Merge branch 'develop' into feature/tauri-beta-update

.github/workflows/kext.yml

@@ -0,0 +1,36 @@
+name: Windows Kernel Extension
+
+on:
+  push:
+    paths:
+      - 'windows_kext/**'
+    branches:
+      - master
+      - develop
+
+  pull_request:
+    paths:
+      - 'windows_kext/**'
+    branches:
+      - master
+      - develop
+
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    steps:
+    - uses: earthly/actions-setup@v1
+      with:
+        version: v0.8.0
+    - uses: actions/checkout@v4
+
+    - name: Log in to the Container registry
+      uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
+      with:
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: Build Kernel Extension
+      run: earthly --ci --remote-cache=ghcr.io/safing/build-cache --push +kext-build

.gitignore

@@ -48,3 +48,6 @@ _testmain.go
 win_dev_*
 go.work
 go.work.sum
+
+# Kext releases
+windows_kext/release/kext_release_*.zip

Earthfile

@@ -3,6 +3,7 @@ VERSION --arg-scope-and-set --global-cache 0.8
 ARG --global go_version = 1.22
 ARG --global node_version = 18
 ARG --global rust_version = 1.76
+ARG --global golangci_lint_version = 1.57.1
 
 ARG --global go_builder_image = "golang:${go_version}-alpine"
 ARG --global node_builder_image = "node:${node_version}"
@@ -90,16 +91,16 @@ go-update-deps:
 
     RUN go get -u ./..
     RUN go mod tidy
-    SAVE ARTIFACT go.mod AS LOCAL go.mod
-    SAVE ARTIFACT --if-exists go.sum AS LOCAL go.sum
+    SAVE ARTIFACT --keep-ts go.mod AS LOCAL go.mod
+    SAVE ARTIFACT --keep-ts --if-exists go.sum AS LOCAL go.sum
 
 # mod-tidy runs 'go mod tidy', saving go.mod and go.sum locally.
 mod-tidy:
     FROM +go-base
 
     RUN go mod tidy
-    SAVE ARTIFACT go.mod AS LOCAL go.mod
-    SAVE ARTIFACT --if-exists go.sum AS LOCAL go.sum
+    SAVE ARTIFACT --keep-ts go.mod AS LOCAL go.mod
+    SAVE ARTIFACT --keep-ts --if-exists go.sum AS LOCAL go.sum
 
 # go-build runs 'go build ./cmds/...', saving artifacts locally.
 # If --CMDS is not set, it defaults to building portmaster-start, portmaster-core and hub
@@ -130,10 +131,33 @@ go-build:
     DO +GO_ARCH_STRING --goos="${GOOS}" --goarch="${GOARCH}" --goarm="${GOARM}"
 
     FOR bin IN $(ls -1 "/tmp/build/")
-        SAVE ARTIFACT "/tmp/build/${bin}" AS LOCAL "${outputDir}/${GO_ARCH_STRING}/${bin}"
+        SAVE ARTIFACT --keep-ts "/tmp/build/${bin}" AS LOCAL "${outputDir}/${GO_ARCH_STRING}/${bin}"
     END
 
-    SAVE ARTIFACT "/tmp/build/" ./output
+    SAVE ARTIFACT --keep-ts "/tmp/build/" ./output
+
+spn-image:
+    # Use minimal image as base.
+    FROM alpine
+
+    # Copy the static executable.
+    COPY (+go-build/output/portmaster-start --GOARCH=amd64 --GOOS=linux --CMDS=portmaster-start) /init/portmaster-start
+
+    # Copy the init script
+    COPY spn/tools/container-init.sh /init.sh
+
+    # Run the hub.
+    ENTRYPOINT ["/init.sh"]
+
+    # Get version.
+    LET version = "$(/init/portmaster-start version --short | tr ' ' -)"
+    RUN echo "Version: ${version}"
+
+    # Save dev image
+    SAVE IMAGE "spn:latest"
+    SAVE IMAGE "spn:${version}"
+    SAVE IMAGE "ghcr.io/safing/spn:latest"
+    SAVE IMAGE "ghcr.io/safing/spn:${version}"
 
 # Test one or more go packages.
 # Test are always run as -short, as "long" tests require a full desktop system.
@@ -164,6 +188,12 @@ go-test-all:
         BUILD +go-test --GOARCH="${GOARCH}" --GOOS="${GOOS}" --GOARM="${GOARM}"
     END
 
+go-lint:
+    FROM +go-base
+
+    RUN go install github.com/golangci/golangci-lint/cmd/golangci-lint@v${golangci_lint_version}
+    RUN golangci-lint run -c ./.golangci.yml --timeout 15m --show-stats
+
 # Builds portmaster-start, portmaster-core, hub and notifier for all supported platforms
 go-release:
     FROM ${work_image}
@@ -217,9 +247,9 @@ angular-base:
     COPY assets/data ./assets
 
     IF [ "${configuration}" = "production" ]
-        RUN npm run build-libs
+        RUN --no-cache npm run build-libs
     ELSE
-        RUN npm run build-libs:dev
+        RUN --no-cache npm run build-libs:dev
     END
 
     # Explicitly cache here.
@@ -241,11 +271,11 @@ angular-project:
     RUN --no-cache ./node_modules/.bin/ng build --configuration ${configuration} --base-href ${baseHref} "${project}"
 
     RUN --no-cache cwd=$(pwd) && cd "${dist}" && zip -r "${cwd}/${project}.zip" ./
-    SAVE ARTIFACT "${dist}" "./output/${project}"
+    SAVE ARTIFACT --keep-ts "${dist}" "./output/${project}"
     
     # Save portmaster UI as local artifact.
     IF [ "${project}" = "portmaster" ]
-        SAVE ARTIFACT "./${project}.zip" AS LOCAL ${outputDir}/all/${project}-ui.zip
+        SAVE ARTIFACT --keep-ts "./${project}.zip" AS LOCAL ${outputDir}/all/${project}-ui.zip
     END
 
 # Build the angular projects (portmaster-UI and tauri-builtin) in dev mode
@@ -258,6 +288,16 @@ angular-release:
     BUILD +angular-project --project=portmaster --dist=./dist --configuration=production --baseHref=/ui/modules/portmaster/
     BUILD +angular-project --project=tauri-builtin --dist=./dist/tauri-builtin --configuration=production --baseHref=/
 
+assets:
+    FROM ${work_image}
+    RUN apk add zip
+
+    WORKDIR /app/assets
+    COPY --keep-ts ./assets/data .
+    RUN zip -r -9 -db assets.zip *
+
+    SAVE ARTIFACT --keep-ts "assets.zip" AS LOCAL "${outputDir}/all/assets.zip"
+
 # A base target for rust to prepare the build container
 rust-base:
     FROM ${rust_builder_image}
@@ -280,7 +320,7 @@ rust-base:
         wget \
         file \
         libsoup-3.0-dev \
-        libwebkit2gtk-4.1-dev 
+        libwebkit2gtk-4.1-dev
 
     # Install library dependencies for all supported architectures
     # required for succesfully linking.
@@ -405,7 +445,7 @@ tauri-build:
         END
         # Save output binary as local artifact.
         IF [ -f "target/${target}/release/${bin}" ]
-            SAVE ARTIFACT "target/${target}/release/${bin}" AS LOCAL "${outputDir}/${GO_ARCH_STRING}/${outbin}"
+            SAVE ARTIFACT --keep-ts "target/${target}/release/${bin}" AS LOCAL "${outputDir}/${GO_ARCH_STRING}/${outbin}"
         END
     END
     SAVE ARTIFACT --if-exists "target/${target}/release/bundle/deb/*.deb" AS LOCAL "${outputDir}/${GO_ARCH_STRING}/"
@@ -467,10 +507,32 @@ tauri-release:
         BUILD +tauri-build --target="${arch}"
     END
 
+kext-build:
+    FROM ${rust_builder_image}
+
+    # Install architecture target
+    DO rust+INIT --keep_fingerprints=true
+
+    # Build kext
+    WORKDIR /app/kext
+    # --keep-ts is necessary to ensure that the timestamps of the source files
+    # are preserved such that Rust's incremental compilation works correctly.
+    COPY --keep-ts ./windows_kext/ .
+
+    # Add target architecture
+    RUN rustup target add x86_64-pc-windows-msvc
+    
+    # Build using special earthly lib
+    WORKDIR /app/kext/release
+    DO rust+CARGO --args="run"
+
+    SAVE ARTIFACT --keep-ts "portmaster-kext-release-bundle.zip" AS LOCAL "${outputDir}/windows_amd64/portmaster-kext-release-bundle.zip"
+
 build:
     BUILD +go-release
     BUILD +angular-release
     BUILD +tauri-release
+    BUILD +assets
 
 release:
     LOCALLY
@@ -479,7 +541,7 @@ release:
         RUN echo -e "\033[1;31m Refusing to release a dirty git repository. Please commit your local changes first! \033[0m" ; exit 1
     END
 
-    BUILD +build-all
+    BUILD +build
 
 
 # Takes GOOS, GOARCH and optionally GOARM and creates a string representation for file-names.

desktop/angular/docker.sh

@@ -11,8 +11,8 @@ mnt="$( cd ../.. && pwd )"
 docker run                                \
     -ti                                   \
     --rm                                  \
-    -v $mnt:/portmaster-ui                \
-    -w /portmaster-ui/modules/portmaster  \
+    -v $mnt:/portmaster                   \
+    -w /portmaster/desktop/angular        \
     -p 8081:8080                          \
     node:latest                           \
     npm start -- --host 0.0.0.0 --port 8080

desktop/angular/package.json

@@ -1,6 +1,6 @@
 {
   "name": "portmaster",
-  "version": "0.8.5",
+  "version": "0.8.7",
   "scripts": {
     "ng": "ng",
     "start": "npm install && npm run build-libs:dev && ng serve --proxy-config ./proxy.json",

desktop/angular/projects/safing/portmaster-api/src/lib/debug-api.service.ts

@@ -18,6 +18,12 @@ export class DebugAPI {
     })
   }
 
+  ready(): Observable<string> {
+    return this.http.get(`${this.httpAPI}/v1/ready`, {
+      responseType: 'text'
+    })
+  }
+
   getStack(): Observable<string> {
     return this.http.get(`${this.httpAPI}/v1/debug/stack`, {
       responseType: 'text'

desktop/angular/src/app/pages/app-view/app-view.html

@@ -181,6 +181,8 @@
             Get Help
           </a>
 
+          <!--
+          TODO: "View Active" button is broken or should have been removed.
           <div sfngTipUpAnchor="left" class="flex space-x-2 flex-rows">
             <sfng-tipup key="appSettings-Filter"></sfng-tipup>
             <sfng-select [ngModel]="viewSetting" (ngModelChange)="viewSettingChange.next($event)"
@@ -193,6 +195,7 @@
               </sfng-select-item>
             </sfng-select>
           </div>
+          -->
         </div>
 
         <div class="flex items-center text-tertiary">

desktop/angular/src/app/pages/spn/map-renderer/map-renderer.ts

@@ -195,6 +195,8 @@ export class MapRendererComponent implements OnInit, AfterViewInit, OnDestroy {
     data.forEach((country: any) => {
       this.countryNames[country.properties.iso_a2] = country.properties.name
     })
+    // Add special country values.
+    this.countryNames["__"] = "Anycast"
 
     this.worldGroup.selectAll()
       .data<GeoPermissibleObjects>(data)

desktop/angular/src/app/shared/app-icon/app-icon.ts

@@ -94,7 +94,7 @@ export class AppIconComponent implements OnInit, OnDestroy {
     this._profile = p || null;
 
     if (this.initDone) {
-      this.updateView(true);
+      this.updateView();
     }
   }
   get profile(): IDandName | null | undefined {

desktop/angular/src/app/shared/netquery/connection-details/conn-details.html

@@ -180,14 +180,14 @@
     <span sfngAddToFilter="remote_ip" [sfngAddToFilterValue]="conn.remote_ip">
       <span>Remote Peer:</span>
       <span>
-        <span *ngIf="!!conn.country" [appCountryFlags]="conn.country"></span>
         {{ conn.remote_ip || 'DNS Request'}}
         <span *ngIf="conn.remote_port" class="text-tertiary">{{ ':'+conn.remote_port }}</span>
       </span>
     </span>
     <span sfngAddToFilter="country" [sfngAddToFilterValue]="conn.country">
       <span>Country:</span>
-      <span>{{ conn.country || 'N/A'}}</span>
+      <span *ngIf="!!conn.country" [appCountryFlags]="conn.country"></span>
+      <span>{{ (conn.country | countryName) || 'N/A' }}</span>
     </span>
     <span sfngAddToFilter="asn" [sfngAddToFilterValue]="conn.asn">
       <span>ASN:</span>

desktop/angular/src/app/shared/netquery/pipes/location.pipe.ts

@@ -11,6 +11,9 @@ export class ConnectionLocationPipe implements PipeTransform {
       return '';
     }
     if (!!conn.country) {
+      if (conn.country === "__") {
+        return "Anycast"
+      }
       return conn.country;
     }
 

go.mod

@@ -1,10 +1,8 @@
 module github.com/safing/portmaster
 
-go 1.21.1
+go 1.22.0
 
-toolchain go1.21.2
-
-// TODO: Remove when https://github.com/tc-hib/winres/pull/4 is merged or changes are otherwise integrated.
+// TODO: Remove when https://github.com/tc-hib/winres/pull/4 is released.
 replace github.com/tc-hib/winres => github.com/dhaavi/winres v0.2.2
 
 require (
@@ -12,28 +10,29 @@ require (
 	github.com/Xuanwo/go-locale v1.1.0
 	github.com/agext/levenshtein v1.2.3
 	github.com/awalterschulze/gographviz v2.0.3+incompatible
-	github.com/cilium/ebpf v0.14.0
+	github.com/brianvoe/gofakeit v3.18.0+incompatible
+	github.com/cilium/ebpf v0.15.0
 	github.com/coreos/go-iptables v0.7.0
 	github.com/dhaavi/go-notify v0.0.0-20190209221809-c404b1f22435
 	github.com/florianl/go-conntrack v0.4.0
-	github.com/florianl/go-nfqueue v1.3.1
+	github.com/florianl/go-nfqueue v1.3.2
 	github.com/fogleman/gg v1.3.0
 	github.com/ghodss/yaml v1.0.0
 	github.com/godbus/dbus/v5 v5.1.0
 	github.com/google/gopacket v1.1.19
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
 	github.com/hashicorp/go-multierror v1.1.1
-	github.com/hashicorp/go-version v1.6.0
+	github.com/hashicorp/go-version v1.7.0
 	github.com/jackc/puddle/v2 v2.2.1
 	github.com/mat/besticon v3.12.0+incompatible
-	github.com/miekg/dns v1.1.58
+	github.com/miekg/dns v1.1.59
 	github.com/mitchellh/go-server-timing v1.0.1
 	github.com/mr-tron/base58 v1.2.0
 	github.com/oschwald/maxminddb-golang v1.12.0
 	github.com/r3labs/diff/v3 v3.0.1
 	github.com/rot256/pblind v0.0.0-20231024115251-cd3f239f28c1
 	github.com/safing/jess v0.3.3
-	github.com/safing/portbase v0.19.4
+	github.com/safing/portbase v0.19.5
 	github.com/safing/portmaster-android/go v0.0.0-20230830120134-3226ceac3bec
 	github.com/shirou/gopsutil v3.21.11+incompatible
 	github.com/spf13/cobra v1.8.0
@@ -44,13 +43,13 @@ require (
 	github.com/tevino/abool v1.2.0
 	github.com/umahmood/haversine v0.0.0-20151105152445-808ab04add26
 	github.com/vincent-petithory/dataurl v1.0.0
-	golang.org/x/exp v0.0.0-20240409090435-93d18d7e34b8
-	golang.org/x/image v0.15.0
-	golang.org/x/net v0.24.0
+	golang.org/x/exp v0.0.0-20240525044651-4c93da0ed11d
+	golang.org/x/image v0.16.0
+	golang.org/x/net v0.25.0
 	golang.org/x/sync v0.7.0
-	golang.org/x/sys v0.19.0
+	golang.org/x/sys v0.20.0
 	gopkg.in/yaml.v3 v3.0.1
-	zombiezen.com/go/sqlite v1.2.0
+	zombiezen.com/go/sqlite v1.3.0
 )
 
 require (
@@ -60,7 +59,6 @@ require (
 	github.com/alessio/shellescape v1.4.2 // indirect
 	github.com/armon/go-radix v1.0.0 // indirect
 	github.com/bluele/gcache v0.0.2 // indirect
-	github.com/brianvoe/gofakeit v3.18.0+incompatible // indirect
 	github.com/danieljoos/wincred v1.2.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
@@ -88,7 +86,6 @@ require (
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/ncruces/go-strftime v0.1.9 // indirect
 	github.com/nfnt/resize v0.0.0-20180221191011-83c6a9932646 // indirect
-	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/satori/go.uuid v1.2.0 // indirect
@@ -99,26 +96,26 @@ require (
 	github.com/tidwall/match v1.1.1 // indirect
 	github.com/tidwall/pretty v1.2.1 // indirect
 	github.com/tidwall/sjson v1.2.5 // indirect
-	github.com/tklauser/go-sysconf v0.3.13 // indirect
-	github.com/tklauser/numcpus v0.7.0 // indirect
+	github.com/tklauser/go-sysconf v0.3.14 // indirect
+	github.com/tklauser/numcpus v0.8.0 // indirect
 	github.com/valyala/fastrand v1.1.0 // indirect
 	github.com/valyala/histogram v1.2.0 // indirect
 	github.com/vmihailenco/msgpack/v5 v5.4.1 // indirect
 	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
-	github.com/zalando/go-keyring v0.2.3 // indirect
+	github.com/zalando/go-keyring v0.2.4 // indirect
 	github.com/zeebo/blake3 v0.2.3 // indirect
-	go.etcd.io/bbolt v1.3.9 // indirect
-	golang.org/x/crypto v0.22.0 // indirect
+	go.etcd.io/bbolt v1.3.10 // indirect
+	golang.org/x/crypto v0.23.0 // indirect
 	golang.org/x/mod v0.17.0 // indirect
-	golang.org/x/text v0.14.0 // indirect
+	golang.org/x/text v0.15.0 // indirect
 	golang.org/x/time v0.5.0 // indirect
-	golang.org/x/tools v0.20.0 // indirect
+	golang.org/x/tools v0.21.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
-	gvisor.dev/gvisor v0.0.0-20240409213450-87d8df37c71e // indirect
-	modernc.org/libc v1.49.3 // indirect
+	gvisor.dev/gvisor v0.0.0-20240524212851-a244eff8ad49 // indirect
+	modernc.org/libc v1.50.9 // indirect
 	modernc.org/mathutil v1.6.0 // indirect
 	modernc.org/memory v1.8.0 // indirect
-	modernc.org/sqlite v1.29.6 // indirect
+	modernc.org/sqlite v1.29.10 // indirect
 )

go.sum

@@ -5,8 +5,6 @@ github.com/AndreasBriese/bbloom v0.0.0-20190825152654-46b345b51c96 h1:cTp8I5+VIo
 github.com/AndreasBriese/bbloom v0.0.0-20190825152654-46b345b51c96/go.mod h1:bOvUY6CB00SOBii9/FifXqc0awNKxLFCL/+pkDPuyl8=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/toml v0.4.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
-github.com/VictoriaMetrics/metrics v1.29.1 h1:yTORfGeO1T0C6P/tEeT4Mf7rBU5TUu3kjmHvmlaoeO8=
-github.com/VictoriaMetrics/metrics v1.29.1/go.mod h1:r7hveu6xMdUACXvB8TYdAj8WEsKzWB0EkpJN+RDtOf8=
 github.com/VictoriaMetrics/metrics v1.33.1 h1:CNV3tfm2Kpv7Y9W3ohmvqgFWPR55tV2c7M2U6OIo+UM=
 github.com/VictoriaMetrics/metrics v1.33.1/go.mod h1:r7hveu6xMdUACXvB8TYdAj8WEsKzWB0EkpJN+RDtOf8=
 github.com/Xuanwo/go-locale v1.1.0 h1:51gUxhxl66oXAjI9uPGb2O0qwPECpriKQb2hl35mQkg=
@@ -32,10 +30,8 @@ github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj
 github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cilium/ebpf v0.5.0/go.mod h1:4tRaxcgiL706VnOzHOdBlY8IEAIdxINsQBcU4xJJXRs=
 github.com/cilium/ebpf v0.7.0/go.mod h1:/oI2+1shJiTGAMgl6/RgJr36Eo1jzrRcAWbcXO2usCA=
-github.com/cilium/ebpf v0.12.3 h1:8ht6F9MquybnY97at+VDZb3eQQr8ev79RueWeVaEcG4=
-github.com/cilium/ebpf v0.12.3/go.mod h1:TctK1ivibvI3znr66ljgi4hqOT8EYQjz1KWBfb1UVgM=
-github.com/cilium/ebpf v0.14.0 h1:0PsxAjO6EjI1rcT+rkp6WcCnE0ZvfkXBYiMedJtrSUs=
-github.com/cilium/ebpf v0.14.0/go.mod h1:DHp1WyrLeiBh19Cf/tfiSMhqheEiK8fXFZ4No0P1Hso=
+github.com/cilium/ebpf v0.15.0 h1:7NxJhNiBT3NG8pZJ3c+yfrVdHY8ScgKD27sScgjLMMk=
+github.com/cilium/ebpf v0.15.0/go.mod h1:DHp1WyrLeiBh19Cf/tfiSMhqheEiK8fXFZ4No0P1Hso=
 github.com/coreos/go-iptables v0.7.0 h1:XWM3V+MPRr5/q51NuWSgU0fqMad64Zyxs8ZUoMsamr8=
 github.com/coreos/go-iptables v0.7.0/go.mod h1:Qe8Bv2Xik5FyTXwgIbLAnv2sWSBmvWdFETJConOQ//Q=
 github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
@@ -59,19 +55,14 @@ github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/florianl/go-conntrack v0.4.0 h1:TlYkxytdwgVayfU0cKwkHurQA0Rd1ZSEBRckRYDUu18=
 github.com/florianl/go-conntrack v0.4.0/go.mod h1:iPDx4oIats2T7X7Jm3PFyRCJM1GfZhJaSHOWROYOrE8=
-github.com/florianl/go-nfqueue v1.3.1 h1:khQ9fYCrjbu5CF8dZF55G2RTIEIQRI0Aj5k3msJR6Gw=
-github.com/florianl/go-nfqueue v1.3.1/go.mod h1:aHWbgkhryJxF5XxYvJ3oRZpdD4JP74Zu/hP1zuhja+M=
+github.com/florianl/go-nfqueue v1.3.2 h1:8DPzhKJHywpHJAE/4ktgcqveCL7qmMLsEsVD68C4x4I=
+github.com/florianl/go-nfqueue v1.3.2/go.mod h1:eSnAor2YCfMCVYrVNEhkLGN/r1L+J4uDjc0EUy0tfq4=
 github.com/fogleman/gg v1.3.0 h1:/7zJX8F6AaYQc57WQCyN9cAIz+4bCJGO9B+dyW29am8=
 github.com/fogleman/gg v1.3.0/go.mod h1:R/bRT+9gY/C5z7JzPU0zXsXHKM4/ayA+zqcVNZzPa1k=
-github.com/frankban/quicktest v1.11.3 h1:8sXhOn0uLys67V8EsXLc6eszDs8VXWxL3iRvebPhedY=
 github.com/frankban/quicktest v1.11.3/go.mod h1:wRf/ReqHper53s+kmmSZizM8NamnL3IM0I9ntUbOk+k=
-github.com/frankban/quicktest v1.14.5 h1:dfYrrRyLtiqT9GyKXgdh+k4inNeTvmGbuSgZ3lx3GhA=
-github.com/frankban/quicktest v1.14.5/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
 github.com/fsnotify/fsnotify v1.4.3-0.20170329110642-4da3e2cfbabc/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fxamacker/cbor v1.5.1 h1:XjQWBgdmQyqimslUh5r4tUGmoqzHmBFQOImkWGi2awg=
 github.com/fxamacker/cbor v1.5.1/go.mod h1:3aPGItF174ni7dDzd6JZ206H8cmr4GDNBGpPa971zsU=
-github.com/fxamacker/cbor/v2 v2.5.0 h1:oHsG0V/Q6E/wqTS2O1Cozzsy69nqCiguo5Q1a1ADivE=
-github.com/fxamacker/cbor/v2 v2.5.0/go.mod h1:TA1xS00nchWmaBnEIxPSE5oHLuJBAVvqrtAnWBwBCVo=
 github.com/fxamacker/cbor/v2 v2.6.0 h1:sU6J2usfADwWlYDAFhZBQ6TnLFBHxgesMrQfQgk1tWA=
 github.com/fxamacker/cbor/v2 v2.6.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
 github.com/garyburd/redigo v1.1.1-0.20170914051019-70e1b1943d4f/go.mod h1:NR3MbYisc3/PwhQ00EMzDiPmrwpPxAn5GI05/YaO1SY=
@@ -80,6 +71,8 @@ github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeME
 github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
 github.com/go-ole/go-ole v1.3.0 h1:Dt6ye7+vXGIKZ7Xtk4s6/xVdGDQynvom7xCFEdWr6uE=
 github.com/go-ole/go-ole v1.3.0/go.mod h1:5LS6F96DhAwUc7C+1HLexzMXY1xGRSryjyPPKW6zv78=
+github.com/go-quicktest/qt v1.101.0 h1:O1K29Txy5P2OK0dGo59b7b0LR6wKfIhttaAhHUyn7eI=
+github.com/go-quicktest/qt v1.101.0/go.mod h1:14Bz/f7NwaXPtdYEgzsx46kqSxVwTbzVZsDC26tQJow=
 github.com/go-stack/stack v1.6.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/godbus/dbus v4.1.0+incompatible h1:WqqLRTsQic3apZUK9qC5sGNfXthmPXzUZ7nQPrNITa4=
 github.com/godbus/dbus v4.1.0+incompatible/go.mod h1:/YcGZj5zSblfDWMMoOzV4fas9FZnQYTkDnsGvmh2Grw=
@@ -118,8 +111,6 @@ github.com/google/gopacket v1.1.19 h1:ves8RnFZPGiFnTS0uPQStjwru6uO6h+nlr9j6fL7kF
 github.com/google/gopacket v1.1.19/go.mod h1:iJ8V8n6KS+z2U1A8pUwu8bW5SyEMkXJB8Yo/Vo+TKTo=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
-github.com/google/uuid v1.5.0 h1:1p67kYwdtXjb0gL0BPiP1Av9wiZPo5A8z2cWkTZ+eyU=
-github.com/google/uuid v1.5.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/googleapis/gax-go v2.0.0+incompatible/go.mod h1:SFVmujtThgffbyetf+mdk2eWhX2bMyUtNHzFKcPA9HY=
@@ -135,8 +126,8 @@ github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/go-version v1.6.0 h1:feTTfFNnjP967rlCxM/I9g701jU+RN74YKx2mOkIeek=
-github.com/hashicorp/go-version v1.6.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
+github.com/hashicorp/go-version v1.7.0 h1:5tqGy27NaOTB8yJKUZELlFAS/LTKJkrmONwQKeRZfjY=
+github.com/hashicorp/go-version v1.7.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/hcl v0.0.0-20170914154624-68e816d1c783/go.mod h1:oZtUIOe8dh44I2q6ScRibXws4Ajl+d+nod3AaR9vL5w=
 github.com/inconshreveable/log15 v0.0.0-20170622235902-74a0988b5f80/go.mod h1:cOaXtrgN4ScfRrD9Bre7U1thNq5RtJ8ZoP4iXVGRj6o=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
@@ -159,8 +150,6 @@ github.com/jsimonetti/rtnetlink v0.0.0-20211022192332-93da33804786/go.mod h1:v4h
 github.com/jtolds/gls v4.20.0+incompatible h1:xdiiI2gbIgH/gLH7ADydsJ1uDOEzR8yvV7C0MuV77Wo=
 github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
 github.com/klauspost/cpuid/v2 v2.0.12/go.mod h1:g2LTdtYhdyuGPqyWyv7qRAmj1WBqxuObKfj5c0PQa7c=
-github.com/klauspost/cpuid/v2 v2.2.6 h1:ndNyv040zDGIDh8thGkXYjnFtiN02M1PVVF+JE/48xc=
-github.com/klauspost/cpuid/v2 v2.2.6/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
 github.com/klauspost/cpuid/v2 v2.2.7 h1:ZWSB3igEs+d0qvnxR/ZBzXVmxkgt8DdzP6m9pfuVLDM=
 github.com/klauspost/cpuid/v2 v2.2.7/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
 github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
@@ -199,14 +188,10 @@ github.com/mdlayher/socket v0.0.0-20210307095302-262dc9984e00/go.mod h1:GAFlyu4/
 github.com/mdlayher/socket v0.0.0-20211007213009-516dcbdf0267/go.mod h1:nFZ1EtZYK8Gi/k6QNu7z7CgO20i/4ExeQswwWuPmG/g=
 github.com/mdlayher/socket v0.1.0/go.mod h1:mYV5YIZAfHh4dzDVzI8x8tWLWCliuX8Mon5Awbj+qDs=
 github.com/mdlayher/socket v0.1.1/go.mod h1:mYV5YIZAfHh4dzDVzI8x8tWLWCliuX8Mon5Awbj+qDs=
-github.com/mdlayher/socket v0.5.0 h1:ilICZmJcQz70vrWVes1MFera4jGiWNocSkykwwoy3XI=
-github.com/mdlayher/socket v0.5.0/go.mod h1:WkcBFfvyG8QENs5+hfQPl1X6Jpd2yeLIYgrGFmJiJxI=
 github.com/mdlayher/socket v0.5.1 h1:VZaqt6RkGkt2OE9l3GcC6nZkqD3xKeQLyfleW/uBcos=
 github.com/mdlayher/socket v0.5.1/go.mod h1:TjPLHI1UgwEv5J1B5q0zTZq12A/6H7nKmtTanQE37IQ=
-github.com/miekg/dns v1.1.57 h1:Jzi7ApEIzwEPLHWRcafCN9LZSBbqQpxjt/wpgvg7wcM=
-github.com/miekg/dns v1.1.57/go.mod h1:uqRjCRUuEAA6qsOiJvDd+CFo/vW+y5WR6SNmHE55hZk=
-github.com/miekg/dns v1.1.58 h1:ca2Hdkz+cDg/7eNF6V56jjzuZ4aCAE+DbVkILdQWG/4=
-github.com/miekg/dns v1.1.58/go.mod h1:Ypv+3b/KadlvW9vJfXOTf300O4UqaHFzFCuHz+rPkBY=
+github.com/miekg/dns v1.1.59 h1:C9EXc/UToRwKLhK5wKU/I4QVsBUc8kE6MkHBkeypWZs=
+github.com/miekg/dns v1.1.59/go.mod h1:nZpewl5p6IvctfgrckopVx2OlSEHPRO/U4SYkRklrEk=
 github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
 github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
 github.com/mitchellh/go-server-timing v1.0.1 h1:f00/aIe8T3MrnLhQHu3tSWvnwc5GV/p5eutuu3hF/tE=
@@ -231,30 +216,17 @@ github.com/r3labs/diff/v3 v3.0.1 h1:CBKqf3XmNRHXKmdU7mZP1w7TV0pDyVCis1AUHtA4Xtg=
 github.com/r3labs/diff/v3 v3.0.1/go.mod h1:f1S9bourRbiM66NskseyUdo0fTmEE0qKrikYJX63dgo=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
-github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
-github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
 github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
+github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA=
 github.com/rot256/pblind v0.0.0-20231024115251-cd3f239f28c1 h1:vfAp3Jbca7Vt8axzmkS5M/RtFJmj0CKmrtWAlHtesaA=
 github.com/rot256/pblind v0.0.0-20231024115251-cd3f239f28c1/go.mod h1:2x8fbm9T+uTl919COhEVHKGkve1DnkrEnDbtGptZuW8=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/safing/jess v0.3.3 h1:0U0bWdO0sFCgox+nMOqISFrnJpVmi+VFOW1xdX6q3qw=
 github.com/safing/jess v0.3.3/go.mod h1:t63qHB+4xd1HIv9MKN/qI2rc7ytvx7d6l4hbX7zxer0=
-github.com/safing/portbase v0.18.9 h1:j+ToHKQz0U2+Tx4jMP7QPky/H0R4uY6qUM+lIJlO6ks=
-github.com/safing/portbase v0.18.9/go.mod h1:Qrh3ck+7VZloFmnozCs9Hj8godhJAi55cmiDiC7BwTc=
-github.com/safing/portbase v0.19.0 h1:2T6f/w90IdIsSgUfyXoveqZM7tVwW+IFrtLbPVXtY3k=
-github.com/safing/portbase v0.19.0/go.mod h1:Qrh3ck+7VZloFmnozCs9Hj8godhJAi55cmiDiC7BwTc=
-github.com/safing/portbase v0.19.1 h1:Uk/WyP9HsIJrCn0pE4a7AWIrfUSHyCOObQyRmXsGQ9A=
-github.com/safing/portbase v0.19.1/go.mod h1:Qrh3ck+7VZloFmnozCs9Hj8godhJAi55cmiDiC7BwTc=
-github.com/safing/portbase v0.19.2 h1:qGF5Jv9eEE33d2aIxeBQdnitnBoF44BGVFtboqfE+1A=
-github.com/safing/portbase v0.19.2/go.mod h1:Qrh3ck+7VZloFmnozCs9Hj8godhJAi55cmiDiC7BwTc=
-github.com/safing/portbase v0.19.3 h1:fzb4d2nzhmRq4Lt6sgn9R20iykireAkBNyf9pfGqQjk=
-github.com/safing/portbase v0.19.3/go.mod h1:Qrh3ck+7VZloFmnozCs9Hj8godhJAi55cmiDiC7BwTc=
-github.com/safing/portbase v0.19.4 h1:Oh7oUBp6xn5whhKtvnNKS5rhHqyXJDDxfxwf+gRswhQ=
-github.com/safing/portbase v0.19.4/go.mod h1:Qrh3ck+7VZloFmnozCs9Hj8godhJAi55cmiDiC7BwTc=
+github.com/safing/portbase v0.19.5 h1:3/8odzlvb629tHPwdj/sthSeJcwZHYrqA6YuvNUZzNc=
+github.com/safing/portbase v0.19.5/go.mod h1:Qrh3ck+7VZloFmnozCs9Hj8godhJAi55cmiDiC7BwTc=
 github.com/safing/portmaster-android/go v0.0.0-20230830120134-3226ceac3bec h1:oSJY1seobofPwpMoJRkCgXnTwfiQWNfGMCPDfqgAEfg=
 github.com/safing/portmaster-android/go v0.0.0-20230830120134-3226ceac3bec/go.mod h1:abwyAQrZGemWbSh/aCD9nnkp0SvFFf/mGWkAbOwPnFE=
-github.com/safing/spn v0.7.5 h1:WfkMs2omLrwxBWccGGG9Akx0AvsvJLG+W7rjWQpQhl4=
-github.com/safing/spn v0.7.5/go.mod h1:Hg585WJuib4JI3R7Kndq/10MJPCUl1UmeJJwL3JIwdQ=
 github.com/satori/go.uuid v1.2.0 h1:0uYX9dsZ2yD7q2RtLRtPSdGDWzjeM3TbMJP9utgA0ww=
 github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
 github.com/seehuhn/fortuna v1.0.1 h1:lu9+CHsmR0bZnx5Ay646XvCSRJ8PJTi5UYJwDBX68H0=
@@ -292,8 +264,6 @@ github.com/tannerryan/ring v1.1.2/go.mod h1:DkELJEjbZhJBtFKR9Xziwj3HKZnb/knRgljN
 github.com/tevino/abool v1.2.0 h1:heAkClL8H6w+mK5md9dzsuohKeXHUpY7Vw0ZCKW+huA=
 github.com/tevino/abool v1.2.0/go.mod h1:qc66Pna1RiIsPa7O4Egxxs9OqkuxDX55zznh9K07Tzg=
 github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
-github.com/tidwall/gjson v1.17.0 h1:/Jocvlh98kcTfpN2+JzGQWQcqrPQwDrVEMApx/M5ZwM=
-github.com/tidwall/gjson v1.17.0/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
 github.com/tidwall/gjson v1.17.1 h1:wlYEnwqAHgzmhNUFfw7Xalt2JzQvsMx2Se4PcoFCT/U=
 github.com/tidwall/gjson v1.17.1/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
 github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
@@ -303,10 +273,10 @@ github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=
 github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
 github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY=
 github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28=
-github.com/tklauser/go-sysconf v0.3.13 h1:GBUpcahXSpR2xN01jhkNAbTLRk2Yzgggk8IM08lq3r4=
-github.com/tklauser/go-sysconf v0.3.13/go.mod h1:zwleP4Q4OehZHGn4CYZDipCgg9usW5IJePewFCGVEa0=
-github.com/tklauser/numcpus v0.7.0 h1:yjuerZP127QG9m5Zh/mSO4wqurYil27tHrqwRoRjpr4=
-github.com/tklauser/numcpus v0.7.0/go.mod h1:bb6dMVcj8A42tSE7i32fsIUCbQNllK5iDguyOZRUzAY=
+github.com/tklauser/go-sysconf v0.3.14 h1:g5vzr9iPFFz24v2KZXs/pvpvh8/V9Fw6vQK5ZZb78yU=
+github.com/tklauser/go-sysconf v0.3.14/go.mod h1:1ym4lWMLUOhuBOPGtRcJm7tEGX4SCYNEEEtghGG/8uY=
+github.com/tklauser/numcpus v0.8.0 h1:Mx4Wwe/FjZLeQsK/6kt2EOepwwSl7SmJrK5bV/dXYgY=
+github.com/tklauser/numcpus v0.8.0/go.mod h1:ZJZlAY+dmR4eut8epnzf0u/VwodKmryxR8txiloSqBE=
 github.com/umahmood/haversine v0.0.0-20151105152445-808ab04add26 h1:UFHFmFfixpmfRBcxuu+LA9l8MdURWVdVNUHxO5n1d2w=
 github.com/umahmood/haversine v0.0.0-20151105152445-808ab04add26/go.mod h1:IGhd0qMDsUa9acVjsbsT7bu3ktadtGOHI79+idTew/M=
 github.com/valyala/fastrand v1.1.0 h1:f+5HkLW4rsgzdNoleUOB69hyT9IlD2ZQh9GyDMfb5G8=
@@ -324,45 +294,33 @@ github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.4.0/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
-github.com/yusufpapurcu/wmi v1.2.3 h1:E1ctvB7uKFMOJw3fdOW32DwGE9I7t++CRUEMKvFoFiw=
-github.com/yusufpapurcu/wmi v1.2.3/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
 github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
 github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
-github.com/zalando/go-keyring v0.2.3 h1:v9CUu9phlABObO4LPWycf+zwMG7nlbb3t/B5wa97yms=
-github.com/zalando/go-keyring v0.2.3/go.mod h1:HL4k+OXQfJUWaMnqyuSOc0drfGPX2b51Du6K+MRgZMk=
+github.com/zalando/go-keyring v0.2.4 h1:wi2xxTqdiwMKbM6TWwi+uJCG/Tum2UV0jqaQhCa9/68=
+github.com/zalando/go-keyring v0.2.4/go.mod h1:HL4k+OXQfJUWaMnqyuSOc0drfGPX2b51Du6K+MRgZMk=
 github.com/zeebo/assert v1.1.0 h1:hU1L1vLTHsnO8x8c9KAR5GmM5QscxHg5RNU5z5qbUWY=
 github.com/zeebo/assert v1.1.0/go.mod h1:Pq9JiuJQpG8JLJdtkwrJESF0Foym2/D9XMU5ciN/wJ0=
 github.com/zeebo/blake3 v0.2.3 h1:TFoLXsjeXqRNFxSbk35Dk4YtszE/MQQGK10BH4ptoTg=
 github.com/zeebo/blake3 v0.2.3/go.mod h1:mjJjZpnsyIVtVgTOSpJ9vmRE4wgDeyt2HU3qXvvKCaQ=
 github.com/zeebo/pcg v1.0.1 h1:lyqfGeWiv4ahac6ttHs+I5hwtH/+1mrhlCtVNQM2kHo=
 github.com/zeebo/pcg v1.0.1/go.mod h1:09F0S9iiKrwn9rlI5yjLkmrug154/YRW6KnnXVDM/l4=
-go.etcd.io/bbolt v1.3.8 h1:xs88BrvEv273UsB79e0hcVrlUWmS0a8upikMFhSyAtA=
-go.etcd.io/bbolt v1.3.8/go.mod h1:N9Mkw9X8x5fupy0IKsmuqVtoGDyxsaDlbk4Rd05IAQw=
-go.etcd.io/bbolt v1.3.9 h1:8x7aARPEXiXbHmtUwAIv7eV2fQFHrLLavdiJ3uzJXoI=
-go.etcd.io/bbolt v1.3.9/go.mod h1:zaO32+Ti0PK1ivdPtgMESzuzL2VPoIG1PCQNvOdo/dE=
+go.etcd.io/bbolt v1.3.10 h1:+BqfJTcCzTItrop8mq/lbzL8wSGtj94UO/3U31shqG0=
+go.etcd.io/bbolt v1.3.10/go.mod h1:bK3UQLPJZly7IlNmV7uVHJDxfe5aK9Ll93e/74Y9oEQ=
 golang.org/x/crypto v0.0.0-20190211182817-74369b46fc67/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.18.0 h1:PGVlW0xEltQnzFZ55hkuX5+KLyrMYhHld1YHO4AKcdc=
-golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1mg=
-golang.org/x/crypto v0.21.0 h1:X31++rzVUdKhX5sWmSOFZxx8UW/ldWx55cbf08iNAMA=
-golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs=
-golang.org/x/crypto v0.22.0 h1:g1v0xeRhjcugydODzvb3mEM9SQ0HGp9s/nh3COQ/C30=
-golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M=
-golang.org/x/exp v0.0.0-20240110193028-0dcbfd608b1e h1:723BNChdd0c2Wk6WOE320qGBiPtYx0F0Bbm1kriShfE=
-golang.org/x/exp v0.0.0-20240110193028-0dcbfd608b1e/go.mod h1:iRJReGqOEeBhDZGkGbynYwcHlctCvnjTYIamk7uXpHI=
-golang.org/x/exp v0.0.0-20240409090435-93d18d7e34b8 h1:ESSUROHIBHg7USnszlcdmjBEwdMj9VUvU+OPk4yl2mc=
-golang.org/x/exp v0.0.0-20240409090435-93d18d7e34b8/go.mod h1:/lliqkxwWAhPjf5oSOIJup2XcqJaw8RGS6k3TGEc7GI=
-golang.org/x/image v0.15.0 h1:kOELfmgrmJlw4Cdb7g/QGuB3CvDrXbqEIww/pNtNBm8=
-golang.org/x/image v0.15.0/go.mod h1:HUYqC05R2ZcZ3ejNQsIHQDQiwWM4JBqmm6MKANTp4LE=
+golang.org/x/crypto v0.23.0 h1:dIJU/v2J8Mdglj/8rJ6UUOM3Zc9zLZxVZwwxMooUSAI=
+golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
+golang.org/x/exp v0.0.0-20240525044651-4c93da0ed11d h1:N0hmiNbwsSNwHBAvR3QB5w25pUwH4tK0Y/RltD1j1h4=
+golang.org/x/exp v0.0.0-20240525044651-4c93da0ed11d/go.mod h1:XtvwrStGgqGPLc4cjQfWqZHG1YFdYs6swckp8vpsjnc=
+golang.org/x/image v0.16.0 h1:9kloLAKhUufZhA12l5fwnx2NZW39/we1UhBesW433jw=
+golang.org/x/image v0.16.0/go.mod h1:ugSZItdV4nOxyqp56HmXwH0Ry0nBCpjnZdpDaIHdoPs=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.5.1/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
-golang.org/x/mod v0.14.0 h1:dGoOF9QVLYng8IHTm7BAyWqCqSheQ5pYWGhzW00YJr0=
-golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0 h1:zY54UmvipHiNd+pm+m0x9KhZ9hl1/7QNMyxXbc6ICqA=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
@@ -386,19 +344,13 @@ golang.org/x/net v0.0.0-20211020060615-d418f374d309/go.mod h1:9nx3DQGgdP8bBQD5qx
 golang.org/x/net v0.0.0-20211209124913-491a49abca63/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220107192237-5cfca573fb4d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.20.0 h1:aCL9BSgETF1k+blQaYUBx9hJ9LOGP3gAVemcZlf1Kpo=
-golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
-golang.org/x/net v0.22.0 h1:9sGLhx7iRIHEiX0oAJ3MRZMUCElJgy7Br1nO+AMN3Tc=
-golang.org/x/net v0.22.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
-golang.org/x/net v0.24.0 h1:1PcaxkF854Fu3+lvBIx5SYn9wRlBzzcnHZSiaFFAb0w=
-golang.org/x/net v0.24.0/go.mod h1:2Q7sJY5mzlzWjKtYUEXSlBWCdyaioyXzRB2RtU8KVE8=
+golang.org/x/net v0.25.0 h1:d/OCCoBEUq33pjydKrGQhw7IlUPI2Oylr+8qLx49kac=
+golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/oauth2 v0.0.0-20170912212905-13449ad91cb2/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/sync v0.0.0-20170517211232-f52d1811a629/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.6.0 h1:5BMeUDZ7vkXGfEr1x9B4bRcTH4lpkTkpdh0T/J+qjbQ=
-golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.7.0 h1:YsImfSBoP9QPYL0xyKJPq0gcaJdG3rInoqxTWbfQu9M=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -435,12 +387,8 @@ golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.16.0 h1:xWw16ngr6ZMtmxDyKyIgsE93KNKz5HKmMa3b8ALHidU=
-golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
-golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.19.0 h1:q5f1RH2jigJ1MoAWp2KTp3gm5zAGFUTarQZ5U386+4o=
-golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.20.0 h1:Od9JTbYCk261bKm4M/mw7AklTlFYIa0bIp9BgSm1S8Y=
+golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -448,8 +396,8 @@ golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
-golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.15.0 h1:h1V/4gjBv8v9cjcR6+AR5+/cIYK5N/WAgiv4xlsEtAk=
+golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/time v0.0.0-20170424234030-8be79e1e0910/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
 golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
@@ -459,10 +407,8 @@ golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtn
 golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
 golang.org/x/tools v0.1.7/go.mod h1:LGqMHiF4EqQNHR1JncWGqT5BVaXmza+X+BDGol+dOxo=
-golang.org/x/tools v0.16.1 h1:TLyB3WofjdOEepBHAU20JdNC1Zbg87elYofWYAY5oZA=
-golang.org/x/tools v0.16.1/go.mod h1:kYVVN6I1mBNoB1OX+noeBjbRk4IUEPa7JJ+TJMEooJ0=
-golang.org/x/tools v0.20.0 h1:hz/CVckiOxybQvFw6h7b/q80NTr9IUQb4s1IIzW7KNY=
-golang.org/x/tools v0.20.0/go.mod h1:WvitBU7JJf6A4jOdg4S1tviW9bhUxkgeCui/0JHctQg=
+golang.org/x/tools v0.21.0 h1:qc0xYgIbsSDt9EyWz05J5wfa7LOVW0YTLOXrqdLAWIw=
+golang.org/x/tools v0.21.0/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -482,29 +428,33 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gvisor.dev/gvisor v0.0.0-20240110202538-8053cd8f0bf6 h1:Ass5FAjCCQ5WECPE9NN7ItZnKJ38i6sM8MCMNBGee5I=
-gvisor.dev/gvisor v0.0.0-20240110202538-8053cd8f0bf6/go.mod h1:10sU+Uh5KKNv1+2x2A0Gvzt8FjD3ASIhorV3YsauXhk=
-gvisor.dev/gvisor v0.0.0-20240327015314-08ed01b28587 h1:wH3g/qTCPlVBwkFktYuKNFJGeo7ctLNEjzrMlfPrVgE=
-gvisor.dev/gvisor v0.0.0-20240327015314-08ed01b28587/go.mod h1:NQHVAzMwvZ+Qe3ElSiHmq9RUm1MdNHpUZ52fiEqvn+0=
-gvisor.dev/gvisor v0.0.0-20240409213450-87d8df37c71e h1:jpvBdtqDLzu2MZuruscr008NwJxiDidjFF4ZQq7YZbk=
-gvisor.dev/gvisor v0.0.0-20240409213450-87d8df37c71e/go.mod h1:NQHVAzMwvZ+Qe3ElSiHmq9RUm1MdNHpUZ52fiEqvn+0=
+gvisor.dev/gvisor v0.0.0-20240524212851-a244eff8ad49 h1:E4ibk9lM99Nqj8fVfZQeqwDR5A1nb4GejITW7TewvMU=
+gvisor.dev/gvisor v0.0.0-20240524212851-a244eff8ad49/go.mod h1:sxc3Uvk/vHcd3tj7/DHVBoR5wvWT/MmRq2pj7HRJnwU=
 honnef.co/go/tools v0.2.1/go.mod h1:lPVVZ2BS5TfnjLyizF7o7hv7j9/L+8cZY2hLyjP9cGY=
 honnef.co/go/tools v0.2.2/go.mod h1:lPVVZ2BS5TfnjLyizF7o7hv7j9/L+8cZY2hLyjP9cGY=
-modernc.org/libc v1.40.1 h1:ZhRylEBcj3GyQbPVC8JxIg7SdrT4JOxIDJoUon0NfF8=
-modernc.org/libc v1.40.1/go.mod h1:YAXkAZ8ktnkCKaN9sw/UDeUVkGYJ/YquGO4FTi5nmHE=
-modernc.org/libc v1.49.3 h1:j2MRCRdwJI2ls/sGbeSk0t2bypOG/uvPZUsGQFDulqg=
-modernc.org/libc v1.49.3/go.mod h1:yMZuGkn7pXbKfoT/M35gFJOAEdSKdxL0q64sF7KqCDo=
+modernc.org/cc/v4 v4.21.2 h1:dycHFB/jDc3IyacKipCNSDrjIC0Lm1hyoWOZTRR20Lk=
+modernc.org/cc/v4 v4.21.2/go.mod h1:HM7VJTZbUCR3rV8EYBi9wxnJ0ZBRiGE5OeGXNA0IsLQ=
+modernc.org/ccgo/v4 v4.17.8 h1:yyWBf2ipA0Y9GGz/MmCmi3EFpKgeS7ICrAFes+suEbs=
+modernc.org/ccgo/v4 v4.17.8/go.mod h1:buJnJ6Fn0tyAdP/dqePbrrvLyr6qslFfTbFrCuaYvtA=
+modernc.org/fileutil v1.3.0 h1:gQ5SIzK3H9kdfai/5x41oQiKValumqNTDXMvKo62HvE=
+modernc.org/fileutil v1.3.0/go.mod h1:XatxS8fZi3pS8/hKG2GH/ArUogfxjpEKs3Ku3aK4JyQ=
+modernc.org/gc/v2 v2.4.1 h1:9cNzOqPyMJBvrUipmynX0ZohMhcxPtMccYgGOJdOiBw=
+modernc.org/gc/v2 v2.4.1/go.mod h1:wzN5dK1AzVGoH6XOzc3YZ+ey/jPgYHLuVckd62P0GYU=
+modernc.org/libc v1.50.9 h1:hIWf1uz55lorXQhfoEoezdUHjxzuO6ceshET/yWjSjk=
+modernc.org/libc v1.50.9/go.mod h1:15P6ublJ9FJR8YQCGy8DeQ2Uwur7iW9Hserr/T3OFZE=
 modernc.org/mathutil v1.6.0 h1:fRe9+AmYlaej+64JsEEhoWuAYBkOtQiMEU7n/XgfYi4=
 modernc.org/mathutil v1.6.0/go.mod h1:Ui5Q9q1TR2gFm0AQRqQUaBWFLAhQpCwNcuhBOSedWPo=
-modernc.org/memory v1.7.2 h1:Klh90S215mmH8c9gO98QxQFsY+W451E8AnzjoE2ee1E=
-modernc.org/memory v1.7.2/go.mod h1:NO4NVCQy0N7ln+T9ngWqOQfi7ley4vpwvARR+Hjw95E=
 modernc.org/memory v1.8.0 h1:IqGTL6eFMaDZZhEWwcREgeMXYwmW83LYW8cROZYkg+E=
 modernc.org/memory v1.8.0/go.mod h1:XPZ936zp5OMKGWPqbD3JShgd/ZoQ7899TUuQqxY+peU=
-modernc.org/sqlite v1.28.0 h1:Zx+LyDDmXczNnEQdvPuEfcFVA2ZPyaD7UCZDjef3BHQ=
-modernc.org/sqlite v1.28.0/go.mod h1:Qxpazz0zH8Z1xCFyi5GSL3FzbtZ3fvbjmywNogldEW0=
-modernc.org/sqlite v1.29.6 h1:0lOXGrycJPptfHDuohfYgNqoe4hu+gYuN/pKgY5XjS4=
-modernc.org/sqlite v1.29.6/go.mod h1:S02dvcmm7TnTRvGhv8IGYyLnIt7AS2KPaB1F/71p75U=
-zombiezen.com/go/sqlite v1.0.0 h1:D2EvOZqumJBy+6t+0uNTTXnepUpB/pKG45op/UziI1o=
-zombiezen.com/go/sqlite v1.0.0/go.mod h1:Yx7FJ77tr7Ucwi5solhXAxpflyxk/BHNXArZ/JvDm60=
-zombiezen.com/go/sqlite v1.2.0 h1:jja0Ubpzpl6bjr/bSaPyvafHO+extoDJJXIaqXT7VOU=
-zombiezen.com/go/sqlite v1.2.0/go.mod h1:yRl27//s/9aXU3RWs8uFQwjkTG9gYNGEls6+6SvrclY=
+modernc.org/opt v0.1.3 h1:3XOZf2yznlhC+ibLltsDGzABUGVx8J6pnFMS3E4dcq4=
+modernc.org/opt v0.1.3/go.mod h1:WdSiB5evDcignE70guQKxYUl14mgWtbClRi5wmkkTX0=
+modernc.org/sortutil v1.2.0 h1:jQiD3PfS2REGJNzNCMMaLSp/wdMNieTbKX920Cqdgqc=
+modernc.org/sortutil v1.2.0/go.mod h1:TKU2s7kJMf1AE84OoiGppNHJwvB753OYfNl2WRb++Ss=
+modernc.org/sqlite v1.29.10 h1:3u93dz83myFnMilBGCOLbr+HjklS6+5rJLx4q86RDAg=
+modernc.org/sqlite v1.29.10/go.mod h1:ItX2a1OVGgNsFh6Dv60JQvGfJfTPHPVpV6DF59akYOA=
+modernc.org/strutil v1.2.0 h1:agBi9dp1I+eOnxXeiZawM8F4LawKv4NzGWSaLfyeNZA=
+modernc.org/strutil v1.2.0/go.mod h1:/mdcBmfOibveCTBxUl5B5l6W+TTH1FXPLHZE6bTosX0=
+modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
+modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
+zombiezen.com/go/sqlite v1.3.0 h1:98g1gnCm+CNz6AuQHu0gqyw7gR2WU3O3PJufDOStpUs=
+zombiezen.com/go/sqlite v1.3.0/go.mod h1:yRl27//s/9aXU3RWs8uFQwjkTG9gYNGEls6+6SvrclY=

packaging/linux/portmaster.service

@@ -15,6 +15,7 @@ RestartSec=10
 RestartPreventExitStatus=24
 LockPersonality=yes
 MemoryDenyWriteExecute=yes
+MemoryLow=2G
 NoNewPrivileges=yes
 PrivateTmp=yes
 PIDFile=/var/lib/portmaster/core-lock.pid

service/firewall/api.go

@@ -75,6 +75,11 @@ func apiAuthenticator(r *http.Request, s *http.Server) (token *api.AuthToken, er
 	if err != nil {
 		return nil, fmt.Errorf("failed to get local IP/Port: %w", err)
 	}
+	// Correct 0.0.0.0 to 127.0.0.1 to fix local process-based authentication,
+	// if 0.0.0.0 is used as the API listen address.
+	if localIP.Equal(net.IPv4zero) {
+		localIP = net.IPv4(127, 0, 0, 1)
+	}
 
 	// get remote IP/Port
 	remoteIP, remotePort, err := netutils.ParseIPPort(r.RemoteAddr)
@@ -110,7 +115,6 @@ func apiAuthenticator(r *http.Request, s *http.Server) (token *api.AuthToken, er
 		if !retry {
 			break
 		}
-
 		// wait a little
 		time.Sleep(500 * time.Millisecond)
 	}

service/firewall/interception/interception_windows.go

@@ -5,12 +5,16 @@ import (
 	"fmt"
 	"time"
 
-	"github.com/safing/portmaster/service/firewall/interception/windowskext"
+	"github.com/safing/portbase/log"
+	kext1 "github.com/safing/portmaster/service/firewall/interception/windowskext"
+	kext2 "github.com/safing/portmaster/service/firewall/interception/windowskext2"
 	"github.com/safing/portmaster/service/network"
 	"github.com/safing/portmaster/service/network/packet"
 	"github.com/safing/portmaster/service/updates"
 )
 
+var useOldKext = false
+
 // start starts the interception.
 func startInterception(packets chan packet.Packet) error {
 	kextFile, err := updates.GetPlatformFile("kext/portmaster-kext.sys")
@@ -18,51 +22,142 @@ func startInterception(packets chan packet.Packet) error {
 		return fmt.Errorf("interception: could not get kext sys: %s", err)
 	}
 
-	err = windowskext.Init(kextFile.Path())
+	err = kext2.Init(kextFile.Path())
 	if err != nil {
 		return fmt.Errorf("interception: could not init windows kext: %s", err)
 	}
 
-	err = windowskext.Start()
+	err = kext2.Start()
 	if err != nil {
 		return fmt.Errorf("interception: could not start windows kext: %s", err)
 	}
 
-	// Start packet handler.
-	module.StartServiceWorker("kext packet handler", 0, func(ctx context.Context) error {
-		windowskext.Handler(ctx, packets)
-		return nil
-	})
+	version, err := kext2.GetVersion()
+	if err != nil {
+		return fmt.Errorf("interception: failed to read version: %s", err)
+	}
+	log.Debugf("Kext version: %s", version.String())
 
-	// Start bandwidth stats monitor.
-	module.StartServiceWorker("kext bandwidth stats monitor", 0, func(ctx context.Context) error {
-		return windowskext.BandwidthStatsWorker(ctx, 1*time.Second, BandwidthUpdates)
-	})
+	if version.Major < 2 {
+		useOldKext = true
+
+		// Transfer ownership.
+		kext1.SetKextHandler(kext2.GetKextHandle())
+		kext1.SetKextService(kext2.GetKextServiceHandle(), kextFile.Path())
+
+		// Start packet handler.
+		module.StartServiceWorker("kext packet handler", 0, func(ctx context.Context) error {
+			kext1.Handler(ctx, packets)
+			return nil
+		})
+
+		// Start bandwidth stats monitor.
+		module.StartServiceWorker("kext bandwidth stats monitor", 0, func(ctx context.Context) error {
+			return kext1.BandwidthStatsWorker(ctx, 1*time.Second, BandwidthUpdates)
+		})
+	} else {
+
+		// Start packet handler.
+		module.StartServiceWorker("kext packet handler", 0, func(ctx context.Context) error {
+			kext2.Handler(ctx, packets, BandwidthUpdates)
+			return nil
+		})
+
+		// Start bandwidth stats monitor.
+		module.StartServiceWorker("kext bandwidth request worker", 0, func(ctx context.Context) error {
+			timer := time.NewTicker(1 * time.Second)
+			defer timer.Stop()
+			for {
+				select {
+				case <-timer.C:
+					err := kext2.SendBandwidthStatsRequest()
+					if err != nil {
+						return err
+					}
+				case <-ctx.Done():
+					return nil
+				}
+
+			}
+		})
+
+		// Start kext logging. The worker will periodically send request to the kext to send logs.
+		module.StartServiceWorker("kext log request worker", 0, func(ctx context.Context) error {
+			timer := time.NewTicker(1 * time.Second)
+			defer timer.Stop()
+			for {
+				select {
+				case <-timer.C:
+					err := kext2.SendLogRequest()
+					if err != nil {
+						return err
+					}
+				case <-ctx.Done():
+					return nil
+				}
+
+			}
+		})
+
+		module.StartServiceWorker("kext clean ended connection worker", 0, func(ctx context.Context) error {
+			timer := time.NewTicker(30 * time.Second)
+			defer timer.Stop()
+			for {
+				select {
+				case <-timer.C:
+					err := kext2.SendCleanEndedConnection()
+					if err != nil {
+						return err
+					}
+				case <-ctx.Done():
+					return nil
+				}
+
+			}
+		})
+	}
 
 	return nil
 }
 
 // stop starts the interception.
 func stopInterception() error {
-	return windowskext.Stop()
+	if useOldKext {
+		return kext1.Stop()
+	}
+	return kext2.Stop()
 }
 
 // ResetVerdictOfAllConnections resets all connections so they are forced to go thought the firewall again.
 func ResetVerdictOfAllConnections() error {
-	return windowskext.ClearCache()
+	if useOldKext {
+		return kext1.ClearCache()
+	}
+	return kext2.ClearCache()
 }
 
 // UpdateVerdictOfConnection updates the verdict of the given connection in the kernel extension.
 func UpdateVerdictOfConnection(conn *network.Connection) error {
-	return windowskext.UpdateVerdict(conn)
+	if useOldKext {
+		return kext1.UpdateVerdict(conn)
+	}
+	return kext2.UpdateVerdict(conn)
 }
 
 // GetKextVersion returns the version of the kernel extension.
 func GetKextVersion() (string, error) {
-	version, err := windowskext.GetVersion()
-	if err != nil {
-		return "", err
+	if useOldKext {
+		version, err := kext1.GetVersion()
+		if err != nil {
+			return "", err
+		}
+		return version.String(), nil
+	} else {
+		version, err := kext2.GetVersion()
+		if err != nil {
+			return "", err
+		}
+		return version.String(), nil
 	}
 
-	return version.String(), nil
 }

service/firewall/interception/windowskext/bandwidth_stats.go

@@ -81,7 +81,7 @@ func reportBandwidth(ctx context.Context, bandwidthUpdates chan *packet.Bandwidt
 	return nil
 }
 
-func StartBandwithConsoleLogger() {
+func StartBandwidthConsoleLogger() {
 	go func() {
 		ticker := time.NewTicker(2 * time.Second)
 		defer ticker.Stop()

service/firewall/interception/windowskext/kext.go

@@ -76,6 +76,15 @@ func Start() error {
 	return nil
 }
 
+func SetKextHandler(handle windows.Handle) {
+	kextHandle = handle
+}
+
+func SetKextService(handle windows.Handle, path string) {
+	service = &KextService{handle: handle}
+	driverPath = path
+}
+
 // Stop intercepting.
 func Stop() error {
 	// Prepare kernel for shutdown

service/firewall/interception/windowskext/service.go

@@ -24,6 +24,7 @@ func createKextService(driverName string, driverPath string) (*KextService, erro
 	}
 	defer windows.CloseServiceHandle(manager)
 
+	// Convert the driver name to a UTF16 string
 	driverNameU16, err := syscall.UTF16FromString(driverName)
 	if err != nil {
 		return nil, fmt.Errorf("failed to convert driver name to UTF16 string: %w", err)

service/firewall/interception/windowskext2/doc.go

@@ -0,0 +1,4 @@
+// +build windows
+
+// Package windowskext provides network interception capabilities on windows via the Portmaster Kernel Extension.
+package windowskext

service/firewall/interception/windowskext2/handler.go

@@ -0,0 +1,204 @@
+//go:build windows
+// +build windows
+
+package windowskext
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"time"
+
+	"github.com/safing/portmaster/service/process"
+	"github.com/safing/portmaster/windows_kext/kextinterface"
+
+	"github.com/tevino/abool"
+
+	"github.com/safing/portbase/log"
+	"github.com/safing/portmaster/service/network/packet"
+)
+
+type VersionInfo struct {
+	Major    uint8
+	Minor    uint8
+	Revision uint8
+	Build    uint8
+}
+
+func (v *VersionInfo) String() string {
+	return fmt.Sprintf("%d.%d.%d.%d", v.Major, v.Minor, v.Revision, v.Build)
+}
+
+// Handler transforms received packets to the Packet interface.
+func Handler(ctx context.Context, packets chan packet.Packet, bandwidthUpdate chan *packet.BandwidthUpdate) {
+	for {
+		packetInfo, err := RecvVerdictRequest()
+
+		if errors.Is(err, kextinterface.ErrUnexpectedInfoSize) || errors.Is(err, kextinterface.ErrUnexpectedReadError) {
+			log.Criticalf("unexpected kext info data: %s", err)
+			continue // Depending on the info type this may not affect the functionality. Try to continue reading the next commands.
+		}
+
+		if err != nil {
+			log.Warningf("failed to get packet from windows kext: %s", err)
+			// Probably IO error, nothing else we can do.
+			return
+		}
+
+		switch {
+		case packetInfo.ConnectionV4 != nil:
+			{
+				// log.Tracef("packet: %+v", packetInfo.ConnectionV4)
+				conn := packetInfo.ConnectionV4
+				// New Packet
+				newPacket := &Packet{
+					verdictRequest: conn.ID,
+					payload:        conn.Payload,
+					verdictSet:     abool.NewBool(false),
+				}
+				info := newPacket.Info()
+				info.Inbound = conn.Direction > 0
+				info.InTunnel = false
+				info.Protocol = packet.IPProtocol(conn.Protocol)
+				info.PID = int(conn.ProcessID)
+				info.SeenAt = time.Now()
+
+				// Check PID
+				if info.PID == 0 {
+					// Windows does not have zero PIDs.
+					// Set to UndefinedProcessID.
+					info.PID = process.UndefinedProcessID
+				}
+
+				// Set IP version
+				info.Version = packet.IPv4
+
+				// Set IPs
+				if info.Inbound {
+					// Inbound
+					info.Src = conn.RemoteIP[:]
+					info.Dst = conn.LocalIP[:]
+				} else {
+					// Outbound
+					info.Src = conn.LocalIP[:]
+					info.Dst = conn.RemoteIP[:]
+				}
+
+				// Set Ports
+				if info.Inbound {
+					// Inbound
+					info.SrcPort = conn.RemotePort
+					info.DstPort = conn.LocalPort
+				} else {
+					// Outbound
+					info.SrcPort = conn.LocalPort
+					info.DstPort = conn.RemotePort
+				}
+
+				packets <- newPacket
+			}
+		case packetInfo.ConnectionV6 != nil:
+			{
+				// log.Tracef("packet: %+v", packetInfo.ConnectionV6)
+				conn := packetInfo.ConnectionV6
+				// New Packet
+				newPacket := &Packet{
+					verdictRequest: conn.ID,
+					payload:        conn.Payload,
+					verdictSet:     abool.NewBool(false),
+				}
+				info := newPacket.Info()
+				info.Inbound = conn.Direction > 0
+				info.InTunnel = false
+				info.Protocol = packet.IPProtocol(conn.Protocol)
+				info.PID = int(conn.ProcessID)
+				info.SeenAt = time.Now()
+
+				// Check PID
+				if info.PID == 0 {
+					// Windows does not have zero PIDs.
+					// Set to UndefinedProcessID.
+					info.PID = process.UndefinedProcessID
+				}
+
+				// Set IP version
+				info.Version = packet.IPv6
+
+				// Set IPs
+				if info.Inbound {
+					// Inbound
+					info.Src = conn.RemoteIP[:]
+					info.Dst = conn.LocalIP[:]
+				} else {
+					// Outbound
+					info.Src = conn.LocalIP[:]
+					info.Dst = conn.RemoteIP[:]
+				}
+
+				// Set Ports
+				if info.Inbound {
+					// Inbound
+					info.SrcPort = conn.RemotePort
+					info.DstPort = conn.LocalPort
+				} else {
+					// Outbound
+					info.SrcPort = conn.LocalPort
+					info.DstPort = conn.RemotePort
+				}
+
+				packets <- newPacket
+			}
+		case packetInfo.LogLine != nil:
+			{
+				line := packetInfo.LogLine
+				switch line.Severity {
+				case byte(log.DebugLevel):
+					log.Debugf("kext: %s", line.Line)
+				case byte(log.InfoLevel):
+					log.Infof("kext: %s", line.Line)
+				case byte(log.WarningLevel):
+					log.Warningf("kext: %s", line.Line)
+				case byte(log.ErrorLevel):
+					log.Errorf("kext: %s", line.Line)
+				case byte(log.CriticalLevel):
+					log.Criticalf("kext: %s", line.Line)
+				}
+			}
+		case packetInfo.BandwidthStats != nil:
+			{
+				bandwidthStats := packetInfo.BandwidthStats
+				for _, stat := range bandwidthStats.ValuesV4 {
+					connID := packet.CreateConnectionID(
+						packet.IPProtocol(bandwidthStats.Protocol),
+						net.IP(stat.LocalIP[:]), stat.LocalPort,
+						net.IP(stat.RemoteIP[:]), stat.RemotePort,
+						false,
+					)
+					update := &packet.BandwidthUpdate{
+						ConnID:        connID,
+						BytesReceived: stat.ReceivedBytes,
+						BytesSent:     stat.TransmittedBytes,
+						Method:        packet.Additive,
+					}
+					bandwidthUpdate <- update
+				}
+				for _, stat := range bandwidthStats.ValuesV6 {
+					connID := packet.CreateConnectionID(
+						packet.IPProtocol(bandwidthStats.Protocol),
+						net.IP(stat.LocalIP[:]), stat.LocalPort,
+						net.IP(stat.RemoteIP[:]), stat.RemotePort,
+						false,
+					)
+					update := &packet.BandwidthUpdate{
+						ConnID:        connID,
+						BytesReceived: stat.ReceivedBytes,
+						BytesSent:     stat.TransmittedBytes,
+						Method:        packet.Additive,
+					}
+					bandwidthUpdate <- update
+				}
+			}
+		}
+	}
+}

service/firewall/interception/windowskext2/kext.go

@@ -0,0 +1,203 @@
+//go:build windows
+// +build windows
+
+package windowskext
+
+import (
+	"fmt"
+
+	"github.com/safing/portbase/log"
+	"github.com/safing/portmaster/service/network"
+	"github.com/safing/portmaster/windows_kext/kextinterface"
+	"golang.org/x/sys/windows"
+)
+
+// Package errors
+var (
+	driverPath string
+
+	service  *kextinterface.KextService
+	kextFile *kextinterface.KextFile
+)
+
+const (
+	driverName = "PortmasterKext"
+)
+
+func Init(path string) error {
+	driverPath = path
+	return nil
+}
+
+// Start intercepting.
+func Start() error {
+	// initialize and start driver service
+	var err error
+	service, err = kextinterface.CreateKextService(driverName, driverPath)
+	if err != nil {
+		return fmt.Errorf("failed to create service: %w", err)
+	}
+
+	// Start service and open file
+	err = service.Start(true)
+	if err != nil {
+		log.Errorf("failed to start service: %s", err)
+	}
+
+	kextFile, err = service.OpenFile(1024)
+	if err != nil {
+		return fmt.Errorf("failed to open driver: %w", err)
+	}
+
+	return nil
+}
+
+func GetKextHandle() windows.Handle {
+	return kextFile.GetHandle()
+}
+
+func GetKextServiceHandle() windows.Handle {
+	return service.GetHandle()
+}
+
+// Stop intercepting.
+func Stop() error {
+	// Prepare kernel for shutdown
+	err := shutdownRequest()
+	if err != nil {
+		log.Warningf("winkext: shutdown request failed: %s", err)
+	}
+	// Close the interface to the driver. Driver will continue to run.
+	err = kextFile.Close()
+	if err != nil {
+		log.Warningf("winkext: failed to close kext file: %s", err)
+	}
+
+	// Stop and delete the driver.
+	err = service.Stop(true)
+	if err != nil {
+		log.Warningf("winkext: failed to stop kernel service: %s", err)
+	}
+
+	err = service.Delete()
+	if err != nil {
+		log.Warningf("winkext: failed to delete kernel service: %s", err)
+	}
+	return nil
+}
+
+// Sends a shutdown request.
+func shutdownRequest() error {
+	return kextinterface.SendShutdownCommand(kextFile)
+}
+
+// Send request for logs of the kext.
+func SendLogRequest() error {
+	return kextinterface.SendGetLogsCommand(kextFile)
+}
+
+func SendBandwidthStatsRequest() error {
+	return kextinterface.SendGetBandwidthStatsCommand(kextFile)
+}
+
+func SendPrintMemoryStatsCommand() error {
+	return kextinterface.SendPrintMemoryStatsCommand(kextFile)
+}
+
+func SendCleanEndedConnection() error {
+	return kextinterface.SendCleanEndedConnectionsCommand(kextFile)
+}
+
+// RecvVerdictRequest waits for the next verdict request from the kext. If a timeout is reached, both *VerdictRequest and error will be nil.
+func RecvVerdictRequest() (*kextinterface.Info, error) {
+	return kextinterface.RecvInfo(kextFile)
+}
+
+// SetVerdict sets the verdict for a packet and/or connection.
+func SetVerdict(pkt *Packet, verdict kextinterface.KextVerdict) error {
+	verdictCommand := kextinterface.Verdict{ID: pkt.verdictRequest, Verdict: uint8(verdict)}
+	return kextinterface.SendVerdictCommand(kextFile, verdictCommand)
+}
+
+// Clears the internal connection cache.
+func ClearCache() error {
+	return kextinterface.SendClearCacheCommand(kextFile)
+}
+
+// Updates a specific connection verdict.
+func UpdateVerdict(conn *network.Connection) error {
+	if conn.IPVersion == 4 {
+		update := kextinterface.UpdateV4{
+			Protocol:      conn.Entity.Protocol,
+			LocalAddress:  [4]byte(conn.LocalIP),
+			LocalPort:     conn.LocalPort,
+			RemoteAddress: [4]byte(conn.Entity.IP),
+			RemotePort:    conn.Entity.Port,
+			Verdict:       uint8(getKextVerdictFromConnection(conn)),
+		}
+
+		return kextinterface.SendUpdateV4Command(kextFile, update)
+	} else if conn.IPVersion == 6 {
+		update := kextinterface.UpdateV6{
+			Protocol:      conn.Entity.Protocol,
+			LocalAddress:  [16]byte(conn.LocalIP),
+			LocalPort:     conn.LocalPort,
+			RemoteAddress: [16]byte(conn.Entity.IP),
+			RemotePort:    conn.Entity.Port,
+			Verdict:       uint8(getKextVerdictFromConnection(conn)),
+		}
+
+		return kextinterface.SendUpdateV6Command(kextFile, update)
+	}
+	return nil
+}
+
+func getKextVerdictFromConnection(conn *network.Connection) kextinterface.KextVerdict {
+	switch conn.Verdict {
+	case network.VerdictUndecided:
+		return kextinterface.VerdictUndecided
+	case network.VerdictUndeterminable:
+		return kextinterface.VerdictUndeterminable
+	case network.VerdictAccept:
+		if conn.VerdictPermanent {
+			return kextinterface.VerdictPermanentAccept
+		} else {
+			return kextinterface.VerdictAccept
+		}
+	case network.VerdictBlock:
+		if conn.VerdictPermanent {
+			return kextinterface.VerdictPermanentBlock
+		} else {
+			return kextinterface.VerdictBlock
+		}
+	case network.VerdictDrop:
+		if conn.VerdictPermanent {
+			return kextinterface.VerdictPermanentDrop
+		} else {
+			return kextinterface.VerdictDrop
+		}
+	case network.VerdictRerouteToNameserver:
+		return kextinterface.VerdictRerouteToNameserver
+	case network.VerdictRerouteToTunnel:
+		return kextinterface.VerdictRerouteToTunnel
+	case network.VerdictFailed:
+		return kextinterface.VerdictFailed
+	}
+	return kextinterface.VerdictUndeterminable
+}
+
+// Returns the kext version.
+func GetVersion() (*VersionInfo, error) {
+	data, err := kextinterface.ReadVersion(kextFile)
+	if err != nil {
+		return nil, err
+	}
+
+	version := &VersionInfo{
+		Major:    data[0],
+		Minor:    data[1],
+		Revision: data[2],
+		Build:    data[3],
+	}
+	return version, nil
+}

service/firewall/interception/windowskext2/packet.go

@@ -0,0 +1,132 @@
+//go:build windows
+// +build windows
+
+package windowskext
+
+import (
+	"sync"
+
+	"github.com/tevino/abool"
+
+	"github.com/safing/portbase/log"
+	"github.com/safing/portmaster/service/network/packet"
+	"github.com/safing/portmaster/windows_kext/kextinterface"
+)
+
+// Packet represents an IP packet.
+type Packet struct {
+	packet.Base
+
+	verdictRequest uint64
+	payload        []byte
+	verdictSet     *abool.AtomicBool
+
+	payloadLoaded bool
+	lock          sync.Mutex
+}
+
+// FastTrackedByIntegration returns whether the packet has been fast-track
+// accepted by the OS integration.
+func (pkt *Packet) FastTrackedByIntegration() bool {
+	return false
+}
+
+// InfoOnly returns whether the packet is informational only and does not
+// represent an actual packet.
+func (pkt *Packet) InfoOnly() bool {
+	return false
+}
+
+// ExpectInfo returns whether the next packet is expected to be informational only.
+func (pkt *Packet) ExpectInfo() bool {
+	return false
+}
+
+// GetPayload returns the full raw packet.
+func (pkt *Packet) LoadPacketData() error {
+	pkt.lock.Lock()
+	defer pkt.lock.Unlock()
+
+	if !pkt.payloadLoaded {
+		pkt.payloadLoaded = true
+
+		if len(pkt.payload) > 0 {
+			err := packet.Parse(pkt.payload, &pkt.Base)
+			if err != nil {
+				log.Tracef("payload: %#v", pkt.payload)
+				log.Tracer(pkt.Ctx()).Warningf("windowskext: failed to parse payload: %s", err)
+				return packet.ErrFailedToLoadPayload
+			}
+		}
+	}
+
+	if len(pkt.Raw()) == 0 {
+		return packet.ErrFailedToLoadPayload
+	}
+
+	return nil
+}
+
+// Accept accepts the packet.
+func (pkt *Packet) Accept() error {
+	if pkt.verdictSet.SetToIf(false, true) {
+		return SetVerdict(pkt, kextinterface.VerdictAccept)
+	}
+	return nil
+}
+
+// Block blocks the packet.
+func (pkt *Packet) Block() error {
+	if pkt.verdictSet.SetToIf(false, true) {
+		return SetVerdict(pkt, kextinterface.VerdictBlock)
+	}
+	return nil
+}
+
+// Drop drops the packet.
+func (pkt *Packet) Drop() error {
+	if pkt.verdictSet.SetToIf(false, true) {
+		return SetVerdict(pkt, kextinterface.VerdictDrop)
+	}
+	return nil
+}
+
+// PermanentAccept permanently accepts connection (and the current packet).
+func (pkt *Packet) PermanentAccept() error {
+	if pkt.verdictSet.SetToIf(false, true) {
+		return SetVerdict(pkt, kextinterface.VerdictPermanentAccept)
+	}
+	return nil
+}
+
+// PermanentBlock permanently blocks connection (and the current packet).
+func (pkt *Packet) PermanentBlock() error {
+	if pkt.verdictSet.SetToIf(false, true) {
+		return SetVerdict(pkt, kextinterface.VerdictPermanentBlock)
+	}
+	return nil
+}
+
+// PermanentDrop permanently drops connection (and the current packet).
+func (pkt *Packet) PermanentDrop() error {
+	if pkt.verdictSet.SetToIf(false, true) {
+		return SetVerdict(pkt, kextinterface.VerdictPermanentDrop)
+	}
+	return nil
+}
+
+// RerouteToNameserver permanently reroutes the connection to the local nameserver (and the current packet).
+func (pkt *Packet) RerouteToNameserver() error {
+	if pkt.verdictSet.SetToIf(false, true) {
+		return SetVerdict(pkt, kextinterface.VerdictRerouteToNameserver)
+	}
+	return nil
+}
+
+// RerouteToTunnel permanently reroutes the connection to the local tunnel entrypoint (and the current packet).
+func (pkt *Packet) RerouteToTunnel() error {
+	if pkt.verdictSet.SetToIf(false, true) {
+		return SetVerdict(pkt, kextinterface.VerdictRerouteToTunnel)
+	}
+	return nil
+}

service/firewall/interception/windowskext2/service.go

@@ -0,0 +1,10 @@
+//go:build windows
+// +build windows
+
+package windowskext
+
+import "github.com/safing/portmaster/windows_kext/kextinterface"
+
+func createKextService(driverName string, driverPath string) (*kextinterface.KextService, error) {
+	return kextinterface.CreateKextService(driverName, driverPath)
+}

service/firewall/module.go

@@ -49,7 +49,7 @@ func init() {
 }
 
 func prep() error {
-	network.SetDefaultFirewallHandler(verdictHandler)
+	network.SetDefaultFirewallHandler(defaultFirewallHandler)
 
 	// Reset connections every time configuration changes
 	// this will be triggered on spn enable/disable

service/firewall/packet_handler.go

@@ -22,7 +22,6 @@ import (
 	"github.com/safing/portmaster/service/network"
 	"github.com/safing/portmaster/service/network/netutils"
 	"github.com/safing/portmaster/service/network/packet"
-	"github.com/safing/portmaster/service/network/reference"
 	"github.com/safing/portmaster/service/process"
 	"github.com/safing/portmaster/spn/access"
 )
@@ -227,7 +226,6 @@ func fastTrackedPermit(conn *network.Connection, pkt packet.Packet) (verdict net
 		meta.Src.Equal(meta.Dst) {
 		log.Tracer(pkt.Ctx()).Debugf("filter: fast-track network self-check: %s", pkt)
 		return network.VerdictAccept, true
-
 	}
 
 	switch meta.Protocol { //nolint:exhaustive // Checking for specific values only.
@@ -374,6 +372,8 @@ func fastTrackedPermit(conn *network.Connection, pkt packet.Packet) (verdict net
 }
 
 func fastTrackHandler(conn *network.Connection, pkt packet.Packet) {
+	conn.SaveWhenFinished()
+
 	fastTrackedVerdict, permanent := fastTrackedPermit(conn, pkt)
 	if fastTrackedVerdict != network.VerdictUndecided {
 		// Set verdict on connection.
@@ -402,6 +402,8 @@ func fastTrackHandler(conn *network.Connection, pkt packet.Packet) {
 }
 
 func gatherDataHandler(conn *network.Connection, pkt packet.Packet) {
+	conn.SaveWhenFinished()
+
 	// Get process info
 	_ = conn.GatherConnectionInfo(pkt)
 	// Errors are informational and are logged to the context.
@@ -412,11 +414,20 @@ func gatherDataHandler(conn *network.Connection, pkt packet.Packet) {
 	}
 
 	// Continue to filter handler, when connection data is complete.
-	conn.UpdateFirewallHandler(filterHandler)
-	filterHandler(conn, pkt)
+	switch conn.IPProtocol { //nolint:exhaustive
+	case packet.ICMP, packet.ICMPv6:
+		conn.UpdateFirewallHandler(icmpFilterHandler)
+		icmpFilterHandler(conn, pkt)
+
+	default:
+		conn.UpdateFirewallHandler(filterHandler)
+		filterHandler(conn, pkt)
+	}
 }
 
 func filterHandler(conn *network.Connection, pkt packet.Packet) {
+	conn.SaveWhenFinished()
+
 	// Skip if data is not complete or packet is info-only.
 	if !conn.DataIsComplete() || pkt.InfoOnly() {
 		return
@@ -469,11 +480,12 @@ func filterHandler(conn *network.Connection, pkt packet.Packet) {
 	switch {
 	case conn.Inspecting:
 		log.Tracer(pkt.Ctx()).Trace("filter: start inspecting")
-		conn.SetFirewallHandler(inspectAndVerdictHandler)
+		conn.UpdateFirewallHandler(inspectAndVerdictHandler)
 		inspectAndVerdictHandler(conn, pkt)
+
 	default:
 		conn.StopFirewallHandler()
-		issueVerdict(conn, pkt, 0, true)
+		verdictHandler(conn, pkt)
 	}
 }
 
@@ -529,6 +541,18 @@ func FilterConnection(ctx context.Context, conn *network.Connection, pkt packet.
 	}
 }
 
+// defaultFirewallHandler is used when no other firewall handler is set on a connection.
+func defaultFirewallHandler(conn *network.Connection, pkt packet.Packet) {
+	switch conn.IPProtocol { //nolint:exhaustive
+	case packet.ICMP, packet.ICMPv6:
+		// Always use the ICMP handler for ICMP connections.
+		icmpFilterHandler(conn, pkt)
+
+	default:
+		verdictHandler(conn, pkt)
+	}
+}
+
 func verdictHandler(conn *network.Connection, pkt packet.Packet) {
 	// Ignore info-only packets in this handler.
 	if pkt.InfoOnly() {
@@ -556,6 +580,73 @@ func inspectAndVerdictHandler(conn *network.Connection, pkt packet.Packet) {
 	issueVerdict(conn, pkt, 0, true)
 }
 
+func icmpFilterHandler(conn *network.Connection, pkt packet.Packet) {
+	// Load packet data.
+	err := pkt.LoadPacketData()
+	if err != nil {
+		log.Tracer(pkt.Ctx()).Debugf("filter: failed to load ICMP packet data: %s", err)
+		issueVerdict(conn, pkt, network.VerdictDrop, false)
+		return
+	}
+
+	// Submit to ICMP listener.
+	submitted := netenv.SubmitPacketToICMPListener(pkt)
+	if submitted {
+		issueVerdict(conn, pkt, network.VerdictDrop, false)
+		return
+	}
+
+	// Handle echo request and replies regularly.
+	// Other ICMP packets are considered system business.
+	icmpLayers := pkt.Layers().LayerClass(layers.LayerClassIPControl)
+	switch icmpLayer := icmpLayers.(type) {
+	case *layers.ICMPv4:
+		switch icmpLayer.TypeCode.Type() {
+		case layers.ICMPv4TypeEchoRequest,
+			layers.ICMPv4TypeEchoReply:
+			// Continue
+		default:
+			issueVerdict(conn, pkt, network.VerdictAccept, false)
+			return
+		}
+
+	case *layers.ICMPv6:
+		switch icmpLayer.TypeCode.Type() {
+		case layers.ICMPv6TypeEchoRequest,
+			layers.ICMPv6TypeEchoReply:
+			// Continue
+
+		default:
+			issueVerdict(conn, pkt, network.VerdictAccept, false)
+			return
+		}
+	}
+
+	// Check if we already have a verdict.
+	switch conn.Verdict { //nolint:exhaustive
+	case network.VerdictUndecided, network.VerdictUndeterminable:
+		// Apply privacy filter and check tunneling.
+		FilterConnection(pkt.Ctx(), conn, pkt, true, false)
+
+		// Save and propagate changes.
+		conn.SaveWhenFinished()
+	}
+
+	// Outbound direction has priority.
+	if conn.Inbound && conn.Ended == 0 && pkt.IsOutbound() {
+		// Change direction from inbound to outbound on first outbound ICMP packet.
+		conn.Inbound = false
+
+		// Apply privacy filter and check tunneling.
+		FilterConnection(pkt.Ctx(), conn, pkt, true, false)
+
+		// Save and propagate changes.
+		conn.SaveWhenFinished()
+	}
+
+	issueVerdict(conn, pkt, 0, false)
+}
+
 func issueVerdict(conn *network.Connection, pkt packet.Packet, verdict network.Verdict, allowPermanent bool) {
 	// Check if packed was already fast-tracked by the OS integration.
 	if pkt.FastTrackedByIntegration() {
@@ -563,17 +654,9 @@ func issueVerdict(conn *network.Connection, pkt packet.Packet, verdict network.V
 	}
 
 	// Enable permanent verdict.
-	if allowPermanent && !conn.VerdictPermanent {
-		switch {
-		case !permanentVerdicts():
-			// Permanent verdicts are disabled by configuration.
-		case conn.Entity != nil && reference.IsICMP(conn.Entity.Protocol):
-		case pkt != nil && reference.IsICMP(uint8(pkt.Info().Protocol)):
-			// ICMP is handled differently based on payload, so we cannot use persistent verdicts.
-		default:
-			conn.VerdictPermanent = true
-			conn.SaveWhenFinished()
-		}
+	if allowPermanent && !conn.VerdictPermanent && permanentVerdicts() {
+		conn.VerdictPermanent = true
+		conn.SaveWhenFinished()
 	}
 
 	// do not allow to circumvent decision: e.g. to ACCEPT packets from a DROP-ed connection

service/intel/geoip/country_info.go

@@ -11,6 +11,14 @@ func (l *Location) AddCountryInfo() {
 		return
 	}
 
+	// Check for anycast.
+	if l.IsAnycast {
+		// Reset data for anycast.
+		l.Country.Code = "__"
+		l.Coordinates.Latitude = 0
+		l.Coordinates.Longitude = 0
+	}
+
 	// Get country info.
 	info, ok := countries[l.Country.Code]
 	if !ok {
@@ -83,6 +91,10 @@ func init() {
 }
 
 var countries = map[string]CountryInfo{
+	"__": {
+		Name:   "Anycast",
+		Center: Coordinates{AccuracyRadius: earthCircumferenceInKm},
+	},
 	"MN": {
 		Name:      "Mongolia",
 		Continent: ContinentInfo{Region: "AS-E"},

service/intel/geoip/country_info_test.go

@@ -9,6 +9,11 @@ func TestCountryInfo(t *testing.T) {
 	t.Parallel()
 
 	for key, country := range countries {
+		// Skip special anycast country.
+		if key == "__" {
+			continue
+		}
+
 		if key != country.Code {
 			t.Errorf("%s has a wrong country code of %q", key, country.Code)
 		}

service/netenv/os_android.go

@@ -4,7 +4,7 @@ import (
 	"net"
 	"time"
 
-	"github.com/safing/portmaster/service-android/go/app_interface"
+	"github.com/safing/portmaster-android/go/app_interface"
 )
 
 var (

service/network/clean.go

@@ -11,6 +11,14 @@ import (
 )
 
 const (
+	// EndConnsAfterInactiveFor defines the amount of time after not seen
+	// connections of unsupported protocols are marked as ended.
+	EndConnsAfterInactiveFor = 5 * time.Minute
+
+	// EndICMPConnsAfterInactiveFor defines the amount of time after not seen
+	// ICMP "connections" are marked as ended.
+	EndICMPConnsAfterInactiveFor = 1 * time.Minute
+
 	// DeleteConnsAfterEndedThreshold defines the amount of time after which
 	// ended connections should be removed from the internal connection state.
 	DeleteConnsAfterEndedThreshold = 10 * time.Minute
@@ -48,7 +56,9 @@ func cleanConnections() (activePIDs map[int]struct{}) {
 	_ = module.RunMicroTask("clean connections", 0, func(ctx context.Context) error {
 		now := time.Now().UTC()
 		nowUnix := now.Unix()
-		ignoreNewer := nowUnix - 1
+		ignoreNewer := nowUnix - 2
+		endNotSeenSince := now.Add(-EndConnsAfterInactiveFor).Unix()
+		endICMPNotSeenSince := now.Add(-EndICMPConnsAfterInactiveFor).Unix()
 		deleteOlderThan := now.Add(-DeleteConnsAfterEndedThreshold).Unix()
 		deleteIncompleteOlderThan := now.Add(-DeleteIncompleteConnsAfterStartedThreshold).Unix()
 
@@ -68,22 +78,37 @@ func cleanConnections() (activePIDs map[int]struct{}) {
 					// Remove connection from state.
 					conn.delete()
 				}
+
 			case conn.Ended == 0:
 				// Step 1: check if still active
-				exists := state.Exists(&packet.Info{
-					Inbound:  false, // src == local
-					Version:  conn.IPVersion,
-					Protocol: conn.IPProtocol,
-					Src:      conn.LocalIP,
-					SrcPort:  conn.LocalPort,
-					Dst:      conn.Entity.IP,
-					DstPort:  conn.Entity.Port,
-					PID:      process.UndefinedProcessID,
-					SeenAt:   time.Unix(conn.Started, 0), // State tables will be updated if older than this.
-				}, now)
+				var connActive bool
+				switch conn.IPProtocol { //nolint:exhaustive
+				case packet.TCP, packet.UDP:
+					connActive = state.Exists(&packet.Info{
+						Inbound:  false, // src == local
+						Version:  conn.IPVersion,
+						Protocol: conn.IPProtocol,
+						Src:      conn.LocalIP,
+						SrcPort:  conn.LocalPort,
+						Dst:      conn.Entity.IP,
+						DstPort:  conn.Entity.Port,
+						PID:      process.UndefinedProcessID,
+						SeenAt:   time.Unix(conn.Started, 0), // State tables will be updated if older than this.
+					}, now)
+					// Update last seen value for permanent verdict connections.
+					if connActive && conn.VerdictPermanent {
+						conn.lastSeen.Store(nowUnix)
+					}
+
+				case packet.ICMP, packet.ICMPv6:
+					connActive = conn.lastSeen.Load() > endICMPNotSeenSince
+
+				default:
+					connActive = conn.lastSeen.Load() > endNotSeenSince
+				}
 
 				// Step 2: mark as ended
-				if !exists {
+				if !connActive {
 					conn.Ended = nowUnix
 
 					// Stop the firewall handler, in case one is running.
@@ -97,6 +122,7 @@ func cleanConnections() (activePIDs map[int]struct{}) {
 				if conn.process != nil {
 					activePIDs[conn.process.Pid] = struct{}{}
 				}
+
 			case conn.Ended < deleteOlderThan:
 				// Step 3: delete
 				// DEBUG:

service/network/connection.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"net"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	"github.com/tevino/abool"
@@ -180,6 +181,11 @@ type Connection struct { //nolint:maligned // TODO: fix alignment
 	// BytesSent holds the observed sent bytes of the connection.
 	BytesSent uint64
 
+	// lastSeen holds the timestamp when the connection was last seen.
+	// If permanent verdicts are enabled and bandwidth reporting is not active,
+	// this value will likely not be correct.
+	lastSeen atomic.Int64
+
 	// prompt holds the active prompt for this connection, if there is one.
 	prompt *notifications.Notification
 	// promptLock locks the prompt separately from the connection.
@@ -340,6 +346,7 @@ func NewConnectionFromDNSRequest(ctx context.Context, fqdn string, cnames []stri
 		Ended:          timestamp,
 		dataComplete:   abool.NewBool(true),
 	}
+	dnsConn.lastSeen.Store(timestamp)
 
 	// Inherit internal status of profile.
 	if localProfile := proc.Profile().LocalProfile(); localProfile != nil {
@@ -383,6 +390,7 @@ func NewConnectionFromExternalDNSRequest(ctx context.Context, fqdn string, cname
 		Ended:          timestamp,
 		dataComplete:   abool.NewBool(true),
 	}
+	dnsConn.lastSeen.Store(timestamp)
 
 	// Inherit internal status of profile.
 	if localProfile := remoteHost.Profile().LocalProfile(); localProfile != nil {
@@ -416,8 +424,10 @@ func NewIncompleteConnection(pkt packet.Packet) *Connection {
 		IPProtocol:   info.Protocol,
 		Started:      info.SeenAt.Unix(),
 		PID:          info.PID,
+		Inbound:      info.Inbound,
 		dataComplete: abool.NewBool(false),
 	}
+	conn.lastSeen.Store(conn.Started)
 
 	// Bullshit check Started timestamp.
 	if conn.Started < tooOldTimestamp {
@@ -569,6 +579,7 @@ func (conn *Connection) GatherConnectionInfo(pkt packet.Packet) (err error) {
 		conn.dataComplete.Set()
 	}
 
+	conn.SaveWhenFinished()
 	return nil
 }
 
@@ -859,6 +870,9 @@ func (conn *Connection) StopFirewallHandler() {
 
 // HandlePacket queues packet of Link for handling.
 func (conn *Connection) HandlePacket(pkt packet.Packet) {
+	// Update last seen timestamp.
+	conn.lastSeen.Store(time.Now().Unix())
+
 	conn.pktQueueLock.Lock()
 	defer conn.pktQueueLock.Unlock()
 
@@ -994,17 +1008,19 @@ func packetHandlerHandleConn(ctx context.Context, conn *Connection, pkt packet.P
 	// Record metrics.
 	packetHandlingHistogram.UpdateDuration(pkt.Info().SeenAt)
 
-	// Log result and submit trace.
-	switch {
-	case conn.DataIsComplete():
-		tracer.Infof("filter: connection %s %s: %s", conn, conn.VerdictVerb(), conn.Reason.Msg)
-	case conn.Verdict != VerdictUndecided:
-		tracer.Debugf("filter: connection %s fast-tracked", pkt)
-	default:
-		tracer.Debugf("filter: gathered data on connection %s", conn)
+	// Log result and submit trace, when there are any changes.
+	if conn.saveWhenFinished {
+		switch {
+		case conn.DataIsComplete():
+			tracer.Infof("filter: connection %s %s: %s", conn, conn.VerdictVerb(), conn.Reason.Msg)
+		case conn.Verdict != VerdictUndecided:
+			tracer.Debugf("filter: connection %s fast-tracked", pkt)
+		default:
+			tracer.Debugf("filter: gathered data on connection %s", conn)
+		}
+		// Submit trace logs.
+		tracer.Submit()
 	}
-	// Submit trace logs.
-	tracer.Submit()
 
 	// Push changes, if there are any.
 	if conn.saveWhenFinished {

service/network/state/lookup.go

@@ -30,7 +30,7 @@ var (
 
 const (
 	lookupTries     = 5
-	fastLookupTries = 2
+	fastLookupTries = 2 // 1. current table, 2. get table with max 10ms, could be 0ms, 3. 10ms wait
 )
 
 // Lookup looks for the given connection in the system state tables and returns the PID of the associated process and whether the connection is inbound.

service/process/executable.go

@@ -30,6 +30,10 @@ func (p *Process) GetExecHash(algorithm string) (string, error) {
 		return "", err
 	}
 
+	defer func() {
+		_ = file.Close()
+	}()
+
 	_, err = io.Copy(hasher, file)
 	if err != nil {
 		return "", err

service/process/find.go

@@ -10,6 +10,7 @@ import (
 	"github.com/safing/portbase/log"
 	"github.com/safing/portmaster/service/network/netutils"
 	"github.com/safing/portmaster/service/network/packet"
+	"github.com/safing/portmaster/service/network/reference"
 	"github.com/safing/portmaster/service/network/state"
 	"github.com/safing/portmaster/service/profile"
 )
@@ -77,10 +78,22 @@ func GetPidOfConnection(ctx context.Context, pktInfo *packet.Info) (pid int, con
 
 	// Fallback to special profiles if PID could not be found.
 	if pid == UndefinedProcessID {
-		if connInbound && !netutils.ClassifyIP(pktInfo.Dst).IsLocalhost() {
-			pid = UnsolicitedProcessID
-		} else {
+		switch {
+		case !connInbound:
 			pid = UnidentifiedProcessID
+
+		case netutils.ClassifyIP(pktInfo.Dst).IsLocalhost():
+			// Always treat localhost connections as unidentified/unknown.
+			pid = UnidentifiedProcessID
+
+		case reference.IsICMP(uint8(pktInfo.Protocol)):
+			// Always treat ICMP as unidentified/unknown, as the direction
+			// might change to outgoing by new ICMP echo packets.
+			pid = UnidentifiedProcessID
+
+		default:
+			// All other inbound connections are "unsolicited".
+			pid = UnsolicitedProcessID
 		}
 	}
 

windows_kext/.gitignore

@@ -0,0 +1,400 @@
+## Ignore Visual Studio temporary files, build results, and
+## files generated by popular Visual Studio add-ons.
+##
+## Get latest from https://github.com/github/gitignore/blob/main/VisualStudio.gitignore
+
+# User-specific files
+*.rsuser
+*.suo
+*.user
+*.userosscache
+*.sln.docstates
+
+# User-specific files (MonoDevelop/Xamarin Studio)
+*.userprefs
+
+# Mono auto generated files
+mono_crash.*
+
+# Build results
+[Dd]ebug/
+[Dd]ebugPublic/
+*/**/[Rr]elease/
+*/**/[Rr]eleases/
+bld/
+[Bb]in/
+[Oo]bj/
+[Ll]og/
+[Ll]ogs/
+
+# Visual Studio 2015/2017 cache/options directory
+.vs/
+# Uncomment if you have tasks that create the project's static files in wwwroot
+#wwwroot/
+
+# Visual Studio 2017 auto generated files
+Generated\ Files/
+
+# MSTest test Results
+[Tt]est[Rr]esult*/
+[Bb]uild[Ll]og.*
+
+# NUnit
+*.VisualState.xml
+TestResult.xml
+nunit-*.xml
+
+# Build Results of an ATL Project
+[Dd]ebugPS/
+[Rr]eleasePS/
+dlldata.c
+
+# Benchmark Results
+BenchmarkDotNet.Artifacts/
+
+# .NET Core
+project.lock.json
+project.fragment.lock.json
+artifacts/
+
+# ASP.NET Scaffolding
+ScaffoldingReadMe.txt
+
+# StyleCop
+StyleCopReport.xml
+
+# Files built by Visual Studio
+*_i.c
+*_p.c
+*_h.h
+*.ilk
+*.meta
+*.obj
+*.iobj
+*.pch
+*.pdb
+*.ipdb
+*.pgc
+*.pgd
+*.rsp
+*.sbr
+*.tlb
+*.tli
+*.tlh
+*.tmp
+*.tmp_proj
+*_wpftmp.csproj
+*.log
+*.tlog
+*.vspscc
+*.vssscc
+.builds
+*.pidb
+*.svclog
+*.scc
+*.exe
+
+# Chutzpah Test files
+_Chutzpah*
+
+# Visual C++ cache files
+ipch/
+*.aps
+*.ncb
+*.opendb
+*.opensdf
+*.sdf
+*.cachefile
+*.VC.db
+*.VC.VC.opendb
+
+# Visual Studio profiler
+*.psess
+*.vsp
+*.vspx
+*.sap
+
+# Visual Studio Trace Files
+*.e2e
+
+# TFS 2012 Local Workspace
+$tf/
+
+# Guidance Automation Toolkit
+*.gpState
+
+# ReSharper is a .NET coding add-in
+_ReSharper*/
+*.[Rr]e[Ss]harper
+*.DotSettings.user
+
+# TeamCity is a build add-in
+_TeamCity*
+
+# DotCover is a Code Coverage Tool
+*.dotCover
+
+# AxoCover is a Code Coverage Tool
+.axoCover/*
+!.axoCover/settings.json
+
+# Coverlet is a free, cross platform Code Coverage Tool
+coverage*.json
+coverage*.xml
+coverage*.info
+
+# Visual Studio code coverage results
+*.coverage
+*.coveragexml
+
+# NCrunch
+_NCrunch_*
+.*crunch*.local.xml
+nCrunchTemp_*
+
+# MightyMoose
+*.mm.*
+AutoTest.Net/
+
+# Web workbench (sass)
+.sass-cache/
+
+# Installshield output folder
+[Ee]xpress/
+
+# DocProject is a documentation generator add-in
+DocProject/buildhelp/
+DocProject/Help/*.HxT
+DocProject/Help/*.HxC
+DocProject/Help/*.hhc
+DocProject/Help/*.hhk
+DocProject/Help/*.hhp
+DocProject/Help/Html2
+DocProject/Help/html
+
+# Click-Once directory
+publish/
+
+# Publish Web Output
+*.[Pp]ublish.xml
+*.azurePubxml
+# Note: Comment the next line if you want to checkin your web deploy settings,
+# but database connection strings (with potential passwords) will be unencrypted
+*.pubxml
+*.publishproj
+
+# Microsoft Azure Web App publish settings. Comment the next line if you want to
+# checkin your Azure Web App publish settings, but sensitive information contained
+# in these scripts will be unencrypted
+PublishScripts/
+
+# NuGet Packages
+*.nupkg
+# NuGet Symbol Packages
+*.snupkg
+# The packages folder can be ignored because of Package Restore
+**/[Pp]ackages/*
+# except build/, which is used as an MSBuild target.
+!**/[Pp]ackages/build/
+# Uncomment if necessary however generally it will be regenerated when needed
+#!**/[Pp]ackages/repositories.config
+# NuGet v3's project.json files produces more ignorable files
+*.nuget.props
+*.nuget.targets
+
+# Microsoft Azure Build Output
+csx/
+*.build.csdef
+
+# Microsoft Azure Emulator
+ecf/
+rcf/
+
+# Windows Store app package directories and files
+AppPackages/
+BundleArtifacts/
+Package.StoreAssociation.xml
+_pkginfo.txt
+*.appx
+*.appxbundle
+*.appxupload
+
+# Visual Studio cache files
+# files ending in .cache can be ignored
+*.[Cc]ache
+# but keep track of directories ending in .cache
+!?*.[Cc]ache/
+
+# Others
+ClientBin/
+~$*
+*~
+*.dbmdl
+*.dbproj.schemaview
+*.jfm
+*.pfx
+*.publishsettings
+orleans.codegen.cs
+
+# Including strong name files can present a security risk
+# (https://github.com/github/gitignore/pull/2483#issue-259490424)
+#*.snk
+
+# Since there are multiple workflows, uncomment next line to ignore bower_components
+# (https://github.com/github/gitignore/pull/1529#issuecomment-104372622)
+#bower_components/
+
+# RIA/Silverlight projects
+Generated_Code/
+
+# Backup & report files from converting an old project file
+# to a newer Visual Studio version. Backup files are not needed,
+# because we have git ;-)
+_UpgradeReport_Files/
+Backup*/
+UpgradeLog*.XML
+UpgradeLog*.htm
+ServiceFabricBackup/
+*.rptproj.bak
+
+# SQL Server files
+*.mdf
+*.ldf
+*.ndf
+
+# Business Intelligence projects
+*.rdl.data
+*.bim.layout
+*.bim_*.settings
+*.rptproj.rsuser
+*- [Bb]ackup.rdl
+*- [Bb]ackup ([0-9]).rdl
+*- [Bb]ackup ([0-9][0-9]).rdl
+
+# Microsoft Fakes
+FakesAssemblies/
+
+# GhostDoc plugin setting file
+*.GhostDoc.xml
+
+# Node.js Tools for Visual Studio
+.ntvs_analysis.dat
+node_modules/
+
+# Visual Studio 6 build log
+*.plg
+
+# Visual Studio 6 workspace options file
+*.opt
+
+# Visual Studio 6 auto-generated workspace file (contains which files were open etc.)
+*.vbw
+
+# Visual Studio 6 auto-generated project file (contains which files were open etc.)
+*.vbp
+
+# Visual Studio 6 workspace and project file (working project files containing files to include in project)
+*.dsw
+*.dsp
+
+# Visual Studio 6 technical files
+*.ncb
+*.aps
+
+# Visual Studio LightSwitch build output
+**/*.HTMLClient/GeneratedArtifacts
+**/*.DesktopClient/GeneratedArtifacts
+**/*.DesktopClient/ModelManifest.xml
+**/*.Server/GeneratedArtifacts
+**/*.Server/ModelManifest.xml
+_Pvt_Extensions
+
+# Paket dependency manager
+.paket/paket.exe
+paket-files/
+
+# FAKE - F# Make
+.fake/
+
+# CodeRush personal settings
+.cr/personal
+
+# Python Tools for Visual Studio (PTVS)
+__pycache__/
+*.pyc
+
+# Cake - Uncomment if you are using it
+# tools/**
+# !tools/packages.config
+
+# Tabs Studio
+*.tss
+
+# Telerik's JustMock configuration file
+*.jmconfig
+
+# BizTalk build output
+*.btp.cs
+*.btm.cs
+*.odx.cs
+*.xsd.cs
+
+# OpenCover UI analysis results
+OpenCover/
+
+# Azure Stream Analytics local run output
+ASALocalRun/
+
+# MSBuild Binary and Structured Log
+*.binlog
+
+# NVidia Nsight GPU debugger configuration file
+*.nvuser
+
+# MFractors (Xamarin productivity tool) working folder
+.mfractor/
+
+# Local History for Visual Studio
+.localhistory/
+
+# Visual Studio History (VSHistory) files
+.vshistory/
+
+# BeatPulse healthcheck temp database
+healthchecksdb
+
+# Backup folder for Package Reference Convert tool in Visual Studio 2017
+MigrationBackup/
+
+# Ionide (cross platform F# VS Code tools) working folder
+.ionide/
+
+# Fody - auto-generated XML schema
+FodyWeavers.xsd
+
+# VS Code files for those working on multiple tools
+.vscode/*
+!.vscode/settings.json
+!.vscode/tasks.json
+!.vscode/launch.json
+!.vscode/extensions.json
+*.code-workspace
+
+# Local History for Visual Studio Code
+.history/
+
+# Windows Installer files from build outputs
+*.cab
+*.msi
+*.msix
+*.msm
+*.msp
+
+# JetBrains Rider
+*.sln.iml
+pm_kext/RCa04400
+pm_kext/RCa05788
+pm_kext/RCa06452
+target
+kext.sys
+release/build

windows_kext/Cargo.lock

@@ -0,0 +1,417 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "anyhow"
+version = "1.0.75"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4668cab20f66d8d020e1fbc0ebe47217433c1b6c8f2040faf858554e394ace6"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "getrandom"
+version = "0.2.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be4136b2a15dd319360be1c07d9933517ccf0be8f16bf62a3bee4f0d618df427"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "glob"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2fabcfbdc87f4758337ca535fb41a6d701b65693ce38287d856d1674551ec9b"
+
+[[package]]
+name = "heck"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d621efb26863f0e9924c6ac577e8275e5e6b77455db64ffa6c65c904e9e132c"
+dependencies = [
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "include_dir"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24b56e147e6187d61e9d0f039f10e070d0c0a887e24fe0bb9ca3f29bfde62cab"
+dependencies = [
+ "glob",
+ "include_dir_impl",
+ "proc-macro-hack",
+]
+
+[[package]]
+name = "include_dir_impl"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0a0c890c85da4bab7bce4204c707396bbd3c6c8a681716a51c8814cfc2b682df"
+dependencies = [
+ "anyhow",
+ "proc-macro-hack",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.147"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4668fb0ea861c1df094127ac5f1da3409a82116a4ba74fca2e58ef927159bb3"
+
+[[package]]
+name = "once_cell"
+version = "1.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
+
+[[package]]
+name = "phf"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fabbf1ead8a5bcbc20f5f8b939ee3f5b0f6f281b6ad3468b84656b658b455259"
+dependencies = [
+ "phf_macros",
+ "phf_shared",
+ "proc-macro-hack",
+]
+
+[[package]]
+name = "phf_generator"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d5285893bb5eb82e6aaf5d59ee909a06a16737a8970984dd7746ba9283498d6"
+dependencies = [
+ "phf_shared",
+ "rand",
+]
+
+[[package]]
+name = "phf_macros"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "58fdf3184dd560f160dd73922bea2d5cd6e8f064bf4b13110abd81b03697b4e0"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+ "proc-macro-hack",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6796ad771acdc0123d2a88dc428b5e38ef24456743ddb1744ed628f9815c096"
+dependencies = [
+ "siphasher",
+]
+
+[[package]]
+name = "portmaster-windows-kext"
+version = "0.1.0"
+dependencies = [
+ "serde",
+ "serde-generate",
+ "serde-reflection",
+ "widestring",
+ "winapi",
+ "windows-sys",
+]
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
+
+[[package]]
+name = "proc-macro-hack"
+version = "0.5.20+deprecated"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc375e1527247fe1a97d8b7156678dfe7c1af2fc075c9a4db3690ecd2a148068"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.66"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18fb31db3f9bddb2ea821cde30a9f70117e3f119938b5ee630b7403aa6e2ead9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5267fca4496028628a95160fc423a33e8b2e6af8a5302579e322e4b520293cae"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "rand"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+dependencies = [
+ "libc",
+ "rand_chacha",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.188"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf9e0fcba69a370eed61bcf2b728575f726b50b55cba78064753d708ddc7549e"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde-generate"
+version = "0.25.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8c9331265d81c61212dc75df7b0836544ed8e32dba77a522f113805ff9a948e"
+dependencies = [
+ "heck",
+ "include_dir",
+ "phf",
+ "serde",
+ "serde-reflection",
+ "textwrap",
+]
+
+[[package]]
+name = "serde-reflection"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f05a5f801ac62a51a49d378fdb3884480041b99aced450b28990673e8ff99895"
+dependencies = [
+ "once_cell",
+ "serde",
+ "thiserror",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.188"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4eca7ac642d82aa35b60049a6eccb4be6be75e599bd2e9adb5f875a737654af2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.29",
+]
+
+[[package]]
+name = "siphasher"
+version = "0.3.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38b58827f4464d87d377d175e90bf58eb00fd8716ff0a62f80356b5e61555d0d"
+
+[[package]]
+name = "smawk"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f67ad224767faa3c7d8b6d91985b78e70a1324408abcb1cfcc2be4c06bc06043"
+
+[[package]]
+name = "syn"
+version = "1.0.109"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c324c494eba9d92503e6f1ef2e6df781e78f6a7705a0202d9801b198807d518a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "textwrap"
+version = "0.13.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd05616119e612a8041ef58f2b578906cc2531a6069047ae092cfb86a325d835"
+dependencies = [
+ "smawk",
+ "unicode-width",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97a802ec30afc17eee47b2855fc72e0c4cd62be9b4efe6591edde0ec5bd68d8f"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6bb623b56e39ab7dcd4b1b98bb6c8f8d907ed255b18de254088016b27a8ee19b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.29",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "301abaae475aa91687eb82514b328ab47a211a533026cb25fc3e519b86adfc3c"
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1dd624098567895118886609431a7c3b8f516e41d30e0643f03d94592a147e36"
+
+[[package]]
+name = "unicode-width"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0edd1e5b14653f783770bce4a4dabb4a5108a5370a5f5d8cfe8710c361f6c8b"
+
+[[package]]
+name = "wasi"
+version = "0.11.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+
+[[package]]
+name = "widestring"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "653f141f39ec16bba3c5abe400a0c60da7468261cc2cbf36805022876bc721a8"
+
+[[package]]
+name = "winapi"
+version = "0.3.7"
+source = "git+https://github.com/Trantect/winapi-rs.git?branch=feature/km#981da7663da0dd9f82bcfceacdc949293a612ef0"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "git+https://github.com/Trantect/winapi-rs.git?branch=feature/km#981da7663da0dd9f82bcfceacdc949293a612ef0"
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "git+https://github.com/Trantect/winapi-rs.git?branch=feature/km#981da7663da0dd9f82bcfceacdc949293a612ef0"
+
+[[package]]
+name = "windows-sys"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.48.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1eeca1c172a285ee6c2c84c341ccea837e7c01b12fbb2d0fe3c9e550ce49ec8"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.48.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b10d0c968ba7f6166195e13d593af609ec2e3d24f916f081690695cf5eaffb2f"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.48.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "571d8d4e62f26d4932099a9efe89660e8bd5087775a2ab5cdd8b747b811f1058"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.48.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2229ad223e178db5fbbc8bd8d3835e51e566b8474bfca58d2e6150c48bb723cd"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.48.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "600956e2d840c194eedfc5d18f8242bc2e17c7775b6684488af3a9fff6fe3287"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.48.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea99ff3f8b49fb7a8e0d305e5aec485bd068c2ba691b6e277d29eaeac945868a"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.48.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f1a05a1ece9a7a0d5a7ccf30ba2c33e3a61a30e042ffd247567d1de1d94120d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.48.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d419259aba16b663966e29e6d7c6ecfa0bb8425818bb96f6f1f3c3eb71a6e7b9"

windows_kext/PacketFlow.md

@@ -0,0 +1,90 @@
+# There and back again, a packets tale.
+
+An explanation on the complete path of the packet from entering to the exit of the kernel extension.
+
+## Entry
+
+The packet entry point depends on the packet and the internal windows filter state:   
+
+- First packet of outbound connection -> AleAuthConnect Layer
+- First packet of inbound connection -> InboundIppacket Layer
+
+## ALE layer
+
+Each defined ALE layer has a filter linked to it. This filter has a state.  
+When a decision is made to block or permit a connection it will be saved to the filter state.
+The only way to update the decision in a filter is to clear the whole state and apply the decision for the next packet of each connection.
+
+### First packet
+
+For outgoing connections this logic fallows:
+  - Packet enters in one of the ALE layer
+  - Packet is TCP or UDP
+    1. Save and absorb packet.
+    2. Send an event to Portmaster. 
+    2. Create a cache entry.
+  - If Packet is not TCP/UDP forward to packet layer
+
+For incoming connection this logic fallow:
+  - Packet enter in one of the Packet layer:
+    1. Save packet and absorb.
+    2. Send an event to Portmaster. 
+    2. Create a cache entry if the protocol is TCP or UDP.
+    3. Wait for Portmasters decision.
+
+
+If more packets arrive before Portmaster returns a decision, packet will be absorbed and another event will be sent.
+For Outgoing connection this will happen in ALE layer.
+For Incoming connection this will happen in Packet layer. 
+
+### Pormtaster returns a verdict for the connection
+
+Connection cache will be updated and the packet will be injected.
+The next steps depend of the direction of the packet and the verdict
+
+* Permanent Verdict / Outgoing connection
+  - Allow / Block / Drop directly in the ALE layer. For Block and Drop packet layer will not see the rest of the packet in the connection.
+* Temporary Verdict / Outgoing connection
+  - Always Allow - this connections are solely handled by the packet layer. (This is true only for outgoing connections) 
+
+* Permanent or Temporary Verdict / Incoming connection
+  - Allow / Block / Drop. Handled by the Packet layer
+
+> There is no defined ALE layers for inbound connection. Inbound packets are handed compactly by the packet layer 
+
+Fallowing specifics apply to the ALE layer:  
+1. Connections with flag `reauthorize == false` are special. When the flag is `false` that means that a applications is calling a function `connect()` or `accept()` for a connection. This is a special case because we control the result of the function, telling the application that it's allowed or not allowed to continue with the connection. Since we are making request to Portmaster we need to take longer time. This is done with pending the packet. This allows the kernel extension to pause the event and continue when it has the verdict. See `ale_callouts.rs -> save_packet()` function.
+2. If packet payload is present it is from the transport layer.
+
+
+## Packet layer
+
+The logic for the packet is split in two:
+
+### TCP or UDP protocols
+
+The packet layer will not process packets that miss a cache entry:  
+- Incoming packet: it will forward it to the ALE layer.
+- Outgoing packet: this is treated as invalid state since ALE should be the entry for the packets. If it happens the packet layer will create a request to Portmaster for it.
+
+For packets with a cache entry:
+- Permanent Verdict: apply the verdict.
+- Redirect Verdict: copy the packet, modify and inject. Drop the original packet.
+- Temporary verdict: send request to Portmaster.
+
+After portmaster returns the verdict for the packet. If its allowed it will be modified (if needed) and injected everything else will be dropped.
+The packet layer will permit all injected packets.
+
+### Not TCP or UDP protocols -> ICMP, IGMP ...
+
+Does packets are treated as with temporary verdict. There will be no cache entry for them.
+Every packet will be send to Portmaster for a decision and re-injected if allowed.
+
+## Connection Cache
+
+It holds information for all TCP and UDP connections. Local and destination ip addresses and ports, verdict, protocol, process id
+It also holds last active time and end time.  
+
+Cache entry is removed automatically 1 minute after an end state has been set or after 10 minutes of inactivity.  
+
+End stat is set by Endpoint layers or Resource release layers.

windows_kext/PortmasterKext64.inf

@@ -0,0 +1,67 @@
+;/*++
+;
+;Copyright (c) Safing ICS Technologies GmbH.
+;
+;    This program is free software: you can redistribute it and/or modify
+;    it under the terms of the GNU General Public License as published by
+;    the Free Software Foundation, either version 3 of the License, or
+;    (at your option) any later version.
+;
+;    This program is distributed in the hope that it will be useful,
+;    but WITHOUT ANY WARRANTY; without even the implied warranty of
+;    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;    GNU General Public License for more details.
+;
+;    You should have received a copy of the GNU General Public License
+;    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+;
+;--*/
+
+[Version]
+Signature = "$Windows NT$"
+Class = WFPCALLOUTS
+ClassGuid = {57465043-616C-6C6F-7574-5F636C617373}
+Provider = %Provider%
+CatalogFile = PortmasterKext64.Cat
+DriverVer = 01/01/2019,1.0.11.0
+
+[SourceDisksNames]
+1 = %DiskName%
+
+[SourceDisksFiles]
+PortmasterKext64.sys = 1
+
+[DestinationDirs]
+DefaultDestDir = 12 ; %windir%\system32\drivers
+PortmasterKext.DriverFiles = 12 ; %windir%\system32\drivers
+
+[DefaultInstall]
+OptionDesc = %Description%
+CopyFiles = PortmasterKext.DriverFiles
+
+[DefaultInstall.Services]
+AddService = %ServiceName%,,PortmasterKext.Service
+
+[DefaultUninstall]
+DelFiles = PortmasterKext.DriverFiles
+
+[DefaultUninstall.Services]
+DelService = PortmasterKext,0x200 ; SPSVCINST_STOPSERVICE
+
+[PortmasterKext.DriverFiles]
+PortmasterKext64.sys,,,0x00000040 ; COPYFLG_OVERWRITE_OLDER_ONLY
+
+[PortmasterKext.Service]
+DisplayName = %ServiceName%
+Description = %ServiceDesc%
+ServiceType = 1  ; SERVICE_KERNEL_DRIVER
+StartType = 0    ; SERVICE_BOOT_START
+ErrorControl = 1 ; SERVICE_ERROR_NORMAL
+ServiceBinary = %12%\PortmasterKext64.sys
+
+[Strings]
+Provider = "Safing ICS Technologies GmbH"
+DiskName = "PortmasterKext Installation Disk"
+Description = "PortmasterKext Driver"
+ServiceName = "PortmasterKext"
+ServiceDesc = "PortmasterKext Driver"

windows_kext/README.md

@@ -0,0 +1,71 @@
+# Portmaster Windows kext
+Implementation of Safing's Portmaster Windows kernel extension in Rust.
+
+### Documentation 
+
+- [Driver](driver/README.md) -> entry point.
+- [WDK](wdk/README.md) -> Windows Driver Kit interface.
+- [Packet Path](PacketDoc.md) -> Detiled documentation of what happens to a packet when it enters the kernel extension.
+- [Release](release/README.md) -> Guide how to do a release build
+
+### Building
+
+The Windows Portmaster Kernel Extension is currently only developed and tested for the amd64 (64-bit) architecture.
+
+__Prerequesites:__
+
+- Visual Studio 2022
+    - Install C++ and Windows 11 SDK (22H2) components
+    - Add `link.exe` and `signtool` in the PATH
+- Rust
+    - https://www.rust-lang.org/tools/install
+- Cargo make(optional)
+    - https://github.com/sagiegurari/cargo-make
+
+__Setup Test Signing:__
+
+In order to test the driver on your machine, you will have to test sign it (starting with Windows 10).
+
+
+Create a new certificate for test signing:
+
+    :: Open a *x64 Free Build Environment* console as Administrator.
+
+    :: Run the MakeCert.exe tool to create a test certificate:
+    MakeCert -r -pe -ss PrivateCertStore -n "CN=DriverCertificate" DriverCertificate.cer
+
+    :: Install the test certificate with CertMgr.exe:
+    CertMgr /add DriverCertificate.cer /s /r localMachine root
+
+
+Enable Test Signing on the dev machine:
+
+    :: Before you can load test-signed drivers, you must enable Windows test mode. To do this, run this command:
+    Bcdedit.exe -set TESTSIGNING ON
+    :: Then, restart Windows. For more information, see The TESTSIGNING Boot Configuration Option.
+
+
+__Build driver:__
+
+```
+cd driver
+cargo build
+```
+> Build also works on linux
+
+__Link and sign:__
+On a windows machine copy `driver.lib` form the project target directory (`driver/target/x86_64-pc-windows-msvc/debug/driver.lib`) in the same folder as `link.bat`.
+Run `link.bat`.
+
+`driver.sys` should appear in the folder. Load and use the driver.
+
+### Test
+- Install go
+    - https://go.dev/dl/
+
+```
+cd kext_tester
+go run .
+```
+
+> make sure the hardcoded path in main.go is pointing to the correct `.sys` file

windows_kext/c_helper/c_helper.filters

@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup>
+    <Filter Include="Source Files">
+      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
+      <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
+    </Filter>
+    <Filter Include="Header Files">
+      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
+      <Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions>
+    </Filter>
+    <Filter Include="Resource Files">
+      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
+      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
+    </Filter>
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="helper.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+  </ItemGroup>
+</Project>

windows_kext/c_helper/c_helper.sln

@@ -0,0 +1,51 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio Version 17
+VisualStudioVersion = 17.5.33502.453
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "c_helper", "c_helper.vcxproj", "{39A5E911-A716-4708-8B88-3895183C6372}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|ARM = Debug|ARM
+		Debug|ARM64 = Debug|ARM64
+		Debug|x64 = Debug|x64
+		Debug|x86 = Debug|x86
+		Release|ARM = Release|ARM
+		Release|ARM64 = Release|ARM64
+		Release|x64 = Release|x64
+		Release|x86 = Release|x86
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{39A5E911-A716-4708-8B88-3895183C6372}.Debug|ARM.ActiveCfg = Debug|ARM
+		{39A5E911-A716-4708-8B88-3895183C6372}.Debug|ARM.Build.0 = Debug|ARM
+		{39A5E911-A716-4708-8B88-3895183C6372}.Debug|ARM.Deploy.0 = Debug|ARM
+		{39A5E911-A716-4708-8B88-3895183C6372}.Debug|ARM64.ActiveCfg = Debug|ARM64
+		{39A5E911-A716-4708-8B88-3895183C6372}.Debug|ARM64.Build.0 = Debug|ARM64
+		{39A5E911-A716-4708-8B88-3895183C6372}.Debug|ARM64.Deploy.0 = Debug|ARM64
+		{39A5E911-A716-4708-8B88-3895183C6372}.Debug|x64.ActiveCfg = Debug|x64
+		{39A5E911-A716-4708-8B88-3895183C6372}.Debug|x64.Build.0 = Debug|x64
+		{39A5E911-A716-4708-8B88-3895183C6372}.Debug|x64.Deploy.0 = Debug|x64
+		{39A5E911-A716-4708-8B88-3895183C6372}.Debug|x86.ActiveCfg = Debug|Win32
+		{39A5E911-A716-4708-8B88-3895183C6372}.Debug|x86.Build.0 = Debug|Win32
+		{39A5E911-A716-4708-8B88-3895183C6372}.Debug|x86.Deploy.0 = Debug|Win32
+		{39A5E911-A716-4708-8B88-3895183C6372}.Release|ARM.ActiveCfg = Release|ARM
+		{39A5E911-A716-4708-8B88-3895183C6372}.Release|ARM.Build.0 = Release|ARM
+		{39A5E911-A716-4708-8B88-3895183C6372}.Release|ARM.Deploy.0 = Release|ARM
+		{39A5E911-A716-4708-8B88-3895183C6372}.Release|ARM64.ActiveCfg = Release|ARM64
+		{39A5E911-A716-4708-8B88-3895183C6372}.Release|ARM64.Build.0 = Release|ARM64
+		{39A5E911-A716-4708-8B88-3895183C6372}.Release|ARM64.Deploy.0 = Release|ARM64
+		{39A5E911-A716-4708-8B88-3895183C6372}.Release|x64.ActiveCfg = Release|x64
+		{39A5E911-A716-4708-8B88-3895183C6372}.Release|x64.Build.0 = Release|x64
+		{39A5E911-A716-4708-8B88-3895183C6372}.Release|x64.Deploy.0 = Release|x64
+		{39A5E911-A716-4708-8B88-3895183C6372}.Release|x86.ActiveCfg = Release|Win32
+		{39A5E911-A716-4708-8B88-3895183C6372}.Release|x86.Build.0 = Release|Win32
+		{39A5E911-A716-4708-8B88-3895183C6372}.Release|x86.Deploy.0 = Release|Win32
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+	GlobalSection(ExtensibilityGlobals) = postSolution
+		SolutionGuid = {91E52350-EBB9-4B0F-9C28-61C0BBAEDC6A}
+	EndGlobalSection
+EndGlobal

windows_kext/c_helper/c_helper.vcxproj

@@ -0,0 +1,188 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|ARM">
+      <Configuration>Debug</Configuration>
+      <Platform>ARM</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|ARM">
+      <Configuration>Release</Configuration>
+      <Platform>ARM</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|ARM64">
+      <Configuration>Debug</Configuration>
+      <Platform>ARM64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|ARM64">
+      <Configuration>Release</Configuration>
+      <Platform>ARM64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="helper.c" />
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <ProjectGuid>{39A5E911-A716-4708-8B88-3895183C6372}</ProjectGuid>
+    <TemplateGuid>{0a049372-4c4d-4ea0-a64e-dc6ad88ceca1}</TemplateGuid>
+    <TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
+    <MinimumVisualStudioVersion>12.0</MinimumVisualStudioVersion>
+    <Configuration>Debug</Configuration>
+    <Platform Condition="'$(Platform)' == ''">Win32</Platform>
+    <RootNamespace>c_helper</RootNamespace>
+    <DriverType>KMDF</DriverType>
+    <WindowsTargetPlatformVersion>$(LatestTargetPlatformVersion)</WindowsTargetPlatformVersion>
+    <ProjectName>c_helper</ProjectName>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <TargetVersion>Windows10</TargetVersion>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <DriverTargetPlatform>Universal</DriverTargetPlatform>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <TargetVersion>Windows10</TargetVersion>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <DriverTargetPlatform>Universal</DriverTargetPlatform>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
+    <TargetVersion>Windows10</TargetVersion>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <DriverTargetPlatform>Universal</DriverTargetPlatform>
+    <CharacterSet>Unicode</CharacterSet>
+    <Driver_SpectreMitigation>false</Driver_SpectreMitigation>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
+    <TargetVersion>Windows10</TargetVersion>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <DriverTargetPlatform>Universal</DriverTargetPlatform>
+    <CharacterSet>Unicode</CharacterSet>
+    <Driver_SpectreMitigation>false</Driver_SpectreMitigation>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'" Label="Configuration">
+    <TargetVersion>Windows10</TargetVersion>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'" Label="Configuration">
+    <TargetVersion>Windows10</TargetVersion>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <DriverTargetPlatform>Universal</DriverTargetPlatform>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'" Label="Configuration">
+    <TargetVersion>Windows10</TargetVersion>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <DriverTargetPlatform>Universal</DriverTargetPlatform>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'" Label="Configuration">
+    <TargetVersion>Windows10</TargetVersion>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <DriverTargetPlatform>Universal</DriverTargetPlatform>
+    <CharacterSet>Unicode</CharacterSet>
+    <Driver_SpectreMitigation>false</Driver_SpectreMitigation>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <OutDir>$(SolutionDir)$(Platform)</OutDir>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <OutDir>$(SolutionDir)$(Platform)</OutDir>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'">
+    <OutDir>$(SolutionDir)$(Platform)</OutDir>
+    <IntDir>$(Platform)\$(ConfigurationName)\</IntDir>
+    <TargetName>$(TargetName.Replace(' ',''))</TargetName>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ClCompile>
+      <PreprocessorDefinitions>_DEBUG;WINAPI_FAMILY=WINAPI_FAMILY_DESKTOP_APP;WINAPI_PARTITION_DESKTOP=1;WINAPI_PARTITION_SYSTEM=1;WINAPI_PARTITION_APP=1;WINAPI_PARTITION_PC_APP=1;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+    </ClCompile>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ClCompile>
+      <PreprocessorDefinitions>WINAPI_FAMILY=WINAPI_FAMILY_DESKTOP_APP;WINAPI_PARTITION_DESKTOP=1;WINAPI_PARTITION_SYSTEM=1;WINAPI_PARTITION_APP=1;WINAPI_PARTITION_PC_APP=1;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+    </ClCompile>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <ClCompile>
+      <PreprocessorDefinitions>_DEBUG;WINAPI_FAMILY=WINAPI_FAMILY_DESKTOP_APP;WINAPI_PARTITION_DESKTOP=1;WINAPI_PARTITION_SYSTEM=1;WINAPI_PARTITION_APP=1;WINAPI_PARTITION_PC_APP=1;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <BufferSecurityCheck>false</BufferSecurityCheck>
+    </ClCompile>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <ClCompile>
+      <PreprocessorDefinitions>WINAPI_FAMILY=WINAPI_FAMILY_DESKTOP_APP;WINAPI_PARTITION_DESKTOP=1;WINAPI_PARTITION_SYSTEM=1;WINAPI_PARTITION_APP=1;WINAPI_PARTITION_PC_APP=1;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <BufferSecurityCheck>false</BufferSecurityCheck>
+    </ClCompile>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'">
+    <ClCompile>
+      <PreprocessorDefinitions>_DEBUG;WINAPI_FAMILY=WINAPI_FAMILY_DESKTOP_APP;WINAPI_PARTITION_DESKTOP=1;WINAPI_PARTITION_SYSTEM=1;WINAPI_PARTITION_APP=1;WINAPI_PARTITION_PC_APP=1;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+    </ClCompile>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'">
+    <ClCompile>
+      <PreprocessorDefinitions>WINAPI_FAMILY=WINAPI_FAMILY_DESKTOP_APP;WINAPI_PARTITION_DESKTOP=1;WINAPI_PARTITION_SYSTEM=1;WINAPI_PARTITION_APP=1;WINAPI_PARTITION_PC_APP=1;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+    </ClCompile>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'">
+    <ClCompile>
+      <PreprocessorDefinitions>_DEBUG;WINAPI_FAMILY=WINAPI_FAMILY_DESKTOP_APP;WINAPI_PARTITION_DESKTOP=1;WINAPI_PARTITION_SYSTEM=1;WINAPI_PARTITION_APP=1;WINAPI_PARTITION_PC_APP=1;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+    </ClCompile>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'">
+    <ClCompile>
+      <PreprocessorDefinitions>WINAPI_FAMILY=WINAPI_FAMILY_DESKTOP_APP;WINAPI_PARTITION_DESKTOP=1;WINAPI_PARTITION_SYSTEM=1;WINAPI_PARTITION_APP=1;WINAPI_PARTITION_PC_APP=1;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <LanguageStandard>Default</LanguageStandard>
+      <LanguageStandard_C>Default</LanguageStandard_C>
+    </ClCompile>
+  </ItemDefinitionGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>

windows_kext/c_helper/helper.c

@@ -0,0 +1,89 @@
+
+/*
+ *  Name:        helper.c
+ */
+
+#include <stdlib.h>
+#include <wchar.h>
+
+#define NDIS640 1                // Windows 8 and Windows Server 2012
+
+#include "Ntifs.h"
+#include <ntddk.h>              // Windows Driver Development Kit
+#include <wdf.h>                // Windows Driver Foundation
+
+#pragma warning(push)
+#pragma warning(disable: 4201)  // Disable "Nameless struct/union" compiler warning for fwpsk.h only!
+#include <fwpsk.h>              // Functions and enumerated types used to implement callouts in kernel mode
+#pragma warning(pop)            // Re-enable "Nameless struct/union" compiler warning
+
+#include <fwpmk.h>              // Functions used for managing IKE and AuthIP main mode (MM) policy and security associations
+#include <fwpvi.h>              // Mappings of OS specific function versions (i.e. fn's that end in 0 or 1)
+#include <guiddef.h>            // Used to define GUID's
+#include <initguid.h>           // Used to define GUID's
+#include "devguid.h"
+#include <stdarg.h>
+#include <stdbool.h>
+#include <ntstrsafe.h>
+
+EVT_WDF_DRIVER_UNLOAD emptyEventUnload;
+
+NTSTATUS pm_InitDriverObject(DRIVER_OBJECT * driverObject, UNICODE_STRING * registryPath, WDFDRIVER * driver, WDFDEVICE * device, wchar_t *win_device_name, wchar_t *dos_device_name, WDF_OBJECT_ATTRIBUTES * objectAttributes, void (*wdfEventUnload)(WDFDRIVER)) {
+	UNICODE_STRING deviceName = { 0 };
+	RtlInitUnicodeString(&deviceName, win_device_name);
+
+	UNICODE_STRING deviceSymlink = { 0 };
+	RtlInitUnicodeString(&deviceSymlink, dos_device_name);
+
+	// Create a WDFDRIVER for this driver
+	WDF_DRIVER_CONFIG config = { 0 };
+	WDF_DRIVER_CONFIG_INIT(&config, WDF_NO_EVENT_CALLBACK);
+	config.DriverInitFlags = WdfDriverInitNonPnpDriver;
+	config.EvtDriverUnload = wdfEventUnload; // <-- Necessary for this driver to unload correctly
+	NTSTATUS status = WdfDriverCreate(driverObject, registryPath, WDF_NO_OBJECT_ATTRIBUTES, &config, driver);
+	if (!NT_SUCCESS(status)) {
+      return status;
+	}
+
+	// Create a WDFDEVICE for this driver
+	PWDFDEVICE_INIT deviceInit = WdfControlDeviceInitAllocate(*driver, &SDDL_DEVOBJ_SYS_ALL_ADM_ALL);  // only admins and kernel can access device
+	if (!deviceInit) {
+	    return STATUS_INSUFFICIENT_RESOURCES;
+	}
+
+	// Configure the WDFDEVICE_INIT with a name to allow for access from user mode
+	WdfDeviceInitSetDeviceType(deviceInit, FILE_DEVICE_NETWORK);
+	WdfDeviceInitSetCharacteristics(deviceInit, FILE_DEVICE_SECURE_OPEN, false);
+	(void) WdfDeviceInitAssignName(deviceInit, &deviceName);
+	(void) WdfPdoInitAssignRawDevice(deviceInit, &GUID_DEVCLASS_NET);
+	WdfDeviceInitSetDeviceClass(deviceInit, &GUID_DEVCLASS_NET);
+
+	status = WdfDeviceCreate(&deviceInit, objectAttributes, device);
+	if (!NT_SUCCESS(status)) {
+	  WdfDeviceInitFree(deviceInit);
+		return status;
+	}
+	status = WdfDeviceCreateSymbolicLink(*device, &deviceSymlink);
+	if (!NT_SUCCESS(status)) {
+		return status;
+	}
+
+	// The system will not send I/O requests or Windows Management Instrumentation (WMI) requests to a control device object unless the driver has called WdfControlFinishInitializing.
+	WdfControlFinishInitializing(*device);
+
+	return STATUS_SUCCESS;
+}
+
+void* pm_WdfObjectGetTypedContextWorker(WDFOBJECT wdfObject, PCWDF_OBJECT_CONTEXT_TYPE_INFO typeInfo) {
+    return WdfObjectGetTypedContextWorker(wdfObject, typeInfo->UniqueType);
+}
+
+DEVICE_OBJECT* pm_GetDeviceObject(WDFDEVICE device) {
+    return WdfDeviceWdmGetDeviceObject(device);
+}
+
+UINT64 pm_QuerySystemTime() {
+	UINT64 timestamp = 0;
+	KeQuerySystemTime(&timestamp);
+	return timestamp;
+}

windows_kext/driver/.cargo/config.toml

@@ -0,0 +1,3 @@
+[build]
+target = "x86_64-pc-windows-msvc"
+rustflags = ["-C", "panic=abort"]

windows_kext/driver/Cargo.lock

@@ -0,0 +1,421 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "ahash"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91429305e9f0a25f6205c5b8e0d2db09e0708a7a6df0f42212bb56c32c8ac97a"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "version_check",
+ "zerocopy",
+]
+
+[[package]]
+name = "atomic-polyfill"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8cf2bce30dfe09ef0bfaef228b9d414faaf7e563035494d7fe092dba54b300f4"
+dependencies = [
+ "critical-section",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "critical-section"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7059fff8937831a9ae6f0fe4d658ffabf58f2ca96aa9dec1c889f936f705f216"
+
+[[package]]
+name = "driver"
+version = "0.0.0"
+dependencies = [
+ "hashbrown",
+ "num",
+ "num-derive",
+ "num-traits",
+ "protocol",
+ "smoltcp",
+ "wdk",
+ "windows-sys",
+]
+
+[[package]]
+name = "hash32"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b0c35f58762feb77d74ebe43bdbc3210f09be9fe6742234d573bacc26ed92b67"
+dependencies = [
+ "byteorder",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.14.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "290f1a1d9242c78d09ce40a5e87e7554ee637af1351968159f4952f028f75604"
+dependencies = [
+ "ahash",
+]
+
+[[package]]
+name = "heapless"
+version = "0.7.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdc6457c0eb62c71aac4bc17216026d8410337c4126773b9c5daba343f17964f"
+dependencies = [
+ "atomic-polyfill",
+ "hash32",
+ "rustc_version",
+ "spin",
+ "stable_deref_trait",
+]
+
+[[package]]
+name = "lock_api"
+version = "0.4.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c168f8615b12bc01f9c17e2eb0cc07dcae1940121185446edc3744920e8ef45"
+dependencies = [
+ "autocfg",
+ "scopeguard",
+]
+
+[[package]]
+name = "managed"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ca88d725a0a943b096803bd34e73a4437208b6077654cc4ecb2947a5f91618d"
+
+[[package]]
+name = "ntstatus"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96ea8ea6a9a8cbe8fefe99b632bd45ec4b41b0bf234e4d740c516372922fb180"
+dependencies = [
+ "num_enum",
+]
+
+[[package]]
+name = "num"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b05180d69e3da0e530ba2a1dae5110317e49e3b7f3d41be227dc5f92e49ee7af"
+dependencies = [
+ "num-complex",
+ "num-integer",
+ "num-iter",
+ "num-rational",
+ "num-traits",
+]
+
+[[package]]
+name = "num-complex"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ba157ca0885411de85d6ca030ba7e2a83a28636056c7c699b07c8b6f7383214"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-derive"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfb77679af88f8b125209d354a202862602672222e7f2313fdd6dc349bad4712"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "num-integer"
+version = "0.1.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "225d3389fb3509a24c93f5c29eb6bde2586b98d9f016636dff58d7c6f7569cd9"
+dependencies = [
+ "autocfg",
+ "num-traits",
+]
+
+[[package]]
+name = "num-iter"
+version = "0.1.43"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d03e6c028c5dc5cac6e2dec0efda81fc887605bb3d884578bb6d6bf7514e252"
+dependencies = [
+ "autocfg",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-rational"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0638a1c9d0a3c0914158145bc76cff373a75a627e6ecbfb71cbe6f453a5a19b0"
+dependencies = [
+ "autocfg",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39e3200413f237f41ab11ad6d161bc7239c84dcb631773ccd7de3dfe4b5c267c"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "num_enum"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02339744ee7253741199f897151b38e72257d13802d4ee837285cc2990a90845"
+dependencies = [
+ "num_enum_derive",
+]
+
+[[package]]
+name = "num_enum_derive"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "681030a937600a36906c185595136d26abfebb4aa9c65701cefcaf8578bb982b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.78"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2422ad645d89c99f8f3e6b88a9fdeca7fabeac836b1002371c4367c8f984aae"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "protocol"
+version = "0.0.0"
+dependencies = [
+ "num",
+ "num-derive",
+ "num-traits",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291ec9ab5efd934aaf503a6466c5d5251535d108ee747472c3977cc5acc868ef"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "rustc_version"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa0f585226d2e68097d4f95d113b15b83a82e819ab25717ec0590d9584ef366"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "semver"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b97ed7a9823b74f99c7742f5336af7be5ecd3eeafcb1507d1fa93347b1d589b0"
+
+[[package]]
+name = "smoltcp"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d2e3a36ac8fea7b94e666dfa3871063d6e0a5c9d5d4fec9a1a6b7b6760f0229"
+dependencies = [
+ "bitflags",
+ "byteorder",
+ "cfg-if",
+ "heapless",
+ "managed",
+]
+
+[[package]]
+name = "spin"
+version = "0.9.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
+dependencies = [
+ "lock_api",
+]
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8f112729512f8e442d81f95a8a7ddf2b7c6b8a1a6f509a95864142b30cab2d3"
+
+[[package]]
+name = "syn"
+version = "2.0.48"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f3531638e407dfc0814761abb7c00a5b54992b849452a0646b7f65c9f770f3f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
+
+[[package]]
+name = "version_check"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
+
+[[package]]
+name = "wdk"
+version = "0.0.0"
+dependencies = [
+ "ntstatus",
+ "widestring",
+ "windows-sys",
+]
+
+[[package]]
+name = "widestring"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "653f141f39ec16bba3c5abe400a0c60da7468261cc2cbf36805022876bc721a8"
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "git+https://github.com/microsoft/windows-rs?rev=dffa8b03dc4987c278d82e88015ffe96aa8ac317#dffa8b03dc4987c278d82e88015ffe96aa8ac317"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.5"
+source = "git+https://github.com/microsoft/windows-rs?rev=dffa8b03dc4987c278d82e88015ffe96aa8ac317#dffa8b03dc4987c278d82e88015ffe96aa8ac317"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.5"
+source = "git+https://github.com/microsoft/windows-rs?rev=dffa8b03dc4987c278d82e88015ffe96aa8ac317#dffa8b03dc4987c278d82e88015ffe96aa8ac317"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.5"
+source = "git+https://github.com/microsoft/windows-rs?rev=dffa8b03dc4987c278d82e88015ffe96aa8ac317#dffa8b03dc4987c278d82e88015ffe96aa8ac317"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.5"
+source = "git+https://github.com/microsoft/windows-rs?rev=dffa8b03dc4987c278d82e88015ffe96aa8ac317#dffa8b03dc4987c278d82e88015ffe96aa8ac317"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.5"
+source = "git+https://github.com/microsoft/windows-rs?rev=dffa8b03dc4987c278d82e88015ffe96aa8ac317#dffa8b03dc4987c278d82e88015ffe96aa8ac317"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.5"
+source = "git+https://github.com/microsoft/windows-rs?rev=dffa8b03dc4987c278d82e88015ffe96aa8ac317#dffa8b03dc4987c278d82e88015ffe96aa8ac317"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.5"
+source = "git+https://github.com/microsoft/windows-rs?rev=dffa8b03dc4987c278d82e88015ffe96aa8ac317#dffa8b03dc4987c278d82e88015ffe96aa8ac317"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.5"
+source = "git+https://github.com/microsoft/windows-rs?rev=dffa8b03dc4987c278d82e88015ffe96aa8ac317#dffa8b03dc4987c278d82e88015ffe96aa8ac317"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.5"
+source = "git+https://github.com/microsoft/windows-rs?rev=dffa8b03dc4987c278d82e88015ffe96aa8ac317#dffa8b03dc4987c278d82e88015ffe96aa8ac317"
+
+[[package]]
+name = "zerocopy"
+version = "0.7.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d6f15f7ade05d2a4935e34a457b936c23dc70a05cc1d97133dc99e7a3fe0f0e"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.7.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dbbad221e3f78500350ecbd7dfa4e63ef945c05f4c61cb7f4d3f84cd0bba649b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]

windows_kext/driver/Cargo.toml

@@ -0,0 +1,26 @@
+[package]
+name = "driver"
+version = "0.0.0"
+edition = "2021"
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[lib]
+name = "driver"
+path = "src/lib.rs"
+crate-type = ["staticlib"]
+
+[dependencies]
+wdk = { path = "../wdk" }
+protocol = { path = "../protocol" }
+num = { version = "0.4", default-features = false }
+num-derive = { version = "0.4", default-features = false }
+num-traits = { version = "0.2", default-features = false }
+smoltcp = { version = "0.10", default-features = false, features = ["proto-ipv4", "proto-ipv6"] }
+hashbrown = { version = "0.14.3", default-features = false, features = ["ahash"]}
+
+# WARNING: Do not update. The version was choosen for a reason. See wdk/README.md for more detiels.
+[dependencies.windows-sys]
+git = "https://github.com/microsoft/windows-rs"
+rev = "dffa8b03dc4987c278d82e88015ffe96aa8ac317"
+features = ["Wdk_Foundation", "Wdk_Storage_FileSystem", "Wdk_System_SystemServices", "Win32_Foundation", "Win32_Security", "Win32_System_IO", "Win32_System_Kernel", "Win32_System_Power", "Win32_System_WindowsProgramming", "Win32_NetworkManagement_IpHelper", "Win32_Networking_WinSock", "Win32_NetworkManagement_WindowsFilteringPlatform"]

windows_kext/driver/Makefile.toml

@@ -0,0 +1,18 @@
+[env.development]
+TARGET_PATH = "target/x86_64-pc-windows-msvc/debug"
+
+[env.production]
+TARGET_PATH = "target/x86_64-pc-windows-msvc/release"
+BUILD_FLAGS = "--release"
+
+[tasks.build-driver]
+script = [
+    "cargo build $BUILD_FLAGS",
+]
+
+[tasks.upload]
+dependencies = ["build-driver"]
+script = [
+    "scp $TARGET_PATH/driver.lib windows:'C:/Dev/'",
+]
+

windows_kext/driver/README.md

@@ -0,0 +1,70 @@
+# Driver
+
+This is the entry point of the Kernel extension.
+
+## Quick overview
+
+`entry.rs`:
+This file contains the entry point and calling all the needed initialization code. 
+- Setting up the driver object
+- Allocating global state
+
+`fn driver_entry()` -> entry pointer of the driver.
+
+`device.rs`:  
+Holds the global state of the driver.  
+Initialization: Setting up global state, Filter engine and callouts.  
+
+Portmaster communication:
+The communication happens concurrently with the File read/write API.
+That means when Pormtaster sends a command the kernel extension will start to process it and queue the result in the `IOQueue`.
+
+`fn read()` -> called on read request from Portmaster  
+- `IOQueue` holds all the events queued for Portmaster.
+
+Blocks until there is a element that can be poped or shutdown request is sent from Portmaster.
+If there is more then one event in the queue it will write as much as it can in the supplied buffer.
+
+`fn write()` -> called on write request from Portmaster.  
+Used when Portmaster wants to send a command to kernel extension.
+Verdict Response, GetLogs ... (see `protocol` for list of all the commands)
+
+
+## Callouts
+
+`callouts.rs` -> defines the list of all used callouts in the kernel extension. 
+
+ALE (Application Layer Enforcement)
+https://learn.microsoft.com/en-us/windows/win32/fwp/application-layer-enforcement--ale-
+
+### ALE Auth
+
+Connection level filtering. It will make a decision based on the first packet of a connection. Works together with the packet layer to provide firewall functionality.
+- **AleLayerOutboundV4**  
+- **AleLayerInboundV4**  
+- **AleLayerOutboundV6**  
+- **AleLayerInboundV6**  
+
+
+### ALE endpoint / resource assignment and release
+
+Used to listen for event when connection has ended. Does no filtering.
+- **AleEndpointClosureV4, AleEndpointClosureV6** - Triggered when connection to an endpoint has ended. Usually only TCP is triggered.  The triggered connection will be marked for deletion.
+
+- **AleResourceAssignmentV4, AleResourceAssignmentV6** -> only for logging (not used)
+- AleResourceReleaseV4, AleResourceReleaseV6 -> Triggered when port is release from an application. The triggered connection/s will be marked for deletion.
+
+### Stream layer  
+
+This layer works on the application OSI layer. Meaning that only the payload of the TCP/UDP connection will be available.
+It is used for bandwidth monitoring. This functionality is completely separate from the rest of the system so it can be disabled or enabled without affect anything else. 
+
+- **StreamLayerV4, StreamLayerV6** -> For TCP connections 
+- **DatagramDataLayerV4, DatagramDataLayerV6** -> For UDP connections
+
+
+### Packet layer
+
+This layer handled each packet on the network OSI layer. Works together with ALE Auth layer to provide firewall functionality.
+- **IPPacketOutboundV4, IPPacketOutboundV6** -> Triggered on every outbound packet.
+- **IPPacketInboundV4, IPPacketInboundV6** -> Triggered on every inbound packet.

windows_kext/driver/rust-toolchain

@@ -0,0 +1 @@
+stable

windows_kext/driver/src/ale_callouts.rs

@@ -0,0 +1,508 @@
+use crate::connection::{Connection, ConnectionV4, ConnectionV6, Direction, Verdict};
+use crate::connection_map::Key;
+use crate::device::{Device, Packet};
+
+use crate::info;
+use smoltcp::wire::{
+    IpAddress, IpProtocol, Ipv4Address, Ipv6Address, IPV4_HEADER_LEN, IPV6_HEADER_LEN,
+};
+use wdk::filter_engine::callout_data::CalloutData;
+use wdk::filter_engine::layer::{self, FieldsAleAuthConnectV4, FieldsAleAuthConnectV6, ValueType};
+use wdk::filter_engine::net_buffer::NetBufferList;
+use wdk::filter_engine::packet::{Injector, TransportPacketList};
+
+// ALE Layers
+
+#[derive(Debug)]
+#[allow(dead_code)]
+struct AleLayerData {
+    is_ipv6: bool,
+    reauthorize: bool,
+    process_id: u64,
+    protocol: IpProtocol,
+    direction: Direction,
+    local_ip: IpAddress,
+    local_port: u16,
+    remote_ip: IpAddress,
+    remote_port: u16,
+    interface_index: u32,
+    sub_interface_index: u32,
+}
+
+impl AleLayerData {
+    fn as_key(&self) -> Key {
+        let mut local_port = 0;
+        let mut remote_port = 0;
+        match self.protocol {
+            IpProtocol::Tcp | IpProtocol::Udp => {
+                local_port = self.local_port;
+                remote_port = self.remote_port;
+            }
+            _ => {}
+        }
+
+        Key {
+            protocol: self.protocol,
+            local_address: self.local_ip,
+            local_port,
+            remote_address: self.remote_ip,
+            remote_port,
+        }
+    }
+}
+
+fn get_protocol(data: &CalloutData, index: usize) -> IpProtocol {
+    IpProtocol::from(data.get_value_u8(index))
+}
+
+fn get_ipv4_address(data: &CalloutData, index: usize) -> IpAddress {
+    IpAddress::Ipv4(Ipv4Address::from_bytes(
+        &data.get_value_u32(index).to_be_bytes(),
+    ))
+}
+
+fn get_ipv6_address(data: &CalloutData, index: usize) -> IpAddress {
+    IpAddress::Ipv6(Ipv6Address::from_bytes(data.get_value_byte_array16(index)))
+}
+
+pub fn ale_layer_connect_v4(data: CalloutData) {
+    type Fields = FieldsAleAuthConnectV4;
+    let ale_data = AleLayerData {
+        is_ipv6: false,
+        reauthorize: data.is_reauthorize(Fields::Flags as usize),
+        process_id: data.get_process_id().unwrap_or(0),
+        protocol: get_protocol(&data, Fields::IpProtocol as usize),
+        direction: Direction::Outbound,
+        local_ip: get_ipv4_address(&data, Fields::IpLocalAddress as usize),
+        local_port: data.get_value_u16(Fields::IpLocalPort as usize),
+        remote_ip: get_ipv4_address(&data, Fields::IpRemoteAddress as usize),
+        remote_port: data.get_value_u16(Fields::IpRemotePort as usize),
+        interface_index: 0,
+        sub_interface_index: 0,
+    };
+
+    ale_layer_auth(data, ale_data);
+}
+
+pub fn ale_layer_connect_v6(data: CalloutData) {
+    type Fields = FieldsAleAuthConnectV6;
+
+    let ale_data = AleLayerData {
+        is_ipv6: true,
+        reauthorize: data.is_reauthorize(Fields::Flags as usize),
+        process_id: data.get_process_id().unwrap_or(0),
+        protocol: get_protocol(&data, Fields::IpProtocol as usize),
+        direction: Direction::Outbound,
+        local_ip: get_ipv6_address(&data, Fields::IpLocalAddress as usize),
+        local_port: data.get_value_u16(Fields::IpLocalPort as usize),
+        remote_ip: get_ipv6_address(&data, Fields::IpRemoteAddress as usize),
+        remote_port: data.get_value_u16(Fields::IpRemotePort as usize),
+        interface_index: data.get_value_u32(Fields::InterfaceIndex as usize),
+        sub_interface_index: data.get_value_u32(Fields::SubInterfaceIndex as usize),
+    };
+
+    ale_layer_auth(data, ale_data);
+}
+
+fn ale_layer_auth(mut data: CalloutData, ale_data: AleLayerData) {
+    let Some(device) = crate::entry::get_device() else {
+        return;
+    };
+
+    // Check if packet was previously injected from the packet layer.
+    if device
+        .injector
+        .was_network_packet_injected_by_self(data.get_layer_data() as _, ale_data.is_ipv6)
+    {
+        data.action_permit();
+        return;
+    }
+
+    match ale_data.protocol {
+        IpProtocol::Tcp | IpProtocol::Udp => {
+            // Only TCP and UDP make sense to be supported in the ALE layer.
+            // Everything else is not associated with a connection and will be handled in the packet layer.
+        }
+        _ => {
+            // Outbound: Will be handled by packet layer next.
+            // Inbound: Was already handled by the packet layer.
+            data.action_permit();
+            return;
+        }
+    }
+
+    let key = ale_data.as_key();
+
+    // Check if connection is already in cache.
+    let verdict = if ale_data.is_ipv6 {
+        device
+            .connection_cache
+            .read_connection_v6(&key, |conn| -> Option<Verdict> {
+                // Function is behind spin lock, just copy and return.
+                Some(conn.verdict)
+            })
+    } else {
+        device
+            .connection_cache
+            .read_connection_v4(&ale_data.as_key(), |conn| -> Option<Verdict> {
+                // Function is behind spin lock, just copy and return.
+                Some(conn.verdict)
+            })
+    };
+
+    // Connection already in cache.
+    if let Some(verdict) = verdict {
+        crate::dbg!("processing existing connection: {} {}", key, verdict);
+        match verdict {
+            // No verdict yet
+            Verdict::Undecided => {
+                crate::dbg!("saving packet: {}", key);
+                // Connection is already pended. Save packet and wait for verdict.
+                match save_packet(device, &mut data, &ale_data, false) {
+                    Ok(packet) => {
+                        let info = device.packet_cache.push(
+                            (key, packet),
+                            ale_data.process_id,
+                            ale_data.direction,
+                            true,
+                        );
+                        if let Some(info) = info {
+                            let _ = device.event_queue.push(info);
+                        }
+                    }
+                    Err(err) => {
+                        crate::err!("failed to pend packet: {}", err);
+                    }
+                };
+                data.block_and_absorb();
+            }
+            // There is a verdict
+            Verdict::PermanentAccept
+            | Verdict::Accept
+            | Verdict::RedirectNameServer
+            | Verdict::RedirectTunnel => {
+                // Continue to packet layer.
+                data.action_permit();
+            }
+            Verdict::PermanentBlock | Verdict::Undeterminable | Verdict::Failed => {
+                // Packet layer will not see this connection.
+                crate::dbg!("permanent block {}", key);
+                data.action_block();
+            }
+            Verdict::PermanentDrop => {
+                // Packet layer will not see this connection.
+                crate::dbg!("permanent drop {}", key);
+                data.block_and_absorb();
+            }
+            Verdict::Block => {
+                if let Direction::Outbound = ale_data.direction {
+                    // Handled by packet layer.
+                    data.action_permit();
+                } else {
+                    // packet layer will still see the packets.
+                    data.action_block();
+                }
+            }
+            Verdict::Drop => {
+                if let Direction::Outbound = ale_data.direction {
+                    // Handled by packet layer.
+                    data.action_permit();
+                } else {
+                    // packet layer will still see the packets.
+                    data.block_and_absorb();
+                }
+            }
+        }
+    } else {
+        crate::dbg!("pending connection: {} {}", key, ale_data.direction);
+        // Only first packet of a connection can be pended: reauthorize == false
+        let can_pend_connection = !ale_data.reauthorize;
+        match save_packet(device, &mut data, &ale_data, can_pend_connection) {
+            Ok(packet) => {
+                let info = device.packet_cache.push(
+                    (key, packet),
+                    ale_data.process_id,
+                    ale_data.direction,
+                    true,
+                );
+                if let Some(info) = info {
+                    let _ = device.event_queue.push(info);
+                }
+            }
+            Err(err) => {
+                crate::err!("failed to pend packet: {}", err);
+            }
+        };
+
+        // Connection is not in cache, add it.
+        crate::dbg!(
+            "ale layer adding connection: {} PID: {}",
+            key,
+            ale_data.process_id
+        );
+        if ale_data.is_ipv6 {
+            let conn =
+                ConnectionV6::from_key(&key, ale_data.process_id, ale_data.direction).unwrap();
+            device.connection_cache.add_connection_v6(conn);
+        } else {
+            let conn =
+                ConnectionV4::from_key(&key, ale_data.process_id, ale_data.direction).unwrap();
+            device.connection_cache.add_connection_v4(conn);
+        }
+
+        // Drop packet. It will be re-injected after Portmaster returns a verdict.
+        data.block_and_absorb();
+    }
+}
+
+fn save_packet(
+    device: &Device,
+    callout_data: &mut CalloutData,
+    ale_data: &AleLayerData,
+    pend: bool,
+) -> Result<Packet, alloc::string::String> {
+    let mut packet_list = None;
+    let mut save_packet_list = true;
+    if ale_data.protocol == IpProtocol::Tcp {
+        if let Direction::Outbound = ale_data.direction {
+            // Only time a packet data is missing is during connect state of outbound TCP connection.
+            // Don't save packet list only if connection is outbound, reauthorize is false and the protocol is TCP.
+            save_packet_list = ale_data.reauthorize;
+        }
+    };
+    if save_packet_list {
+        packet_list = create_packet_list(device, callout_data, ale_data);
+    }
+    if pend && matches!(ale_data.protocol, IpProtocol::Tcp | IpProtocol::Udp) {
+        match callout_data.pend_operation(packet_list) {
+            Ok(classify_defer) => Ok(Packet::AleLayer(classify_defer)),
+            Err(err) => Err(alloc::format!("failed to defer connection: {}", err)),
+        }
+    } else {
+        Ok(Packet::AleLayer(callout_data.pend_filter_rest(packet_list)))
+    }
+}
+
+fn create_packet_list(
+    device: &Device,
+    callout_data: &mut CalloutData,
+    ale_data: &AleLayerData,
+) -> Option<TransportPacketList> {
+    let mut nbl = NetBufferList::new(callout_data.get_layer_data() as _);
+    let mut inbound = false;
+    if let Direction::Inbound = ale_data.direction {
+        if ale_data.is_ipv6 {
+            nbl.retreat(IPV6_HEADER_LEN as u32, true);
+        } else {
+            nbl.retreat(IPV4_HEADER_LEN as u32, true);
+        }
+        inbound = true;
+    }
+
+    let address: &[u8] = match &ale_data.remote_ip {
+        IpAddress::Ipv4(address) => &address.0,
+        IpAddress::Ipv6(address) => &address.0,
+    };
+    if let Ok(clone) = nbl.clone(&device.network_allocator) {
+        return Some(Injector::from_ale_callout(
+            ale_data.is_ipv6,
+            callout_data,
+            clone,
+            address,
+            inbound,
+            ale_data.interface_index,
+            ale_data.sub_interface_index,
+        ));
+    }
+    return None;
+}
+
+pub fn endpoint_closure_v4(data: CalloutData) {
+    type Fields = layer::FieldsAleEndpointClosureV4;
+    let Some(device) = crate::entry::get_device() else {
+        return;
+    };
+    let ip_address_type = data.get_value_type(Fields::IpLocalAddress as usize);
+    if let ValueType::FwpUint32 = ip_address_type {
+        let key = Key {
+            protocol: get_protocol(&data, Fields::IpProtocol as usize),
+            local_address: get_ipv4_address(&data, Fields::IpLocalAddress as usize),
+            local_port: data.get_value_u16(Fields::IpLocalPort as usize),
+            remote_address: get_ipv4_address(&data, Fields::IpRemoteAddress as usize),
+            remote_port: data.get_value_u16(Fields::IpRemotePort as usize),
+        };
+
+        let conn = device.connection_cache.end_connection_v4(key);
+        if let Some(conn) = conn {
+            let info = protocol::info::connection_end_event_v4_info(
+                data.get_process_id().unwrap_or(0),
+                conn.get_direction() as u8,
+                u8::from(get_protocol(&data, Fields::IpProtocol as usize)),
+                conn.local_address.0,
+                conn.remote_address.0,
+                conn.local_port,
+                conn.remote_port,
+            );
+            let _ = device.event_queue.push(info);
+        }
+    } else {
+        // Invalid ip address type. Just ignore the error.
+        // err!(
+        //     device.logger,
+        //     "unknown ipv4 address type: {:?}",
+        //     ip_address_type
+        // );
+    }
+}
+
+pub fn endpoint_closure_v6(data: CalloutData) {
+    type Fields = layer::FieldsAleEndpointClosureV6;
+    let Some(device) = crate::entry::get_device() else {
+        return;
+    };
+    let local_ip_address_type = data.get_value_type(Fields::IpLocalAddress as usize);
+    let remote_ip_address_type = data.get_value_type(Fields::IpRemoteAddress as usize);
+
+    if let ValueType::FwpByteArray16Type = local_ip_address_type {
+        if let ValueType::FwpByteArray16Type = remote_ip_address_type {
+            let key = Key {
+                protocol: get_protocol(&data, Fields::IpProtocol as usize),
+                local_address: get_ipv6_address(&data, Fields::IpLocalAddress as usize),
+                local_port: data.get_value_u16(Fields::IpLocalPort as usize),
+                remote_address: get_ipv6_address(&data, Fields::IpRemoteAddress as usize),
+                remote_port: data.get_value_u16(Fields::IpRemotePort as usize),
+            };
+
+            let conn = device.connection_cache.end_connection_v6(key);
+            if let Some(conn) = conn {
+                let info = protocol::info::connection_end_event_v6_info(
+                    data.get_process_id().unwrap_or(0),
+                    conn.get_direction() as u8,
+                    u8::from(get_protocol(&data, Fields::IpProtocol as usize)),
+                    conn.local_address.0,
+                    conn.remote_address.0,
+                    conn.local_port,
+                    conn.remote_port,
+                );
+                let _ = device.event_queue.push(info);
+            }
+        }
+    }
+}
+
+pub fn ale_resource_monitor(data: CalloutData) {
+    let Some(device) = crate::entry::get_device() else {
+        return;
+    };
+    match data.layer {
+        layer::Layer::AleResourceAssignmentV4Discard => {
+            type Fields = layer::FieldsAleResourceAssignmentV4;
+            if let Some(conns) = device.connection_cache.end_all_on_port_v4((
+                get_protocol(&data, Fields::IpProtocol as usize),
+                data.get_value_u16(Fields::IpLocalPort as usize),
+            )) {
+                let process_id = data.get_process_id().unwrap_or(0);
+                info!(
+                    "Port {}/{} Ipv4 assign request discarded pid={}",
+                    data.get_value_u16(Fields::IpLocalPort as usize),
+                    get_protocol(&data, Fields::IpProtocol as usize),
+                    process_id,
+                );
+                for conn in conns {
+                    let info = protocol::info::connection_end_event_v4_info(
+                        process_id,
+                        conn.get_direction() as u8,
+                        data.get_value_u8(Fields::IpProtocol as usize),
+                        conn.local_address.0,
+                        conn.remote_address.0,
+                        conn.local_port,
+                        conn.remote_port,
+                    );
+                    let _ = device.event_queue.push(info);
+                }
+            }
+        }
+        layer::Layer::AleResourceAssignmentV6Discard => {
+            type Fields = layer::FieldsAleResourceAssignmentV6;
+            if let Some(conns) = device.connection_cache.end_all_on_port_v6((
+                get_protocol(&data, Fields::IpProtocol as usize),
+                data.get_value_u16(Fields::IpLocalPort as usize),
+            )) {
+                let process_id = data.get_process_id().unwrap_or(0);
+                info!(
+                    "Port {}/{} Ipv6 assign request discarded pid={}",
+                    data.get_value_u16(Fields::IpLocalPort as usize),
+                    get_protocol(&data, Fields::IpProtocol as usize),
+                    process_id,
+                );
+                for conn in conns {
+                    let info = protocol::info::connection_end_event_v6_info(
+                        process_id,
+                        conn.get_direction() as u8,
+                        data.get_value_u8(Fields::IpProtocol as usize),
+                        conn.local_address.0,
+                        conn.remote_address.0,
+                        conn.local_port,
+                        conn.remote_port,
+                    );
+                    let _ = device.event_queue.push(info);
+                }
+            }
+        }
+        layer::Layer::AleResourceReleaseV4 => {
+            type Fields = layer::FieldsAleResourceReleaseV4;
+            if let Some(conns) = device.connection_cache.end_all_on_port_v4((
+                get_protocol(&data, Fields::IpProtocol as usize),
+                data.get_value_u16(Fields::IpLocalPort as usize),
+            )) {
+                let process_id = data.get_process_id().unwrap_or(0);
+                info!(
+                    "Port {}/{} released pid={}",
+                    data.get_value_u16(Fields::IpLocalPort as usize),
+                    get_protocol(&data, Fields::IpProtocol as usize),
+                    process_id,
+                );
+                for conn in conns {
+                    let info = protocol::info::connection_end_event_v4_info(
+                        process_id,
+                        conn.get_direction() as u8,
+                        data.get_value_u8(Fields::IpProtocol as usize),
+                        conn.local_address.0,
+                        conn.remote_address.0,
+                        conn.local_port,
+                        conn.remote_port,
+                    );
+                    let _ = device.event_queue.push(info);
+                }
+            }
+        }
+        layer::Layer::AleResourceReleaseV6 => {
+            type Fields = layer::FieldsAleResourceReleaseV6;
+            if let Some(conns) = device.connection_cache.end_all_on_port_v6((
+                get_protocol(&data, Fields::IpProtocol as usize),
+                data.get_value_u16(Fields::IpLocalPort as usize),
+            )) {
+                let process_id = data.get_process_id().unwrap_or(0);
+                info!(
+                    "Port {}/{} released pid={}",
+                    data.get_value_u16(Fields::IpLocalPort as usize),
+                    get_protocol(&data, Fields::IpProtocol as usize),
+                    process_id,
+                );
+                for conn in conns {
+                    let info = protocol::info::connection_end_event_v6_info(
+                        process_id,
+                        conn.get_direction() as u8,
+                        data.get_value_u8(Fields::IpProtocol as usize),
+                        conn.local_address.0,
+                        conn.remote_address.0,
+                        conn.local_port,
+                        conn.remote_port,
+                    );
+                    let _ = device.event_queue.push(info);
+                }
+            }
+        }
+        _ => {}
+    }
+}

windows_kext/driver/src/array_holder.rs

@@ -0,0 +1,25 @@
+use core::cell::RefCell;
+
+use alloc::vec::Vec;
+
+pub struct ArrayHolder(RefCell<Option<Vec<u8>>>);
+unsafe impl Sync for ArrayHolder {}
+
+impl ArrayHolder {
+    pub const fn default() -> Self {
+        Self(RefCell::new(None))
+    }
+
+    pub fn save(&self, data: &[u8]) {
+        if let Ok(mut opt) = self.0.try_borrow_mut() {
+            opt.replace(data.to_vec());
+        }
+    }
+
+    pub fn load(&self) -> Option<Vec<u8>> {
+        if let Ok(mut opt) = self.0.try_borrow_mut() {
+            return opt.take();
+        }
+        None
+    }
+}

windows_kext/driver/src/bandwidth.rs

@@ -0,0 +1,293 @@
+use protocol::info::{BandwidthValueV4, BandwidthValueV6, Info};
+use smoltcp::wire::{IpProtocol, Ipv4Address, Ipv6Address};
+use wdk::rw_spin_lock::RwSpinLock;
+
+use crate::driver_hashmap::DeviceHashMap;
+
+#[derive(Debug, Hash, PartialEq, Eq, PartialOrd, Ord, Clone, Copy, Default)]
+pub struct Key<Address>
+where
+    Address: Eq + PartialEq,
+{
+    pub local_ip: Address,
+    pub local_port: u16,
+    pub remote_ip: Address,
+    pub remote_port: u16,
+}
+
+struct Value {
+    received_bytes: usize,
+    transmitted_bytes: usize,
+}
+
+enum Direction {
+    Tx(usize),
+    Rx(usize),
+}
+pub struct Bandwidth {
+    stats_tcp_v4: DeviceHashMap<Key<Ipv4Address>, Value>,
+    stats_tcp_v4_lock: RwSpinLock,
+
+    stats_tcp_v6: DeviceHashMap<Key<Ipv6Address>, Value>,
+    stats_tcp_v6_lock: RwSpinLock,
+
+    stats_udp_v4: DeviceHashMap<Key<Ipv4Address>, Value>,
+    stats_udp_v4_lock: RwSpinLock,
+
+    stats_udp_v6: DeviceHashMap<Key<Ipv6Address>, Value>,
+    stats_udp_v6_lock: RwSpinLock,
+}
+
+impl Bandwidth {
+    pub fn new() -> Self {
+        Self {
+            stats_tcp_v4: DeviceHashMap::new(),
+            stats_tcp_v4_lock: RwSpinLock::default(),
+
+            stats_tcp_v6: DeviceHashMap::new(),
+            stats_tcp_v6_lock: RwSpinLock::default(),
+
+            stats_udp_v4: DeviceHashMap::new(),
+            stats_udp_v4_lock: RwSpinLock::default(),
+
+            stats_udp_v6: DeviceHashMap::new(),
+            stats_udp_v6_lock: RwSpinLock::default(),
+        }
+    }
+
+    pub fn get_all_updates_tcp_v4(&mut self) -> Option<Info> {
+        let stats_map;
+        {
+            let _guard = self.stats_tcp_v4_lock.write_lock();
+            if self.stats_tcp_v4.is_empty() {
+                return None;
+            }
+            stats_map = core::mem::replace(&mut self.stats_tcp_v4, DeviceHashMap::new());
+        }
+
+        let mut values = alloc::vec::Vec::with_capacity(stats_map.len());
+        for (key, value) in stats_map.iter() {
+            values.push(BandwidthValueV4 {
+                local_ip: key.local_ip.0,
+                local_port: key.local_port,
+                remote_ip: key.remote_ip.0,
+                remote_port: key.remote_port,
+                transmitted_bytes: value.transmitted_bytes as u64,
+                received_bytes: value.received_bytes as u64,
+            });
+        }
+        Some(protocol::info::bandiwth_stats_array_v4(
+            u8::from(IpProtocol::Tcp),
+            values,
+        ))
+    }
+
+    pub fn get_all_updates_tcp_v6(&mut self) -> Option<Info> {
+        let stats_map;
+        {
+            let _guard = self.stats_tcp_v6_lock.write_lock();
+            if self.stats_tcp_v6.is_empty() {
+                return None;
+            }
+            stats_map = core::mem::replace(&mut self.stats_tcp_v6, DeviceHashMap::new());
+        }
+
+        let mut values = alloc::vec::Vec::with_capacity(stats_map.len());
+        for (key, value) in stats_map.iter() {
+            values.push(BandwidthValueV6 {
+                local_ip: key.local_ip.0,
+                local_port: key.local_port,
+                remote_ip: key.remote_ip.0,
+                remote_port: key.remote_port,
+                transmitted_bytes: value.transmitted_bytes as u64,
+                received_bytes: value.received_bytes as u64,
+            });
+        }
+        Some(protocol::info::bandiwth_stats_array_v6(
+            u8::from(IpProtocol::Tcp),
+            values,
+        ))
+    }
+
+    pub fn get_all_updates_udp_v4(&mut self) -> Option<Info> {
+        let stats_map;
+        {
+            let _guard = self.stats_udp_v4_lock.write_lock();
+            if self.stats_udp_v4.is_empty() {
+                return None;
+            }
+            stats_map = core::mem::replace(&mut self.stats_udp_v4, DeviceHashMap::new());
+        }
+
+        let mut values = alloc::vec::Vec::with_capacity(stats_map.len());
+        for (key, value) in stats_map.iter() {
+            values.push(BandwidthValueV4 {
+                local_ip: key.local_ip.0,
+                local_port: key.local_port,
+                remote_ip: key.remote_ip.0,
+                remote_port: key.remote_port,
+                transmitted_bytes: value.transmitted_bytes as u64,
+                received_bytes: value.received_bytes as u64,
+            });
+        }
+        Some(protocol::info::bandiwth_stats_array_v4(
+            u8::from(IpProtocol::Udp),
+            values,
+        ))
+    }
+
+    pub fn get_all_updates_udp_v6(&mut self) -> Option<Info> {
+        let stats_map;
+        {
+            let _guard = self.stats_udp_v6_lock.write_lock();
+            if self.stats_tcp_v6.is_empty() {
+                return None;
+            }
+            stats_map = core::mem::replace(&mut self.stats_tcp_v6, DeviceHashMap::new());
+        }
+
+        let mut values = alloc::vec::Vec::with_capacity(stats_map.len());
+        for (key, value) in stats_map.iter() {
+            values.push(BandwidthValueV6 {
+                local_ip: key.local_ip.0,
+                local_port: key.local_port,
+                remote_ip: key.remote_ip.0,
+                remote_port: key.remote_port,
+                transmitted_bytes: value.transmitted_bytes as u64,
+                received_bytes: value.received_bytes as u64,
+            });
+        }
+        Some(protocol::info::bandiwth_stats_array_v6(
+            u8::from(IpProtocol::Udp),
+            values,
+        ))
+    }
+
+    pub fn update_tcp_v4_tx(&mut self, key: Key<Ipv4Address>, tx_bytes: usize) {
+        Self::update(
+            &mut self.stats_tcp_v4,
+            &mut self.stats_tcp_v4_lock,
+            key,
+            Direction::Tx(tx_bytes),
+        );
+    }
+
+    pub fn update_tcp_v4_rx(&mut self, key: Key<Ipv4Address>, rx_bytes: usize) {
+        Self::update(
+            &mut self.stats_tcp_v4,
+            &mut self.stats_tcp_v4_lock,
+            key,
+            Direction::Rx(rx_bytes),
+        );
+    }
+
+    pub fn update_tcp_v6_tx(&mut self, key: Key<Ipv6Address>, tx_bytes: usize) {
+        Self::update(
+            &mut self.stats_tcp_v6,
+            &mut self.stats_tcp_v6_lock,
+            key,
+            Direction::Tx(tx_bytes),
+        );
+    }
+
+    pub fn update_tcp_v6_rx(&mut self, key: Key<Ipv6Address>, rx_bytes: usize) {
+        Self::update(
+            &mut self.stats_tcp_v6,
+            &mut self.stats_tcp_v6_lock,
+            key,
+            Direction::Rx(rx_bytes),
+        );
+    }
+
+    pub fn update_udp_v4_tx(&mut self, key: Key<Ipv4Address>, tx_bytes: usize) {
+        Self::update(
+            &mut self.stats_udp_v4,
+            &mut self.stats_udp_v4_lock,
+            key,
+            Direction::Tx(tx_bytes),
+        );
+    }
+
+    pub fn update_udp_v4_rx(&mut self, key: Key<Ipv4Address>, rx_bytes: usize) {
+        Self::update(
+            &mut self.stats_udp_v4,
+            &mut self.stats_udp_v4_lock,
+            key,
+            Direction::Rx(rx_bytes),
+        );
+    }
+
+    pub fn update_udp_v6_tx(&mut self, key: Key<Ipv6Address>, tx_bytes: usize) {
+        Self::update(
+            &mut self.stats_udp_v6,
+            &mut self.stats_udp_v6_lock,
+            key,
+            Direction::Tx(tx_bytes),
+        );
+    }
+
+    pub fn update_udp_v6_rx(&mut self, key: Key<Ipv6Address>, rx_bytes: usize) {
+        Self::update(
+            &mut self.stats_udp_v6,
+            &mut self.stats_udp_v6_lock,
+            key,
+            Direction::Rx(rx_bytes),
+        );
+    }
+
+    fn update<Address: Eq + PartialEq + core::hash::Hash>(
+        map: &mut DeviceHashMap<Key<Address>, Value>,
+        lock: &mut RwSpinLock,
+        key: Key<Address>,
+        bytes: Direction,
+    ) {
+        let _guard = lock.write_lock();
+        if let Some(value) = map.get_mut(&key) {
+            match bytes {
+                Direction::Tx(bytes_count) => value.transmitted_bytes += bytes_count,
+                Direction::Rx(bytes_count) => value.received_bytes += bytes_count,
+            }
+        } else {
+            let mut received_bytes = 0;
+            let mut transmitted_bytes = 0;
+            match bytes {
+                Direction::Tx(bytes_count) => transmitted_bytes += bytes_count,
+                Direction::Rx(bytes_count) => received_bytes += bytes_count,
+            }
+            map.insert(
+                key,
+                Value {
+                    received_bytes,
+                    transmitted_bytes,
+                },
+            );
+        }
+    }
+
+    #[allow(dead_code)]
+    pub fn get_entries_count(&self) -> usize {
+        let mut size = 0;
+        {
+            let values = &self.stats_tcp_v4.values();
+            let _guard = self.stats_tcp_v4_lock.read_lock();
+            size += values.len();
+        }
+        {
+            let values = &self.stats_tcp_v6.values();
+            let _guard = self.stats_tcp_v6_lock.read_lock();
+            size += values.len();
+        }
+        {
+            let values = &self.stats_udp_v4.values();
+            let _guard = self.stats_udp_v4_lock.read_lock();
+            size += values.len();
+        }
+        {
+            let values = &self.stats_udp_v6.values();
+            let _guard = self.stats_udp_v6_lock.read_lock();
+            size += values.len();
+        }
+
+        return size;
+    }
+}

windows_kext/driver/src/callouts.rs

@@ -0,0 +1,167 @@
+use alloc::vec::Vec;
+use wdk::filter_engine::callout::FilterType;
+use wdk::{
+    consts,
+    filter_engine::{callout::Callout, layer::Layer},
+};
+
+use crate::{ale_callouts, packet_callouts, stream_callouts};
+
+pub fn get_callout_vec() -> Vec<Callout> {
+    alloc::vec![
+        // -----------------------------------------
+        // ALE Auth layers
+        Callout::new(
+            "Portmaster ALE Outbound IPv4",
+            "Portmaster uses this layer to block/permit outgoing ipv4 connections",
+            0x58545073_f893_454c_bbea_a57bc964f46d,
+            Layer::AleAuthConnectV4,
+            consts::FWP_ACTION_CALLOUT_TERMINATING,
+            FilterType::Resettable,
+            ale_callouts::ale_layer_connect_v4,
+        ),
+        Callout::new(
+            "Portmaster ALE Outbound IPv6",
+            "Portmaster uses this layer to block/permit outgoing ipv6 connections",
+            0x4bd2a080_2585_478d_977c_7f340c6bc3d4,
+            Layer::AleAuthConnectV6,
+            consts::FWP_ACTION_CALLOUT_TERMINATING,
+            FilterType::Resettable,
+            ale_callouts::ale_layer_connect_v6,
+        ),
+        // -----------------------------------------
+        // ALE connection end layers
+        Callout::new(
+            "Portmaster Endpoint Closure IPv4",
+            "Portmaster uses this layer to detect when a IPv4 connection has ended",
+            0x58f02845_ace9_4455_ac80_8a84b86fe566,
+            Layer::AleEndpointClosureV4,
+            consts::FWP_ACTION_CALLOUT_INSPECTION,
+            FilterType::NonResettable,
+            ale_callouts::endpoint_closure_v4,
+        ),
+        Callout::new(
+            "Portmaster Endpoint Closure IPv6",
+            "Portmaster uses this layer to detect when a IPv6 connection has ended",
+            0x2bc82359_9dc5_4315_9c93_c89467e283ce,
+            Layer::AleEndpointClosureV6,
+            consts::FWP_ACTION_CALLOUT_INSPECTION,
+            FilterType::NonResettable,
+            ale_callouts::endpoint_closure_v6,
+        ),
+        // -----------------------------------------
+        // ALE resource assignment and release.
+        // Callout::new(
+        //     "AleResourceAssignmentV4",
+        //     "Ipv4 Port assignment monitoring",
+        //     0x6b9d1985_6f75_4d05_b9b5_1607e187906f,
+        //     Layer::AleResourceAssignmentV4Discard,
+        //     consts::FWP_ACTION_CALLOUT_INSPECTION,
+        //     FilterType::NonResettable,
+        //     ale_callouts::ale_resource_monitor,
+        // ),
+        Callout::new(
+            "Portmaster resource release IPv4",
+            "Portmaster uses this layer to detect when a IPv4 port has been released",
+            0x7b513bb3_a0be_4f77_a4bc_03c052abe8d7,
+            Layer::AleResourceReleaseV4,
+            consts::FWP_ACTION_CALLOUT_INSPECTION,
+            FilterType::NonResettable,
+            ale_callouts::ale_resource_monitor,
+        ),
+        // Callout::new(
+        //     "AleResourceAssignmentV6",
+        //     "Ipv4 Port assignment monitor",
+        //     0xb0d02299_3d3e_437d_916a_f0e96a60cc18,
+        //     Layer::AleResourceAssignmentV6Discard,
+        //     consts::FWP_ACTION_CALLOUT_INSPECTION,
+        //     FilterType::NonResettable,
+        //     ale_callouts::ale_resource_monitor,
+        // ),
+        Callout::new(
+            "Portmaster resource release IPv6",
+            "Portmaster uses this layer to detect when a IPv6 port has been released",
+            0x6cf36e04_e656_42c3_8cac_a1ce05328bd1,
+            Layer::AleResourceReleaseV6,
+            consts::FWP_ACTION_CALLOUT_INSPECTION,
+            FilterType::NonResettable,
+            ale_callouts::ale_resource_monitor,
+        ),
+        // -----------------------------------------
+        // Stream layer
+        Callout::new(
+            "Portmaster Stream IPv4",
+            "Portmaster uses this layer for bandwidth statistics of IPv4 TCP connections",
+            0xe2ca13bf_9710_4caa_a45c_e8c78b5ac780,
+            Layer::StreamV4,
+            consts::FWP_ACTION_CALLOUT_INSPECTION,
+            FilterType::NonResettable,
+            stream_callouts::stream_layer_tcp_v4,
+        ),
+        Callout::new(
+            "Portmaster Stream IPv6",
+            "Portmaster uses this layer for bandwidth statistics of IPv6 TCP connections",
+            0x66c549b3_11e2_4b27_8f73_856e6fd82baa,
+            Layer::StreamV6,
+            consts::FWP_ACTION_CALLOUT_INSPECTION,
+            FilterType::NonResettable,
+            stream_callouts::stream_layer_tcp_v6,
+        ),
+        Callout::new(
+            "Portmaster Datagram IPv4",
+            "Portmaster uses this layer for bandwidth statistics of IPv4 UDP connections",
+            0xe7eeeaba_168a_45bb_8747_e1a702feb2c5,
+            Layer::DatagramDataV4,
+            consts::FWP_ACTION_CALLOUT_INSPECTION,
+            FilterType::NonResettable,
+            stream_callouts::stream_layer_udp_v4,
+        ),
+        Callout::new(
+            "Portmaster Datagram IPv6",
+            "Portmaster uses this layer for bandwidth statistics of IPv6 UDP connections",
+            0xb25862cd_f744_4452_b14a_d0c1e5a25b30,
+            Layer::DatagramDataV6,
+            consts::FWP_ACTION_CALLOUT_INSPECTION,
+            FilterType::NonResettable,
+            stream_callouts::stream_layer_udp_v6,
+        ),
+        // -----------------------------------------
+        // Packet layers
+        Callout::new(
+            "Portmaster Packet Outbound IPv4",
+            "Portmaster uses this layer to redirect/block/permit outgoing ipv4 packets",
+            0xf3183afe_dc35_49f1_8ea2_b16b5666dd36,
+            Layer::OutboundIppacketV4,
+            consts::FWP_ACTION_CALLOUT_TERMINATING,
+            FilterType::NonResettable,
+            packet_callouts::ip_packet_layer_outbound_v4,
+        ),
+        Callout::new(
+            "Portmaster Packet Inbound IPv4",
+            "Portmaster uses this layer to redirect/block/permit inbound ipv4 packets",
+            0xf0369374_203d_4bf0_83d2_b2ad3cc17a50,
+            Layer::InboundIppacketV4,
+            consts::FWP_ACTION_CALLOUT_TERMINATING,
+            FilterType::NonResettable,
+            packet_callouts::ip_packet_layer_inbound_v4,
+        ),
+        Callout::new(
+            "Portmaster Packet Outbound IPv6",
+            "Portmaster uses this layer to redirect/block/permit outgoing ipv6 packets",
+            0x91daf8bc_0908_4bf8_9f81_2c538ab8f25a,
+            Layer::OutboundIppacketV6,
+            consts::FWP_ACTION_CALLOUT_TERMINATING,
+            FilterType::NonResettable,
+            packet_callouts::ip_packet_layer_outbound_v6,
+        ),
+        Callout::new(
+            "Portmaster Packet Inbound IPv6",
+            "Portmaster uses this layer to redirect/block/permit inbound ipv6 packets",
+            0xfe9faf5f_ceb2_4cd9_9995_f2f2b4f5fcc0,
+            Layer::InboundIppacketV6,
+            consts::FWP_ACTION_CALLOUT_TERMINATING,
+            FilterType::NonResettable,
+            packet_callouts::ip_packet_layer_inbound_v6,
+        )
+    ]
+}

windows_kext/driver/src/common.rs

@@ -0,0 +1,59 @@
+#![allow(dead_code)]
+
+use core::fmt::Display;
+
+use num_derive::{FromPrimitive, ToPrimitive};
+
+pub const ICMPV4_CODE_DESTINATION_UNREACHABLE: u32 = 3;
+pub const ICMPV4_CODE_DU_PORT_UNREACHABLE: u32 = 3; // Destination Unreachable (Port unreachable) ;
+pub const ICMPV4_CODE_DU_ADMINISTRATIVELY_PROHIBITED: u32 = 13; // Destination Unreachable (Communication Administratively Prohibited) ;
+
+pub const ICMPV6_CODE_DESTINATION_UNREACHABLE: u32 = 1;
+pub const ICMPV6_CODE_DU_PORT_UNREACHABLE: u32 = 4; // Destination Unreachable (Port unreachable) ;
+
+enum Direction {
+    Outbound = 0,
+    Inbound = 1,
+}
+
+const SIOCTL_TYPE: u32 = 40000;
+macro_rules! ctl_code {
+    ($device_type:expr, $function:expr, $method:expr, $access:expr) => {
+        ($device_type << 16) | ($access << 14) | ($function << 2) | $method
+    };
+}
+
+pub const METHOD_BUFFERED: u32 = 0;
+pub const METHOD_IN_DIRECT: u32 = 1;
+pub const METHOD_OUT_DIRECT: u32 = 2;
+pub const METHOD_NEITHER: u32 = 3;
+
+pub const FILE_READ_DATA: u32 = 0x0001; // file & pipe
+pub const FILE_WRITE_DATA: u32 = 0x0002; // file & pipe
+
+#[repr(u32)]
+#[derive(FromPrimitive, ToPrimitive)]
+pub enum ControlCode {
+    Version = ctl_code!(
+        SIOCTL_TYPE,
+        0x800,
+        METHOD_BUFFERED,
+        FILE_READ_DATA | FILE_WRITE_DATA
+    ),
+    ShutdownRequest = ctl_code!(
+        SIOCTL_TYPE,
+        0x801,
+        METHOD_BUFFERED,
+        FILE_READ_DATA | FILE_WRITE_DATA
+    ),
+}
+
+impl Display for ControlCode {
+    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        match self {
+            ControlCode::Version => _ = write!(f, "Version"),
+            ControlCode::ShutdownRequest => _ = write!(f, "Shutdown"),
+        };
+        return Ok(());
+    }
+}

windows_kext/driver/src/connection.rs

@@ -0,0 +1,499 @@
+use alloc::{
+    boxed::Box,
+    string::{String, ToString},
+};
+use core::{
+    fmt::{Debug, Display},
+    sync::atomic::{AtomicU64, Ordering},
+};
+use num_derive::FromPrimitive;
+use smoltcp::wire::{IpAddress, IpProtocol, Ipv4Address, Ipv6Address};
+
+use crate::connection_map::Key;
+
+pub static PM_DNS_PORT: u16 = 53;
+pub static PM_SPN_PORT: u16 = 717;
+
+// Make sure this in sync with the Go version
+#[derive(Copy, Clone, FromPrimitive)]
+#[repr(u8)]
+#[rustfmt::skip]
+pub enum Verdict {
+    Undecided          = 0, // Undecided is the default status of new connections.
+    Undeterminable     = 1,
+    Accept             = 2,
+    PermanentAccept    = 3,
+    Block              = 4,
+    PermanentBlock     = 5,
+    Drop               = 6,
+    PermanentDrop      = 7,
+    RedirectNameServer = 8,
+    RedirectTunnel     = 9,
+    Failed             = 10,
+}
+
+impl Display for Verdict {
+    #[rustfmt::skip]
+    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        match self {
+            Verdict::Undecided          => write!(f, "Undecided"),
+            Verdict::Undeterminable     => write!(f, "Undeterminable"),
+            Verdict::Accept             => write!(f, "Accept"),
+            Verdict::PermanentAccept    => write!(f, "PermanentAccept"),
+            Verdict::Block              => write!(f, "Block"),
+            Verdict::PermanentBlock     => write!(f, "PermanentBlock"),
+            Verdict::Drop               => write!(f, "Drop"),
+            Verdict::PermanentDrop      => write!(f, "PermanentDrop"),
+            Verdict::RedirectNameServer => write!(f, "RedirectNameServer"),
+            Verdict::RedirectTunnel     => write!(f, "RedirectTunnel"),
+            Verdict::Failed             => write!(f, "Failed"),
+        }
+    }
+}
+
+#[allow(dead_code)]
+impl Verdict {
+    /// Returns true if the verdict is a redirect.
+    pub fn is_redirect(&self) -> bool {
+        matches!(self, Verdict::RedirectNameServer | Verdict::RedirectTunnel)
+    }
+
+    /// Returns true if the verdict is a permanent verdict.
+    pub fn is_permanent(&self) -> bool {
+        matches!(
+            self,
+            Verdict::PermanentAccept
+                | Verdict::PermanentBlock
+                | Verdict::PermanentDrop
+                | Verdict::RedirectNameServer
+                | Verdict::RedirectTunnel
+        )
+    }
+}
+
+/// Direction of the connection.
+#[derive(Copy, Clone, FromPrimitive)]
+#[repr(u8)]
+pub enum Direction {
+    Outbound = 0,
+    Inbound = 1,
+}
+
+impl Display for Direction {
+    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        match self {
+            Direction::Outbound => write!(f, "Outbound"),
+            Direction::Inbound => write!(f, "Inbound"),
+        }
+    }
+}
+
+impl Debug for Direction {
+    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        write!(f, "{}", self)
+    }
+}
+
+#[derive(Clone)]
+pub struct ConnectionExtra {
+    pub(crate) end_timestamp: u64,
+    pub(crate) direction: Direction,
+}
+
+pub trait Connection {
+    fn redirect_info(&self) -> Option<RedirectInfo> {
+        let redirect_address = if self.is_ipv6() {
+            IpAddress::Ipv6(Ipv6Address::LOOPBACK)
+        } else {
+            IpAddress::Ipv4(Ipv4Address::new(127, 0, 0, 1))
+        };
+
+        match self.get_verdict() {
+            Verdict::RedirectNameServer => Some(RedirectInfo {
+                local_address: self.get_local_address(),
+                remote_address: self.get_remote_address(),
+                remote_port: self.get_remote_port(),
+                redirect_port: PM_DNS_PORT,
+                unify: false,
+                redirect_address,
+            }),
+            Verdict::RedirectTunnel => Some(RedirectInfo {
+                local_address: self.get_local_address(),
+                remote_address: self.get_remote_address(),
+                remote_port: self.get_remote_port(),
+                redirect_port: PM_SPN_PORT,
+                unify: true,
+                redirect_address,
+            }),
+            _ => None,
+        }
+    }
+
+    /// Returns the key of the connection.
+    fn get_key(&self) -> Key {
+        Key {
+            protocol: self.get_protocol(),
+            local_address: self.get_local_address(),
+            local_port: self.get_local_port(),
+            remote_address: self.get_remote_address(),
+            remote_port: self.get_remote_port(),
+        }
+    }
+
+    /// Returns true if the connection is equal to the given key. The key is considered equal if the remote port and address are equal.
+    fn remote_equals(&self, key: &Key) -> bool;
+    /// Returns true if the connection is equal to the given key for redirecting. The key is considered equal if the remote port and address are equal.
+    fn redirect_equals(&self, key: &Key) -> bool;
+    /// Returns the protocol of the connection.
+    fn get_protocol(&self) -> IpProtocol;
+    /// Returns the verdict of the connection.
+    fn get_verdict(&self) -> Verdict;
+    /// Returns the local address of the connection.
+    fn get_local_address(&self) -> IpAddress;
+    /// Returns the local port of the connection.
+    fn get_local_port(&self) -> u16;
+    /// Returns the remote address of the connection.
+    fn get_remote_address(&self) -> IpAddress;
+    /// Returns the remote port of the connection.
+    fn get_remote_port(&self) -> u16;
+    /// Returns true if the connection is an IPv6 connection.
+    fn is_ipv6(&self) -> bool;
+    /// Returns the direction of the connection.
+    fn get_direction(&self) -> Direction;
+    // Returns the process id of the connection.
+    fn get_process_id(&self) -> u64;
+    /// Ends the connection.
+    fn end(&mut self, timestamp: u64);
+    /// Returns true if the connection has ended.
+    fn has_ended(&self) -> bool {
+        self.get_end_time() > 0
+    }
+    /// Returns the timestamp when the connection ended.
+    fn get_end_time(&self) -> u64;
+    /// Returns the timestamp when the connection was last accessed.
+    fn get_last_accessed_time(&self) -> u64;
+    /// Sets the timestamp when the connection was last accessed.
+    fn set_last_accessed_time(&self, timestamp: u64);
+}
+
+pub struct ConnectionV4 {
+    pub(crate) protocol: IpProtocol,
+    pub(crate) local_address: Ipv4Address,
+    pub(crate) local_port: u16,
+    pub(crate) remote_address: Ipv4Address,
+    pub(crate) remote_port: u16,
+    pub(crate) verdict: Verdict,
+    pub(crate) process_id: u64,
+    pub(crate) last_accessed_timestamp: AtomicU64,
+    pub(crate) extra: Box<ConnectionExtra>,
+}
+
+pub struct ConnectionV6 {
+    pub(crate) protocol: IpProtocol,
+    pub(crate) local_address: Ipv6Address,
+    pub(crate) local_port: u16,
+    pub(crate) remote_address: Ipv6Address,
+    pub(crate) remote_port: u16,
+    pub(crate) verdict: Verdict,
+    pub(crate) process_id: u64,
+    pub(crate) last_accessed_timestamp: AtomicU64,
+    pub(crate) extra: Box<ConnectionExtra>,
+}
+
+#[derive(Debug)]
+pub struct RedirectInfo {
+    pub(crate) local_address: IpAddress,
+    pub(crate) remote_address: IpAddress,
+    pub(crate) remote_port: u16,
+    pub(crate) redirect_port: u16,
+    pub(crate) unify: bool,
+    pub(crate) redirect_address: IpAddress,
+}
+
+impl ConnectionV4 {
+    /// Creates a new ipv4 connection from the given key.
+    pub fn from_key(key: &Key, process_id: u64, direction: Direction) -> Result<Self, String> {
+        let IpAddress::Ipv4(local_address) = key.local_address else {
+            return Err("wrong ip address version".to_string());
+        };
+
+        let IpAddress::Ipv4(remote_address) = key.remote_address else {
+            return Err("wrong ip address version".to_string());
+        };
+
+        let timestamp = wdk::utils::get_system_timestamp_ms();
+
+        Ok(Self {
+            protocol: key.protocol,
+            local_address,
+            local_port: key.local_port,
+            remote_address,
+            remote_port: key.remote_port,
+            verdict: Verdict::Undecided,
+            process_id,
+            last_accessed_timestamp: AtomicU64::new(timestamp),
+            extra: Box::new(ConnectionExtra {
+                direction,
+                end_timestamp: 0,
+            }),
+        })
+    }
+}
+
+impl Connection for ConnectionV4 {
+    fn remote_equals(&self, key: &Key) -> bool {
+        if self.remote_port != key.remote_port {
+            return false;
+        }
+        if let IpAddress::Ipv4(remote_address) = &key.remote_address {
+            return self.remote_address.eq(remote_address);
+        }
+        false
+    }
+
+    fn get_key(&self) -> Key {
+        Key {
+            protocol: self.protocol,
+            local_address: IpAddress::Ipv4(self.local_address),
+            local_port: self.local_port,
+            remote_address: IpAddress::Ipv4(self.remote_address),
+            remote_port: self.remote_port,
+        }
+    }
+
+    fn redirect_equals(&self, key: &Key) -> bool {
+        match self.verdict {
+            Verdict::RedirectNameServer => {
+                if key.remote_port != PM_DNS_PORT {
+                    return false;
+                }
+
+                match key.remote_address {
+                    IpAddress::Ipv4(a) => a.is_loopback(),
+                    IpAddress::Ipv6(_) => false,
+                }
+            }
+            Verdict::RedirectTunnel => {
+                if key.remote_port != PM_SPN_PORT {
+                    return false;
+                }
+                key.local_address.eq(&key.remote_address)
+            }
+            _ => false,
+        }
+    }
+
+    fn get_protocol(&self) -> IpProtocol {
+        self.protocol
+    }
+
+    fn get_verdict(&self) -> Verdict {
+        self.verdict
+    }
+
+    fn get_local_address(&self) -> IpAddress {
+        IpAddress::Ipv4(self.local_address)
+    }
+
+    fn get_local_port(&self) -> u16 {
+        self.local_port
+    }
+
+    fn get_remote_address(&self) -> IpAddress {
+        IpAddress::Ipv4(self.remote_address)
+    }
+
+    fn get_remote_port(&self) -> u16 {
+        self.remote_port
+    }
+
+    fn is_ipv6(&self) -> bool {
+        false
+    }
+
+    fn get_process_id(&self) -> u64 {
+        self.process_id
+    }
+
+    fn get_direction(&self) -> Direction {
+        self.extra.direction
+    }
+
+    fn end(&mut self, timestamp: u64) {
+        self.extra.end_timestamp = timestamp;
+    }
+
+    fn get_end_time(&self) -> u64 {
+        self.extra.end_timestamp
+    }
+
+    fn get_last_accessed_time(&self) -> u64 {
+        self.last_accessed_timestamp.load(Ordering::Relaxed)
+    }
+
+    fn set_last_accessed_time(&self, timestamp: u64) {
+        self.last_accessed_timestamp
+            .store(timestamp, Ordering::Relaxed);
+    }
+}
+
+impl Clone for ConnectionV4 {
+    fn clone(&self) -> Self {
+        Self {
+            protocol: self.protocol,
+            local_address: self.local_address,
+            local_port: self.local_port,
+            remote_address: self.remote_address,
+            remote_port: self.remote_port,
+            verdict: self.verdict,
+            process_id: self.process_id,
+            last_accessed_timestamp: AtomicU64::new(
+                self.last_accessed_timestamp.load(Ordering::Relaxed),
+            ),
+            extra: self.extra.clone(),
+        }
+    }
+}
+
+impl ConnectionV6 {
+    /// Creates a new ipv6 connection from the given key.
+    pub fn from_key(key: &Key, process_id: u64, direction: Direction) -> Result<Self, String> {
+        let IpAddress::Ipv6(local_address) = key.local_address else {
+            return Err("wrong ip address version".to_string());
+        };
+
+        let IpAddress::Ipv6(remote_address) = key.remote_address else {
+            return Err("wrong ip address version".to_string());
+        };
+        let timestamp = wdk::utils::get_system_timestamp_ms();
+
+        Ok(Self {
+            protocol: key.protocol,
+            local_address,
+            local_port: key.local_port,
+            remote_address,
+            remote_port: key.remote_port,
+            verdict: Verdict::Undecided,
+            process_id,
+            last_accessed_timestamp: AtomicU64::new(timestamp),
+            extra: Box::new(ConnectionExtra {
+                direction,
+                end_timestamp: 0,
+            }),
+        })
+    }
+}
+
+impl Connection for ConnectionV6 {
+    fn remote_equals(&self, key: &Key) -> bool {
+        if self.remote_port != key.remote_port {
+            return false;
+        }
+        if let IpAddress::Ipv6(remote_address) = &key.remote_address {
+            return self.remote_address.eq(remote_address);
+        }
+        false
+    }
+    fn get_key(&self) -> Key {
+        Key {
+            protocol: self.protocol,
+            local_address: IpAddress::Ipv6(self.local_address),
+            local_port: self.local_port,
+            remote_address: IpAddress::Ipv6(self.remote_address),
+            remote_port: self.remote_port,
+        }
+    }
+
+    fn redirect_equals(&self, key: &Key) -> bool {
+        match self.verdict {
+            Verdict::RedirectNameServer => {
+                if key.remote_port != PM_DNS_PORT {
+                    return false;
+                }
+
+                match key.remote_address {
+                    IpAddress::Ipv4(_) => false,
+                    IpAddress::Ipv6(a) => a.is_loopback(),
+                }
+            }
+            Verdict::RedirectTunnel => {
+                if key.remote_port != PM_SPN_PORT {
+                    return false;
+                }
+                key.local_address.eq(&key.remote_address)
+            }
+            _ => false,
+        }
+    }
+
+    fn get_protocol(&self) -> IpProtocol {
+        self.protocol
+    }
+
+    fn get_verdict(&self) -> Verdict {
+        self.verdict
+    }
+
+    fn get_local_address(&self) -> IpAddress {
+        IpAddress::Ipv6(self.local_address)
+    }
+
+    fn get_local_port(&self) -> u16 {
+        self.local_port
+    }
+
+    fn get_remote_address(&self) -> IpAddress {
+        IpAddress::Ipv6(self.remote_address)
+    }
+
+    fn get_remote_port(&self) -> u16 {
+        self.remote_port
+    }
+
+    fn is_ipv6(&self) -> bool {
+        true
+    }
+
+    fn get_process_id(&self) -> u64 {
+        self.process_id
+    }
+
+    fn get_direction(&self) -> Direction {
+        self.extra.direction
+    }
+
+    fn end(&mut self, timestamp: u64) {
+        self.extra.end_timestamp = timestamp;
+    }
+
+    fn get_end_time(&self) -> u64 {
+        self.extra.end_timestamp
+    }
+
+    fn get_last_accessed_time(&self) -> u64 {
+        self.last_accessed_timestamp.load(Ordering::Relaxed)
+    }
+
+    fn set_last_accessed_time(&self, timestamp: u64) {
+        self.last_accessed_timestamp
+            .store(timestamp, Ordering::Relaxed);
+    }
+}
+
+impl Clone for ConnectionV6 {
+    fn clone(&self) -> Self {
+        Self {
+            protocol: self.protocol,
+            local_address: self.local_address,
+            local_port: self.local_port,
+            remote_address: self.remote_address,
+            remote_port: self.remote_port,
+            verdict: self.verdict,
+            process_id: self.process_id,
+            last_accessed_timestamp: AtomicU64::new(
+                self.last_accessed_timestamp.load(Ordering::Relaxed),
+            ),
+            extra: self.extra.clone(),
+        }
+    }
+}

windows_kext/driver/src/connection_cache.rs

@@ -0,0 +1,200 @@
+use core::time::Duration;
+
+use crate::{
+    connection::{Connection, ConnectionV4, ConnectionV6, RedirectInfo, Verdict},
+    connection_map::{ConnectionMap, Key},
+};
+use alloc::{format, string::String, vec::Vec};
+
+use smoltcp::wire::IpProtocol;
+use wdk::rw_spin_lock::RwSpinLock;
+
+pub struct ConnectionCache {
+    connections_v4: ConnectionMap<ConnectionV4>,
+    connections_v6: ConnectionMap<ConnectionV6>,
+    lock_v4: RwSpinLock,
+    lock_v6: RwSpinLock,
+}
+
+impl ConnectionCache {
+    pub fn new() -> Self {
+        Self {
+            connections_v4: ConnectionMap::new(),
+            connections_v6: ConnectionMap::new(),
+            lock_v4: RwSpinLock::default(),
+            lock_v6: RwSpinLock::default(),
+        }
+    }
+
+    pub fn add_connection_v4(&mut self, connection: ConnectionV4) {
+        let _guard = self.lock_v4.write_lock();
+        self.connections_v4.add(connection);
+    }
+
+    pub fn add_connection_v6(&mut self, connection: ConnectionV6) {
+        let _guard = self.lock_v6.write_lock();
+        self.connections_v6.add(connection);
+    }
+
+    pub fn update_connection(&mut self, key: Key, verdict: Verdict) -> Option<RedirectInfo> {
+        if key.is_ipv6() {
+            let _guard = self.lock_v6.write_lock();
+            if let Some(conn) = self.connections_v6.get_mut(&key) {
+                conn.verdict = verdict;
+                return conn.redirect_info();
+            }
+        } else {
+            let _guard = self.lock_v4.write_lock();
+            if let Some(conn) = self.connections_v4.get_mut(&key) {
+                conn.verdict = verdict;
+                return conn.redirect_info();
+            }
+        }
+        None
+    }
+
+    pub fn read_connection_v4<T>(
+        &self,
+        key: &Key,
+        process_connection: fn(&ConnectionV4) -> Option<T>,
+    ) -> Option<T> {
+        let _guard = self.lock_v4.read_lock();
+        self.connections_v4.read(key, process_connection)
+    }
+
+    pub fn read_connection_v6<T>(
+        &self,
+        key: &Key,
+        process_connection: fn(&ConnectionV6) -> Option<T>,
+    ) -> Option<T> {
+        let _guard = self.lock_v6.read_lock();
+        self.connections_v6.read(key, process_connection)
+    }
+
+    pub fn end_connection_v4(&mut self, key: Key) -> Option<ConnectionV4> {
+        let _guard = self.lock_v4.write_lock();
+        self.connections_v4.end(key)
+    }
+
+    pub fn end_connection_v6(&mut self, key: Key) -> Option<ConnectionV6> {
+        let _guard = self.lock_v6.write_lock();
+        self.connections_v6.end(key)
+    }
+
+    pub fn end_all_on_port_v4(&mut self, key: (IpProtocol, u16)) -> Option<Vec<ConnectionV4>> {
+        let _guard = self.lock_v4.write_lock();
+        self.connections_v4.end_all_on_port(key)
+    }
+
+    pub fn end_all_on_port_v6(&mut self, key: (IpProtocol, u16)) -> Option<Vec<ConnectionV6>> {
+        let _guard = self.lock_v6.write_lock();
+        self.connections_v6.end_all_on_port(key)
+    }
+
+    pub fn clean_ended_connections(&mut self) {
+        {
+            let _guard = self.lock_v4.write_lock();
+            self.connections_v4.clean_ended_connections();
+        }
+        {
+            let _guard = self.lock_v6.write_lock();
+            self.connections_v6.clean_ended_connections();
+        }
+    }
+
+    pub fn clear(&mut self) {
+        {
+            let _guard = self.lock_v4.write_lock();
+            self.connections_v4.clear();
+        }
+        {
+            let _guard = self.lock_v6.write_lock();
+            self.connections_v6.clear();
+        }
+    }
+
+    #[allow(dead_code)]
+    pub fn get_entries_count(&self) -> usize {
+        let mut size = 0;
+        {
+            let _guard = self.lock_v4.read_lock();
+            size += self.connections_v4.get_count();
+        }
+
+        {
+            let _guard = self.lock_v6.read_lock();
+            size += self.connections_v6.get_count();
+        }
+
+        return size;
+    }
+
+    #[allow(dead_code)]
+    pub fn get_full_cache_info(&self) -> String {
+        let mut info = String::new();
+        let now = wdk::utils::get_system_timestamp_ms();
+        {
+            let _guard = self.lock_v4.read_lock();
+            for ((protocol, port), connections) in self.connections_v4.iter() {
+                info.push_str(&format!("{} -> {}\n", protocol, port,));
+                for conn in connections {
+                    let active_time_seconds =
+                        Duration::from_millis(now - conn.get_last_accessed_time()).as_secs();
+                    info.push_str(&format!(
+                        "\t{}:{} -> {}:{} {} last active {}m {}s ago",
+                        conn.local_address,
+                        conn.local_port,
+                        conn.remote_address,
+                        conn.remote_port,
+                        conn.verdict,
+                        active_time_seconds / 60,
+                        active_time_seconds % 60
+                    ));
+                    if conn.has_ended() {
+                        let end_time_seconds =
+                            Duration::from_millis(now - conn.get_end_time()).as_secs();
+                        info.push_str(&format!(
+                            "\t ended {}m {}s ago",
+                            end_time_seconds / 60,
+                            end_time_seconds % 60
+                        ));
+                    }
+                    info.push('\n');
+                }
+            }
+        }
+
+        {
+            let _guard = self.lock_v6.read_lock();
+            for ((protocol, port), connections) in self.connections_v6.iter() {
+                info.push_str(&format!("{} -> {} \n", protocol, port));
+                for conn in connections {
+                    let active_time_seconds =
+                        Duration::from_millis(now - conn.get_last_accessed_time()).as_secs();
+                    info.push_str(&format!(
+                        "\t{}:{} -> {}:{} {} last active {}m {}s ago",
+                        conn.local_address,
+                        conn.local_port,
+                        conn.remote_address,
+                        conn.remote_port,
+                        conn.verdict,
+                        active_time_seconds / 60,
+                        active_time_seconds % 60
+                    ));
+                    if conn.has_ended() {
+                        let end_time_seconds =
+                            Duration::from_millis(now - conn.get_end_time()).as_secs();
+                        info.push_str(&format!(
+                            "\t ended {}m {}s ago",
+                            end_time_seconds / 60,
+                            end_time_seconds % 60
+                        ));
+                    }
+                    info.push('\n');
+                }
+            }
+        }
+
+        return info;
+    }
+}

windows_kext/driver/src/connection_map.rs

@@ -0,0 +1,179 @@
+use core::{fmt::Display, time::Duration};
+
+use crate::connection::Connection;
+use alloc::vec::Vec;
+use hashbrown::HashMap;
+use smoltcp::wire::{IpAddress, IpProtocol};
+
+#[derive(Clone, Copy, PartialEq, PartialOrd, Eq, Ord)]
+pub struct Key {
+    pub(crate) protocol: IpProtocol,
+    pub(crate) local_address: IpAddress,
+    pub(crate) local_port: u16,
+    pub(crate) remote_address: IpAddress,
+    pub(crate) remote_port: u16,
+}
+
+impl Display for Key {
+    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        write!(
+            f,
+            "p: {} l: {}:{} r: {}:{}",
+            self.protocol,
+            self.local_address,
+            self.local_port,
+            self.remote_address,
+            self.remote_port
+        )
+    }
+}
+
+impl Key {
+    /// Returns the protocol and port as a tuple.
+    pub fn small(&self) -> (IpProtocol, u16) {
+        (self.protocol, self.local_port)
+    }
+
+    /// Returns true if the local address is an IPv4 address.
+    pub fn is_ipv6(&self) -> bool {
+        match self.local_address {
+            IpAddress::Ipv4(_) => false,
+            IpAddress::Ipv6(_) => true,
+        }
+    }
+
+    /// Returns true if the local address is a loopback address.
+    pub fn is_loopback(&self) -> bool {
+        match self.local_address {
+            IpAddress::Ipv4(ip) => ip.is_loopback(),
+            IpAddress::Ipv6(ip) => ip.is_loopback(),
+        }
+    }
+
+    /// Returns a new key with the local and remote addresses and ports reversed.
+    #[allow(dead_code)]
+    pub fn reverse(&self) -> Key {
+        Key {
+            protocol: self.protocol,
+            local_address: self.remote_address,
+            local_port: self.remote_port,
+            remote_address: self.local_address,
+            remote_port: self.local_port,
+        }
+    }
+}
+
+pub struct ConnectionMap<T: Connection>(HashMap<(IpProtocol, u16), Vec<T>>);
+
+impl<T: Connection + Clone> ConnectionMap<T> {
+    pub fn new() -> Self {
+        Self(HashMap::new())
+    }
+
+    pub fn add(&mut self, conn: T) {
+        let key = conn.get_key().small();
+        if let Some(connections) = self.0.get_mut(&key) {
+            connections.push(conn);
+        } else {
+            self.0.insert(key, alloc::vec![conn]);
+        }
+    }
+
+    pub fn get_mut(&mut self, key: &Key) -> Option<&mut T> {
+        if let Some(connections) = self.0.get_mut(&key.small()) {
+            for conn in connections {
+                if conn.remote_equals(key) {
+                    conn.set_last_accessed_time(wdk::utils::get_system_timestamp_ms());
+                    return Some(conn);
+                }
+            }
+        }
+
+        None
+    }
+
+    pub fn read<C>(&self, key: &Key, read_connection: fn(&T) -> Option<C>) -> Option<C> {
+        if let Some(connections) = self.0.get(&key.small()) {
+            for conn in connections {
+                if conn.remote_equals(key) {
+                    conn.set_last_accessed_time(wdk::utils::get_system_timestamp_ms());
+                    return read_connection(conn);
+                }
+                if conn.redirect_equals(key) {
+                    conn.set_last_accessed_time(wdk::utils::get_system_timestamp_ms());
+                    return read_connection(conn);
+                }
+            }
+        }
+
+        None
+    }
+
+    pub fn end(&mut self, key: Key) -> Option<T> {
+        if let Some(connections) = self.0.get_mut(&key.small()) {
+            for conn in connections.iter_mut() {
+                if conn.remote_equals(&key) {
+                    conn.end(wdk::utils::get_system_timestamp_ms());
+                    return Some(conn.clone());
+                }
+            }
+        }
+        return None;
+    }
+
+    pub fn end_all_on_port(&mut self, key: (IpProtocol, u16)) -> Option<Vec<T>> {
+        if let Some(connections) = self.0.get_mut(&key) {
+            let mut vec = Vec::with_capacity(connections.len());
+            for conn in connections.iter_mut() {
+                if !conn.has_ended() {
+                    conn.end(wdk::utils::get_system_timestamp_ms());
+                    vec.push(conn.clone());
+                }
+            }
+            return Some(vec);
+        }
+        return None;
+    }
+
+    pub fn clear(&mut self) {
+        self.0.clear();
+    }
+
+    pub fn clean_ended_connections(&mut self) {
+        let now = wdk::utils::get_system_timestamp_ms();
+        const TEN_MINUETS: u64 = Duration::from_secs(60 * 10).as_millis() as u64;
+        let before_ten_minutes = now - TEN_MINUETS;
+        let before_one_minute = now - Duration::from_secs(60).as_millis() as u64;
+
+        for (_, connections) in self.0.iter_mut() {
+            connections.retain(|c| {
+                if c.has_ended() && c.get_end_time() < before_one_minute {
+                    // Ended more than 1 minute ago
+                    return false;
+                }
+
+                if c.get_last_accessed_time() < before_ten_minutes {
+                    // Last active more than 10 minutes ago
+                    return false;
+                }
+
+                // Keep
+                return true;
+            });
+        }
+        self.0.retain(|_, v| !v.is_empty());
+    }
+
+    #[allow(dead_code)]
+    pub fn get_count(&self) -> usize {
+        let mut count = 0;
+        for conn in self.0.values() {
+            count += conn.len();
+        }
+        return count;
+    }
+
+    pub fn iter(&self) -> hashbrown::hash_map::Iter<'_, (IpProtocol, u16), Vec<T>> {
+        self.0.iter()
+    }
+}

windows_kext/driver/src/device.rs

@@ -0,0 +1,330 @@
+use alloc::string::String;
+use num_traits::FromPrimitive;
+use protocol::{command::CommandType, info::Info};
+use smoltcp::wire::{IpAddress, IpProtocol, Ipv4Address, Ipv6Address};
+use wdk::{
+    driver::Driver,
+    filter_engine::{
+        callout_data::ClassifyDefer,
+        net_buffer::{NetBufferList, NetworkAllocator},
+        packet::{InjectInfo, Injector},
+        FilterEngine,
+    },
+    ioqueue::{self, IOQueue},
+    irp_helpers::{ReadRequest, WriteRequest},
+};
+
+use crate::{
+    array_holder::ArrayHolder, bandwidth::Bandwidth, callouts, connection_cache::ConnectionCache,
+    connection_map::Key, dbg, err, id_cache::IdCache, logger, packet_util::Redirect,
+};
+
+pub enum Packet {
+    PacketLayer(NetBufferList, InjectInfo),
+    AleLayer(ClassifyDefer),
+}
+
+// Device Context
+pub struct Device {
+    pub(crate) filter_engine: FilterEngine,
+    pub(crate) read_leftover: ArrayHolder,
+    pub(crate) event_queue: IOQueue<Info>,
+    pub(crate) packet_cache: IdCache,
+    pub(crate) connection_cache: ConnectionCache,
+    pub(crate) injector: Injector,
+    pub(crate) network_allocator: NetworkAllocator,
+    pub(crate) bandwidth_stats: Bandwidth,
+}
+
+impl Device {
+    /// Initialize all members of the device. Memory is handled by windows.
+    /// Make sure everything is initialized here.
+    pub fn new(driver: &Driver) -> Result<Self, String> {
+        let mut filter_engine =
+            match FilterEngine::new(driver, 0x7dab1057_8e2b_40c4_9b85_693e381d7896) {
+                Ok(fe) => fe,
+                Err(err) => return Err(alloc::format!("filter engine error: {}", err)),
+            };
+
+        filter_engine.commit(callouts::get_callout_vec())?;
+
+        Ok(Self {
+            filter_engine,
+            read_leftover: ArrayHolder::default(),
+            event_queue: IOQueue::new(),
+            packet_cache: IdCache::new(),
+            connection_cache: ConnectionCache::new(),
+            injector: Injector::new(),
+            network_allocator: NetworkAllocator::new(),
+            bandwidth_stats: Bandwidth::new(),
+        })
+    }
+
+    /// Cleanup is called just before drop.
+    // pub fn cleanup(&mut self) {}
+
+    fn write_buffer(&mut self, read_request: &mut ReadRequest, info: Info) {
+        let bytes = info.as_bytes();
+        let count = read_request.write(bytes);
+
+        // Check if the full buffer was written.
+        if count < bytes.len() {
+            // Save the leftovers for later.
+            self.read_leftover.save(&bytes[count..]);
+        }
+    }
+
+    /// Called when handle. Read is called from user-space.
+    pub fn read(&mut self, read_request: &mut ReadRequest) {
+        if let Some(data) = self.read_leftover.load() {
+            // There are leftovers from previous request.
+            let count = read_request.write(&data);
+
+            // Check if full command was written.
+            if count < data.len() {
+                // Save the leftovers for later.
+                self.read_leftover.save(&data[count..]);
+            }
+        } else {
+            // Noting left from before. Wait for next commands.
+            match self.event_queue.wait_and_pop() {
+                Ok(info) => {
+                    self.write_buffer(read_request, info);
+                }
+                Err(ioqueue::Status::Timeout) => {
+                    // Timeout. This will only trigger if pop function is called with timeout.
+                    read_request.timeout();
+                    return;
+                }
+                Err(err) => {
+                    // Queue failed. Send EOF, to notify user-space. Usually happens on rundown.
+                    err!("failed to pop value: {}", err);
+                    read_request.end_of_file();
+                    return;
+                }
+            }
+        }
+
+        // Check if we have more space. InfoType + data_size == 5 bytes
+        while read_request.free_space() > 5 {
+            match self.event_queue.pop() {
+                Ok(info) => {
+                    self.write_buffer(read_request, info);
+                }
+                Err(_) => {
+                    break;
+                }
+            }
+        }
+        read_request.complete();
+    }
+
+    // Called when handle.Write is called from user-space.
+    pub fn write(&mut self, write_request: &mut WriteRequest) {
+        // Try parsing the command.
+        let mut buffer = write_request.get_buffer();
+        let command = protocol::command::parse_type(buffer);
+        let Some(command) = command else {
+            err!("Unknown command number: {}", buffer[0]);
+            return;
+        };
+        buffer = &buffer[1..];
+
+        let mut _classify_defer = None;
+
+        match command {
+            CommandType::Shutdown => {
+                wdk::dbg!("Shutdown command");
+                self.shutdown();
+            }
+            CommandType::Verdict => {
+                let verdict = protocol::command::parse_verdict(buffer);
+                wdk::dbg!("Verdict command");
+                // Received verdict decision for a specific connection.
+                if let Some((key, mut packet)) = self.packet_cache.pop_id(verdict.id) {
+                    if let Some(verdict) = FromPrimitive::from_u8(verdict.verdict) {
+                        dbg!("Verdict received {}: {}", key, verdict);
+                        // Add verdict in the cache.
+                        let redirect_info = self.connection_cache.update_connection(key, verdict);
+
+                        // if verdict.is_permanent() {
+                        //     dbg!(self.logger, "resetting filters {}: {}", key, verdict);
+                        //     _ = self.filter_engine.reset_all_filters();
+                        // }
+
+                        match verdict {
+                            crate::connection::Verdict::Accept
+                            | crate::connection::Verdict::PermanentAccept => {
+                                if let Err(err) = self.inject_packet(packet, false) {
+                                    err!("failed to inject packet: {}", err);
+                                } else {
+                                    dbg!("packet injected: {}", key);
+                                }
+                            }
+                            crate::connection::Verdict::RedirectNameServer
+                            | crate::connection::Verdict::RedirectTunnel => {
+                                if let Some(redirect_info) = redirect_info {
+                                    // Will not redirect packets from ALE layer
+                                    if let Err(err) = packet.redirect(redirect_info) {
+                                        err!("failed to redirect packet: {}", err);
+                                    }
+                                    if let Err(err) = self.inject_packet(packet, false) {
+                                        err!("failed to inject packet: {}", err);
+                                    }
+                                }
+                            }
+                            _ => {
+                                // Inject only ALE layer. This will trigger proper block/drop.
+                                // Packet layer just drop the packet.
+                                if let Err(err) = self.inject_packet(packet, true) {
+                                    err!("failed to inject packet: {}", err);
+                                }
+                            }
+                        }
+                    };
+                } else {
+                    // Id was not in the packet cache.
+                    let id = verdict.id;
+                    err!("Verdict invalid id: {}", id);
+                }
+            }
+            CommandType::UpdateV4 => {
+                let update = protocol::command::parse_update_v4(buffer);
+                // Build the new action.
+                if let Some(verdict) = FromPrimitive::from_u8(update.verdict) {
+                    // Update with new action.
+                    dbg!("Verdict update received {:?}: {}", update, verdict);
+                    _classify_defer = self.connection_cache.update_connection(
+                        Key {
+                            protocol: IpProtocol::from(update.protocol),
+                            local_address: IpAddress::Ipv4(Ipv4Address::from_bytes(
+                                &update.local_address,
+                            )),
+                            local_port: update.local_port,
+                            remote_address: IpAddress::Ipv4(Ipv4Address::from_bytes(
+                                &update.remote_address,
+                            )),
+                            remote_port: update.remote_port,
+                        },
+                        verdict,
+                    );
+                } else {
+                    err!("invalid verdict value: {}", update.verdict);
+                }
+            }
+            CommandType::UpdateV6 => {
+                let update = protocol::command::parse_update_v6(buffer);
+                // Build the new action.
+                if let Some(verdict) = FromPrimitive::from_u8(update.verdict) {
+                    // Update with new action.
+                    dbg!("Verdict update received {:?}: {}", update, verdict);
+                    _classify_defer = self.connection_cache.update_connection(
+                        Key {
+                            protocol: IpProtocol::from(update.protocol),
+                            local_address: IpAddress::Ipv6(Ipv6Address::from_bytes(
+                                &update.local_address,
+                            )),
+                            local_port: update.local_port,
+                            remote_address: IpAddress::Ipv6(Ipv6Address::from_bytes(
+                                &update.remote_address,
+                            )),
+                            remote_port: update.remote_port,
+                        },
+                        verdict,
+                    );
+                } else {
+                    err!("invalid verdict value: {}", update.verdict);
+                }
+            }
+            CommandType::ClearCache => {
+                wdk::dbg!("ClearCache command");
+                self.connection_cache.clear();
+                if let Err(err) = self.filter_engine.reset_all_filters() {
+                    err!("failed to reset filters: {}", err);
+                }
+            }
+            CommandType::GetLogs => {
+                wdk::dbg!("GetLogs command");
+                let lines_vec = logger::flush();
+                for line in lines_vec {
+                    let _ = self.event_queue.push(line);
+                }
+            }
+            CommandType::GetBandwidthStats => {
+                wdk::dbg!("GetBandwidthStats command");
+                let stats = self.bandwidth_stats.get_all_updates_tcp_v4();
+                if let Some(stats) = stats {
+                    _ = self.event_queue.push(stats);
+                }
+
+                let stats = self.bandwidth_stats.get_all_updates_tcp_v6();
+                if let Some(stats) = stats {
+                    _ = self.event_queue.push(stats);
+                }
+
+                let stats = self.bandwidth_stats.get_all_updates_udp_v4();
+                if let Some(stats) = stats {
+                    _ = self.event_queue.push(stats);
+                }
+
+                let stats = self.bandwidth_stats.get_all_updates_udp_v6();
+                if let Some(stats) = stats {
+                    _ = self.event_queue.push(stats);
+                }
+            }
+            CommandType::PrintMemoryStats => {
+                // Getting the information takes a long time and interferes with the callouts causing the device to crash.
+                // TODO(vladimir): Make more optimized version
+                // info!(
+                //     "Packet cache: {} entries",
+                //     self.packet_cache.get_entries_count()
+                // );
+                // info!(
+                //     "BandwidthStats cache: {} entries",
+                //     self.bandwidth_stats.get_entries_count()
+                // );
+                // info!(
+                //     "Connection cache: {} entries\n {}",
+                //     self.connection_cache.get_entries_count(),
+                //     self.connection_cache.get_full_cache_info()
+                // );
+            }
+            CommandType::CleanEndedConnections => {
+                wdk::dbg!("CleanEndedConnections command");
+                self.connection_cache.clean_ended_connections();
+            }
+        }
+    }
+
+    pub fn shutdown(&self) {
+        // End blocking operations from the queue. This will end pending read requests.
+        self.event_queue.rundown();
+    }
+
+    pub fn inject_packet(&mut self, packet: Packet, blocked: bool) -> Result<(), String> {
+        match packet {
+            Packet::PacketLayer(nbl, inject_info) => {
+                if !blocked {
+                    self.injector.inject_net_buffer_list(nbl, inject_info)
+                } else {
+                    Ok(())
+                }
+            }
+            Packet::AleLayer(defer) => {
+                let packet_list = defer.complete(&mut self.filter_engine)?;
+                if let Some(packet_list) = packet_list {
+                    self.injector.inject_packet_list_transport(packet_list)?;
+                }
+
+                Ok(())
+            }
+        }
+    }
+}
+
+impl Drop for Device {
+    fn drop(&mut self) {
+        _ = logger::flush();
+        // dbg!("Device Context drop called.");
+    }
+}

windows_kext/driver/src/driver_hashmap.rs

@@ -0,0 +1,25 @@
+use core::ops::{Deref, DerefMut};
+
+use hashbrown::HashMap;
+
+pub struct DeviceHashMap<Key, Value>(Option<HashMap<Key, Value>>);
+
+impl<Key, Value> DeviceHashMap<Key, Value> {
+    pub fn new() -> Self {
+        Self(Some(HashMap::new()))
+    }
+}
+
+impl<Key, Value> Deref for DeviceHashMap<Key, Value> {
+    type Target = HashMap<Key, Value>;
+
+    fn deref(&self) -> &Self::Target {
+        self.0.as_ref().unwrap()
+    }
+}
+
+impl<Key, Value> DerefMut for DeviceHashMap<Key, Value> {
+    fn deref_mut(&mut self) -> &mut Self::Target {
+        self.0.as_mut().unwrap()
+    }
+}

windows_kext/driver/src/entry.rs

@@ -0,0 +1,135 @@
+use crate::common::ControlCode;
+use crate::device;
+use alloc::boxed::Box;
+use num_traits::FromPrimitive;
+use wdk::irp_helpers::{DeviceControlRequest, ReadRequest, WriteRequest};
+use wdk::{err, info, interface};
+use windows_sys::Wdk::Foundation::{DEVICE_OBJECT, DRIVER_OBJECT, IRP};
+use windows_sys::Win32::Foundation::{NTSTATUS, STATUS_SUCCESS};
+
+static VERSION: [u8; 4] = include!("../../kextinterface/version.txt");
+
+static mut DEVICE: *mut device::Device = core::ptr::null_mut();
+pub fn get_device() -> Option<&'static mut device::Device> {
+    return unsafe { DEVICE.as_mut() };
+}
+
+// DriverEntry is the entry point of the driver (main function). Will be called when driver is loaded.
+// Name should not be changed
+#[export_name = "DriverEntry"]
+pub extern "system" fn driver_entry(
+    driver_object: *mut windows_sys::Wdk::Foundation::DRIVER_OBJECT,
+    registry_path: *mut windows_sys::Win32::Foundation::UNICODE_STRING,
+) -> windows_sys::Win32::Foundation::NTSTATUS {
+    info!("Starting initialization...");
+
+    // Initialize driver object.
+    let mut driver = match interface::init_driver_object(
+        driver_object,
+        registry_path,
+        "PortmasterKext",
+        core::ptr::null_mut(),
+    ) {
+        Ok(driver) => driver,
+        Err(status) => {
+            err!("driver_entry: failed to initialize driver: {}", status);
+            return windows_sys::Win32::Foundation::STATUS_FAILED_DRIVER_ENTRY;
+        }
+    };
+
+    // Set driver functions.
+    driver.set_driver_unload(Some(driver_unload));
+    driver.set_read_fn(Some(driver_read));
+    driver.set_write_fn(Some(driver_write));
+    driver.set_device_control_fn(Some(device_control));
+
+    // Initialize device.
+    unsafe {
+        let device = match device::Device::new(&driver) {
+            Ok(device) => Box::new(device),
+            Err(err) => {
+                wdk::err!("filed to initialize device: {}", err);
+                return -1;
+            }
+        };
+        DEVICE = Box::into_raw(device);
+    }
+
+    STATUS_SUCCESS
+}
+
+// driver_unload function is called when service delete is called from user-space.
+unsafe extern "system" fn driver_unload(_object: *const DRIVER_OBJECT) {
+    info!("Unloading complete");
+    unsafe {
+        if !DEVICE.is_null() {
+            _ = Box::from_raw(DEVICE);
+        }
+    }
+}
+
+// driver_read event triggered from user-space on file.Read.
+unsafe extern "system" fn driver_read(
+    _device_object: *const DEVICE_OBJECT,
+    irp: *mut IRP,
+) -> NTSTATUS {
+    let mut read_request = ReadRequest::new(irp.as_mut().unwrap());
+    let Some(device) = get_device() else {
+        read_request.complete();
+
+        return read_request.get_status();
+    };
+
+    device.read(&mut read_request);
+    read_request.get_status()
+}
+
+/// driver_write event triggered from user-space on file.Write.
+unsafe extern "system" fn driver_write(
+    _device_object: *const DEVICE_OBJECT,
+    irp: *mut IRP,
+) -> NTSTATUS {
+    let mut write_request = WriteRequest::new(irp.as_mut().unwrap());
+    let Some(device) = get_device() else {
+        write_request.complete();
+        return write_request.get_status();
+    };
+
+    device.write(&mut write_request);
+
+    write_request.mark_all_as_read();
+    write_request.complete();
+    write_request.get_status()
+}
+
+/// device_control event triggered from user-space on file.deviceIOControl.
+unsafe extern "system" fn device_control(
+    _device_object: *const DEVICE_OBJECT,
+    irp: *mut IRP,
+) -> NTSTATUS {
+    let mut control_request = DeviceControlRequest::new(irp.as_mut().unwrap());
+    let Some(device) = get_device() else {
+        control_request.complete();
+        return control_request.get_status();
+    };
+
+    let Some(control_code): Option<ControlCode> =
+        FromPrimitive::from_u32(control_request.get_control_code())
+    else {
+        wdk::info!("Unknown IOCTL code: {}", control_request.get_control_code());
+        control_request.not_implemented();
+        return control_request.get_status();
+    };
+
+    wdk::info!("IOCTL: {}", control_code);
+
+    match control_code {
+        ControlCode::Version => {
+            control_request.write(&VERSION);
+        }
+        ControlCode::ShutdownRequest => device.shutdown(),
+    };
+
+    control_request.complete();
+    control_request.get_status()
+}

windows_kext/driver/src/id_cache.rs

@@ -0,0 +1,131 @@
+use alloc::collections::VecDeque;
+use protocol::info::Info;
+use smoltcp::wire::{IpAddress, IpProtocol};
+use wdk::rw_spin_lock::RwSpinLock;
+
+use crate::{connection::Direction, connection_map::Key, device::Packet};
+
+struct Entry<T> {
+    value: T,
+    id: u64,
+}
+
+pub struct IdCache {
+    values: VecDeque<Entry<(Key, Packet)>>,
+    lock: RwSpinLock,
+    next_id: u64,
+}
+
+impl IdCache {
+    pub fn new() -> Self {
+        Self {
+            values: VecDeque::with_capacity(1000),
+            lock: RwSpinLock::default(),
+            next_id: 1, // 0 is invalid id
+        }
+    }
+
+    pub fn push(
+        &mut self,
+        value: (Key, Packet),
+        process_id: u64,
+        direction: Direction,
+        ale_layer: bool,
+    ) -> Option<Info> {
+        let _guard = self.lock.write_lock();
+        let id = self.next_id;
+        let info = build_info(&value.0, id, process_id, direction, &value.1, ale_layer);
+        self.values.push_back(Entry { value, id });
+        self.next_id = self.next_id.wrapping_add(1); // Assuming this will not overflow.
+
+        return info;
+    }
+
+    pub fn pop_id(&mut self, id: u64) -> Option<(Key, Packet)> {
+        let _guard = self.lock.write_lock();
+        if let Ok(index) = self.values.binary_search_by_key(&id, |val| val.id) {
+            return Some(self.values.remove(index).unwrap().value);
+        }
+        None
+    }
+
+    #[allow(dead_code)]
+    pub fn get_entries_count(&self) -> usize {
+        let _guard = self.lock.read_lock();
+        return self.values.len();
+    }
+}
+
+fn get_payload(packet: &Packet) -> Option<&[u8]> {
+    match packet {
+        Packet::PacketLayer(nbl, _) => nbl.get_data(),
+        Packet::AleLayer(defer) => {
+            let p = match defer {
+                wdk::filter_engine::callout_data::ClassifyDefer::Initial(_, p) => p,
+                wdk::filter_engine::callout_data::ClassifyDefer::Reauthorization(_, p) => p,
+            };
+            if let Some(tpl) = p {
+                tpl.net_buffer_list.get_data()
+            } else {
+                None
+            }
+        }
+    }
+}
+
+fn build_info(
+    key: &Key,
+    packet_id: u64,
+    process_id: u64,
+    direction: Direction,
+    packet: &Packet,
+    ale_layer: bool,
+) -> Option<Info> {
+    let (local_port, remote_port) = match key.protocol {
+        IpProtocol::Tcp | IpProtocol::Udp => (key.local_port, key.remote_port),
+        _ => (0, 0),
+    };
+
+    let payload_layer = if ale_layer {
+        4 // Transport layer
+    } else {
+        3 // Network layer
+    };
+
+    let mut payload = &[][..];
+    if let Some(p) = get_payload(packet) {
+        payload = p;
+    }
+
+    match (key.local_address, key.remote_address) {
+        (IpAddress::Ipv6(local_ip), IpAddress::Ipv6(remote_ip)) if key.is_ipv6() => {
+            Some(protocol::info::connection_info_v6(
+                packet_id,
+                process_id,
+                direction as u8,
+                u8::from(key.protocol),
+                local_ip.0,
+                remote_ip.0,
+                local_port,
+                remote_port,
+                payload_layer,
+                payload,
+            ))
+        }
+        (IpAddress::Ipv4(local_ip), IpAddress::Ipv4(remote_ip)) => {
+            Some(protocol::info::connection_info_v4(
+                packet_id,
+                process_id,
+                direction as u8,
+                u8::from(key.protocol),
+                local_ip.0,
+                remote_ip.0,
+                local_port,
+                remote_port,
+                payload_layer,
+                payload,
+            ))
+        }
+        _ => None,
+    }
+}

windows_kext/driver/src/lib.rs

@@ -0,0 +1,43 @@
+#![cfg_attr(not(test), no_std)]
+#![no_main]
+#![allow(clippy::needless_return)]
+
+extern crate alloc;
+
+mod ale_callouts;
+mod array_holder;
+mod bandwidth;
+mod callouts;
+mod common;
+mod connection;
+mod connection_cache;
+mod connection_map;
+mod device;
+mod driver_hashmap;
+mod entry;
+mod id_cache;
+pub mod logger;
+mod packet_callouts;
+mod packet_util;
+mod stream_callouts;
+
+use wdk::allocator::WindowsAllocator;
+
+#[cfg(not(test))]
+use core::panic::PanicInfo;
+
+// Declaration of the global memory allocator
+#[global_allocator]
+static HEAP: WindowsAllocator = WindowsAllocator {};
+
+#[no_mangle]
+pub extern "system" fn _DllMainCRTStartup() {}
+
+#[cfg(not(test))]
+#[panic_handler]
+fn panic(info: &PanicInfo) -> ! {
+    use wdk::err;
+
+    err!("{}", info);
+    loop {}
+}

windows_kext/driver/src/logger.rs

@@ -0,0 +1,114 @@
+use alloc::boxed::Box;
+use alloc::vec::Vec;
+use core::{
+    mem::MaybeUninit,
+    sync::atomic::{AtomicPtr, AtomicUsize, Ordering},
+};
+use protocol::info::{Info, Severity};
+
+#[cfg(not(debug_assertions))]
+pub const LOG_LEVEL: u8 = Severity::Warning as u8;
+
+#[cfg(debug_assertions)]
+pub const LOG_LEVEL: u8 = Severity::Trace as u8;
+
+pub const MAX_LOG_LINE_SIZE: usize = 150;
+
+static mut LOG_LINES: [AtomicPtr<Info>; 1024] = unsafe { MaybeUninit::zeroed().assume_init() };
+static START_INDEX: AtomicUsize = unsafe { MaybeUninit::zeroed().assume_init() };
+static END_INDEX: AtomicUsize = unsafe { MaybeUninit::zeroed().assume_init() };
+
+pub fn add_line(log_line: Info) {
+    let mut index = END_INDEX.fetch_add(1, Ordering::Acquire);
+    unsafe {
+        index %= LOG_LINES.len();
+        let ptr = &mut LOG_LINES[index];
+        let line = Box::new(log_line);
+        let old = ptr.swap(Box::into_raw(line), Ordering::SeqCst);
+        if !old.is_null() {
+            _ = Box::from_raw(old);
+        }
+    }
+}
+
+pub fn flush() -> Vec<Info> {
+    let mut vec = Vec::new();
+    let end_index = END_INDEX.load(Ordering::Acquire);
+    let start_index = START_INDEX.load(Ordering::Acquire);
+    if end_index <= start_index {
+        return vec;
+    }
+    unsafe {
+        let count = end_index - start_index;
+        for i in start_index..start_index + count {
+            let index = i % LOG_LINES.len();
+            let ptr = LOG_LINES[index].swap(core::ptr::null_mut(), Ordering::SeqCst);
+            if !ptr.is_null() {
+                vec.push(*Box::from_raw(ptr));
+            }
+        }
+    }
+
+    START_INDEX.store(end_index, Ordering::Release);
+    vec
+}
+
+#[macro_export]
+macro_rules! log_internal {
+    ($log_line:expr, $($arg:tt)*) => ({
+        use core::fmt::Write;
+        _ = write!($log_line, "{}:{} ", file!(), line!());
+        _ = write!($log_line, $($arg)*);
+        $crate::logger::add_line($log_line);
+    });
+}
+
+#[macro_export]
+macro_rules! crit {
+    ($($arg:tt)*) => ({
+        if protocol::info::Severity::Critical as u8 >= $crate::logger::LOG_LEVEL {
+            let message = alloc::format!($($arg)*);
+            $crate::logger::add_line(protocol::info::Severity::Critical, alloc::format!("{}:{} ", file!(), line!()), message)
+        }
+    });
+}
+
+#[macro_export]
+macro_rules! err {
+    ($($arg:tt)*) => ({
+        if protocol::info::Severity::Error as u8 >= $crate::logger::LOG_LEVEL {
+            let mut log_line = protocol::info::log_line(protocol::info::Severity::Error, $crate::logger::MAX_LOG_LINE_SIZE);
+            $crate::log_internal!(log_line, $($arg)*);
+        }
+    });
+}
+
+#[macro_export]
+macro_rules! warn {
+    ($($arg:tt)*) => ({
+        if protocol::info::Severity::Warning as u8 >= $crate::logger::LOG_LEVEL {
+            let mut log_line = protocol::info::log_line(protocol::info::Severity::Warning, $crate::logger::MAX_LOG_LINE_SIZE);
+            $crate::log_internal!(log_line, $($arg)*);
+        }
+    });
+}
+
+#[macro_export]
+macro_rules! dbg {
+    ($($arg:tt)*) => ({
+        if protocol::info::Severity::Debug as u8 >= $crate::logger::LOG_LEVEL {
+            let mut log_line = protocol::info::log_line(protocol::info::Severity::Debug, $crate::logger::MAX_LOG_LINE_SIZE);
+            $crate::log_internal!(log_line, $($arg)*);
+        }
+    });
+}
+
+#[macro_export]
+macro_rules! info {
+    ($($arg:tt)*) => ({
+        if protocol::info::Severity::Info as u8 >= $crate::logger::LOG_LEVEL {
+            let mut log_line = protocol::info::log_line(protocol::info::Severity::Info, $crate::logger::MAX_LOG_LINE_SIZE);
+            $crate::log_internal!(log_line, $($arg)*);
+        }
+    });
+}

windows_kext/driver/src/packet_callouts.rs

@@ -0,0 +1,299 @@
+use alloc::string::String;
+use smoltcp::wire::{IPV4_HEADER_LEN, IPV6_HEADER_LEN};
+use wdk::filter_engine::callout_data::CalloutData;
+use wdk::filter_engine::layer;
+use wdk::filter_engine::net_buffer::{NetBufferList, NetBufferListIter};
+use wdk::filter_engine::packet::InjectInfo;
+
+use crate::connection::{
+    Connection, ConnectionV4, ConnectionV6, Direction, RedirectInfo, Verdict, PM_DNS_PORT,
+    PM_SPN_PORT,
+};
+use crate::connection_cache::ConnectionCache;
+use crate::connection_map::Key;
+use crate::device::{Device, Packet};
+use crate::packet_util::{get_key_from_nbl_v4, get_key_from_nbl_v6, Redirect};
+
+// IP packet layers
+pub fn ip_packet_layer_outbound_v4(data: CalloutData) {
+    type Fields = layer::FieldsOutboundIppacketV4;
+    let interface_index = data.get_value_u32(Fields::InterfaceIndex as usize);
+    let sub_interface_index = data.get_value_u32(Fields::SubInterfaceIndex as usize);
+
+    ip_packet_layer(
+        data,
+        false,
+        Direction::Outbound,
+        interface_index,
+        sub_interface_index,
+    );
+}
+
+pub fn ip_packet_layer_inbound_v4(data: CalloutData) {
+    type Fields = layer::FieldsInboundIppacketV4;
+    let interface_index = data.get_value_u32(Fields::InterfaceIndex as usize);
+    let sub_interface_index = data.get_value_u32(Fields::SubInterfaceIndex as usize);
+    ip_packet_layer(
+        data,
+        false,
+        Direction::Inbound,
+        interface_index,
+        sub_interface_index,
+    );
+}
+
+pub fn ip_packet_layer_outbound_v6(data: CalloutData) {
+    type Fields = layer::FieldsOutboundIppacketV6;
+    let interface_index = data.get_value_u32(Fields::InterfaceIndex as usize);
+    let sub_interface_index = data.get_value_u32(Fields::SubInterfaceIndex as usize);
+
+    ip_packet_layer(
+        data,
+        true,
+        Direction::Outbound,
+        interface_index,
+        sub_interface_index,
+    );
+}
+
+pub fn ip_packet_layer_inbound_v6(data: CalloutData) {
+    type Fields = layer::FieldsInboundIppacketV6;
+    let interface_index = data.get_value_u32(Fields::InterfaceIndex as usize);
+    let sub_interface_index = data.get_value_u32(Fields::SubInterfaceIndex as usize);
+
+    ip_packet_layer(
+        data,
+        true,
+        Direction::Inbound,
+        interface_index,
+        sub_interface_index,
+    );
+}
+
+struct ConnectionInfo {
+    verdict: Verdict,
+    process_id: u64,
+    redirect_info: Option<RedirectInfo>,
+}
+
+impl ConnectionInfo {
+    fn from_connection<T: Connection>(conn: &T) -> Self {
+        ConnectionInfo {
+            verdict: conn.get_verdict(),
+            process_id: conn.get_process_id(),
+            redirect_info: conn.redirect_info(),
+        }
+    }
+}
+
+fn fast_track_pm_packets(key: &Key, direction: Direction) -> bool {
+    match direction {
+        Direction::Outbound => {
+            if key.local_port == PM_DNS_PORT || key.local_port == PM_SPN_PORT {
+                return key.local_address == key.remote_address;
+            }
+        }
+        Direction::Inbound => {
+            if key.local_port == PM_DNS_PORT || key.local_port == PM_SPN_PORT {
+                return key.local_address == key.remote_address;
+            }
+        }
+    }
+
+    return false;
+}
+
+fn ip_packet_layer(
+    mut data: CalloutData,
+    ipv6: bool,
+    direction: Direction,
+    interface_index: u32,
+    sub_interface_index: u32,
+) {
+    let Some(device) = crate::entry::get_device() else {
+        return;
+    };
+    if device
+        .injector
+        .was_network_packet_injected_by_self(data.get_layer_data() as _, ipv6)
+    {
+        data.action_permit();
+        return;
+    }
+
+    for mut nbl in NetBufferListIter::new(data.get_layer_data() as _) {
+        if let Direction::Inbound = direction {
+            // The header is not part of the NBL for incoming packets. Move the beginning of the buffer back so we get access to it.
+            // The NBL will auto advance after it loses scope.
+            if ipv6 {
+                nbl.retreat(IPV6_HEADER_LEN as u32, true);
+            } else {
+                nbl.retreat(IPV4_HEADER_LEN as u32, true);
+            }
+        }
+
+        // Get key from packet.
+        let key = match if ipv6 {
+            get_key_from_nbl_v6(&nbl, direction)
+        } else {
+            get_key_from_nbl_v4(&nbl, direction)
+        } {
+            Ok(key) => key,
+            Err(err) => {
+                crate::dbg!("failed to get key from nbl: {}", err);
+                return;
+            }
+        };
+
+        if fast_track_pm_packets(&key, direction) {
+            data.action_permit();
+            return;
+        }
+
+        let mut send_request_to_portmaster = true;
+        let mut process_id = 0;
+
+        if matches!(
+            key.protocol,
+            smoltcp::wire::IpProtocol::Tcp | smoltcp::wire::IpProtocol::Udp
+        ) {
+            if let Some(mut conn_info) =
+                get_connection_info(&mut device.connection_cache, &key, ipv6)
+            {
+                process_id = conn_info.process_id;
+                // Check if there is action for this connection.
+                match conn_info.verdict {
+                    Verdict::Undecided | Verdict::Accept | Verdict::Block | Verdict::Drop => {}
+                    Verdict::PermanentAccept => {
+                        send_request_to_portmaster = false;
+                        data.action_permit();
+                    }
+                    Verdict::PermanentBlock => {
+                        send_request_to_portmaster = false;
+                        data.action_block();
+                    }
+                    Verdict::Undeterminable | Verdict::PermanentDrop | Verdict::Failed => {
+                        send_request_to_portmaster = false;
+                        data.block_and_absorb();
+                    }
+                    Verdict::RedirectNameServer | Verdict::RedirectTunnel => {
+                        if let Some(redirect_info) = conn_info.redirect_info.take() {
+                            match clone_packet(
+                                device,
+                                nbl,
+                                direction,
+                                ipv6,
+                                key.is_loopback(),
+                                interface_index,
+                                sub_interface_index,
+                            ) {
+                                Ok(mut packet) => {
+                                    let _ = packet.redirect(redirect_info);
+                                    if let Err(err) = device.inject_packet(packet, false) {
+                                        crate::err!("failed to inject packet: {}", err);
+                                    }
+                                }
+                                Err(err) => crate::err!("failed to clone packet: {}", err),
+                            }
+                        }
+
+                        // This will block the original packet. Even if injection failed.
+                        data.block_and_absorb();
+                        continue;
+                    }
+                }
+            } else {
+                // Connections is not in the cache.
+                crate::dbg!("packet layer adding connection: {} PID: 0", key);
+                if ipv6 {
+                    let conn = ConnectionV6::from_key(&key, 0, direction).unwrap();
+                    device.connection_cache.add_connection_v6(conn);
+                } else {
+                    let conn = ConnectionV4::from_key(&key, 0, direction).unwrap();
+                    device.connection_cache.add_connection_v4(conn);
+                }
+            }
+        }
+
+        // Clone packet and send to Portmaster.
+        if send_request_to_portmaster {
+            let packet = match clone_packet(
+                device,
+                nbl,
+                direction,
+                ipv6,
+                key.is_loopback(),
+                interface_index,
+                sub_interface_index,
+            ) {
+                Ok(p) => p,
+                Err(err) => {
+                    crate::err!("failed to clone packet: {}", err);
+                    return;
+                }
+            };
+
+            let info = device
+                .packet_cache
+                .push((key, packet), process_id, direction, false);
+
+            // Send to Portmaster
+            if let Some(info) = info {
+                let _ = device.event_queue.push(info);
+            }
+            data.block_and_absorb();
+        }
+    }
+}
+
+fn clone_packet(
+    device: &mut Device,
+    nbl: NetBufferList,
+    direction: Direction,
+    ipv6: bool,
+    loopback: bool,
+    interface_index: u32,
+    sub_interface_index: u32,
+) -> Result<Packet, String> {
+    let clone = nbl.clone(&device.network_allocator)?;
+    let inbound = match direction {
+        Direction::Outbound => false,
+        Direction::Inbound => true,
+    };
+    Ok(Packet::PacketLayer(
+        clone,
+        InjectInfo {
+            ipv6,
+            inbound,
+            loopback,
+            interface_index,
+            sub_interface_index,
+        },
+    ))
+}
+
+fn get_connection_info(
+    connection_cache: &mut ConnectionCache,
+    key: &Key,
+    ipv6: bool,
+) -> Option<ConnectionInfo> {
+    if ipv6 {
+        let conn_info = connection_cache.read_connection_v6(
+            key,
+            |conn: &ConnectionV6| -> Option<ConnectionInfo> {
+                // Function is is behind spin lock. Just copy and return.
+                Some(ConnectionInfo::from_connection(conn))
+            },
+        );
+        return conn_info;
+    } else {
+        let conn_info = connection_cache.read_connection_v4(
+            key,
+            |conn: &ConnectionV4| -> Option<ConnectionInfo> {
+                // Function is is behind spin lock. Just copy and return.
+                Some(ConnectionInfo::from_connection(conn))
+            },
+        );
+        return conn_info;
+    }
+}

windows_kext/driver/src/packet_util.rs

@@ -0,0 +1,399 @@
+use alloc::string::{String, ToString};
+use smoltcp::wire::{
+    IpAddress, IpProtocol, Ipv4Address, Ipv4Packet, Ipv6Address, Ipv6Packet, TcpPacket, UdpPacket,
+};
+use wdk::filter_engine::net_buffer::NetBufferList;
+
+use crate::connection_map::Key;
+use crate::device::Packet;
+use crate::{
+    connection::{Direction, RedirectInfo},
+    dbg, err,
+};
+
+/// `Redirect` is a trait that defines a method for redirecting network packets.
+///
+/// This trait is used to implement different strategies for redirecting packets,
+/// depending on the specific requirements of the application.
+pub trait Redirect {
+    /// Redirects a network packet based on the provided `RedirectInfo`.
+    ///
+    /// # Arguments
+    ///
+    /// * `redirect_info` - A struct containing information about how to redirect the packet.
+    ///
+    /// # Returns
+    ///
+    /// * `Ok(())` if the packet was successfully redirected.
+    /// * `Err(String)` if there was an error redirecting the packet.
+    fn redirect(&mut self, redirect_info: RedirectInfo) -> Result<(), String>;
+}
+
+impl Redirect for Packet {
+    fn redirect(&mut self, redirect_info: RedirectInfo) -> Result<(), String> {
+        if let Packet::PacketLayer(nbl, inject_info) = self {
+            let Some(data) = nbl.get_data_mut() else {
+                return Err("trying to redirect immutable NBL".to_string());
+            };
+
+            if inject_info.inbound {
+                redirect_inbound_packet(
+                    data,
+                    redirect_info.local_address,
+                    redirect_info.remote_address,
+                    redirect_info.remote_port,
+                )
+            } else {
+                redirect_outbound_packet(
+                    data,
+                    redirect_info.redirect_address,
+                    redirect_info.redirect_port,
+                    redirect_info.unify,
+                )
+            }
+            return Ok(());
+        }
+        // return Err("can't redirect from non packet layer".to_string());
+        return Ok(());
+    }
+}
+
+/// Redirects an outbound packet to a specified remote address and port.
+///
+/// # Arguments
+///
+/// * `packet` - A mutable reference to the packet data.
+/// * `remote_address` - The IP address to redirect the packet to.
+/// * `remote_port` - The port to redirect the packet to.
+/// * `unify` - If true, the source and destination addresses of the packet will be set to the same value.
+///
+/// This function modifies the packet in-place to change its destination address and port.
+/// It also updates the checksums for the IP and transport layer headers.
+/// If the `unify` parameter is true, it sets the source and destination addresses to be the same.
+/// If the remote address is a loopback address, it sets the source address to the loopback address.
+fn redirect_outbound_packet(
+    packet: &mut [u8],
+    remote_address: IpAddress,
+    remote_port: u16,
+    unify: bool,
+) {
+    match remote_address {
+        IpAddress::Ipv4(remote_address) => {
+            if let Ok(mut ip_packet) = Ipv4Packet::new_checked(packet) {
+                if unify {
+                    ip_packet.set_dst_addr(ip_packet.src_addr());
+                } else {
+                    ip_packet.set_dst_addr(remote_address);
+                    if remote_address.is_loopback() {
+                        ip_packet.set_src_addr(Ipv4Address::new(127, 0, 0, 1));
+                    }
+                }
+                ip_packet.fill_checksum();
+                let src_addr = ip_packet.src_addr();
+                let dst_addr = ip_packet.dst_addr();
+                if ip_packet.next_header() == IpProtocol::Udp {
+                    if let Ok(mut udp_packet) = UdpPacket::new_checked(ip_packet.payload_mut()) {
+                        udp_packet.set_dst_port(remote_port);
+                        udp_packet
+                            .fill_checksum(&IpAddress::Ipv4(src_addr), &IpAddress::Ipv4(dst_addr));
+                    }
+                }
+                if ip_packet.next_header() == IpProtocol::Tcp {
+                    if let Ok(mut tcp_packet) = TcpPacket::new_checked(ip_packet.payload_mut()) {
+                        tcp_packet.set_dst_port(remote_port);
+                        tcp_packet
+                            .fill_checksum(&IpAddress::Ipv4(src_addr), &IpAddress::Ipv4(dst_addr));
+                    }
+                }
+            }
+        }
+        IpAddress::Ipv6(remote_address) => {
+            if let Ok(mut ip_packet) = Ipv6Packet::new_checked(packet) {
+                ip_packet.set_dst_addr(remote_address);
+                if unify {
+                    ip_packet.set_dst_addr(ip_packet.src_addr());
+                } else {
+                    ip_packet.set_dst_addr(remote_address);
+                    if remote_address.is_loopback() {
+                        ip_packet.set_src_addr(Ipv6Address::LOOPBACK);
+                    }
+                }
+                let src_addr = ip_packet.src_addr();
+                let dst_addr = ip_packet.dst_addr();
+                if ip_packet.next_header() == IpProtocol::Udp {
+                    if let Ok(mut udp_packet) = UdpPacket::new_checked(ip_packet.payload_mut()) {
+                        udp_packet.set_dst_port(remote_port);
+                        udp_packet
+                            .fill_checksum(&IpAddress::Ipv6(src_addr), &IpAddress::Ipv6(dst_addr));
+                    }
+                }
+                if ip_packet.next_header() == IpProtocol::Tcp {
+                    if let Ok(mut tcp_packet) = TcpPacket::new_checked(ip_packet.payload_mut()) {
+                        tcp_packet.set_dst_port(remote_port);
+                        tcp_packet
+                            .fill_checksum(&IpAddress::Ipv6(src_addr), &IpAddress::Ipv6(dst_addr));
+                    }
+                }
+            }
+        }
+    }
+}
+
+/// Redirects an inbound packet to a local address.
+///
+/// This function takes a mutable reference to a packet and modifies it in place.
+/// It changes the destination address to the provided local address and the source address
+/// to the original remote address. It also sets the source port to the original remote port.
+/// The function handles both IPv4 and IPv6 addresses.
+///
+/// # Arguments
+///
+/// * `packet` - A mutable reference to the packet data.
+/// * `local_address` - The local IP address to redirect the packet to.
+/// * `original_remote_address` - The original remote IP address of the packet.
+/// * `original_remote_port` - The original remote port of the packet.
+///
+fn redirect_inbound_packet(
+    packet: &mut [u8],
+    local_address: IpAddress,
+    original_remote_address: IpAddress,
+    original_remote_port: u16,
+) {
+    match local_address {
+        IpAddress::Ipv4(local_address) => {
+            let IpAddress::Ipv4(original_remote_address) = original_remote_address else {
+                return;
+            };
+
+            if let Ok(mut ip_packet) = Ipv4Packet::new_checked(packet) {
+                ip_packet.set_dst_addr(local_address);
+                ip_packet.set_src_addr(original_remote_address);
+                ip_packet.fill_checksum();
+                let src_addr = ip_packet.src_addr();
+                let dst_addr = ip_packet.dst_addr();
+                if ip_packet.next_header() == IpProtocol::Udp {
+                    if let Ok(mut udp_packet) = UdpPacket::new_checked(ip_packet.payload_mut()) {
+                        udp_packet.set_src_port(original_remote_port);
+                        udp_packet
+                            .fill_checksum(&IpAddress::Ipv4(src_addr), &IpAddress::Ipv4(dst_addr));
+                    }
+                }
+                if ip_packet.next_header() == IpProtocol::Tcp {
+                    if let Ok(mut tcp_packet) = TcpPacket::new_checked(ip_packet.payload_mut()) {
+                        tcp_packet.set_src_port(original_remote_port);
+                        tcp_packet
+                            .fill_checksum(&IpAddress::Ipv4(src_addr), &IpAddress::Ipv4(dst_addr));
+                    }
+                }
+            }
+        }
+        IpAddress::Ipv6(local_address) => {
+            if let Ok(mut ip_packet) = Ipv6Packet::new_checked(packet) {
+                let IpAddress::Ipv6(original_remote_address) = original_remote_address else {
+                    return;
+                };
+                ip_packet.set_dst_addr(local_address);
+                ip_packet.set_src_addr(original_remote_address);
+                let src_addr = ip_packet.src_addr();
+                let dst_addr = ip_packet.dst_addr();
+                if ip_packet.next_header() == IpProtocol::Udp {
+                    if let Ok(mut udp_packet) = UdpPacket::new_checked(ip_packet.payload_mut()) {
+                        udp_packet.set_src_port(original_remote_port);
+                        udp_packet
+                            .fill_checksum(&IpAddress::Ipv6(src_addr), &IpAddress::Ipv6(dst_addr));
+                    }
+                }
+                if ip_packet.next_header() == IpProtocol::Tcp {
+                    if let Ok(mut tcp_packet) = TcpPacket::new_checked(ip_packet.payload_mut()) {
+                        tcp_packet.set_src_port(original_remote_port);
+                        tcp_packet
+                            .fill_checksum(&IpAddress::Ipv6(src_addr), &IpAddress::Ipv6(dst_addr));
+                    }
+                }
+            }
+        }
+    }
+}
+
+#[allow(dead_code)]
+fn print_packet(packet: &[u8]) {
+    if let Ok(ip_packet) = Ipv4Packet::new_checked(packet) {
+        if ip_packet.next_header() == IpProtocol::Udp {
+            if let Ok(udp_packet) = UdpPacket::new_checked(ip_packet.payload()) {
+                dbg!("packet {} {}", ip_packet, udp_packet);
+            }
+        }
+        if ip_packet.next_header() == IpProtocol::Tcp {
+            if let Ok(tcp_packet) = TcpPacket::new_checked(ip_packet.payload()) {
+                dbg!("packet {} {}", ip_packet, tcp_packet);
+            }
+        }
+    } else {
+        err!("failed to print packet: invalid ip header: {:?}", packet);
+    }
+}
+
+/// This function extracts a key from a given IPv4 network buffer list (NBL).
+/// The key contains the protocol, local and remote addresses and ports.
+///
+/// # Arguments
+///
+/// * `nbl` - A reference to the network buffer list from which the key will be extracted.
+/// * `direction` - The direction of the packet (Inbound or Outbound).
+///
+/// # Returns
+///
+/// * `Ok(Key)` - A key containing the protocol, local and remote addresses and ports.
+/// * `Err(String)` - An error message if the function fails to get net_buffer data.
+const HEADERS_LEN: usize = smoltcp::wire::IPV4_HEADER_LEN + smoltcp::wire::TCP_HEADER_LEN;
+
+fn get_ports(packet: &[u8], protocol: smoltcp::wire::IpProtocol) -> (u16, u16) {
+    match protocol {
+        smoltcp::wire::IpProtocol::Tcp => {
+            let tcp_packet = TcpPacket::new_unchecked(packet);
+            (tcp_packet.src_port(), tcp_packet.dst_port())
+        }
+        smoltcp::wire::IpProtocol::Udp => {
+            let udp_packet = UdpPacket::new_unchecked(packet);
+            (udp_packet.src_port(), udp_packet.dst_port())
+        }
+        _ => (0, 0), // No ports for other protocols
+    }
+}
+
+pub fn get_key_from_nbl_v4(nbl: &NetBufferList, direction: Direction) -> Result<Key, String> {
+    // Get bytes
+    let mut headers = [0; HEADERS_LEN];
+    if nbl.read_bytes(&mut headers).is_err() {
+        return Err("failed to get net_buffer data".to_string());
+    }
+
+    // Parse packet
+    let ip_packet = Ipv4Packet::new_unchecked(&headers);
+    let (src_port, dst_port) = get_ports(
+        &headers[smoltcp::wire::IPV4_HEADER_LEN..],
+        ip_packet.next_header(),
+    );
+
+    // Build key
+    match direction {
+        Direction::Outbound => Ok(Key {
+            protocol: ip_packet.next_header(),
+            local_address: IpAddress::Ipv4(ip_packet.src_addr()),
+            local_port: src_port,
+            remote_address: IpAddress::Ipv4(ip_packet.dst_addr()),
+            remote_port: dst_port,
+        }),
+        Direction::Inbound => Ok(Key {
+            protocol: ip_packet.next_header(),
+            local_address: IpAddress::Ipv4(ip_packet.dst_addr()),
+            local_port: dst_port,
+            remote_address: IpAddress::Ipv4(ip_packet.src_addr()),
+            remote_port: src_port,
+        }),
+    }
+}
+
+/// This function extracts a key from a given IPv6 network buffer list (NBL).
+/// The key contains the protocol, local and remote addresses and ports.
+///
+/// # Arguments
+///
+/// * `nbl` - A reference to the network buffer list from which the key will be extracted.
+/// * `direction` - The direction of the packet (Inbound or Outbound).
+///
+/// # Returns
+///
+/// * `Ok(Key)` - A key containing the protocol, local and remote addresses and ports.
+/// * `Err(String)` - An error message if the function fails to get net_buffer data.
+pub fn get_key_from_nbl_v6(nbl: &NetBufferList, direction: Direction) -> Result<Key, String> {
+    // Get bytes
+    let mut headers = [0; smoltcp::wire::IPV6_HEADER_LEN + smoltcp::wire::TCP_HEADER_LEN];
+    let Ok(()) = nbl.read_bytes(&mut headers) else {
+        return Err("failed to get net_buffer data".to_string());
+    };
+    // Parse packet
+    let ip_packet = Ipv6Packet::new_unchecked(&headers);
+    let (src_port, dst_port) = get_ports(
+        &headers[smoltcp::wire::IPV6_HEADER_LEN..],
+        ip_packet.next_header(),
+    );
+
+    // Build key
+    match direction {
+        Direction::Outbound => Ok(Key {
+            protocol: ip_packet.next_header(),
+            local_address: IpAddress::Ipv6(ip_packet.src_addr()),
+            local_port: src_port,
+            remote_address: IpAddress::Ipv6(ip_packet.dst_addr()),
+            remote_port: dst_port,
+        }),
+        Direction::Inbound => Ok(Key {
+            protocol: ip_packet.next_header(),
+            local_address: IpAddress::Ipv6(ip_packet.dst_addr()),
+            local_port: dst_port,
+            remote_address: IpAddress::Ipv6(ip_packet.src_addr()),
+            remote_port: src_port,
+        }),
+    }
+}
+
+// Converts a given key into connection information.
+//
+// This function takes a key, packet id, process id, and direction as input.
+// It then uses these to create a new `ConnectionInfoV6` or `ConnectionInfoV4` object,
+// depending on whether the IP addresses in the key are IPv6 or IPv4 respectively.
+//
+// # Arguments
+//
+// * `key` - A reference to the key object containing the connection details.
+// * `packet_id` - The id of the packet.
+// * `process_id` - The id of the process.
+// * `direction` - The direction of the connection.
+//
+// # Returns
+//
+// * `Some(Box<dyn Info>)` - A boxed `Info` trait object if the key contains valid IPv4 or IPv6 addresses.
+// * `None` - If the key does not contain valid IPv4 or IPv6 addresses.
+// pub fn key_to_connection_info(
+//     key: &Key,
+//     packet_id: u64,
+//     process_id: u64,
+//     direction: Direction,
+//     payload: &[u8],
+// ) -> Option<Info> {
+//     let (local_port, remote_port) = match key.protocol {
+//         IpProtocol::Tcp | IpProtocol::Udp => (key.local_port, key.remote_port),
+//         _ => (0, 0),
+//     };
+
+//     match (key.local_address, key.remote_address) {
+//         (IpAddress::Ipv6(local_ip), IpAddress::Ipv6(remote_ip)) if key.is_ipv6() => {
+//             Some(protocol::info::connection_info_v6(
+//                 packet_id,
+//                 process_id,
+//                 direction as u8,
+//                 u8::from(key.protocol),
+//                 local_ip.0,
+//                 remote_ip.0,
+//                 local_port,
+//                 remote_port,
+//                 payload,
+//             ))
+//         }
+//         (IpAddress::Ipv4(local_ip), IpAddress::Ipv4(remote_ip)) => {
+//             Some(protocol::info::connection_info_v4(
+//                 packet_id,
+//                 process_id,
+//                 direction as u8,
+//                 u8::from(key.protocol),
+//                 local_ip.0,
+//                 remote_ip.0,
+//                 local_port,
+//                 remote_port,
+//                 payload,
+//             ))
+//         }
+//         _ => None,
+//     }
+// }

windows_kext/driver/src/stream_callouts.rs

@@ -0,0 +1,203 @@
+use smoltcp::wire::{Ipv4Address, Ipv6Address};
+use wdk::filter_engine::{callout_data::CalloutData, layer, net_buffer::NetBufferListIter};
+
+use crate::{bandwidth, connection::Direction};
+
+pub fn stream_layer_tcp_v4(data: CalloutData) {
+    let Some(device) = crate::entry::get_device() else {
+        return;
+    };
+    let mut direction = Direction::Outbound;
+    let data_length = if let Some(packet) = data.get_stream_callout_packet() {
+        if packet.is_receive() {
+            direction = Direction::Inbound;
+        }
+        packet.get_data_len()
+    } else {
+        return;
+    };
+    type Fields = layer::FieldsStreamV4;
+    let local_ip = Ipv4Address::from_bytes(
+        &data
+            .get_value_u32(Fields::IpLocalAddress as usize)
+            .to_be_bytes(),
+    );
+    let local_port = data.get_value_u16(Fields::IpLocalPort as usize);
+    let remote_ip = Ipv4Address::from_bytes(
+        &data
+            .get_value_u32(Fields::IpRemoteAddress as usize)
+            .to_be_bytes(),
+    );
+    let remote_port = data.get_value_u16(Fields::IpRemotePort as usize);
+    match direction {
+        Direction::Outbound => {
+            device.bandwidth_stats.update_tcp_v4_tx(
+                bandwidth::Key {
+                    local_ip,
+                    local_port,
+                    remote_ip,
+                    remote_port,
+                },
+                data_length,
+            );
+        }
+        Direction::Inbound => {
+            device.bandwidth_stats.update_tcp_v4_rx(
+                bandwidth::Key {
+                    local_ip,
+                    local_port,
+                    remote_ip,
+                    remote_port,
+                },
+                data_length,
+            );
+        }
+    }
+}
+
+pub fn stream_layer_tcp_v6(data: CalloutData) {
+    let Some(device) = crate::entry::get_device() else {
+        return;
+    };
+    let mut direction = Direction::Outbound;
+    let data_length = if let Some(packet) = data.get_stream_callout_packet() {
+        if packet.is_receive() {
+            direction = Direction::Inbound;
+        }
+        packet.get_data_len()
+    } else {
+        return;
+    };
+    type Fields = layer::FieldsStreamV6;
+    if data_length == 0 {
+        return;
+    }
+    let local_ip =
+        Ipv6Address::from_bytes(data.get_value_byte_array16(Fields::IpLocalAddress as usize));
+    let local_port = data.get_value_u16(Fields::IpLocalPort as usize);
+    let remote_ip =
+        Ipv6Address::from_bytes(data.get_value_byte_array16(Fields::IpRemoteAddress as usize));
+    let remote_port = data.get_value_u16(Fields::IpRemotePort as usize);
+    match direction {
+        Direction::Outbound => {
+            device.bandwidth_stats.update_tcp_v6_tx(
+                bandwidth::Key {
+                    local_ip,
+                    local_port,
+                    remote_ip,
+                    remote_port,
+                },
+                data_length,
+            );
+        }
+        Direction::Inbound => {
+            device.bandwidth_stats.update_tcp_v6_rx(
+                bandwidth::Key {
+                    local_ip,
+                    local_port,
+                    remote_ip,
+                    remote_port,
+                },
+                data_length,
+            );
+        }
+    }
+}
+
+pub fn stream_layer_udp_v4(data: CalloutData) {
+    let Some(device) = crate::entry::get_device() else {
+        return;
+    };
+    let mut data_length: usize = 0;
+    for nbl in NetBufferListIter::new(data.get_layer_data() as _) {
+        data_length += nbl.get_data_length() as usize;
+    }
+    type Fields = layer::FieldsDatagramDataV4;
+    let mut direction = Direction::Inbound;
+    if data.get_value_u8(Fields::Direction as usize) == 0 {
+        direction = Direction::Outbound;
+    }
+
+    let local_ip = Ipv4Address::from_bytes(
+        &data
+            .get_value_u32(Fields::IpLocalAddress as usize)
+            .to_be_bytes(),
+    );
+    let local_port = data.get_value_u16(Fields::IpLocalPort as usize);
+    let remote_ip = Ipv4Address::from_bytes(
+        &data
+            .get_value_u32(Fields::IpRemoteAddress as usize)
+            .to_be_bytes(),
+    );
+    let remote_port = data.get_value_u16(Fields::IpRemotePort as usize);
+    match direction {
+        Direction::Outbound => {
+            device.bandwidth_stats.update_udp_v4_tx(
+                bandwidth::Key {
+                    local_ip,
+                    local_port,
+                    remote_ip,
+                    remote_port,
+                },
+                data_length,
+            );
+        }
+        Direction::Inbound => {
+            device.bandwidth_stats.update_udp_v4_rx(
+                bandwidth::Key {
+                    local_ip,
+                    local_port,
+                    remote_ip,
+                    remote_port,
+                },
+                data_length,
+            );
+        }
+    }
+}
+
+pub fn stream_layer_udp_v6(data: CalloutData) {
+    let Some(device) = crate::entry::get_device() else {
+        return;
+    };
+    let mut data_length: usize = 0;
+    for nbl in NetBufferListIter::new(data.get_layer_data() as _) {
+        data_length += nbl.get_data_length() as usize;
+    }
+    type Fields = layer::FieldsDatagramDataV6;
+    let mut direction = Direction::Inbound;
+    if data.get_value_u8(Fields::Direction as usize) == 0 {
+        direction = Direction::Outbound;
+    }
+
+    let local_ip =
+        Ipv6Address::from_bytes(data.get_value_byte_array16(Fields::IpLocalAddress as usize));
+    let local_port = data.get_value_u16(Fields::IpLocalPort as usize);
+    let remote_ip =
+        Ipv6Address::from_bytes(data.get_value_byte_array16(Fields::IpRemoteAddress as usize));
+    let remote_port = data.get_value_u16(Fields::IpRemotePort as usize);
+    match direction {
+        Direction::Outbound => {
+            device.bandwidth_stats.update_udp_v6_tx(
+                bandwidth::Key {
+                    local_ip,
+                    local_port,
+                    remote_ip,
+                    remote_port,
+                },
+                data_length,
+            );
+        }
+        Direction::Inbound => {
+            device.bandwidth_stats.update_udp_v6_rx(
+                bandwidth::Key {
+                    local_ip,
+                    local_port,
+                    remote_ip,
+                    remote_port,
+                },
+                data_length,
+            );
+        }
+    }
+}

windows_kext/kextinterface/command.go

@@ -0,0 +1,119 @@
+package kextinterface
+
+import (
+	"encoding/binary"
+	"io"
+)
+
+// Command IDs.
+const (
+	CommandShutdown              = 0
+	CommandVerdict               = 1
+	CommandUpdateV4              = 2
+	CommandUpdateV6              = 3
+	CommandClearCache            = 4
+	CommandGetLogs               = 5
+	CommandBandwidthStats        = 6
+	CommandPrintMemoryStats      = 7
+	CommandCleanEndedConnections = 8
+)
+
+// KextVerdict is the verdict ID used to with the kext.
+type KextVerdict uint8
+
+// Kext Verdicts.
+// Make sure this is in sync with the Rust version.
+const (
+	// VerdictUndecided is the default status of new connections.
+	VerdictUndecided           KextVerdict = 0
+	VerdictUndeterminable      KextVerdict = 1
+	VerdictAccept              KextVerdict = 2
+	VerdictPermanentAccept     KextVerdict = 3
+	VerdictBlock               KextVerdict = 4
+	VerdictPermanentBlock      KextVerdict = 5
+	VerdictDrop                KextVerdict = 6
+	VerdictPermanentDrop       KextVerdict = 7
+	VerdictRerouteToNameserver KextVerdict = 8
+	VerdictRerouteToTunnel     KextVerdict = 9
+	VerdictFailed              KextVerdict = 10
+)
+
+type Verdict struct {
+	command uint8
+	ID      uint64
+	Verdict uint8
+}
+
+type UpdateV4 struct {
+	command       uint8
+	Protocol      uint8
+	LocalAddress  [4]byte
+	LocalPort     uint16
+	RemoteAddress [4]byte
+	RemotePort    uint16
+	Verdict       uint8
+}
+
+type UpdateV6 struct {
+	command       uint8
+	Protocol      uint8
+	LocalAddress  [16]byte
+	LocalPort     uint16
+	RemoteAddress [16]byte
+	RemotePort    uint16
+	Verdict       uint8
+}
+
+// SendShutdownCommand sends a Shutdown command to the kext.
+func SendShutdownCommand(writer io.Writer) error {
+	_, err := writer.Write([]byte{CommandShutdown})
+	return err
+}
+
+// SendVerdictCommand sends a Verdict command to the kext.
+func SendVerdictCommand(writer io.Writer, verdict Verdict) error {
+	verdict.command = CommandVerdict
+	return binary.Write(writer, binary.LittleEndian, verdict)
+}
+
+// SendUpdateV4Command sends a UpdateV4 command to the kext.
+func SendUpdateV4Command(writer io.Writer, update UpdateV4) error {
+	update.command = CommandUpdateV4
+	return binary.Write(writer, binary.LittleEndian, update)
+}
+
+// SendUpdateV6Command sends a UpdateV6 command to the kext.
+func SendUpdateV6Command(writer io.Writer, update UpdateV6) error {
+	update.command = CommandUpdateV6
+	return binary.Write(writer, binary.LittleEndian, update)
+}
+
+// SendClearCacheCommand sends a ClearCache command to the kext.
+func SendClearCacheCommand(writer io.Writer) error {
+	_, err := writer.Write([]byte{CommandClearCache})
+	return err
+}
+
+// SendGetLogsCommand sends a GetLogs command to the kext.
+func SendGetLogsCommand(writer io.Writer) error {
+	_, err := writer.Write([]byte{CommandGetLogs})
+	return err
+}
+
+// SendGetBandwidthStatsCommand sends a GetBandwidthStats command to the kext.
+func SendGetBandwidthStatsCommand(writer io.Writer) error {
+	_, err := writer.Write([]byte{CommandBandwidthStats})
+	return err
+}
+
+// SendPrintMemoryStatsCommand sends a PrintMemoryStats command to the kext.
+func SendPrintMemoryStatsCommand(writer io.Writer) error {
+	_, err := writer.Write([]byte{CommandPrintMemoryStats})
+	return err
+}
+
+// SendCleanEndedConnectionsCommand sends a CleanEndedConnections command to the kext.
+func SendCleanEndedConnectionsCommand(writer io.Writer) error {
+	_, err := writer.Write([]byte{CommandCleanEndedConnections})
+	return err
+}

windows_kext/kextinterface/info.go

@@ -0,0 +1,383 @@
+package kextinterface
+
+import (
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"io"
+)
+
+const (
+	InfoLogLine              = 0
+	InfoConnectionIpv4       = 1
+	InfoConnectionIpv6       = 2
+	InfoConnectionEndEventV4 = 3
+	InfoConnectionEndEventV6 = 4
+	InfoBandwidthStatsV4     = 5
+	InfoBandwidthStatsV6     = 6
+)
+
+var (
+	ErrUnknownInfoType     = errors.New("unknown info type")
+	ErrUnexpectedInfoSize  = errors.New("unexpected info size")
+	ErrUnexpectedReadError = errors.New("unexpected read error")
+)
+
+type connectionV4Internal struct {
+	ID           uint64
+	ProcessID    uint64
+	Direction    byte
+	Protocol     byte
+	LocalIP      [4]byte
+	RemoteIP     [4]byte
+	LocalPort    uint16
+	RemotePort   uint16
+	PayloadLayer uint8
+}
+
+type ConnectionV4 struct {
+	connectionV4Internal
+	Payload []byte
+}
+
+func (c *ConnectionV4) Compare(other *ConnectionV4) bool {
+	return c.ID == other.ID &&
+		c.ProcessID == other.ProcessID &&
+		c.Direction == other.Direction &&
+		c.Protocol == other.Protocol &&
+		c.LocalIP == other.LocalIP &&
+		c.RemoteIP == other.RemoteIP &&
+		c.LocalPort == other.LocalPort &&
+		c.RemotePort == other.RemotePort
+}
+
+type connectionV6Internal struct {
+	ID           uint64
+	ProcessID    uint64
+	Direction    byte
+	Protocol     byte
+	LocalIP      [16]byte
+	RemoteIP     [16]byte
+	LocalPort    uint16
+	RemotePort   uint16
+	PayloadLayer uint8
+}
+
+type ConnectionV6 struct {
+	connectionV6Internal
+	Payload []byte
+}
+
+func (c ConnectionV6) Compare(other *ConnectionV6) bool {
+	return c.ID == other.ID &&
+		c.ProcessID == other.ProcessID &&
+		c.Direction == other.Direction &&
+		c.Protocol == other.Protocol &&
+		c.LocalIP == other.LocalIP &&
+		c.RemoteIP == other.RemoteIP &&
+		c.LocalPort == other.LocalPort &&
+		c.RemotePort == other.RemotePort
+}
+
+type ConnectionEndV4 struct {
+	ProcessID  uint64
+	Direction  byte
+	Protocol   byte
+	LocalIP    [4]byte
+	RemoteIP   [4]byte
+	LocalPort  uint16
+	RemotePort uint16
+}
+
+type ConnectionEndV6 struct {
+	ProcessID  uint64
+	Direction  byte
+	Protocol   byte
+	LocalIP    [16]byte
+	RemoteIP   [16]byte
+	LocalPort  uint16
+	RemotePort uint16
+}
+
+type LogLine struct {
+	Severity byte
+	Line     string
+}
+
+type BandwidthValueV4 struct {
+	LocalIP          [4]byte
+	LocalPort        uint16
+	RemoteIP         [4]byte
+	RemotePort       uint16
+	TransmittedBytes uint64
+	ReceivedBytes    uint64
+}
+
+type BandwidthValueV6 struct {
+	LocalIP          [16]byte
+	LocalPort        uint16
+	RemoteIP         [16]byte
+	RemotePort       uint16
+	TransmittedBytes uint64
+	ReceivedBytes    uint64
+}
+
+type BandwidthStatsArray struct {
+	Protocol uint8
+	ValuesV4 []BandwidthValueV4
+	ValuesV6 []BandwidthValueV6
+}
+
+type Info struct {
+	ConnectionV4    *ConnectionV4
+	ConnectionV6    *ConnectionV6
+	ConnectionEndV4 *ConnectionEndV4
+	ConnectionEndV6 *ConnectionEndV6
+	LogLine         *LogLine
+	BandwidthStats  *BandwidthStatsArray
+}
+
+type readHelper struct {
+	infoType    byte
+	commandSize uint32
+
+	readSize int
+
+	reader io.Reader
+}
+
+func newReadHelper(reader io.Reader) (*readHelper, error) {
+	helper := &readHelper{reader: reader}
+
+	err := binary.Read(reader, binary.LittleEndian, &helper.infoType)
+	if err != nil {
+		return nil, err
+	}
+
+	err = binary.Read(reader, binary.LittleEndian, &helper.commandSize)
+	if err != nil {
+		return nil, err
+	}
+
+	return helper, nil
+}
+
+func (r *readHelper) ReadData(data any) error {
+	err := binary.Read(r, binary.LittleEndian, data)
+	if err != nil {
+		return errors.Join(ErrUnexpectedReadError, err)
+	}
+
+	if err := r.checkOverRead(); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// Passing size = 0 will read the rest of the command.
+func (r *readHelper) ReadBytes(size uint32) ([]byte, error) {
+	if uint32(r.readSize) >= r.commandSize {
+		return nil, errors.Join(fmt.Errorf("cannot read more bytes than the command size: %d >= %d", r.readSize, r.commandSize), ErrUnexpectedReadError)
+	}
+
+	if size == 0 {
+		size = r.commandSize - uint32(r.readSize)
+	}
+
+	if r.commandSize < uint32(r.readSize)+size {
+		return nil, ErrUnexpectedInfoSize
+	}
+
+	bytes := make([]byte, size)
+	err := binary.Read(r, binary.LittleEndian, bytes)
+	if err != nil {
+		return nil, errors.Join(ErrUnexpectedReadError, err)
+	}
+
+	return bytes, nil
+}
+
+func (r *readHelper) ReadUntilTheEnd() {
+	_, _ = r.ReadBytes(0)
+}
+
+func (r *readHelper) checkOverRead() error {
+	if uint32(r.readSize) > r.commandSize {
+		return ErrUnexpectedInfoSize
+	}
+
+	return nil
+}
+
+func (r *readHelper) Read(p []byte) (n int, err error) {
+	n, err = r.reader.Read(p)
+	r.readSize += n
+	return
+}
+
+func RecvInfo(reader io.Reader) (*Info, error) {
+	helper, err := newReadHelper(reader)
+	if err != nil {
+		return nil, err
+	}
+
+	// Make sure the whole command is read before return.
+	defer helper.ReadUntilTheEnd()
+
+	// Read data
+	switch helper.infoType {
+	case InfoConnectionIpv4:
+		{
+			parseError := fmt.Errorf("failed to parse InfoConnectionIpv4")
+			newInfo := ConnectionV4{}
+			var fixedSizeValues connectionV4Internal
+			// Read fixed size values.
+			err = helper.ReadData(&fixedSizeValues)
+			if err != nil {
+				return nil, errors.Join(parseError, err, fmt.Errorf("fixed"))
+			}
+			newInfo.connectionV4Internal = fixedSizeValues
+			// Read size of payload.
+			var payloadSize uint32
+			err = helper.ReadData(&payloadSize)
+			if err != nil {
+				return nil, errors.Join(parseError, err, fmt.Errorf("payloadsize"))
+			}
+
+			// Check if there is payload.
+			if payloadSize > 0 {
+				// Read payload.
+				newInfo.Payload, err = helper.ReadBytes(payloadSize)
+				if err != nil {
+					return nil, errors.Join(parseError, err, fmt.Errorf("payload"))
+				}
+			}
+			return &Info{ConnectionV4: &newInfo}, nil
+		}
+	case InfoConnectionIpv6:
+		{
+			parseError := fmt.Errorf("failed to parse InfoConnectionIpv6")
+			newInfo := ConnectionV6{}
+
+			// Read fixed size values.
+			err = helper.ReadData(&newInfo.connectionV6Internal)
+			if err != nil {
+				return nil, errors.Join(parseError, err)
+			}
+
+			// Read size of payload.
+			var payloadSize uint32
+			err = helper.ReadData(&payloadSize)
+			if err != nil {
+				return nil, errors.Join(parseError, err)
+			}
+
+			// Check if there is payload.
+			if payloadSize > 0 {
+				// Read payload.
+				newInfo.Payload, err = helper.ReadBytes(payloadSize)
+				if err != nil {
+					return nil, errors.Join(parseError, err)
+				}
+			}
+
+			return &Info{ConnectionV6: &newInfo}, nil
+		}
+	case InfoConnectionEndEventV4:
+		{
+			parseError := fmt.Errorf("failed to parse InfoConnectionEndEventV4")
+			var connectionEnd ConnectionEndV4
+
+			// Read fixed size values.
+			err = helper.ReadData(&connectionEnd)
+			if err != nil {
+				return nil, errors.Join(parseError, err)
+			}
+			return &Info{ConnectionEndV4: &connectionEnd}, nil
+		}
+	case InfoConnectionEndEventV6:
+		{
+			parseError := fmt.Errorf("failed to parse InfoConnectionEndEventV6")
+			var connectionEnd ConnectionEndV6
+
+			// Read fixed size values.
+			err = helper.ReadData(&connectionEnd)
+			if err != nil {
+				return nil, errors.Join(parseError, err)
+			}
+			return &Info{ConnectionEndV6: &connectionEnd}, nil
+		}
+	case InfoLogLine:
+		{
+			parseError := fmt.Errorf("failed to parse InfoLogLine")
+			logLine := LogLine{}
+			// Read severity
+			err = helper.ReadData(&logLine.Severity)
+			if err != nil {
+				return nil, errors.Join(parseError, err)
+			}
+			// Read string
+			bytes, err := helper.ReadBytes(0)
+			if err != nil {
+				return nil, errors.Join(parseError, err)
+			}
+			logLine.Line = string(bytes)
+			return &Info{LogLine: &logLine}, nil
+		}
+	case InfoBandwidthStatsV4:
+		{
+			parseError := fmt.Errorf("failed to parse InfoBandwidthStatsV4")
+			// Read Protocol
+			var protocol uint8
+			err = helper.ReadData(&protocol)
+			if err != nil {
+				return nil, errors.Join(parseError, err)
+			}
+			// Read size of array
+			var size uint32
+			err = helper.ReadData(&size)
+			if err != nil {
+				return nil, errors.Join(parseError, err)
+			}
+			// Read array
+			statsArray := make([]BandwidthValueV4, size)
+			for i := range int(size) {
+				err = helper.ReadData(&statsArray[i])
+				if err != nil {
+					return nil, errors.Join(parseError, err)
+				}
+			}
+
+			return &Info{BandwidthStats: &BandwidthStatsArray{Protocol: protocol, ValuesV4: statsArray}}, nil
+		}
+	case InfoBandwidthStatsV6:
+		{
+			parseError := fmt.Errorf("failed to parse InfoBandwidthStatsV6")
+			// Read Protocol
+			var protocol uint8
+			err = helper.ReadData(&protocol)
+			if err != nil {
+				return nil, errors.Join(parseError, err)
+			}
+			// Read size of array
+			var size uint32
+			err = helper.ReadData(&size)
+			if err != nil {
+				return nil, errors.Join(parseError, err)
+			}
+			// Read array
+			statsArray := make([]BandwidthValueV6, size)
+			for i := range int(size) {
+				err = helper.ReadData(&statsArray[i])
+				if err != nil {
+					return nil, errors.Join(parseError, err)
+				}
+			}
+
+			return &Info{BandwidthStats: &BandwidthStatsArray{Protocol: protocol, ValuesV6: statsArray}}, nil
+		}
+	}
+
+	return nil, ErrUnknownInfoType
+}

windows_kext/kextinterface/ioctl.go

@@ -0,0 +1,35 @@
+//go:build windows
+// +build windows
+
+package kextinterface
+
+import (
+	"golang.org/x/sys/windows"
+)
+
+const (
+	METHOD_BUFFERED   = 0
+	METHOD_IN_DIRECT  = 1
+	METHOD_OUT_DIRECT = 2
+	METHOD_NEITHER    = 3
+
+	SIOCTL_TYPE = 40000
+)
+
+func ctlCode(device_type, function, method, access uint32) uint32 {
+	return (device_type << 16) | (access << 14) | (function << 2) | method
+}
+
+var (
+	IOCTL_VERSION          = ctlCode(SIOCTL_TYPE, 0x800, METHOD_BUFFERED, windows.FILE_READ_DATA|windows.FILE_WRITE_DATA)
+	IOCTL_SHUTDOWN_REQUEST = ctlCode(SIOCTL_TYPE, 0x801, METHOD_BUFFERED, windows.FILE_READ_DATA|windows.FILE_WRITE_DATA)
+)
+
+func ReadVersion(file *KextFile) ([]uint8, error) {
+	data := make([]uint8, 4)
+	_, err := file.deviceIOControl(IOCTL_VERSION, nil, data)
+	if err != nil {
+		return nil, err
+	}
+	return data, nil
+}

windows_kext/kextinterface/kext.go

@@ -0,0 +1,249 @@
+//go:build windows
+// +build windows
+
+package kextinterface
+
+import (
+	_ "embed"
+	"fmt"
+	"strconv"
+	"strings"
+	"syscall"
+	"time"
+
+	"github.com/safing/portbase/log"
+	"golang.org/x/sys/windows"
+)
+
+var (
+	//go:embed version.txt
+	versionTxt string
+
+	// 4 byte version of the Kext interface
+	InterfaceVersion = func() (v [4]byte) {
+		// Parse version from file "version.txt". Expected format: [0, 1, 2, 3]
+		s := strings.TrimSpace(versionTxt)
+		s = strings.TrimPrefix(s, "[")
+		s = strings.TrimSuffix(s, "]")
+		str_ver := strings.Split(s, ",")
+		for i := range v {
+			n, err := strconv.Atoi(strings.TrimSpace(str_ver[i]))
+			if err != nil {
+				panic(err)
+			}
+			v[i] = byte(n)
+		}
+		return
+	}()
+)
+
+const (
+	winInvalidHandleValue      = windows.Handle(^uintptr(0)) // Max value
+	stopServiceTimeoutDuration = time.Duration(30 * time.Second)
+)
+
+type KextService struct {
+	handle     windows.Handle
+	driverName string
+}
+
+func (s *KextService) isValid() bool {
+	return s != nil && s.handle != winInvalidHandleValue && s.handle != 0
+}
+
+func (s *KextService) isRunning() (bool, error) {
+	if !s.isValid() {
+		return false, fmt.Errorf("kext service not initialized")
+	}
+	var status windows.SERVICE_STATUS
+	err := windows.QueryServiceStatus(s.handle, &status)
+	if err != nil {
+		return false, err
+	}
+	return status.CurrentState == windows.SERVICE_RUNNING, nil
+}
+
+func (s *KextService) waitForServiceStatus(neededStatus uint32, timeLimit time.Duration) (bool, error) {
+	var status windows.SERVICE_STATUS
+	status.CurrentState = windows.SERVICE_NO_CHANGE
+	start := time.Now()
+	for status.CurrentState != neededStatus {
+		err := windows.QueryServiceStatus(s.handle, &status)
+		if err != nil {
+			return false, fmt.Errorf("failed while waiting for service to start: %w", err)
+		}
+
+		if time.Since(start) > timeLimit {
+			return false, fmt.Errorf("time limit reached")
+		}
+
+		// Sleep for 1/10 of the wait hint, recommended time from microsoft
+		time.Sleep(time.Duration((status.WaitHint / 10)) * time.Millisecond)
+	}
+
+	return true, nil
+}
+
+func (s *KextService) Start(wait bool) error {
+	if !s.isValid() {
+		return fmt.Errorf("kext service not initialized")
+	}
+
+	// Start the service:
+	err := windows.StartService(s.handle, 0, nil)
+	if err != nil {
+		err = windows.GetLastError()
+		if err != windows.ERROR_SERVICE_ALREADY_RUNNING {
+			// Failed to start service; clean-up:
+			var status windows.SERVICE_STATUS
+			_ = windows.ControlService(s.handle, windows.SERVICE_CONTROL_STOP, &status)
+			_ = windows.DeleteService(s.handle)
+			_ = windows.CloseServiceHandle(s.handle)
+			s.handle = winInvalidHandleValue
+			return err
+		}
+	}
+
+	// Wait for service to start
+	if wait {
+		success, err := s.waitForServiceStatus(windows.SERVICE_RUNNING, stopServiceTimeoutDuration)
+		if err != nil || !success {
+			return fmt.Errorf("service did not start: %w", err)
+		}
+	}
+
+	return nil
+}
+
+func (s *KextService) GetHandle() windows.Handle {
+	return s.handle
+}
+
+func (s *KextService) Stop(wait bool) error {
+	if !s.isValid() {
+		return fmt.Errorf("kext service not initialized")
+	}
+
+	// Stop the service
+	var status windows.SERVICE_STATUS
+	err := windows.ControlService(s.handle, windows.SERVICE_CONTROL_STOP, &status)
+	if err != nil {
+		return fmt.Errorf("service failed to stop: %w", err)
+	}
+
+	// Wait for service to stop
+	if wait {
+		success, err := s.waitForServiceStatus(windows.SERVICE_STOPPED, time.Duration(10*time.Second))
+		if err != nil || !success {
+			return fmt.Errorf("service did not stop: %w", err)
+		}
+	}
+
+	return nil
+}
+
+func (s *KextService) Delete() error {
+	if !s.isValid() {
+		return fmt.Errorf("kext service not initialized")
+	}
+
+	err := windows.DeleteService(s.handle)
+	if err != nil {
+		return fmt.Errorf("failed to delete service: %s", err)
+	}
+
+	// Service wont be deleted until all handles are closed.
+	err = windows.CloseServiceHandle(s.handle)
+	if err != nil {
+		return fmt.Errorf("failed to close service handle: %s", err)
+	}
+
+	s.handle = winInvalidHandleValue
+	return nil
+}
+
+func (s *KextService) WaitUntilDeleted(serviceManager windows.Handle) error {
+	driverNameU16, err := syscall.UTF16FromString(s.driverName)
+	if err != nil {
+		return fmt.Errorf("failed to convert driver name to UTF16 string: %w", err)
+	}
+	// Wait until we can no longer open the old service.
+	// Not very efficient but NotifyServiceStatusChange cannot be used with driver service.
+	start := time.Now()
+	timeLimit := time.Duration(30 * time.Second)
+	for {
+		handle, err := windows.OpenService(serviceManager, &driverNameU16[0], windows.SERVICE_ALL_ACCESS)
+		if err != nil {
+			break
+		}
+		_ = windows.CloseServiceHandle(handle)
+
+		if time.Since(start) > timeLimit {
+			return fmt.Errorf("time limit reached")
+		}
+
+		time.Sleep(100 * time.Millisecond)
+	}
+
+	return nil
+}
+
+func (s *KextService) OpenFile(readBufferSize int) (*KextFile, error) {
+	if !s.isValid() {
+		return nil, fmt.Errorf("invalid kext object")
+	}
+
+	driverNameU16, err := syscall.UTF16FromString(`\\.\` + s.driverName)
+	if err != nil {
+		return nil, fmt.Errorf("failed to convert driver driverName to UTF16 string %w", err)
+	}
+
+	handle, err := windows.CreateFile(&driverNameU16[0], windows.GENERIC_READ|windows.GENERIC_WRITE, 0, nil, windows.OPEN_EXISTING, windows.FILE_ATTRIBUTE_NORMAL|windows.FILE_FLAG_OVERLAPPED, 0)
+	if err != nil {
+		return nil, err
+	}
+
+	return &KextFile{handle: handle, buffer: make([]byte, readBufferSize)}, nil
+}
+
+func CreateKextService(driverName string, driverPath string) (*KextService, error) {
+	// Open the service manager:
+	manager, err := windows.OpenSCManager(nil, nil, windows.SC_MANAGER_ALL_ACCESS)
+	if err != nil {
+		return nil, fmt.Errorf("failed to open service manager: %d", err)
+	}
+	defer windows.CloseServiceHandle(manager)
+
+	driverNameU16, err := syscall.UTF16FromString(driverName)
+	if err != nil {
+		return nil, fmt.Errorf("failed to convert driver name to UTF16 string: %w", err)
+	}
+
+	// Check if there is an old service.
+	service, err := windows.OpenService(manager, &driverNameU16[0], windows.SERVICE_ALL_ACCESS)
+	if err == nil {
+		log.Warning("kext: old driver service was found")
+		oldService := &KextService{handle: service, driverName: driverName}
+		oldService.Stop(true)
+		err = oldService.Delete()
+		if err != nil {
+			return nil, err
+		}
+		err := oldService.WaitUntilDeleted(manager)
+		if err != nil {
+			return nil, err
+		}
+
+		service = winInvalidHandleValue
+		log.Warning("kext: old driver service was deleted successfully")
+	}
+
+	driverPathU16, err := syscall.UTF16FromString(driverPath)
+
+	// Create the service
+	service, err = windows.CreateService(manager, &driverNameU16[0], &driverNameU16[0], windows.SERVICE_ALL_ACCESS, windows.SERVICE_KERNEL_DRIVER, windows.SERVICE_DEMAND_START, windows.SERVICE_ERROR_NORMAL, &driverPathU16[0], nil, nil, nil, nil, nil)
+	if err != nil {
+		return nil, err
+	}
+	return &KextService{handle: service, driverName: driverName}, nil
+}

windows_kext/kextinterface/kext_file.go

@@ -0,0 +1,97 @@
+//go:build windows
+// +build windows
+
+package kextinterface
+
+import (
+	"golang.org/x/sys/windows"
+)
+
+type KextFile struct {
+	handle     windows.Handle
+	buffer     []byte
+	read_slice []byte
+}
+
+func (f *KextFile) Read(buffer []byte) (int, error) {
+	if f.read_slice == nil || len(f.read_slice) == 0 {
+		err := f.refill_read_buffer()
+		if err != nil {
+			return 0, err
+		}
+	}
+
+	if len(f.read_slice) >= len(buffer) {
+		// Write all requested bytes.
+		copy(buffer, f.read_slice[0:len(buffer)])
+		f.read_slice = f.read_slice[len(buffer):]
+	} else {
+		// Write all available bytes and read again.
+		copy(buffer[0:len(f.read_slice)], f.read_slice)
+		copiedBytes := len(f.read_slice)
+		f.read_slice = nil
+		_, err := f.Read(buffer[copiedBytes:])
+		if err != nil {
+			return 0, err
+		}
+	}
+
+	return len(buffer), nil
+}
+
+func (f *KextFile) refill_read_buffer() error {
+	var count uint32 = 0
+	overlapped := &windows.Overlapped{}
+	err := windows.ReadFile(f.handle, f.buffer[:], &count, overlapped)
+	if err != nil {
+		return err
+	}
+	f.read_slice = f.buffer[0:count]
+
+	return nil
+}
+
+func (f *KextFile) Write(buffer []byte) (int, error) {
+	var count uint32 = 0
+	overlapped := &windows.Overlapped{}
+	err := windows.WriteFile(f.handle, buffer, &count, overlapped)
+	return int(count), err
+}
+
+func (f *KextFile) Close() error {
+	err := windows.CloseHandle(f.handle)
+	f.handle = winInvalidHandleValue
+	return err
+}
+
+func (f *KextFile) deviceIOControl(code uint32, inData []byte, outData []byte) (*windows.Overlapped, error) {
+	var inDataPtr *byte = nil
+	var inDataSize uint32 = 0
+	if inData != nil {
+		inDataPtr = &inData[0]
+		inDataSize = uint32(len(inData))
+	}
+
+	var outDataPtr *byte = nil
+	var outDataSize uint32 = 0
+	if outData != nil {
+		outDataPtr = &outData[0]
+		outDataSize = uint32(len(outData))
+	}
+
+	overlapped := &windows.Overlapped{}
+	err := windows.DeviceIoControl(f.handle,
+		code,
+		inDataPtr, inDataSize,
+		outDataPtr, outDataSize,
+		nil, overlapped)
+	if err != nil {
+		return nil, err
+	}
+
+	return overlapped, nil
+}
+
+func (f *KextFile) GetHandle() windows.Handle {
+	return f.handle
+}

windows_kext/kextinterface/kext_file_test.go

@@ -0,0 +1,12 @@
+//go:build linux
+// +build linux
+
+package kextinterface
+
+type KextFile struct{}
+
+func (f *KextFile) Read(buffer []byte) (int, error) {
+	return 0, nil
+}
+
+// func (f *KextFile) flushBuffer() {}

windows_kext/kextinterface/protocol_test.go

@@ -0,0 +1,285 @@
+package kextinterface
+
+import (
+	"bytes"
+	"errors"
+	"math/rand"
+	"os"
+	"testing"
+)
+
+func TestRustInfoFile(t *testing.T) {
+	t.Parallel()
+
+	file, err := os.Open("testdata/rust_info_test.bin")
+	if err != nil {
+		panic(err)
+	}
+	defer func() {
+		_ = file.Close()
+	}()
+	first := true
+	for {
+		info, err := RecvInfo(file)
+		// First info should be with invalid size.
+		// This tests if invalid info data is handled properly.
+		if first {
+			if !errors.Is(err, ErrUnexpectedInfoSize) {
+				t.Errorf("unexpected error: %s\n", err)
+			}
+			first = false
+			continue
+		}
+		if err != nil {
+			if errors.Is(err, ErrUnexpectedReadError) {
+				t.Errorf("unexpected error: %s\n", err)
+			}
+			return
+		}
+
+		switch {
+		case info.LogLine != nil:
+			if info.LogLine.Severity != 1 {
+				t.Errorf("unexpected Log severity: %d\n", info.LogLine.Severity)
+			}
+			if info.LogLine.Line != "prefix: test log" {
+				t.Errorf("unexpected Log line: %s\n", info.LogLine.Line)
+			}
+
+		case info.ConnectionV4 != nil:
+			conn := info.ConnectionV4
+			expected := connectionV4Internal{
+				ID:           1,
+				ProcessID:    2,
+				Direction:    3,
+				Protocol:     4,
+				LocalIP:      [4]byte{1, 2, 3, 4},
+				RemoteIP:     [4]byte{2, 3, 4, 5},
+				LocalPort:    5,
+				RemotePort:   6,
+				PayloadLayer: 7,
+			}
+			if conn.connectionV4Internal != expected {
+				t.Errorf("unexpected ConnectionV4: %+v\n", conn)
+			}
+			if !bytes.Equal(conn.Payload, []byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10}) {
+				t.Errorf("unexpected ConnectionV4 payload: %+v\n", conn.Payload)
+			}
+
+		case info.ConnectionV6 != nil:
+			conn := info.ConnectionV6
+			expected := connectionV6Internal{
+				ID:           1,
+				ProcessID:    2,
+				Direction:    3,
+				Protocol:     4,
+				LocalIP:      [16]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16},
+				RemoteIP:     [16]byte{2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17},
+				LocalPort:    5,
+				RemotePort:   6,
+				PayloadLayer: 7,
+			}
+			if conn.connectionV6Internal != expected {
+				t.Errorf("unexpected ConnectionV6: %+v\n", conn)
+			}
+			if !bytes.Equal(conn.Payload, []byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10}) {
+				t.Errorf("unexpected ConnectionV6 payload: %+v\n", conn.Payload)
+			}
+
+		case info.ConnectionEndV4 != nil:
+			endEvent := info.ConnectionEndV4
+			expected := ConnectionEndV4{
+				ProcessID:  1,
+				Direction:  2,
+				Protocol:   3,
+				LocalIP:    [4]byte{1, 2, 3, 4},
+				RemoteIP:   [4]byte{2, 3, 4, 5},
+				LocalPort:  4,
+				RemotePort: 5,
+			}
+			if *endEvent != expected {
+				t.Errorf("unexpected ConnectionEndV4: %+v\n", endEvent)
+			}
+
+		case info.ConnectionEndV6 != nil:
+			endEvent := info.ConnectionEndV6
+			expected := ConnectionEndV6{
+				ProcessID:  1,
+				Direction:  2,
+				Protocol:   3,
+				LocalIP:    [16]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16},
+				RemoteIP:   [16]byte{2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17},
+				LocalPort:  4,
+				RemotePort: 5,
+			}
+			if *endEvent != expected {
+				t.Errorf("unexpected ConnectionEndV6: %+v\n", endEvent)
+			}
+
+		case info.BandwidthStats != nil:
+			stats := info.BandwidthStats
+			if stats.Protocol != 1 {
+				t.Errorf("unexpected Bandwidth stats protocol: %d\n", stats.Protocol)
+			}
+
+			if stats.ValuesV4 != nil {
+				if len(stats.ValuesV4) != 2 {
+					t.Errorf("unexpected Bandwidth stats value length: %d\n", len(stats.ValuesV4))
+				}
+				expected1 := BandwidthValueV4{
+					LocalIP:          [4]byte{1, 2, 3, 4},
+					LocalPort:        1,
+					RemoteIP:         [4]byte{2, 3, 4, 5},
+					RemotePort:       2,
+					TransmittedBytes: 3,
+					ReceivedBytes:    4,
+				}
+				if stats.ValuesV4[0] != expected1 {
+					t.Errorf("unexpected Bandwidth stats value: %+v expected: %+v\n", stats.ValuesV4[0], expected1)
+				}
+				expected2 := BandwidthValueV4{
+					LocalIP:          [4]byte{1, 2, 3, 4},
+					LocalPort:        5,
+					RemoteIP:         [4]byte{2, 3, 4, 5},
+					RemotePort:       6,
+					TransmittedBytes: 7,
+					ReceivedBytes:    8,
+				}
+				if stats.ValuesV4[1] != expected2 {
+					t.Errorf("unexpected Bandwidth stats value: %+v expected: %+v\n", stats.ValuesV4[1], expected2)
+				}
+
+			} else if stats.ValuesV6 != nil {
+				if len(stats.ValuesV6) != 2 {
+					t.Errorf("unexpected Bandwidth stats value length: %d\n", len(stats.ValuesV6))
+				}
+
+				expected1 := BandwidthValueV6{
+					LocalIP:          [16]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16},
+					LocalPort:        1,
+					RemoteIP:         [16]byte{2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17},
+					RemotePort:       2,
+					TransmittedBytes: 3,
+					ReceivedBytes:    4,
+				}
+				if stats.ValuesV6[0] != expected1 {
+					t.Errorf("unexpected Bandwidth stats value: %+v expected: %+v\n", stats.ValuesV6[0], expected1)
+				}
+				expected2 := BandwidthValueV6{
+					LocalIP:          [16]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16},
+					LocalPort:        5,
+					RemoteIP:         [16]byte{2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17},
+					RemotePort:       6,
+					TransmittedBytes: 7,
+					ReceivedBytes:    8,
+				}
+				if stats.ValuesV6[1] != expected2 {
+					t.Errorf("unexpected Bandwidth stats value: %+v expected: %+v\n", stats.ValuesV6[1], expected2)
+				}
+
+			}
+		}
+	}
+}
+
+func TestGenerateCommandFile(t *testing.T) {
+	t.Parallel()
+
+	file, err := os.Create("../protocol/testdata/go_command_test.bin")
+	if err != nil {
+		t.Errorf("failed to create file: %s", err)
+	}
+	defer func() {
+		_ = file.Close()
+	}()
+	enums := []byte{
+		CommandShutdown,
+		CommandVerdict,
+		CommandUpdateV4,
+		CommandUpdateV6,
+		CommandClearCache,
+		CommandGetLogs,
+		CommandBandwidthStats,
+		CommandCleanEndedConnections,
+	}
+
+	selected := make([]byte, 5000)
+	for i := range selected {
+		selected[i] = enums[rand.Intn(len(enums))] //nolint:gosec
+	}
+
+	for _, value := range selected {
+		switch value {
+		case CommandShutdown:
+			err := SendShutdownCommand(file)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+		case CommandVerdict:
+			err := SendVerdictCommand(file, Verdict{
+				ID:      1,
+				Verdict: 2,
+			})
+			if err != nil {
+				t.Fatal(err)
+			}
+
+		case CommandUpdateV4:
+			err := SendUpdateV4Command(file, UpdateV4{
+				Protocol:      1,
+				LocalAddress:  [4]byte{1, 2, 3, 4},
+				LocalPort:     2,
+				RemoteAddress: [4]byte{2, 3, 4, 5},
+				RemotePort:    3,
+				Verdict:       4,
+			})
+			if err != nil {
+				t.Fatal(err)
+			}
+
+		case CommandUpdateV6:
+			err := SendUpdateV6Command(file, UpdateV6{
+				Protocol:      1,
+				LocalAddress:  [16]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16},
+				LocalPort:     2,
+				RemoteAddress: [16]byte{2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17},
+				RemotePort:    3,
+				Verdict:       4,
+			})
+			if err != nil {
+				t.Fatal(err)
+			}
+
+		case CommandClearCache:
+			err := SendClearCacheCommand(file)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+		case CommandGetLogs:
+			err := SendGetLogsCommand(file)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+		case CommandBandwidthStats:
+			err := SendGetBandwidthStatsCommand(file)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+		case CommandPrintMemoryStats:
+			err := SendPrintMemoryStatsCommand(file)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+		case CommandCleanEndedConnections:
+			err := SendCleanEndedConnectionsCommand(file)
+			if err != nil {
+				t.Fatal(err)
+			}
+		}
+	}
+}

windows_kext/kextinterface/version.txt

@@ -0,0 +1 @@
+[2, 0, 3, 0]

windows_kext/protocol/Cargo.lock

@@ -0,0 +1,193 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "autocfg"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "getrandom"
+version = "0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "190092ea657667030ac6a35e305e62fc4dd69fd98ac98631e5d3a2b1575a12b5"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.153"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c198f91728a82281a64e1f4f9eeb25d82cb32a5de251c6bd1b5154d63a8e7bd"
+
+[[package]]
+name = "num"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b05180d69e3da0e530ba2a1dae5110317e49e3b7f3d41be227dc5f92e49ee7af"
+dependencies = [
+ "num-complex",
+ "num-integer",
+ "num-iter",
+ "num-rational",
+ "num-traits",
+]
+
+[[package]]
+name = "num-complex"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ba157ca0885411de85d6ca030ba7e2a83a28636056c7c699b07c8b6f7383214"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-derive"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfb77679af88f8b125209d354a202862602672222e7f2313fdd6dc349bad4712"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "num-integer"
+version = "0.1.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "225d3389fb3509a24c93f5c29eb6bde2586b98d9f016636dff58d7c6f7569cd9"
+dependencies = [
+ "autocfg",
+ "num-traits",
+]
+
+[[package]]
+name = "num-iter"
+version = "0.1.43"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d03e6c028c5dc5cac6e2dec0efda81fc887605bb3d884578bb6d6bf7514e252"
+dependencies = [
+ "autocfg",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-rational"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0638a1c9d0a3c0914158145bc76cff373a75a627e6ecbfb71cbe6f453a5a19b0"
+dependencies = [
+ "autocfg",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39e3200413f237f41ab11ad6d161bc7239c84dcb631773ccd7de3dfe4b5c267c"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.78"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2422ad645d89c99f8f3e6b88a9fdeca7fabeac836b1002371c4367c8f984aae"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "protocol"
+version = "0.0.0"
+dependencies = [
+ "num",
+ "num-derive",
+ "num-traits",
+ "rand",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291ec9ab5efd934aaf503a6466c5d5251535d108ee747472c3977cc5acc868ef"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "rand"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+dependencies = [
+ "libc",
+ "rand_chacha",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.48"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f3531638e407dfc0814761abb7c00a5b54992b849452a0646b7f65c9f770f3f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
+
+[[package]]
+name = "wasi"
+version = "0.11.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"

windows_kext/protocol/Cargo.toml

@@ -0,0 +1,14 @@
+[package]
+name = "protocol"
+version = "0.0.0"
+edition = "2021"
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
+num = { version = "0.4", default-features = false }
+num-derive = { version = "0.4", default-features = false }
+num-traits = { version = "0.2", default-features = false }
+
+[dev-dependencies]
+rand = "0.8.5"

windows_kext/protocol/README.md

@@ -0,0 +1,4 @@
+# Protocol
+
+Defines protocol that communicates with `kextinterface` / Portmaster.
+

windows_kext/protocol/src/command.rs

@@ -0,0 +1,158 @@
+// Commands from user space
+
+use num_derive::FromPrimitive;
+use num_traits::FromPrimitive;
+
+#[repr(u8)]
+#[derive(Clone, Copy, FromPrimitive)]
+#[rustfmt::skip]
+pub enum CommandType {
+    Shutdown              = 0,
+    Verdict               = 1,
+    UpdateV4              = 2,
+    UpdateV6              = 3,
+    ClearCache            = 4,
+    GetLogs               = 5,
+    GetBandwidthStats     = 6,
+    PrintMemoryStats      = 7,
+    CleanEndedConnections = 8,
+}
+
+#[repr(C, packed)]
+pub struct Command {
+    pub command_type: CommandType,
+    value: [u8; 0],
+}
+
+#[repr(C, packed)]
+#[derive(Debug, PartialEq, Eq)]
+pub struct Verdict {
+    pub id: u64,
+    pub verdict: u8,
+}
+
+#[repr(C, packed)]
+#[derive(Debug, PartialEq, Eq)]
+pub struct UpdateV4 {
+    pub protocol: u8,
+    pub local_address: [u8; 4],
+    pub local_port: u16,
+    pub remote_address: [u8; 4],
+    pub remote_port: u16,
+    pub verdict: u8,
+}
+
+#[repr(C, packed)]
+#[derive(Debug, PartialEq, Eq)]
+pub struct UpdateV6 {
+    pub protocol: u8,
+    pub local_address: [u8; 16],
+    pub local_port: u16,
+    pub remote_address: [u8; 16],
+    pub remote_port: u16,
+    pub verdict: u8,
+}
+
+pub fn parse_type(bytes: &[u8]) -> Option<CommandType> {
+    FromPrimitive::from_u8(bytes[0])
+}
+
+pub fn parse_verdict(bytes: &[u8]) -> &Verdict {
+    as_type(bytes)
+}
+
+pub fn parse_update_v4(bytes: &[u8]) -> &UpdateV4 {
+    as_type(bytes)
+}
+
+pub fn parse_update_v6(bytes: &[u8]) -> &UpdateV6 {
+    as_type(bytes)
+}
+
+fn as_type<T>(bytes: &[u8]) -> &T {
+    let ptr: *const u8 = &bytes[0];
+    let t_ptr: *const T = ptr as _;
+    unsafe { t_ptr.as_ref().unwrap() }
+}
+
+#[cfg(test)]
+use std::fs::File;
+#[cfg(test)]
+use std::io::Read;
+#[cfg(test)]
+use std::mem::size_of;
+#[cfg(test)]
+use std::panic;
+
+#[test]
+fn test_go_command_file() {
+    let mut file = File::open("testdata/go_command_test.bin").unwrap();
+    loop {
+        let mut command: [u8; 1] = [0];
+        let bytes_count = file.read(&mut command).unwrap();
+        if bytes_count == 0 {
+            return;
+        }
+        if let Some(command) = parse_type(&command) {
+            match command {
+                CommandType::Shutdown => {}
+                CommandType::Verdict => {
+                    let mut buf = [0; size_of::<Verdict>()];
+                    let bytes_count = file.read(&mut buf).unwrap();
+                    if bytes_count != size_of::<Verdict>() {
+                        panic!("unexpected bytes count")
+                    }
+
+                    assert_eq!(parse_verdict(&buf), &Verdict { id: 1, verdict: 2 })
+                }
+                CommandType::UpdateV4 => {
+                    let mut buf = [0; size_of::<UpdateV4>()];
+                    let bytes_count = file.read(&mut buf).unwrap();
+                    if bytes_count != size_of::<UpdateV4>() {
+                        panic!("unexpected bytes count")
+                    }
+
+                    assert_eq!(
+                        parse_update_v4(&buf),
+                        &UpdateV4 {
+                            protocol: 1,
+                            local_address: [1, 2, 3, 4],
+                            local_port: 2,
+                            remote_address: [2, 3, 4, 5],
+                            remote_port: 3,
+                            verdict: 4
+                        }
+                    )
+                }
+                CommandType::UpdateV6 => {
+                    let mut buf = [0; size_of::<UpdateV6>()];
+                    let bytes_count = file.read(&mut buf).unwrap();
+                    if bytes_count != size_of::<UpdateV6>() {
+                        panic!("unexpected bytes count")
+                    }
+
+                    assert_eq!(
+                        parse_update_v6(&buf),
+                        &UpdateV6 {
+                            protocol: 1,
+                            local_address: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16],
+                            local_port: 2,
+                            remote_address: [
+                                2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17
+                            ],
+                            remote_port: 3,
+                            verdict: 4
+                        }
+                    )
+                }
+                CommandType::ClearCache => {}
+                CommandType::GetLogs => {}
+                CommandType::GetBandwidthStats => {}
+                CommandType::PrintMemoryStats => {}
+                CommandType::CleanEndedConnections => {}
+            }
+        } else {
+            panic!("Unknown command: {}", command[0]);
+        }
+    }
+}

windows_kext/protocol/src/info.rs

@@ -0,0 +1,569 @@
+use alloc::vec::Vec;
+
+#[repr(u8)]
+#[derive(Clone, Copy)]
+enum InfoType {
+    LogLine = 0,
+    ConnectionIpv4 = 1,
+    ConnectionIpv6 = 2,
+    ConnectionEndEventV4 = 3,
+    ConnectionEndEventV6 = 4,
+    BandwidthStatsV4 = 5,
+    BandwidthStatsV6 = 6,
+}
+
+// Fallow this pattern when adding new packets: [InfoType: u8, data_size_in_bytes: u32, data: ...]
+
+trait PushBytes {
+    fn push(self, vec: &mut Vec<u8>);
+}
+
+impl PushBytes for u8 {
+    fn push(self, vec: &mut Vec<u8>) {
+        vec.push(self);
+    }
+}
+
+impl PushBytes for InfoType {
+    fn push(self, vec: &mut Vec<u8>) {
+        vec.push(self as u8);
+    }
+}
+
+impl PushBytes for u16 {
+    fn push(self, vec: &mut Vec<u8>) {
+        vec.extend_from_slice(&u16::to_le_bytes(self));
+    }
+}
+
+impl PushBytes for u32 {
+    fn push(self, vec: &mut Vec<u8>) {
+        vec.extend_from_slice(&u32::to_le_bytes(self));
+    }
+}
+
+impl PushBytes for u64 {
+    fn push(self, vec: &mut Vec<u8>) {
+        vec.extend_from_slice(&u64::to_le_bytes(self));
+    }
+}
+
+impl PushBytes for usize {
+    fn push(self, vec: &mut Vec<u8>) {
+        vec.extend_from_slice(&usize::to_le_bytes(self));
+    }
+}
+
+impl PushBytes for [u8; 4] {
+    fn push(self, vec: &mut Vec<u8>) {
+        vec.extend_from_slice(&self);
+    }
+}
+
+impl PushBytes for [u8; 16] {
+    fn push(self, vec: &mut Vec<u8>) {
+        vec.extend_from_slice(&self);
+    }
+}
+
+impl PushBytes for &[u8] {
+    fn push(self, vec: &mut Vec<u8>) {
+        vec.extend_from_slice(self);
+    }
+}
+
+macro_rules! push_bytes {
+    ($vec:expr,$value:expr) => {
+        PushBytes::push($value, $vec);
+    };
+}
+
+macro_rules! get_combined_size{
+    ($($a:expr),*)=>{{0 $(+core::mem::size_of_val(&$a))*}}
+}
+
+pub struct Info(Vec<u8>);
+
+impl Info {
+    fn new(info_type: InfoType, size: usize) -> Self {
+        let mut vec = Vec::with_capacity(size + 5); // +1 for the info type +4 for the size.
+        push_bytes!(&mut vec, info_type);
+        push_bytes!(&mut vec, size as u32);
+        Self(vec)
+    }
+
+    fn with_capacity(info_type: InfoType, capacity: usize) -> Self {
+        let mut vec = Vec::with_capacity(capacity + 5); // +1 for the info type + 4 for the size.
+        push_bytes!(&mut vec, info_type);
+        push_bytes!(&mut vec, 0 as u32);
+        Self(vec)
+    }
+
+    #[cfg(test)]
+    fn assert_size(&self) {
+        let size = u32::from_le_bytes([self.0[1], self.0[2], self.0[3], self.0[4]]) as usize;
+        assert_eq!(size, self.0.len() - 5);
+    }
+
+    fn update_size(&mut self) {
+        let size = self.0.len() - 5;
+        let bytes = &mut self.0;
+        bytes[1] = size as u8;
+        bytes[2] = (size >> 8) as u8;
+        bytes[3] = (size >> 16) as u8;
+        bytes[4] = (size >> 24) as u8;
+    }
+
+    pub fn as_bytes(&self) -> &[u8] {
+        return self.0.as_slice();
+    }
+}
+
+impl core::fmt::Write for Info {
+    fn write_str(&mut self, s: &str) -> Result<(), core::fmt::Error> {
+        const MAX_CAPACITY: usize = 500;
+
+        let space_left = self.0.capacity() - self.0.len();
+        if s.len() > space_left {
+            if self.0.capacity() < MAX_CAPACITY {
+                self.0.reserve(MAX_CAPACITY);
+            } else {
+                return Ok(());
+            }
+        }
+
+        self.0.extend_from_slice(s.as_bytes());
+        self.update_size();
+        Ok(())
+    }
+}
+
+pub fn connection_info_v4(
+    id: u64,
+    process_id: u64,
+    direction: u8,
+    protocol: u8,
+    local_ip: [u8; 4],
+    remote_ip: [u8; 4],
+    local_port: u16,
+    remote_port: u16,
+    payload_layer: u8,
+    payload: &[u8],
+) -> Info {
+    let mut size = get_combined_size!(
+        id,
+        process_id,
+        direction,
+        protocol,
+        local_ip,
+        remote_ip,
+        local_port,
+        remote_port,
+        payload_layer,
+        payload.len() as u32
+    );
+    size += payload.len();
+
+    let mut info = Info::new(InfoType::ConnectionIpv4, size);
+    let vec = &mut info.0;
+    push_bytes!(vec, id);
+    push_bytes!(vec, process_id);
+    push_bytes!(vec, direction);
+    push_bytes!(vec, protocol);
+    push_bytes!(vec, local_ip);
+    push_bytes!(vec, remote_ip);
+    push_bytes!(vec, local_port);
+    push_bytes!(vec, remote_port);
+    push_bytes!(vec, payload_layer);
+    push_bytes!(vec, payload.len() as u32);
+    push_bytes!(vec, payload);
+    info
+}
+
+pub fn connection_info_v6(
+    id: u64,
+    process_id: u64,
+    direction: u8,
+    protocol: u8,
+    local_ip: [u8; 16],
+    remote_ip: [u8; 16],
+    local_port: u16,
+    remote_port: u16,
+    payload_layer: u8,
+    payload: &[u8],
+) -> Info {
+    let mut size = get_combined_size!(
+        id,
+        process_id,
+        direction,
+        protocol,
+        local_ip,
+        remote_ip,
+        local_port,
+        remote_port,
+        payload_layer,
+        payload.len() as u32
+    );
+    size += payload.len();
+    let mut info = Info::new(InfoType::ConnectionIpv6, size);
+    let vec = &mut info.0;
+    push_bytes!(vec, id);
+    push_bytes!(vec, process_id);
+    push_bytes!(vec, direction);
+    push_bytes!(vec, protocol);
+    push_bytes!(vec, local_ip);
+    push_bytes!(vec, remote_ip);
+    push_bytes!(vec, local_port);
+    push_bytes!(vec, remote_port);
+    push_bytes!(vec, payload_layer);
+    push_bytes!(vec, payload.len() as u32);
+    if !payload.is_empty() {
+        push_bytes!(vec, payload);
+    }
+    info
+}
+
+pub fn connection_end_event_v4_info(
+    process_id: u64,
+    direction: u8,
+    protocol: u8,
+    local_ip: [u8; 4],
+    remote_ip: [u8; 4],
+    local_port: u16,
+    remote_port: u16,
+) -> Info {
+    let size = get_combined_size!(
+        process_id,
+        direction,
+        protocol,
+        local_ip,
+        remote_ip,
+        local_port,
+        remote_port
+    );
+    let mut info = Info::new(InfoType::ConnectionEndEventV4, size);
+    let vec = &mut info.0;
+    push_bytes!(vec, process_id);
+    push_bytes!(vec, direction);
+    push_bytes!(vec, protocol);
+    push_bytes!(vec, local_ip);
+    push_bytes!(vec, remote_ip);
+    push_bytes!(vec, local_port);
+    push_bytes!(vec, remote_port);
+    info
+}
+
+pub fn connection_end_event_v6_info(
+    process_id: u64,
+    direction: u8,
+    protocol: u8,
+    local_ip: [u8; 16],
+    remote_ip: [u8; 16],
+    local_port: u16,
+    remote_port: u16,
+) -> Info {
+    let size = get_combined_size!(
+        process_id,
+        direction,
+        protocol,
+        local_ip,
+        remote_ip,
+        local_port,
+        remote_port
+    );
+    let mut info = Info::new(InfoType::ConnectionEndEventV6, size);
+    let vec = &mut info.0;
+    push_bytes!(vec, process_id);
+    push_bytes!(vec, direction);
+    push_bytes!(vec, protocol);
+    push_bytes!(vec, local_ip);
+    push_bytes!(vec, remote_ip);
+    push_bytes!(vec, local_port);
+    push_bytes!(vec, remote_port);
+    info
+}
+
+#[repr(u8)]
+#[derive(Clone, Copy)]
+pub enum Severity {
+    Trace = 1,
+    Debug = 2,
+    Info = 3,
+    Warning = 4,
+    Error = 5,
+    Critical = 6,
+    Disabled = 7,
+}
+
+// pub fn log_line(severity: Severity, prefix: String, line: String) -> Info {
+//     let mut size = get_combined_size!(severity);
+//     size += prefix.len() + line.len();
+
+//     let mut info = Info::new(InfoType::LogLine, size);
+//     let vec = &mut info.0;
+//     push_bytes!(vec, severity as u8);
+//     push_bytes!(vec, prefix.as_bytes());
+//     push_bytes!(vec, line.as_bytes());
+//     info
+// }
+
+pub fn log_line(severity: Severity, capacity: usize) -> Info {
+    let mut info = Info::with_capacity(InfoType::LogLine, capacity);
+    let vec = &mut info.0;
+    push_bytes!(vec, severity as u8);
+    info
+}
+
+// Special struct for Bandwidth stats
+pub struct BandwidthValueV4 {
+    pub local_ip: [u8; 4],
+    pub local_port: u16,
+    pub remote_ip: [u8; 4],
+    pub remote_port: u16,
+    pub transmitted_bytes: u64,
+    pub received_bytes: u64,
+}
+
+impl BandwidthValueV4 {
+    fn get_size(&self) -> usize {
+        get_combined_size!(
+            self.local_ip,
+            self.local_port,
+            self.remote_ip,
+            self.remote_port,
+            self.transmitted_bytes,
+            self.received_bytes
+        )
+    }
+}
+
+impl PushBytes for BandwidthValueV4 {
+    fn push(self, vec: &mut Vec<u8>) {
+        push_bytes!(vec, self.local_ip);
+        push_bytes!(vec, self.local_port);
+        push_bytes!(vec, self.remote_ip);
+        push_bytes!(vec, self.remote_port);
+        push_bytes!(vec, self.transmitted_bytes);
+        push_bytes!(vec, self.received_bytes);
+    }
+}
+
+pub struct BandwidthValueV6 {
+    pub local_ip: [u8; 16],
+    pub local_port: u16,
+    pub remote_ip: [u8; 16],
+    pub remote_port: u16,
+    pub transmitted_bytes: u64,
+    pub received_bytes: u64,
+}
+
+impl BandwidthValueV6 {
+    fn get_size(&self) -> usize {
+        get_combined_size!(
+            self.local_ip,
+            self.local_port,
+            self.remote_ip,
+            self.remote_port,
+            self.transmitted_bytes,
+            self.received_bytes
+        )
+    }
+}
+
+impl PushBytes for BandwidthValueV6 {
+    fn push(self, vec: &mut Vec<u8>) {
+        push_bytes!(vec, self.local_ip);
+        push_bytes!(vec, self.local_port);
+        push_bytes!(vec, self.remote_ip);
+        push_bytes!(vec, self.remote_port);
+        push_bytes!(vec, self.transmitted_bytes);
+        push_bytes!(vec, self.received_bytes);
+    }
+}
+
+pub fn bandiwth_stats_array_v4(protocol: u8, values: Vec<BandwidthValueV4>) -> Info {
+    let mut size = get_combined_size!(protocol, values.len() as u32);
+
+    if !values.is_empty() {
+        size += values[0].get_size() * values.len();
+    }
+
+    let mut info = Info::new(InfoType::BandwidthStatsV4, size);
+    let vec = &mut info.0;
+    push_bytes!(vec, protocol);
+    push_bytes!(vec, values.len() as u32);
+    for v in values {
+        push_bytes!(vec, v);
+    }
+    info
+}
+
+pub fn bandiwth_stats_array_v6(protocol: u8, values: Vec<BandwidthValueV6>) -> Info {
+    let mut size = get_combined_size!(protocol, values.len() as u32);
+
+    if !values.is_empty() {
+        size += values[0].get_size() * values.len();
+    }
+
+    let mut info = Info::new(InfoType::BandwidthStatsV6, size);
+    let vec = &mut info.0;
+    push_bytes!(vec, protocol);
+    push_bytes!(vec, values.len() as u32);
+    for v in values {
+        push_bytes!(vec, v);
+    }
+    info
+}
+
+#[cfg(test)]
+use std::fs::File;
+#[cfg(test)]
+use std::io::Write;
+
+#[cfg(test)]
+use rand::seq::SliceRandom;
+
+#[test]
+fn generate_test_info_file() -> Result<(), std::io::Error> {
+    let mut file = File::create("../kextinterface/testdata/rust_info_test.bin")?;
+    let enums = [
+        InfoType::LogLine,
+        InfoType::ConnectionIpv4,
+        InfoType::ConnectionIpv6,
+        InfoType::ConnectionEndEventV4,
+        InfoType::ConnectionEndEventV6,
+        InfoType::BandwidthStatsV4,
+        InfoType::BandwidthStatsV6,
+    ];
+
+    let mut selected: Vec<InfoType> = Vec::with_capacity(1000);
+    let mut rng = rand::thread_rng();
+    for _ in 0..selected.capacity() {
+        selected.push(enums.choose(&mut rng).unwrap().clone());
+    }
+    // Write wrong size data. To make sure that mismatches between kext and portmaster are handled properly.
+    let mut info = connection_info_v6(
+        1,
+        2,
+        3,
+        4,
+        [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16],
+        [2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17],
+        5,
+        6,
+        7,
+        &[1, 2, 3, 4, 5, 6, 7, 8, 9, 10],
+    );
+    info.assert_size();
+    info.0[0] = InfoType::ConnectionIpv4 as u8;
+    file.write_all(&info.0)?;
+
+    for value in selected {
+        file.write_all(&match value {
+            InfoType::LogLine => {
+                let mut info = log_line(Severity::Trace, 5);
+                use std::fmt::Write;
+                _ = write!(info, "prefix: test log");
+                info.assert_size();
+                info.0
+            }
+            InfoType::ConnectionIpv4 => {
+                let info = connection_info_v4(
+                    1,
+                    2,
+                    3,
+                    4,
+                    [1, 2, 3, 4],
+                    [2, 3, 4, 5],
+                    5,
+                    6,
+                    7,
+                    &[1, 2, 3, 4, 5, 6, 7, 8, 9, 10],
+                );
+                info.assert_size();
+                info.0
+            }
+
+            InfoType::ConnectionIpv6 => {
+                let info = connection_info_v6(
+                    1,
+                    2,
+                    3,
+                    4,
+                    [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16],
+                    [2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17],
+                    5,
+                    6,
+                    7,
+                    &[1, 2, 3, 4, 5, 6, 7, 8, 9, 10],
+                );
+                info.assert_size();
+                info.0
+            }
+            InfoType::ConnectionEndEventV4 => {
+                let info = connection_end_event_v4_info(1, 2, 3, [1, 2, 3, 4], [2, 3, 4, 5], 4, 5);
+                info.assert_size();
+                info.0
+            }
+            InfoType::ConnectionEndEventV6 => {
+                let info = connection_end_event_v6_info(
+                    1,
+                    2,
+                    3,
+                    [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16],
+                    [2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17],
+                    4,
+                    5,
+                );
+                info.assert_size();
+                info.0
+            }
+            InfoType::BandwidthStatsV4 => {
+                let mut vec = Vec::new();
+                vec.push(BandwidthValueV4 {
+                    local_ip: [1, 2, 3, 4],
+                    local_port: 1,
+                    remote_ip: [2, 3, 4, 5],
+                    remote_port: 2,
+                    transmitted_bytes: 3,
+                    received_bytes: 4,
+                });
+                vec.push(BandwidthValueV4 {
+                    local_ip: [1, 2, 3, 4],
+                    local_port: 5,
+                    remote_ip: [2, 3, 4, 5],
+                    remote_port: 6,
+                    transmitted_bytes: 7,
+                    received_bytes: 8,
+                });
+                let info = bandiwth_stats_array_v4(1, vec);
+                info.assert_size();
+                info.0
+            }
+            InfoType::BandwidthStatsV6 => {
+                let mut vec = Vec::new();
+                vec.push(BandwidthValueV6 {
+                    local_ip: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16],
+                    local_port: 1,
+                    remote_ip: [2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17],
+                    remote_port: 2,
+                    transmitted_bytes: 3,
+                    received_bytes: 4,
+                });
+                vec.push(BandwidthValueV6 {
+                    local_ip: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16],
+                    local_port: 5,
+                    remote_ip: [2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17],
+                    remote_port: 6,
+                    transmitted_bytes: 7,
+                    received_bytes: 8,
+                });
+                let info = bandiwth_stats_array_v6(1, vec);
+                info.assert_size();
+                info.0
+            }
+        })?;
+    }
+
+    return Ok(());
+}

windows_kext/protocol/src/lib.rs

@@ -0,0 +1,5 @@
+#![cfg_attr(not(test), no_std)]
+extern crate alloc;
+
+pub mod command;
+pub mod info;

windows_kext/release/Cargo.lock

@@ -0,0 +1,525 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "android-tzdata"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e999941b234f3131b00bc13c22d06e8c5ff726d1b6318ac7eb276997bbb4fef0"
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.15.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ff69b9dd49fd426c69a0db9fc04dd934cdb6645ff000864d98f7e2af8830eaa"
+
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
+[[package]]
+name = "cc"
+version = "1.0.90"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8cd6604a82acf3039f1144f54b8eb34e91ffba622051189e71b781822d5ee1f5"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "chrono"
+version = "0.4.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8eaf5903dcbc0a39312feb77df2ff4c76387d591b9fc7b04a238dcf8bb62639a"
+dependencies = [
+ "android-tzdata",
+ "iana-time-zone",
+ "js-sys",
+ "num-traits",
+ "wasm-bindgen",
+ "windows-targets",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06ea2b9bc92be3c2baa9334a323ebca2d6f074ff852cd1d7b11064035cd3868f"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53fe5e26ff1b7aef8bca9c6080520cfb8d9333c7568e1829cef191a9723e5504"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crc32fast"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b3855a8a784b474f333699ef2bbca9db2c4a1f6d9088a90a2d25b1eb53111eaa"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "248e3bacc7dc6baa3b21e405ee045c3047101a49145e7e9eca583ab4c2ca5345"
+
+[[package]]
+name = "crypto-common"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "crypto-common",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "handlebars"
+version = "5.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab283476b99e66691dee3f1640fea91487a8d81f50fb5ecc75538f8f8879a1e4"
+dependencies = [
+ "log",
+ "pest",
+ "pest_derive",
+ "serde",
+ "serde_json",
+ "thiserror",
+]
+
+[[package]]
+name = "iana-time-zone"
+version = "0.1.60"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7ffbb5a1b541ea2561f8c41c087286cc091e21e556a4f09a8f6cbf17b69b141"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "wasm-bindgen",
+ "windows-core",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1a46d1a171d865aa5f83f92695765caa047a9b4cbae2cbf37dbd613a793fd4c"
+
+[[package]]
+name = "js-sys"
+version = "0.3.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29c15563dc2726973df627357ce0c9ddddbea194836909d655df6a75d2cf296d"
+dependencies = [
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.153"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c198f91728a82281a64e1f4f9eeb25d82cb32a5de251c6bd1b5154d63a8e7bd"
+
+[[package]]
+name = "log"
+version = "0.4.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90ed8c1e510134f979dbc4f070f87d4313098b704861a105fe34231c70a3901c"
+
+[[package]]
+name = "memchr"
+version = "2.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "523dc4f511e55ab87b694dc30d0f820d60906ef06413f93d4d7a1385599cc149"
+
+[[package]]
+name = "num-traits"
+version = "0.2.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da0df0e5185db44f69b44f26786fe401b6c293d1907744beaa7fa62b2e5a517a"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
+
+[[package]]
+name = "pest"
+version = "2.7.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56f8023d0fb78c8e03784ea1c7f3fa36e68a723138990b8d5a47d916b651e7a8"
+dependencies = [
+ "memchr",
+ "thiserror",
+ "ucd-trie",
+]
+
+[[package]]
+name = "pest_derive"
+version = "2.7.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b0d24f72393fd16ab6ac5738bc33cdb6a9aa73f8b902e8fe29cf4e67d7dd1026"
+dependencies = [
+ "pest",
+ "pest_generator",
+]
+
+[[package]]
+name = "pest_generator"
+version = "2.7.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fdc17e2a6c7d0a492f0158d7a4bd66cc17280308bbaff78d5bef566dca35ab80"
+dependencies = [
+ "pest",
+ "pest_meta",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "pest_meta"
+version = "2.7.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "934cd7631c050f4674352a6e835d5f6711ffbfb9345c2fc0107155ac495ae293"
+dependencies = [
+ "once_cell",
+ "pest",
+ "sha2",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.79"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e835ff2298f5721608eb1a980ecaee1aef2c132bf95ecc026a11b7bf3c01c02e"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291ec9ab5efd934aaf503a6466c5d5251535d108ee747472c3977cc5acc868ef"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "release"
+version = "0.0.0"
+dependencies = [
+ "chrono",
+ "handlebars",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "zip",
+]
+
+[[package]]
+name = "ryu"
+version = "1.0.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e86697c916019a8588c99b5fac3cead74ec0b4b819707a682fd4d23fa0ce1ba1"
+
+[[package]]
+name = "serde"
+version = "1.0.197"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3fb1c873e1b9b056a4dc4c0c198b24c3ffa059243875552b2bd0933b1aee4ce2"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.197"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7eb0b34b42edc17f6b7cac84a52a1c5f0e1bb2227e997ca9011ea3dd34e8610b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.114"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c5f09b1bd632ef549eaa9f60a1f8de742bdbc698e6cee2095fc84dde5f549ae0"
+dependencies = [
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "793db75ad2bcafc3ffa7c68b215fee268f537982cd901d132f89c6343f3a3dc8"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.53"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7383cd0e49fff4b6b90ca5670bfd3e9d6a733b3f90c686605aa7eec8c4996032"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.58"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03468839009160513471e86a034bb2c5c0e4baae3b43f79ffc55c4a5427b3297"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.58"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c61f3ba182994efc43764a46c018c347bc492c79f024e705f46567b418f6d4f7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "typenum"
+version = "1.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"
+
+[[package]]
+name = "ucd-trie"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed646292ffc8188ef8ea4d1e0e0150fb15a5c2e12ad9b8fc191ae7a8a7f3c4b9"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
+
+[[package]]
+name = "version_check"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.92"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4be2531df63900aeb2bca0daaaddec08491ee64ceecbee5076636a3b026795a8"
+dependencies = [
+ "cfg-if",
+ "wasm-bindgen-macro",
+]
+
+[[package]]
+name = "wasm-bindgen-backend"
+version = "0.2.92"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "614d787b966d3989fa7bb98a654e369c762374fd3213d212cfc0251257e747da"
+dependencies = [
+ "bumpalo",
+ "log",
+ "once_cell",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.92"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1f8823de937b71b9460c0c34e25f3da88250760bec0ebac694b49997550d726"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.92"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e94f17b526d0a461a191c78ea52bbce64071ed5c04c9ffe424dcb38f74171bb7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-backend",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.92"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af190c94f2773fdb3729c55b007a722abb5384da03bc0986df4c289bf5567e96"
+
+[[package]]
+name = "windows-core"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33ab640c8d7e35bf8ba19b884ba838ceb4fba93a4e8c65a9059d08afcfc683d9"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7dd37b7e5ab9018759f893a1952c9420d060016fc19a472b4bb20d1bdd694d1b"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bcf46cf4c365c6f2d1cc93ce535f2c8b244591df96ceee75d8e83deb70a9cac9"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da9f259dd3bcf6990b55bffd094c4f7235817ba4ceebde8e6d11cd0c5633b675"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b474d8268f99e0995f25b9f095bc7434632601028cf86590aea5c8a5cb7801d3"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1515e9a29e5bed743cb4415a9ecf5dfca648ce85ee42e15873c3cd8610ff8e02"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5eee091590e89cc02ad514ffe3ead9eb6b660aedca2183455434b93546371a03"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ca79f2451b49fa9e2af39f0747fe999fcda4f5e241b2898624dca97a1f2177"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32b752e52a2da0ddfbdbcc6fceadfeede4c939ed16d13e648833a61dfb611ed8"
+
+[[package]]
+name = "zip"
+version = "0.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "760394e246e4c28189f19d488c058bf16f564016aefac5d32bb1f3b51d5e9261"
+dependencies = [
+ "byteorder",
+ "crc32fast",
+ "crossbeam-utils",
+]

windows_kext/release/Cargo.toml

@@ -0,0 +1,14 @@
+[package]
+name = "release"
+version = "0.0.0"
+edition = "2021"
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
+handlebars = "5.1.0"
+serde = "1.0.197"
+serde_derive = "1.0.197"
+serde_json = "1.0.114"
+chrono = "0.4.35"
+zip = { version = "0.6.6", default-features = false }

windows_kext/release/README.md

@@ -0,0 +1,28 @@
+# Kext release tool
+
+### Generate the zip file
+- Make sure `kextinterface/version.txt` is up to date
+- Execute: `cargo run`  
+  * This will generate release `kext_release_vX-X-X.zip` file. Which contains all the necessary files to make the release.  
+
+### Generate the cab file
+- Copy the zip and extract it on a windows machine.
+  * Some version Visual Studio needs to be installed.
+- From VS Command Prompt / PowerShell run:
+```
+cd kext_release_v.../
+./build_cab.bat
+```
+
+3. Sing the cab file
+
+### Let Microsoft Sign
+- Go to https://partner.microsoft.com/en-us/dashboard/hardware/driver/New
+- Enter "PortmasterKext vX.X.X #1" as the product name
+- Upload `portmaster-kext_vX-X-X.cab`
+- Select the Windows 10 versions that you compiled and tested on
+  - Currently: Windows 11 Client, version 22H2 x64 (Ni)
+- Wait for the process to finish, download the `.zip`.
+
+The zip will contain the release files.  
+> Optionally sign the .sys file.

windows_kext/release/src/main.rs

@@ -0,0 +1,124 @@
+use std::{fs::File, io::Write, process::Command};
+
+use chrono::Local;
+use handlebars::Handlebars;
+use serde_json::json;
+use zip::{write::FileOptions, ZipWriter};
+
+static VERSION: [u8; 4] = include!("../../kextinterface/version.txt");
+static LIB_PATH: &'static str = "./build/x86_64-pc-windows-msvc/release/driver.lib";
+
+fn main() {
+    build_driver();
+    println!(
+        "Building kext v{}-{}-{} #{}",
+        VERSION[0], VERSION[1], VERSION[2], VERSION[3]
+    );
+
+    // Create Zip that will hold all the release files and scripts.
+    let file = File::create("portmaster-kext-release-bundle.zip").unwrap();
+    let mut zip = zip::ZipWriter::new(file);
+
+    // Write files to zip
+    zip.add_directory("cab", FileOptions::default()).unwrap();
+
+    // Write driver.lib
+    write_lib_file_zip(&mut zip);
+
+    // Write ddf file
+    write_to_zip(&mut zip, "PortmasterKext.ddf", get_ddf_content());
+
+    // Write build cab script
+    write_to_zip(&mut zip, "build_cab.ps1", get_build_cab_script_content());
+
+    // Write metadata file
+    write_to_zip(&mut zip, "version.rc", get_metadata_file_content());
+
+    // Write inf file
+    write_to_zip(&mut zip, "cab/PortmasterKext64.inf", get_inf_content());
+
+    zip.finish().unwrap();
+}
+
+fn version_str() -> String {
+    return format!(
+        "{}.{}.{}.{}",
+        VERSION[0], VERSION[1], VERSION[2], VERSION[3]
+    );
+}
+
+fn build_driver() {
+    let output = Command::new("cargo")
+        .current_dir("../driver")
+        .arg("build")
+        .arg("--release")
+        .args(["--target", "x86_64-pc-windows-msvc"])
+        .args(["--target-dir", "../release/build"])
+        .output()
+        .unwrap();
+    println!("{}", String::from_utf8(output.stderr).unwrap());
+}
+
+fn get_inf_content() -> String {
+    let reg = Handlebars::new();
+    let today = Local::now();
+    reg.render_template(
+        include_str!("../templates/PortmasterKext64.inf"),
+        &json!({"date": today.format("%m/%d/%Y").to_string(), "version": version_str()}),
+    )
+    .unwrap()
+}
+
+fn get_ddf_content() -> String {
+    let reg = Handlebars::new();
+    let cab_file = format!(
+        "PortmasterKext_v{}-{}-{}.cab",
+        VERSION[0], VERSION[1], VERSION[2]
+    );
+    reg.render_template(
+        include_str!("../templates/PortmasterKext.ddf"),
+        &json!({"cab_file": cab_file}),
+    )
+    .unwrap()
+}
+
+fn get_metadata_file_content() -> String {
+    let reg = Handlebars::new();
+
+    let version = format!(
+        "{}, {}, {}, {}",
+        VERSION[0], VERSION[1], VERSION[2], VERSION[3]
+    );
+    reg.render_template(
+        include_str!("../templates/version.rc"),
+        &json!({"version": version, "version_str": version_str()}),
+    )
+    .unwrap()
+}
+
+fn get_build_cab_script_content() -> String {
+    let reg = Handlebars::new();
+    let cab_file = format!(
+        "PortmasterKext_v{}-{}-{}.cab",
+        VERSION[0], VERSION[1], VERSION[2]
+    );
+
+    reg
+        .render_template(
+            include_str!("../templates/build_cab.ps1"),
+            &json!({"sys_file": "PortmasterKext64.sys", "pdb_file": "PortmasterKext64.pdb", "lib_file": "driver.lib", "cab_file": &cab_file }),
+        )
+        .unwrap()
+}
+
+fn write_to_zip(zip: &mut ZipWriter<File>, filename: &str, content: String) {
+    zip.start_file(filename, FileOptions::default()).unwrap();
+    zip.write(&content.into_bytes()).unwrap();
+}
+
+fn write_lib_file_zip(zip: &mut ZipWriter<File>) {
+    zip.start_file("driver.lib", FileOptions::default())
+        .unwrap();
+    let mut driver_file = File::open(LIB_PATH).unwrap();
+    std::io::copy(&mut driver_file, zip).unwrap();
+}

windows_kext/release/templates/PortmasterKext.ddf

@@ -0,0 +1,24 @@
+;*** PortmasterKext.ddf
+.OPTION EXPLICIT     ; Generate errors
+.Set CabinetFileCountThreshold=0
+.Set FolderFileCountThreshold=0
+.Set FolderSizeThreshold=0
+.Set MaxCabinetSize=0
+.Set MaxDiskFileCount=0
+.Set MaxDiskSize=0
+.Set CompressionType=MSZIP
+.Set Cabinet=on
+.Set Compress=on
+
+;Specify file name for new cab file
+.Set CabinetNameTemplate={{cab_file}}
+
+; Specify the subdirectory for the files.
+; Your cab file should not have files at the root level,
+; and each driver package must be in a separate subfolder.
+.Set DestinationDir=PortmasterKext
+
+;Specify files to be included in cab file
+.\cab\\PortmasterKext64.inf
+.\cab\\PortmasterKext64.sys
+.\cab\\PortmasterKext64.pdb

windows_kext/release/templates/PortmasterKext64.inf

@@ -0,0 +1,62 @@
+
+;/*++
+;
+;Copyright (c) Safing ICS Technologies GmbH.
+;
+;    This program is free software: you can redistribute it and/or modify
+;    it under the terms of the GNU General Public License as published by
+;    the Free Software Foundation, either version 3 of the License, or
+;    (at your option) any later version.
+;
+;    This program is distributed in the hope that it will be useful,
+;    but WITHOUT ANY WARRANTY; without even the implied warranty of
+;    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;    GNU General Public License for more details.
+;
+;    You should have received a copy of the GNU General Public License
+;    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+;
+;--*/
+
+[Version]
+Signature = "$Windows NT$"
+Class = WFPCALLOUTS
+ClassGuid = {57465043-616C-6C6F-7574-5F636C617373}
+Provider = %Provider%
+CatalogFile = PortmasterKext64.Cat
+DriverVer = {{date}},{{version}}
+
+[SourceDisksNames]
+1 = %DiskName%
+
+[SourceDisksFiles]
+PortmasterKext64.sys = 1
+
+[DestinationDirs]
+DefaultDestDir = 12 ; %windir%\system32\drivers
+PortmasterKext.DriverFiles = 12 ; %windir%\system32\drivers
+
+[DefaultInstall.NTamd64]
+OptionDesc = %Description%
+CopyFiles = PortmasterKext.DriverFiles
+
+[DefaultInstall.NTamd64.Services]
+AddService = %ServiceName%,,PortmasterKext.Service
+
+[PortmasterKext.DriverFiles]
+PortmasterKext64.sys,,,0x00000040 ; COPYFLG_OVERWRITE_OLDER_ONLY
+
+[PortmasterKext.Service]
+DisplayName = %ServiceName%
+Description = %ServiceDesc%
+ServiceType = 1  ; SERVICE_KERNEL_DRIVER
+StartType = 0    ; SERVICE_BOOT_START
+ErrorControl = 1 ; SERVICE_ERROR_NORMAL
+ServiceBinary = %12%\PortmasterKext64.sys
+
+[Strings]
+Provider = "Safing ICS Technologies GmbH"
+DiskName = "PortmasterKext Installation Disk"
+Description = "PortmasterKext Driver"
+ServiceName = "PortmasterKext"
+ServiceDesc = "PortmasterKext Driver"

windows_kext/release/templates/build_cab.ps1

@@ -0,0 +1,59 @@
+# Remove previous cab build
+Remove-Item -Path "PortmasterKext_v2-0-0.cab" -ErrorAction SilentlyContinue
+
+$SDK_Version = "10.0.22621.0"
+
+# Build metadata file
+rc -I "C:\Program Files (x86)\Windows Kits\10\Include\$SDK_Version\um" `
+   -I "C:\Program Files (x86)\Windows Kits\10\Include\$SDK_Version\shared" `
+    .\version.rc
+
+# Link the driver.
+link.exe /OUT:{{sys_file}} `
+/MANIFEST:NO /PROFILE /Driver `
+"C:\Program Files (x86)\Windows Kits\10\lib\$SDK_Version\km\x64\wdmsec.lib" `
+"C:\Program Files (x86)\Windows Kits\10\lib\$SDK_Version\km\x64\ndis.lib" `
+"C:\Program Files (x86)\Windows Kits\10\lib\$SDK_Version\km\x64\fwpkclnt.lib" `
+"C:\Program Files (x86)\Windows Kits\10\lib\$SDK_Version\um\x64\uuid.lib" `
+"C:\Program Files (x86)\Windows Kits\10\lib\$SDK_Version\km\x64\BufferOverflowK.lib" `
+"C:\Program Files (x86)\Windows Kits\10\lib\$SDK_Version\km\x64\ntoskrnl.lib" `
+"C:\Program Files (x86)\Windows Kits\10\lib\$SDK_Version\km\x64\hal.lib" `
+"C:\Program Files (x86)\Windows Kits\10\lib\$SDK_Version\km\x64\wmilib.lib" `
+"C:\Program Files (x86)\Windows Kits\10\lib\wdf\kmdf\x64\1.15\WdfLdr.lib" `
+"C:\Program Files (x86)\Windows Kits\10\lib\wdf\kmdf\x64\1.15\WdfDriverEntry.lib" `
+"{{lib_file}}" "version.res" `
+/RELEASE /VERSION:"10.0" /DEBUG /MACHINE:X64 /ENTRY:"FxDriverEntry" /OPT:REF /INCREMENTAL:NO /SUBSYSTEM:NATIVE",6.01" /OPT:ICF /ERRORREPORT:PROMPT /MERGE:"_TEXT=.text;_PAGE=PAGE" /NOLOGO /NODEFAULTLIB /SECTION:"INIT,d" 
+if(!$?) { 
+    Exit $LASTEXITCODE 
+}
+
+# Move the driver and debug symbolds into the cab directory.
+move {{sys_file}} cab\\PortmasterKext64.sys
+move {{pdb_file}} cab\\PortmasterKext64.pdb
+
+# Create the cab.
+Write-Host
+Write-Host =====
+Write-Host creating .cab ...
+MakeCab /f PortmasterKext.ddf
+if(!$?) { 
+    Exit $LASTEXITCODE 
+}
+
+# Clean up after cab creation.
+Write-Host
+Write-Host =====
+Write-Host cleaning up ...
+Remove-Item -Path "setup.inf" -ErrorAction SilentlyContinue
+Remove-Item -Path "setup.rpt" -ErrorAction SilentlyContinue
+Move-Item disk1\\{{cab_file}} {{cab_file}}
+Remove-Item disk1
+
+# Print signing instructions.
+Write-Host
+Write-Host =====
+Write-Host YOUR TURN: sign the .cab
+Write-Host "(If the sha1 fingerprint of the cert has changed, you can find it in the cert properties on Windows as Thumbprint)"
+Write-Host
+Write-Host signtool sign /sha1 69ADFEACD5AC42D0DB5698E38CA917B9C60FBFA6 /tr http://timestamp.digicert.com /td sha256 /fd sha256 /a {{cab_file}}
+Write-Host

windows_kext/release/templates/version.rc

@@ -0,0 +1,34 @@
+#include "winres.h"
+
+/////////////////////////////////////////////////////////////////////////////
+//
+// Version
+//
+
+VS_VERSION_INFO VERSIONINFO
+ FILEVERSION {{version}}
+ PRODUCTVERSION {{version}}
+ FILEFLAGSMASK 0x3fL
+ FILEFLAGS 0x0L
+ FILEOS 0x40004L
+ FILETYPE VFT_DRV
+ FILESUBTYPE 0x0L
+BEGIN
+    BLOCK "StringFileInfo"
+    BEGIN
+        BLOCK "040904b0"
+        BEGIN
+            VALUE "CompanyName", "Safing ICS Technologies GmbH"
+            VALUE "FileDescription", "Portmaster Windows Kernel Extension Driver"
+            VALUE "FileVersion", "{{version_str}}"
+            VALUE "LegalCopyright", "Safing ICS Technologies GmbH"
+            VALUE "OriginalFilename", "PortmasterKext64.sys"
+            VALUE "ProductName", "Portmaster Windows Kernel Extension"
+            VALUE "ProductVersion", "{{version_str}}"
+        END
+    END
+    BLOCK "VarFileInfo"
+    BEGIN
+        VALUE "Translation", 0x409, 1200
+    END
+END

windows_kext/test_protocol.sh

@@ -0,0 +1,8 @@
+#!/bin/sh
+echo Running tests
+echo ========================
+cd protocol
+cargo test
+
+cd ../kextinterface
+go test -v .

windows_kext/wdk/.cargo/config.toml

@@ -0,0 +1,2 @@
+[build]
+target = "x86_64-pc-windows-msvc"

windows_kext/wdk/Cargo.lock

@@ -0,0 +1,145 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "ntstatus"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96ea8ea6a9a8cbe8fefe99b632bd45ec4b41b0bf234e4d740c516372922fb180"
+dependencies = [
+ "num_enum",
+]
+
+[[package]]
+name = "num_enum"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "683751d591e6d81200c39fb0d1032608b77724f34114db54f571ff1317b337c0"
+dependencies = [
+ "num_enum_derive",
+]
+
+[[package]]
+name = "num_enum_derive"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c11e44798ad209ccdd91fc192f0526a369a01234f7373e1b141c96d7cee4f0e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.70"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39278fbbf5fb4f646ce651690877f89d1c5811a3d4acb27700c1cb3cdb78fd3b"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5267fca4496028628a95160fc423a33e8b2e6af8a5302579e322e4b520293cae"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.41"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44c8b28c477cc3bf0e7966561e3460130e1255f7a1cf71931075f1c5e7a7e269"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
+
+[[package]]
+name = "wdk"
+version = "0.0.0"
+dependencies = [
+ "ntstatus",
+ "widestring",
+ "windows-sys",
+]
+
+[[package]]
+name = "widestring"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "653f141f39ec16bba3c5abe400a0c60da7468261cc2cbf36805022876bc721a8"
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "git+https://github.com/microsoft/windows-rs?rev=dffa8b03dc4987c278d82e88015ffe96aa8ac317#dffa8b03dc4987c278d82e88015ffe96aa8ac317"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.5"
+source = "git+https://github.com/microsoft/windows-rs?rev=dffa8b03dc4987c278d82e88015ffe96aa8ac317#dffa8b03dc4987c278d82e88015ffe96aa8ac317"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.5"
+source = "git+https://github.com/microsoft/windows-rs?rev=dffa8b03dc4987c278d82e88015ffe96aa8ac317#dffa8b03dc4987c278d82e88015ffe96aa8ac317"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.5"
+source = "git+https://github.com/microsoft/windows-rs?rev=dffa8b03dc4987c278d82e88015ffe96aa8ac317#dffa8b03dc4987c278d82e88015ffe96aa8ac317"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.5"
+source = "git+https://github.com/microsoft/windows-rs?rev=dffa8b03dc4987c278d82e88015ffe96aa8ac317#dffa8b03dc4987c278d82e88015ffe96aa8ac317"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.5"
+source = "git+https://github.com/microsoft/windows-rs?rev=dffa8b03dc4987c278d82e88015ffe96aa8ac317#dffa8b03dc4987c278d82e88015ffe96aa8ac317"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.5"
+source = "git+https://github.com/microsoft/windows-rs?rev=dffa8b03dc4987c278d82e88015ffe96aa8ac317#dffa8b03dc4987c278d82e88015ffe96aa8ac317"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.5"
+source = "git+https://github.com/microsoft/windows-rs?rev=dffa8b03dc4987c278d82e88015ffe96aa8ac317#dffa8b03dc4987c278d82e88015ffe96aa8ac317"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.5"
+source = "git+https://github.com/microsoft/windows-rs?rev=dffa8b03dc4987c278d82e88015ffe96aa8ac317#dffa8b03dc4987c278d82e88015ffe96aa8ac317"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.5"
+source = "git+https://github.com/microsoft/windows-rs?rev=dffa8b03dc4987c278d82e88015ffe96aa8ac317#dffa8b03dc4987c278d82e88015ffe96aa8ac317"

windows_kext/wdk/Cargo.toml

@@ -0,0 +1,20 @@
+[package]
+name = "wdk"
+version = "0.0.0"
+edition = "2021"
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
+ntstatus = { version = "0.1.2", default-features = false }
+
+[dependencies.widestring]
+version = "1.0.2"
+default-features = false 
+features = ["alloc"]
+
+# WARNING: Do not update. The version was choosen for a reason. See wdk/README.md for more detiels.
+[dependencies.windows-sys]
+git = "https://github.com/microsoft/windows-rs"
+rev = "dffa8b03dc4987c278d82e88015ffe96aa8ac317"
+features = ["Wdk_Foundation", "Wdk_Storage_FileSystem", "Wdk_System_SystemServices", "Win32_Foundation", "Win32_Security", "Win32_System_IO", "Win32_System_Kernel", "Win32_System_Power", "Win32_System_WindowsProgramming", "Win32_NetworkManagement_IpHelper", "Win32_Networking_WinSock", "Win32_NetworkManagement_WindowsFilteringPlatform", "Win32_System_Rpc"]

windows_kext/wdk/README.md

@@ -0,0 +1,16 @@
+# WDK (Windows Driver Kit)
+
+A library that interfaces with the windows kernel.  
+The crate has extensive use of **unsafe** rust, be more causes when making changes.
+
+Do not update `windows-sys` dependency.
+The version contains bugs that have specific workarounds in this crate. Updating without reviewing the new version can result in broken build or undefined behavior.
+
+see: `wdk/src/driver.rs`
+see: `wdk/src/irp_helper.rs`
+
+Open issues need to be resolved:
+https://github.com/microsoft/windows-rs/issues/2805
+
+Resolved:
+https://github.com/microsoft/wdkmetadata/issues/59

windows_kext/wdk/build.rs

@@ -0,0 +1,13 @@
+#[cfg(target_arch = "x86_64")]
+fn main() {
+    // C Helper
+    println!("cargo:rerun-if-changed=../c_helper/x64/c_helper.lib");
+    println!("cargo:rustc-link-search=native=../c_helper/x64");
+}
+
+#[cfg(target_arch = "aarch64")]
+fn main() {
+    // C Helper
+    println!("cargo:rerun-if-changed=../c_helper/ARM64/c_helper.lib");
+    println!("cargo:rustc-link-search=native=../c_helper/ARM64");
+}