Move kext files to proper path

service/firewall/interception/interception_windows.go

@@ -6,11 +6,11 @@ import (
 	"time"
 
 	"github.com/safing/portbase/log"
-	kext1 "github.com/safing/portmaster/firewall/interception/windowskext"
-	kext2 "github.com/safing/portmaster/firewall/interception/windowskext2"
-	"github.com/safing/portmaster/network"
-	"github.com/safing/portmaster/network/packet"
-	"github.com/safing/portmaster/updates"
+	kext1 "github.com/safing/portmaster/service/firewall/interception/windowskext"
+	kext2 "github.com/safing/portmaster/service/firewall/interception/windowskext2"
+	"github.com/safing/portmaster/service/network"
+	"github.com/safing/portmaster/service/network/packet"
+	"github.com/safing/portmaster/service/updates"
 )
 
 var useOldKext = false

service/firewall/interception/windowskext2/doc.go

@@ -0,0 +1,4 @@
+// +build windows
+
+// Package windowskext provides network interception capabilities on windows via the Portmaster Kernel Extension.
+package windowskext

service/firewall/interception/windowskext2/handler.go

@@ -0,0 +1,196 @@
+//go:build windows
+// +build windows
+
+package windowskext
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"time"
+
+	"github.com/safing/portmaster/service/process"
+
+	"github.com/tevino/abool"
+
+	"github.com/safing/portbase/log"
+	"github.com/safing/portmaster/service/network/packet"
+)
+
+type VersionInfo struct {
+	Major    uint8
+	Minor    uint8
+	Revision uint8
+	Build    uint8
+}
+
+func (v *VersionInfo) String() string {
+	return fmt.Sprintf("%d.%d.%d.%d", v.Major, v.Minor, v.Revision, v.Build)
+}
+
+// Handler transforms received packets to the Packet interface.
+func Handler(ctx context.Context, packets chan packet.Packet, bandwidthUpdate chan *packet.BandwidthUpdate) {
+	for {
+		packetInfo, err := RecvVerdictRequest()
+		if err != nil {
+			log.Warningf("failed to get packet from windows kext: %s", err)
+			return
+		}
+
+		switch {
+		case packetInfo.ConnectionV4 != nil:
+			{
+				log.Tracef("packet: %+v", packetInfo.ConnectionV4)
+				conn := packetInfo.ConnectionV4
+				// New Packet
+				new := &Packet{
+					verdictRequest: conn.Id,
+					payload:        conn.Payload,
+					verdictSet:     abool.NewBool(false),
+				}
+				new.Base.Payload()
+				info := new.Info()
+				info.Inbound = conn.Direction > 0
+				info.InTunnel = false
+				info.Protocol = packet.IPProtocol(conn.Protocol)
+				info.PID = int(conn.ProcessId)
+				info.SeenAt = time.Now()
+
+				// Check PID
+				if info.PID == 0 {
+					// Windows does not have zero PIDs.
+					// Set to UndefinedProcessID.
+					info.PID = process.UndefinedProcessID
+				}
+
+				// Set IP version
+				info.Version = packet.IPv4
+
+				// Set IPs
+				if info.Inbound {
+					// Inbound
+					info.Src = conn.RemoteIp[:]
+					info.Dst = conn.LocalIp[:]
+				} else {
+					// Outbound
+					info.Src = conn.LocalIp[:]
+					info.Dst = conn.RemoteIp[:]
+				}
+
+				// Set Ports
+				if info.Inbound {
+					// Inbound
+					info.SrcPort = conn.RemotePort
+					info.DstPort = conn.LocalPort
+				} else {
+					// Outbound
+					info.SrcPort = conn.LocalPort
+					info.DstPort = conn.RemotePort
+				}
+
+				packets <- new
+			}
+		case packetInfo.ConnectionV6 != nil:
+			{
+				log.Tracef("packet: %+v", packetInfo.ConnectionV6)
+				conn := packetInfo.ConnectionV6
+				// New Packet
+				new := &Packet{
+					verdictRequest: conn.Id,
+					payload:        conn.Payload,
+					verdictSet:     abool.NewBool(false),
+				}
+				info := new.Info()
+				info.Inbound = conn.Direction > 0
+				info.InTunnel = false
+				info.Protocol = packet.IPProtocol(conn.Protocol)
+				info.PID = int(conn.ProcessId)
+				info.SeenAt = time.Now()
+
+				// Check PID
+				if info.PID == 0 {
+					// Windows does not have zero PIDs.
+					// Set to UndefinedProcessID.
+					info.PID = process.UndefinedProcessID
+				}
+
+				// Set IP version
+				info.Version = packet.IPv6
+
+				// Set IPs
+				if info.Inbound {
+					// Inbound
+					info.Src = conn.RemoteIp[:]
+					info.Dst = conn.LocalIp[:]
+				} else {
+					// Outbound
+					info.Src = conn.LocalIp[:]
+					info.Dst = conn.RemoteIp[:]
+				}
+
+				// Set Ports
+				if info.Inbound {
+					// Inbound
+					info.SrcPort = conn.RemotePort
+					info.DstPort = conn.LocalPort
+				} else {
+					// Outbound
+					info.SrcPort = conn.LocalPort
+					info.DstPort = conn.RemotePort
+				}
+
+				packets <- new
+			}
+		case packetInfo.LogLine != nil:
+			{
+				line := packetInfo.LogLine
+				switch line.Severity {
+				case byte(log.DebugLevel):
+					log.Debugf("kext: %s", line.Line)
+				case byte(log.InfoLevel):
+					log.Infof("kext: %s", line.Line)
+				case byte(log.WarningLevel):
+					log.Warningf("kext: %s", line.Line)
+				case byte(log.ErrorLevel):
+					log.Errorf("kext: %s", line.Line)
+				case byte(log.CriticalLevel):
+					log.Criticalf("kext: %s", line.Line)
+				}
+			}
+		case packetInfo.BandwidthStats != nil:
+			{
+				bandwidthStats := packetInfo.BandwidthStats
+				for _, stat := range bandwidthStats.ValuesV4 {
+					connID := packet.CreateConnectionID(
+						packet.IPProtocol(bandwidthStats.Protocol),
+						net.IP(stat.LocalIP[:]), stat.LocalPort,
+						net.IP(stat.RemoteIP[:]), stat.RemotePort,
+						false,
+					)
+					update := &packet.BandwidthUpdate{
+						ConnID:        connID,
+						BytesReceived: stat.ReceivedBytes,
+						BytesSent:     stat.TransmittedBytes,
+						Method:        packet.Additive,
+					}
+					bandwidthUpdate <- update
+				}
+				for _, stat := range bandwidthStats.ValuesV6 {
+					connID := packet.CreateConnectionID(
+						packet.IPProtocol(bandwidthStats.Protocol),
+						net.IP(stat.LocalIP[:]), stat.LocalPort,
+						net.IP(stat.RemoteIP[:]), stat.RemotePort,
+						false,
+					)
+					update := &packet.BandwidthUpdate{
+						ConnID:        connID,
+						BytesReceived: stat.ReceivedBytes,
+						BytesSent:     stat.TransmittedBytes,
+						Method:        packet.Additive,
+					}
+					bandwidthUpdate <- update
+				}
+			}
+		}
+	}
+}

service/firewall/interception/windowskext2/kext.go

@@ -0,0 +1,167 @@
+//go:build windows
+// +build windows
+
+package windowskext
+
+import (
+	"fmt"
+
+	"github.com/safing/portbase/log"
+	"github.com/safing/portmaster/service/network"
+	"github.com/vlabo/portmaster_windows_rust_kext/kext_interface"
+	"golang.org/x/sys/windows"
+)
+
+// Package errors
+var (
+	driverPath string
+
+	service  *kext_interface.KextService
+	kextFile *kext_interface.KextFile
+)
+
+const (
+	driverName = "PortmasterKext"
+)
+
+func Init(path string) error {
+	driverPath = path
+	return nil
+}
+
+// Start intercepting.
+func Start() error {
+
+	// initialize and start driver service
+	var err error
+	service, err = kext_interface.CreateKextService(driverName, driverPath)
+	if err != nil {
+		return fmt.Errorf("failed to create service: %w", err)
+	}
+
+	// Start service and open file
+	service.Start(true)
+	kextFile, err = service.OpenFile(1024)
+
+	if err != nil {
+		return fmt.Errorf("failed to open driver: %w", err)
+	}
+
+	return nil
+}
+
+func GetKextHandle() windows.Handle {
+	return kextFile.GetHandle()
+}
+
+func GetKextServiceHandle() windows.Handle {
+	return service.GetHandle()
+}
+
+// Stop intercepting.
+func Stop() error {
+	// Prepare kernel for shutdown
+	err := shutdownRequest()
+	if err != nil {
+		log.Warningf("winkext: shutdown request failed: %s", err)
+	}
+	// Close the interface to the driver. Driver will continue to run.
+	err = kextFile.Close()
+	if err != nil {
+		log.Warningf("winkext: failed to close kext file: %s", err)
+	}
+
+	// Stop and delete the driver.
+	err = service.Stop(true)
+	if err != nil {
+		log.Warningf("winkext: failed to stop kernel service: %s", err)
+	}
+
+	err = service.Delete()
+	if err != nil {
+		log.Warningf("winkext: failed to delete kernel service: %s", err)
+	}
+	return nil
+}
+
+// Sends a shutdown request.
+func shutdownRequest() error {
+	return kext_interface.SendShutdownCommand(kextFile)
+}
+
+// Send request for logs of the kext.
+func SendLogRequest() error {
+	return kext_interface.SendGetLogsCommand(kextFile)
+}
+
+func SendBandwidthStatsRequest() error {
+	return kext_interface.SendGetBandwidthStatsCommand(kextFile)
+}
+
+func SendPrintMemoryStatsCommand() error {
+	return kext_interface.SendPrintMemoryStatsCommand(kextFile)
+}
+
+func SendCleanEndedConnection() error {
+	return kext_interface.SendCleanEndedConnectionsCommand(kextFile)
+}
+
+// RecvVerdictRequest waits for the next verdict request from the kext. If a timeout is reached, both *VerdictRequest and error will be nil.
+func RecvVerdictRequest() (*kext_interface.Info, error) {
+	return kext_interface.RecvInfo(kextFile)
+}
+
+// SetVerdict sets the verdict for a packet and/or connection.
+func SetVerdict(pkt *Packet, verdict kext_interface.KextVerdict) error {
+	verdictCommand := kext_interface.Verdict{Id: pkt.verdictRequest, Verdict: uint8(verdict)}
+	return kext_interface.SendVerdictCommand(kextFile, verdictCommand)
+}
+
+// Clears the internal connection cache.
+func ClearCache() error {
+	return kext_interface.SendClearCacheCommand(kextFile)
+}
+
+// Updates a specific connection verdict.
+func UpdateVerdict(conn *network.Connection) error {
+	if conn.IPVersion == 4 {
+		update := kext_interface.UpdateV4{
+			Protocol:      conn.Entity.Protocol,
+			LocalAddress:  [4]byte(conn.LocalIP),
+			LocalPort:     conn.LocalPort,
+			RemoteAddress: [4]byte(conn.Entity.IP),
+			RemotePort:    conn.Entity.Port,
+			Verdict:       uint8(conn.Verdict.Active),
+		}
+
+		return kext_interface.SendUpdateV4Command(kextFile, update)
+	} else if conn.IPVersion == 6 {
+		update := kext_interface.UpdateV6{
+			Protocol:      conn.Entity.Protocol,
+			LocalAddress:  [16]byte(conn.LocalIP),
+			LocalPort:     conn.LocalPort,
+			RemoteAddress: [16]byte(conn.Entity.IP),
+			RemotePort:    conn.Entity.Port,
+			Verdict:       uint8(conn.Verdict.Active),
+		}
+
+		return kext_interface.SendUpdateV6Command(kextFile, update)
+	}
+	return nil
+}
+
+// Returns the kext version.
+func GetVersion() (*VersionInfo, error) {
+	data, err := kext_interface.ReadVersion(kextFile)
+	if err != nil {
+		return nil, err
+	}
+
+	version := &VersionInfo{
+		Major:    data[0],
+		Minor:    data[1],
+		Revision: data[2],
+		Build:    data[3],
+	}
+	return version, nil
+}

service/firewall/interception/windowskext2/packet.go

@@ -0,0 +1,132 @@
+//go:build windows
+// +build windows
+
+package windowskext
+
+import (
+	"sync"
+
+	"github.com/tevino/abool"
+	"github.com/vlabo/portmaster_windows_rust_kext/kext_interface"
+
+	"github.com/safing/portbase/log"
+	"github.com/safing/portmaster/service/network/packet"
+)
+
+// Packet represents an IP packet.
+type Packet struct {
+	packet.Base
+
+	verdictRequest uint64
+	payload        []byte
+	verdictSet     *abool.AtomicBool
+
+	payloadLoaded bool
+	lock          sync.Mutex
+}
+
+// FastTrackedByIntegration returns whether the packet has been fast-track
+// accepted by the OS integration.
+func (pkt *Packet) FastTrackedByIntegration() bool {
+	return false
+}
+
+// InfoOnly returns whether the packet is informational only and does not
+// represent an actual packet.
+func (pkt *Packet) InfoOnly() bool {
+	return false
+}
+
+// ExpectInfo returns whether the next packet is expected to be informational only.
+func (pkt *Packet) ExpectInfo() bool {
+	return false
+}
+
+// GetPayload returns the full raw packet.
+func (pkt *Packet) LoadPacketData() error {
+	pkt.lock.Lock()
+	defer pkt.lock.Unlock()
+
+	if !pkt.payloadLoaded {
+		pkt.payloadLoaded = true
+
+		if len(pkt.payload) > 0 {
+			err := packet.Parse(pkt.payload, &pkt.Base)
+			if err != nil {
+				log.Tracef("payload: %#v", pkt.payload)
+				log.Tracer(pkt.Ctx()).Warningf("windowskext: failed to parse payload: %s", err)
+				return packet.ErrFailedToLoadPayload
+			}
+		}
+	}
+
+	if len(pkt.Raw()) == 0 {
+		return packet.ErrFailedToLoadPayload
+	}
+
+	return nil
+}
+
+// Accept accepts the packet.
+func (pkt *Packet) Accept() error {
+	if pkt.verdictSet.SetToIf(false, true) {
+		return SetVerdict(pkt, kext_interface.VerdictAccept)
+	}
+	return nil
+}
+
+// Block blocks the packet.
+func (pkt *Packet) Block() error {
+	if pkt.verdictSet.SetToIf(false, true) {
+		return SetVerdict(pkt, kext_interface.VerdictBlock)
+	}
+	return nil
+}
+
+// Drop drops the packet.
+func (pkt *Packet) Drop() error {
+	if pkt.verdictSet.SetToIf(false, true) {
+		return SetVerdict(pkt, kext_interface.VerdictDrop)
+	}
+	return nil
+}
+
+// PermanentAccept permanently accepts connection (and the current packet).
+func (pkt *Packet) PermanentAccept() error {
+	if pkt.verdictSet.SetToIf(false, true) {
+		return SetVerdict(pkt, kext_interface.VerdictPermanentAccept)
+	}
+	return nil
+}
+
+// PermanentBlock permanently blocks connection (and the current packet).
+func (pkt *Packet) PermanentBlock() error {
+	if pkt.verdictSet.SetToIf(false, true) {
+		return SetVerdict(pkt, kext_interface.VerdictPermanentBlock)
+	}
+	return nil
+}
+
+// PermanentDrop permanently drops connection (and the current packet).
+func (pkt *Packet) PermanentDrop() error {
+	if pkt.verdictSet.SetToIf(false, true) {
+		return SetVerdict(pkt, kext_interface.VerdictPermanentDrop)
+	}
+	return nil
+}
+
+// RerouteToNameserver permanently reroutes the connection to the local nameserver (and the current packet).
+func (pkt *Packet) RerouteToNameserver() error {
+	if pkt.verdictSet.SetToIf(false, true) {
+		return SetVerdict(pkt, kext_interface.VerdictRerouteToNameserver)
+	}
+	return nil
+}
+
+// RerouteToTunnel permanently reroutes the connection to the local tunnel entrypoint (and the current packet).
+func (pkt *Packet) RerouteToTunnel() error {
+	if pkt.verdictSet.SetToIf(false, true) {
+		return SetVerdict(pkt, kext_interface.VerdictRerouteToTunnel)
+	}
+	return nil
+}

service/firewall/interception/windowskext2/service.go

@@ -0,0 +1,12 @@
+//go:build windows
+// +build windows
+
+package windowskext
+
+import (
+	"github.com/vlabo/portmaster_windows_rust_kext/kext_interface"
+)
+
+func createKextService(driverName string, driverPath string) (*kext_interface.KextService, error) {
+	return kext_interface.CreateKextService(driverName, driverPath)
+}