mirror of
https://github.com/usestrix/firewall.git
synced 2026-11-09 05:19:35 -10:00
Compare commits
3
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Ian
|
219765e4ff | ||
|
Ian
|
8b0d734f02 | ||
|
Ian
|
10fdd0f272 |
No files matched your search
@@ -1,54 +0,0 @@
|
||||
name: Build Firewall.pkg
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
plan:
|
||||
required: true
|
||||
type: string
|
||||
|
||||
jobs:
|
||||
pkg:
|
||||
runs-on: macos-26
|
||||
env:
|
||||
TEAM: ${{ vars.APPLE_TEAM }}
|
||||
NOTARY_PROFILE: firewall
|
||||
steps:
|
||||
- uses: actions/checkout@v6
|
||||
with:
|
||||
persist-credentials: false
|
||||
- run: brew install xcodegen
|
||||
- name: Install signing identities, profiles and notary key
|
||||
env:
|
||||
CERTIFICATES: ${{ secrets.MACOS_CERTIFICATES }}
|
||||
CERTIFICATES_PASSWORD: ${{ secrets.MACOS_CERTIFICATES_PASSWORD }}
|
||||
APP_PROFILE: ${{ secrets.MACOS_APP_PROFILE }}
|
||||
EXTENSION_PROFILE: ${{ secrets.MACOS_EXTENSION_PROFILE }}
|
||||
NOTARY_KEY: ${{ secrets.NOTARY_KEY }}
|
||||
NOTARY_KEY_ID: ${{ secrets.NOTARY_KEY_ID }}
|
||||
NOTARY_ISSUER: ${{ secrets.NOTARY_ISSUER }}
|
||||
run: |
|
||||
keychain="$RUNNER_TEMP/signing.keychain-db"
|
||||
security create-keychain -p "" "$keychain"
|
||||
security set-keychain-settings "$keychain"
|
||||
security unlock-keychain -p "" "$keychain"
|
||||
security default-keychain -s "$keychain"
|
||||
security list-keychains -d user -s "$keychain" login.keychain
|
||||
base64 --decode <<<"$CERTIFICATES" > "$RUNNER_TEMP/certificates.p12"
|
||||
security import "$RUNNER_TEMP/certificates.p12" -k "$keychain" -P "$CERTIFICATES_PASSWORD" \
|
||||
-T /usr/bin/codesign -T /usr/bin/pkgbuild
|
||||
security set-key-partition-list -S apple-tool:,apple: -s -k "" "$keychain" >/dev/null
|
||||
|
||||
profiles="$HOME/Library/Developer/Xcode/UserData/Provisioning Profiles"
|
||||
mkdir -p "$profiles"
|
||||
base64 --decode <<<"$APP_PROFILE" > "$profiles/app.provisionprofile"
|
||||
base64 --decode <<<"$EXTENSION_PROFILE" > "$profiles/extension.provisionprofile"
|
||||
|
||||
printf '%s' "$NOTARY_KEY" > "$RUNNER_TEMP/notary.p8"
|
||||
xcrun notarytool store-credentials "$NOTARY_PROFILE" \
|
||||
--key "$RUNNER_TEMP/notary.p8" --key-id "$NOTARY_KEY_ID" --issuer "$NOTARY_ISSUER"
|
||||
- run: macos/build.sh
|
||||
- uses: actions/upload-artifact@v7
|
||||
with:
|
||||
name: artifacts-macos-pkg
|
||||
path: macos/build/Firewall.pkg
|
||||
@@ -211,24 +211,14 @@ jobs:
|
||||
path: |
|
||||
${{ steps.cargo-dist.outputs.paths }}
|
||||
${{ env.BUILD_MANIFEST_NAME }}
|
||||
|
||||
custom-build-macos-pkg:
|
||||
needs:
|
||||
- plan
|
||||
- build-local-artifacts
|
||||
uses: ./.github/workflows/build-macos-pkg.yml
|
||||
with:
|
||||
plan: ${{ needs.plan.outputs.val }}
|
||||
secrets: inherit
|
||||
# Determines if we should publish/announce
|
||||
host:
|
||||
needs:
|
||||
- plan
|
||||
- build-local-artifacts
|
||||
- build-global-artifacts
|
||||
- custom-build-macos-pkg
|
||||
# Only run if we're "publishing", and only if plan, local and global didn't fail (skipped is fine)
|
||||
if: ${{ always() && needs.plan.result == 'success' && needs.plan.outputs.publishing == 'true' && (needs.build-global-artifacts.result == 'skipped' || needs.build-global-artifacts.result == 'success') && (needs.custom-build-macos-pkg.result == 'skipped' || needs.custom-build-macos-pkg.result == 'success') && (needs.build-local-artifacts.result == 'skipped' || needs.build-local-artifacts.result == 'success') }}
|
||||
if: ${{ always() && needs.plan.result == 'success' && needs.plan.outputs.publishing == 'true' && (needs.build-global-artifacts.result == 'skipped' || needs.build-global-artifacts.result == 'success') && (needs.build-local-artifacts.result == 'skipped' || needs.build-local-artifacts.result == 'success') }}
|
||||
env:
|
||||
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
runs-on: "ubuntu-22.04"
|
||||
@@ -288,6 +278,52 @@ jobs:
|
||||
|
||||
gh release create "${{ needs.plan.outputs.tag }}" --target "$RELEASE_COMMIT" $PRERELEASE_FLAG --title "$ANNOUNCEMENT_TITLE" --notes-file "$RUNNER_TEMP/notes.txt" artifacts/*
|
||||
|
||||
publish-homebrew-formula:
|
||||
needs:
|
||||
- plan
|
||||
- host
|
||||
runs-on: "ubuntu-22.04"
|
||||
env:
|
||||
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
PLAN: ${{ needs.plan.outputs.val }}
|
||||
GITHUB_USER: "axo bot"
|
||||
GITHUB_EMAIL: "[email protected]"
|
||||
if: ${{ !fromJson(needs.plan.outputs.val).announcement_is_prerelease || fromJson(needs.plan.outputs.val).publish_prereleases }}
|
||||
steps:
|
||||
- uses: actions/checkout@v6
|
||||
with:
|
||||
persist-credentials: true
|
||||
repository: "usestrix/homebrew-tap"
|
||||
token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
|
||||
# So we have access to the formula
|
||||
- name: Fetch homebrew formulae
|
||||
uses: actions/download-artifact@v8
|
||||
with:
|
||||
pattern: artifacts-*
|
||||
path: Formula/
|
||||
merge-multiple: true
|
||||
# This is extra complex because you can make your Formula name not match your app name
|
||||
# so we need to find releases with a *.rb file, and publish with that filename.
|
||||
- name: Commit formula files
|
||||
run: |
|
||||
git config --global user.name "${GITHUB_USER}"
|
||||
git config --global user.email "${GITHUB_EMAIL}"
|
||||
|
||||
for release in $(echo "$PLAN" | jq --compact-output '.releases[] | select([.artifacts[] | endswith(".rb")] | any)'); do
|
||||
filename=$(echo "$release" | jq '.artifacts[] | select(endswith(".rb"))' --raw-output)
|
||||
name=$(echo "$filename" | sed "s/\.rb$//")
|
||||
version=$(echo "$release" | jq .app_version --raw-output)
|
||||
|
||||
export PATH="/home/linuxbrew/.linuxbrew/bin:$PATH"
|
||||
brew update
|
||||
# We avoid reformatting user-provided data such as the app description and homepage.
|
||||
brew style --except-cops FormulaAudit/Homepage,FormulaAudit/Desc,FormulaAuditStrict --fix "Formula/${filename}" || true
|
||||
|
||||
git add "Formula/${filename}"
|
||||
git commit -m "${name} ${version}"
|
||||
done
|
||||
git push
|
||||
|
||||
custom-publish-crates:
|
||||
needs:
|
||||
- plan
|
||||
@@ -306,11 +342,12 @@ jobs:
|
||||
needs:
|
||||
- plan
|
||||
- host
|
||||
- publish-homebrew-formula
|
||||
- custom-publish-crates
|
||||
# use "always() && ..." to allow us to wait for all publish jobs while
|
||||
# still allowing individual publish jobs to skip themselves (for prereleases).
|
||||
# "host" however must run to completion, no skipping allowed!
|
||||
if: ${{ always() && needs.host.result == 'success' && (needs.custom-publish-crates.result == 'skipped' || needs.custom-publish-crates.result == 'success') }}
|
||||
if: ${{ always() && needs.host.result == 'success' && (needs.publish-homebrew-formula.result == 'skipped' || needs.publish-homebrew-formula.result == 'success') && (needs.custom-publish-crates.result == 'skipped' || needs.custom-publish-crates.result == 'success') }}
|
||||
runs-on: "ubuntu-22.04"
|
||||
env:
|
||||
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
Generated
+5
-80
@@ -711,20 +711,6 @@ version = "1.18.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "252afb9ae5eaa683babdc6a068b3f5726eb19e05070c731f9b2a23a7c3e8ed34"
|
||||
|
||||
[[package]]
|
||||
name = "embed-resource"
|
||||
version = "3.0.12"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "6168487b5e7eb2673e6efe1200b1848016e436a6ca0b8031bf04bd9d493a249f"
|
||||
dependencies = [
|
||||
"cc",
|
||||
"memchr",
|
||||
"rustc_version",
|
||||
"toml",
|
||||
"vswhom",
|
||||
"winreg",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "encoding_rs"
|
||||
version = "0.8.42"
|
||||
@@ -3257,15 +3243,6 @@ dependencies = [
|
||||
"zmij",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "serde_spanned"
|
||||
version = "1.1.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "4e7523beb55eece201a2356bee0bbca0d1ab466c14c07703b2e0ee6d42cb0c2c"
|
||||
dependencies = [
|
||||
"serde_core",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "sha1"
|
||||
version = "0.11.0"
|
||||
@@ -3393,12 +3370,11 @@ checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
|
||||
|
||||
[[package]]
|
||||
name = "strix-firewall"
|
||||
version = "0.1.0-rc.1"
|
||||
version = "0.1.0"
|
||||
dependencies = [
|
||||
"clap",
|
||||
"core-foundation 0.10.1",
|
||||
"directories",
|
||||
"embed-resource",
|
||||
"muda",
|
||||
"percent-encoding",
|
||||
"png",
|
||||
@@ -3694,26 +3670,11 @@ dependencies = [
|
||||
"tokio",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "toml"
|
||||
version = "1.1.8+spec-1.1.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "20489e00e4d8741d6be680764cc12e270655e375a20d1011e844a9c3379e678d"
|
||||
dependencies = [
|
||||
"indexmap",
|
||||
"serde_core",
|
||||
"serde_spanned",
|
||||
"toml_datetime",
|
||||
"toml_parser",
|
||||
"toml_writer",
|
||||
"winnow",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "toml_datetime"
|
||||
version = "1.1.2+spec-1.1.0"
|
||||
version = "1.1.1+spec-1.1.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "2b86d767906c6c42421dcba507eb9d203e779497710a47782a224bb871653053"
|
||||
checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
|
||||
dependencies = [
|
||||
"serde_core",
|
||||
]
|
||||
@@ -3732,19 +3693,13 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "toml_parser"
|
||||
version = "1.1.5+spec-1.1.0"
|
||||
version = "1.1.3+spec-1.1.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "baa693a8032d7e1cada7d0041e96126df243179ff061456783ac7f12bda4744c"
|
||||
checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56"
|
||||
dependencies = [
|
||||
"winnow",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "toml_writer"
|
||||
version = "1.1.3+spec-1.1.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "06bdbd8cfc056b8d2e2e85f29b56a3bdbecb527cef81eb39e3e7b98af4652770"
|
||||
|
||||
[[package]]
|
||||
name = "tower-layer"
|
||||
version = "0.3.3"
|
||||
@@ -3954,26 +3909,6 @@ version = "0.9.5"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
|
||||
|
||||
[[package]]
|
||||
name = "vswhom"
|
||||
version = "0.1.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "be979b7f07507105799e854203b470ff7c78a1639e330a58f183b5fea574608b"
|
||||
dependencies = [
|
||||
"libc",
|
||||
"vswhom-sys",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "vswhom-sys"
|
||||
version = "0.1.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "fb067e4cbd1ff067d1df46c9194b5de0e98efd2810bbc95c5d5e5f25a3231150"
|
||||
dependencies = [
|
||||
"cc",
|
||||
"libc",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "walkdir"
|
||||
version = "2.5.0"
|
||||
@@ -4349,16 +4284,6 @@ dependencies = [
|
||||
"memchr",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "winreg"
|
||||
version = "0.56.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "7d6f32a0ff4a9f6f01231eb2059cc85479330739333e0e58cadf03b6af2cca10"
|
||||
dependencies = [
|
||||
"cfg-if",
|
||||
"windows-sys 0.61.2",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "wit-bindgen"
|
||||
version = "0.57.1"
|
||||
|
||||
+2
-17
@@ -1,6 +1,6 @@
|
||||
[package]
|
||||
name = "strix-firewall"
|
||||
version = "0.1.0-rc.1"
|
||||
version = "0.1.0"
|
||||
edition = "2021"
|
||||
license = "Apache-2.0"
|
||||
authors = ["Strix"]
|
||||
@@ -38,17 +38,14 @@ path = "src/main.rs"
|
||||
[[bin]]
|
||||
name = "firewall-service"
|
||||
path = "src/bin/firewall-service.rs"
|
||||
required-features = ["machine-wide"]
|
||||
|
||||
[[bin]]
|
||||
name = "firewall-tray"
|
||||
path = "src/bin/firewall-tray.rs"
|
||||
required-features = ["machine-wide"]
|
||||
|
||||
[[bin]]
|
||||
name = "firewall-uninstall"
|
||||
path = "src/bin/firewall-uninstall.rs"
|
||||
required-features = ["machine-wide"]
|
||||
|
||||
[[example]]
|
||||
name = "proxy-test"
|
||||
@@ -90,14 +87,6 @@ path = "tests/tpm.rs"
|
||||
name = "managers"
|
||||
path = "tests/managers.rs"
|
||||
|
||||
[[test]]
|
||||
name = "blocks"
|
||||
path = "tests/blocks.rs"
|
||||
|
||||
[features]
|
||||
# Builds the machine-wide binaries: the Windows service and tray, and the macOS uninstaller.
|
||||
machine-wide = []
|
||||
|
||||
[dependencies]
|
||||
clap = "4.6.6"
|
||||
directories = "6.0.0"
|
||||
@@ -129,14 +118,10 @@ schannel = "0.1.29"
|
||||
tokio = { version = "1.53.1", features = ["net"] }
|
||||
tracing-appender = "0.2.5"
|
||||
tray-icon = { version = "0.26.1", default-features = false }
|
||||
windows = { version = "0.62", features = ["Win32_Foundation", "Win32_Security", "Win32_Security_Authorization", "Win32_Security_Cryptography", "Win32_Storage_FileSystem", "Win32_System_Com", "Win32_System_Console", "Win32_System_Environment", "Win32_System_JobObjects", "Win32_System_LibraryLoader", "Win32_System_Pipes", "Win32_System_Registry", "Win32_System_Threading", "Win32_UI_Controls", "Win32_UI_Shell", "Win32_UI_WindowsAndMessaging"] }
|
||||
windows = { version = "0.62", features = ["Win32_Foundation", "Win32_Security", "Win32_Security_Authorization", "Win32_Security_Cryptography", "Win32_System_Com", "Win32_System_Environment", "Win32_System_Threading", "Win32_UI_Shell", "Win32_UI_WindowsAndMessaging"] }
|
||||
windows-registry = "0.6.1"
|
||||
windows-service = "0.8.0"
|
||||
|
||||
# Only on Windows hosts, where the tray and service are built.
|
||||
[target.'cfg(windows)'.build-dependencies]
|
||||
embed-resource = "3.0.12"
|
||||
|
||||
[dev-dependencies]
|
||||
tokio = { version = "1.53.1", features = ["macros", "rt-multi-thread"] }
|
||||
|
||||
|
||||
@@ -1,20 +0,0 @@
|
||||
//! The tray's task dialogs exist only in version 6 of the common controls, which takes a manifest.
|
||||
//! Both machine-wide binaries also get the Strix icon.
|
||||
fn main() {
|
||||
println!("cargo:rerun-if-changed=src/bin/firewall-tray.manifest");
|
||||
let msvc = std::env::var("CARGO_CFG_TARGET_ENV").as_deref() == Ok("msvc");
|
||||
if msvc && std::env::var_os("CARGO_FEATURE_MACHINE_WIDE").is_some() {
|
||||
let manifest = concat!(env!("CARGO_MANIFEST_DIR"), "/src/bin/firewall-tray.manifest");
|
||||
println!("cargo:rustc-link-arg-bin=firewall-tray=/MANIFEST:EMBED");
|
||||
println!("cargo:rustc-link-arg-bin=firewall-tray=/MANIFESTINPUT:{manifest}");
|
||||
#[cfg(windows)]
|
||||
embed_resource::compile_for(
|
||||
"src/bin/firewall.rc",
|
||||
["firewall-tray", "firewall-service"],
|
||||
embed_resource::NONE,
|
||||
)
|
||||
// Fails the build, rather than ship without the icon.
|
||||
.manifest_required()
|
||||
.unwrap();
|
||||
}
|
||||
}
|
||||
@@ -1 +0,0 @@
|
||||
use_small_heuristics = "Max"
|
||||
@@ -80,7 +80,6 @@ async fn handle(req: Request, firewall: &Firewall) -> Result<Response, Infallibl
|
||||
warn!(method = %req.method(), uri = %req.uri(), "unroutable, expected an absolute URL");
|
||||
return Ok(text(400, "firewall: expected an absolute URL\n"));
|
||||
};
|
||||
let url = firewall.mirrored(url);
|
||||
|
||||
let reason = policies::screen(&url, firewall).await;
|
||||
telemetry::screened(firewall, &url, reason.as_deref());
|
||||
@@ -90,16 +89,12 @@ async fn handle(req: Request, firewall: &Firewall) -> Result<Response, Infallibl
|
||||
}
|
||||
|
||||
info!(method = %req.method(), %url, "forwarding");
|
||||
// Only an HTTPS registry was downgraded to reach us, so only it is upgraded back and rewritten.
|
||||
let tls = firewall.is_https_url(&url);
|
||||
let index = tls && firewall.is_index_url(&url);
|
||||
let index = firewall.is_index_url(&url);
|
||||
let (mut parts, body) = req.into_parts();
|
||||
if tls {
|
||||
let Ok(uri) = url.parse() else {
|
||||
return Ok(text(400, "firewall: expected an absolute URL\n"));
|
||||
};
|
||||
parts.uri = uri;
|
||||
}
|
||||
let Ok(uri) = url.parse() else {
|
||||
return Ok(text(400, "firewall: expected an absolute URL\n"));
|
||||
};
|
||||
parts.uri = uri;
|
||||
|
||||
let client = DecompressionLayer::new().into_layer(EasyHttpWebClient::default());
|
||||
let response = match client.serve(Request::from_parts(parts, body)).await {
|
||||
@@ -130,9 +125,6 @@ pub fn downgrade(firewall: &Firewall, body: Vec<u8>) -> Vec<u8> {
|
||||
Ok(text) => text,
|
||||
Err(raw) => return raw.into_bytes(),
|
||||
};
|
||||
for (upstream, mirror) in firewall.mirrors() {
|
||||
text = text.replace(mirror, upstream);
|
||||
}
|
||||
for host in firewall.hosts() {
|
||||
text = text.replace(&format!("https://{host}"), &format!("http://{host}"));
|
||||
}
|
||||
|
||||
@@ -11,5 +11,4 @@ pub static BUN: Manager = Manager {
|
||||
("npm_config_registry", "http://registry.npmjs.org/"),
|
||||
],
|
||||
args: &[],
|
||||
lockfile: None,
|
||||
};
|
||||
@@ -17,5 +17,4 @@ pub static CARGO: Manager = Manager {
|
||||
"source.firewall.registry=\"sparse+http://index.crates.io/\"",
|
||||
],
|
||||
}],
|
||||
lockfile: None,
|
||||
};
|
||||
@@ -8,5 +8,4 @@ pub static GEM: Manager = Manager {
|
||||
when: &["install", "update", "fetch"],
|
||||
flags: &["--clear-sources", "--source", "http://rubygems.org/"],
|
||||
}],
|
||||
lockfile: None,
|
||||
};
|
||||
@@ -11,5 +11,4 @@ pub static GO: Manager = Manager {
|
||||
("GOFLAGS", "-mod=mod"),
|
||||
],
|
||||
args: &[],
|
||||
lockfile: None,
|
||||
};
|
||||
@@ -36,14 +36,6 @@ pub struct Manager {
|
||||
pub command: &'static str,
|
||||
pub env: &'static [(&'static str, &'static str)],
|
||||
pub args: &'static [Args],
|
||||
/// Where the manager records registry URLs, which then carry our http:// override.
|
||||
pub lockfile: Option<Lockfile>,
|
||||
}
|
||||
|
||||
/// What to do after a run about http:// registry URLs left in the lockfile at this path.
|
||||
pub enum Lockfile {
|
||||
Restore(&'static str),
|
||||
Warn(&'static str),
|
||||
}
|
||||
|
||||
pub static MANAGERS: &[&Manager] =
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
use super::{Lockfile, Manager, PROXY};
|
||||
use super::{Manager, PROXY};
|
||||
|
||||
pub static NPM: Manager = Manager {
|
||||
command: "npm",
|
||||
@@ -8,5 +8,4 @@ pub static NPM: Manager = Manager {
|
||||
("npm_config_registry", "http://registry.npmjs.org/"),
|
||||
],
|
||||
args: &[],
|
||||
lockfile: Some(Lockfile::Restore("package-lock.json")),
|
||||
};
|
||||
@@ -13,5 +13,4 @@ pub static PDM: Manager = Manager {
|
||||
("PDM_PYPI_VERIFY_SSL", "false"),
|
||||
],
|
||||
args: &[],
|
||||
lockfile: None,
|
||||
};
|
||||
@@ -12,5 +12,5 @@ pub static PIP: Manager = recipe("pip");
|
||||
pub static PIP3: Manager = recipe("pip3");
|
||||
|
||||
const fn recipe(name: &'static str) -> Manager {
|
||||
Manager { command: name, env: PIP_ENV, args: &[], lockfile: None }
|
||||
Manager { command: name, env: PIP_ENV, args: &[] }
|
||||
}
|
||||
@@ -13,5 +13,4 @@ pub static PIPENV: Manager = Manager {
|
||||
("PIP_TRUSTED_HOST", "pypi.org files.pythonhosted.org"),
|
||||
],
|
||||
args: &[],
|
||||
lockfile: None,
|
||||
};
|
||||
@@ -9,5 +9,4 @@ pub static PNPM: Manager = Manager {
|
||||
("pnpm_config_registry", "http://registry.npmjs.org/"),
|
||||
],
|
||||
args: &[],
|
||||
lockfile: None,
|
||||
};
|
||||
@@ -1,8 +1,7 @@
|
||||
use super::{Lockfile, Manager, PROXY, PYPI_SIMPLE};
|
||||
use super::{Manager, PROXY, PYPI_SIMPLE};
|
||||
|
||||
pub static UV: Manager = Manager {
|
||||
command: "uv",
|
||||
env: &[("HTTP_PROXY", PROXY), ("http_proxy", PROXY), ("UV_DEFAULT_INDEX", PYPI_SIMPLE)],
|
||||
args: &[],
|
||||
lockfile: Some(Lockfile::Warn("uv.lock")),
|
||||
};
|
||||
@@ -1,16 +1,12 @@
|
||||
pub mod forward;
|
||||
pub mod managers;
|
||||
#[cfg(windows)]
|
||||
mod windows;
|
||||
|
||||
pub use forward::spawn;
|
||||
pub use managers::*;
|
||||
|
||||
use crate::policies::registries::BUILT_IN;
|
||||
use std::io::{Error, ErrorKind};
|
||||
use std::path::{Path, PathBuf};
|
||||
use std::process::Command;
|
||||
use tracing::{info, warn};
|
||||
|
||||
pub struct Invocation {
|
||||
pub program: String,
|
||||
@@ -38,8 +34,7 @@ impl Invocation {
|
||||
|
||||
pub fn run(port: u16, invocation: &Invocation, dir: Option<&Path>) -> std::io::Result<i32> {
|
||||
let proxy = crate::local_url(port, "");
|
||||
let program = resolve(&invocation.program)?;
|
||||
let mut command = Command::new(&program);
|
||||
let mut command = Command::new(resolve(&invocation.program)?);
|
||||
command.args(invocation.arguments(&proxy));
|
||||
if let Some(dir) = dir {
|
||||
command.current_dir(dir);
|
||||
@@ -47,47 +42,10 @@ pub fn run(port: u16, invocation: &Invocation, dir: Option<&Path>) -> std::io::R
|
||||
for (key, value) in managers::variables(&proxy) {
|
||||
command.env(key, value);
|
||||
}
|
||||
#[cfg(windows)]
|
||||
windows::prepare();
|
||||
let status = command.status();
|
||||
#[cfg(windows)]
|
||||
let status = status.map_err(|error| windows::explain(error, &program));
|
||||
let code = status?.code().unwrap_or(1);
|
||||
let manager = MANAGERS.iter().find(|manager| manager.command == invocation.program);
|
||||
match manager.and_then(|manager| manager.lockfile.as_ref()) {
|
||||
Some(Lockfile::Restore(lockfile)) => restore_https(lockfile, dir),
|
||||
Some(Lockfile::Warn(lockfile)) => warn_if_plaintext(lockfile, dir),
|
||||
None => {}
|
||||
}
|
||||
Ok(code)
|
||||
Ok(command.status()?.code().unwrap_or(1))
|
||||
}
|
||||
|
||||
// Command::new only finds .exe on Windows; npm, pnpm and gem are .cmd shims found via PATHEXT.
|
||||
fn resolve(program: &str) -> std::io::Result<PathBuf> {
|
||||
which::which(program).map_err(|e| Error::new(ErrorKind::NotFound, e))
|
||||
}
|
||||
|
||||
fn warn_if_plaintext(lockfile: &str, dir: Option<&Path>) {
|
||||
let path = dir.unwrap_or(Path::new(".")).join(lockfile);
|
||||
let Ok(text) = std::fs::read_to_string(path) else { return };
|
||||
if BUILT_IN.iter().any(|registry| text.contains(&format!("http://{}/", registry.host()))) {
|
||||
warn!("{lockfile} has http:// registry URLs; change them to https:// before committing");
|
||||
}
|
||||
}
|
||||
|
||||
fn restore_https(lockfile: &str, dir: Option<&Path>) {
|
||||
let path = dir.unwrap_or(Path::new(".")).join(lockfile);
|
||||
let Ok(text) = std::fs::read_to_string(&path) else { return };
|
||||
let mut fixed = text.clone();
|
||||
for registry in BUILT_IN {
|
||||
let host = registry.host();
|
||||
fixed = fixed.replace(&format!("http://{host}/"), &format!("https://{host}/"));
|
||||
}
|
||||
if fixed == text {
|
||||
return;
|
||||
}
|
||||
match std::fs::write(&path, fixed) {
|
||||
Ok(()) => info!("changed {lockfile}'s registry URLs back to https://"),
|
||||
Err(e) => warn!("could not change {lockfile}'s registry URLs back to https://: {e}"),
|
||||
}
|
||||
}
|
||||
@@ -1,64 +0,0 @@
|
||||
use std::io::{Error, ErrorKind};
|
||||
use std::path::Path;
|
||||
use std::sync::Once;
|
||||
use tracing::debug;
|
||||
use windows::core::{BOOL, PCWSTR};
|
||||
use windows::Win32::System::Console::{SetConsoleCtrlHandler, CTRL_BREAK_EVENT, CTRL_C_EVENT};
|
||||
use windows::Win32::System::JobObjects::{
|
||||
AssignProcessToJobObject, CreateJobObjectW, JobObjectExtendedLimitInformation,
|
||||
SetInformationJobObject, JOBOBJECT_EXTENDED_LIMIT_INFORMATION,
|
||||
JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE,
|
||||
};
|
||||
use windows::Win32::System::Threading::GetCurrentProcess;
|
||||
|
||||
/// Called before spawning, so the manager behaves as it would run from the shell directly.
|
||||
/// Once per process: a caller may run several managers.
|
||||
pub fn prepare() {
|
||||
static PREPARED: Once = Once::new();
|
||||
PREPARED.call_once(|| {
|
||||
// The console sends Ctrl+C to the manager too. Exiting first would hand the prompt back
|
||||
// while a .cmd shim still asks "Terminate batch job (Y/N)?", so wait for its exit instead.
|
||||
// A handler, unlike ignoring the signal outright, is not inherited by the manager.
|
||||
let _ = unsafe { SetConsoleCtrlHandler(Some(ignore_interrupt), true) };
|
||||
if let Err(error) = kill_children_on_exit() {
|
||||
debug!(%error, "the manager may outlive the firewall");
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
unsafe extern "system" fn ignore_interrupt(event: u32) -> BOOL {
|
||||
(event == CTRL_C_EVENT || event == CTRL_BREAK_EVENT).into()
|
||||
}
|
||||
|
||||
/// Joins a job that kills what is left in it once the firewall exits, even if killed itself.
|
||||
/// The manager inherits the job when spawned, as do its own children.
|
||||
fn kill_children_on_exit() -> windows::core::Result<()> {
|
||||
let mut limits = JOBOBJECT_EXTENDED_LIMIT_INFORMATION::default();
|
||||
limits.BasicLimitInformation.LimitFlags = JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE;
|
||||
// Never closed: the handle closing as the firewall exits is what kills the rest.
|
||||
let job = unsafe { CreateJobObjectW(None, PCWSTR::null())? };
|
||||
unsafe {
|
||||
SetInformationJobObject(
|
||||
job,
|
||||
JobObjectExtendedLimitInformation,
|
||||
(&raw const limits).cast(),
|
||||
size_of_val(&limits) as u32,
|
||||
)?
|
||||
};
|
||||
unsafe { AssignProcessToJobObject(job, GetCurrentProcess()) }
|
||||
}
|
||||
|
||||
/// Rust refuses to pass a line break to a batch file, where it would cut the command short.
|
||||
pub fn explain(error: Error, program: &Path) -> Error {
|
||||
let batch = program
|
||||
.extension()
|
||||
.is_some_and(|ext| ext.eq_ignore_ascii_case("cmd") || ext.eq_ignore_ascii_case("bat"));
|
||||
if !batch || error.kind() != ErrorKind::InvalidInput {
|
||||
return error;
|
||||
}
|
||||
let name = program.file_name().unwrap_or(program.as_os_str()).to_string_lossy();
|
||||
Error::new(
|
||||
ErrorKind::InvalidInput,
|
||||
format!("{name} is a batch file, which cannot be passed an argument with a line break"),
|
||||
)
|
||||
}
|
||||
@@ -1,9 +0,0 @@
|
||||
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
|
||||
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
|
||||
<dependency>
|
||||
<dependentAssembly>
|
||||
<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0"
|
||||
processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"/>
|
||||
</dependentAssembly>
|
||||
</dependency>
|
||||
</assembly>
|
||||
@@ -1,2 +0,0 @@
|
||||
// The icon Explorer, UAC and the tray's popups show.
|
||||
1 ICON "strix.ico"
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 13 KiB |
@@ -1,154 +0,0 @@
|
||||
use crate::config::{self, AllowedPackage};
|
||||
use crate::policies::Package;
|
||||
use crate::Firewall;
|
||||
use rama::error::BoxError;
|
||||
use serde::Serialize;
|
||||
use std::path::Path;
|
||||
use std::sync::Mutex;
|
||||
use std::time::{Duration, Instant};
|
||||
use tokio::sync::watch;
|
||||
|
||||
/// So blocks can't pile up while no app collects them.
|
||||
const KEPT: usize = 50;
|
||||
/// Under pip's, pipenv's and pdm's 15 s read timeout, the shortest of the supported managers.
|
||||
const HOLD: Duration = Duration::from_secs(10);
|
||||
/// Only hold while an app is asking for blocks, so someone can answer.
|
||||
const WATCHED: Duration = Duration::from_secs(2);
|
||||
/// For a minute, so the rest of that install can fetch it too.
|
||||
const ONCE: Duration = Duration::from_secs(60);
|
||||
|
||||
#[derive(Clone, Serialize)]
|
||||
pub struct BlockedPackage {
|
||||
pub id: u64,
|
||||
pub eco: &'static str,
|
||||
pub name: String,
|
||||
pub version: Option<String>,
|
||||
pub filter: &'static str,
|
||||
pub reason: String,
|
||||
}
|
||||
|
||||
struct Blocks {
|
||||
last_id: u64,
|
||||
unsent: Vec<BlockedPackage>,
|
||||
/// Age holds, the only blocks that can be allowed, each with what wakes its waiting downloads.
|
||||
held: Vec<(BlockedPackage, watch::Sender<bool>)>,
|
||||
polled: Option<Instant>,
|
||||
}
|
||||
|
||||
static BLOCKS: Mutex<Blocks> =
|
||||
Mutex::new(Blocks { last_id: 0, unsent: Vec::new(), held: Vec::new(), polled: None });
|
||||
|
||||
/// Records a block and holds a new package's download for up to `HOLD`. Returns whether it was allowed.
|
||||
pub async fn block(eco: &'static str, pkg: &Package, filter: &'static str, reason: &str) -> bool {
|
||||
let Some(mut answer) = record(eco, pkg, filter, reason) else {
|
||||
return false;
|
||||
};
|
||||
let allowed = tokio::time::timeout(HOLD, answer.wait_for(|allowed| *allowed)).await;
|
||||
matches!(allowed, Ok(Ok(_)))
|
||||
}
|
||||
|
||||
/// The app's requests: `blocks`, `allow <id>` or `allow-once <id>`.
|
||||
/// An allow replies `late` if the download had stopped waiting.
|
||||
pub fn answer(firewall: &Firewall, config: &Path, request: &str) -> String {
|
||||
if request == "blocks" {
|
||||
return serde_json::to_string(&take()).expect("blocks serialize");
|
||||
}
|
||||
let result = match request.split_once(' ').map(|(verb, id)| (verb, id.parse())) {
|
||||
Some(("allow", Ok(id))) => trust(firewall, config, id),
|
||||
Some(("allow-once", Ok(id))) => allow_once(firewall, id),
|
||||
_ => Err(format!("unknown message {request}").into()),
|
||||
};
|
||||
match result {
|
||||
Ok(true) => "ok".to_owned(),
|
||||
Ok(false) => "late".to_owned(),
|
||||
Err(error) => format!("error: {error}"),
|
||||
}
|
||||
}
|
||||
|
||||
/// Hands each block over once.
|
||||
fn take() -> Vec<BlockedPackage> {
|
||||
let mut blocks = lock();
|
||||
blocks.polled = Some(Instant::now());
|
||||
std::mem::take(&mut blocks.unsent)
|
||||
}
|
||||
|
||||
fn record(
|
||||
eco: &'static str,
|
||||
pkg: &Package,
|
||||
filter: &'static str,
|
||||
reason: &str,
|
||||
) -> Option<watch::Receiver<bool>> {
|
||||
let mut blocks = lock();
|
||||
let watched = blocks.polled.is_some_and(|polled| polled.elapsed() < WATCHED);
|
||||
let holds = filter == "age" && watched;
|
||||
// A repeat fetch of a held package waits on the same answer.
|
||||
let waiting = blocks.held.iter().find(|(held, wake)| {
|
||||
wake.receiver_count() > 0
|
||||
&& held.eco == eco
|
||||
&& held.name == pkg.name
|
||||
&& held.version == pkg.version
|
||||
});
|
||||
if let (true, Some((_, wake))) = (holds, waiting) {
|
||||
return Some(wake.subscribe());
|
||||
}
|
||||
blocks.last_id += 1;
|
||||
let block = BlockedPackage {
|
||||
id: blocks.last_id,
|
||||
eco,
|
||||
name: pkg.name.clone(),
|
||||
version: pkg.version.clone(),
|
||||
filter,
|
||||
reason: reason.to_owned(),
|
||||
};
|
||||
push(&mut blocks.unsent, block.clone());
|
||||
if filter != "age" {
|
||||
return None;
|
||||
}
|
||||
let (wake, allowed) = watch::channel(false);
|
||||
push(&mut blocks.held, (block, wake));
|
||||
holds.then_some(allowed)
|
||||
}
|
||||
|
||||
/// Also saved to the config, so it survives a restart.
|
||||
fn trust(firewall: &Firewall, config: &Path, id: u64) -> Result<bool, BoxError> {
|
||||
let block = held(id)?;
|
||||
let version = block.version.ok_or("only a version can be trusted")?;
|
||||
config::allow(config, block.eco, &block.name, &version)?;
|
||||
let package = AllowedPackage { name: block.name, version: Some(version) };
|
||||
firewall.lift_age_check(block.eco, package, None);
|
||||
Ok(release(id))
|
||||
}
|
||||
|
||||
fn allow_once(firewall: &Firewall, id: u64) -> Result<bool, BoxError> {
|
||||
let block = held(id)?;
|
||||
let package = AllowedPackage { name: block.name, version: block.version };
|
||||
firewall.lift_age_check(block.eco, package, Some(Instant::now() + ONCE));
|
||||
Ok(release(id))
|
||||
}
|
||||
|
||||
fn held(id: u64) -> Result<BlockedPackage, BoxError> {
|
||||
let blocks = lock();
|
||||
let held = blocks.held.iter().find(|(held, _)| held.id == id);
|
||||
Ok(held.ok_or(format!("no new package was held back as {id}"))?.0.clone())
|
||||
}
|
||||
|
||||
/// Returns whether a download was still waiting.
|
||||
fn release(id: u64) -> bool {
|
||||
let blocks = lock();
|
||||
let Some((_, wake)) = blocks.held.iter().find(|(held, _)| held.id == id) else {
|
||||
return false;
|
||||
};
|
||||
wake.send_replace(true);
|
||||
wake.receiver_count() > 0
|
||||
}
|
||||
|
||||
fn push<T>(list: &mut Vec<T>, item: T) {
|
||||
if list.len() == KEPT {
|
||||
list.remove(0);
|
||||
}
|
||||
list.push(item);
|
||||
}
|
||||
|
||||
fn lock() -> std::sync::MutexGuard<'static, Blocks> {
|
||||
BLOCKS.lock().unwrap_or_else(|e| e.into_inner())
|
||||
}
|
||||
+28
-90
@@ -1,29 +1,28 @@
|
||||
use crate::policies::registries::{host_of, BUILT_IN};
|
||||
use crate::policies::registries::{Registry, BUILT_IN};
|
||||
use directories::ProjectDirs;
|
||||
use rama::net::uri::Uri;
|
||||
use serde::Deserialize;
|
||||
use serde_json::{json, Map, Value};
|
||||
use serde_json::{Map, Value};
|
||||
use std::collections::HashMap;
|
||||
use std::io::{Error, ErrorKind};
|
||||
use std::num::{NonZeroU16, NonZeroU64};
|
||||
use std::path::{Path, PathBuf};
|
||||
use std::path::PathBuf;
|
||||
|
||||
pub const DEFAULT_PORT: u16 = 8080;
|
||||
|
||||
#[derive(Debug, Deserialize)]
|
||||
#[serde(default, deny_unknown_fields)]
|
||||
pub struct FirewallConfig {
|
||||
pub port: NonZeroU16,
|
||||
pub port: u16,
|
||||
/// Allow a package when a filter could not check it.
|
||||
pub fail_open: bool,
|
||||
/// 0 turns the age check off.
|
||||
pub min_age_hours: u64,
|
||||
pub denylist: DenylistSource,
|
||||
/// Packages exempt from the age check, by ecosystem: `{"npm": [{"name": "left-pad"}]}`.
|
||||
/// Packages never screened, by ecosystem: `{"npm": [{"name": "left-pad"}]}`.
|
||||
pub allow: HashMap<String, Vec<AllowedPackage>>,
|
||||
pub telemetry: bool,
|
||||
/// Mirrors laid out like a built-in registry, by its name: `{"npm": ["https://npm.example.com/"]}`.
|
||||
pub registries: HashMap<String, Vec<String>>,
|
||||
/// Not describable in the file yet, so this is always the built-in table.
|
||||
#[serde(skip)]
|
||||
pub registries: Vec<&'static Registry>,
|
||||
}
|
||||
|
||||
#[derive(Debug, Deserialize)]
|
||||
@@ -41,19 +40,19 @@ pub struct DenylistSource {
|
||||
pub base: String,
|
||||
/// Polled for a new commit, which re-fetches every list in use.
|
||||
pub revision: String,
|
||||
pub poll_secs: NonZeroU64,
|
||||
pub poll_secs: u64,
|
||||
}
|
||||
|
||||
impl Default for FirewallConfig {
|
||||
fn default() -> Self {
|
||||
FirewallConfig {
|
||||
port: NonZeroU16::new(DEFAULT_PORT).unwrap(),
|
||||
port: DEFAULT_PORT,
|
||||
fail_open: true,
|
||||
min_age_hours: 24,
|
||||
min_age_hours: 0,
|
||||
denylist: DenylistSource::default(),
|
||||
allow: HashMap::new(),
|
||||
telemetry: true,
|
||||
registries: HashMap::new(),
|
||||
registries: BUILT_IN.to_vec(),
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -64,7 +63,7 @@ impl Default for DenylistSource {
|
||||
base: "https://raw.githubusercontent.com/usestrix/firewall-blocklist/main".into(),
|
||||
revision: "https://api.github.com/repos/usestrix/firewall-blocklist/commits/main"
|
||||
.into(),
|
||||
poll_secs: NonZeroU64::new(10).unwrap(),
|
||||
poll_secs: 10,
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -86,13 +85,9 @@ impl FirewallConfig {
|
||||
Err(e) if e.kind() == ErrorKind::NotFound => continue,
|
||||
Err(e) => return Err(Error::new(e.kind(), format!("{}: {e}", path.display()))),
|
||||
};
|
||||
let invalid =
|
||||
|e| Error::new(ErrorKind::InvalidData, format!("{}: {e}", path.display()));
|
||||
let invalid = |e| Error::new(ErrorKind::InvalidData, format!("{}: {e}", path.display()));
|
||||
let layer: Value = serde_json::from_str(&text).map_err(invalid)?;
|
||||
let config = FirewallConfig::deserialize(&layer).map_err(invalid)?;
|
||||
check(&config).map_err(|e| {
|
||||
Error::new(ErrorKind::InvalidData, format!("{}: {e}", path.display()))
|
||||
})?;
|
||||
FirewallConfig::deserialize(&layer).map_err(invalid)?;
|
||||
let Value::Object(layer) = layer else {
|
||||
unreachable!("a config parses only from an object");
|
||||
};
|
||||
@@ -102,7 +97,19 @@ impl FirewallConfig {
|
||||
}
|
||||
|
||||
pub fn local_url(&self, path: &str) -> String {
|
||||
crate::local_url(self.port.get(), path)
|
||||
crate::local_url(self.port, path)
|
||||
}
|
||||
|
||||
/// Without building a `Firewall`, which needs a runtime.
|
||||
pub fn hosts(&self) -> Vec<&'static str> {
|
||||
let mut hosts: Vec<&'static str> = Vec::new();
|
||||
for registry in &self.registries {
|
||||
let host = registry.host();
|
||||
if !hosts.contains(&host) {
|
||||
hosts.push(host);
|
||||
}
|
||||
}
|
||||
hosts
|
||||
}
|
||||
}
|
||||
|
||||
@@ -122,72 +129,3 @@ fn merge(base: &mut Map<String, Value>, top: Map<String, Value>) {
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Adds an `allow` entry to the file, leaving the rest of it as written.
|
||||
pub fn allow(path: &Path, eco: &str, name: &str, version: &str) -> std::io::Result<()> {
|
||||
let invalid =
|
||||
|e: String| Error::new(ErrorKind::InvalidData, format!("{}: {e}", path.display()));
|
||||
let mut config = match std::fs::read_to_string(path) {
|
||||
Ok(text) => serde_json::from_str(&text).map_err(|e| invalid(e.to_string()))?,
|
||||
Err(e) if e.kind() == ErrorKind::NotFound => json!({}),
|
||||
Err(e) => return Err(e),
|
||||
};
|
||||
if !config.is_object() {
|
||||
return Err(invalid("not an object".into()));
|
||||
}
|
||||
let entry = json!({ "name": name, "version": version });
|
||||
let entries = &mut config["allow"][eco];
|
||||
if entries.is_null() {
|
||||
*entries = Value::Array(Vec::new());
|
||||
}
|
||||
let Some(entries) = entries.as_array_mut() else {
|
||||
return Err(invalid(format!("allow.{eco} is not a list")));
|
||||
};
|
||||
if !entries.contains(&entry) {
|
||||
entries.push(entry);
|
||||
}
|
||||
if let Some(dir) = path.parent() {
|
||||
std::fs::create_dir_all(dir)?;
|
||||
}
|
||||
std::fs::write(path, serde_json::to_string_pretty(&config)?)
|
||||
}
|
||||
|
||||
/// What serde's types cannot say.
|
||||
fn check(config: &FirewallConfig) -> Result<(), String> {
|
||||
// `Duration::hours` panics past this.
|
||||
if config.min_age_hours > time::Duration::MAX.whole_hours() as u64 {
|
||||
return Err(format!("{} hours is too long", config.min_age_hours));
|
||||
}
|
||||
for eco in config.allow.keys() {
|
||||
if !BUILT_IN.iter().any(|r| r.eco == eco) {
|
||||
return Err(format!("unknown ecosystem {eco:?} in allow"));
|
||||
}
|
||||
}
|
||||
for url in [&config.denylist.base, &config.denylist.revision] {
|
||||
if parse_url(url, &["http", "https"]).is_none() {
|
||||
return Err(format!("{url:?} is not an http(s) URL"));
|
||||
}
|
||||
}
|
||||
for (name, mirrors) in &config.registries {
|
||||
if !BUILT_IN.iter().any(|r| r.name() == name) {
|
||||
return Err(format!("no built-in registry is named {name}"));
|
||||
}
|
||||
if let Some(url) = mirrors.iter().find(|url| !is_mirror(url)) {
|
||||
return Err(format!("{url}: a mirror is an https:// URL ending in /"));
|
||||
}
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// No port or userinfo, as `host_of` is what gets intercepted.
|
||||
fn is_mirror(url: &str) -> bool {
|
||||
let Some(uri) = parse_url(url, &["https"]) else { return false };
|
||||
let bare_host = uri.host_str().is_some_and(|host| host == host_of(url));
|
||||
bare_host && uri.query().is_none() && uri.fragment().is_none() && url.ends_with('/')
|
||||
}
|
||||
|
||||
fn parse_url(url: &str, schemes: &[&str]) -> Option<Uri> {
|
||||
let uri = Uri::parse(url).ok()?;
|
||||
let has_host = uri.host_str().is_some_and(|host| !host.is_empty());
|
||||
(has_host && schemes.contains(&uri.scheme_str()?)).then_some(uri)
|
||||
}
|
||||
+7
-72
@@ -1,4 +1,4 @@
|
||||
use crate::config::{AllowedPackage, FirewallConfig};
|
||||
use crate::config::FirewallConfig;
|
||||
use crate::policies::filters::age::Age;
|
||||
use crate::policies::filters::denylist::Denylist;
|
||||
use crate::policies::filters::osv::Osv;
|
||||
@@ -6,16 +6,11 @@ use crate::policies::filters::Filter;
|
||||
use crate::policies::registries::*;
|
||||
use regex::Regex;
|
||||
use std::collections::HashMap;
|
||||
use std::sync::Mutex;
|
||||
use std::time::Instant;
|
||||
|
||||
pub struct Firewall {
|
||||
pub config: FirewallConfig,
|
||||
registries: Vec<&'static Registry>,
|
||||
patterns: HashMap<&'static str, Vec<Regex>>,
|
||||
filters: Vec<Box<dyn Filter>>,
|
||||
/// Each lift expires at its time, or lasts until the firewall stops. Never saved.
|
||||
age_lifted: Mutex<Vec<(String, AllowedPackage, Option<Instant>)>>,
|
||||
}
|
||||
|
||||
impl Default for Firewall {
|
||||
@@ -26,19 +21,18 @@ impl Default for Firewall {
|
||||
|
||||
impl Firewall {
|
||||
pub fn new(config: FirewallConfig) -> Self {
|
||||
let registries = with_mirrors(&config.registries);
|
||||
let mut patterns = HashMap::new();
|
||||
for registry in ®istries {
|
||||
for registry in &config.registries {
|
||||
let compiled = registry.patterns.iter().map(|p| Regex::new(p.re).expect(p.re));
|
||||
patterns.insert(registry.prefix, compiled.collect());
|
||||
}
|
||||
let ecosystems = registries.iter().map(|r| r.osv_name);
|
||||
let ecosystems = config.registries.iter().map(|r| r.osv_name);
|
||||
let denylist = Denylist::new(config.denylist.clone(), ecosystems);
|
||||
let mut filters: Vec<Box<dyn Filter>> = vec![Box::new(denylist), Box::new(Osv)];
|
||||
if config.min_age_hours > 0 {
|
||||
filters.push(Box::new(Age::new(config.min_age_hours)));
|
||||
}
|
||||
Firewall { config, registries, patterns, filters, age_lifted: Mutex::default() }
|
||||
Firewall { config, patterns, filters }
|
||||
}
|
||||
|
||||
pub fn match_on<'a>(
|
||||
@@ -46,49 +40,15 @@ impl Firewall {
|
||||
url: &'a str,
|
||||
key: fn(&Registry) -> &'static str,
|
||||
) -> Option<(&'static Registry, &'a str)> {
|
||||
self.registries.iter().find_map(|r| url.strip_prefix(key(r)).map(|rest| (*r, rest)))
|
||||
self.config.registries.iter().find_map(|r| url.strip_prefix(key(r)).map(|rest| (*r, rest)))
|
||||
}
|
||||
|
||||
pub fn hosts(&self) -> Vec<&'static str> {
|
||||
let mut hosts: Vec<&'static str> = Vec::new();
|
||||
for registry in &self.registries {
|
||||
let host = registry.host();
|
||||
if !hosts.contains(&host) {
|
||||
hosts.push(host);
|
||||
}
|
||||
}
|
||||
hosts
|
||||
}
|
||||
|
||||
pub fn is_https_url(&self, url: &str) -> bool {
|
||||
let host = host_of(url);
|
||||
self.registries.iter().any(|r| r.upstream.starts_with("https://") && r.host() == host)
|
||||
self.config.hosts()
|
||||
}
|
||||
|
||||
pub fn is_index_url(&self, url: &str) -> bool {
|
||||
self.registries.iter().any(|r| r.index && r.host() == host_of(url))
|
||||
}
|
||||
|
||||
/// The URL at the first mirror of the built-in registry it is on, if one is configured.
|
||||
pub fn mirrored(&self, url: String) -> String {
|
||||
for (upstream, mirror) in self.mirrors() {
|
||||
if let Some(rest) = url.strip_prefix(upstream) {
|
||||
return format!("{mirror}{rest}");
|
||||
}
|
||||
}
|
||||
url
|
||||
}
|
||||
|
||||
/// Each built-in upstream with a mirror, paired with its first one.
|
||||
pub fn mirrors(&self) -> Vec<(&'static str, &str)> {
|
||||
let mut mirrors = Vec::new();
|
||||
for registry in BUILT_IN {
|
||||
let first = self.config.registries.get(registry.name()).and_then(|m| m.first());
|
||||
if let Some(mirror) = first {
|
||||
mirrors.push((registry.upstream, mirror.as_str()));
|
||||
}
|
||||
}
|
||||
mirrors
|
||||
self.config.registries.iter().any(|r| r.index && r.host() == host_of(url))
|
||||
}
|
||||
|
||||
pub fn resolve(&self, registry: &'static Registry, rest: &str) -> Resolved {
|
||||
@@ -98,29 +58,4 @@ impl Firewall {
|
||||
pub fn filters(&self) -> &[Box<dyn Filter>] {
|
||||
&self.filters
|
||||
}
|
||||
|
||||
pub fn lift_age_check(&self, eco: &str, package: AllowedPackage, until: Option<Instant>) {
|
||||
let mut lifted = self.age_lifted.lock().unwrap_or_else(|e| e.into_inner());
|
||||
lifted.retain(|(_, _, until)| until.is_none_or(|until| until > Instant::now()));
|
||||
lifted.push((eco.to_owned(), package, until));
|
||||
}
|
||||
|
||||
pub fn age_check_lifted(&self, eco: &str, matches: impl Fn(&AllowedPackage) -> bool) -> bool {
|
||||
let lifted = self.age_lifted.lock().unwrap_or_else(|e| e.into_inner());
|
||||
lifted.iter().any(|(e, package, until)| {
|
||||
e == eco && until.is_none_or(|until| until > Instant::now()) && matches(package)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
/// The built-ins, then a copy of one per mirror. Leaked, as a `Registry` is `'static` everywhere.
|
||||
fn with_mirrors(mirrors: &HashMap<String, Vec<String>>) -> Vec<&'static Registry> {
|
||||
let mut registries = BUILT_IN.to_vec();
|
||||
for built_in in BUILT_IN {
|
||||
for upstream in mirrors.get(built_in.name()).into_iter().flatten() {
|
||||
let upstream = upstream.clone().leak();
|
||||
registries.push(Box::leak(Box::new(Registry { upstream, ..(*built_in).clone() })));
|
||||
}
|
||||
}
|
||||
registries
|
||||
}
|
||||
+1
-6
@@ -1,5 +1,4 @@
|
||||
pub mod aliasing;
|
||||
pub mod blocks;
|
||||
pub mod config;
|
||||
pub mod firewall;
|
||||
pub mod http;
|
||||
@@ -25,11 +24,7 @@ pub fn local_url(port: u16, path: &str) -> String {
|
||||
}
|
||||
|
||||
pub fn init_logging(default_level: &str) {
|
||||
fmt()
|
||||
.with_env_filter(log_filter(default_level))
|
||||
.with_target(false)
|
||||
.with_writer(std::io::stderr)
|
||||
.init();
|
||||
fmt().with_env_filter(log_filter(default_level)).with_target(false).with_writer(std::io::stderr).init();
|
||||
}
|
||||
|
||||
pub(crate) fn log_filter(default_level: &str) -> EnvFilter {
|
||||
|
||||
+4
-1
@@ -58,7 +58,10 @@ fn serve() -> ! {
|
||||
Ok(()) => exit(0),
|
||||
Err(e) if e.kind() == ErrorKind::AddrInUse => {
|
||||
let location = config::path().map_or("the config".into(), |p| p.display().to_string());
|
||||
fail("port", &format!("port {port} is in use, set another in {location}"))
|
||||
fail(
|
||||
"port",
|
||||
&format!("port {port} is in use, set another in {location}"),
|
||||
)
|
||||
}
|
||||
Err(e) if e.kind() == ErrorKind::PermissionDenied => {
|
||||
fail("port", &format!("not allowed to listen on port {port}"))
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
use crate::http::{blocked, https_url};
|
||||
use crate::Firewall;
|
||||
use crate::{policies, telemetry};
|
||||
use crate::Firewall;
|
||||
use rama::error::BoxError;
|
||||
use rama::http::{Request, Response};
|
||||
use rama::{Layer, Service};
|
||||
|
||||
@@ -75,8 +75,8 @@ fn create() -> Result<SecKey, BoxError> {
|
||||
.set_key_type(KeyType::ec_sec_prime_random())
|
||||
.set_token(Token::SecureEnclave)
|
||||
.set_access_control(access);
|
||||
let key =
|
||||
SecKey::new(&options).map_err(|e| format!("secure enclave key generation failed: {e}"))?;
|
||||
let key = SecKey::new(&options)
|
||||
.map_err(|e| format!("secure enclave key generation failed: {e}"))?;
|
||||
|
||||
let blob = key
|
||||
.attributes()
|
||||
@@ -102,10 +102,7 @@ fn load(blob: &[u8]) -> Result<SecKey, BoxError> {
|
||||
CFString::wrap_under_get_rule(kSecAttrKeyClass),
|
||||
CFString::wrap_under_get_rule(kSecAttrKeyClassPrivate).into_CFType(),
|
||||
),
|
||||
(
|
||||
CFString::from_static_string(TOKEN_OBJECT_ID),
|
||||
CFData::from_buffer(blob).into_CFType(),
|
||||
),
|
||||
(CFString::from_static_string(TOKEN_OBJECT_ID), CFData::from_buffer(blob).into_CFType()),
|
||||
])
|
||||
};
|
||||
let mut error = ptr::null_mut();
|
||||
|
||||
@@ -5,8 +5,8 @@ mod uninstall;
|
||||
pub use uninstall::uninstall;
|
||||
|
||||
use crate::config::FirewallConfig;
|
||||
use crate::{mitm, telemetry};
|
||||
use crate::Firewall;
|
||||
use crate::{blocks, mitm, telemetry};
|
||||
use rama::bytes::Bytes;
|
||||
use rama::error::BoxError;
|
||||
use rama::io::BridgeIo;
|
||||
@@ -39,7 +39,6 @@ const CONFIG_FILE: &str = "/Library/Application Support/Firewall/config.json";
|
||||
struct Handler {
|
||||
ca: Arc<mitm::CertificateAuthority>,
|
||||
hosts: Vec<&'static str>,
|
||||
firewall: Arc<Firewall>,
|
||||
service: mitm::MitmService,
|
||||
}
|
||||
|
||||
@@ -59,7 +58,7 @@ impl TransparentProxyHandler for Handler {
|
||||
let message = String::from_utf8_lossy(&message).into_owned();
|
||||
Some(Bytes::from(match message.as_str() {
|
||||
"ca" => self.ca.pem.clone(),
|
||||
other => blocks::answer(&self.firewall, CONFIG_FILE.as_ref(), other),
|
||||
other => format!("error: unknown message {other}"),
|
||||
}))
|
||||
}
|
||||
|
||||
@@ -107,16 +106,15 @@ pub fn system_config() -> Option<PathBuf> {
|
||||
fn handler(exec: Executor) -> Result<Handler, BoxError> {
|
||||
telemetry::set_mode("extension");
|
||||
telemetry::heartbeat();
|
||||
let config = FirewallConfig::load_from(&[CONFIG_FILE.into()])
|
||||
.inspect_err(|_| telemetry::error("config"))?;
|
||||
let config = FirewallConfig::load_from(&[CONFIG_FILE.into()]).inspect_err(|_| telemetry::error("config"))?;
|
||||
let firewall = Arc::new(Firewall::new(config));
|
||||
let hosts = firewall.hosts();
|
||||
let key = enclave::EnclaveKey::load_or_create().inspect_err(|_| telemetry::error("enclave"))?;
|
||||
let signer: mitm::CaSigner = Arc::new(key);
|
||||
let ca = install::certificate_authority(&hosts, &*signer);
|
||||
let ca = Arc::new(ca.inspect_err(|_| telemetry::error("ca"))?);
|
||||
let service = mitm::mitm_service(firewall.clone(), &ca, signer, None, exec);
|
||||
Ok(Handler { ca, hosts, firewall, service })
|
||||
let service = mitm::mitm_service(firewall, &ca, signer, None, exec);
|
||||
Ok(Handler { ca, hosts, service })
|
||||
}
|
||||
|
||||
/// stderr is invisible in a system extension, so events go to the unified log:
|
||||
@@ -126,8 +124,7 @@ fn init(_config: Option<&TransparentProxyInitConfig>) -> bool {
|
||||
std::panic::set_hook(Box::new(|panic| tracing::error!("{panic}")));
|
||||
if let Ok(oslog) = OsLogLayer::new(BUNDLE_ID, "extension") {
|
||||
let oslog = oslog.with_privacy(Privacy::Public);
|
||||
let _ =
|
||||
tracing_subscriber::registry().with(crate::log_filter("info")).with(oslog).try_init();
|
||||
let _ = tracing_subscriber::registry().with(crate::log_filter("info")).with(oslog).try_init();
|
||||
}
|
||||
true
|
||||
}
|
||||
|
||||
+14
-25
@@ -11,7 +11,6 @@ use std::time::{SystemTime, UNIX_EPOCH};
|
||||
use tracing::warn;
|
||||
use windows::Win32::Security::Authorization::{GetNamedSecurityInfoW, SE_FILE_OBJECT};
|
||||
use windows::Win32::Security::*;
|
||||
use windows::Win32::Storage::FileSystem::CreateDirectoryW;
|
||||
use windows_registry::Type;
|
||||
|
||||
/// SYSTEM and admins write, users only read, so no one else can plant a CA for node.
|
||||
@@ -37,7 +36,9 @@ pub fn load_or_create_ca(
|
||||
None => {
|
||||
warn!(?hosts, "minting a new CA");
|
||||
let ca = CertificateAuthority::generate(hosts, signer)?;
|
||||
LOCAL_MACHINE.create(REGISTRY_KEY)?.set_string("ca", ca.to_blob(hosts))?;
|
||||
LOCAL_MACHINE
|
||||
.create(REGISTRY_KEY)?
|
||||
.set_string("ca", ca.to_blob(hosts))?;
|
||||
// Windows discards CRLs it cached before now, in case an old CA's is cached at our URL.
|
||||
let now = SystemTime::now().duration_since(UNIX_EPOCH)?.as_nanos() / 100
|
||||
+ FILETIME_UNIX_EPOCH;
|
||||
@@ -64,39 +65,25 @@ pub fn load_or_create_ca(
|
||||
Ok(ca)
|
||||
}
|
||||
|
||||
/// Created on first use with its ACL, which is reset every time. One a user made first, or a link,
|
||||
/// Created on first use, its owner and ACL reset every time. One a user made first, or a link,
|
||||
/// is replaced: its owner could grant itself access again, and a link would redirect our writes.
|
||||
pub(super) fn secure_data_dir() -> io::Result<PathBuf> {
|
||||
let dir = data_dir();
|
||||
let exists = match std::fs::symlink_metadata(&dir) {
|
||||
Ok(meta) if meta.file_type().is_symlink() => {
|
||||
std::fs::remove_dir(&dir)?;
|
||||
false
|
||||
}
|
||||
match std::fs::symlink_metadata(&dir) {
|
||||
Ok(meta) if meta.file_type().is_symlink() => std::fs::remove_dir(&dir)?,
|
||||
Ok(_) if !owned_by_admins(&dir)? => {
|
||||
warn!(dir = %dir.display(), "replacing a data folder not created by an admin");
|
||||
std::fs::remove_dir_all(&dir)?;
|
||||
false
|
||||
std::fs::remove_dir_all(&dir)?
|
||||
}
|
||||
Ok(_) => true,
|
||||
Err(_) => false,
|
||||
};
|
||||
_ => {}
|
||||
}
|
||||
std::fs::create_dir_all(&dir)?;
|
||||
let info = OWNER_SECURITY_INFORMATION
|
||||
| DACL_SECURITY_INFORMATION
|
||||
| PROTECTED_DACL_SECURITY_INFORMATION;
|
||||
let path = HSTRING::from(dir.as_path());
|
||||
let acl = security_descriptor(DATA_DIR_ACL)?;
|
||||
if exists {
|
||||
unsafe { SetFileSecurityW(&path, info, PSECURITY_DESCRIPTOR(acl.0)).ok()? };
|
||||
} else {
|
||||
let attributes = SECURITY_ATTRIBUTES {
|
||||
nLength: size_of::<SECURITY_ATTRIBUTES>() as u32,
|
||||
lpSecurityDescriptor: acl.0,
|
||||
bInheritHandle: false.into(),
|
||||
};
|
||||
// Never inherits ProgramData's ACL, which lets users add files; fails if it was recreated.
|
||||
unsafe { CreateDirectoryW(&path, Some(&attributes))? };
|
||||
}
|
||||
unsafe { SetFileSecurityW(&path, info, PSECURITY_DESCRIPTOR(acl.0)).ok()? };
|
||||
Ok(dir)
|
||||
}
|
||||
|
||||
@@ -117,7 +104,9 @@ fn owned_by_admins(path: &Path) -> windows::core::Result<bool> {
|
||||
.ok()?
|
||||
};
|
||||
let admins = [WinBuiltinAdministratorsSid, WinLocalSystemSid];
|
||||
let owned = admins.into_iter().any(|sid| unsafe { IsWellKnownSid(owner, sid) }.as_bool());
|
||||
let owned = admins
|
||||
.into_iter()
|
||||
.any(|sid| unsafe { IsWellKnownSid(owner, sid) }.as_bool());
|
||||
// `owner` points into the descriptor, so it is freed last.
|
||||
unsafe { LocalFree(Some(HLOCAL(descriptor.0))) };
|
||||
Ok(owned)
|
||||
|
||||
@@ -2,7 +2,6 @@
|
||||
//! LocalSystem service screens it as the macOS extension does.
|
||||
|
||||
mod ca;
|
||||
mod pipe;
|
||||
mod service;
|
||||
mod tpm;
|
||||
mod tray;
|
||||
@@ -48,7 +47,9 @@ pub fn system_config() -> Option<PathBuf> {
|
||||
/// In the folder Windows reads it from, normally %SystemRoot%\System32\drivers\etc.
|
||||
fn hosts_file() -> PathBuf {
|
||||
let key = r"SYSTEM\CurrentControlSet\Services\Tcpip\Parameters";
|
||||
let configured = LOCAL_MACHINE.open(key).and_then(|key| key.get_hstring("DataBasePath"));
|
||||
let configured = LOCAL_MACHINE
|
||||
.open(key)
|
||||
.and_then(|key| key.get_hstring("DataBasePath"));
|
||||
let dir = match configured {
|
||||
Ok(dir) => expand_environment(&dir),
|
||||
Err(_) => known_folder(&FOLDERID_System).join(r"drivers\etc"),
|
||||
@@ -69,12 +70,17 @@ fn expand_environment(path: &HSTRING) -> PathBuf {
|
||||
let mut expanded = vec![0; len as usize];
|
||||
let len = unsafe { ExpandEnvironmentStringsW(path, Some(&mut expanded)) };
|
||||
// Less the terminating null.
|
||||
PathBuf::from(String::from_utf16_lossy(&expanded[..(len as usize).saturating_sub(1)]))
|
||||
PathBuf::from(String::from_utf16_lossy(
|
||||
&expanded[..(len as usize).saturating_sub(1)],
|
||||
))
|
||||
}
|
||||
|
||||
/// From 127.0.0.3, leaving 127.0.0.1 to whatever else serves locally.
|
||||
fn loopback_addresses(hosts: &[&'static str]) -> Vec<(Ipv4Addr, &'static str)> {
|
||||
(3..).zip(hosts).map(|(i, host)| (Ipv4Addr::new(127, 0, 0, i), *host)).collect()
|
||||
(3..)
|
||||
.zip(hosts)
|
||||
.map(|(i, host)| (Ipv4Addr::new(127, 0, 0, i), *host))
|
||||
.collect()
|
||||
}
|
||||
|
||||
/// Points each host at its listener, replacing the lines we wrote before; with none, only removes
|
||||
@@ -84,7 +90,11 @@ fn write_hosts_entries(hosts: &[&'static str]) -> std::io::Result<()> {
|
||||
let old = std::fs::read(hosts_file())?;
|
||||
let ours = |line: &&[u8]| line.trim_ascii_end().ends_with(TAG.as_bytes());
|
||||
let lines = old.split_inclusive(|&byte| byte == b'\n');
|
||||
let mut new: Vec<u8> = lines.filter(|line| !ours(line)).flatten().copied().collect();
|
||||
let mut new: Vec<u8> = lines
|
||||
.filter(|line| !ours(line))
|
||||
.flatten()
|
||||
.copied()
|
||||
.collect();
|
||||
if !new.is_empty() && !new.ends_with(b"\n") {
|
||||
new.extend_from_slice(b"\r\n");
|
||||
}
|
||||
@@ -109,7 +119,11 @@ fn security_descriptor(sddl: &str) -> windows::core::Result<Owned<HLOCAL>> {
|
||||
}
|
||||
|
||||
fn read_registry_string(key: &str, value: &str) -> Result<Option<String>, BoxError> {
|
||||
none_if_missing(LOCAL_MACHINE.open(key).and_then(|key| key.get_string(value)))
|
||||
none_if_missing(
|
||||
LOCAL_MACHINE
|
||||
.open(key)
|
||||
.and_then(|key| key.get_string(value)),
|
||||
)
|
||||
}
|
||||
|
||||
/// `None` for a missing key or value.
|
||||
|
||||
@@ -1,99 +0,0 @@
|
||||
//! How the tray asks the service what it blocked, and allows a new package, as the macOS app
|
||||
//! messages its extension.
|
||||
|
||||
use super::{config_file, security_descriptor};
|
||||
use crate::{blocks, Firewall};
|
||||
use rama::error::BoxError;
|
||||
use std::os::windows::io::AsRawHandle;
|
||||
use std::sync::Arc;
|
||||
use std::time::Duration;
|
||||
use tokio::io::{AsyncBufReadExt, AsyncReadExt, AsyncWriteExt, BufReader};
|
||||
use tokio::net::windows::named_pipe::{NamedPipeServer, ServerOptions};
|
||||
use windows::core::{Owned, PWSTR};
|
||||
use windows::Win32::Foundation::HANDLE;
|
||||
use windows::Win32::Security::*;
|
||||
use windows::Win32::System::Pipes::{GetNamedPipeClientProcessId, ImpersonateNamedPipeClient};
|
||||
use windows::Win32::System::Threading::*;
|
||||
|
||||
pub(super) const PIPE: &str = r"\\.\pipe\StrixFirewall";
|
||||
/// Signed-in users can connect, as the tray runs as them.
|
||||
const PIPE_ACL: &str = "D:P(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW;;;IU)";
|
||||
|
||||
pub(super) async fn serve(firewall: Arc<Firewall>) -> Result<(), BoxError> {
|
||||
let mut server = create(true)?;
|
||||
loop {
|
||||
server.connect().await?;
|
||||
let client = std::mem::replace(&mut server, create(false)?);
|
||||
let firewall = Arc::clone(&firewall);
|
||||
tokio::spawn(async move {
|
||||
if let Err(error) = answer(client, &firewall).await {
|
||||
tracing::debug!(%error, "could not answer the tray");
|
||||
}
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
fn create(first: bool) -> Result<NamedPipeServer, BoxError> {
|
||||
let acl = security_descriptor(PIPE_ACL)?;
|
||||
let mut attributes = SECURITY_ATTRIBUTES {
|
||||
nLength: size_of::<SECURITY_ATTRIBUTES>() as u32,
|
||||
lpSecurityDescriptor: acl.0,
|
||||
bInheritHandle: false.into(),
|
||||
};
|
||||
let attributes = (&raw mut attributes).cast();
|
||||
let mut options = ServerOptions::new();
|
||||
// Fails if anyone else made the pipe first.
|
||||
options.first_pipe_instance(first);
|
||||
Ok(unsafe { options.create_with_security_attributes_raw(PIPE, attributes)? })
|
||||
}
|
||||
|
||||
/// A line each way.
|
||||
async fn answer(client: NamedPipeServer, firewall: &Firewall) -> Result<(), BoxError> {
|
||||
let mut client = BufReader::new(client);
|
||||
let mut request = String::new();
|
||||
(&mut client).take(64 * 1024).read_line(&mut request).await?;
|
||||
let request = request.trim_end();
|
||||
// Only the app can message the macOS extension; here any program could connect.
|
||||
let reply = if !client_is_tray(client.get_ref())? {
|
||||
"error: only the tray can ask".to_owned()
|
||||
} else if request.starts_with("allow ") && !client_is_admin(client.get_ref())? {
|
||||
"error: trusting a package takes an administrator".to_owned()
|
||||
} else {
|
||||
blocks::answer(firewall, &config_file(), request)
|
||||
};
|
||||
client.write_all(format!("{reply}\n").as_bytes()).await?;
|
||||
// Closing before the tray hangs up could discard the reply.
|
||||
let _ = tokio::time::timeout(Duration::from_secs(5), client.read(&mut [0])).await;
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn client_is_tray(client: &NamedPipeServer) -> Result<bool, BoxError> {
|
||||
let mut id = 0;
|
||||
unsafe { GetNamedPipeClientProcessId(HANDLE(client.as_raw_handle()), &mut id)? };
|
||||
let process = unsafe { Owned::new(OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, false, id)?) };
|
||||
let mut path = [0u16; 1024];
|
||||
let mut len = path.len() as u32;
|
||||
let flags = PROCESS_NAME_WIN32;
|
||||
unsafe { QueryFullProcessImageNameW(*process, flags, PWSTR(path.as_mut_ptr()), &mut len)? };
|
||||
let path = String::from_utf16(&path[..len as usize])?;
|
||||
let tray = std::env::current_exe()?.with_file_name("firewall-tray.exe");
|
||||
// Windows paths ignore case.
|
||||
Ok(path.to_lowercase() == tray.to_string_lossy().to_lowercase())
|
||||
}
|
||||
|
||||
/// Elevated, as only an elevated token has the Administrators group enabled.
|
||||
fn client_is_admin(client: &NamedPipeServer) -> windows::core::Result<bool> {
|
||||
let mut sid = [0u32; SECURITY_MAX_SID_SIZE as usize / 4];
|
||||
let admins = PSID(sid.as_mut_ptr().cast());
|
||||
let mut size = SECURITY_MAX_SID_SIZE;
|
||||
unsafe { CreateWellKnownSid(WinBuiltinAdministratorsSid, None, Some(admins), &mut size)? };
|
||||
unsafe { ImpersonateNamedPipeClient(HANDLE(client.as_raw_handle()))? };
|
||||
let mut member = false.into();
|
||||
let checked = unsafe { CheckTokenMembership(None, admins, &mut member) };
|
||||
// Carrying on as the client would be worse than stopping.
|
||||
if unsafe { RevertToSelf() }.is_err() {
|
||||
std::process::abort();
|
||||
}
|
||||
checked?;
|
||||
Ok(member.as_bool())
|
||||
}
|
||||
@@ -1,8 +1,6 @@
|
||||
use super::ca::{load_or_create_ca, secure_data_dir};
|
||||
use super::tpm::CaKey;
|
||||
use super::{
|
||||
config_file, loopback_addresses, pipe, write_hosts_entries, CRL_ADDRESS, SERVICE_NAME,
|
||||
};
|
||||
use super::{config_file, loopback_addresses, write_hosts_entries, CRL_ADDRESS, SERVICE_NAME};
|
||||
use crate::config::FirewallConfig;
|
||||
use crate::http::{reply, text};
|
||||
use crate::{mitm, telemetry, Firewall};
|
||||
@@ -28,7 +26,6 @@ use std::net::{IpAddr, Ipv4Addr};
|
||||
use std::sync::Arc;
|
||||
use std::time::Duration;
|
||||
use tracing_appender::rolling::{RollingFileAppender, Rotation};
|
||||
use windows::Win32::Foundation::ERROR_GEN_FAILURE;
|
||||
use windows_service::service::*;
|
||||
use windows_service::service_control_handler::{
|
||||
self, ServiceControlHandlerResult, ServiceStatusHandle,
|
||||
@@ -76,10 +73,8 @@ fn run_until_stopped() -> Result<(), BoxError> {
|
||||
| ServiceControl::Shutdown
|
||||
| ServiceControl::Pause
|
||||
| ServiceControl::Continue => {
|
||||
// Answered once handled, so a failed pause fails the caller's ControlService.
|
||||
let (reply, handled) = tokio::sync::oneshot::channel();
|
||||
let _ = control_sender.send((control, reply));
|
||||
handled.blocking_recv().unwrap_or(ServiceControlHandlerResult::NoError)
|
||||
let _ = control_sender.send(control);
|
||||
ServiceControlHandlerResult::NoError
|
||||
}
|
||||
ServiceControl::Interrogate => ServiceControlHandlerResult::NoError,
|
||||
_ => ServiceControlHandlerResult::NotImplemented,
|
||||
@@ -94,24 +89,16 @@ fn run_until_stopped() -> Result<(), BoxError> {
|
||||
}
|
||||
};
|
||||
// Only pausing removes our hosts entries; a stop or crash keeps them, failing closed.
|
||||
while let Some((control, reply)) = control_receiver.recv().await {
|
||||
while let Some(control) = control_receiver.recv().await {
|
||||
let (hosts, state) = match control {
|
||||
ServiceControl::Pause => (&[][..], ServiceState::Paused),
|
||||
ServiceControl::Continue => (&hosts[..], ServiceState::Running),
|
||||
_ => break,
|
||||
};
|
||||
let result = match write_hosts_entries(hosts) {
|
||||
Ok(()) => {
|
||||
set_status(&status, state, false)?;
|
||||
ServiceControlHandlerResult::NoError
|
||||
}
|
||||
Err(error) => {
|
||||
tracing::error!(%error, "could not rewrite the hosts file");
|
||||
let code = error.raw_os_error().map_or(ERROR_GEN_FAILURE.0, |code| code as u32);
|
||||
ServiceControlHandlerResult::Other(code)
|
||||
}
|
||||
};
|
||||
let _ = reply.send(result);
|
||||
match write_hosts_entries(hosts) {
|
||||
Ok(()) => set_status(&status, state, false)?,
|
||||
Err(error) => tracing::error!(%error, "could not rewrite the hosts file"),
|
||||
}
|
||||
}
|
||||
Ok::<_, BoxError>(())
|
||||
});
|
||||
@@ -151,19 +138,16 @@ async fn start_screening(status: &ServiceStatusHandle) -> Result<Vec<&'static st
|
||||
let crl = HttpServer::auto(exec.clone()).service(crl);
|
||||
tokio::spawn(listen_on(CRL_ADDRESS, 80, &exec)?.serve(crl));
|
||||
|
||||
let tray_firewall = Arc::clone(&firewall);
|
||||
tokio::spawn(async move {
|
||||
if let Err(error) = pipe::serve(tray_firewall).await {
|
||||
tracing::error!(%error, "the tray cannot reach the service");
|
||||
}
|
||||
});
|
||||
|
||||
let service = mitm::mitm_service(firewall, &ca, signer, Some(crl_url), exec.clone());
|
||||
for (address, host) in loopback_addresses(&hosts) {
|
||||
for port in [80, 443] {
|
||||
let upstream =
|
||||
RedirectedHost { host, port, resolver: resolver.clone(), service: service.clone() };
|
||||
let upstream = ConsumeErrLayer::trace_as_warning().into_layer(upstream);
|
||||
let upstream = RedirectedHost {
|
||||
host,
|
||||
port,
|
||||
resolver: resolver.clone(),
|
||||
service: service.clone(),
|
||||
};
|
||||
let upstream = ConsumeErrLayer::trace_as_debug().into_layer(upstream);
|
||||
tokio::spawn(listen_on(address, port, &exec)?.serve(upstream));
|
||||
}
|
||||
}
|
||||
|
||||
+22
-358
@@ -1,53 +1,25 @@
|
||||
//! The notification-area icon, started at sign-in as the menu bar app is on macOS.
|
||||
|
||||
use super::pipe::PIPE;
|
||||
use super::*;
|
||||
use muda::{IsMenuItem, Menu, MenuEvent, MenuItem, PredefinedMenuItem, Submenu};
|
||||
use serde::Deserialize;
|
||||
use std::io::{BufRead, BufReader, Cursor, Write};
|
||||
use std::os::windows::io::AsRawHandle;
|
||||
use std::sync::mpsc::{channel, Receiver, Sender};
|
||||
use std::time::Duration;
|
||||
use muda::{Menu, MenuEvent, MenuItem, PredefinedMenuItem};
|
||||
use std::io::Cursor;
|
||||
use tray_icon::{Icon, MouseButtonState, TrayIcon, TrayIconBuilder, TrayIconEvent};
|
||||
use windows::core::{w, HRESULT, PCWSTR};
|
||||
use windows::core::{w, PCWSTR};
|
||||
use windows::Win32::Foundation::*;
|
||||
use windows::Win32::System::LibraryLoader::GetModuleHandleW;
|
||||
use windows::Win32::System::Pipes::GetNamedPipeServerProcessId;
|
||||
use windows::Win32::System::Threading::*;
|
||||
use windows::Win32::UI::Controls::*;
|
||||
use windows::Win32::System::Threading::CreateMutexW;
|
||||
use windows::Win32::UI::Shell::*;
|
||||
use windows::Win32::UI::WindowsAndMessaging::*;
|
||||
use windows_registry::CURRENT_USER;
|
||||
use windows_service::service::{Service, ServiceAccess, ServiceState, ServiceStatus};
|
||||
use windows_service::service::{Service, ServiceAccess, ServiceState};
|
||||
use windows_service::service_manager::{ServiceManager, ServiceManagerAccess};
|
||||
|
||||
const MENU_PAUSE: &str = "pause";
|
||||
const MENU_RESTART: &str = "restart";
|
||||
const MENU_LOG: &str = "log";
|
||||
const MENU_QUIT: &str = "quit";
|
||||
/// Also the service's requests, and `allow` the elevated `firewall-tray` command.
|
||||
const ALLOW: &str = "allow";
|
||||
const ALLOW_ONCE: &str = "allow-once";
|
||||
const LOGO: &[u8] = include_bytes!("tray.png");
|
||||
/// Where blocked packages are listed, below Open logs.
|
||||
const BLOCKED_AT: usize = 5;
|
||||
const BLOCKED_KEPT: usize = 10;
|
||||
|
||||
/// Runs until Quit, once per session.
|
||||
pub fn run() -> Result<(), BoxError> {
|
||||
let args: Vec<String> = std::env::args().skip(1).collect();
|
||||
if let [verb, id, label @ ..] = &args[..] {
|
||||
if verb == ALLOW {
|
||||
// Run by `run_elevated`, so the service can tell an admin asked.
|
||||
let trusted = ask_service(&format!("{ALLOW} {id}"))
|
||||
.and_then(|reply| answered(&format!("Trusted {}", label.join(" ")), &reply));
|
||||
if let Err(error) = trusted {
|
||||
show_error(error);
|
||||
std::process::exit(1);
|
||||
}
|
||||
return Ok(());
|
||||
}
|
||||
}
|
||||
// Held until we exit.
|
||||
let _mutex = unsafe { CreateMutexW(None, false, w!(r"Local\StrixFirewallTray"))? };
|
||||
if unsafe { GetLastError() } == ERROR_ALREADY_EXISTS {
|
||||
@@ -55,18 +27,16 @@ pub fn run() -> Result<(), BoxError> {
|
||||
}
|
||||
let status = MenuItem::new("", false, None);
|
||||
let pause = MenuItem::with_id(MENU_PAUSE, "", false, None);
|
||||
let blocked_separator = PredefinedMenuItem::separator();
|
||||
let menu = Menu::with_items(&[
|
||||
&status,
|
||||
&PredefinedMenuItem::separator(),
|
||||
&pause,
|
||||
&MenuItem::with_id(MENU_RESTART, "Restart", true, None),
|
||||
&MenuItem::with_id(MENU_LOG, "Open logs", true, None),
|
||||
&PredefinedMenuItem::separator(),
|
||||
&MenuItem::with_id(MENU_QUIT, "Quit", true, None),
|
||||
])?;
|
||||
let (logo, logo_size) = logo_mask()?;
|
||||
let icon = TrayIconBuilder::new().with_menu(Box::new(menu.clone())).build()?;
|
||||
let icon = TrayIconBuilder::new().with_menu(Box::new(menu)).build()?;
|
||||
let window = HWND(icon.window_handle());
|
||||
let mut tray = Tray {
|
||||
icon,
|
||||
@@ -76,14 +46,9 @@ pub fn run() -> Result<(), BoxError> {
|
||||
status,
|
||||
pause,
|
||||
state: None,
|
||||
menu,
|
||||
blocked_separator,
|
||||
blocked: Vec::new(),
|
||||
allowed: channel(),
|
||||
};
|
||||
tray.update();
|
||||
// The service holds a new package's download only while it is asked this often.
|
||||
unsafe { SetTimer(None, 0, 500, None) };
|
||||
unsafe { SetTimer(None, 0, 2000, None) };
|
||||
let mut message = MSG::default();
|
||||
while unsafe { GetMessageW(&mut message, None, 0, 0) }.0 > 0 {
|
||||
unsafe { DispatchMessageW(&message) };
|
||||
@@ -94,11 +59,14 @@ pub fn run() -> Result<(), BoxError> {
|
||||
// Ours, not the icon window's own hover timer.
|
||||
if message.message == WM_TIMER && message.hwnd.is_invalid() {
|
||||
tray.update();
|
||||
tray.collect_blocks();
|
||||
}
|
||||
while let Ok(event) = TrayIconEvent::receiver().try_recv() {
|
||||
// The menu opens on release, so this keeps it current.
|
||||
if let TrayIconEvent::Click { button_state: MouseButtonState::Down, .. } = event {
|
||||
if let TrayIconEvent::Click {
|
||||
button_state: MouseButtonState::Down,
|
||||
..
|
||||
} = event
|
||||
{
|
||||
tray.update();
|
||||
}
|
||||
}
|
||||
@@ -123,47 +91,11 @@ struct Tray {
|
||||
pause: MenuItem,
|
||||
/// As the menu last showed it.
|
||||
state: Option<ServiceState>,
|
||||
menu: Menu,
|
||||
blocked_separator: PredefinedMenuItem,
|
||||
/// The most recent, as the menu lists them.
|
||||
blocked: Vec<BlockedPackage>,
|
||||
/// Allowed from another thread, so no longer listed.
|
||||
allowed: (Sender<BlockedPackage>, Receiver<BlockedPackage>),
|
||||
}
|
||||
|
||||
#[derive(Clone, PartialEq, Deserialize)]
|
||||
struct BlockedPackage {
|
||||
id: u64,
|
||||
eco: String,
|
||||
name: String,
|
||||
version: Option<String>,
|
||||
filter: String,
|
||||
reason: String,
|
||||
}
|
||||
|
||||
impl BlockedPackage {
|
||||
fn label(&self) -> String {
|
||||
match &self.version {
|
||||
Some(version) => format!("{} {version} ({})", self.name, self.eco),
|
||||
None => format!("{} ({})", self.name, self.eco),
|
||||
}
|
||||
}
|
||||
|
||||
/// The denylist and OSV only flag packages known to be malicious; the age check only holds
|
||||
/// back new ones.
|
||||
fn malicious(&self) -> bool {
|
||||
self.filter != "age"
|
||||
}
|
||||
|
||||
/// Malware is never allowed, and a new package only by version.
|
||||
fn trustable(&self) -> bool {
|
||||
!self.malicious() && self.version.is_some()
|
||||
}
|
||||
}
|
||||
|
||||
impl Tray {
|
||||
fn update(&mut self) {
|
||||
self.state = service_status().map(|status| status.current_state);
|
||||
self.state = service_state();
|
||||
let screening = self.state == Some(ServiceState::Running);
|
||||
let light = light_taskbar();
|
||||
if self.drawn != Some((light, screening)) {
|
||||
@@ -182,83 +114,7 @@ impl Tray {
|
||||
self.pause.set_enabled(self.state.is_some());
|
||||
}
|
||||
|
||||
/// The service hands each block over once, so whichever tray asks first shows it.
|
||||
fn collect_blocks(&mut self) {
|
||||
let allowed: Vec<_> = self.allowed.1.try_iter().collect();
|
||||
if !allowed.is_empty() {
|
||||
self.blocked.retain(|blocked| !allowed.contains(blocked));
|
||||
self.list_blocked();
|
||||
}
|
||||
if self.state != Some(ServiceState::Running) {
|
||||
return;
|
||||
}
|
||||
let Ok(reply) = ask_service("blocks") else {
|
||||
return;
|
||||
};
|
||||
let Ok(packages) = serde_json::from_str::<Vec<BlockedPackage>>(&reply) else {
|
||||
return;
|
||||
};
|
||||
let mut new = Vec::new();
|
||||
for package in packages {
|
||||
if !self.blocked.contains(&package) {
|
||||
self.blocked.push(package.clone());
|
||||
new.push(package);
|
||||
}
|
||||
}
|
||||
if new.is_empty() {
|
||||
return;
|
||||
}
|
||||
let excess = self.blocked.len().saturating_sub(BLOCKED_KEPT);
|
||||
self.blocked.drain(..excess);
|
||||
self.list_blocked();
|
||||
// Off the UI thread, so the menu keeps working while they are open.
|
||||
let allowed = self.allowed.0.clone();
|
||||
std::thread::spawn(move || {
|
||||
for package in new {
|
||||
if let Some(trust) = alert(&package) {
|
||||
allow(package, trust, &allowed);
|
||||
}
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
fn list_blocked(&self) {
|
||||
while self.menu.items().len() > BLOCKED_AT + 2 {
|
||||
self.menu.remove_at(BLOCKED_AT);
|
||||
}
|
||||
let _ = self.menu.insert(&self.blocked_separator, BLOCKED_AT);
|
||||
for (i, package) in self.blocked.iter().enumerate() {
|
||||
let verb = if package.malicious() { "Blocked" } else { "Held back" };
|
||||
let reason = if package.malicious() {
|
||||
format!("Malicious: {}", package.reason)
|
||||
} else {
|
||||
package.reason.clone()
|
||||
};
|
||||
let reason = MenuItem::new(reason, false, None);
|
||||
let trustable = package.trustable();
|
||||
let once =
|
||||
MenuItem::with_id(format!("{ALLOW_ONCE}:{i}"), "Allow Once", trustable, None);
|
||||
let always =
|
||||
MenuItem::with_id(format!("{ALLOW}:{i}"), "Trust this version", trustable, None);
|
||||
let items: &[&dyn IsMenuItem] =
|
||||
if package.malicious() { &[&reason] } else { &[&reason, &once, &always] };
|
||||
let label = format!("{verb} {}", package.label());
|
||||
if let Ok(item) = Submenu::with_items(label, true, items) {
|
||||
let _ = self.menu.insert(&item, BLOCKED_AT + 1 + i);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fn on_menu(&self, id: &str) {
|
||||
if let Some((verb @ (ALLOW | ALLOW_ONCE), i)) = id.split_once(':') {
|
||||
let trust = verb == ALLOW;
|
||||
let package = i.parse().ok().and_then(|i: usize| self.blocked.get(i));
|
||||
if let Some(package) = package.cloned() {
|
||||
let allowed = self.allowed.0.clone();
|
||||
std::thread::spawn(move || allow(package, trust, &allowed));
|
||||
}
|
||||
return;
|
||||
}
|
||||
let state = self.state;
|
||||
let screening = state == Some(ServiceState::Running);
|
||||
let action: fn() -> Result<(), BoxError> = match id {
|
||||
@@ -267,11 +123,6 @@ impl Tray {
|
||||
|| Ok(open_service()?.resume().map(drop)?)
|
||||
}
|
||||
MENU_PAUSE => || Ok(open_service()?.start::<&str>(&[])?),
|
||||
MENU_RESTART => {
|
||||
// Off the UI thread, since stopping takes a while.
|
||||
std::thread::spawn(|| restart().unwrap_or_else(show_error));
|
||||
return;
|
||||
}
|
||||
MENU_LOG => {
|
||||
let log = HSTRING::from(data_dir().as_path());
|
||||
let none = PCWSTR::null();
|
||||
@@ -280,190 +131,21 @@ impl Tray {
|
||||
}
|
||||
_ => return,
|
||||
};
|
||||
action().unwrap_or_else(show_error);
|
||||
}
|
||||
}
|
||||
|
||||
const ALLOW_ONCE_BUTTON: i32 = 100;
|
||||
const TRUST_BUTTON: i32 = 101;
|
||||
/// `firewall.rc`'s icon, embedded by `build.rs`.
|
||||
const STRIX_ICON: PCWSTR = PCWSTR(1 as _);
|
||||
|
||||
/// `Some(true)` if the user chose to trust it, `Some(false)` to allow it once.
|
||||
/// A task dialog, as a message box can't have both buttons.
|
||||
fn alert(package: &BlockedPackage) -> Option<bool> {
|
||||
let text = format!("{} {}.", package.label(), package.reason);
|
||||
let (title, text, icon) = if package.malicious() {
|
||||
let title = format!("Blocked malware: {}", package.label());
|
||||
let text = text
|
||||
+ "\n\nIt was not installed. Don't install it from another source. If you didn't expect this "
|
||||
+ "package, a dependency may be compromised; tell your security team.";
|
||||
(title, text, TD_ERROR_ICON)
|
||||
} else {
|
||||
("Held back a new package".to_owned(), text, STRIX_ICON)
|
||||
};
|
||||
let button = |id, text| TASKDIALOG_BUTTON { nButtonID: id, pszButtonText: text };
|
||||
let allow = [
|
||||
button(ALLOW_ONCE_BUTTON, w!("Allow Once")),
|
||||
button(TRUST_BUTTON, w!("Trust this version")),
|
||||
];
|
||||
let buttons: &[_] = if package.trustable() { &allow } else { &[] };
|
||||
let (title, text) = (HSTRING::from(title), HSTRING::from(linked(&text)));
|
||||
let dialog = TASKDIALOGCONFIG {
|
||||
cbSize: size_of::<TASKDIALOGCONFIG>() as u32,
|
||||
dwFlags: TDF_ENABLE_HYPERLINKS,
|
||||
// Where `STRIX_ICON` is loaded from; the `TD_` icons are Windows'.
|
||||
hInstance: unsafe { GetModuleHandleW(None) }.ok()?.into(),
|
||||
dwCommonButtons: TDCBF_CLOSE_BUTTON,
|
||||
pszWindowTitle: w!("Strix Firewall"),
|
||||
Anonymous1: TASKDIALOGCONFIG_0 { pszMainIcon: icon },
|
||||
pszMainInstruction: PCWSTR(title.as_ptr()),
|
||||
pszContent: PCWSTR(text.as_ptr()),
|
||||
cButtons: buttons.len() as u32,
|
||||
pButtons: buttons.as_ptr(),
|
||||
pfCallback: Some(on_dialog),
|
||||
..Default::default()
|
||||
};
|
||||
let mut chosen = 0;
|
||||
unsafe { TaskDialogIndirect(&dialog, Some(&raw mut chosen), None, None) }.ok()?;
|
||||
match chosen {
|
||||
ALLOW_ONCE_BUTTON => Some(false),
|
||||
TRUST_BUTTON => Some(true),
|
||||
_ => None,
|
||||
}
|
||||
}
|
||||
|
||||
/// Asks for the foreground, as `MB_SETFOREGROUND` did; Windows may still leave it behind.
|
||||
/// Opens the links `linked` made, in the browser.
|
||||
unsafe extern "system" fn on_dialog(
|
||||
window: HWND,
|
||||
event: TASKDIALOG_NOTIFICATIONS,
|
||||
_: WPARAM,
|
||||
link: LPARAM,
|
||||
_: isize,
|
||||
) -> HRESULT {
|
||||
if event == TDN_CREATED {
|
||||
let _ = unsafe { SetForegroundWindow(window) };
|
||||
} else if event == TDN_HYPERLINK_CLICKED {
|
||||
let link = PCWSTR(link.0 as *const u16);
|
||||
// Only web pages, whatever a block's reason contains.
|
||||
let web = unsafe { link.to_string() }
|
||||
.is_ok_and(|link| link.starts_with("https://") || link.starts_with("http://"));
|
||||
if web {
|
||||
let none = PCWSTR::null();
|
||||
unsafe { ShellExecuteW(None, w!("open"), link, none, none, SW_SHOWNORMAL) };
|
||||
if let Err(error) = action() {
|
||||
let text = HSTRING::from(error.to_string());
|
||||
unsafe { MessageBoxW(None, &text, w!("Strix Firewall"), MB_ICONERROR) };
|
||||
}
|
||||
}
|
||||
S_OK
|
||||
}
|
||||
|
||||
/// A task dialog's markup for the text, with each URL a link.
|
||||
fn linked(text: &str) -> String {
|
||||
let mut marked = String::new();
|
||||
let mut rest = text;
|
||||
while let Some(start) =
|
||||
["https://", "http://"].iter().filter_map(|scheme| rest.find(scheme)).min()
|
||||
{
|
||||
let end = rest[start..].find(|c: char| c.is_whitespace() || c == ',' || c == ')');
|
||||
let url = rest[start..end.map_or(rest.len(), |end| start + end)].trim_end_matches('.');
|
||||
marked += &rest[..start];
|
||||
marked += &format!("<a href=\"{url}\">{url}</a>");
|
||||
rest = &rest[start + url.len()..];
|
||||
}
|
||||
marked + rest
|
||||
}
|
||||
|
||||
/// Trusting writes the config for every user, so it goes through a UAC prompt.
|
||||
/// The elevated process shows its own errors and late replies.
|
||||
fn allow(package: BlockedPackage, trust: bool, allowed: &Sender<BlockedPackage>) {
|
||||
let allowed_it = if trust {
|
||||
run_elevated(&[ALLOW, &package.id.to_string(), &package.label()])
|
||||
.map(|code| code == Some(0))
|
||||
} else {
|
||||
let title = format!("Allowed {} for the next minute", package.label());
|
||||
ask_service(&format!("{ALLOW_ONCE} {}", package.id))
|
||||
.and_then(|reply| answered(&title, &reply))
|
||||
.map(|()| true)
|
||||
};
|
||||
match allowed_it {
|
||||
Ok(true) => {
|
||||
let _ = allowed.send(package);
|
||||
}
|
||||
Ok(false) => {}
|
||||
Err(error) => show_error(error),
|
||||
}
|
||||
}
|
||||
|
||||
/// Tells the user, under `title`, when the install had already stopped waiting.
|
||||
fn answered(title: &str, reply: &str) -> Result<(), BoxError> {
|
||||
match reply {
|
||||
"ok" => Ok(()),
|
||||
"late" => {
|
||||
let text = "The install had already stopped waiting for it. Run it again to finish.";
|
||||
let (title, text) = (HSTRING::from(title), HSTRING::from(text));
|
||||
unsafe { MessageBoxW(None, &text, &title, MB_ICONINFORMATION | MB_SETFOREGROUND) };
|
||||
Ok(())
|
||||
}
|
||||
other => Err(other.into()),
|
||||
}
|
||||
}
|
||||
|
||||
/// This program as an admin, waiting for its exit code; `None` if the user said no.
|
||||
fn run_elevated(args: &[&str]) -> Result<Option<u32>, BoxError> {
|
||||
let exe = HSTRING::from(std::env::current_exe()?.as_path());
|
||||
let parameters = HSTRING::from(args.join(" "));
|
||||
let mut info = SHELLEXECUTEINFOW {
|
||||
cbSize: size_of::<SHELLEXECUTEINFOW>() as u32,
|
||||
fMask: SEE_MASK_NOCLOSEPROCESS,
|
||||
lpVerb: w!("runas"),
|
||||
lpFile: PCWSTR(exe.as_ptr()),
|
||||
lpParameters: PCWSTR(parameters.as_ptr()),
|
||||
nShow: SW_HIDE.0,
|
||||
..Default::default()
|
||||
};
|
||||
if let Err(error) = unsafe { ShellExecuteExW(&mut info) } {
|
||||
if error.code() == ERROR_CANCELLED.to_hresult() {
|
||||
return Ok(None);
|
||||
}
|
||||
return Err(error.into());
|
||||
}
|
||||
let process = unsafe { Owned::new(info.hProcess) };
|
||||
unsafe { WaitForSingleObject(*process, INFINITE) };
|
||||
let mut code = 1;
|
||||
unsafe { GetExitCodeProcess(*process, &mut code)? };
|
||||
Ok(Some(code))
|
||||
}
|
||||
|
||||
/// One request per connection, as the service answers.
|
||||
fn ask_service(request: &str) -> Result<String, BoxError> {
|
||||
let mut pipe = std::fs::OpenOptions::new().read(true).write(true).open(PIPE)?;
|
||||
// Any program can create the pipe if it gets there before the service.
|
||||
let mut server = 0;
|
||||
unsafe { GetNamedPipeServerProcessId(HANDLE(pipe.as_raw_handle()), &mut server)? };
|
||||
if service_status().and_then(|status| status.process_id) != Some(server) {
|
||||
return Err("Another program is posing as the firewall service.".into());
|
||||
}
|
||||
pipe.write_all(format!("{request}\n").as_bytes())?;
|
||||
let mut reply = String::new();
|
||||
BufReader::new(pipe).read_line(&mut reply)?;
|
||||
Ok(reply.trim_end().to_owned())
|
||||
}
|
||||
|
||||
fn show_error(error: BoxError) {
|
||||
let text = match error.source() {
|
||||
Some(source) => format!("{error}: {source}"),
|
||||
None => error.to_string(),
|
||||
};
|
||||
let text = HSTRING::from(text);
|
||||
unsafe { MessageBoxW(None, &text, w!("Strix Firewall"), MB_ICONERROR) };
|
||||
}
|
||||
|
||||
/// `None` when the service is not installed.
|
||||
fn service_status() -> Option<ServiceStatus> {
|
||||
fn service_state() -> Option<ServiceState> {
|
||||
let manager =
|
||||
ServiceManager::local_computer(None::<&str>, ServiceManagerAccess::CONNECT).ok()?;
|
||||
let service = manager.open_service(SERVICE_NAME, ServiceAccess::QUERY_STATUS).ok()?;
|
||||
service.query_status().ok()
|
||||
let service = manager
|
||||
.open_service(SERVICE_NAME, ServiceAccess::QUERY_STATUS)
|
||||
.ok()?;
|
||||
Some(service.query_status().ok()?.current_state)
|
||||
}
|
||||
|
||||
fn light_taskbar() -> bool {
|
||||
@@ -484,28 +166,10 @@ fn status_text(state: Option<ServiceState>) -> &'static str {
|
||||
|
||||
fn open_service() -> Result<Service, BoxError> {
|
||||
let manager = ServiceManager::local_computer(None::<&str>, ServiceManagerAccess::CONNECT)?;
|
||||
let access = ServiceAccess::QUERY_STATUS
|
||||
| ServiceAccess::START
|
||||
| ServiceAccess::STOP
|
||||
| ServiceAccess::PAUSE_CONTINUE;
|
||||
let access = ServiceAccess::START | ServiceAccess::PAUSE_CONTINUE;
|
||||
Ok(manager.open_service(SERVICE_NAME, access)?)
|
||||
}
|
||||
|
||||
/// Starting again re-reads the config.
|
||||
fn restart() -> Result<(), BoxError> {
|
||||
let service = open_service()?;
|
||||
if service.query_status()?.current_state != ServiceState::Stopped {
|
||||
service.stop()?;
|
||||
}
|
||||
for _ in 0..60 {
|
||||
if service.query_status()?.current_state == ServiceState::Stopped {
|
||||
return Ok(service.start::<&str>(&[])?);
|
||||
}
|
||||
std::thread::sleep(Duration::from_millis(500));
|
||||
}
|
||||
Err("The service did not stop.".into())
|
||||
}
|
||||
|
||||
/// The alpha channel of the RGBA logo, and its width.
|
||||
fn logo_mask() -> Result<(Vec<u8>, u32), BoxError> {
|
||||
let mut reader = png::Decoder::new(Cursor::new(LOGO)).read_info()?;
|
||||
|
||||
@@ -63,7 +63,9 @@ impl Filter for Denylist {
|
||||
fn check<'a>(&'a self, registry: &'static Registry, pkg: &'a Package) -> VerdictFuture<'a> {
|
||||
Box::pin(async move {
|
||||
let eco = registry.osv_name;
|
||||
let load = || async { RwLock::new(Arc::new(load(&self.source, eco).await)) };
|
||||
let load = || async {
|
||||
RwLock::new(Arc::new(load(&self.source, eco).await))
|
||||
};
|
||||
let list = self.lists[eco].get_or_init(load).await;
|
||||
let list = Arc::clone(&list.read().expect("denylist lock"));
|
||||
match &*list {
|
||||
@@ -141,7 +143,7 @@ pub fn describe(advisories: &[&Advisory]) -> String {
|
||||
|
||||
/// A failed fetch leaves the last good list in place; a list that never loaded is retried every tick.
|
||||
async fn watch(source: DenylistSource, lists: Arc<Lists>) {
|
||||
let period = Duration::from_secs(source.poll_secs.get());
|
||||
let period = Duration::from_secs(source.poll_secs);
|
||||
let mut seen = revision(&source, None).await;
|
||||
loop {
|
||||
tokio::time::sleep(period).await;
|
||||
|
||||
@@ -3,7 +3,6 @@ pub mod denylist;
|
||||
pub mod osv;
|
||||
|
||||
use super::registries::{Package, Registry};
|
||||
use crate::config::AllowedPackage;
|
||||
use crate::Firewall;
|
||||
use std::future::Future;
|
||||
use std::pin::Pin;
|
||||
@@ -26,19 +25,16 @@ pub trait Filter: Send + Sync {
|
||||
}
|
||||
|
||||
/// Asks every filter. A `Deny` wins; failing that, the first filter that could not tell.
|
||||
/// An allowed package skips only the age check, so malware is never let through.
|
||||
pub async fn consult(
|
||||
firewall: &Firewall,
|
||||
registry: &'static Registry,
|
||||
pkg: &Package,
|
||||
) -> Option<(&'static str, Verdict)> {
|
||||
let lifted = allowed(firewall, registry, pkg)
|
||||
|| firewall.age_check_lifted(registry.eco, |entry| matches(registry, pkg, entry));
|
||||
if allowed(firewall, registry, pkg) {
|
||||
return None;
|
||||
}
|
||||
let mut unsure = None;
|
||||
for filter in firewall.filters() {
|
||||
if lifted && filter.name() == "age" {
|
||||
continue;
|
||||
}
|
||||
match filter.check(registry, pkg).await {
|
||||
Verdict::Allow => continue,
|
||||
Verdict::Deny(reason) => return Some((filter.name(), Verdict::Deny(reason))),
|
||||
@@ -53,15 +49,13 @@ fn allowed(firewall: &Firewall, registry: &Registry, pkg: &Package) -> bool {
|
||||
let Some(entries) = firewall.config.allow.get(registry.eco) else {
|
||||
return false;
|
||||
};
|
||||
entries.iter().any(|entry| matches(registry, pkg, entry))
|
||||
}
|
||||
|
||||
fn matches(registry: &Registry, pkg: &Package, entry: &AllowedPackage) -> bool {
|
||||
let name_matches = match registry.normalize {
|
||||
Some(normalize) => normalize(&entry.name) == pkg.name,
|
||||
None => entry.name == pkg.name,
|
||||
};
|
||||
// Go writes a leading v that the parsed version drops, and PEP 440 ignores one.
|
||||
let version = entry.version.as_deref().map(|v| v.strip_prefix('v').unwrap_or(v));
|
||||
name_matches && (version.is_none() || version == pkg.version.as_deref())
|
||||
entries.iter().any(|entry| {
|
||||
let name_matches = match registry.normalize {
|
||||
Some(normalize) => normalize(&entry.name) == pkg.name,
|
||||
None => entry.name == pkg.name,
|
||||
};
|
||||
// Go writes a leading v that the parsed version drops, and PEP 440 ignores one.
|
||||
let version = entry.version.as_deref().map(|v| v.strip_prefix('v').unwrap_or(v));
|
||||
name_matches && (version.is_none() || version == pkg.version.as_deref())
|
||||
})
|
||||
}
|
||||
@@ -41,11 +41,7 @@ impl Filter for Osv {
|
||||
if hits.is_empty() {
|
||||
Verdict::Allow
|
||||
} else {
|
||||
let links: Vec<String> = hits
|
||||
.iter()
|
||||
.map(|id| format!("{id} https://osv.dev/vulnerability/{id}"))
|
||||
.collect();
|
||||
Verdict::Deny(format!("is flagged malicious by OSV: {}", links.join(", ")))
|
||||
Verdict::Deny(format!("is flagged malicious by OSV ({})", hits.join(", ")))
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
@@ -69,11 +69,7 @@ pub async fn screen(url: &str, firewall: &Firewall) -> Option<String> {
|
||||
};
|
||||
info!(eco = registry.eco, pkg = %pkg.label(), %url, "screening");
|
||||
match consult(firewall, registry, &pkg).await {
|
||||
Some((filter, Verdict::Deny(reason))) => {
|
||||
if crate::blocks::block(registry.eco, &pkg, filter, &reason).await {
|
||||
info!(eco = registry.eco, pkg = %pkg.label(), "allowed while held");
|
||||
return None;
|
||||
}
|
||||
Some((_, Verdict::Deny(reason))) => {
|
||||
Some(format!("{} {reason}", pkg.label()))
|
||||
}
|
||||
Some((filter, Verdict::Unknown(e))) if !firewall.config.fail_open => {
|
||||
|
||||
@@ -36,7 +36,7 @@ pub struct Pattern {
|
||||
}
|
||||
|
||||
/// Requests to the local server match on `prefix`; intercepted URLs match on `upstream`.
|
||||
#[derive(Debug, Clone)]
|
||||
#[derive(Debug)]
|
||||
pub struct Registry {
|
||||
pub prefix: &'static str,
|
||||
pub eco: &'static str,
|
||||
@@ -52,7 +52,7 @@ pub struct Registry {
|
||||
}
|
||||
|
||||
/// A URL to fetch and a JSON pointer to the timestamp in its reply.
|
||||
#[derive(Debug, Clone)]
|
||||
#[derive(Debug)]
|
||||
pub struct Published {
|
||||
pub url: &'static str,
|
||||
pub pointer: &'static str,
|
||||
@@ -63,11 +63,6 @@ impl Registry {
|
||||
pub fn host(&self) -> &'static str {
|
||||
host_of(self.upstream)
|
||||
}
|
||||
|
||||
/// What the config file calls it.
|
||||
pub fn name(&self) -> &'static str {
|
||||
self.prefix.trim_matches('/')
|
||||
}
|
||||
}
|
||||
|
||||
/// The host of an https:// URL, with the path dropped.
|
||||
|
||||
@@ -15,7 +15,7 @@ use std::sync::Arc;
|
||||
use tracing::{info, info_span, warn, Instrument};
|
||||
|
||||
pub fn serve(config: FirewallConfig) -> std::io::Result<()> {
|
||||
let bound = std::net::TcpListener::bind(("127.0.0.1", config.port.get()))?;
|
||||
let bound = std::net::TcpListener::bind(("127.0.0.1", config.port))?;
|
||||
bound.set_nonblocking(true)?;
|
||||
crate::runtime()?.block_on(async move {
|
||||
let firewall = Arc::new(Firewall::new(config));
|
||||
|
||||
@@ -23,7 +23,11 @@ static TELEMETRY: LazyLock<Option<Telemetry>> = LazyLock::new(|| {
|
||||
return None;
|
||||
}
|
||||
let session = format!("{:016x}", rand::random::<u64>());
|
||||
Some(Telemetry { key, session, events: Mutex::default() })
|
||||
Some(Telemetry {
|
||||
key,
|
||||
session,
|
||||
events: Mutex::default(),
|
||||
})
|
||||
});
|
||||
|
||||
/// How the firewall is running: "extension", "service", "wrapper" or "proxy".
|
||||
|
||||
@@ -1,34 +0,0 @@
|
||||
use firewall::blocks::{answer, block};
|
||||
use firewall::policies::Package;
|
||||
use firewall::Firewall;
|
||||
use std::path::Path;
|
||||
use std::time::Duration;
|
||||
|
||||
#[tokio::test]
|
||||
async fn allowing_once_releases_the_held_download() {
|
||||
let firewall = Firewall::default();
|
||||
let config = Path::new("/nonexistent/config.json");
|
||||
let pkg = Package { name: "left-pad".into(), version: Some("1.3.0".into()) };
|
||||
assert!(!block("npm", &pkg, "age", "is new").await, "held while nothing was asking");
|
||||
answer(&firewall, config, "blocks");
|
||||
|
||||
let held = tokio::spawn(async move { block("npm", &pkg, "age", "is new").await });
|
||||
let id = loop {
|
||||
let blocks: serde_json::Value =
|
||||
serde_json::from_str(&answer(&firewall, config, "blocks")).unwrap();
|
||||
if let Some(id) = blocks[0]["id"].as_u64() {
|
||||
break id;
|
||||
}
|
||||
tokio::time::sleep(Duration::from_millis(10)).await;
|
||||
};
|
||||
assert_eq!(answer(&firewall, config, &format!("allow-once {id}")), "ok");
|
||||
assert!(held.await.unwrap(), "the waiting download goes through");
|
||||
assert!(
|
||||
firewall.age_check_lifted("npm", |p| p.name == "left-pad"),
|
||||
"and the rest of the install"
|
||||
);
|
||||
assert!(
|
||||
!block("npm", &Package { name: "evil".into(), version: None }, "denylist", "is malware")
|
||||
.await
|
||||
);
|
||||
}
|
||||
+10
-84
@@ -1,4 +1,4 @@
|
||||
use firewall::config::{path, AllowedPackage};
|
||||
use firewall::config::path;
|
||||
use firewall::policies::filters::consult;
|
||||
use firewall::policies::{screen, Package};
|
||||
use firewall::{Firewall, FirewallConfig};
|
||||
@@ -7,7 +7,7 @@ use firewall::{Firewall, FirewallConfig};
|
||||
fn a_file_only_has_to_set_what_it_changes() {
|
||||
let config: FirewallConfig = serde_json::from_str(r#"{"fail_open": false}"#).expect("parses");
|
||||
assert!(!config.fail_open);
|
||||
assert_eq!(config.port.get(), firewall::DEFAULT_PORT);
|
||||
assert_eq!(config.port, firewall::DEFAULT_PORT);
|
||||
}
|
||||
|
||||
#[test]
|
||||
@@ -15,28 +15,6 @@ fn a_misspelled_setting_is_an_error() {
|
||||
assert!(serde_json::from_str::<FirewallConfig>(r#"{"fail-open": false}"#).is_err());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn nonsense_values_are_errors() {
|
||||
let file = std::env::temp_dir().join(format!("firewall-nonsense-{}.json", std::process::id()));
|
||||
for bad in [
|
||||
r#"{"allow": {"nmp": [{"name": "left-pad"}]}}"#,
|
||||
r#"{"denylist": {"poll_secs": 0}}"#,
|
||||
r#"{"denylist": {"base": "raw.githubusercontent.com/usestrix"}}"#,
|
||||
r#"{"denylist": {"revision": "https://"}}"#,
|
||||
r#"{"port": 0}"#,
|
||||
r#"{"min_age_hours": 18446744073709551615}"#,
|
||||
r#"{"registries": {"npm": ["http://npm.example.com/"]}}"#,
|
||||
r#"{"registries": {"npm": ["https://npm.example.com"]}}"#,
|
||||
r#"{"registries": {"npm": ["https://npm.example.com:8443/"]}}"#,
|
||||
r#"{"registries": {"npm": ["https://[email protected]/"]}}"#,
|
||||
r#"{"registries": {"npm": ["https://npm.example.com/?a=/"]}}"#,
|
||||
] {
|
||||
std::fs::write(&file, bad).expect("write");
|
||||
assert!(FirewallConfig::load_from(std::slice::from_ref(&file)).is_err(), "{bad}");
|
||||
}
|
||||
std::fs::remove_file(&file).ok();
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn the_config_lives_under_the_config_directory() {
|
||||
let path = path().expect("a home directory");
|
||||
@@ -49,13 +27,8 @@ fn a_later_file_wins_and_allow_lists_add_up() {
|
||||
std::fs::create_dir_all(&dir).expect("temp dir");
|
||||
let user = dir.join("user.json");
|
||||
let system = dir.join("system.json");
|
||||
std::fs::write(
|
||||
&user,
|
||||
r#"{"min_age_hours": 1, "fail_open": false, "allow": {"npm": [{"name": "a"}]}}"#,
|
||||
)
|
||||
.expect("write");
|
||||
std::fs::write(&system, r#"{"min_age_hours": 24, "allow": {"npm": [{"name": "b"}]}}"#)
|
||||
.expect("write");
|
||||
std::fs::write(&user, r#"{"min_age_hours": 1, "fail_open": false, "allow": {"npm": [{"name": "a"}]}}"#).expect("write");
|
||||
std::fs::write(&system, r#"{"min_age_hours": 24, "allow": {"npm": [{"name": "b"}]}}"#).expect("write");
|
||||
let missing = dir.join("missing.json");
|
||||
let config = FirewallConfig::load_from(&[user, system, missing]).expect("loads");
|
||||
std::fs::remove_dir_all(&dir).ok();
|
||||
@@ -66,34 +39,14 @@ fn a_later_file_wins_and_allow_lists_add_up() {
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn a_mirror_is_screened_like_the_registry_it_copies() {
|
||||
let config = r#"{"registries": {"npm": ["https://npm.example.com/"]}}"#;
|
||||
let firewall = Firewall::new(serde_json::from_str(config).expect("parses"));
|
||||
assert!(firewall.hosts().contains(&"npm.example.com"));
|
||||
let url = "https://npm.example.com/left-pad/-/left-pad-1.3.0.tgz";
|
||||
let (registry, rest) = firewall.match_on(url, |r| r.upstream).expect("the mirror");
|
||||
assert_eq!(
|
||||
firewall.resolve(registry, rest).pkg.map(|p| p.label()),
|
||||
Some("[email protected]".into())
|
||||
);
|
||||
let unknown = std::env::temp_dir().join(format!("firewall-mirror-{}.json", std::process::id()));
|
||||
std::fs::write(&unknown, r#"{"registries": {"nmp": ["https://npm.example.com/"]}}"#)
|
||||
.expect("write");
|
||||
let loaded = FirewallConfig::load_from(std::slice::from_ref(&unknown));
|
||||
std::fs::remove_file(&unknown).ok();
|
||||
assert!(loaded.is_err());
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn an_allowed_version_is_still_checked_for_malware() {
|
||||
// The unreachable denylist shows that it still runs.
|
||||
async fn an_allowed_version_skips_the_filters() {
|
||||
// An unreachable denylist would otherwise leave the package unchecked.
|
||||
let config = r#"{"allow": {"go": [{"name": "golang.org/x/net", "version": "v0.20.0"}]}, "denylist": {"base": "http://127.0.0.1:1"}}"#;
|
||||
let firewall = Firewall::new(serde_json::from_str(config).expect("parses"));
|
||||
let (registry, _) =
|
||||
firewall.match_on("/go/golang.org/x/net/@v/list", |r| r.prefix).expect("go");
|
||||
let pkg = Package { name: "golang.org/x/net".into(), version: Some("0.20.0".into()) };
|
||||
let verdict = consult(&firewall, registry, &pkg).await;
|
||||
assert_eq!(verdict.map(|(filter, _)| filter), Some("denylist"));
|
||||
let (registry, _) = firewall.match_on("/go/golang.org/x/net/@v/list", |r| r.prefix).expect("go");
|
||||
let pkg = |version: &str| Package { name: "golang.org/x/net".into(), version: Some(version.into()) };
|
||||
assert!(consult(&firewall, registry, &pkg("0.20.0")).await.is_none());
|
||||
assert!(consult(&firewall, registry, &pkg("0.21.0")).await.is_some());
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
@@ -104,30 +57,3 @@ async fn failing_closed_blocks_what_could_not_be_checked() {
|
||||
let blocked = screen(url, &firewall).await.unwrap_or_default();
|
||||
assert!(blocked.contains("could not be checked"), "{blocked:?}");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn lifting_the_age_check_still_checks_for_malware() {
|
||||
let config = r#"{"denylist": {"base": "http://127.0.0.1:1"}}"#;
|
||||
let firewall = Firewall::new(serde_json::from_str(config).expect("parses"));
|
||||
let (registry, _) =
|
||||
firewall.match_on("/go/golang.org/x/net/@v/list", |r| r.prefix).expect("go");
|
||||
let pkg = Package { name: "golang.org/x/net".into(), version: Some("0.20.0".into()) };
|
||||
firewall.lift_age_check("go", AllowedPackage { name: pkg.name.clone(), version: None }, None);
|
||||
let (filter, _) = consult(&firewall, registry, &pkg).await.expect("the denylist still runs");
|
||||
assert_eq!(filter, "denylist");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn allowing_keeps_the_rest_of_the_file() {
|
||||
let path = std::env::temp_dir().join(format!("firewall-allow-{}.json", std::process::id()));
|
||||
std::fs::write(&path, r#"{"fail_open": false}"#).expect("write");
|
||||
for _ in 0..2 {
|
||||
firewall::config::allow(&path, "npm", "left-pad", "1.3.0").expect("allow");
|
||||
}
|
||||
let text = std::fs::read_to_string(&path).expect("read");
|
||||
std::fs::remove_file(&path).ok();
|
||||
let config: FirewallConfig = serde_json::from_str(&text).expect("parses");
|
||||
assert!(!config.fail_open);
|
||||
assert_eq!(config.allow["npm"].len(), 1);
|
||||
assert_eq!(config.allow["npm"][0].version.as_deref(), Some("1.3.0"));
|
||||
}
|
||||
+1
-36
@@ -1,9 +1,7 @@
|
||||
use firewall::aliasing::forward::downgrade;
|
||||
use firewall::http::https_url;
|
||||
use firewall::{aliasing, Firewall, FirewallConfig};
|
||||
use firewall::Firewall;
|
||||
use rama::http::{Body, Request};
|
||||
use std::io::{Read, Write};
|
||||
use std::net::{TcpListener, TcpStream};
|
||||
|
||||
fn request(target: &str, host: Option<&str>) -> Request {
|
||||
let mut builder = Request::builder().method("GET").uri(target);
|
||||
@@ -37,26 +35,6 @@ fn requests_always_go_out_over_tls() {
|
||||
assert_eq!(https_url(&request("/six", None)), None);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn a_plain_http_upstream_is_not_upgraded() {
|
||||
let upstream = TcpListener::bind("127.0.0.1:0").expect("bind");
|
||||
let addr = upstream.local_addr().expect("address");
|
||||
std::thread::spawn(move || {
|
||||
let (mut stream, _) = upstream.accept().expect("accept");
|
||||
let _ = stream.read(&mut [0; 4096]);
|
||||
let _ = stream.write_all(b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\nok");
|
||||
});
|
||||
|
||||
let port = aliasing::spawn(0, FirewallConfig::default()).expect("spawn");
|
||||
let mut proxy = TcpStream::connect(("127.0.0.1", port)).expect("connect");
|
||||
let request =
|
||||
format!("GET http://{addr}/x HTTP/1.1\r\nHost: {addr}\r\nConnection: close\r\n\r\n");
|
||||
proxy.write_all(request.as_bytes()).expect("write");
|
||||
let mut response = String::new();
|
||||
proxy.read_to_string(&mut response).expect("read");
|
||||
assert!(response.starts_with("HTTP/1.1 200") && response.ends_with("ok"), "{response}");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn downgrade_touches_known_hosts_in_text_only() {
|
||||
let text = b"https://pypi.org/x https://example.com/y".to_vec();
|
||||
@@ -65,16 +43,3 @@ async fn downgrade_touches_known_hosts_in_text_only() {
|
||||
let binary = vec![0x1f, 0x8b, 0xff, 0xfe];
|
||||
assert_eq!(downgrade(&firewall, binary.clone()), binary);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn a_mirror_stands_in_for_its_registry() {
|
||||
let mut config = FirewallConfig::default();
|
||||
config.registries.insert("pypi".into(), vec!["https://art.example.com/pypi/".into()]);
|
||||
let firewall = Firewall::new(config);
|
||||
let mirrored = firewall.mirrored("https://pypi.org/simple/six/".into());
|
||||
assert_eq!(mirrored, "https://art.example.com/pypi/simple/six/");
|
||||
let npm = "https://registry.npmjs.org/left-pad";
|
||||
assert_eq!(firewall.mirrored(npm.into()), npm);
|
||||
let links = b"https://art.example.com/pypi/packages/six.whl".to_vec();
|
||||
assert_eq!(downgrade(&firewall, links), b"http://pypi.org/packages/six.whl".to_vec());
|
||||
}
|
||||
@@ -36,8 +36,7 @@ pub fn all(port: u16) -> Vec<(&'static str, Outcome)> {
|
||||
fn run(probe: &Probe, port: u16) -> Outcome {
|
||||
let args = probe.args.iter().map(|arg| arg.to_string()).collect();
|
||||
let dir = probe.setup.and_then(|prepare| prepare());
|
||||
match aliasing::run(port, &Invocation::new(probe.manager.command.into(), args), dir.as_deref())
|
||||
{
|
||||
match aliasing::run(port, &Invocation::new(probe.manager.command.into(), args), dir.as_deref()) {
|
||||
Ok(0) => Outcome::Ok,
|
||||
Ok(_) => Outcome::Failed,
|
||||
Err(e) if e.kind() == std::io::ErrorKind::NotFound => Outcome::Absent,
|
||||
|
||||
@@ -162,12 +162,6 @@
|
||||
Execute='deferred'
|
||||
Impersonate='no'
|
||||
Return='check'/>
|
||||
<!-- From the exit dialog, which runs as the signed-in user rather than elevated. -->
|
||||
<CustomAction
|
||||
Id='StartTray'
|
||||
Directory='APPLICATIONFOLDER'
|
||||
ExeCommand='"[#exe2]"'
|
||||
Return='asyncNoWait'/>
|
||||
<!-- Before its file is replaced or removed. Trays WM_CLOSE does not reach, as in other sessions, are terminated. -->
|
||||
<util:CloseApplication Id='CloseTray' Target='firewall-tray.exe' CloseMessage='yes' RebootPrompt='no' TerminateProcess='0'/>
|
||||
<InstallExecuteSequence>
|
||||
@@ -186,7 +180,6 @@
|
||||
<UIRef Id='WixUI_FeatureTree'/>
|
||||
<Publish Dialog='WelcomeDlg' Control='Next' Event='NewDialog' Value='CustomizeDlg' Order='99'>1</Publish>
|
||||
<Publish Dialog='CustomizeDlg' Control='Back' Event='NewDialog' Value='WelcomeDlg' Order='99'>1</Publish>
|
||||
<Publish Dialog='ExitDialog' Control='Finish' Event='DoAction' Value='StartTray' Order='1'>NOT Installed</Publish>
|
||||
</UI>
|
||||
</Product>
|
||||
|
||||
|
||||
+3
-4
@@ -4,10 +4,9 @@ members = ["cargo:core"]
|
||||
[dist]
|
||||
cargo-dist-version = "0.32.0"
|
||||
ci = "github"
|
||||
installers = ["shell", "powershell", "msi"]
|
||||
installers = ["shell", "powershell", "homebrew", "msi"]
|
||||
# core/wix/main.wxs is edited to install the service.
|
||||
allow-dirty = ["msi"]
|
||||
features = ["machine-wide"]
|
||||
publish-jobs = ["./publish-crates"]
|
||||
global-artifacts-jobs = ["./build-macos-pkg"]
|
||||
tap = "usestrix/homebrew-tap"
|
||||
publish-jobs = ["homebrew", "./publish-crates"]
|
||||
targets = ["aarch64-apple-darwin", "x86_64-apple-darwin", "aarch64-unknown-linux-gnu", "x86_64-unknown-linux-gnu", "x86_64-pc-windows-msvc"]
|
||||
@@ -1,93 +0,0 @@
|
||||
import AppKit
|
||||
import Security
|
||||
|
||||
struct BlockedPackage: Codable, Hashable, Identifiable {
|
||||
let id: UInt64
|
||||
let eco: String
|
||||
let name: String
|
||||
let version: String?
|
||||
let filter: String
|
||||
let reason: String
|
||||
|
||||
var label: String { version.map { "\(name) \($0)" } ?? name }
|
||||
/// The denylist and OSV only flag packages known to be malicious; the age check only holds back new ones.
|
||||
var malicious: Bool { filter != "age" }
|
||||
/// Malware is never allowed, and a new package only by version.
|
||||
var trustable: Bool { !malicious && version != nil }
|
||||
}
|
||||
|
||||
enum Allowance {
|
||||
/// For a minute, so the rest of that install can fetch it too.
|
||||
case once
|
||||
case always
|
||||
}
|
||||
|
||||
@MainActor
|
||||
enum BlockAlert {
|
||||
static func show(_ package: BlockedPackage) -> Allowance? {
|
||||
let alert = NSAlert()
|
||||
alert.addButton(withTitle: "OK")
|
||||
if package.malicious {
|
||||
alert.alertStyle = .critical
|
||||
alert.messageText = "Blocked malware: \(package.label) (\(package.eco))"
|
||||
setText(alert, "\(package.label) \(package.reason).\n\n"
|
||||
+ "It was not installed. Don't install it from another source. "
|
||||
+ "If you didn't expect this package, a dependency may be compromised; tell your security team.")
|
||||
} else {
|
||||
alert.messageText = "Held back a new package"
|
||||
setText(alert, "\(package.label) (\(package.eco)) \(package.reason).")
|
||||
if package.trustable {
|
||||
alert.addButton(withTitle: "Allow Once")
|
||||
alert.addButton(withTitle: "Trust this version")
|
||||
}
|
||||
}
|
||||
NSApp.activate(ignoringOtherApps: true)
|
||||
switch alert.runModal() {
|
||||
case .alertSecondButtonReturn: return .once
|
||||
case .alertThirdButtonReturn: return .always
|
||||
default: return nil
|
||||
}
|
||||
}
|
||||
|
||||
static func late(_ package: BlockedPackage, _ allowance: Allowance) {
|
||||
let alert = NSAlert()
|
||||
alert.messageText = allowance == .once ? "Allowed \(package.label) for the next minute" : "Trusted \(package.label)"
|
||||
alert.informativeText = "The install had already stopped waiting for it. Run it again to finish."
|
||||
NSApp.activate(ignoringOtherApps: true)
|
||||
alert.runModal()
|
||||
}
|
||||
|
||||
/// An alert's own text is plain, so this text goes in a selectable field, where its links open on click.
|
||||
private static func setText(_ alert: NSAlert, _ text: String) {
|
||||
let linked = NSMutableAttributedString(string: text, attributes: [.font: NSFont.systemFont(ofSize: NSFont.smallSystemFontSize)])
|
||||
let detector = try! NSDataDetector(types: NSTextCheckingResult.CheckingType.link.rawValue)
|
||||
for match in detector.matches(in: text, range: NSRange(text.startIndex..., in: text)) {
|
||||
if let url = match.url { linked.addAttribute(.link, value: url, range: match.range) }
|
||||
}
|
||||
let field = NSTextField(wrappingLabelWithString: "")
|
||||
field.allowsEditingTextAttributes = true
|
||||
field.isSelectable = true
|
||||
field.attributedStringValue = linked
|
||||
field.preferredMaxLayoutWidth = 300
|
||||
field.frame.size = field.fittingSize
|
||||
alert.accessoryView = field
|
||||
}
|
||||
}
|
||||
|
||||
enum AdminAuthorization {
|
||||
/// The allowlist applies to every user of the Mac, so changing it takes an admin, as `sudo` would.
|
||||
static func confirm() -> Bool {
|
||||
var authorization: AuthorizationRef?
|
||||
guard AuthorizationCreate(nil, nil, [], &authorization) == errAuthorizationSuccess,
|
||||
let authorization else { return false }
|
||||
defer { AuthorizationFree(authorization, []) }
|
||||
return "system.preferences".withCString { name in
|
||||
var item = AuthorizationItem(name: name, valueLength: 0, value: nil, flags: 0)
|
||||
return withUnsafeMutablePointer(to: &item) { item in
|
||||
var rights = AuthorizationRights(count: 1, items: item)
|
||||
let flags: AuthorizationFlags = [.interactionAllowed, .extendRights]
|
||||
return AuthorizationCopyRights(authorization, &rights, nil, flags, nil) == errAuthorizationSuccess
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -29,13 +29,11 @@ enum FirewallError: Error, LocalizedError {
|
||||
case extensionUnavailable
|
||||
case screeningDidNotStart(NEVPNStatus)
|
||||
case extensionStopped(String)
|
||||
case extensionRefused(String)
|
||||
|
||||
var errorDescription: String? {
|
||||
switch self {
|
||||
case .extensionUnavailable: return "The extension is not running"
|
||||
case let .screeningDidNotStart(status): return "Screening did not start (\(status.label))"
|
||||
case let .extensionRefused(reply): return "The extension replied \(reply)"
|
||||
case let .extensionStopped(reason):
|
||||
return "The extension stopped: \(reason). Its log: log show --last 5m --predicate 'subsystem BEGINSWITH \"\(FirewallIDs.appBundleID)\"'"
|
||||
}
|
||||
@@ -53,7 +51,6 @@ final class FirewallModel: NSObject, ObservableObject {
|
||||
@Published private(set) var completed = false
|
||||
@Published private(set) var removed = false
|
||||
@Published private(set) var screening = false
|
||||
@Published private(set) var blocked: [BlockedPackage] = []
|
||||
|
||||
private let logger = Logger(subsystem: FirewallIDs.appBundleID, category: "installer")
|
||||
private var pendingRequest: (request: OSSystemExtensionRequest, continuation: CheckedContinuation<Void, Error>)?
|
||||
@@ -75,7 +72,6 @@ final class FirewallModel: NSObject, ObservableObject {
|
||||
await refresh()
|
||||
if CommandLine.arguments.contains("--install") { await install() }
|
||||
}
|
||||
Task { await watchBlocks() }
|
||||
}
|
||||
|
||||
// MARK: - Flows
|
||||
@@ -203,39 +199,6 @@ final class FirewallModel: NSObject, ObservableObject {
|
||||
if let url = URL(string: pane) { NSWorkspace.shared.open(url) }
|
||||
}
|
||||
|
||||
/// Trusting changes the config for every user, so it takes an admin.
|
||||
func allow(_ package: BlockedPackage, _ allowance: Allowance) async {
|
||||
guard package.trustable else { return }
|
||||
if allowance == .always, !AdminAuthorization.confirm() {
|
||||
log("Trust cancelled for \(package.label)")
|
||||
return
|
||||
}
|
||||
do {
|
||||
let reply = try await providerMessage("\(allowance == .once ? "allow-once" : "allow") \(package.id)")
|
||||
guard reply == "ok" || reply == "late" else { throw FirewallError.extensionRefused(reply) }
|
||||
blocked.removeAll { $0 == package }
|
||||
log("Allowed \(package.label) (\(package.eco)) \(allowance)")
|
||||
if reply == "late" { BlockAlert.late(package, allowance) }
|
||||
} catch {
|
||||
log("Could not allow \(package.label): \(error.localizedDescription)")
|
||||
}
|
||||
}
|
||||
|
||||
/// The extension cannot message the app, so the app asks it for blocks.
|
||||
private func watchBlocks() async {
|
||||
while true {
|
||||
if screening, let reply = try? await providerMessage("blocks"),
|
||||
let packages = try? JSONDecoder().decode([BlockedPackage].self, from: Data(reply.utf8)) {
|
||||
for package in packages where !blocked.contains(package) {
|
||||
blocked.append(package)
|
||||
if let allowance = BlockAlert.show(package) { await allow(package, allowance) }
|
||||
}
|
||||
blocked = Array(blocked.suffix(10))
|
||||
}
|
||||
try? await Task.sleep(nanoseconds: 500_000_000)
|
||||
}
|
||||
}
|
||||
|
||||
private func stage(_ step: ReferenceWritableKeyPath<FirewallModel, StepStatus>,
|
||||
running: String,
|
||||
work: @MainActor () async throws -> String) async -> Bool {
|
||||
|
||||
@@ -22,28 +22,5 @@ struct MenuBarView: View {
|
||||
Task { await model.restart() }
|
||||
}
|
||||
.disabled(model.busy)
|
||||
|
||||
if !model.blocked.isEmpty {
|
||||
Divider()
|
||||
ForEach(model.blocked) { package in
|
||||
if !package.malicious {
|
||||
Menu("Held back \(package.label) (\(package.eco))") {
|
||||
Text(package.reason)
|
||||
Button("Allow Once") {
|
||||
Task { await model.allow(package, .once) }
|
||||
}
|
||||
.disabled(model.busy || !package.trustable)
|
||||
Button("Trust this version") {
|
||||
Task { await model.allow(package, .always) }
|
||||
}
|
||||
.disabled(model.busy || !package.trustable)
|
||||
}
|
||||
} else {
|
||||
Menu("Blocked \(package.label) (\(package.eco))") {
|
||||
Text("Malicious: \(package.reason)")
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
+1
-2
@@ -47,8 +47,7 @@ build() {
|
||||
echo "==> Building"
|
||||
xcodegen generate >/dev/null
|
||||
xcodebuild -project Firewall.xcodeproj -scheme StrixFirewall -configuration $CONFIGURATION \
|
||||
-destination generic/platform=macOS \
|
||||
-derivedDataPath build CURRENT_PROJECT_VERSION="$(date +%s)" CODE_SIGNING_ALLOWED=NO CODE_SIGNING_REQUIRED=NO \
|
||||
-derivedDataPath build CODE_SIGNING_ALLOWED=NO CODE_SIGNING_REQUIRED=NO \
|
||||
CODE_SIGN_IDENTITY="" CODE_SIGN_ENTITLEMENTS="" build >/dev/null
|
||||
}
|
||||
|
||||
|
||||
+3
-15
@@ -10,7 +10,7 @@ settings:
|
||||
"CARGO_PROFILE[config=Debug]": debug
|
||||
"LIBRARY_SEARCH_PATHS[arch=arm64]": $(SRCROOT)/../core/target/aarch64-apple-darwin/$(CARGO_PROFILE)
|
||||
"LIBRARY_SEARCH_PATHS[arch=x86_64]": $(SRCROOT)/../core/target/x86_64-apple-darwin/$(CARGO_PROFILE)
|
||||
ARCHS: arm64 x86_64
|
||||
ARCHS: arm64
|
||||
"ONLY_ACTIVE_ARCH[config=Debug]": "YES"
|
||||
SWIFT_VERSION: "5.0"
|
||||
DEVELOPMENT_TEAM: ${TEAM}
|
||||
@@ -19,8 +19,6 @@ settings:
|
||||
ENABLE_DEBUG_DYLIB: "NO"
|
||||
CODE_SIGN_STYLE: Automatic
|
||||
CODE_SIGN_IDENTITY: Apple Development
|
||||
# build.sh sets a fresh one per build; macOS only replaces an installed extension whose version differs.
|
||||
CURRENT_PROJECT_VERSION: "1"
|
||||
|
||||
packages:
|
||||
Rama:
|
||||
@@ -44,7 +42,6 @@ targets:
|
||||
properties:
|
||||
CFBundlePackageType: SYSX
|
||||
CFBundleShortVersionString: "0.1"
|
||||
CFBundleVersion: $(CURRENT_PROJECT_VERSION)
|
||||
NSSystemExtensionUsageDescription: Firewall uses a network extension to screen package downloads before they install.
|
||||
NetworkExtension:
|
||||
NEMachServiceName: ${TEAM}.com.usestrix.firewall.extension
|
||||
@@ -105,7 +102,6 @@ targets:
|
||||
path: App/Info.plist
|
||||
properties:
|
||||
CFBundleShortVersionString: "0.1"
|
||||
CFBundleVersion: $(CURRENT_PROJECT_VERSION)
|
||||
LSMinimumSystemVersion: $(MACOSX_DEPLOYMENT_TARGET)
|
||||
NSSystemExtensionUsageDescription: Firewall uses a network extension to screen package downloads before they install.
|
||||
LSUIElement: true
|
||||
@@ -131,13 +127,5 @@ targets:
|
||||
unset CC CXX CFLAGS CXXFLAGS
|
||||
export SDKROOT="$(xcrun --sdk macosx --show-sdk-path)"
|
||||
cd "$SRCROOT/../core"
|
||||
bins=
|
||||
for arch in $ARCHS; do
|
||||
case $arch in
|
||||
arm64|arm64e) triple=aarch64-apple-darwin ;;
|
||||
x86_64) triple=x86_64-apple-darwin ;;
|
||||
esac
|
||||
cargo build --bin firewall-uninstall --features machine-wide --target $triple $([ "$CONFIGURATION" = Debug ] || echo --release)
|
||||
bins="$bins target/$triple/$CARGO_PROFILE/firewall-uninstall"
|
||||
done
|
||||
lipo -create $bins -output "$TARGET_BUILD_DIR/$EXECUTABLE_FOLDER_PATH/firewall-uninstall"
|
||||
cargo build --bin firewall-uninstall --target aarch64-apple-darwin $([ "$CONFIGURATION" = Debug ] || echo --release)
|
||||
cp "target/aarch64-apple-darwin/$CARGO_PROFILE/firewall-uninstall" "$TARGET_BUILD_DIR/$EXECUTABLE_FOLDER_PATH/"
|
||||
Reference in new issue
Block a user