Add support for fast-tracking connections within the OS integration

firewall/interception/windowskext/handler.go

@@ -13,14 +13,26 @@ import (
 	"github.com/safing/portmaster/network/packet"
 )
 
+const (
+	// VerdictRequestFlagFastTrackPermitted is set on packets that have been
+	// already permitted by the kernel extension and the verdict request is only
+	// informational.
+	VerdictRequestFlagFastTrackPermitted = 1
+
+	// VerdictRequestFlagSocketAuth indicates that the verdict request is for a
+	// connection that was intercepted on an ALE layer instead of in the network
+	// stack itself. Thus, no packet data is available.
+	VerdictRequestFlagSocketAuth = 2
+)
+
 // VerdictRequest is the request structure from the Kext.
 type VerdictRequest struct {
 	id         uint32 // ID from RegisterPacket
 	_          uint64 // Process ID - does not yet work
 	direction  uint8
-	ipV6       uint8 // True: IPv6, False: IPv4
-	protocol   uint8 // Protocol
-	_          uint8
+	ipV6       uint8     // True: IPv6, False: IPv4
+	protocol   uint8     // Protocol
+	flags      uint8     // Flags
 	localIP    [4]uint32 // Source Address
 	remoteIP   [4]uint32 // Destination Address
 	localPort  uint16    // Source Port

firewall/interception/windowskext/kext.go

@@ -20,6 +20,7 @@ import (
 // Package errors
 var (
 	ErrKextNotReady = errors.New("the windows kernel extension (driver) is not ready to accept commands")
+	ErrNoPacketID   = errors.New("the packet has no ID, possibly because it was fast-tracked by the kernel extension")
 
 	winErrInvalidData = uintptr(windows.ERROR_INVALID_DATA)
 
@@ -178,22 +179,29 @@ func RecvVerdictRequest() (*VerdictRequest, error) {
 }
 
 // SetVerdict sets the verdict for a packet and/or connection.
-func SetVerdict(packetID uint32, verdict network.Verdict) error {
+func SetVerdict(pkt *Packet, verdict network.Verdict) error {
+	if pkt.verdictRequest.id == 0 {
+		log.Tracer(pkt.Ctx()).Errorf("kext: failed to set verdict %s: no packet ID", verdict)
+		return ErrNoPacketID
+	}
+
 	kextLock.RLock()
 	defer kextLock.RUnlock()
 	if !ready.IsSet() {
+		log.Tracer(pkt.Ctx()).Errorf("kext: failed to set verdict %s: kext not ready", verdict)
 		return ErrKextNotReady
 	}
 
 	atomic.AddInt32(urgentRequests, 1)
 	// timestamp := time.Now()
 	rc, _, lastErr := kext.setVerdict.Call(
-		uintptr(packetID),
+		uintptr(pkt.verdictRequest.id),
 		uintptr(verdict),
 	)
 	// log.Tracef("winkext: settings verdict for packetID %d took %s", packetID, time.Now().Sub(timestamp))
 	atomic.AddInt32(urgentRequests, -1)
 	if rc != windows.NO_ERROR {
+		log.Tracer(pkt.Ctx()).Errorf("kext: failed to set verdict %s on packet %d", verdict, pkt.verdictRequest.id)
 		return formatErr(lastErr, rc)
 	}
 	return nil
@@ -201,6 +209,10 @@ func SetVerdict(packetID uint32, verdict network.Verdict) error {
 
 // GetPayload returns the payload of a packet.
 func GetPayload(packetID uint32, packetSize uint32) ([]byte, error) {
+	if packetID == 0 {
+		return nil, ErrNoPacketID
+	}
+
 	kextLock.RLock()
 	defer kextLock.RUnlock()
 	if !ready.IsSet() {

firewall/interception/windowskext/packet.go

@@ -23,11 +23,21 @@ type Packet struct {
 	lock          sync.Mutex
 }
 
+// FastTrackedByIntegration returns whether the packet has been fast-track
+// accepted by the OS integration.
+func (pkt *Packet) FastTrackedByIntegration() bool {
+	return pkt.verdictRequest.flags&VerdictRequestFlagFastTrackPermitted > 0
+}
+
 // GetPayload returns the full raw packet.
 func (pkt *Packet) LoadPacketData() error {
 	pkt.lock.Lock()
 	defer pkt.lock.Unlock()
 
+	if pkt.verdictRequest.id == 0 {
+		return packet.ErrNoPacketID
+	}
+
 	if !pkt.payloadLoaded {
 		pkt.payloadLoaded = true
 
@@ -53,7 +63,7 @@ func (pkt *Packet) LoadPacketData() error {
 // Accept accepts the packet.
 func (pkt *Packet) Accept() error {
 	if pkt.verdictSet.SetToIf(false, true) {
-		return SetVerdict(pkt.verdictRequest.id, -network.VerdictAccept)
+		return SetVerdict(pkt, -network.VerdictAccept)
 	}
 	return nil
 }
@@ -61,7 +71,7 @@ func (pkt *Packet) Accept() error {
 // Block blocks the packet.
 func (pkt *Packet) Block() error {
 	if pkt.verdictSet.SetToIf(false, true) {
-		return SetVerdict(pkt.verdictRequest.id, -network.VerdictBlock)
+		return SetVerdict(pkt, -network.VerdictBlock)
 	}
 	return nil
 }
@@ -69,7 +79,7 @@ func (pkt *Packet) Block() error {
 // Drop drops the packet.
 func (pkt *Packet) Drop() error {
 	if pkt.verdictSet.SetToIf(false, true) {
-		return SetVerdict(pkt.verdictRequest.id, -network.VerdictDrop)
+		return SetVerdict(pkt, -network.VerdictDrop)
 	}
 	return nil
 }
@@ -77,7 +87,7 @@ func (pkt *Packet) Drop() error {
 // PermanentAccept permanently accepts connection (and the current packet).
 func (pkt *Packet) PermanentAccept() error {
 	if pkt.verdictSet.SetToIf(false, true) {
-		return SetVerdict(pkt.verdictRequest.id, network.VerdictAccept)
+		return SetVerdict(pkt, network.VerdictAccept)
 	}
 	return nil
 }
@@ -85,7 +95,7 @@ func (pkt *Packet) PermanentAccept() error {
 // PermanentBlock permanently blocks connection (and the current packet).
 func (pkt *Packet) PermanentBlock() error {
 	if pkt.verdictSet.SetToIf(false, true) {
-		return SetVerdict(pkt.verdictRequest.id, network.VerdictBlock)
+		return SetVerdict(pkt, network.VerdictBlock)
 	}
 	return nil
 }
@@ -93,7 +103,7 @@ func (pkt *Packet) PermanentBlock() error {
 // PermanentDrop permanently drops connection (and the current packet).
 func (pkt *Packet) PermanentDrop() error {
 	if pkt.verdictSet.SetToIf(false, true) {
-		return SetVerdict(pkt.verdictRequest.id, network.VerdictDrop)
+		return SetVerdict(pkt, network.VerdictDrop)
 	}
 	return nil
 }
@@ -101,7 +111,7 @@ func (pkt *Packet) PermanentDrop() error {
 // RerouteToNameserver permanently reroutes the connection to the local nameserver (and the current packet).
 func (pkt *Packet) RerouteToNameserver() error {
 	if pkt.verdictSet.SetToIf(false, true) {
-		return SetVerdict(pkt.verdictRequest.id, network.VerdictRerouteToNameserver)
+		return SetVerdict(pkt, network.VerdictRerouteToNameserver)
 	}
 	return nil
 }
@@ -109,7 +119,7 @@ func (pkt *Packet) RerouteToNameserver() error {
 // RerouteToTunnel permanently reroutes the connection to the local tunnel entrypoint (and the current packet).
 func (pkt *Packet) RerouteToTunnel() error {
 	if pkt.verdictSet.SetToIf(false, true) {
-		return SetVerdict(pkt.verdictRequest.id, network.VerdictRerouteToTunnel)
+		return SetVerdict(pkt, network.VerdictRerouteToTunnel)
 	}
 	return nil
 }