Merge branch 'make-the-lockdown-mode-that-is-used-during-upgrades-not-des-2193'

4 files changed, 75 insertions, 2 deletions

diff --git a/windows/winfw/src/winfw/objectpurger.cpp b/windows/winfw/src/winfw/objectpurger.cpp
index dce36c99c8..52adaac187 100644
--- a/windows/winfw/src/winfw/objectpurger.cpp
+++ b/windows/winfw/src/winfw/objectpurger.cpp
@@ -71,6 +71,22 @@ ObjectPurger::RemovalFunctor ObjectPurger::GetRemoveNonPersistentFunctor()
 }
 
 //static
+ObjectPurger::RemovalFunctor ObjectPurger::GetRemovePersistentFunctor()
+{
+	return [](wfp::FilterEngine &engine)
+	{
+		const auto registry = MullvadGuids::DetailedRegistry(MullvadGuids::IdentityQualifier::IncludePersistent);
+
+		// Resolve correct overload.
+		void(*deleter)(wfp::FilterEngine &, const GUID &) = wfp::ObjectDeleter::DeleteFilter;
+
+		RemoveRange(engine, deleter, registry.equal_range(WfpObjectType::Filter));
+		RemoveRange(engine, wfp::ObjectDeleter::DeleteSublayer, registry.equal_range(WfpObjectType::Sublayer));
+		RemoveRange(engine, wfp::ObjectDeleter::DeleteProvider, registry.equal_range(WfpObjectType::Provider));
+	};
+}
+
+//static
 bool ObjectPurger::Execute(RemovalFunctor f)
 {
 	auto engine = wfp::FilterEngine::StandardSession();
diff --git a/windows/winfw/src/winfw/objectpurger.h b/windows/winfw/src/winfw/objectpurger.h
index 7728aac694..9d3ca0146e 100644
--- a/windows/winfw/src/winfw/objectpurger.h
+++ b/windows/winfw/src/winfw/objectpurger.h
@@ -16,6 +16,7 @@ public:
 	static RemovalFunctor GetRemoveFiltersFunctor();
 	static RemovalFunctor GetRemoveAllFunctor();
 	static RemovalFunctor GetRemoveNonPersistentFunctor();
+	static RemovalFunctor GetRemovePersistentFunctor();
 
 	static bool Execute(RemovalFunctor f);
 };
diff --git a/windows/winfw/src/winfw/winfw.cpp b/windows/winfw/src/winfw/winfw.cpp
index c862de4b5a..cd90befead 100644
--- a/windows/winfw/src/winfw/winfw.cpp
+++ b/windows/winfw/src/winfw/winfw.cpp
@@ -4,6 +4,7 @@
 #include "objectpurger.h"
 #include "mullvadobjects.h"
 #include "rules/persistent/blockall.h"
+#include "rules/baseline/blockall.h"
 #include "libwfp/ipnetwork.h"
 #include <windows.h>
 #include <libcommon/error.h>
@@ -167,11 +168,14 @@ WinFw_Deinitialize(WINFW_CLEANUP_POLICY cleanupPolicy)
 	delete g_fwContext;
 	g_fwContext = nullptr;
 
+	std::stringstream ss;
+	ss << "Deinitializing WinFw";
+	g_logSink(MULLVAD_LOG_LEVEL_WARNING, ss.str().c_str(), g_logSinkContext);
+
 	//
-	// Continue blocking if this is what the caller requested
+	// Continue blocking with persistent rules if this is what the caller requested
 	// and if the current policy is "(net) blocked".
 	//
-
 	if (WINFW_CLEANUP_POLICY_CONTINUE_BLOCKING == cleanupPolicy
 		&& FwContext::Policy::Blocked == activePolicy)
 	{
@@ -182,6 +186,10 @@ WinFw_Deinitialize(WINFW_CLEANUP_POLICY cleanupPolicy)
 
 			rules::persistent::BlockAll blockAll;
 
+			std::stringstream ss;
+			ss << "Adding persistent block rules";
+			g_logSink(MULLVAD_LOG_LEVEL_WARNING, ss.str().c_str(), g_logSinkContext);
+
 			return sessionController->executeTransaction([&](SessionController &controller, wfp::FilterEngine &engine)
 			{
 				ObjectPurger::GetRemoveNonPersistentFunctor()(engine);
@@ -205,6 +213,50 @@ WinFw_Deinitialize(WINFW_CLEANUP_POLICY cleanupPolicy)
 		}
 	}
 
+	//
+	// Continue blocking with non-persistent rules if this is what the caller requested
+	// and if the current policy is "(net) blocked".
+	//
+	if (WINFW_CLEANUP_POLICY_BLOCK_UNTIL_REBOOT == cleanupPolicy
+		&& FwContext::Policy::Blocked == activePolicy)
+	{
+		try
+		{
+			auto engine = wfp::FilterEngine::StandardSession(DEINITIALIZE_TIMEOUT);
+			auto sessionController = std::make_unique<SessionController>(std::move(engine));
+
+			rules::baseline::BlockAll blockAll;
+
+			std::stringstream ss;
+			ss << "Adding ephemeral block rules";
+			g_logSink(MULLVAD_LOG_LEVEL_WARNING, ss.str().c_str(), g_logSinkContext);
+
+			return sessionController->executeTransaction([&](SessionController &controller, wfp::FilterEngine &engine)
+			{
+				// Keep non-persistent filters intact, the intent is just to *not*
+				// persist any filters across a BFE restart, not muck around with
+				// any other filters. We will apply blocking filters anyway.
+				ObjectPurger::GetRemovePersistentFunctor()(engine);
+
+				return controller.addProvider(*MullvadObjects::Provider())
+					&& controller.addSublayer(*MullvadObjects::SublayerBaseline())
+					&& blockAll.apply(controller);
+			});
+		}
+		catch (std::exception & err)
+		{
+			if (nullptr != g_logSink)
+			{
+				g_logSink(MULLVAD_LOG_LEVEL_ERROR, err.what(), g_logSinkContext);
+			}
+			return false;
+		}
+		catch (...)
+		{
+			return false;
+		}
+	}
+
 	return WINFW_POLICY_STATUS_SUCCESS == WinFw_Reset();
 }
 
diff --git a/windows/winfw/src/winfw/winfw.h b/windows/winfw/src/winfw/winfw.h
index ab2a136ceb..f40d835a95 100644
--- a/windows/winfw/src/winfw/winfw.h
+++ b/windows/winfw/src/winfw/winfw.h
@@ -127,6 +127,10 @@ enum WINFW_CLEANUP_POLICY : uint32_t
 
 	// Remove all objects that have been registered with WFP.
 	WINFW_CLEANUP_POLICY_RESET_FIREWALL = 1,
+
+	// Continue blocking if this is the active policy.
+	// Adds ephemeral blocking filters that are active until WinFw is shut down (??)
+	WINFW_CLEANUP_POLICY_BLOCK_UNTIL_REBOOT = 2,
 };
 
 //