mDNSWindows/SystemService/Firewall.cpp

   1 /* -*- Mode: C; tab-width: 4 -*-
   2  *
   3  * Copyright (c) 2003-2004 Apple Computer, Inc. All rights reserved.
   4  *
   5  * Licensed under the Apache License, Version 2.0 (the "License");
   6  * you may not use this file except in compliance with the License.
   7  * You may obtain a copy of the License at
   8  *
   9  *     http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  * Unless required by applicable law or agreed to in writing, software
  12  * distributed under the License is distributed on an "AS IS" BASIS,
  13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  * See the License for the specific language governing permissions and
  15  * limitations under the License.
  16  */
  17
  18 // <rdar://problem/4278931> Doesn't compile correctly with latest Platform SDK
  19
  20 #if !defined(_WIN32_DCOM)
  21 #       define _WIN32_DCOM
  22 #endif
  23
  24
  25 #include "Firewall.h"
  26 #include <windows.h>
  27 #include <crtdbg.h>
  28 #include <netfw.h>
  29 #include <objbase.h>
  30 #include <oleauto.h>
  31
  32
  33 static const int kMaxTries                      = 30;
  34 static const int kRetrySleepPeriod      = 1 * 1000; // 1 second
  35
  36
  37 static OSStatus
  38 mDNSFirewallInitialize(OUT INetFwProfile ** fwProfile)
  39 {
  40         INetFwMgr               *       fwMgr           = NULL;
  41         INetFwPolicy    *       fwPolicy        = NULL;
  42         int                                     numRetries      = 0;
  43         HRESULT                         err                     = kNoErr;
  44
  45         _ASSERT(fwProfile != NULL);
  46
  47     *fwProfile = NULL;
  48
  49         // Use COM to get a reference to the firewall settings manager.  This
  50         // call will fail on anything other than XP SP2
  51
  52         err = CoCreateInstance( __uuidof(NetFwMgr), NULL, CLSCTX_INPROC_SERVER, __uuidof(INetFwMgr), (void**)&fwMgr );
  53         require(SUCCEEDED(err) && ( fwMgr != NULL ), exit);
  54
  55         // Use the reference to get the local firewall policy
  56
  57         err = fwMgr->get_LocalPolicy(&fwPolicy);
  58         require(SUCCEEDED(err) && ( fwPolicy != NULL ), exit);
  59
  60         // Use the reference to get the extant profile. Empirical evidence
  61         // suggests that there is the potential for a race condition when a system
  62         // service whose startup type is automatic calls this method.
  63         // This is true even when the service declares itself to be dependent
  64         // on the firewall service. Re-trying the method will succeed within
  65         // a few seconds.
  66
  67         do
  68         {
  69         err = fwPolicy->get_CurrentProfile(fwProfile);
  70
  71                 if (err)
  72                 {
  73                         Sleep(kRetrySleepPeriod);
  74                 }
  75         }
  76         while (err && (numRetries++ < kMaxTries));
  77
  78         require(SUCCEEDED(err), exit);
  79
  80         err = kNoErr;
  81
  82 exit:
  83
  84         // Release temporary COM objects
  85
  86     if (fwPolicy != NULL)
  87     {
  88         fwPolicy->Release();
  89     }
  90
  91     if (fwMgr != NULL)
  92     {
  93         fwMgr->Release();
  94     }
  95
  96     return err;
  97 }
  98
  99
 100 static void
 101 mDNSFirewallCleanup
 102                         (
 103                         IN INetFwProfile        *       fwProfile
 104                         )
 105 {
 106         // Call Release on the COM reference.
 107
 108     if (fwProfile != NULL)
 109     {
 110         fwProfile->Release();
 111     }
 112 }
 113
 114
 115 static OSStatus
 116 mDNSFirewallAppIsEnabled
 117                         (
 118                         IN INetFwProfile        *       fwProfile,
 119                         IN const wchar_t        *       fwProcessImageFileName,
 120                         OUT BOOL                        *       fwAppEnabled
 121                         )
 122 {
 123         BSTR                                                    fwBstrProcessImageFileName = NULL;
 124         VARIANT_BOOL                                    fwEnabled;
 125         INetFwAuthorizedApplication     *       fwApp   = NULL;
 126         INetFwAuthorizedApplications*   fwApps  = NULL;
 127         OSStatus                                                err             = kNoErr;
 128
 129         _ASSERT(fwProfile != NULL);
 130         _ASSERT(fwProcessImageFileName != NULL);
 131         _ASSERT(fwAppEnabled != NULL);
 132
 133     *fwAppEnabled = FALSE;
 134
 135         // Get the list of authorized applications
 136
 137         err = fwProfile->get_AuthorizedApplications(&fwApps);
 138         require(SUCCEEDED(err) && ( fwApps != NULL ), exit);
 139
 140     fwBstrProcessImageFileName = SysAllocString(fwProcessImageFileName);
 141         require_action( ( fwProcessImageFileName != NULL ) && ( SysStringLen(fwBstrProcessImageFileName) > 0 ), exit, err = kNoMemoryErr);
 142
 143         // Look for us
 144
 145     err = fwApps->Item(fwBstrProcessImageFileName, &fwApp);
 146
 147     if (SUCCEEDED(err) && ( fwApp != NULL ) )
 148     {
 149         // It's listed, but is it enabled?
 150
 151                 err = fwApp->get_Enabled(&fwEnabled);
 152                 require(SUCCEEDED(err), exit);
 153
 154         if (fwEnabled != VARIANT_FALSE)
 155         {
 156                         // Yes, it's enabled
 157
 158             *fwAppEnabled = TRUE;
 159                 }
 160         }
 161
 162         err = kNoErr;
 163
 164 exit:
 165
 166         // Deallocate the BSTR
 167
 168         if ( fwBstrProcessImageFileName != NULL )
 169         {
 170                 SysFreeString(fwBstrProcessImageFileName);
 171         }
 172
 173         // Release the COM objects
 174
 175     if (fwApp != NULL)
 176     {
 177         fwApp->Release();
 178     }
 179
 180     if (fwApps != NULL)
 181     {
 182         fwApps->Release();
 183     }
 184
 185     return err;
 186 }
 187
 188
 189 static OSStatus
 190 mDNSFirewallAddApp
 191                         (
 192             IN INetFwProfile    *       fwProfile,
 193             IN const wchar_t    *       fwProcessImageFileName,
 194             IN const wchar_t    *       fwName
 195             )
 196 {
 197         BOOL                                                    fwAppEnabled;
 198         BSTR                                                    fwBstrName = NULL;
 199         BSTR                                                    fwBstrProcessImageFileName = NULL;
 200         INetFwAuthorizedApplication     *       fwApp = NULL;
 201         INetFwAuthorizedApplications*   fwApps = NULL;
 202         OSStatus                                                err = S_OK;
 203
 204         _ASSERT(fwProfile != NULL);
 205     _ASSERT(fwProcessImageFileName != NULL);
 206     _ASSERT(fwName != NULL);
 207
 208     // First check to see if the application is already authorized.
 209         err = mDNSFirewallAppIsEnabled( fwProfile, fwProcessImageFileName, &fwAppEnabled );
 210         require_noerr(err, exit);
 211
 212         // Only add the application if it isn't enabled
 213
 214         if (!fwAppEnabled)
 215         {
 216                 // Get the list of authorized applications
 217
 218         err = fwProfile->get_AuthorizedApplications(&fwApps);
 219                 require(SUCCEEDED(err) && ( fwApps != NULL ), exit);
 220
 221         // Create an instance of an authorized application.
 222
 223                 err = CoCreateInstance( __uuidof(NetFwAuthorizedApplication), NULL, CLSCTX_INPROC_SERVER, __uuidof(INetFwAuthorizedApplication), (void**)&fwApp );
 224                 require(SUCCEEDED(err) && ( fwApp != NULL ), exit);
 225
 226         fwBstrProcessImageFileName = SysAllocString(fwProcessImageFileName);
 227                 require_action(( fwProcessImageFileName != NULL ) && ( SysStringLen(fwBstrProcessImageFileName) > 0 ), exit, err = kNoMemoryErr);
 228
 229                 // Set the executable file name
 230
 231                 err = fwApp->put_ProcessImageFileName(fwBstrProcessImageFileName);
 232                 require(SUCCEEDED(err), exit);
 233
 234                 fwBstrName = SysAllocString(fwName);
 235                 require_action( ( fwBstrName != NULL ) && ( SysStringLen(fwBstrName) > 0 ), exit, err = kNoMemoryErr);
 236
 237                 // Set the friendly name
 238
 239         err = fwApp->put_Name(fwBstrName);
 240                 require(SUCCEEDED(err), exit);
 241
 242                 // Now add the application
 243
 244         err = fwApps->Add(fwApp);
 245                 require(SUCCEEDED(err), exit);
 246         }
 247
 248         err = kNoErr;
 249
 250 exit:
 251
 252         // Deallocate the BSTR objects
 253
 254         if ( fwBstrName != NULL )
 255         {
 256                 SysFreeString(fwBstrName);
 257         }
 258
 259         if ( fwBstrProcessImageFileName != NULL )
 260         {
 261                 SysFreeString(fwBstrProcessImageFileName);
 262         }
 263
 264     // Release the COM objects
 265
 266     if (fwApp != NULL)
 267     {
 268         fwApp->Release();
 269     }
 270
 271     if (fwApps != NULL)
 272     {
 273         fwApps->Release();
 274     }
 275
 276     return err;
 277 }
 278
 279
 280
 281
 282
 283 static OSStatus
 284
 285 mDNSFirewallIsFileAndPrintSharingEnabled
 286
 287         (
 288
 289         IN INetFwProfile        * fwProfile,
 290
 291         OUT BOOL                        * fwServiceEnabled
 292
 293         )
 294
 295 {
 296
 297     VARIANT_BOOL fwEnabled;
 298
 299     INetFwService* fwService = NULL;
 300
 301     INetFwServices* fwServices = NULL;
 302
 303         OSStatus err = S_OK;
 304
 305
 306
 307     _ASSERT(fwProfile != NULL);
 308
 309     _ASSERT(fwServiceEnabled != NULL);
 310
 311
 312
 313     *fwServiceEnabled = FALSE;
 314
 315
 316
 317     // Retrieve the globally open ports collection.
 318
 319     err = fwProfile->get_Services(&fwServices);
 320
 321         require( SUCCEEDED( err ), exit );
 322
 323
 324
 325     // Attempt to retrieve the globally open port.
 326
 327     err = fwServices->Item(NET_FW_SERVICE_FILE_AND_PRINT, &fwService);
 328
 329         require( SUCCEEDED( err ), exit );
 330
 331
 332
 333         // Find out if the globally open port is enabled.
 334
 335     err = fwService->get_Enabled(&fwEnabled);
 336
 337         require( SUCCEEDED( err ), exit );
 338
 339         if (fwEnabled != VARIANT_FALSE)
 340
 341         {
 342
 343                 *fwServiceEnabled = TRUE;
 344
 345         }
 346
 347
 348
 349 exit:
 350
 351
 352
 353     // Release the globally open port.
 354
 355     if (fwService != NULL)
 356
 357     {
 358
 359         fwService->Release();
 360
 361     }
 362
 363
 364
 365     // Release the globally open ports collection.
 366
 367     if (fwServices != NULL)
 368
 369     {
 370
 371         fwServices->Release();
 372
 373     }
 374
 375
 376
 377     return err;
 378
 379 }
 380
 381
 382 OSStatus
 383 mDNSAddToFirewall
 384                 (
 385                 LPWSTR  executable,
 386                 LPWSTR  name
 387                 )
 388 {
 389         INetFwProfile   *       fwProfile       = NULL;
 390         HRESULT                         comInit         = E_FAIL;
 391         OSStatus                        err                     = kNoErr;
 392
 393         // Initialize COM.
 394
 395         comInit = CoInitializeEx( 0, COINIT_APARTMENTTHREADED | COINIT_DISABLE_OLE1DDE );
 396
 397         // Ignore this case. RPC_E_CHANGED_MODE means that COM has already been
 398         // initialized with a different mode.
 399
 400         if (comInit != RPC_E_CHANGED_MODE)
 401         {
 402                 err = comInit;
 403                 require(SUCCEEDED(err), exit);
 404         }
 405
 406         // Connect to the firewall
 407
 408         err = mDNSFirewallInitialize(&fwProfile);
 409         require( SUCCEEDED( err ) && ( fwProfile != NULL ), exit);
 410
 411         // Add us to the list of exempt programs
 412
 413         err = mDNSFirewallAddApp( fwProfile, executable, name );
 414         require_noerr(err, exit);
 415
 416 exit:
 417
 418         // Disconnect from the firewall
 419
 420         if ( fwProfile != NULL )
 421         {
 422                 mDNSFirewallCleanup(fwProfile);
 423         }
 424
 425         // De-initialize COM
 426
 427         if (SUCCEEDED(comInit))
 428     {
 429         CoUninitialize();
 430     }
 431
 432         return err;
 433 }
 434
 435
 436 BOOL
 437 mDNSIsFileAndPrintSharingEnabled( BOOL * retry )
 438 {
 439         INetFwProfile   *       fwProfile                                       = NULL;
 440         HRESULT                         comInit                                         = E_FAIL;
 441         BOOL                            enabled                                         = FALSE;
 442         OSStatus                        err                                                     = kNoErr;
 443
 444         // Initialize COM.
 445
 446         *retry = FALSE;
 447         comInit = CoInitializeEx( 0, COINIT_APARTMENTTHREADED | COINIT_DISABLE_OLE1DDE );
 448
 449         // Ignore this case. RPC_E_CHANGED_MODE means that COM has already been
 450         // initialized with a different mode.
 451
 452         if (comInit != RPC_E_CHANGED_MODE)
 453         {
 454                 *retry = TRUE;
 455                 err = comInit;
 456                 require(SUCCEEDED(err), exit);
 457         }
 458
 459         // Connect to the firewall
 460
 461         err = mDNSFirewallInitialize(&fwProfile);
 462         require( SUCCEEDED( err ) && ( fwProfile != NULL ), exit);
 463
 464         err = mDNSFirewallIsFileAndPrintSharingEnabled( fwProfile, &enabled );
 465         require_noerr( err, exit );
 466
 467 exit:
 468
 469         // Disconnect from the firewall
 470
 471         if ( fwProfile != NULL )
 472         {
 473                 mDNSFirewallCleanup(fwProfile);
 474         }
 475
 476         // De-initialize COM
 477
 478         if (SUCCEEDED(comInit))
 479     {
 480         CoUninitialize();
 481     }
 482
 483         return enabled;
 484 }