From 08a19ff5525d9dbbfbe1ff2be7defa29c97c10d1 Mon Sep 17 00:00:00 2001 From: henrypp Date: Mon, 7 Aug 2023 22:51:39 +0600 Subject: [PATCH] upd win8 support --- src/helper.c | 11 +---- src/log.c | 110 +------------------------------------------------ src/log.h | 6 --- src/main.c | 6 +-- src/network.c | 2 +- src/profile.c | 3 +- src/wfp.c | 112 ++++++++++++++++++++------------------------------ 7 files changed, 51 insertions(+), 199 deletions(-) diff --git a/src/helper.c b/src/helper.c index a166940e..d8183610 100644 --- a/src/helper.c +++ b/src/helper.c @@ -941,16 +941,7 @@ VOID _app_getfilesignatureinfo ( status = _app_verifyfromfile (WTD_CHOICE_FILE, &file_info, &WinTrustActionGenericVerifyV2, NULL, &string); if (status == TRUST_E_NOSIGNATURE) - { - if (_r_sys_isosversiongreaterorequal (WINDOWS_8)) - { - status = _app_verifyfilefromcatalog (hfile, ptr_app_info->path->buffer, BCRYPT_SHA256_ALGORITHM, &string); - } - else - { - status = _app_verifyfilefromcatalog (hfile, ptr_app_info->path->buffer, NULL, &string); - } - } + status = _app_verifyfilefromcatalog (hfile, ptr_app_info->path->buffer, BCRYPT_SHA256_ALGORITHM, &string); _r_obj_movereference (&ptr_app_info->signature_info, string); } diff --git a/src/log.c b/src/log.c index 2708d429..589114fa 100644 --- a/src/log.c +++ b/src/log.c @@ -407,10 +407,6 @@ VOID _wfp_logsetoption ( UINT32 mask = 0; ULONG status; - // configure dropped packets logging (win8+) - if (!_r_sys_isosversiongreaterorequal (WINDOWS_8)) - return; - // add allowed connections monitor if (!_r_config_getboolean (L"IsExcludeClassifyAllow", TRUE)) mask |= FWPM_NET_EVENT_KEYWORD_CLASSIFY_ALLOW; @@ -670,97 +666,7 @@ FORCEINLINE BOOLEAN log_struct_to_f ( _In_ ULONG version ) { - if (version == WINDOWS_7) - { - FWPM_NET_EVENT1 *evt = event_data; - - if (evt->type == FWPM_NET_EVENT_TYPE_CLASSIFY_DROP && evt->classifyDrop) - { - log->layer_id = evt->classifyDrop->layerId; - log->filter_id = evt->classifyDrop->filterId; - log->direction = evt->classifyDrop->msFwpDirection; - log->is_loopback = !!evt->classifyDrop->isLoopback; - } - else if (evt->type == FWPM_NET_EVENT_TYPE_IPSEC_KERNEL_DROP && evt->ipsecDrop) - { - log->layer_id = evt->ipsecDrop->layerId; - log->filter_id = evt->ipsecDrop->filterId; - log->direction = evt->ipsecDrop->direction; - } - else - { - return FALSE; - } - - // indicates the direction of the packet transmission and set valid directions - switch (log->direction) - { - case FWP_DIRECTION_IN: - case FWP_DIRECTION_INBOUND: - { - log->direction = FWP_DIRECTION_INBOUND; - break; - } - - case FWP_DIRECTION_OUT: - case FWP_DIRECTION_OUTBOUND: - { - log->direction = FWP_DIRECTION_OUTBOUND; - break; - } - - default: - { - return FALSE; - } - } - - log->flags = evt->header.flags; - - RtlCopyMemory (&log->timestamp, &evt->header.timeStamp, sizeof (log->timestamp)); - - if (evt->header.flags & FWPM_NET_EVENT_FLAG_APP_ID_SET) - log->app_id = evt->header.appId.data; - - if (evt->header.flags & FWPM_NET_EVENT_FLAG_USER_ID_SET) - log->user_id = evt->header.userId; - - if (evt->header.flags & FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET) - log->protocol = evt->header.ipProtocol; - - if (evt->header.flags & FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET) - log->local_port = evt->header.localPort; - - if (evt->header.flags & FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET) - log->remote_port = evt->header.remotePort; - - if (evt->header.flags & FWPM_NET_EVENT_FLAG_IP_VERSION_SET) - { - log->version = evt->header.ipVersion; - - if (evt->header.ipVersion == FWP_IP_VERSION_V4) - { - if (evt->header.flags & FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET) - log->local_addr4 = evt->header.localAddrV4; - - if (evt->header.flags & FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET) - log->remote_addr4 = evt->header.remoteAddrV4; - } - else if (evt->header.ipVersion == FWP_IP_VERSION_V6) - { - if (evt->header.flags & FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET) - log->local_addr6 = &evt->header.localAddrV6; - - if (evt->header.flags & FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET) - log->remote_addr6 = &evt->header.remoteAddrV6; - } - } - else - { - log->version = FWP_IP_VERSION_NONE; - } - } - else if (version == WINDOWS_8) + if (version == WINDOWS_8) { FWPM_NET_EVENT2 *evt = event_data; @@ -1200,20 +1106,6 @@ FORCEINLINE BOOLEAN log_struct_to_f ( return TRUE; } -// win7+ callback -VOID CALLBACK _wfp_logcallback0 ( - _In_opt_ PVOID context, - _In_ const FWPM_NET_EVENT1 *event_data -) -{ - ITEM_LOG_CALLBACK log = {0}; - - UNREFERENCED_PARAMETER (context); - - if (log_struct_to_f (&log, (PVOID)event_data, WINDOWS_7)) - _wfp_logcallback (&log); -} - // win8+ callback VOID CALLBACK _wfp_logcallback1 ( _In_opt_ PVOID context, diff --git a/src/log.h b/src/log.h index 55f00fb1..c30e830b 100644 --- a/src/log.h +++ b/src/log.h @@ -88,12 +88,6 @@ VOID CALLBACK _wfp_logcallback ( _In_ PITEM_LOG_CALLBACK log ); -// win7+ callback -VOID CALLBACK _wfp_logcallback0 ( - _In_opt_ PVOID context, - _In_ const FWPM_NET_EVENT1* event_data -); - // win8+ callback VOID CALLBACK _wfp_logcallback1 ( _In_opt_ PVOID context, diff --git a/src/main.c b/src/main.c index 2dfea322..a01d03a2 100644 --- a/src/main.c +++ b/src/main.c @@ -696,8 +696,7 @@ INT_PTR CALLBACK SettingsProc ( _r_ctrl_checkbutton (hwnd, IDC_EXCLUDECLASSIFYALLOW_CHK, _r_config_getboolean (L"IsExcludeClassifyAllow", TRUE)); // win8+ - if (!_r_sys_isosversiongreaterorequal (WINDOWS_8)) - _r_ctrl_enable (hwnd, IDC_EXCLUDECLASSIFYALLOW_CHK, FALSE); + _r_ctrl_enable (hwnd, IDC_EXCLUDECLASSIFYALLOW_CHK, FALSE); break; } @@ -1757,8 +1756,7 @@ INT _app_addwindowtabs ( _r_tab_additem (hwnd, IDC_TAB, tabs_count++, L"", I_IMAGENONE, (LPARAM)IDC_APPS_SERVICE); // uwp apps (win8+) - if (_r_sys_isosversiongreaterorequal (WINDOWS_8)) - _r_tab_additem (hwnd, IDC_TAB, tabs_count++, L"", I_IMAGENONE, (LPARAM)IDC_APPS_UWP); + _r_tab_additem (hwnd, IDC_TAB, tabs_count++, L"", I_IMAGENONE, (LPARAM)IDC_APPS_UWP); if (!_r_config_getboolean (L"IsInternalRulesDisabled", FALSE)) { diff --git a/src/network.c b/src/network.c index 2d0d454a..95b9a749 100644 --- a/src/network.c +++ b/src/network.c @@ -512,7 +512,7 @@ BOOLEAN _app_network_getpath ( if (NT_SUCCESS (status)) { - if (_r_sys_isosversiongreaterorequal (WINDOWS_8) && _r_sys_isprocessimmersive (process_handle)) + if (_r_sys_isprocessimmersive (process_handle)) { ptr_network->type = DATA_APP_UWP; } diff --git a/src/profile.c b/src/profile.c index 1cb5c97b..a9e6cc6b 100644 --- a/src/profile.c +++ b/src/profile.c @@ -1702,8 +1702,7 @@ VOID _app_profile_refresh () _app_package_getserviceslist (); // generate uwp apps list (win8+) - if (_r_sys_isosversiongreaterorequal (WINDOWS_8)) - _app_package_getpackageslist (); + _app_package_getpackageslist (); } NTSTATUS _app_profile_load ( diff --git a/src/wfp.c b/src/wfp.c index 1ffb1f5c..3431a258 100644 --- a/src/wfp.c +++ b/src/wfp.c @@ -381,22 +381,19 @@ BOOLEAN _wfp_initialize ( } // packet queuing (win8+) - if (_r_sys_isosversiongreaterorequal (WINDOWS_8)) + if (_r_config_getboolean (L"IsPacketQueuingEnabled", TRUE)) { - if (_r_config_getboolean (L"IsPacketQueuingEnabled", TRUE)) - { - // Enables inbound or forward packet queuing independently. - // when enabled, the system is able to evenly distribute cpu load - // to multiple cpus for site-to-site ipsec tunnel scenarios. + // Enables inbound or forward packet queuing independently. + // when enabled, the system is able to evenly distribute cpu load + // to multiple cpus for site-to-site ipsec tunnel scenarios. - val.type = FWP_UINT32; - val.uint32 = FWPM_ENGINE_OPTION_PACKET_QUEUE_INBOUND | FWPM_ENGINE_OPTION_PACKET_QUEUE_FORWARD; + val.type = FWP_UINT32; + val.uint32 = FWPM_ENGINE_OPTION_PACKET_QUEUE_INBOUND | FWPM_ENGINE_OPTION_PACKET_QUEUE_FORWARD; - status = FwpmEngineSetOption (engine_handle, FWPM_ENGINE_PACKET_QUEUING, &val); + status = FwpmEngineSetOption (engine_handle, FWPM_ENGINE_PACKET_QUEUING, &val); - if (status != ERROR_SUCCESS) - _r_log (LOG_LEVEL_WARNING, NULL, L"FwpmEngineSetOption", status, L"FWPM_ENGINE_PACKET_QUEUING"); - } + if (status != ERROR_SUCCESS) + _r_log (LOG_LEVEL_WARNING, NULL, L"FwpmEngineSetOption", status, L"FWPM_ENGINE_PACKET_QUEUING"); } CleanupExit: @@ -819,8 +816,7 @@ ULONG _wfp_createfilter ( filter.flags |= FWPM_FILTER_FLAG_PERSISTENT; // filter is indexed to help enable faster lookup during classification (win8+) - if (_r_sys_isosversiongreaterorequal (WINDOWS_8)) - filter.flags |= FWPM_FILTER_FLAG_INDEXED; + filter.flags |= FWPM_FILTER_FLAG_INDEXED; } if (flags) @@ -1804,17 +1800,12 @@ BOOLEAN _wfp_create2filters ( if (_r_config_getboolean (L"AllowLoopbackConnections", TRUE)) { // match all loopback (localhost) data - fwfc[0].fieldKey = FWPM_CONDITION_FLAGS; - fwfc[0].matchType = FWP_MATCH_FLAGS_ALL_SET; - fwfc[0].conditionValue.type = FWP_UINT32; - fwfc[0].conditionValue.uint32 = FWP_CONDITION_FLAG_IS_LOOPBACK; - // tests if the network traffic is (non-)app container loopback traffic (win8+) - if (_r_sys_isosversiongreaterorequal (WINDOWS_8)) - { - fwfc[0].matchType = FWP_MATCH_FLAGS_ANY_SET; - fwfc[0].conditionValue.uint32 |= FWP_CONDITION_FLAG_IS_APPCONTAINER_LOOPBACK; - } + + fwfc[0].fieldKey = FWPM_CONDITION_FLAGS; + fwfc[0].matchType = FWP_MATCH_FLAGS_ANY_SET; + fwfc[0].conditionValue.type = FWP_UINT32; + fwfc[0].conditionValue.uint32 = FWP_CONDITION_FLAG_IS_LOOPBACK | FWP_CONDITION_FLAG_IS_APPCONTAINER_LOOPBACK; _wfp_createfilter ( engine_handle, @@ -2062,14 +2053,11 @@ BOOLEAN _wfp_create2filters ( if (_r_config_getboolean (L"UseStealthMode", TRUE)) { // blocks udp port scanners + // tests if the network traffic is (non-)app container loopback traffic (win8+) fwfc[0].fieldKey = FWPM_CONDITION_FLAGS; fwfc[0].matchType = FWP_MATCH_FLAGS_NONE_SET; fwfc[0].conditionValue.type = FWP_UINT32; - fwfc[0].conditionValue.uint32 = FWP_CONDITION_FLAG_IS_LOOPBACK; - - // tests if the network traffic is (non-)app container loopback traffic (win8+) - if (_r_sys_isosversiongreaterorequal (WINDOWS_8)) - fwfc[0].conditionValue.uint32 |= FWP_CONDITION_FLAG_IS_APPCONTAINER_LOOPBACK; + fwfc[0].conditionValue.uint32 = FWP_CONDITION_FLAG_IS_LOOPBACK | FWP_CONDITION_FLAG_IS_APPCONTAINER_LOOPBACK; fwfc[1].fieldKey = FWPM_CONDITION_ICMP_TYPE; fwfc[1].matchType = FWP_MATCH_EQUAL; @@ -2141,16 +2129,9 @@ BOOLEAN _wfp_create2filters ( if (_r_config_getboolean (L"InstallBoottimeFilters", TRUE) && !config.is_filterstemporary) { fwfc[0].fieldKey = FWPM_CONDITION_FLAGS; - fwfc[0].matchType = FWP_MATCH_FLAGS_ALL_SET; + fwfc[0].matchType = FWP_MATCH_FLAGS_ANY_SET; fwfc[0].conditionValue.type = FWP_UINT32; - fwfc[0].conditionValue.uint32 = FWP_CONDITION_FLAG_IS_LOOPBACK; - - // tests if the network traffic is (non-)app container loopback traffic (win8+) - if (_r_sys_isosversiongreaterorequal (WINDOWS_8)) - { - fwfc[0].matchType = FWP_MATCH_FLAGS_ANY_SET; - fwfc[0].conditionValue.uint32 |= FWP_CONDITION_FLAG_IS_APPCONTAINER_LOOPBACK; - } + fwfc[0].conditionValue.uint32 = FWP_CONDITION_FLAG_IS_LOOPBACK | FWP_CONDITION_FLAG_IS_APPCONTAINER_LOOPBACK; _wfp_createfilter ( engine_handle, @@ -2390,36 +2371,33 @@ BOOLEAN _wfp_create2filters ( if (action == FWP_ACTION_BLOCK) { // workaround #689 - if (_r_sys_isosversiongreaterorequal (WINDOWS_8)) - { - _wfp_createfilter ( - engine_handle, - DATA_FILTER_GENERAL, - FW_NAME_BLOCK_CONNECTION, - NULL, - 0, - &FWPM_LAYER_ALE_AUTH_CONNECT_V4, - &FWPM_CALLOUT_TCP_TEMPLATES_CONNECT_LAYER_V4, - FW_WEIGHT_LOWEST, - FWP_ACTION_CALLOUT_TERMINATING, - 0, - filter_ids - ); + _wfp_createfilter ( + engine_handle, + DATA_FILTER_GENERAL, + FW_NAME_BLOCK_CONNECTION, + NULL, + 0, + &FWPM_LAYER_ALE_AUTH_CONNECT_V4, + &FWPM_CALLOUT_TCP_TEMPLATES_CONNECT_LAYER_V4, + FW_WEIGHT_LOWEST, + FWP_ACTION_CALLOUT_TERMINATING, + 0, + filter_ids + ); - _wfp_createfilter ( - engine_handle, - DATA_FILTER_GENERAL, - FW_NAME_BLOCK_CONNECTION, - NULL, - 0, - &FWPM_LAYER_ALE_AUTH_CONNECT_V6, - &FWPM_CALLOUT_TCP_TEMPLATES_CONNECT_LAYER_V6, - FW_WEIGHT_LOWEST, - FWP_ACTION_CALLOUT_TERMINATING, - 0, - filter_ids - ); - } + _wfp_createfilter ( + engine_handle, + DATA_FILTER_GENERAL, + FW_NAME_BLOCK_CONNECTION, + NULL, + 0, + &FWPM_LAYER_ALE_AUTH_CONNECT_V6, + &FWPM_CALLOUT_TCP_TEMPLATES_CONNECT_LAYER_V6, + FW_WEIGHT_LOWEST, + FWP_ACTION_CALLOUT_TERMINATING, + 0, + filter_ids + ); } // fallback