vikarti.anatra/safing-portmaster
1
0
Fork 0
mirror of https://github.com/safing/portmaster synced 2025-09-01 18:19:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge branch 'fix/remove-glue-library' into fix/verdict-cache-update

Browse source
This commit is contained in:
Vladimir 2022-11-03 21:11:09 +01:00
commit 9bc2da90a8
6 changed files with 272 additions and 144 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
firewall/interception/interception_windows.go
View file

@ -10,16 +10,12 @@ import (
// start starts the interception.
func start(ch chan packet.Packet) error {
dllFile, err := updates.GetPlatformFile("kext/portmaster-kext.dll")
if err != nil {
return fmt.Errorf("interception: could not get kext dll: %s", err)
}
kextFile, err := updates.GetPlatformFile("kext/portmaster-kext.sys")
if err != nil {
return fmt.Errorf("interception: could not get kext sys: %s", err)
}
err = windowskext.Init(dllFile.Path(), kextFile.Path())
err = windowskext.Init(kextFile.Path())
if err != nil {
return fmt.Errorf("interception: could not init windows kext: %s", err)
}

7
firewall/interception/windowskext/handler.go
View file

@ -1,3 +1,4 @@
//go:build windows
// +build windows
package windowskext
@ -10,6 +11,7 @@ import (
"github.com/tevino/abool"
"github.com/safing/portbase/log"
"github.com/safing/portmaster/network"
"github.com/safing/portmaster/network/packet"
)
@ -43,6 +45,11 @@ type VerdictRequest struct {
packetSize uint32
}
type VerdictInfo struct {
id uint32 // ID from RegisterPacket
verdict network.Verdict // verdict for the connection
}
// Handler transforms received packets to the Packet interface.
func Handler(packets chan packet.Packet) {
if !ready.IsSet() {

224
firewall/interception/windowskext/kext.go
View file

@ -6,9 +6,9 @@ package windowskext
import (
"errors"
"fmt"
"os/exec"
"sync"
"sync/atomic"
"syscall"
"time"
"unsafe"
@ -25,90 +25,24 @@ var (
winErrInvalidData = uintptr(windows.ERROR_INVALID_DATA)
kext *WinKext
kextLock sync.RWMutex
ready = abool.NewBool(false)
urgentRequests *int32
driverPath string
kextHandle windows.Handle
)
const driverName = "PortmasterKext"
func init() {
var urgentRequestsValue int32
urgentRequests = &urgentRequestsValue
}
// WinKext holds the DLL handle.
type WinKext struct {
sync.RWMutex
dll *windows.DLL
driverPath string
init *windows.Proc
start *windows.Proc
stop *windows.Proc
recvVerdictRequest *windows.Proc
setVerdict *windows.Proc
getPayload *windows.Proc
clearCache *windows.Proc
}
// Init initializes the DLL and the Kext (Kernel Driver).
func Init(dllPath, driverPath string) error {
new := &WinKext{
driverPath: driverPath,
}
var err error
// load dll
new.dll, err = windows.LoadDLL(dllPath)
if err != nil {
return err
}
// load functions
new.init, err = new.dll.FindProc("PortmasterInit")
if err != nil {
return fmt.Errorf("could not find proc PortmasterStart in dll: %s", err)
}
new.start, err = new.dll.FindProc("PortmasterStart")
if err != nil {
return fmt.Errorf("could not find proc PortmasterStart in dll: %s", err)
}
new.stop, err = new.dll.FindProc("PortmasterStop")
if err != nil {
return fmt.Errorf("could not find proc PortmasterStop in dll: %s", err)
}
new.recvVerdictRequest, err = new.dll.FindProc("PortmasterRecvVerdictRequest")
if err != nil {
return fmt.Errorf("could not find proc PortmasterRecvVerdictRequest in dll: %s", err)
}
new.setVerdict, err = new.dll.FindProc("PortmasterSetVerdict")
if err != nil {
return fmt.Errorf("could not find proc PortmasterSetVerdict in dll: %s", err)
}
new.getPayload, err = new.dll.FindProc("PortmasterGetPayload")
if err != nil {
return fmt.Errorf("could not find proc PortmasterGetPayload in dll: %s", err)
}
new.clearCache, err = new.dll.FindProc("PortmasterClearCache")
if err != nil {
// the loaded dll is an old version
log.Errorf("could not find proc PortmasterClearCache (v1.0.12+) in dll: %s", err)
}
// initialize dll/kext
rc, _, lastErr := new.init.Call()
if rc != windows.NO_ERROR {
return formatErr(lastErr, rc)
}
// set kext
kextLock.Lock()
defer kextLock.Unlock()
kext = new
func Init(path string) error {
driverPath = path
return nil
}
@ -117,16 +51,31 @@ func Start() error {
kextLock.Lock()
defer kextLock.Unlock()
// convert to C string
charArray := make([]byte, len(kext.driverPath)+1)
copy(charArray, []byte(kext.driverPath))
charArray[len(charArray)-1] = 0 // force NULL byte at the end
filename := `\\.\` + driverName
rc, _, lastErr := kext.start.Call(
uintptr(unsafe.Pointer(&charArray[0])),
)
if rc != windows.NO_ERROR {
return formatErr(lastErr, rc)
// check if driver is already installed
var err error
kextHandle, err = openDriver(filename)
if err == nil {
return nil // device was already initialized
}
// initialize and start driver service
service, err := driverInstall(driverPath)
if err != nil {
return fmt.Errorf("Failed to start service: %s", err)
}
// open the driver
kextHandle, err = openDriver(filename)
// close the service handles
_ = windows.DeleteService(service)
_ = windows.CloseServiceHandle(service)
// driver was not installed
if err != nil {
return fmt.Errorf("Failed to start the kext service: %s %q", err, filename)
}
ready.Set()
@ -142,9 +91,14 @@ func Stop() error {
}
ready.UnSet()
rc, _, lastErr := kext.stop.Call()
if rc != windows.NO_ERROR {
return formatErr(lastErr, rc)
err := closeDriver(kextHandle)
if err != nil {
log.Errorf("winkext: failed to close the handle: %s", err)
}
_, err = exec.Command("sc", "stop", driverName).Output() // This is a question of taste, but it is a robust and solid solution
if err != nil {
log.Errorf("winkext: failed to stop the service: %q", err)
}
return nil
}
@ -156,9 +110,6 @@ func RecvVerdictRequest() (*VerdictRequest, error) {
if !ready.IsSet() {
return nil, ErrKextNotReady
}
new := &VerdictRequest{}
// wait for urgent requests to complete
for i := 1; i <= 100; i++ {
if atomic.LoadInt32(urgentRequests) <= 0 {
@ -170,19 +121,22 @@ func RecvVerdictRequest() (*VerdictRequest, error) {
time.Sleep(100 * time.Microsecond)
}
// timestamp := time.Now()
rc, _, lastErr := kext.recvVerdictRequest.Call(
uintptr(unsafe.Pointer(new)),
)
// log.Tracef("winkext: getting verdict request took %s", time.Now().Sub(timestamp))
timestamp := time.Now()
// Initialize struct for the output data
var new VerdictRequest
if rc != windows.NO_ERROR {
if rc == winErrInvalidData {
return nil, nil
}
return nil, formatErr(lastErr, rc)
// Make driver request
data := asByteArray(&new)
bytesRead, err := deviceIoControlRead(kextHandle, IOCTL_RECV_VERDICT_REQ, data)
if err != nil {
return nil, err
}
return new, nil
if bytesRead == 0 {
return nil, nil // no error, no new verdict request
}
log.Tracef("winkext: getting verdict request took %s", time.Now().Sub(timestamp))
return &new, nil
}
// SetVerdict sets the verdict for a packet and/or connection.
@ -199,17 +153,16 @@ func SetVerdict(pkt *Packet, verdict network.Verdict) error {
return ErrKextNotReady
}
verdictInfo := VerdictInfo{pkt.verdictRequest.id, verdict}
// Make driver request
atomic.AddInt32(urgentRequests, 1)
// timestamp := time.Now()
rc, _, lastErr := kext.setVerdict.Call(
uintptr(pkt.verdictRequest.id),
uintptr(verdict),
)
// log.Tracef("winkext: settings verdict for packetID %d took %s", packetID, time.Now().Sub(timestamp))
data := asByteArray(&verdictInfo)
_, err := deviceIoControlWrite(kextHandle, IOCTL_SET_VERDICT, data)
atomic.AddInt32(urgentRequests, -1)
if rc != windows.NO_ERROR {
if err != nil {
log.Tracer(pkt.Ctx()).Errorf("kext: failed to set verdict %s on packet %d", verdict, pkt.verdictRequest.id)
return formatErr(lastErr, rc)
return err
}
return nil
}
@ -220,6 +173,7 @@ func GetPayload(packetID uint32, packetSize uint32) ([]byte, error) {
return nil, ErrNoPacketID
}
// Check if driver is initialized
kextLock.RLock()
defer kextLock.RUnlock()
if !ready.IsSet() {
@ -228,26 +182,30 @@ func GetPayload(packetID uint32, packetSize uint32) ([]byte, error) {
buf := make([]byte, packetSize)
// Combine id and length
payload := struct {
id uint32
length uint32
}{packetID, packetSize}
// Make driver request
atomic.AddInt32(urgentRequests, 1)
// timestamp := time.Now()
rc, _, lastErr := kext.getPayload.Call(
uintptr(packetID),
uintptr(unsafe.Pointer(&buf[0])),
uintptr(unsafe.Pointer(&packetSize)),
)
// log.Tracef("winkext: getting payload for packetID %d took %s", packetID, time.Now().Sub(timestamp))
data := asByteArray(&payload)
bytesRead, err := deviceIoControlReadWrite(kextHandle, IOCTL_GET_PAYLOAD, data, unsafe.Slice(&buf[0], packetSize))
atomic.AddInt32(urgentRequests, -1)
if rc != windows.NO_ERROR {
return nil, formatErr(lastErr, rc)
if err != nil {
return nil, err
}
if packetSize == 0 {
// check the result and return
if bytesRead == 0 {
return nil, errors.New("windows kext did not return any data")
}
if packetSize < uint32(len(buf)) {
return buf[:packetSize], nil
if bytesRead < uint32(len(buf)) {
return buf[:bytesRead], nil
}
return buf, nil
@ -256,28 +214,18 @@ func GetPayload(packetID uint32, packetSize uint32) ([]byte, error) {
func ClearCache() error {
kextLock.RLock()
defer kextLock.RUnlock()
// Check if driver is initialized
if !ready.IsSet() {
log.Error("kext: failed to clear the cache: kext not ready")
return ErrKextNotReady
}
if kext.clearCache == nil {
log.Error("kext: cannot clear cache: clearCache function missing")
}
rc, _, lastErr := kext.clearCache.Call()
if rc != windows.NO_ERROR {
return formatErr(lastErr, rc)
}
return nil
}
func formatErr(err error, rc uintptr) error {
sysErr, ok := err.(syscall.Errno)
if ok {
return fmt.Errorf("%s [LE 0x%X] [RC 0x%X]", err, uintptr(sysErr), rc)
}
// Make driver request
_, err := deviceIoControlRead(kextHandle, IOCTL_CLEAR_CACHE, nil)
return err
}
func asByteArray[T any](obj *T) []byte {
return unsafe.Slice((*byte)(unsafe.Pointer(obj)), unsafe.Sizeof(*obj))
}

87
firewall/interception/windowskext/service.go Normal file
View file

@ -0,0 +1,87 @@
//go:build windows
// +build windows
package windowskext
import (
"fmt"
"syscall"
"golang.org/x/sys/windows"
)
func createService(manager windows.Handle, portmasterKextPath *uint16) (windows.Handle, error) {
u16filename, err := syscall.UTF16FromString(driverName)
if err != nil {
return 0, fmt.Errorf("Bad service: %s", err)
}
// Check if it's already created
service, err := windows.OpenService(manager, &u16filename[0], windows.SERVICE_ALL_ACCESS)
if err == nil {
return service, nil
}
// Create the service
service, err = windows.CreateService(manager, &u16filename[0], &u16filename[0], windows.SERVICE_ALL_ACCESS, windows.SERVICE_KERNEL_DRIVER, windows.SERVICE_DEMAND_START, windows.SERVICE_ERROR_NORMAL, portmasterKextPath, nil, nil, nil, nil, nil)
if err != nil {
return 0, err
}
return service, nil
}
func driverInstall(portmasterKextPath string) (windows.Handle, error) {
u16kextPath, _ := syscall.UTF16FromString(portmasterKextPath)
// Open the service manager:
manager, err := windows.OpenSCManager(nil, nil, windows.SC_MANAGER_ALL_ACCESS)
if err != nil {
return 0, fmt.Errorf("Failed to open service manager: %d", err)
}
defer windows.CloseServiceHandle(manager)
// Try to create the service. Retry if it fails.
var service windows.Handle
retryLoop:
for i := 0; i < 3; i++ {
service, err = createService(manager, &u16kextPath[0])
if err == nil {
break retryLoop
}
}
if err != nil {
return 0, fmt.Errorf("Failed to create service: %s", err)
}
// Start the service:
err = windows.StartService(service, 0, nil)
if err != nil {
err = windows.GetLastError()
if err != windows.ERROR_SERVICE_ALREADY_RUNNING {
// Failed to start service; clean-up:
var status windows.SERVICE_STATUS
_ = windows.ControlService(service, windows.SERVICE_CONTROL_STOP, &status)
_ = windows.DeleteService(service)
_ = windows.CloseServiceHandle(service)
service = 0
}
}
return service, nil
}
func openDriver(filename string) (windows.Handle, error) {
u16filename, _ := syscall.UTF16FromString(filename)
handle, err := windows.CreateFile(&u16filename[0], windows.GENERIC_READ|windows.GENERIC_WRITE, 0, nil, windows.OPEN_EXISTING, 0, 0)
if err != nil {
return 0, err
}
return handle, nil
}
func closeDriver(handle windows.Handle) error {
return windows.CloseHandle(handle)
}

91
firewall/interception/windowskext/syscall.go Normal file
View file

@ -0,0 +1,91 @@
//go:build windows
// +build windows
package windowskext
import "golang.org/x/sys/windows"
const (
METHOD_BUFFERED = 0
METHOD_IN_DIRECT = 1
METHOD_OUT_DIRECT = 2
METHOD_NEITHER = 3
SIOCTL_TYPE = 40000
)
var (
IOCTL_HELLO = ctlCode(SIOCTL_TYPE, 0x800, METHOD_BUFFERED, windows.FILE_READ_DATA|windows.FILE_WRITE_DATA)
IOCTL_RECV_VERDICT_REQ_POLL = ctlCode(SIOCTL_TYPE, 0x801, METHOD_BUFFERED, windows.FILE_READ_DATA|windows.FILE_WRITE_DATA)
IOCTL_RECV_VERDICT_REQ = ctlCode(SIOCTL_TYPE, 0x802, METHOD_BUFFERED, windows.FILE_READ_DATA|windows.FILE_WRITE_DATA)
IOCTL_SET_VERDICT = ctlCode(SIOCTL_TYPE, 0x803, METHOD_BUFFERED, windows.FILE_READ_DATA|windows.FILE_WRITE_DATA)
IOCTL_GET_PAYLOAD = ctlCode(SIOCTL_TYPE, 0x804, METHOD_BUFFERED, windows.FILE_READ_DATA|windows.FILE_WRITE_DATA)
IOCTL_CLEAR_CACHE = ctlCode(SIOCTL_TYPE, 0x805, METHOD_BUFFERED, windows.FILE_READ_DATA|windows.FILE_WRITE_DATA)
)
func ctlCode(device_type, function, method, access uint32) uint32 {
return (device_type << 16) | (access << 14) | (function << 2) | method
}
func deviceIoControlRead(handle windows.Handle, code uint32, data []byte) (uint32, error) {
var bytesReturned uint32
var dataPtr *byte = nil
var dataSize uint32 = 0
if data != nil {
dataPtr = &data[0]
dataSize = uint32(len(data))
}
err := windows.DeviceIoControl(handle,
code,
nil, 0,
dataPtr, dataSize,
&bytesReturned, nil)
return bytesReturned, err
}
func deviceIoControlWrite(handle windows.Handle, code uint32, data []byte) (uint32, error) {
var bytesReturned uint32
var dataPtr *byte = nil
var dataSize uint32 = 0
if data != nil {
dataPtr = &data[0]
dataSize = uint32(len(data))
}
err := windows.DeviceIoControl(handle,
code,
dataPtr, dataSize,
nil, 0,
&bytesReturned, nil)
return bytesReturned, err
}
func deviceIoControlReadWrite(handle windows.Handle, code uint32, inData []byte, outData []byte) (uint32, error) {
var bytesReturned uint32
var inDataPtr *byte = nil
var inDataSize uint32 = 0
if inData != nil {
inDataPtr = &inData[0]
inDataSize = uint32(len(inData))
}
var outDataPtr *byte = nil
var outDataSize uint32 = 0
if outData != nil {
outDataPtr = &outData[0]
outDataSize = uint32(len(outData))
}
err := windows.DeviceIoControl(handle,
code,
inDataPtr, inDataSize,
outDataPtr, outDataSize,
&bytesReturned, nil)
return bytesReturned, err
}

1
updates/helper/updates.go
View file

@ -52,7 +52,6 @@ func MandatoryUpdates() (identifiers []string) {
identifiers = append(
identifiers,
PlatformIdentifier("core/portmaster-core.exe"),
PlatformIdentifier("kext/portmaster-kext.dll"),
PlatformIdentifier("kext/portmaster-kext.sys"),
PlatformIdentifier("kext/portmaster-kext.pdb"),
PlatformIdentifier("start/portmaster-start.exe"),