From f858ef492f77186080edac84a7e37dccaef6dcd3 Mon Sep 17 00:00:00 2001 From: Vladimir Date: Mon, 17 Oct 2022 00:06:32 -0700 Subject: [PATCH 1/5] PoC replace kext start with go code --- firewall/interception/windowskext/kext.go | 128 ++++++++++++++++++++-- 1 file changed, 119 insertions(+), 9 deletions(-) diff --git a/firewall/interception/windowskext/kext.go b/firewall/interception/windowskext/kext.go index d438538e..73ce5d4f 100644 --- a/firewall/interception/windowskext/kext.go +++ b/firewall/interception/windowskext/kext.go @@ -29,6 +29,8 @@ var ( kextLock sync.RWMutex ready = abool.NewBool(false) urgentRequests *int32 + + kextHandle windows.Handle ) func init() { @@ -50,6 +52,7 @@ type WinKext struct { setVerdict *windows.Proc getPayload *windows.Proc clearCache *windows.Proc + setHandle *windows.Proc } // Init initializes the DLL and the Kext (Kernel Driver). @@ -98,6 +101,11 @@ func Init(dllPath, driverPath string) error { log.Errorf("could not find proc PortmasterClearCache (v1.0.12+) in dll: %s", err) } + new.setHandle, err = new.dll.FindProc("PortmasterSetDeviceHandle") + if err != nil { + log.Errorf("could not find proc PortmasterSetDeviceHandle in dll: %s", err) + } + // initialize dll/kext rc, _, lastErr := new.init.Call() if rc != windows.NO_ERROR { @@ -117,22 +125,124 @@ func Start() error { kextLock.Lock() defer kextLock.Unlock() - // convert to C string - charArray := make([]byte, len(kext.driverPath)+1) - copy(charArray, []byte(kext.driverPath)) - charArray[len(charArray)-1] = 0 // force NULL byte at the end + filename := `\\.\PortmasterKext` - rc, _, lastErr := kext.start.Call( - uintptr(unsafe.Pointer(&charArray[0])), - ) - if rc != windows.NO_ERROR { - return formatErr(lastErr, rc) + u16fname, err := syscall.UTF16FromString(filename) + if err != nil { + return fmt.Errorf("Bad filename: %s", err) } + u16DriverPath, err := syscall.UTF16FromString(kext.driverPath) + if err != nil { + return fmt.Errorf("Bad driver path: %s", err) + } + kextHandle, err = windows.CreateFile(&u16fname[0], windows.GENERIC_READ|windows.GENERIC_WRITE, 0, nil, windows.OPEN_EXISTING, 0, 0) + if err == nil { + return nil // All good + } + + service, err := portmasterDriverInstall(&u16DriverPath[0]) + if err != nil { + return fmt.Errorf("Faield to start service: %s", err) + } + + kextHandle, err = windows.CreateFile(&u16fname[0], + windows.GENERIC_READ|windows.GENERIC_WRITE, 0, nil, + windows.OPEN_EXISTING, 0, 0) + + windows.DeleteService(service) + windows.CloseServiceHandle(service) + + if err != nil { + return fmt.Errorf("Faield to kext service: %s %q", err, filename) + } + + // rc, _, lastErr := kext.start.Call( + // uintptr(unsafe.Pointer(&charArray[0])), + // ) + // if rc != windows.NO_ERROR { + // return formatErr(lastErr, rc) + // } + + kext.setHandle.Call(uintptr(kextHandle)) + ready.Set() + testRead() return nil } +func testRead() { + + buf := [5]byte{1, 2, 3, 4, 5} + var read uint32 = 0 + err := windows.ReadFile(kextHandle, buf[:], &read, nil) + + if err != nil { + log.Criticalf("Erro reading test data: %s", err) + } + + log.Criticalf("Read restul: %v", buf) +} + +func createService(manager windows.Handle, portmasterKextPath *uint16) (windows.Handle, error) { + u16fname, err := syscall.UTF16FromString("PortmasterKext") + if err != nil { + return 0, fmt.Errorf("Bad service: %s", err) + } + service, err := windows.OpenService(manager, &u16fname[0], windows.SERVICE_ALL_ACCESS) + if err == nil { + return service, nil + } + service, err = windows.CreateService(manager, &u16fname[0], &u16fname[0], windows.SERVICE_ALL_ACCESS, windows.SERVICE_KERNEL_DRIVER, windows.SERVICE_DEMAND_START, windows.SERVICE_ERROR_NORMAL, portmasterKextPath, nil, nil, nil, nil, nil) + if err != nil { + return 0, err + } + + return service, nil +} + +func portmasterDriverInstall(portmasterKextPath *uint16) (windows.Handle, error) { + // Open the service manager: + manager, err := windows.OpenSCManager(nil, nil, windows.SC_MANAGER_ALL_ACCESS) + if err != nil { + return 0, fmt.Errorf("Failed to open service manager: %d", err) + } + defer windows.CloseServiceHandle(manager) + + var service windows.Handle +retryLoop: + for i := 0; i < 3; i++ { + service, err = createService(manager, portmasterKextPath) + if err == nil { + break retryLoop + } + } + + if err != nil { + return 0, fmt.Errorf("Failed to create service: %s", err) + } + + err = windows.StartService(service, 0, nil) + // Start the service: + if err != nil { + err = windows.GetLastError() + if err == windows.ERROR_SERVICE_ALREADY_RUNNING { + // windows.SetLastError(0) + // windows.SetLast + } else { + // Failed to start service; clean-up: + var status windows.SERVICE_STATUS + _ = windows.ControlService(service, windows.SERVICE_CONTROL_STOP, &status) + _ = windows.DeleteService(service) + _ = windows.CloseServiceHandle(service) + service = 0 + //windows.SetLastError(err) + } + } + + return service, nil +} + // Stop intercepting. func Stop() error { kextLock.Lock() From 3b341496af557a79bf382c0c0ff40ae3d8ce495c Mon Sep 17 00:00:00 2001 From: Vladimir Date: Mon, 17 Oct 2022 23:45:49 -0700 Subject: [PATCH 2/5] remove the need for the glue library --- firewall/interception/interception_windows.go | 6 +- firewall/interception/windowskext/kext.go | 191 +++++------------- .../interception/windowskext/kext_request.go | 50 +++++ 3 files changed, 96 insertions(+), 151 deletions(-) create mode 100644 firewall/interception/windowskext/kext_request.go diff --git a/firewall/interception/interception_windows.go b/firewall/interception/interception_windows.go index 382869be..151dc070 100644 --- a/firewall/interception/interception_windows.go +++ b/firewall/interception/interception_windows.go @@ -10,16 +10,12 @@ import ( // start starts the interception. func start(ch chan packet.Packet) error { - dllFile, err := updates.GetPlatformFile("kext/portmaster-kext.dll") - if err != nil { - return fmt.Errorf("interception: could not get kext dll: %s", err) - } kextFile, err := updates.GetPlatformFile("kext/portmaster-kext.sys") if err != nil { return fmt.Errorf("interception: could not get kext sys: %s", err) } - err = windowskext.Init(dllFile.Path(), kextFile.Path()) + err = windowskext.Init("", kextFile.Path()) if err != nil { return fmt.Errorf("interception: could not init windows kext: %s", err) } diff --git a/firewall/interception/windowskext/kext.go b/firewall/interception/windowskext/kext.go index 73ce5d4f..42159227 100644 --- a/firewall/interception/windowskext/kext.go +++ b/firewall/interception/windowskext/kext.go @@ -6,6 +6,7 @@ package windowskext import ( "errors" "fmt" + "os/exec" "sync" "sync/atomic" "syscall" @@ -25,10 +26,10 @@ var ( winErrInvalidData = uintptr(windows.ERROR_INVALID_DATA) - kext *WinKext kextLock sync.RWMutex ready = abool.NewBool(false) urgentRequests *int32 + driverPath string kextHandle windows.Handle ) @@ -38,85 +39,9 @@ func init() { urgentRequests = &urgentRequestsValue } -// WinKext holds the DLL handle. -type WinKext struct { - sync.RWMutex - - dll *windows.DLL - driverPath string - - init *windows.Proc - start *windows.Proc - stop *windows.Proc - recvVerdictRequest *windows.Proc - setVerdict *windows.Proc - getPayload *windows.Proc - clearCache *windows.Proc - setHandle *windows.Proc -} - // Init initializes the DLL and the Kext (Kernel Driver). -func Init(dllPath, driverPath string) error { - - new := &WinKext{ - driverPath: driverPath, - } - - var err error - - // load dll - new.dll, err = windows.LoadDLL(dllPath) - if err != nil { - return err - } - - // load functions - new.init, err = new.dll.FindProc("PortmasterInit") - if err != nil { - return fmt.Errorf("could not find proc PortmasterStart in dll: %s", err) - } - new.start, err = new.dll.FindProc("PortmasterStart") - if err != nil { - return fmt.Errorf("could not find proc PortmasterStart in dll: %s", err) - } - new.stop, err = new.dll.FindProc("PortmasterStop") - if err != nil { - return fmt.Errorf("could not find proc PortmasterStop in dll: %s", err) - } - new.recvVerdictRequest, err = new.dll.FindProc("PortmasterRecvVerdictRequest") - if err != nil { - return fmt.Errorf("could not find proc PortmasterRecvVerdictRequest in dll: %s", err) - } - new.setVerdict, err = new.dll.FindProc("PortmasterSetVerdict") - if err != nil { - return fmt.Errorf("could not find proc PortmasterSetVerdict in dll: %s", err) - } - new.getPayload, err = new.dll.FindProc("PortmasterGetPayload") - if err != nil { - return fmt.Errorf("could not find proc PortmasterGetPayload in dll: %s", err) - } - new.clearCache, err = new.dll.FindProc("PortmasterClearCache") - if err != nil { - // the loaded dll is an old version - log.Errorf("could not find proc PortmasterClearCache (v1.0.12+) in dll: %s", err) - } - - new.setHandle, err = new.dll.FindProc("PortmasterSetDeviceHandle") - if err != nil { - log.Errorf("could not find proc PortmasterSetDeviceHandle in dll: %s", err) - } - - // initialize dll/kext - rc, _, lastErr := new.init.Call() - if rc != windows.NO_ERROR { - return formatErr(lastErr, rc) - } - - // set kext - kextLock.Lock() - defer kextLock.Unlock() - kext = new - +func Init(dllPath, path string) error { + driverPath = path return nil } @@ -132,7 +57,7 @@ func Start() error { return fmt.Errorf("Bad filename: %s", err) } - u16DriverPath, err := syscall.UTF16FromString(kext.driverPath) + u16DriverPath, err := syscall.UTF16FromString(driverPath) if err != nil { return fmt.Errorf("Bad driver path: %s", err) } @@ -157,26 +82,14 @@ func Start() error { return fmt.Errorf("Faield to kext service: %s %q", err, filename) } - // rc, _, lastErr := kext.start.Call( - // uintptr(unsafe.Pointer(&charArray[0])), - // ) - // if rc != windows.NO_ERROR { - // return formatErr(lastErr, rc) - // } - - kext.setHandle.Call(uintptr(kextHandle)) - ready.Set() testRead() return nil } func testRead() { - buf := [5]byte{1, 2, 3, 4, 5} - var read uint32 = 0 - err := windows.ReadFile(kextHandle, buf[:], &read, nil) - + _, err := deviceIoControl(IOCTL_TEST, &buf[0], uintptr(len(buf))) if err != nil { log.Criticalf("Erro reading test data: %s", err) } @@ -252,10 +165,11 @@ func Stop() error { } ready.UnSet() - rc, _, lastErr := kext.stop.Call() - if rc != windows.NO_ERROR { - return formatErr(lastErr, rc) + err := windows.CloseHandle(kextHandle) + if err != nil { + log.Errorf("kext: faield to close handle: %s", err) } + _, _ = exec.Command("sc", "stop", "PortmasterKext").Output() return nil } @@ -266,9 +180,6 @@ func RecvVerdictRequest() (*VerdictRequest, error) { if !ready.IsSet() { return nil, ErrKextNotReady } - - new := &VerdictRequest{} - // wait for urgent requests to complete for i := 1; i <= 100; i++ { if atomic.LoadInt32(urgentRequests) <= 0 { @@ -280,19 +191,18 @@ func RecvVerdictRequest() (*VerdictRequest, error) { time.Sleep(100 * time.Microsecond) } - // timestamp := time.Now() - rc, _, lastErr := kext.recvVerdictRequest.Call( - uintptr(unsafe.Pointer(new)), - ) - // log.Tracef("winkext: getting verdict request took %s", time.Now().Sub(timestamp)) + timestamp := time.Now() + var new VerdictRequest - if rc != windows.NO_ERROR { - if rc == winErrInvalidData { - return nil, nil - } - return nil, formatErr(lastErr, rc) + data := (*byte)(unsafe.Pointer(&new)) + _, err := deviceIoControl(IOCTL_RECV_VERDICT_REQ, data, unsafe.Sizeof(new)) + if err != nil { + return nil, err } - return new, nil + log.Tracef("winkext: getting verdict request took %s", time.Now().Sub(timestamp)) + + log.Criticalf("%v", new) + return &new, nil } // SetVerdict sets the verdict for a packet and/or connection. @@ -309,17 +219,18 @@ func SetVerdict(pkt *Packet, verdict network.Verdict) error { return ErrKextNotReady } + verdictInfo := struct { + id uint32 + verdict network.Verdict + }{pkt.verdictRequest.id, verdict} + atomic.AddInt32(urgentRequests, 1) - // timestamp := time.Now() - rc, _, lastErr := kext.setVerdict.Call( - uintptr(pkt.verdictRequest.id), - uintptr(verdict), - ) - // log.Tracef("winkext: settings verdict for packetID %d took %s", packetID, time.Now().Sub(timestamp)) + _, err := deviceIoControlBufferd(IOCTL_SET_VERDICT, + (*byte)(unsafe.Pointer(&verdictInfo)), unsafe.Sizeof(verdictInfo), nil, 0) atomic.AddInt32(urgentRequests, -1) - if rc != windows.NO_ERROR { + if err != nil { log.Tracer(pkt.Ctx()).Errorf("kext: failed to set verdict %s on packet %d", verdict, pkt.verdictRequest.id) - return formatErr(lastErr, rc) + return err } return nil } @@ -338,26 +249,31 @@ func GetPayload(packetID uint32, packetSize uint32) ([]byte, error) { buf := make([]byte, packetSize) + payload := struct { + id uint32 + length uint32 + }{packetID, packetSize} + atomic.AddInt32(urgentRequests, 1) + + writenSize, err := deviceIoControlBufferd(IOCTL_GET_PAYLOAD, + (*byte)(unsafe.Pointer(&payload)), unsafe.Sizeof(payload), + &buf[0], uintptr(packetSize)) + // timestamp := time.Now() - rc, _, lastErr := kext.getPayload.Call( - uintptr(packetID), - uintptr(unsafe.Pointer(&buf[0])), - uintptr(unsafe.Pointer(&packetSize)), - ) // log.Tracef("winkext: getting payload for packetID %d took %s", packetID, time.Now().Sub(timestamp)) atomic.AddInt32(urgentRequests, -1) - if rc != windows.NO_ERROR { - return nil, formatErr(lastErr, rc) + if err != nil { + return nil, err } - if packetSize == 0 { + if writenSize == 0 { return nil, errors.New("windows kext did not return any data") } - if packetSize < uint32(len(buf)) { - return buf[:packetSize], nil + if writenSize < uint32(len(buf)) { + return buf[:writenSize], nil } return buf, nil @@ -371,23 +287,6 @@ func ClearCache() error { return ErrKextNotReady } - if kext.clearCache == nil { - log.Error("kext: cannot clear cache: clearCache function missing") - } - - rc, _, lastErr := kext.clearCache.Call() - - if rc != windows.NO_ERROR { - return formatErr(lastErr, rc) - } - - return nil -} - -func formatErr(err error, rc uintptr) error { - sysErr, ok := err.(syscall.Errno) - if ok { - return fmt.Errorf("%s [LE 0x%X] [RC 0x%X]", err, uintptr(sysErr), rc) - } + _, err := deviceIoControl(IOCTL_CLEAR_CACHE, nil, 0) return err } diff --git a/firewall/interception/windowskext/kext_request.go b/firewall/interception/windowskext/kext_request.go new file mode 100644 index 00000000..828b2561 --- /dev/null +++ b/firewall/interception/windowskext/kext_request.go @@ -0,0 +1,50 @@ +//go:build windows +// +build windows + +package windowskext + +import "golang.org/x/sys/windows" + +const ( + METHOD_BUFFERED = 0 + METHOD_IN_DIRECT = 1 + METHOD_OUT_DIRECT = 2 + METHOD_NEITHER = 3 + SIOCTL_TYPE = 40000 +) + +var ( + IOCTL_HELLO = ctl_code(SIOCTL_TYPE, 0x800, METHOD_BUFFERED, windows.FILE_READ_DATA|windows.FILE_WRITE_DATA) + IOCTL_RECV_VERDICT_REQ_POLL = ctl_code(SIOCTL_TYPE, 0x801, METHOD_BUFFERED, windows.FILE_READ_DATA|windows.FILE_WRITE_DATA) + IOCTL_RECV_VERDICT_REQ = ctl_code(SIOCTL_TYPE, 0x802, METHOD_BUFFERED, windows.FILE_READ_DATA|windows.FILE_WRITE_DATA) + IOCTL_SET_VERDICT = ctl_code(SIOCTL_TYPE, 0x803, METHOD_BUFFERED, windows.FILE_READ_DATA|windows.FILE_WRITE_DATA) + IOCTL_GET_PAYLOAD = ctl_code(SIOCTL_TYPE, 0x804, METHOD_BUFFERED, windows.FILE_READ_DATA|windows.FILE_WRITE_DATA) + IOCTL_CLEAR_CACHE = ctl_code(SIOCTL_TYPE, 0x805, METHOD_BUFFERED, windows.FILE_READ_DATA|windows.FILE_WRITE_DATA) + IOCTL_TEST = ctl_code(SIOCTL_TYPE, 0x806, METHOD_NEITHER, windows.FILE_READ_DATA|windows.FILE_WRITE_DATA) +) + +func ctl_code(device_type, function, method, access uint32) uint32 { + return (device_type << 16) | (access << 14) | (function << 2) | method +} + +func deviceIoControl(code uint32, data *byte, size uintptr) (uint32, error) { + var bytesReturned uint32 + err := windows.DeviceIoControl(kextHandle, + code, + nil, 0, + data, uint32(size), + &bytesReturned, nil) + + return bytesReturned, err +} + +func deviceIoControlBufferd(code uint32, inData *byte, inSize uintptr, outData *byte, outSize uintptr) (uint32, error) { + var bytesReturned uint32 + err := windows.DeviceIoControl(kextHandle, + code, + inData, uint32(inSize), + outData, uint32(outSize), + &bytesReturned, nil) + + return bytesReturned, err +} From 1f677cb93f5d02c57311675990ba309896037439 Mon Sep 17 00:00:00 2001 From: Vladimir Date: Wed, 19 Oct 2022 13:25:11 -0700 Subject: [PATCH 3/5] Refactoring --- firewall/interception/windowskext/kext.go | 144 +++++------------- .../interception/windowskext/kext_request.go | 50 ------ firewall/interception/windowskext/service.go | 85 +++++++++++ firewall/interception/windowskext/syscall.go | 91 +++++++++++ 4 files changed, 212 insertions(+), 158 deletions(-) delete mode 100644 firewall/interception/windowskext/kext_request.go create mode 100644 firewall/interception/windowskext/service.go create mode 100644 firewall/interception/windowskext/syscall.go diff --git a/firewall/interception/windowskext/kext.go b/firewall/interception/windowskext/kext.go index 42159227..7906d1b2 100644 --- a/firewall/interception/windowskext/kext.go +++ b/firewall/interception/windowskext/kext.go @@ -9,7 +9,6 @@ import ( "os/exec" "sync" "sync/atomic" - "syscall" "time" "unsafe" @@ -34,6 +33,8 @@ var ( kextHandle windows.Handle ) +const driverName = "PortmasterKext" + func init() { var urgentRequestsValue int32 urgentRequests = &urgentRequestsValue @@ -50,112 +51,37 @@ func Start() error { kextLock.Lock() defer kextLock.Unlock() - filename := `\\.\PortmasterKext` + filename := `\\.\` + driverName - u16fname, err := syscall.UTF16FromString(filename) - if err != nil { - return fmt.Errorf("Bad filename: %s", err) - } - - u16DriverPath, err := syscall.UTF16FromString(driverPath) - if err != nil { - return fmt.Errorf("Bad driver path: %s", err) - } - kextHandle, err = windows.CreateFile(&u16fname[0], windows.GENERIC_READ|windows.GENERIC_WRITE, 0, nil, windows.OPEN_EXISTING, 0, 0) + // check if driver is already installed + var err error + kextHandle, err = openDriver(filename) if err == nil { - return nil // All good + return nil // device was already initialized } - service, err := portmasterDriverInstall(&u16DriverPath[0]) + // initialize and start driver service + service, err := driverInstall(driverPath) if err != nil { - return fmt.Errorf("Faield to start service: %s", err) + return fmt.Errorf("Failed to start service: %s", err) } - kextHandle, err = windows.CreateFile(&u16fname[0], - windows.GENERIC_READ|windows.GENERIC_WRITE, 0, nil, - windows.OPEN_EXISTING, 0, 0) + // open the driver + kextHandle, err = openDriver(filename) + // close the service handles windows.DeleteService(service) windows.CloseServiceHandle(service) + // driver was not installed if err != nil { - return fmt.Errorf("Faield to kext service: %s %q", err, filename) + return fmt.Errorf("Failed to start the kext service: %s %q", err, filename) } ready.Set() - testRead() return nil } -func testRead() { - buf := [5]byte{1, 2, 3, 4, 5} - _, err := deviceIoControl(IOCTL_TEST, &buf[0], uintptr(len(buf))) - if err != nil { - log.Criticalf("Erro reading test data: %s", err) - } - - log.Criticalf("Read restul: %v", buf) -} - -func createService(manager windows.Handle, portmasterKextPath *uint16) (windows.Handle, error) { - u16fname, err := syscall.UTF16FromString("PortmasterKext") - if err != nil { - return 0, fmt.Errorf("Bad service: %s", err) - } - service, err := windows.OpenService(manager, &u16fname[0], windows.SERVICE_ALL_ACCESS) - if err == nil { - return service, nil - } - service, err = windows.CreateService(manager, &u16fname[0], &u16fname[0], windows.SERVICE_ALL_ACCESS, windows.SERVICE_KERNEL_DRIVER, windows.SERVICE_DEMAND_START, windows.SERVICE_ERROR_NORMAL, portmasterKextPath, nil, nil, nil, nil, nil) - if err != nil { - return 0, err - } - - return service, nil -} - -func portmasterDriverInstall(portmasterKextPath *uint16) (windows.Handle, error) { - // Open the service manager: - manager, err := windows.OpenSCManager(nil, nil, windows.SC_MANAGER_ALL_ACCESS) - if err != nil { - return 0, fmt.Errorf("Failed to open service manager: %d", err) - } - defer windows.CloseServiceHandle(manager) - - var service windows.Handle -retryLoop: - for i := 0; i < 3; i++ { - service, err = createService(manager, portmasterKextPath) - if err == nil { - break retryLoop - } - } - - if err != nil { - return 0, fmt.Errorf("Failed to create service: %s", err) - } - - err = windows.StartService(service, 0, nil) - // Start the service: - if err != nil { - err = windows.GetLastError() - if err == windows.ERROR_SERVICE_ALREADY_RUNNING { - // windows.SetLastError(0) - // windows.SetLast - } else { - // Failed to start service; clean-up: - var status windows.SERVICE_STATUS - _ = windows.ControlService(service, windows.SERVICE_CONTROL_STOP, &status) - _ = windows.DeleteService(service) - _ = windows.CloseServiceHandle(service) - service = 0 - //windows.SetLastError(err) - } - } - - return service, nil -} - // Stop intercepting. func Stop() error { kextLock.Lock() @@ -165,11 +91,11 @@ func Stop() error { } ready.UnSet() - err := windows.CloseHandle(kextHandle) + err := closeDriver(kextHandle) if err != nil { - log.Errorf("kext: faield to close handle: %s", err) + log.Errorf("winkext: failed to close the handle: %s", err) } - _, _ = exec.Command("sc", "stop", "PortmasterKext").Output() + _, _ = exec.Command("sc", "stop", driverName).Output() return nil } @@ -194,14 +120,16 @@ func RecvVerdictRequest() (*VerdictRequest, error) { timestamp := time.Now() var new VerdictRequest - data := (*byte)(unsafe.Pointer(&new)) - _, err := deviceIoControl(IOCTL_RECV_VERDICT_REQ, data, unsafe.Sizeof(new)) + data := asByteArray(&new) + bytesRead, err := deviceIoControlRead(kextHandle, IOCTL_RECV_VERDICT_REQ, data) if err != nil { return nil, err } - log.Tracef("winkext: getting verdict request took %s", time.Now().Sub(timestamp)) + if bytesRead == 0 { + return nil, nil // no error, no new verdict request + } - log.Criticalf("%v", new) + log.Tracef("winkext: getting verdict request took %s", time.Now().Sub(timestamp)) return &new, nil } @@ -225,8 +153,8 @@ func SetVerdict(pkt *Packet, verdict network.Verdict) error { }{pkt.verdictRequest.id, verdict} atomic.AddInt32(urgentRequests, 1) - _, err := deviceIoControlBufferd(IOCTL_SET_VERDICT, - (*byte)(unsafe.Pointer(&verdictInfo)), unsafe.Sizeof(verdictInfo), nil, 0) + data := asByteArray(&verdictInfo) + _, err := deviceIoControlWrite(kextHandle, IOCTL_SET_VERDICT, data) atomic.AddInt32(urgentRequests, -1) if err != nil { log.Tracer(pkt.Ctx()).Errorf("kext: failed to set verdict %s on packet %d", verdict, pkt.verdictRequest.id) @@ -255,25 +183,21 @@ func GetPayload(packetID uint32, packetSize uint32) ([]byte, error) { }{packetID, packetSize} atomic.AddInt32(urgentRequests, 1) + data := asByteArray(&payload) + bytesRead, err := deviceIoControlReadWrite(kextHandle, IOCTL_GET_PAYLOAD, data, unsafe.Slice(&buf[0], packetSize)) - writenSize, err := deviceIoControlBufferd(IOCTL_GET_PAYLOAD, - (*byte)(unsafe.Pointer(&payload)), unsafe.Sizeof(payload), - &buf[0], uintptr(packetSize)) - - // timestamp := time.Now() - // log.Tracef("winkext: getting payload for packetID %d took %s", packetID, time.Now().Sub(timestamp)) atomic.AddInt32(urgentRequests, -1) if err != nil { return nil, err } - if writenSize == 0 { + if bytesRead == 0 { return nil, errors.New("windows kext did not return any data") } - if writenSize < uint32(len(buf)) { - return buf[:writenSize], nil + if bytesRead < uint32(len(buf)) { + return buf[:bytesRead], nil } return buf, nil @@ -287,6 +211,10 @@ func ClearCache() error { return ErrKextNotReady } - _, err := deviceIoControl(IOCTL_CLEAR_CACHE, nil, 0) + _, err := deviceIoControlRead(kextHandle, IOCTL_CLEAR_CACHE, nil) return err } + +func asByteArray[T any](obj *T) []byte { + return unsafe.Slice((*byte)(unsafe.Pointer(obj)), unsafe.Sizeof(*obj)) +} diff --git a/firewall/interception/windowskext/kext_request.go b/firewall/interception/windowskext/kext_request.go deleted file mode 100644 index 828b2561..00000000 --- a/firewall/interception/windowskext/kext_request.go +++ /dev/null @@ -1,50 +0,0 @@ -//go:build windows -// +build windows - -package windowskext - -import "golang.org/x/sys/windows" - -const ( - METHOD_BUFFERED = 0 - METHOD_IN_DIRECT = 1 - METHOD_OUT_DIRECT = 2 - METHOD_NEITHER = 3 - SIOCTL_TYPE = 40000 -) - -var ( - IOCTL_HELLO = ctl_code(SIOCTL_TYPE, 0x800, METHOD_BUFFERED, windows.FILE_READ_DATA|windows.FILE_WRITE_DATA) - IOCTL_RECV_VERDICT_REQ_POLL = ctl_code(SIOCTL_TYPE, 0x801, METHOD_BUFFERED, windows.FILE_READ_DATA|windows.FILE_WRITE_DATA) - IOCTL_RECV_VERDICT_REQ = ctl_code(SIOCTL_TYPE, 0x802, METHOD_BUFFERED, windows.FILE_READ_DATA|windows.FILE_WRITE_DATA) - IOCTL_SET_VERDICT = ctl_code(SIOCTL_TYPE, 0x803, METHOD_BUFFERED, windows.FILE_READ_DATA|windows.FILE_WRITE_DATA) - IOCTL_GET_PAYLOAD = ctl_code(SIOCTL_TYPE, 0x804, METHOD_BUFFERED, windows.FILE_READ_DATA|windows.FILE_WRITE_DATA) - IOCTL_CLEAR_CACHE = ctl_code(SIOCTL_TYPE, 0x805, METHOD_BUFFERED, windows.FILE_READ_DATA|windows.FILE_WRITE_DATA) - IOCTL_TEST = ctl_code(SIOCTL_TYPE, 0x806, METHOD_NEITHER, windows.FILE_READ_DATA|windows.FILE_WRITE_DATA) -) - -func ctl_code(device_type, function, method, access uint32) uint32 { - return (device_type << 16) | (access << 14) | (function << 2) | method -} - -func deviceIoControl(code uint32, data *byte, size uintptr) (uint32, error) { - var bytesReturned uint32 - err := windows.DeviceIoControl(kextHandle, - code, - nil, 0, - data, uint32(size), - &bytesReturned, nil) - - return bytesReturned, err -} - -func deviceIoControlBufferd(code uint32, inData *byte, inSize uintptr, outData *byte, outSize uintptr) (uint32, error) { - var bytesReturned uint32 - err := windows.DeviceIoControl(kextHandle, - code, - inData, uint32(inSize), - outData, uint32(outSize), - &bytesReturned, nil) - - return bytesReturned, err -} diff --git a/firewall/interception/windowskext/service.go b/firewall/interception/windowskext/service.go new file mode 100644 index 00000000..c1e2b52f --- /dev/null +++ b/firewall/interception/windowskext/service.go @@ -0,0 +1,85 @@ +//go:build windows +// +build windows + +package windowskext + +import ( + "fmt" + "syscall" + + "golang.org/x/sys/windows" +) + +func createService(manager windows.Handle, portmasterKextPath *uint16) (windows.Handle, error) { + u16filename, err := syscall.UTF16FromString(driverName) + if err != nil { + return 0, fmt.Errorf("Bad service: %s", err) + } + service, err := windows.OpenService(manager, &u16filename[0], windows.SERVICE_ALL_ACCESS) + if err == nil { + return service, nil + } + service, err = windows.CreateService(manager, &u16filename[0], &u16filename[0], windows.SERVICE_ALL_ACCESS, windows.SERVICE_KERNEL_DRIVER, windows.SERVICE_DEMAND_START, windows.SERVICE_ERROR_NORMAL, portmasterKextPath, nil, nil, nil, nil, nil) + if err != nil { + return 0, err + } + + return service, nil +} + +func driverInstall(portmasterKextPath string) (windows.Handle, error) { + u16kextPath, _ := syscall.UTF16FromString(portmasterKextPath) + // Open the service manager: + manager, err := windows.OpenSCManager(nil, nil, windows.SC_MANAGER_ALL_ACCESS) + if err != nil { + return 0, fmt.Errorf("Failed to open service manager: %d", err) + } + defer windows.CloseServiceHandle(manager) + + var service windows.Handle +retryLoop: + for i := 0; i < 3; i++ { + service, err = createService(manager, &u16kextPath[0]) + if err == nil { + break retryLoop + } + } + + if err != nil { + return 0, fmt.Errorf("Failed to create service: %s", err) + } + + err = windows.StartService(service, 0, nil) + // Start the service: + if err != nil { + err = windows.GetLastError() + if err == windows.ERROR_SERVICE_ALREADY_RUNNING { + // windows.SetLastError(0) + } else { + // Failed to start service; clean-up: + var status windows.SERVICE_STATUS + _ = windows.ControlService(service, windows.SERVICE_CONTROL_STOP, &status) + _ = windows.DeleteService(service) + _ = windows.CloseServiceHandle(service) + service = 0 + //windows.SetLastError(err) + } + } + + return service, nil +} + +func openDriver(filename string) (windows.Handle, error) { + u16filename, _ := syscall.UTF16FromString(filename) + + handle, err := windows.CreateFile(&u16filename[0], windows.GENERIC_READ|windows.GENERIC_WRITE, 0, nil, windows.OPEN_EXISTING, 0, 0) + if err != nil { + return 0, err + } + + return handle, nil +} + +func closeDriver(handle windows.Handle) error { + return windows.CloseHandle(handle) +} diff --git a/firewall/interception/windowskext/syscall.go b/firewall/interception/windowskext/syscall.go new file mode 100644 index 00000000..6ec11348 --- /dev/null +++ b/firewall/interception/windowskext/syscall.go @@ -0,0 +1,91 @@ +//go:build windows +// +build windows + +package windowskext + +import "golang.org/x/sys/windows" + +const ( + METHOD_BUFFERED = 0 + METHOD_IN_DIRECT = 1 + METHOD_OUT_DIRECT = 2 + METHOD_NEITHER = 3 + + SIOCTL_TYPE = 40000 +) + +var ( + IOCTL_HELLO = ctlCode(SIOCTL_TYPE, 0x800, METHOD_BUFFERED, windows.FILE_READ_DATA|windows.FILE_WRITE_DATA) + IOCTL_RECV_VERDICT_REQ_POLL = ctlCode(SIOCTL_TYPE, 0x801, METHOD_BUFFERED, windows.FILE_READ_DATA|windows.FILE_WRITE_DATA) + IOCTL_RECV_VERDICT_REQ = ctlCode(SIOCTL_TYPE, 0x802, METHOD_BUFFERED, windows.FILE_READ_DATA|windows.FILE_WRITE_DATA) + IOCTL_SET_VERDICT = ctlCode(SIOCTL_TYPE, 0x803, METHOD_BUFFERED, windows.FILE_READ_DATA|windows.FILE_WRITE_DATA) + IOCTL_GET_PAYLOAD = ctlCode(SIOCTL_TYPE, 0x804, METHOD_BUFFERED, windows.FILE_READ_DATA|windows.FILE_WRITE_DATA) + IOCTL_CLEAR_CACHE = ctlCode(SIOCTL_TYPE, 0x805, METHOD_BUFFERED, windows.FILE_READ_DATA|windows.FILE_WRITE_DATA) +) + +func ctlCode(device_type, function, method, access uint32) uint32 { + return (device_type << 16) | (access << 14) | (function << 2) | method +} + +func deviceIoControlRead(handle windows.Handle, code uint32, data []byte) (uint32, error) { + var bytesReturned uint32 + + var dataPtr *byte = nil + var dataSize uint32 = 0 + if data != nil { + dataPtr = &data[0] + dataSize = uint32(len(data)) + } + + err := windows.DeviceIoControl(handle, + code, + nil, 0, + dataPtr, dataSize, + &bytesReturned, nil) + + return bytesReturned, err +} + +func deviceIoControlWrite(handle windows.Handle, code uint32, data []byte) (uint32, error) { + var bytesReturned uint32 + + var dataPtr *byte = nil + var dataSize uint32 = 0 + if data != nil { + dataPtr = &data[0] + dataSize = uint32(len(data)) + } + + err := windows.DeviceIoControl(handle, + code, + dataPtr, dataSize, + nil, 0, + &bytesReturned, nil) + + return bytesReturned, err +} + +func deviceIoControlReadWrite(handle windows.Handle, code uint32, inData []byte, outData []byte) (uint32, error) { + var bytesReturned uint32 + + var inDataPtr *byte = nil + var inDataSize uint32 = 0 + if inData != nil { + inDataPtr = &inData[0] + inDataSize = uint32(len(inData)) + } + + var outDataPtr *byte = nil + var outDataSize uint32 = 0 + if outData != nil { + outDataPtr = &outData[0] + outDataSize = uint32(len(outData)) + } + err := windows.DeviceIoControl(handle, + code, + inDataPtr, inDataSize, + outDataPtr, outDataSize, + &bytesReturned, nil) + + return bytesReturned, err +} From 1ff27784c31515e7e6e174ce5d29136f3b7cbc9e Mon Sep 17 00:00:00 2001 From: Vladimir Date: Wed, 2 Nov 2022 15:03:26 -0700 Subject: [PATCH 4/5] Refactoring and more comments --- firewall/interception/windowskext/handler.go | 7 ++++++ firewall/interception/windowskext/kext.go | 25 ++++++++++++++------ firewall/interception/windowskext/service.go | 12 ++++++---- 3 files changed, 32 insertions(+), 12 deletions(-) diff --git a/firewall/interception/windowskext/handler.go b/firewall/interception/windowskext/handler.go index 623c49a3..a19cbfdc 100644 --- a/firewall/interception/windowskext/handler.go +++ b/firewall/interception/windowskext/handler.go @@ -1,3 +1,4 @@ +//go:build windows // +build windows package windowskext @@ -10,6 +11,7 @@ import ( "github.com/tevino/abool" "github.com/safing/portbase/log" + "github.com/safing/portmaster/network" "github.com/safing/portmaster/network/packet" ) @@ -43,6 +45,11 @@ type VerdictRequest struct { packetSize uint32 } +type VerdictInfo struct { + id uint32 // ID from RegisterPacket + verdict network.Verdict // verdict for the connection +} + // Handler transforms received packets to the Packet interface. func Handler(packets chan packet.Packet) { if !ready.IsSet() { diff --git a/firewall/interception/windowskext/kext.go b/firewall/interception/windowskext/kext.go index 7906d1b2..084ecded 100644 --- a/firewall/interception/windowskext/kext.go +++ b/firewall/interception/windowskext/kext.go @@ -70,8 +70,8 @@ func Start() error { kextHandle, err = openDriver(filename) // close the service handles - windows.DeleteService(service) - windows.CloseServiceHandle(service) + _ = windows.DeleteService(service) + _ = windows.CloseServiceHandle(service) // driver was not installed if err != nil { @@ -95,7 +95,11 @@ func Stop() error { if err != nil { log.Errorf("winkext: failed to close the handle: %s", err) } - _, _ = exec.Command("sc", "stop", driverName).Output() + + _, err = exec.Command("sc", "stop", driverName).Output() // This is a question of taste, but it is a robust and solid solution + if err != nil { + log.Errorf("winkext: failed to stop the service: %q", err) + } return nil } @@ -118,8 +122,10 @@ func RecvVerdictRequest() (*VerdictRequest, error) { } timestamp := time.Now() + // Initialize struct for the output data var new VerdictRequest + // Make driver request data := asByteArray(&new) bytesRead, err := deviceIoControlRead(kextHandle, IOCTL_RECV_VERDICT_REQ, data) if err != nil { @@ -147,11 +153,9 @@ func SetVerdict(pkt *Packet, verdict network.Verdict) error { return ErrKextNotReady } - verdictInfo := struct { - id uint32 - verdict network.Verdict - }{pkt.verdictRequest.id, verdict} + verdictInfo := VerdictInfo{pkt.verdictRequest.id, verdict} + // Make driver request atomic.AddInt32(urgentRequests, 1) data := asByteArray(&verdictInfo) _, err := deviceIoControlWrite(kextHandle, IOCTL_SET_VERDICT, data) @@ -169,6 +173,7 @@ func GetPayload(packetID uint32, packetSize uint32) ([]byte, error) { return nil, ErrNoPacketID } + // Check if driver is initialized kextLock.RLock() defer kextLock.RUnlock() if !ready.IsSet() { @@ -177,11 +182,13 @@ func GetPayload(packetID uint32, packetSize uint32) ([]byte, error) { buf := make([]byte, packetSize) + // Combine id and length payload := struct { id uint32 length uint32 }{packetID, packetSize} + // Make driver request atomic.AddInt32(urgentRequests, 1) data := asByteArray(&payload) bytesRead, err := deviceIoControlReadWrite(kextHandle, IOCTL_GET_PAYLOAD, data, unsafe.Slice(&buf[0], packetSize)) @@ -192,6 +199,7 @@ func GetPayload(packetID uint32, packetSize uint32) ([]byte, error) { return nil, err } + // check the result and return if bytesRead == 0 { return nil, errors.New("windows kext did not return any data") } @@ -206,11 +214,14 @@ func GetPayload(packetID uint32, packetSize uint32) ([]byte, error) { func ClearCache() error { kextLock.RLock() defer kextLock.RUnlock() + + // Check if driver is initialized if !ready.IsSet() { log.Error("kext: failed to clear the cache: kext not ready") return ErrKextNotReady } + // Make driver request _, err := deviceIoControlRead(kextHandle, IOCTL_CLEAR_CACHE, nil) return err } diff --git a/firewall/interception/windowskext/service.go b/firewall/interception/windowskext/service.go index c1e2b52f..a2807a59 100644 --- a/firewall/interception/windowskext/service.go +++ b/firewall/interception/windowskext/service.go @@ -15,10 +15,13 @@ func createService(manager windows.Handle, portmasterKextPath *uint16) (windows. if err != nil { return 0, fmt.Errorf("Bad service: %s", err) } + // Check if it's already created service, err := windows.OpenService(manager, &u16filename[0], windows.SERVICE_ALL_ACCESS) if err == nil { return service, nil } + + // Create the service service, err = windows.CreateService(manager, &u16filename[0], &u16filename[0], windows.SERVICE_ALL_ACCESS, windows.SERVICE_KERNEL_DRIVER, windows.SERVICE_DEMAND_START, windows.SERVICE_ERROR_NORMAL, portmasterKextPath, nil, nil, nil, nil, nil) if err != nil { return 0, err @@ -36,6 +39,7 @@ func driverInstall(portmasterKextPath string) (windows.Handle, error) { } defer windows.CloseServiceHandle(manager) + // Try to create the service. Retry if it fails. var service windows.Handle retryLoop: for i := 0; i < 3; i++ { @@ -49,20 +53,18 @@ retryLoop: return 0, fmt.Errorf("Failed to create service: %s", err) } - err = windows.StartService(service, 0, nil) // Start the service: + err = windows.StartService(service, 0, nil) + if err != nil { err = windows.GetLastError() - if err == windows.ERROR_SERVICE_ALREADY_RUNNING { - // windows.SetLastError(0) - } else { + if err != windows.ERROR_SERVICE_ALREADY_RUNNING { // Failed to start service; clean-up: var status windows.SERVICE_STATUS _ = windows.ControlService(service, windows.SERVICE_CONTROL_STOP, &status) _ = windows.DeleteService(service) _ = windows.CloseServiceHandle(service) service = 0 - //windows.SetLastError(err) } } From 5d2715ca171d3167f9581fa0b4a8bb053cd88ecb Mon Sep 17 00:00:00 2001 From: Vladimir Date: Thu, 3 Nov 2022 10:58:00 +0100 Subject: [PATCH 5/5] remove kext glue dll from dependencies --- firewall/interception/interception_windows.go | 2 +- firewall/interception/windowskext/kext.go | 2 +- updates/helper/updates.go | 1 - 3 files changed, 2 insertions(+), 3 deletions(-) diff --git a/firewall/interception/interception_windows.go b/firewall/interception/interception_windows.go index 151dc070..0441d3a6 100644 --- a/firewall/interception/interception_windows.go +++ b/firewall/interception/interception_windows.go @@ -15,7 +15,7 @@ func start(ch chan packet.Packet) error { return fmt.Errorf("interception: could not get kext sys: %s", err) } - err = windowskext.Init("", kextFile.Path()) + err = windowskext.Init(kextFile.Path()) if err != nil { return fmt.Errorf("interception: could not init windows kext: %s", err) } diff --git a/firewall/interception/windowskext/kext.go b/firewall/interception/windowskext/kext.go index 084ecded..ca8315e6 100644 --- a/firewall/interception/windowskext/kext.go +++ b/firewall/interception/windowskext/kext.go @@ -41,7 +41,7 @@ func init() { } // Init initializes the DLL and the Kext (Kernel Driver). -func Init(dllPath, path string) error { +func Init(path string) error { driverPath = path return nil } diff --git a/updates/helper/updates.go b/updates/helper/updates.go index 17fe6116..80193ee8 100644 --- a/updates/helper/updates.go +++ b/updates/helper/updates.go @@ -52,7 +52,6 @@ func MandatoryUpdates() (identifiers []string) { identifiers = append( identifiers, PlatformIdentifier("core/portmaster-core.exe"), - PlatformIdentifier("kext/portmaster-kext.dll"), PlatformIdentifier("kext/portmaster-kext.sys"), PlatformIdentifier("kext/portmaster-kext.pdb"), PlatformIdentifier("start/portmaster-start.exe"),