Merge pull request #380 from openziti/release-next

Release next

BUILDING.md

@@ -14,3 +14,11 @@ components:
 * A Windows service which runs as the local system account which creates the TUN as well as manages the Ziti connections
 * A Windows UWP UI application that allows the interactively logged on user to interact with the Windows service
 
+Build steps
+
+* Set PROJECT_ROOT=<project_path> and SVC_ROOT_DIR=%PROJECT_ROOT%\desktop-edge-win\service\ path
+* Go to service directory: "cd %SVC_ROOT_DIR%"
+* Run "build.bat clean|quick" or quick.bat or clean.bat (Use quick, if you have already done a clean build, and you have the latest tsdk library in the _deps folder)
+* Obtain WinSign.p12 file and copy it to the "%PROJECT_ROOT%\desktop-edge-win\Installer" path. This is the signing certificate and that it's necessary to build the installer with this.
+* Build Installer: cd to the "%PROJECT_ROOT%\desktop-edge-win" path and execute "powershell -file Installer\build.ps1"
+* If build is successful, the installer and sha file will be generated in "%PROJECT_ROOT%\desktop-edge-win\Installer\Output"

DesktopEdge/Views/Screens/IdentityDetails.xaml

@@ -47,7 +47,7 @@
 
                 <local:Filter x:Name="FilterServices" OnFilter="DoFilter" VerticalAlignment="Top" Margin="10,16,10,0" />
 
-                <TextBox Name="NoAuthServices" Height="30" FontWeight="Bold" TextAlignment="Center" Text="You must authenticate to access services" IsReadOnly="True" HorizontalAlignment="Stretch" BorderThickness="0" ClipToBounds="True" Grid.Column="0" Grid.Row="5" VerticalAlignment="Center" Padding="0,6,3,0" FontSize="12" FontFamily="pack://application:,,,/Assets/Fonts/#Open Sans" Foreground="Black"></TextBox>
+                <TextBox Name="NoAuthServices" Height="30" FontWeight="Bold" Margin="10,0,10,0" TextAlignment="Center" Text="You must authenticate to access services" IsReadOnly="True" HorizontalAlignment="Stretch" BorderThickness="0" ClipToBounds="True" Grid.Column="0" Grid.Row="5" VerticalAlignment="Center" Padding="0,6,3,0" FontSize="12" FontFamily="pack://application:,,,/Assets/Fonts/#Open Sans" Foreground="Black"></TextBox>
                 <Grid Name="MainDetailScroll" MaxHeight="160" Margin="10,0,10,-10">
                     <Rectangle Margin="10,10,10,10" Fill="#070826" RadiusY="10" RadiusX="10"></Rectangle>
                     <ListView x:Name="ServiceList" VirtualizingPanel.IsVirtualizing="True" ScrollViewer.IsDeferredScrollingEnabled="True" ScrollViewer.ScrollChanged="Scrolled" Focusable="False" IsManipulationEnabled="False" BorderThickness="0" Background="Transparent" Margin="20,20,10,20" Style="{DynamicResource ServiceListStyle}">

ZitiUpdateService/UpdateService.cs

@@ -33,8 +33,6 @@ namespace ZitiUpdateService {
 
 		public bool useGithubCheck { get; private set; }
 
-		private static string[] expected_hashes = new string[] { "39636E9F5E80308DE370C914CE8112876ECF4E0C", "51D52749DA021F095B021DF8C09BD62C55C36F1F" };
-
 		private static string[] expected_subject = new string[] { @"CN=""NetFoundry, Inc."", O=""NetFoundry, Inc."", L=Herndon, S=Virginia, C=US", @"CN=NetFoundry Inc., O=NetFoundry Inc., L=Herndon, S=Virginia, C=US" };
 
 		private static readonly Logger Logger = LogManager.GetCurrentClassLogger();
@@ -195,7 +193,7 @@ namespace ZitiUpdateService {
 
 				outputIpconfigInfo(destinationLocation);
 				outputSystemInfo(destinationLocation);
-				// removing this as of 1.9.0+ since we use NRPT... outputDnsCache(destinationLocation);
+				outputDnsCache(destinationLocation);
 				outputExternalIP(destinationLocation);
 				outputTasklist(destinationLocation);
 				outputRouteInfo(destinationLocation);
@@ -660,16 +658,6 @@ namespace ZitiUpdateService {
 					Logger.Info("the file downloaded uses a known subject. installation and can proceed. [subject:{0}]", subject);
 				}
 
-				var hash = signer.GetCertHashString();
-				if (!expected_hashes.Contains(hash)) {
-					Logger.Error("the file downloaded is signed by an unknown certificate! the installation will not proceed. [hash:{0}]", hash);
-					inUpdateCheck = false;
-					return;
-
-				} else {
-					Logger.Info("the file downloaded is signed by a known certificate. installation and can proceed. [subject:{0}]", subject);
-				}
-
 				StopZiti();
 				StopUI().Wait();
 

release-notes.md

@@ -1,11 +1,13 @@
 # Release 1.9.6
 
 ## What's New
-* none
+* [#378](https://github.com/openziti/desktop-edge-win/issues/378) Cleanup old ziti network adapter profiles
 
 ## Other changes:
-* updated installation config
+* updated auto-installation config
 * renewed signing cert
+* added dns cache output back to feedback.zip
+* set lower metric, if dns server property is set
 
 ## Bugs fixed:
 * none

service/build.bat

@@ -85,6 +85,8 @@ echo REMOVING old build folder if it exists at %TUNNELER_SDK_DIR%build
 rmdir /s /q %TUNNELER_SDK_DIR%build
 echo REMOVING ziti.dll at %SVC_ROOT_DIR%ziti.dll
 del /q %SVC_ROOT_DIR%ziti.dll
+echo REMOVING wintun.dll at %SVC_ROOT_DIR%wintun.dll
+del /q %SVC_ROOT_DIR%wintun.dll
 
 :QUICK
 

service/windns/windns.go

@@ -288,3 +288,23 @@ func removeSingleNrtpRule(nrptRule string) {
 		log.Errorf("ERROR removing the nrpt rules: %v", err)
 	}
 }
+
+func CleanUpNetworkAdapterProfile() {
+	script := fmt.Sprintf(`$key="Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\Unmanaged\*"
+Get-ItemProperty -Path $key | where {$_.FirstNetwork -match "ziti.*"} | Remove-Item
+
+$key="Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\*"
+Get-ItemProperty -Path $key | where {$_.ProfileName -match "Ziti.*"} | Remove-Item`)
+	log.Debugf("Cleaning up the Network Adapter profiles with: %s", script)
+
+	cmd := exec.Command("powershell", "-Command", script)
+	cmd.Stderr = os.Stdout
+	output := new(bytes.Buffer)
+	cmd.Stdout = output
+
+	err := cmd.Run()
+	if err != nil {
+		log.Errorf("ERROR Cleaning up the Network Adapter profiles: %v", err)
+	}
+
+}

service/ziti-tunnel/service/ipc.go

@@ -65,6 +65,8 @@ var shutdown = make(chan bool, 8) //a channel informing go routines to exit
 func SubMain(ops chan string, changes chan<- svc.Status) error {
 	log.Info("============================== service begins ==============================")
 	windns.RemoveAllNrptRules()
+	// cleanup old ziti tun profiles
+	windns.CleanUpNetworkAdapterProfile()
 
 	rts.LoadConfig()
 	l := rts.state.LogLevel
@@ -287,8 +289,6 @@ func initialize(cLogLevel int) error {
 		return err
 	}
 
-	cziti.SetInterfaceMetric(TunName, 255)
-
 	cziti.Start(rts, rts.state.TunIpv4, rts.state.TunIpv4Mask, cLogLevel)
 	err = cziti.HookupTun(*t)
 	if err != nil {

service/ziti-tunnel/service/state.go

@@ -225,6 +225,7 @@ func (t *RuntimeState) CreateTun(ipv4 string, ipv4mask int, applyDns bool) (net.
 	log.Info("routing applied")
 
 	zitiPoliciesEffective := windns.IsNrptPoliciesEffective(ipv4)
+	interfaceMetric := 255
 	if applyDns || !zitiPoliciesEffective {
 		if applyDns {
 			log.Infof("DNS is applied to the TUN interface, because apply Dns flag in the config file is %t ", applyDns)
@@ -234,7 +235,10 @@ func (t *RuntimeState) CreateTun(ipv4 string, ipv4mask int, applyDns bool) (net.
 		}
 		//for windows 10+, could 'domains' be able to replace NRPT? dunno - didn't test it
 		luid.SetDNS(windows.AF_INET, []net.IP{ip}, nil)
+		interfaceMetric = 5
 	}
+	cziti.SetInterfaceMetric(TunName, interfaceMetric)
+	log.Debugf("Interface Metric of %s is set to %d", TunName, interfaceMetric)
 
 	return ip, t.tun, nil
 }

service/ziti-tunnel/version.go

@@ -21,8 +21,8 @@ package main
 
 const (
 	Version   = "1.9.6"
-	Revision  = "5e93339120fc"
-	Branch    = "main"
+	Revision  = "fccaa5f5d3c2"
+	Branch    = "release-next"
 	BuildUser = ""
-	BuildDate = "2021-05-13 10:30:25"
+	BuildDate = "2021-05-25 18:09:13"
 )