text(text);
|
||||
let pause = if screening { "Pause" } else { "Resume" };
|
||||
self.pause.set_text(pause);
|
||||
self.pause.set_enabled(self.state.is_some());
|
||||
}
|
||||
|
||||
fn on_menu(&self, id: &str) {
|
||||
let state = self.state;
|
||||
let screening = state == Some(ServiceState::Running);
|
||||
let action: fn() -> Result<(), BoxError> = match id {
|
||||
MENU_PAUSE if screening => || Ok(open_service()?.pause().map(drop)?),
|
||||
MENU_PAUSE if state == Some(ServiceState::Paused) => {
|
||||
|| Ok(open_service()?.resume().map(drop)?)
|
||||
}
|
||||
MENU_PAUSE => || Ok(open_service()?.start::<&str>(&[])?),
|
||||
MENU_RESTART => {
|
||||
// Off the UI thread, since stopping takes a while.
|
||||
std::thread::spawn(|| restart().unwrap_or_else(show_error));
|
||||
return;
|
||||
}
|
||||
MENU_LOG => {
|
||||
let log = HSTRING::from(data_dir().as_path());
|
||||
let none = PCWSTR::null();
|
||||
unsafe { ShellExecuteW(None, w!("open"), &log, none, none, SW_SHOWNORMAL) };
|
||||
return;
|
||||
}
|
||||
_ => return,
|
||||
};
|
||||
action().unwrap_or_else(show_error);
|
||||
}
|
||||
}
|
||||
|
||||
fn show_error(error: BoxError) {
|
||||
let text = match error.source() {
|
||||
Some(source) => format!("{error}: {source}"),
|
||||
None => error.to_string(),
|
||||
};
|
||||
let text = HSTRING::from(text);
|
||||
unsafe { MessageBoxW(None, &text, w!("Strix Firewall"), MB_ICONERROR) };
|
||||
}
|
||||
|
||||
/// `None` when the service is not installed.
|
||||
fn service_state() -> Option<ServiceState> {
|
||||
let manager =
|
||||
ServiceManager::local_computer(None::<&str>, ServiceManagerAccess::CONNECT).ok()?;
|
||||
let service = manager
|
||||
.open_service(SERVICE_NAME, ServiceAccess::QUERY_STATUS)
|
||||
.ok()?;
|
||||
Some(service.query_status().ok()?.current_state)
|
||||
}
|
||||
|
||||
fn light_taskbar() -> bool {
|
||||
let personalize = r"Software\Microsoft\Windows\CurrentVersion\Themes\Personalize";
|
||||
let Ok(key) = CURRENT_USER.open(personalize) else {
|
||||
return false;
|
||||
};
|
||||
key.get_u32("SystemUsesLightTheme").is_ok_and(|light| light == 1)
|
||||
}
|
||||
|
||||
fn status_text(state: Option<ServiceState>) -> &'static str {
|
||||
match state {
|
||||
Some(ServiceState::Running) => "Screening downloads",
|
||||
Some(ServiceState::Paused) => "Paused",
|
||||
_ => "Not running",
|
||||
}
|
||||
}
|
||||
|
||||
fn open_service() -> Result<Service, BoxError> {
|
||||
let manager = ServiceManager::local_computer(None::<&str>, ServiceManagerAccess::CONNECT)?;
|
||||
let access = ServiceAccess::QUERY_STATUS
|
||||
| ServiceAccess::START
|
||||
| ServiceAccess::STOP
|
||||
| ServiceAccess::PAUSE_CONTINUE;
|
||||
Ok(manager.open_service(SERVICE_NAME, access)?)
|
||||
}
|
||||
|
||||
/// Starting again re-reads the config.
|
||||
fn restart() -> Result<(), BoxError> {
|
||||
let service = open_service()?;
|
||||
if service.query_status()?.current_state != ServiceState::Stopped {
|
||||
service.stop()?;
|
||||
}
|
||||
for _ in 0..60 {
|
||||
if service.query_status()?.current_state == ServiceState::Stopped {
|
||||
return Ok(service.start::<&str>(&[])?);
|
||||
}
|
||||
std::thread::sleep(Duration::from_millis(500));
|
||||
}
|
||||
Err("The service did not stop.".into())
|
||||
}
|
||||
|
||||
/// The alpha channel of the RGBA logo, and its width.
|
||||
fn logo_mask() -> Result<(Vec<u8>, u32), BoxError> {
|
||||
let mut reader = png::Decoder::new(Cursor::new(LOGO)).read_info()?;
|
||||
let mut rgba = vec![0; reader.output_buffer_size().ok_or("logo too large")?];
|
||||
let info = reader.next_frame(&mut rgba)?;
|
||||
let mut alpha = Vec::with_capacity(rgba.len() / 4);
|
||||
for pixel in rgba.chunks(4) {
|
||||
alpha.push(pixel[3]);
|
||||
}
|
||||
Ok((alpha, info.width))
|
||||
}
|
||||
|
||||
/// White on a dark taskbar and black on a light one, as macOS draws a template image; dimmed
|
||||
/// when not screening.
|
||||
fn logo_rgba(mask: &[u8], light: bool, screening: bool) -> Vec<u8> {
|
||||
let shade = if light { 0 } else { 255 };
|
||||
let mut rgba = Vec::with_capacity(mask.len() * 4);
|
||||
for &alpha in mask {
|
||||
let alpha = if screening { alpha } else { alpha / 2 };
|
||||
rgba.extend([shade, shade, shade, alpha]);
|
||||
}
|
||||
rgba
|
||||
}
|
||||
@@ -1,41 +0,0 @@
|
||||
use super::ca::remove_our_cas_except;
|
||||
use super::tpm::CaKey;
|
||||
use super::*;
|
||||
use std::io::ErrorKind;
|
||||
use std::path::Path;
|
||||
use tracing::info;
|
||||
|
||||
/// Run by the MSI after it deletes the service, which would restore the hosts entries. Does
|
||||
/// nothing for what is already gone.
|
||||
pub fn uninstall() -> Result<(), BoxError> {
|
||||
write_hosts_entries(&[])?;
|
||||
remove_our_cas_except(None)?;
|
||||
none_if_missing(LOCAL_MACHINE.remove_tree(REGISTRY_KEY))?;
|
||||
CaKey::delete_machine_key()?;
|
||||
let entries = match std::fs::read_dir(data_dir()) {
|
||||
Err(error) if error.kind() == ErrorKind::NotFound => Vec::new(),
|
||||
entries => entries?.collect::<Result<Vec<_>, _>>()?,
|
||||
};
|
||||
for path in entries.into_iter().map(|entry| entry.path()) {
|
||||
// The admin's config stays for a reinstall, as on macOS.
|
||||
if path != config_file() {
|
||||
remove_path(&path)?;
|
||||
}
|
||||
}
|
||||
// Fails while the config is in it.
|
||||
let _ = std::fs::remove_dir(data_dir());
|
||||
info!("removed the CA, its key and the data folder");
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// A file or a folder, if it is there.
|
||||
fn remove_path(path: &Path) -> std::io::Result<()> {
|
||||
let removed = match path.is_dir() {
|
||||
true => std::fs::remove_dir_all(path),
|
||||
false => std::fs::remove_file(path),
|
||||
};
|
||||
match removed {
|
||||
Err(error) if error.kind() == ErrorKind::NotFound => Ok(()),
|
||||
removed => removed,
|
||||
}
|
||||
}
|
||||
@@ -30,7 +30,7 @@ static TELEMETRY: LazyLock<Option<Telemetry>> = LazyLock::new(|| {
|
||||
})
|
||||
});
|
||||
|
||||
/// How the firewall is running: "extension", "service", "wrapper" or "proxy".
|
||||
/// How the firewall is running: "extension", "wrapper" or "proxy".
|
||||
static MODE: OnceLock<&'static str> = OnceLock::new();
|
||||
|
||||
struct Telemetry {
|
||||
|
||||
+1
-22
@@ -1,9 +1,7 @@
|
||||
use firewall::aliasing::forward::downgrade;
|
||||
use firewall::http::https_url;
|
||||
use firewall::{aliasing, Firewall, FirewallConfig};
|
||||
use firewall::Firewall;
|
||||
use rama::http::{Body, Request};
|
||||
use std::io::{Read, Write};
|
||||
use std::net::{TcpListener, TcpStream};
|
||||
|
||||
fn request(target: &str, host: Option<&str>) -> Request {
|
||||
let mut builder = Request::builder().method("GET").uri(target);
|
||||
@@ -37,25 +35,6 @@ fn requests_always_go_out_over_tls() {
|
||||
assert_eq!(https_url(&request("/six", None)), None);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn a_plain_http_upstream_is_not_upgraded() {
|
||||
let upstream = TcpListener::bind("127.0.0.1:0").expect("bind");
|
||||
let addr = upstream.local_addr().expect("address");
|
||||
std::thread::spawn(move || {
|
||||
let (mut stream, _) = upstream.accept().expect("accept");
|
||||
let _ = stream.read(&mut [0; 4096]);
|
||||
let _ = stream.write_all(b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\nok");
|
||||
});
|
||||
|
||||
let port = aliasing::spawn(0, FirewallConfig::default()).expect("spawn");
|
||||
let mut proxy = TcpStream::connect(("127.0.0.1", port)).expect("connect");
|
||||
let request = format!("GET http://{addr}/x HTTP/1.1\r\nHost: {addr}\r\nConnection: close\r\n\r\n");
|
||||
proxy.write_all(request.as_bytes()).expect("write");
|
||||
let mut response = String::new();
|
||||
proxy.read_to_string(&mut response).expect("read");
|
||||
assert!(response.starts_with("HTTP/1.1 200") && response.ends_with("ok"), "{response}");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn downgrade_touches_known_hosts_in_text_only() {
|
||||
let text = b"https://pypi.org/x https://example.com/y".to_vec();
|
||||
|
||||
@@ -50,3 +50,12 @@ fn ca_signs_an_empty_crl() {
|
||||
let crl = mitm::crl(&["registry.npmjs.org", "pypi.org"], &signer()).expect("sign a crl");
|
||||
assert_eq!(crl[0], 0x30, "a DER SEQUENCE");
|
||||
}
|
||||
|
||||
/// A re-minted CA must not inherit the old one's CRL from a verifier's cache.
|
||||
#[test]
|
||||
fn each_ca_names_its_own_crl() {
|
||||
let signer = signer();
|
||||
let npm = mitm::CertificateAuthority::generate(&["registry.npmjs.org"], &signer).expect("mint a ca");
|
||||
let pypi = mitm::CertificateAuthority::generate(&["pypi.org"], &signer).expect("mint a ca");
|
||||
assert_ne!(npm.crl_path(), pypi.crl_path());
|
||||
}
|
||||
@@ -1,193 +0,0 @@
|
||||
<?xml version='1.0' encoding='windows-1252'?>
|
||||
<!--
|
||||
Copyright (C) 2017 Christopher R. Field.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
-->
|
||||
|
||||
<?if $(sys.BUILDARCH) = x64 or $(sys.BUILDARCH) = arm64 ?>
|
||||
<?define PlatformProgramFilesFolder = "ProgramFiles64Folder" ?>
|
||||
<?else ?>
|
||||
<?define PlatformProgramFilesFolder = "ProgramFilesFolder" ?>
|
||||
<?endif ?>
|
||||
|
||||
<Wix xmlns='http://schemas.microsoft.com/wix/2006/wi' xmlns:util='http://schemas.microsoft.com/wix/UtilExtension'>
|
||||
|
||||
<Product
|
||||
Id='*'
|
||||
Name='strix-firewall'
|
||||
UpgradeCode='D944C2F6-BF55-4B21-A60E-1BBDB1A66293'
|
||||
Manufacturer='Strix'
|
||||
Language='1033'
|
||||
Codepage='1252'
|
||||
Version='$(var.Version)'>
|
||||
|
||||
<Package Id='*'
|
||||
Keywords='Installer'
|
||||
Description='Screens package downloads for known malware before they reach your machine'
|
||||
Manufacturer='Strix'
|
||||
InstallerVersion='500'
|
||||
Languages='1033'
|
||||
Compressed='yes'
|
||||
InstallScope='perMachine'
|
||||
SummaryCodepage='1252'
|
||||
/>
|
||||
|
||||
<MajorUpgrade
|
||||
Schedule='afterInstallInitialize'
|
||||
DowngradeErrorMessage='A newer version of [ProductName] is already installed. Setup will now exit.'/>
|
||||
|
||||
<Media Id='1' Cabinet='media1.cab' EmbedCab='yes' DiskPrompt='CD-ROM #1'/>
|
||||
<Property Id='DiskPrompt' Value='strix-firewall Installation'/>
|
||||
|
||||
<Directory Id='TARGETDIR' Name='SourceDir'>
|
||||
<Directory Id='$(var.PlatformProgramFilesFolder)' Name='PFiles'>
|
||||
<Directory Id='APPLICATIONFOLDER' Name='Strix Firewall'>
|
||||
<Component Id='Path' Guid='033B1050-23D0-4F5A-A0D3-F4757B4B67E0' KeyPath='yes'>
|
||||
<Environment
|
||||
Id='PATH'
|
||||
Name='PATH'
|
||||
Value='[APPLICATIONFOLDER]'
|
||||
Permanent='no'
|
||||
Part='last'
|
||||
Action='set'
|
||||
System='yes'/>
|
||||
</Component>
|
||||
<Component Id='binary0' Guid='*'>
|
||||
<File
|
||||
Id='exe0'
|
||||
Name='firewall.exe'
|
||||
DiskId='1'
|
||||
Source='$(var.CargoTargetBinDir)\firewall.exe'
|
||||
KeyPath='yes'/>
|
||||
</Component>
|
||||
<Component Id='binary1' Guid='*'>
|
||||
<File
|
||||
Id='exe1'
|
||||
Name='firewall-service.exe'
|
||||
DiskId='1'
|
||||
Source='$(var.CargoTargetBinDir)\firewall-service.exe'
|
||||
KeyPath='yes'/>
|
||||
<ServiceInstall
|
||||
Name='StrixFirewall'
|
||||
DisplayName='Strix Firewall'
|
||||
Description='Screens package downloads for known malware'
|
||||
Type='ownProcess'
|
||||
Start='auto'
|
||||
ErrorControl='normal'
|
||||
Vital='yes'>
|
||||
<!-- The default, except that interactive users (IU) may also start (RP), stop (WP) and pause (DT) it, as the tray does. -->
|
||||
<PermissionEx Sddl='D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)'/>
|
||||
</ServiceInstall>
|
||||
<!-- Waits, so a service that cannot start fails the install. -->
|
||||
<ServiceControl Id='StrixFirewall' Name='StrixFirewall' Start='install' Stop='both' Remove='uninstall' Wait='yes'/>
|
||||
<!-- For clients that read no trust store. SSL_CERT_FILE would replace OpenSSL's bundle. -->
|
||||
<Environment Id='NODE_EXTRA_CA_CERTS' Name='NODE_EXTRA_CA_CERTS' Value='[CommonAppDataFolder]Strix Firewall\ca.pem' Action='set' System='yes'/>
|
||||
<Environment Id='UV_SYSTEM_CERTS' Name='UV_SYSTEM_CERTS' Value='1' Action='set' System='yes'/>
|
||||
</Component>
|
||||
<Component Id='binary2' Guid='*'>
|
||||
<File
|
||||
Id='exe2'
|
||||
Name='firewall-tray.exe'
|
||||
DiskId='1'
|
||||
Source='$(var.CargoTargetBinDir)\firewall-tray.exe'
|
||||
KeyPath='yes'/>
|
||||
<RegistryValue
|
||||
Root='HKLM'
|
||||
Key='SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
|
||||
Name='Strix Firewall'
|
||||
Type='string'
|
||||
Value='"[#exe2]"'/>
|
||||
</Component>
|
||||
</Directory>
|
||||
</Directory>
|
||||
</Directory>
|
||||
|
||||
<Feature
|
||||
Id='Binaries'
|
||||
Title='Application'
|
||||
Description='Installs the firewall and its service.'
|
||||
Level='1'
|
||||
ConfigurableDirectory='APPLICATIONFOLDER'
|
||||
AllowAdvertise='no'
|
||||
Display='expand'
|
||||
Absent='disallow'>
|
||||
<ComponentRef Id='binary0'/>
|
||||
<ComponentRef Id='binary1'/>
|
||||
<ComponentRef Id='binary2'/>
|
||||
|
||||
<Feature
|
||||
Id='Environment'
|
||||
Title='PATH Environment Variable'
|
||||
Description='Add the install location of the [ProductName] executable to the PATH system environment variable. This allows the [ProductName] executable to be called from any location.'
|
||||
Level='1'
|
||||
Absent='allow'>
|
||||
<ComponentRef Id='Path'/>
|
||||
</Feature>
|
||||
</Feature>
|
||||
|
||||
<!-- Removing the app must not leave the hosts file pointing at a service that is gone. -->
|
||||
<CustomAction
|
||||
Id='UninstallFirewall'
|
||||
FileKey='exe1'
|
||||
ExeCommand='uninstall'
|
||||
Execute='deferred'
|
||||
Impersonate='no'
|
||||
Return='check'/>
|
||||
<!--
|
||||
Registry hosts lead nowhere while the service is down, so bring it back, also when it fails to
|
||||
start. Through sc.exe, as MsiServiceConfigFailureActions cannot restart a service.
|
||||
-->
|
||||
<CustomAction
|
||||
Id='SetFailureActions'
|
||||
Directory='APPLICATIONFOLDER'
|
||||
ExeCommand='"[System64Folder]sc.exe" failure StrixFirewall reset= 3600 actions= restart/5000/restart/5000/restart/5000'
|
||||
Execute='deferred'
|
||||
Impersonate='no'
|
||||
Return='check'/>
|
||||
<CustomAction
|
||||
Id='SetFailureFlag'
|
||||
Directory='APPLICATIONFOLDER'
|
||||
ExeCommand='"[System64Folder]sc.exe" failureflag StrixFirewall 1'
|
||||
Execute='deferred'
|
||||
Impersonate='no'
|
||||
Return='check'/>
|
||||
<!-- From the exit dialog, which runs as the signed-in user rather than elevated. -->
|
||||
<CustomAction
|
||||
Id='StartTray'
|
||||
Directory='APPLICATIONFOLDER'
|
||||
ExeCommand='"[#exe2]"'
|
||||
Return='asyncNoWait'/>
|
||||
<!-- Before its file is replaced or removed. Trays WM_CLOSE does not reach, as in other sessions, are terminated. -->
|
||||
<util:CloseApplication Id='CloseTray' Target='firewall-tray.exe' CloseMessage='yes' RebootPrompt='no' TerminateProcess='0'/>
|
||||
<InstallExecuteSequence>
|
||||
<!-- An upgrade removes the old version too, but should keep screening. -->
|
||||
<Custom Action='UninstallFirewall' After='DeleteServices'>REMOVE~="ALL" AND NOT UPGRADINGPRODUCTCODE</Custom>
|
||||
<Custom Action='SetFailureActions' After='InstallServices'>NOT REMOVE~="ALL"</Custom>
|
||||
<Custom Action='SetFailureFlag' After='SetFailureActions'>NOT REMOVE~="ALL"</Custom>
|
||||
<!-- The default, before InstallFiles, is after RemoveFiles, which would find the tray still running. -->
|
||||
<Custom Action='WixCloseApplications' Before='RemoveFiles'/>
|
||||
</InstallExecuteSequence>
|
||||
|
||||
<SetProperty Id='ARPINSTALLLOCATION' Value='[APPLICATIONFOLDER]' After='CostFinalize'/>
|
||||
<Property Id='ARPHELPLINK' Value='https://github.com/usestrix/firewall'/>
|
||||
|
||||
<UI>
|
||||
<UIRef Id='WixUI_FeatureTree'/>
|
||||
<Publish Dialog='WelcomeDlg' Control='Next' Event='NewDialog' Value='CustomizeDlg' Order='99'>1</Publish>
|
||||
<Publish Dialog='CustomizeDlg' Control='Back' Event='NewDialog' Value='WelcomeDlg' Order='99'>1</Publish>
|
||||
<Publish Dialog='ExitDialog' Control='Finish' Event='DoAction' Value='StartTray' Order='1'>NOT Installed</Publish>
|
||||
</UI>
|
||||
</Product>
|
||||
|
||||
</Wix>
|
||||
+1
-3
@@ -4,9 +4,7 @@ members = ["cargo:core"]
|
||||
[dist]
|
||||
cargo-dist-version = "0.32.0"
|
||||
ci = "github"
|
||||
installers = ["shell", "powershell", "homebrew", "msi"]
|
||||
# core/wix/main.wxs is edited to install the service.
|
||||
allow-dirty = ["msi"]
|
||||
installers = ["shell", "powershell", "homebrew"]
|
||||
tap = "usestrix/homebrew-tap"
|
||||
publish-jobs = ["homebrew", "./publish-crates"]
|
||||
targets = ["aarch64-apple-darwin", "x86_64-apple-darwin", "aarch64-unknown-linux-gnu", "x86_64-unknown-linux-gnu", "x86_64-pc-windows-msvc"]
|
||||
@@ -280,10 +280,10 @@ final class FirewallModel: NSObject, ObservableObject {
|
||||
return true
|
||||
}
|
||||
|
||||
/// The extension wrote these as root, so the bundled firewall-uninstall removes them behind an admin prompt; returns what to report if it failed.
|
||||
/// The extension wrote these as root, so the bundled CLI removes them behind an admin prompt; returns what to report if it failed.
|
||||
private func removeStoredCA() -> String? {
|
||||
let uninstaller = Bundle.main.path(forAuxiliaryExecutable: "firewall-uninstall") ?? ""
|
||||
let script = "do shell script quoted form of \"\(uninstaller)\" with administrator privileges"
|
||||
let cli = Bundle.main.path(forAuxiliaryExecutable: "firewall") ?? ""
|
||||
let script = "do shell script quoted form of \"\(cli)\" & \" uninstall\" with administrator privileges"
|
||||
var error: NSDictionary?
|
||||
NSAppleScript(source: script)?.executeAndReturnError(&error)
|
||||
if let error {
|
||||
|
||||
+1
-2
@@ -47,7 +47,6 @@ build() {
|
||||
echo "==> Building"
|
||||
xcodegen generate >/dev/null
|
||||
xcodebuild -project Firewall.xcodeproj -scheme StrixFirewall -configuration $CONFIGURATION \
|
||||
-destination generic/platform=macOS \
|
||||
-derivedDataPath build CODE_SIGNING_ALLOWED=NO CODE_SIGNING_REQUIRED=NO \
|
||||
CODE_SIGN_IDENTITY="" CODE_SIGN_ENTITLEMENTS="" build >/dev/null
|
||||
}
|
||||
@@ -56,7 +55,7 @@ sign() {
|
||||
echo "==> Signing with $IDENTITY"
|
||||
cp "$(profile_for $APP_ID)" "$APP/Contents/embedded.provisionprofile"
|
||||
cp "$(profile_for $EXT_ID)" "$EXT/Contents/embedded.provisionprofile"
|
||||
codesign --force --options runtime --timestamp -s "$IDENTITY" "$APP/Contents/MacOS/firewall-uninstall"
|
||||
codesign --force --options runtime --timestamp -s "$IDENTITY" "$APP/Contents/MacOS/firewall"
|
||||
codesign --force --options runtime --timestamp \
|
||||
--entitlements Extension/Extension.entitlements -s "$IDENTITY" "$EXT"
|
||||
codesign --force --options runtime --timestamp \
|
||||
|
||||
+5
-13
@@ -10,7 +10,7 @@ settings:
|
||||
"CARGO_PROFILE[config=Debug]": debug
|
||||
"LIBRARY_SEARCH_PATHS[arch=arm64]": $(SRCROOT)/../core/target/aarch64-apple-darwin/$(CARGO_PROFILE)
|
||||
"LIBRARY_SEARCH_PATHS[arch=x86_64]": $(SRCROOT)/../core/target/x86_64-apple-darwin/$(CARGO_PROFILE)
|
||||
ARCHS: arm64 x86_64
|
||||
ARCHS: arm64
|
||||
"ONLY_ACTIVE_ARCH[config=Debug]": "YES"
|
||||
SWIFT_VERSION: "5.0"
|
||||
DEVELOPMENT_TEAM: ${TEAM}
|
||||
@@ -118,22 +118,14 @@ targets:
|
||||
- target: Extension
|
||||
embed: true
|
||||
codeSign: true
|
||||
# Uninstall runs this as root to remove what the extension left.
|
||||
# Uninstall runs the CLI as root to remove what the extension left.
|
||||
postBuildScripts:
|
||||
- name: Embed firewall-uninstall
|
||||
- name: Embed the CLI
|
||||
basedOnDependencyAnalysis: false
|
||||
script: |
|
||||
export PATH="$HOME/.cargo/bin:$PATH"
|
||||
unset CC CXX CFLAGS CXXFLAGS
|
||||
export SDKROOT="$(xcrun --sdk macosx --show-sdk-path)"
|
||||
cd "$SRCROOT/../core"
|
||||
bins=
|
||||
for arch in $ARCHS; do
|
||||
case $arch in
|
||||
arm64|arm64e) triple=aarch64-apple-darwin ;;
|
||||
x86_64) triple=x86_64-apple-darwin ;;
|
||||
esac
|
||||
cargo build --bin firewall-uninstall --target $triple $([ "$CONFIGURATION" = Debug ] || echo --release)
|
||||
bins="$bins target/$triple/$CARGO_PROFILE/firewall-uninstall"
|
||||
done
|
||||
lipo -create $bins -output "$TARGET_BUILD_DIR/$EXECUTABLE_FOLDER_PATH/firewall-uninstall"
|
||||
cargo build --bin firewall --target aarch64-apple-darwin $([ "$CONFIGURATION" = Debug ] || echo --release)
|
||||
cp "target/aarch64-apple-darwin/$CARGO_PROFILE/firewall" "$TARGET_BUILD_DIR/$EXECUTABLE_FOLDER_PATH/"
|
||||
Reference in new issue
Block a user