diff options
Diffstat (limited to 'windows')
| -rw-r--r-- | windows/winfw/src/winfw/winfw.cpp | 56 | ||||
| -rw-r--r-- | windows/winfw/src/winfw/winfw.h | 4 |
2 files changed, 58 insertions, 2 deletions
diff --git a/windows/winfw/src/winfw/winfw.cpp b/windows/winfw/src/winfw/winfw.cpp index c862de4b5a..cd90befead 100644 --- a/windows/winfw/src/winfw/winfw.cpp +++ b/windows/winfw/src/winfw/winfw.cpp @@ -4,6 +4,7 @@ #include "objectpurger.h" #include "mullvadobjects.h" #include "rules/persistent/blockall.h" +#include "rules/baseline/blockall.h" #include "libwfp/ipnetwork.h" #include <windows.h> #include <libcommon/error.h> @@ -167,11 +168,14 @@ WinFw_Deinitialize(WINFW_CLEANUP_POLICY cleanupPolicy) delete g_fwContext; g_fwContext = nullptr; + std::stringstream ss; + ss << "Deinitializing WinFw"; + g_logSink(MULLVAD_LOG_LEVEL_WARNING, ss.str().c_str(), g_logSinkContext); + // - // Continue blocking if this is what the caller requested + // Continue blocking with persistent rules if this is what the caller requested // and if the current policy is "(net) blocked". // - if (WINFW_CLEANUP_POLICY_CONTINUE_BLOCKING == cleanupPolicy && FwContext::Policy::Blocked == activePolicy) { @@ -182,6 +186,10 @@ WinFw_Deinitialize(WINFW_CLEANUP_POLICY cleanupPolicy) rules::persistent::BlockAll blockAll; + std::stringstream ss; + ss << "Adding persistent block rules"; + g_logSink(MULLVAD_LOG_LEVEL_WARNING, ss.str().c_str(), g_logSinkContext); + return sessionController->executeTransaction([&](SessionController &controller, wfp::FilterEngine &engine) { ObjectPurger::GetRemoveNonPersistentFunctor()(engine); @@ -205,6 +213,50 @@ WinFw_Deinitialize(WINFW_CLEANUP_POLICY cleanupPolicy) } } + // + // Continue blocking with non-persistent rules if this is what the caller requested + // and if the current policy is "(net) blocked". + // + if (WINFW_CLEANUP_POLICY_BLOCK_UNTIL_REBOOT == cleanupPolicy + && FwContext::Policy::Blocked == activePolicy) + { + try + { + auto engine = wfp::FilterEngine::StandardSession(DEINITIALIZE_TIMEOUT); + auto sessionController = std::make_unique<SessionController>(std::move(engine)); + + rules::baseline::BlockAll blockAll; + + std::stringstream ss; + ss << "Adding ephemeral block rules"; + g_logSink(MULLVAD_LOG_LEVEL_WARNING, ss.str().c_str(), g_logSinkContext); + + return sessionController->executeTransaction([&](SessionController &controller, wfp::FilterEngine &engine) + { + // Keep non-persistent filters intact, the intent is just to *not* + // persist any filters across a BFE restart, not muck around with + // any other filters. We will apply blocking filters anyway. + ObjectPurger::GetRemovePersistentFunctor()(engine); + + return controller.addProvider(*MullvadObjects::Provider()) + && controller.addSublayer(*MullvadObjects::SublayerBaseline()) + && blockAll.apply(controller); + }); + } + catch (std::exception & err) + { + if (nullptr != g_logSink) + { + g_logSink(MULLVAD_LOG_LEVEL_ERROR, err.what(), g_logSinkContext); + } + return false; + } + catch (...) + { + return false; + } + } + return WINFW_POLICY_STATUS_SUCCESS == WinFw_Reset(); } diff --git a/windows/winfw/src/winfw/winfw.h b/windows/winfw/src/winfw/winfw.h index ab2a136ceb..f40d835a95 100644 --- a/windows/winfw/src/winfw/winfw.h +++ b/windows/winfw/src/winfw/winfw.h @@ -127,6 +127,10 @@ enum WINFW_CLEANUP_POLICY : uint32_t // Remove all objects that have been registered with WFP. WINFW_CLEANUP_POLICY_RESET_FIREWALL = 1, + + // Continue blocking if this is the active policy. + // Adds ephemeral blocking filters that are active until WinFw is shut down (??) + WINFW_CLEANUP_POLICY_BLOCK_UNTIL_REBOOT = 2, }; // |