Create the Windows data folder with its ACL instead of setting it after

On Windows the console sends Ctrl+C to both processes. The firewall
exited at once with 0xC000013A, handing the prompt back while a .cmd
shim's cmd.exe still asked "Terminate batch job (Y/N)?". It now ignores
Ctrl+C and Ctrl+Break while the manager runs and exits with its code.

A killed firewall also left the manager and its children running. The
firewall now joins a kill-on-close job before spawning, so whatever is
left dies with it.

An argument with a line break, which Rust refuses to pass to a batch
file, now says so instead of "batch file arguments are invalid".

Co-authored-by: Ian Graham Martinez <[email protected]>

core/Cargo.toml

@@ -38,14 +38,17 @@ path = "src/main.rs"
 [[bin]]
 name = "firewall-service"
 path = "src/bin/firewall-service.rs"
+required-features = ["machine-wide"]
 
 [[bin]]
 name = "firewall-tray"
 path = "src/bin/firewall-tray.rs"
+required-features = ["machine-wide"]
 
 [[bin]]
 name = "firewall-uninstall"
 path = "src/bin/firewall-uninstall.rs"
+required-features = ["machine-wide"]
 
 [[example]]
 name = "proxy-test"
@@ -87,6 +90,10 @@ path = "tests/tpm.rs"
 name = "managers"
 path = "tests/managers.rs"
 
+[features]
+# Builds the machine-wide binaries: the Windows service and tray, and the macOS uninstaller.
+machine-wide = []
+
 [dependencies]
 clap = "4.6.6"
 directories = "6.0.0"
@@ -118,7 +125,7 @@ schannel = "0.1.29"
 tokio = { version = "1.53.1", features = ["net"] }
 tracing-appender = "0.2.5"
 tray-icon = { version = "0.26.1", default-features = false }
-windows = { version = "0.62", features = ["Win32_Foundation", "Win32_Security", "Win32_Security_Authorization", "Win32_Security_Cryptography", "Win32_System_Com", "Win32_System_Environment", "Win32_System_Threading", "Win32_UI_Shell", "Win32_UI_WindowsAndMessaging"] }
+windows = { version = "0.62", features = ["Win32_Foundation", "Win32_Security", "Win32_Security_Authorization", "Win32_Security_Cryptography", "Win32_Storage_FileSystem", "Win32_System_Com", "Win32_System_Console", "Win32_System_Environment", "Win32_System_JobObjects", "Win32_System_Threading", "Win32_UI_Shell", "Win32_UI_WindowsAndMessaging"] }
 windows-registry = "0.6.1"
 windows-service = "0.8.0"
 

core/src/aliasing/forward.rs

@@ -89,12 +89,16 @@ async fn handle(req: Request, firewall: &Firewall) -> Result<Response, Infallibl
     }
 
     info!(method = %req.method(), %url, "forwarding");
-    let index = firewall.is_index_url(&url);
+    // Only an HTTPS registry was downgraded to reach us, so only it is upgraded back and rewritten.
+    let tls = firewall.is_https_url(&url);
+    let index = tls && firewall.is_index_url(&url);
     let (mut parts, body) = req.into_parts();
-    let Ok(uri) = url.parse() else {
-        return Ok(text(400, "firewall: expected an absolute URL\n"));
-    };
-    parts.uri = uri;
+    if tls {
+        let Ok(uri) = url.parse() else {
+            return Ok(text(400, "firewall: expected an absolute URL\n"));
+        };
+        parts.uri = uri;
+    }
 
     let client = DecompressionLayer::new().into_layer(EasyHttpWebClient::default());
     let response = match client.serve(Request::from_parts(parts, body)).await {

core/src/aliasing/mod.rs

@@ -1,5 +1,7 @@
 pub mod forward;
 pub mod managers;
+#[cfg(windows)]
+mod windows;
 
 pub use forward::spawn;
 pub use managers::*;
@@ -34,7 +36,8 @@ impl Invocation {
 
 pub fn run(port: u16, invocation: &Invocation, dir: Option<&Path>) -> std::io::Result<i32> {
     let proxy = crate::local_url(port, "");
-    let mut command = Command::new(resolve(&invocation.program)?);
+    let program = resolve(&invocation.program)?;
+    let mut command = Command::new(&program);
     command.args(invocation.arguments(&proxy));
     if let Some(dir) = dir {
         command.current_dir(dir);
@@ -42,7 +45,12 @@ pub fn run(port: u16, invocation: &Invocation, dir: Option<&Path>) -> std::io::R
     for (key, value) in managers::variables(&proxy) {
         command.env(key, value);
     }
-    Ok(command.status()?.code().unwrap_or(1))
+    #[cfg(windows)]
+    windows::prepare();
+    let status = command.status();
+    #[cfg(windows)]
+    let status = status.map_err(|error| windows::explain(error, &program));
+    Ok(status?.code().unwrap_or(1))
 }
 
 // Command::new only finds .exe on Windows; npm, pnpm and gem are .cmd shims found via PATHEXT.

core/src/aliasing/windows.rs

@@ -0,0 +1,64 @@
+use std::io::{Error, ErrorKind};
+use std::path::Path;
+use std::sync::Once;
+use tracing::debug;
+use windows::core::{BOOL, PCWSTR};
+use windows::Win32::System::Console::{SetConsoleCtrlHandler, CTRL_BREAK_EVENT, CTRL_C_EVENT};
+use windows::Win32::System::JobObjects::{
+    AssignProcessToJobObject, CreateJobObjectW, JobObjectExtendedLimitInformation,
+    SetInformationJobObject, JOBOBJECT_EXTENDED_LIMIT_INFORMATION,
+    JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE,
+};
+use windows::Win32::System::Threading::GetCurrentProcess;
+
+/// Called before spawning, so the manager behaves as it would run from the shell directly.
+/// Once per process: a caller may run several managers.
+pub fn prepare() {
+    static PREPARED: Once = Once::new();
+    PREPARED.call_once(|| {
+        // The console sends Ctrl+C to the manager too. Exiting first would hand the prompt back
+        // while a .cmd shim still asks "Terminate batch job (Y/N)?", so wait for its exit instead.
+        // A handler, unlike ignoring the signal outright, is not inherited by the manager.
+        let _ = unsafe { SetConsoleCtrlHandler(Some(ignore_interrupt), true) };
+        if let Err(error) = kill_children_on_exit() {
+            debug!(%error, "the manager may outlive the firewall");
+        }
+    });
+}
+
+unsafe extern "system" fn ignore_interrupt(event: u32) -> BOOL {
+    (event == CTRL_C_EVENT || event == CTRL_BREAK_EVENT).into()
+}
+
+/// Joins a job that kills what is left in it once the firewall exits, even if killed itself.
+/// The manager inherits the job when spawned, as do its own children.
+fn kill_children_on_exit() -> windows::core::Result<()> {
+    let mut limits = JOBOBJECT_EXTENDED_LIMIT_INFORMATION::default();
+    limits.BasicLimitInformation.LimitFlags = JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE;
+    // Never closed: the handle closing as the firewall exits is what kills the rest.
+    let job = unsafe { CreateJobObjectW(None, PCWSTR::null())? };
+    unsafe {
+        SetInformationJobObject(
+            job,
+            JobObjectExtendedLimitInformation,
+            (&raw const limits).cast(),
+            size_of_val(&limits) as u32,
+        )?
+    };
+    unsafe { AssignProcessToJobObject(job, GetCurrentProcess()) }
+}
+
+/// Rust refuses to pass a line break to a batch file, where it would cut the command short.
+pub fn explain(error: Error, program: &Path) -> Error {
+    let batch = program
+        .extension()
+        .is_some_and(|ext| ext.eq_ignore_ascii_case("cmd") || ext.eq_ignore_ascii_case("bat"));
+    if !batch || error.kind() != ErrorKind::InvalidInput {
+        return error;
+    }
+    let name = program.file_name().unwrap_or(program.as_os_str()).to_string_lossy();
+    Error::new(
+        ErrorKind::InvalidInput,
+        format!("{name} is a batch file, which cannot be passed an argument with a line break"),
+    )
+}

core/src/blocks.rs

@@ -0,0 +1,36 @@
+use crate::policies::Package;
+use serde::Serialize;
+use std::sync::Mutex;
+
+/// Bounded, so blocks pile up harmlessly while nothing collects them.
+const KEPT: usize = 50;
+
+static RECENT: Mutex<Vec<BlockedPackage>> = Mutex::new(Vec::new());
+
+#[derive(Serialize)]
+pub struct BlockedPackage {
+    pub eco: &'static str,
+    pub name: String,
+    pub version: Option<String>,
+    pub filter: &'static str,
+    pub reason: String,
+}
+
+pub fn record(eco: &'static str, pkg: &Package, filter: &'static str, reason: &str) {
+    let mut recent = RECENT.lock().unwrap_or_else(|e| e.into_inner());
+    if recent.len() == KEPT {
+        recent.remove(0);
+    }
+    recent.push(BlockedPackage {
+        eco,
+        name: pkg.name.clone(),
+        version: pkg.version.clone(),
+        filter,
+        reason: reason.to_owned(),
+    });
+}
+
+/// Hands each block over once.
+pub fn take() -> Vec<BlockedPackage> {
+    std::mem::take(&mut *RECENT.lock().unwrap_or_else(|e| e.into_inner()))
+}

core/src/config/mod.rs

@@ -1,10 +1,10 @@
 use crate::policies::registries::{Registry, BUILT_IN};
 use directories::ProjectDirs;
 use serde::Deserialize;
-use serde_json::{Map, Value};
+use serde_json::{json, Map, Value};
 use std::collections::HashMap;
 use std::io::{Error, ErrorKind};
-use std::path::PathBuf;
+use std::path::{Path, PathBuf};
 
 pub const DEFAULT_PORT: u16 = 8080;
 
@@ -48,7 +48,7 @@ impl Default for FirewallConfig {
         FirewallConfig {
             port: DEFAULT_PORT,
             fail_open: true,
-            min_age_hours: 0,
+            min_age_hours: 24,
             denylist: DenylistSource::default(),
             allow: HashMap::new(),
             telemetry: true,
@@ -129,3 +129,31 @@ fn merge(base: &mut Map<String, Value>, top: Map<String, Value>) {
         }
     }
 }
+
+/// Adds an `allow` entry to the file, leaving the rest of it as written.
+pub fn allow(path: &Path, eco: &str, name: &str, version: Option<&str>) -> std::io::Result<()> {
+    let invalid = |e: String| Error::new(ErrorKind::InvalidData, format!("{}: {e}", path.display()));
+    let mut config = match std::fs::read_to_string(path) {
+        Ok(text) => serde_json::from_str(&text).map_err(|e| invalid(e.to_string()))?,
+        Err(e) if e.kind() == ErrorKind::NotFound => json!({}),
+        Err(e) => return Err(e),
+    };
+    if !config.is_object() {
+        return Err(invalid("not an object".into()));
+    }
+    let entry = json!({ "name": name, "version": version });
+    let entries = &mut config["allow"][eco];
+    if entries.is_null() {
+        *entries = Value::Array(Vec::new());
+    }
+    let Some(entries) = entries.as_array_mut() else {
+        return Err(invalid(format!("allow.{eco} is not a list")));
+    };
+    if !entries.contains(&entry) {
+        entries.push(entry);
+    }
+    if let Some(dir) = path.parent() {
+        std::fs::create_dir_all(dir)?;
+    }
+    std::fs::write(path, serde_json::to_string_pretty(&config)?)
+}

core/src/firewall.rs

@@ -47,6 +47,11 @@ impl Firewall {
         self.config.hosts()
     }
 
+    pub fn is_https_url(&self, url: &str) -> bool {
+        let host = host_of(url);
+        self.config.registries.iter().any(|r| r.upstream.starts_with("https://") && r.host() == host)
+    }
+
     pub fn is_index_url(&self, url: &str) -> bool {
         self.config.registries.iter().any(|r| r.index && r.host() == host_of(url))
     }

core/src/lib.rs

@@ -1,4 +1,5 @@
 pub mod aliasing;
+pub mod blocks;
 pub mod config;
 pub mod firewall;
 pub mod http;

core/src/os/macos/mod.rs

@@ -4,8 +4,8 @@ mod uninstall;
 
 pub use uninstall::uninstall;
 
-use crate::config::FirewallConfig;
-use crate::{mitm, telemetry};
+use crate::config::{self, FirewallConfig};
+use crate::{blocks, mitm, telemetry};
 use crate::Firewall;
 use rama::bytes::Bytes;
 use rama::error::BoxError;
@@ -22,6 +22,7 @@ use rama::net::apple::networkextension::{transparent_proxy_ffi, NwTcpStream, Tcp
 use rama::rt::Executor;
 use rama::telemetry::tracing::apple::oslog::{OsLogLayer, Privacy};
 use rama::{Layer, Service};
+use serde::Deserialize;
 use std::convert::Infallible;
 use std::path::PathBuf;
 use std::sync::Arc;
@@ -58,7 +59,12 @@ impl TransparentProxyHandler for Handler {
         let message = String::from_utf8_lossy(&message).into_owned();
         Some(Bytes::from(match message.as_str() {
             "ca" => self.ca.pem.clone(),
-            other => format!("error: unknown message {other}"),
+            "blocks" => serde_json::to_string(&blocks::take()).expect("blocks serialize"),
+            other => match other.strip_prefix("allow ").map(allow) {
+                Some(Ok(())) => "ok".to_owned(),
+                Some(Err(error)) => format!("error: {error}"),
+                None => format!("error: unknown message {other}"),
+            },
         }))
     }
 
@@ -117,6 +123,20 @@ fn handler(exec: Executor) -> Result<Handler, BoxError> {
     Ok(Handler { ca, hosts, service })
 }
 
+#[derive(Deserialize)]
+struct AllowRequest {
+    eco: String,
+    name: String,
+    version: Option<String>,
+}
+
+/// Takes effect when the provider restarts, which rebuilds it from the config.
+fn allow(request: &str) -> Result<(), BoxError> {
+    let request: AllowRequest = serde_json::from_str(request)?;
+    config::allow(CONFIG_FILE.as_ref(), &request.eco, &request.name, request.version.as_deref())?;
+    Ok(())
+}
+
 /// stderr is invisible in a system extension, so events go to the unified log:
 /// `log stream --predicate 'subsystem == "com.usestrix.firewall"'`.
 fn init(_config: Option<&TransparentProxyInitConfig>) -> bool {

core/src/os/windows/ca.rs

@@ -11,6 +11,7 @@ use std::time::{SystemTime, UNIX_EPOCH};
 use tracing::warn;
 use windows::Win32::Security::Authorization::{GetNamedSecurityInfoW, SE_FILE_OBJECT};
 use windows::Win32::Security::*;
+use windows::Win32::Storage::FileSystem::CreateDirectoryW;
 use windows_registry::Type;
 
 /// SYSTEM and admins write, users only read, so no one else can plant a CA for node.
@@ -65,25 +66,39 @@ pub fn load_or_create_ca(
     Ok(ca)
 }
 
-/// Created on first use, its owner and ACL reset every time. One a user made first, or a link,
+/// Created on first use with its ACL, which is reset every time. One a user made first, or a link,
 /// is replaced: its owner could grant itself access again, and a link would redirect our writes.
 pub(super) fn secure_data_dir() -> io::Result<PathBuf> {
     let dir = data_dir();
-    match std::fs::symlink_metadata(&dir) {
-        Ok(meta) if meta.file_type().is_symlink() => std::fs::remove_dir(&dir)?,
+    let exists = match std::fs::symlink_metadata(&dir) {
+        Ok(meta) if meta.file_type().is_symlink() => {
+            std::fs::remove_dir(&dir)?;
+            false
+        }
         Ok(_) if !owned_by_admins(&dir)? => {
             warn!(dir = %dir.display(), "replacing a data folder not created by an admin");
-            std::fs::remove_dir_all(&dir)?
+            std::fs::remove_dir_all(&dir)?;
+            false
         }
-        _ => {}
-    }
-    std::fs::create_dir_all(&dir)?;
+        Ok(_) => true,
+        Err(_) => false,
+    };
     let info = OWNER_SECURITY_INFORMATION
         | DACL_SECURITY_INFORMATION
         | PROTECTED_DACL_SECURITY_INFORMATION;
     let path = HSTRING::from(dir.as_path());
     let acl = security_descriptor(DATA_DIR_ACL)?;
-    unsafe { SetFileSecurityW(&path, info, PSECURITY_DESCRIPTOR(acl.0)).ok()? };
+    if exists {
+        unsafe { SetFileSecurityW(&path, info, PSECURITY_DESCRIPTOR(acl.0)).ok()? };
+    } else {
+        let attributes = SECURITY_ATTRIBUTES {
+            nLength: size_of::<SECURITY_ATTRIBUTES>() as u32,
+            lpSecurityDescriptor: acl.0,
+            bInheritHandle: false.into(),
+        };
+        // Never inherits ProgramData's ACL, which lets users add files; fails if it was recreated.
+        unsafe { CreateDirectoryW(&path, Some(&attributes))? };
+    }
     Ok(dir)
 }
 

core/src/os/windows/service.rs

@@ -26,6 +26,7 @@ use std::net::{IpAddr, Ipv4Addr};
 use std::sync::Arc;
 use std::time::Duration;
 use tracing_appender::rolling::{RollingFileAppender, Rotation};
+use windows::Win32::Foundation::ERROR_GEN_FAILURE;
 use windows_service::service::*;
 use windows_service::service_control_handler::{
     self, ServiceControlHandlerResult, ServiceStatusHandle,
@@ -73,8 +74,12 @@ fn run_until_stopped() -> Result<(), BoxError> {
         | ServiceControl::Shutdown
         | ServiceControl::Pause
         | ServiceControl::Continue => {
-            let _ = control_sender.send(control);
-            ServiceControlHandlerResult::NoError
+            // Answered once handled, so a failed pause fails the caller's ControlService.
+            let (reply, handled) = tokio::sync::oneshot::channel();
+            let _ = control_sender.send((control, reply));
+            handled
+                .blocking_recv()
+                .unwrap_or(ServiceControlHandlerResult::NoError)
         }
         ServiceControl::Interrogate => ServiceControlHandlerResult::NoError,
         _ => ServiceControlHandlerResult::NotImplemented,
@@ -89,16 +94,26 @@ fn run_until_stopped() -> Result<(), BoxError> {
             }
         };
         // Only pausing removes our hosts entries; a stop or crash keeps them, failing closed.
-        while let Some(control) = control_receiver.recv().await {
+        while let Some((control, reply)) = control_receiver.recv().await {
             let (hosts, state) = match control {
                 ServiceControl::Pause => (&[][..], ServiceState::Paused),
                 ServiceControl::Continue => (&hosts[..], ServiceState::Running),
                 _ => break,
             };
-            match write_hosts_entries(hosts) {
-                Ok(()) => set_status(&status, state, false)?,
-                Err(error) => tracing::error!(%error, "could not rewrite the hosts file"),
-            }
+            let result = match write_hosts_entries(hosts) {
+                Ok(()) => {
+                    set_status(&status, state, false)?;
+                    ServiceControlHandlerResult::NoError
+                }
+                Err(error) => {
+                    tracing::error!(%error, "could not rewrite the hosts file");
+                    let code = error
+                        .raw_os_error()
+                        .map_or(ERROR_GEN_FAILURE.0, |code| code as u32);
+                    ServiceControlHandlerResult::Other(code)
+                }
+            };
+            let _ = reply.send(result);
         }
         Ok::<_, BoxError>(())
     });
@@ -147,7 +162,7 @@ async fn start_screening(status: &ServiceStatusHandle) -> Result<Vec<&'static st
                 resolver: resolver.clone(),
                 service: service.clone(),
             };
-            let upstream = ConsumeErrLayer::trace_as_debug().into_layer(upstream);
+            let upstream = ConsumeErrLayer::trace_as_warning().into_layer(upstream);
             tokio::spawn(listen_on(address, port, &exec)?.serve(upstream));
         }
     }

core/src/os/windows/tray.rs

@@ -3,6 +3,7 @@
 use super::*;
 use muda::{Menu, MenuEvent, MenuItem, PredefinedMenuItem};
 use std::io::Cursor;
+use std::time::Duration;
 use tray_icon::{Icon, MouseButtonState, TrayIcon, TrayIconBuilder, TrayIconEvent};
 use windows::core::{w, PCWSTR};
 use windows::Win32::Foundation::*;
@@ -14,6 +15,7 @@ use windows_service::service::{Service, ServiceAccess, ServiceState};
 use windows_service::service_manager::{ServiceManager, ServiceManagerAccess};
 
 const MENU_PAUSE: &str = "pause";
+const MENU_RESTART: &str = "restart";
 const MENU_LOG: &str = "log";
 const MENU_QUIT: &str = "quit";
 const LOGO: &[u8] = include_bytes!("tray.png");
@@ -31,6 +33,7 @@ pub fn run() -> Result<(), BoxError> {
         &status,
         &PredefinedMenuItem::separator(),
         &pause,
+        &MenuItem::with_id(MENU_RESTART, "Restart", true, None),
         &MenuItem::with_id(MENU_LOG, "Open logs", true, None),
         &PredefinedMenuItem::separator(),
         &MenuItem::with_id(MENU_QUIT, "Quit", true, None),
@@ -123,6 +126,11 @@ impl Tray {
                 || Ok(open_service()?.resume().map(drop)?)
             }
             MENU_PAUSE => || Ok(open_service()?.start::<&str>(&[])?),
+            MENU_RESTART => {
+                // Off the UI thread, since stopping takes a while.
+                std::thread::spawn(|| restart().unwrap_or_else(show_error));
+                return;
+            }
             MENU_LOG => {
                 let log = HSTRING::from(data_dir().as_path());
                 let none = PCWSTR::null();
@@ -131,13 +139,19 @@ impl Tray {
             }
             _ => return,
         };
-        if let Err(error) = action() {
-            let text = HSTRING::from(error.to_string());
-            unsafe { MessageBoxW(None, &text, w!("Strix Firewall"), MB_ICONERROR) };
-        }
+        action().unwrap_or_else(show_error);
     }
 }
 
+fn show_error(error: BoxError) {
+    let text = match error.source() {
+        Some(source) => format!("{error}: {source}"),
+        None => error.to_string(),
+    };
+    let text = HSTRING::from(text);
+    unsafe { MessageBoxW(None, &text, w!("Strix Firewall"), MB_ICONERROR) };
+}
+
 /// `None` when the service is not installed.
 fn service_state() -> Option<ServiceState> {
     let manager =
@@ -166,10 +180,28 @@ fn status_text(state: Option<ServiceState>) -> &'static str {
 
 fn open_service() -> Result<Service, BoxError> {
     let manager = ServiceManager::local_computer(None::<&str>, ServiceManagerAccess::CONNECT)?;
-    let access = ServiceAccess::START | ServiceAccess::PAUSE_CONTINUE;
+    let access = ServiceAccess::QUERY_STATUS
+        | ServiceAccess::START
+        | ServiceAccess::STOP
+        | ServiceAccess::PAUSE_CONTINUE;
     Ok(manager.open_service(SERVICE_NAME, access)?)
 }
 
+/// Starting again re-reads the config.
+fn restart() -> Result<(), BoxError> {
+    let service = open_service()?;
+    if service.query_status()?.current_state != ServiceState::Stopped {
+        service.stop()?;
+    }
+    for _ in 0..60 {
+        if service.query_status()?.current_state == ServiceState::Stopped {
+            return Ok(service.start::<&str>(&[])?);
+        }
+        std::thread::sleep(Duration::from_millis(500));
+    }
+    Err("The service did not stop.".into())
+}
+
 /// The alpha channel of the RGBA logo, and its width.
 fn logo_mask() -> Result<(Vec<u8>, u32), BoxError> {
     let mut reader = png::Decoder::new(Cursor::new(LOGO)).read_info()?;

core/src/policies/mod.rs

@@ -69,7 +69,8 @@ pub async fn screen(url: &str, firewall: &Firewall) -> Option<String> {
     };
     info!(eco = registry.eco, pkg = %pkg.label(), %url, "screening");
     match consult(firewall, registry, &pkg).await {
-        Some((_, Verdict::Deny(reason))) => {
+        Some((filter, Verdict::Deny(reason))) => {
+            crate::blocks::record(registry.eco, &pkg, filter, &reason);
             Some(format!("{} {reason}", pkg.label()))
         }
         Some((filter, Verdict::Unknown(e))) if !firewall.config.fail_open => {

core/tests/config.rs

@@ -57,3 +57,18 @@ async fn failing_closed_blocks_what_could_not_be_checked() {
     let blocked = screen(url, &firewall).await.unwrap_or_default();
     assert!(blocked.contains("could not be checked"), "{blocked:?}");
 }
+
+#[test]
+fn allowing_keeps_the_rest_of_the_file() {
+    let path = std::env::temp_dir().join(format!("firewall-allow-{}.json", std::process::id()));
+    std::fs::write(&path, r#"{"fail_open": false}"#).expect("write");
+    for _ in 0..2 {
+        firewall::config::allow(&path, "npm", "left-pad", Some("1.3.0")).expect("allow");
+    }
+    let text = std::fs::read_to_string(&path).expect("read");
+    std::fs::remove_file(&path).ok();
+    let config: FirewallConfig = serde_json::from_str(&text).expect("parses");
+    assert!(!config.fail_open);
+    assert_eq!(config.allow["npm"].len(), 1);
+    assert_eq!(config.allow["npm"][0].version.as_deref(), Some("1.3.0"));
+}

core/tests/forward.rs

@@ -1,7 +1,9 @@
 use firewall::aliasing::forward::downgrade;
 use firewall::http::https_url;
-use firewall::Firewall;
+use firewall::{aliasing, Firewall, FirewallConfig};
 use rama::http::{Body, Request};
+use std::io::{Read, Write};
+use std::net::{TcpListener, TcpStream};
 
 fn request(target: &str, host: Option<&str>) -> Request {
     let mut builder = Request::builder().method("GET").uri(target);
@@ -35,6 +37,25 @@ fn requests_always_go_out_over_tls() {
     assert_eq!(https_url(&request("/six", None)), None);
 }
 
+#[test]
+fn a_plain_http_upstream_is_not_upgraded() {
+    let upstream = TcpListener::bind("127.0.0.1:0").expect("bind");
+    let addr = upstream.local_addr().expect("address");
+    std::thread::spawn(move || {
+        let (mut stream, _) = upstream.accept().expect("accept");
+        let _ = stream.read(&mut [0; 4096]);
+        let _ = stream.write_all(b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\nok");
+    });
+
+    let port = aliasing::spawn(0, FirewallConfig::default()).expect("spawn");
+    let mut proxy = TcpStream::connect(("127.0.0.1", port)).expect("connect");
+    let request = format!("GET http://{addr}/x HTTP/1.1\r\nHost: {addr}\r\nConnection: close\r\n\r\n");
+    proxy.write_all(request.as_bytes()).expect("write");
+    let mut response = String::new();
+    proxy.read_to_string(&mut response).expect("read");
+    assert!(response.starts_with("HTTP/1.1 200") && response.ends_with("ok"), "{response}");
+}
+
 #[tokio::test]
 async fn downgrade_touches_known_hosts_in_text_only() {
     let text = b"https://pypi.org/x https://example.com/y".to_vec();

core/wix/main.wxs

@@ -162,6 +162,12 @@
             Execute='deferred'
             Impersonate='no'
             Return='check'/>
+        <!-- From the exit dialog, which runs as the signed-in user rather than elevated. -->
+        <CustomAction
+            Id='StartTray'
+            Directory='APPLICATIONFOLDER'
+            ExeCommand='"[#exe2]"'
+            Return='asyncNoWait'/>
         <!-- Before its file is replaced or removed. Trays WM_CLOSE does not reach, as in other sessions, are terminated. -->
         <util:CloseApplication Id='CloseTray' Target='firewall-tray.exe' CloseMessage='yes' RebootPrompt='no' TerminateProcess='0'/>
         <InstallExecuteSequence>
@@ -180,6 +186,7 @@
             <UIRef Id='WixUI_FeatureTree'/>
             <Publish Dialog='WelcomeDlg' Control='Next' Event='NewDialog' Value='CustomizeDlg' Order='99'>1</Publish>
             <Publish Dialog='CustomizeDlg' Control='Back' Event='NewDialog' Value='WelcomeDlg' Order='99'>1</Publish>
+            <Publish Dialog='ExitDialog' Control='Finish' Event='DoAction' Value='StartTray' Order='1'>NOT Installed</Publish>
         </UI>
     </Product>
 

dist-workspace.toml

@@ -7,6 +7,7 @@ ci = "github"
 installers = ["shell", "powershell", "homebrew", "msi"]
 # core/wix/main.wxs is edited to install the service.
 allow-dirty = ["msi"]
+features = ["machine-wide"]
 tap = "usestrix/homebrew-tap"
 publish-jobs = ["homebrew", "./publish-crates"]
 targets = ["aarch64-apple-darwin", "x86_64-apple-darwin", "aarch64-unknown-linux-gnu", "x86_64-unknown-linux-gnu", "x86_64-pc-windows-msvc"]

macos/App/BlockAlerts.swift

@@ -0,0 +1,57 @@
+import AppKit
+import Security
+
+struct BlockedPackage: Codable, Hashable, Identifiable {
+    let eco: String
+    let name: String
+    let version: String?
+    let filter: String
+    let reason: String
+
+    var id: String { "\(eco)/\(name)@\(version ?? "")" }
+    var label: String { version.map { "\(name) \($0)" } ?? name }
+    /// The denylist and OSV only flag packages known to be malicious; the age check only holds back new ones.
+    var malicious: Bool { filter != "age" }
+    /// Malware is never allowed, and a new package only by version.
+    var trustable: Bool { !malicious && version != nil }
+}
+
+@MainActor
+enum BlockAlert {
+    /// Returns whether the user chose to trust the package.
+    static func show(_ package: BlockedPackage) -> Bool {
+        let alert = NSAlert()
+        alert.addButton(withTitle: "OK")
+        if package.malicious {
+            alert.alertStyle = .critical
+            alert.messageText = "Blocked malware: \(package.label) (\(package.eco))"
+            alert.informativeText = "\(package.label) \(package.reason).\n\n"
+                + "It was not installed. Don't install it from another source. "
+                + "If you didn't expect this package, a dependency may be compromised; tell your security team."
+        } else {
+            alert.messageText = "Held back a new package"
+            alert.informativeText = "\(package.label) (\(package.eco)) \(package.reason)."
+            if package.trustable { alert.addButton(withTitle: "Trust this version") }
+        }
+        NSApp.activate(ignoringOtherApps: true)
+        return alert.runModal() == .alertSecondButtonReturn
+    }
+}
+
+enum AdminAuthorization {
+    /// The allowlist applies to every user of the Mac, so changing it takes an admin, as `sudo` would.
+    static func confirm() -> Bool {
+        var authorization: AuthorizationRef?
+        guard AuthorizationCreate(nil, nil, [], &authorization) == errAuthorizationSuccess,
+              let authorization else { return false }
+        defer { AuthorizationFree(authorization, []) }
+        return "system.preferences".withCString { name in
+            var item = AuthorizationItem(name: name, valueLength: 0, value: nil, flags: 0)
+            return withUnsafeMutablePointer(to: &item) { item in
+                var rights = AuthorizationRights(count: 1, items: item)
+                let flags: AuthorizationFlags = [.interactionAllowed, .extendRights]
+                return AuthorizationCopyRights(authorization, &rights, nil, flags, nil) == errAuthorizationSuccess
+            }
+        }
+    }
+}

macos/App/FirewallModel.swift

@@ -29,11 +29,13 @@ enum FirewallError: Error, LocalizedError {
     case extensionUnavailable
     case screeningDidNotStart(NEVPNStatus)
     case extensionStopped(String)
+    case extensionRefused(String)
 
     var errorDescription: String? {
         switch self {
         case .extensionUnavailable: return "The extension is not running"
         case let .screeningDidNotStart(status): return "Screening did not start (\(status.label))"
+        case let .extensionRefused(reply): return "The extension replied \(reply)"
         case let .extensionStopped(reason):
             return "The extension stopped: \(reason). Its log: log show --last 5m --predicate 'subsystem BEGINSWITH \"\(FirewallIDs.appBundleID)\"'"
         }
@@ -51,6 +53,7 @@ final class FirewallModel: NSObject, ObservableObject {
     @Published private(set) var completed = false
     @Published private(set) var removed = false
     @Published private(set) var screening = false
+    @Published private(set) var blocked: [BlockedPackage] = []
 
     private let logger = Logger(subsystem: FirewallIDs.appBundleID, category: "installer")
     private var pendingRequest: (request: OSSystemExtensionRequest, continuation: CheckedContinuation<Void, Error>)?
@@ -72,6 +75,7 @@ final class FirewallModel: NSObject, ObservableObject {
             await refresh()
             if CommandLine.arguments.contains("--install") { await install() }
         }
+        Task { await watchBlocks() }
     }
 
     // MARK: - Flows
@@ -199,6 +203,43 @@ final class FirewallModel: NSObject, ObservableObject {
         if let url = URL(string: pane) { NSWorkspace.shared.open(url) }
     }
 
+    /// Allowing a version writes it into the extension's config, which a restart then loads.
+    func trust(_ package: BlockedPackage) async {
+        guard package.trustable else { return }
+        guard AdminAuthorization.confirm() else {
+            log("Trust cancelled for \(package.label)")
+            return
+        }
+        do {
+            var request = ["eco": package.eco, "name": package.name]
+            request["version"] = package.version
+            let json = String(decoding: try JSONSerialization.data(withJSONObject: request), as: UTF8.self)
+            let reply = try await providerMessage("allow \(json)")
+            guard reply == "ok" else { throw FirewallError.extensionRefused(reply) }
+            blocked.removeAll { $0 == package }
+            log("Trusted \(package.label) (\(package.eco))")
+        } catch {
+            log("Could not trust \(package.label): \(error.localizedDescription)")
+            return
+        }
+        await restart()
+    }
+
+    /// The extension cannot message the app, so the app asks it for blocks.
+    private func watchBlocks() async {
+        while true {
+            if screening, let reply = try? await providerMessage("blocks"),
+               let packages = try? JSONDecoder().decode([BlockedPackage].self, from: Data(reply.utf8)) {
+                for package in packages where !blocked.contains(package) {
+                    blocked.append(package)
+                    if BlockAlert.show(package) { await trust(package) }
+                }
+                blocked = Array(blocked.suffix(10))
+            }
+            try? await Task.sleep(nanoseconds: 2_000_000_000)
+        }
+    }
+
     private func stage(_ step: ReferenceWritableKeyPath<FirewallModel, StepStatus>,
                        running: String,
                        work: @MainActor () async throws -> String) async -> Bool {

macos/App/MenuBarView.swift

@@ -22,5 +22,24 @@ struct MenuBarView: View {
             Task { await model.restart() }
         }
         .disabled(model.busy)
+
+        if !model.blocked.isEmpty {
+            Divider()
+            ForEach(model.blocked) { package in
+                if !package.malicious {
+                    Menu("Held back \(package.label) (\(package.eco))") {
+                        Text(package.reason)
+                        Button("Trust this version") {
+                            Task { await model.trust(package) }
+                        }
+                        .disabled(model.busy || !package.trustable)
+                    }
+                } else {
+                    Menu("Blocked \(package.label) (\(package.eco))") {
+                        Text("Malicious: \(package.reason)")
+                    }
+                }
+            }
+        }
     }
 }

macos/build.sh

@@ -47,6 +47,7 @@ build() {
   echo "==> Building"
   xcodegen generate >/dev/null
   xcodebuild -project Firewall.xcodeproj -scheme StrixFirewall -configuration $CONFIGURATION \
+    -destination generic/platform=macOS \
     -derivedDataPath build CODE_SIGNING_ALLOWED=NO CODE_SIGNING_REQUIRED=NO \
     CODE_SIGN_IDENTITY="" CODE_SIGN_ENTITLEMENTS="" build >/dev/null
 }

macos/project.yml

@@ -10,7 +10,7 @@ settings:
     "CARGO_PROFILE[config=Debug]": debug
     "LIBRARY_SEARCH_PATHS[arch=arm64]": $(SRCROOT)/../core/target/aarch64-apple-darwin/$(CARGO_PROFILE)
     "LIBRARY_SEARCH_PATHS[arch=x86_64]": $(SRCROOT)/../core/target/x86_64-apple-darwin/$(CARGO_PROFILE)
-    ARCHS: arm64
+    ARCHS: arm64 x86_64
     "ONLY_ACTIVE_ARCH[config=Debug]": "YES"
     SWIFT_VERSION: "5.0"
     DEVELOPMENT_TEAM: ${TEAM}
@@ -127,5 +127,13 @@ targets:
           unset CC CXX CFLAGS CXXFLAGS
           export SDKROOT="$(xcrun --sdk macosx --show-sdk-path)"
           cd "$SRCROOT/../core"
-          cargo build --bin firewall-uninstall --target aarch64-apple-darwin $([ "$CONFIGURATION" = Debug ] || echo --release)
-          cp "target/aarch64-apple-darwin/$CARGO_PROFILE/firewall-uninstall" "$TARGET_BUILD_DIR/$EXECUTABLE_FOLDER_PATH/"
+          bins=
+          for arch in $ARCHS; do
+            case $arch in
+              arm64|arm64e) triple=aarch64-apple-darwin ;;
+              x86_64)       triple=x86_64-apple-darwin ;;
+            esac
+            cargo build --bin firewall-uninstall --features machine-wide --target $triple $([ "$CONFIGURATION" = Debug ] || echo --release)
+            bins="$bins target/$triple/$CARGO_PROFILE/firewall-uninstall"
+          done
+          lipo -create $bins -output "$TARGET_BUILD_DIR/$EXECUTABLE_FOLDER_PATH/firewall-uninstall"