Merge pull request #1513 from safing/feature/new-kext

Support for new windows kext

service/firewall/interception/interception_windows.go

@@ -5,12 +5,16 @@ import (
 	"fmt"
 	"time"
 
-	"github.com/safing/portmaster/service/firewall/interception/windowskext"
+	"github.com/safing/portbase/log"
+	kext1 "github.com/safing/portmaster/service/firewall/interception/windowskext"
+	kext2 "github.com/safing/portmaster/service/firewall/interception/windowskext2"
 	"github.com/safing/portmaster/service/network"
 	"github.com/safing/portmaster/service/network/packet"
 	"github.com/safing/portmaster/service/updates"
 )
 
+var useOldKext = false
+
 // start starts the interception.
 func startInterception(packets chan packet.Packet) error {
 	kextFile, err := updates.GetPlatformFile("kext/portmaster-kext.sys")
@@ -18,51 +22,142 @@ func startInterception(packets chan packet.Packet) error {
 		return fmt.Errorf("interception: could not get kext sys: %s", err)
 	}
 
-	err = windowskext.Init(kextFile.Path())
+	err = kext2.Init(kextFile.Path())
 	if err != nil {
 		return fmt.Errorf("interception: could not init windows kext: %s", err)
 	}
 
-	err = windowskext.Start()
+	err = kext2.Start()
 	if err != nil {
 		return fmt.Errorf("interception: could not start windows kext: %s", err)
 	}
 
-	// Start packet handler.
-	module.StartServiceWorker("kext packet handler", 0, func(ctx context.Context) error {
-		windowskext.Handler(ctx, packets)
-		return nil
-	})
+	version, err := kext2.GetVersion()
+	if err != nil {
+		return fmt.Errorf("interception: failed to read version: %s", err)
+	}
+	log.Debugf("Kext version: %s", version.String())
 
-	// Start bandwidth stats monitor.
-	module.StartServiceWorker("kext bandwidth stats monitor", 0, func(ctx context.Context) error {
-		return windowskext.BandwidthStatsWorker(ctx, 1*time.Second, BandwidthUpdates)
-	})
+	if version.Major < 2 {
+		useOldKext = true
+
+		// Transfer ownership.
+		kext1.SetKextHandler(kext2.GetKextHandle())
+		kext1.SetKextService(kext2.GetKextServiceHandle(), kextFile.Path())
+
+		// Start packet handler.
+		module.StartServiceWorker("kext packet handler", 0, func(ctx context.Context) error {
+			kext1.Handler(ctx, packets)
+			return nil
+		})
+
+		// Start bandwidth stats monitor.
+		module.StartServiceWorker("kext bandwidth stats monitor", 0, func(ctx context.Context) error {
+			return kext1.BandwidthStatsWorker(ctx, 1*time.Second, BandwidthUpdates)
+		})
+	} else {
+
+		// Start packet handler.
+		module.StartServiceWorker("kext packet handler", 0, func(ctx context.Context) error {
+			kext2.Handler(ctx, packets, BandwidthUpdates)
+			return nil
+		})
+
+		// Start bandwidth stats monitor.
+		module.StartServiceWorker("kext bandwidth request worker", 0, func(ctx context.Context) error {
+			timer := time.NewTicker(1 * time.Second)
+			defer timer.Stop()
+			for {
+				select {
+				case <-timer.C:
+					err := kext2.SendBandwidthStatsRequest()
+					if err != nil {
+						return err
+					}
+				case <-ctx.Done():
+					return nil
+				}
+
+			}
+		})
+
+		// Start kext logging. The worker will periodically send request to the kext to send logs.
+		module.StartServiceWorker("kext log request worker", 0, func(ctx context.Context) error {
+			timer := time.NewTicker(1 * time.Second)
+			defer timer.Stop()
+			for {
+				select {
+				case <-timer.C:
+					err := kext2.SendLogRequest()
+					if err != nil {
+						return err
+					}
+				case <-ctx.Done():
+					return nil
+				}
+
+			}
+		})
+
+		module.StartServiceWorker("kext clean ended connection worker", 0, func(ctx context.Context) error {
+			timer := time.NewTicker(30 * time.Second)
+			defer timer.Stop()
+			for {
+				select {
+				case <-timer.C:
+					err := kext2.SendCleanEndedConnection()
+					if err != nil {
+						return err
+					}
+				case <-ctx.Done():
+					return nil
+				}
+
+			}
+		})
+	}
 
 	return nil
 }
 
 // stop starts the interception.
 func stopInterception() error {
-	return windowskext.Stop()
+	if useOldKext {
+		return kext1.Stop()
+	}
+	return kext2.Stop()
 }
 
 // ResetVerdictOfAllConnections resets all connections so they are forced to go thought the firewall again.
 func ResetVerdictOfAllConnections() error {
-	return windowskext.ClearCache()
+	if useOldKext {
+		return kext1.ClearCache()
+	}
+	return kext2.ClearCache()
 }
 
 // UpdateVerdictOfConnection updates the verdict of the given connection in the kernel extension.
 func UpdateVerdictOfConnection(conn *network.Connection) error {
-	return windowskext.UpdateVerdict(conn)
+	if useOldKext {
+		return kext1.UpdateVerdict(conn)
+	}
+	return kext2.UpdateVerdict(conn)
 }
 
 // GetKextVersion returns the version of the kernel extension.
 func GetKextVersion() (string, error) {
-	version, err := windowskext.GetVersion()
-	if err != nil {
-		return "", err
+	if useOldKext {
+		version, err := kext1.GetVersion()
+		if err != nil {
+			return "", err
+		}
+		return version.String(), nil
+	} else {
+		version, err := kext2.GetVersion()
+		if err != nil {
+			return "", err
+		}
+		return version.String(), nil
 	}
 
-	return version.String(), nil
 }

service/firewall/interception/windowskext/bandwidth_stats.go

@@ -81,7 +81,7 @@ func reportBandwidth(ctx context.Context, bandwidthUpdates chan *packet.Bandwidt
 	return nil
 }
 
-func StartBandwithConsoleLogger() {
+func StartBandwidthConsoleLogger() {
 	go func() {
 		ticker := time.NewTicker(2 * time.Second)
 		defer ticker.Stop()

service/firewall/interception/windowskext/kext.go

@@ -76,6 +76,15 @@ func Start() error {
 	return nil
 }
 
+func SetKextHandler(handle windows.Handle) {
+	kextHandle = handle
+}
+
+func SetKextService(handle windows.Handle, path string) {
+	service = &KextService{handle: handle}
+	driverPath = path
+}
+
 // Stop intercepting.
 func Stop() error {
 	// Prepare kernel for shutdown

service/firewall/interception/windowskext/service.go

@@ -24,6 +24,7 @@ func createKextService(driverName string, driverPath string) (*KextService, erro
 	}
 	defer windows.CloseServiceHandle(manager)
 
+	// Convert the driver name to a UTF16 string
 	driverNameU16, err := syscall.UTF16FromString(driverName)
 	if err != nil {
 		return nil, fmt.Errorf("failed to convert driver name to UTF16 string: %w", err)

service/firewall/interception/windowskext2/doc.go

@@ -0,0 +1,4 @@
+// +build windows
+
+// Package windowskext provides network interception capabilities on windows via the Portmaster Kernel Extension.
+package windowskext

service/firewall/interception/windowskext2/handler.go

@@ -0,0 +1,195 @@
+//go:build windows
+// +build windows
+
+package windowskext
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"time"
+
+	"github.com/safing/portmaster/service/process"
+
+	"github.com/tevino/abool"
+
+	"github.com/safing/portbase/log"
+	"github.com/safing/portmaster/service/network/packet"
+)
+
+type VersionInfo struct {
+	Major    uint8
+	Minor    uint8
+	Revision uint8
+	Build    uint8
+}
+
+func (v *VersionInfo) String() string {
+	return fmt.Sprintf("%d.%d.%d.%d", v.Major, v.Minor, v.Revision, v.Build)
+}
+
+// Handler transforms received packets to the Packet interface.
+func Handler(ctx context.Context, packets chan packet.Packet, bandwidthUpdate chan *packet.BandwidthUpdate) {
+	for {
+		packetInfo, err := RecvVerdictRequest()
+		if err != nil {
+			log.Warningf("failed to get packet from windows kext: %s", err)
+			return
+		}
+
+		switch {
+		case packetInfo.ConnectionV4 != nil:
+			{
+				// log.Tracef("packet: %+v", packetInfo.ConnectionV4)
+				conn := packetInfo.ConnectionV4
+				// New Packet
+				newPacket := &Packet{
+					verdictRequest: conn.ID,
+					payload:        conn.Payload,
+					verdictSet:     abool.NewBool(false),
+				}
+				info := newPacket.Info()
+				info.Inbound = conn.Direction > 0
+				info.InTunnel = false
+				info.Protocol = packet.IPProtocol(conn.Protocol)
+				info.PID = int(conn.ProcessID)
+				info.SeenAt = time.Now()
+
+				// Check PID
+				if info.PID == 0 {
+					// Windows does not have zero PIDs.
+					// Set to UndefinedProcessID.
+					info.PID = process.UndefinedProcessID
+				}
+
+				// Set IP version
+				info.Version = packet.IPv4
+
+				// Set IPs
+				if info.Inbound {
+					// Inbound
+					info.Src = conn.RemoteIP[:]
+					info.Dst = conn.LocalIP[:]
+				} else {
+					// Outbound
+					info.Src = conn.LocalIP[:]
+					info.Dst = conn.RemoteIP[:]
+				}
+
+				// Set Ports
+				if info.Inbound {
+					// Inbound
+					info.SrcPort = conn.RemotePort
+					info.DstPort = conn.LocalPort
+				} else {
+					// Outbound
+					info.SrcPort = conn.LocalPort
+					info.DstPort = conn.RemotePort
+				}
+
+				packets <- newPacket
+			}
+		case packetInfo.ConnectionV6 != nil:
+			{
+				// log.Tracef("packet: %+v", packetInfo.ConnectionV6)
+				conn := packetInfo.ConnectionV6
+				// New Packet
+				newPacket := &Packet{
+					verdictRequest: conn.ID,
+					payload:        conn.Payload,
+					verdictSet:     abool.NewBool(false),
+				}
+				info := newPacket.Info()
+				info.Inbound = conn.Direction > 0
+				info.InTunnel = false
+				info.Protocol = packet.IPProtocol(conn.Protocol)
+				info.PID = int(conn.ProcessID)
+				info.SeenAt = time.Now()
+
+				// Check PID
+				if info.PID == 0 {
+					// Windows does not have zero PIDs.
+					// Set to UndefinedProcessID.
+					info.PID = process.UndefinedProcessID
+				}
+
+				// Set IP version
+				info.Version = packet.IPv6
+
+				// Set IPs
+				if info.Inbound {
+					// Inbound
+					info.Src = conn.RemoteIP[:]
+					info.Dst = conn.LocalIP[:]
+				} else {
+					// Outbound
+					info.Src = conn.LocalIP[:]
+					info.Dst = conn.RemoteIP[:]
+				}
+
+				// Set Ports
+				if info.Inbound {
+					// Inbound
+					info.SrcPort = conn.RemotePort
+					info.DstPort = conn.LocalPort
+				} else {
+					// Outbound
+					info.SrcPort = conn.LocalPort
+					info.DstPort = conn.RemotePort
+				}
+
+				packets <- newPacket
+			}
+		case packetInfo.LogLine != nil:
+			{
+				line := packetInfo.LogLine
+				switch line.Severity {
+				case byte(log.DebugLevel):
+					log.Debugf("kext: %s", line.Line)
+				case byte(log.InfoLevel):
+					log.Infof("kext: %s", line.Line)
+				case byte(log.WarningLevel):
+					log.Warningf("kext: %s", line.Line)
+				case byte(log.ErrorLevel):
+					log.Errorf("kext: %s", line.Line)
+				case byte(log.CriticalLevel):
+					log.Criticalf("kext: %s", line.Line)
+				}
+			}
+		case packetInfo.BandwidthStats != nil:
+			{
+				bandwidthStats := packetInfo.BandwidthStats
+				for _, stat := range bandwidthStats.ValuesV4 {
+					connID := packet.CreateConnectionID(
+						packet.IPProtocol(bandwidthStats.Protocol),
+						net.IP(stat.LocalIP[:]), stat.LocalPort,
+						net.IP(stat.RemoteIP[:]), stat.RemotePort,
+						false,
+					)
+					update := &packet.BandwidthUpdate{
+						ConnID:        connID,
+						BytesReceived: stat.ReceivedBytes,
+						BytesSent:     stat.TransmittedBytes,
+						Method:        packet.Additive,
+					}
+					bandwidthUpdate <- update
+				}
+				for _, stat := range bandwidthStats.ValuesV6 {
+					connID := packet.CreateConnectionID(
+						packet.IPProtocol(bandwidthStats.Protocol),
+						net.IP(stat.LocalIP[:]), stat.LocalPort,
+						net.IP(stat.RemoteIP[:]), stat.RemotePort,
+						false,
+					)
+					update := &packet.BandwidthUpdate{
+						ConnID:        connID,
+						BytesReceived: stat.ReceivedBytes,
+						BytesSent:     stat.TransmittedBytes,
+						Method:        packet.Additive,
+					}
+					bandwidthUpdate <- update
+				}
+			}
+		}
+	}
+}

service/firewall/interception/windowskext2/kext.go

@@ -0,0 +1,166 @@
+//go:build windows
+// +build windows
+
+package windowskext
+
+import (
+	"fmt"
+
+	"github.com/safing/portbase/log"
+	"github.com/safing/portmaster/service/network"
+	"github.com/safing/portmaster/windows_kext/kextinterface"
+	"golang.org/x/sys/windows"
+)
+
+// Package errors
+var (
+	driverPath string
+
+	service  *kextinterface.KextService
+	kextFile *kextinterface.KextFile
+)
+
+const (
+	driverName = "PortmasterKext"
+)
+
+func Init(path string) error {
+	driverPath = path
+	return nil
+}
+
+// Start intercepting.
+func Start() error {
+	// initialize and start driver service
+	var err error
+	service, err = kextinterface.CreateKextService(driverName, driverPath)
+	if err != nil {
+		return fmt.Errorf("failed to create service: %w", err)
+	}
+
+	// Start service and open file
+	service.Start(true)
+	kextFile, err = service.OpenFile(1024)
+
+	if err != nil {
+		return fmt.Errorf("failed to open driver: %w", err)
+	}
+
+	return nil
+}
+
+func GetKextHandle() windows.Handle {
+	return kextFile.GetHandle()
+}
+
+func GetKextServiceHandle() windows.Handle {
+	return service.GetHandle()
+}
+
+// Stop intercepting.
+func Stop() error {
+	// Prepare kernel for shutdown
+	err := shutdownRequest()
+	if err != nil {
+		log.Warningf("winkext: shutdown request failed: %s", err)
+	}
+	// Close the interface to the driver. Driver will continue to run.
+	err = kextFile.Close()
+	if err != nil {
+		log.Warningf("winkext: failed to close kext file: %s", err)
+	}
+
+	// Stop and delete the driver.
+	err = service.Stop(true)
+	if err != nil {
+		log.Warningf("winkext: failed to stop kernel service: %s", err)
+	}
+
+	err = service.Delete()
+	if err != nil {
+		log.Warningf("winkext: failed to delete kernel service: %s", err)
+	}
+	return nil
+}
+
+// Sends a shutdown request.
+func shutdownRequest() error {
+	return kextinterface.SendShutdownCommand(kextFile)
+}
+
+// Send request for logs of the kext.
+func SendLogRequest() error {
+	return kextinterface.SendGetLogsCommand(kextFile)
+}
+
+func SendBandwidthStatsRequest() error {
+	return kextinterface.SendGetBandwidthStatsCommand(kextFile)
+}
+
+func SendPrintMemoryStatsCommand() error {
+	return kextinterface.SendPrintMemoryStatsCommand(kextFile)
+}
+
+func SendCleanEndedConnection() error {
+	return kextinterface.SendCleanEndedConnectionsCommand(kextFile)
+}
+
+// RecvVerdictRequest waits for the next verdict request from the kext. If a timeout is reached, both *VerdictRequest and error will be nil.
+func RecvVerdictRequest() (*kextinterface.Info, error) {
+	return kextinterface.RecvInfo(kextFile)
+}
+
+// SetVerdict sets the verdict for a packet and/or connection.
+func SetVerdict(pkt *Packet, verdict kextinterface.KextVerdict) error {
+	verdictCommand := kextinterface.Verdict{ID: pkt.verdictRequest, Verdict: uint8(verdict)}
+	return kextinterface.SendVerdictCommand(kextFile, verdictCommand)
+}
+
+// Clears the internal connection cache.
+func ClearCache() error {
+	return kextinterface.SendClearCacheCommand(kextFile)
+}
+
+// Updates a specific connection verdict.
+func UpdateVerdict(conn *network.Connection) error {
+	if conn.IPVersion == 4 {
+		update := kextinterface.UpdateV4{
+			Protocol:      conn.Entity.Protocol,
+			LocalAddress:  [4]byte(conn.LocalIP),
+			LocalPort:     conn.LocalPort,
+			RemoteAddress: [4]byte(conn.Entity.IP),
+			RemotePort:    conn.Entity.Port,
+			Verdict:       uint8(conn.Verdict),
+		}
+
+		return kextinterface.SendUpdateV4Command(kextFile, update)
+	} else if conn.IPVersion == 6 {
+		update := kextinterface.UpdateV6{
+			Protocol:      conn.Entity.Protocol,
+			LocalAddress:  [16]byte(conn.LocalIP),
+			LocalPort:     conn.LocalPort,
+			RemoteAddress: [16]byte(conn.Entity.IP),
+			RemotePort:    conn.Entity.Port,
+			Verdict:       uint8(conn.Verdict),
+		}
+
+		return kextinterface.SendUpdateV6Command(kextFile, update)
+	}
+	return nil
+}
+
+// Returns the kext version.
+func GetVersion() (*VersionInfo, error) {
+	data, err := kextinterface.ReadVersion(kextFile)
+	if err != nil {
+		return nil, err
+	}
+
+	version := &VersionInfo{
+		Major:    data[0],
+		Minor:    data[1],
+		Revision: data[2],
+		Build:    data[3],
+	}
+	return version, nil
+}

service/firewall/interception/windowskext2/packet.go

@@ -0,0 +1,132 @@
+//go:build windows
+// +build windows
+
+package windowskext
+
+import (
+	"sync"
+
+	"github.com/tevino/abool"
+
+	"github.com/safing/portbase/log"
+	"github.com/safing/portmaster/service/network/packet"
+	"github.com/safing/portmaster/windows_kext/kextinterface"
+)
+
+// Packet represents an IP packet.
+type Packet struct {
+	packet.Base
+
+	verdictRequest uint64
+	payload        []byte
+	verdictSet     *abool.AtomicBool
+
+	payloadLoaded bool
+	lock          sync.Mutex
+}
+
+// FastTrackedByIntegration returns whether the packet has been fast-track
+// accepted by the OS integration.
+func (pkt *Packet) FastTrackedByIntegration() bool {
+	return false
+}
+
+// InfoOnly returns whether the packet is informational only and does not
+// represent an actual packet.
+func (pkt *Packet) InfoOnly() bool {
+	return false
+}
+
+// ExpectInfo returns whether the next packet is expected to be informational only.
+func (pkt *Packet) ExpectInfo() bool {
+	return false
+}
+
+// GetPayload returns the full raw packet.
+func (pkt *Packet) LoadPacketData() error {
+	pkt.lock.Lock()
+	defer pkt.lock.Unlock()
+
+	if !pkt.payloadLoaded {
+		pkt.payloadLoaded = true
+
+		if len(pkt.payload) > 0 {
+			err := packet.Parse(pkt.payload, &pkt.Base)
+			if err != nil {
+				log.Tracef("payload: %#v", pkt.payload)
+				log.Tracer(pkt.Ctx()).Warningf("windowskext: failed to parse payload: %s", err)
+				return packet.ErrFailedToLoadPayload
+			}
+		}
+	}
+
+	if len(pkt.Raw()) == 0 {
+		return packet.ErrFailedToLoadPayload
+	}
+
+	return nil
+}
+
+// Accept accepts the packet.
+func (pkt *Packet) Accept() error {
+	if pkt.verdictSet.SetToIf(false, true) {
+		return SetVerdict(pkt, kextinterface.VerdictAccept)
+	}
+	return nil
+}
+
+// Block blocks the packet.
+func (pkt *Packet) Block() error {
+	if pkt.verdictSet.SetToIf(false, true) {
+		return SetVerdict(pkt, kextinterface.VerdictBlock)
+	}
+	return nil
+}
+
+// Drop drops the packet.
+func (pkt *Packet) Drop() error {
+	if pkt.verdictSet.SetToIf(false, true) {
+		return SetVerdict(pkt, kextinterface.VerdictDrop)
+	}
+	return nil
+}
+
+// PermanentAccept permanently accepts connection (and the current packet).
+func (pkt *Packet) PermanentAccept() error {
+	if pkt.verdictSet.SetToIf(false, true) {
+		return SetVerdict(pkt, kextinterface.VerdictPermanentAccept)
+	}
+	return nil
+}
+
+// PermanentBlock permanently blocks connection (and the current packet).
+func (pkt *Packet) PermanentBlock() error {
+	if pkt.verdictSet.SetToIf(false, true) {
+		return SetVerdict(pkt, kextinterface.VerdictPermanentBlock)
+	}
+	return nil
+}
+
+// PermanentDrop permanently drops connection (and the current packet).
+func (pkt *Packet) PermanentDrop() error {
+	if pkt.verdictSet.SetToIf(false, true) {
+		return SetVerdict(pkt, kextinterface.VerdictPermanentDrop)
+	}
+	return nil
+}
+
+// RerouteToNameserver permanently reroutes the connection to the local nameserver (and the current packet).
+func (pkt *Packet) RerouteToNameserver() error {
+	if pkt.verdictSet.SetToIf(false, true) {
+		return SetVerdict(pkt, kextinterface.VerdictRerouteToNameserver)
+	}
+	return nil
+}
+
+// RerouteToTunnel permanently reroutes the connection to the local tunnel entrypoint (and the current packet).
+func (pkt *Packet) RerouteToTunnel() error {
+	if pkt.verdictSet.SetToIf(false, true) {
+		return SetVerdict(pkt, kextinterface.VerdictRerouteToTunnel)
+	}
+	return nil
+}

service/firewall/interception/windowskext2/service.go

@@ -0,0 +1,10 @@
+//go:build windows
+// +build windows
+
+package windowskext
+
+import "github.com/safing/portmaster/windows_kext/kextinterface"
+
+func createKextService(driverName string, driverPath string) (*kextinterface.KextService, error) {
+	return kextinterface.CreateKextService(driverName, driverPath)
+}