WireGuard transport SDK: release 0.46.0

.github/workflows/DualPlatformBuildAndPackage.yml

@@ -98,7 +98,52 @@ jobs:
 
     - name: Build GuardianConnectSDK.Services.Abstractions for any CPU
       run: msbuild /t:restore /t:Build /p:Configuration=Release GuardianConnect.Abstractions\GuardianConnect.Abstractions.csproj
-
+
+    ##############################################################################
+    # curve25519.dll — built from Go source on every SDK CI run for proper
+    # provenance. The .nuspec at the SDK root expects the DLLs at
+    #   native/curve25519/win-x64/curve25519.dll
+    #   native/curve25519/win-arm64/curve25519.dll
+    # so this step must run BEFORE the SignPath zip step (which packs per
+    # ListOfGuardianConnectSDKFilesToSign.fls) and the nuget pack steps further
+    # down. Source is `native/curve25519/src/curve25519.go` (Go's BSD-3-Clause
+    # crypto/ecdh.X25519 wrapped with cgo //export). build.cmd handles both
+    # arches; we feed it the runner's Go (PATH-resolved) and llvm-mingw via
+    # GO_EXE and LLVM_MINGW_BIN env vars.
+    ##############################################################################
+
+    - name: Set up Go (for curve25519.dll build)
+      uses: actions/setup-go@v5
+      with:
+        go-version: '1.26.4'
+
+    - name: Cache llvm-mingw cross-toolchain
+      id: cache-llvm-mingw
+      uses: actions/cache@v4
+      with:
+        path: C:\llvm-mingw
+        key: llvm-mingw-20250709-ucrt-x86_64
+
+    - name: Download llvm-mingw (only if cache miss)
+      if: steps.cache-llvm-mingw.outputs.cache-hit != 'true'
+      shell: pwsh
+      run: |
+        $url = 'https://github.com/mstorsjo/llvm-mingw/releases/download/20250709/llvm-mingw-20250709-ucrt-x86_64.zip'
+        $dl = "$env:RUNNER_TEMP\llvm-mingw.zip"
+        $ProgressPreference = 'SilentlyContinue'
+        Write-Host "Downloading llvm-mingw..."
+        Invoke-WebRequest -Uri $url -OutFile $dl -UseBasicParsing
+        Write-Host "Downloaded $((Get-Item $dl).Length / 1MB) MB; extracting..."
+        if (Test-Path C:\llvm-mingw) { Remove-Item C:\llvm-mingw -Recurse -Force }
+        Expand-Archive -Path $dl -DestinationPath C:\llvm-mingw -Force
+
+    - name: Build curve25519.dll (x64 + arm64) from Go source
+      shell: cmd
+      run: |
+        for /d %%D in (C:\llvm-mingw\llvm-mingw-*) do set "LLVM_MINGW_BIN=%%D\bin"
+        set "GO_EXE=go"
+        call native\curve25519\build.cmd
+
 ####    - name: Build GuardianFirewall Service for x64 CPU
 ####      run: |
 ####            msbuild /t:restore /t:Build /p:Configuration=Release /p:Platform=x64 /p:WarningLevel=0 /p:RuntimeIdentifier=win-x64 GuardianFirewallService\GuardianFirewallService.csproj

.gitignore

@@ -10,6 +10,7 @@
 /GuardianConnectSDK/x64
 /GuardianConnectSDK/ARM64
 /GuardianConnectSDK/BuildOutput
+/GuardianConnectSDK/**/BuildOutput
 /GuardianConnectSDK/GuardianConnect/BuildOutput
 /GuardianConnectSDK/.vs
 /GuardianConnectSDK/NativeRoutinesLoadTest/obj

GuardianConnectSDK/Directory.Build.Props

@@ -8,11 +8,11 @@
         <Authors>DNSFilter, Inc.</Authors>
         <RepositoryUrl>https://github.com/GuardianFirewall/GuardianConnect-Windows</RepositoryUrl>
 
-        <AssemblyVersion>0.46.0</AssemblyVersion>
-        <FileVersion>0.46.0</FileVersion>
-        <Version>0.46.0</Version>
-        <!-- Set this for prerelease builds (e.g., "alpha.1", "beta.1", "rc.1"); remove or leave empty for stable releases. -->
-        <VersionSuffix>alpha.2</VersionSuffix>
+        <AssemblyVersion>0.46.1</AssemblyVersion>
+        <FileVersion>0.46.1</FileVersion>
+        <Version>0.46.1</Version>
+        <!-- Set this for prerelease builds (e.g., "alpha.1", "beta.1", "rc.1"); remove or leave empty for stable releases.-->
+        <VersionSuffix></VersionSuffix>
     </PropertyGroup>
 
     <PropertyGroup>

GuardianConnectSDK/GuardianConnect.Abstractions/IGuardianNPContract.cs

@@ -17,7 +17,12 @@ public enum NPCommands
         ToggleLogging,
         RequestLogLines,
         SwitchLoggingLevel,
-        SendPowerAndNetworkEvents
+        SendPowerAndNetworkEvents,
+        SetKillSwitchMode,
+        SetKillSwitchAllowLan,
+        GetKillSwitchStatus,
+        EnterConnectingMode,
+        ExitConnectingMode
     }
 
     public enum SystemEventType
@@ -46,4 +51,27 @@ public enum SystemEventType
     void ToggleLogging(bool whetherToDeleteLogFiles);
 
     void SwitchServiceLoggingLevel(Common.LoggingLevels loggingLevel);
+
+    ErrorResponse SetKillSwitchMode(KillSwitchMode mode);
+
+    ErrorResponse SetKillSwitchAllowLan(bool allow);
+
+    KillSwitchStatus GetKillSwitchStatus();
+
+    /// <summary>
+    /// Tell the service "I'm about to attempt a Connect; open the kill-switch
+    /// connecting-overlay so my credential-registration HTTP calls can escape
+    /// the DNS-block + block-all set". Idempotent; watchdog auto-exits after
+    /// 60s if no paired ExitConnectingMode arrives. See KillSwitchService.cs
+    /// for full lifecycle notes.
+    /// </summary>
+    ErrorResponse EnterConnectingMode();
+
+    /// <summary>
+    /// Optional explicit teardown of the connecting-overlay (e.g., registration
+    /// failed in the client and we don't want to wait for the watchdog).
+    /// Idempotent. Normally not needed — the overlay is cleared automatically
+    /// when the tunnel comes up via the wgConnected / RasConnected event paths.
+    /// </summary>
+    ErrorResponse ExitConnectingMode();
 }

GuardianConnectSDK/GuardianConnect.Abstractions/ITransportProvider.cs

@@ -4,7 +4,13 @@ namespace GuardianConnect.Abstractions;
 
 public interface ITransportProvider
 {
-    public TransportProtocol ProtocolType { get; }
+    // TransportProtocol enum moved to GRDTransportProtocol.cs (still in
+    // this Abstractions assembly) as part of the consolidation that put
+    // the registry Get/Set helpers and the enum into one canonical
+    // location. Property type below is now
+    // GRDTransportProtocol.TransportProtocol; on-disk ordinal values are
+    // unchanged so credential serialization stays wire-compatible.
+    public GRDTransportProtocol.TransportProtocol ProtocolType { get; }
     public VPNProviderStatus VPNStatus { get; }
     public VPNConnectionError LastVPNError { get; }
 
@@ -19,13 +25,6 @@ public interface ITransportProvider
 
     #region CommonEnumerations
 
-    public enum TransportProtocol
-    {
-        TransportUnknown,
-        TransportIKEv2,
-        TransportWireGuard
-    }
-
     public enum VPNProviderStatus
     {
         /*! @const NEVPNStatusInvalid The VPN is not configured. */

GuardianConnectSDK/GuardianConnect.Abstractions/KillSwitchMode.cs

@@ -0,0 +1,43 @@
+using System.Text.Json.Serialization;
+
+namespace GuardianConnect.Abstractions;
+
+/// <summary>
+/// Kill switch mode. v1 ships only Off and OnConnected. Any other mode (e.g. Always-On - here meaning
+/// survive process exit and reboot), is not implemented at this time.
+/// </summary>
+public enum KillSwitchMode
+{
+    /// <summary>No filters installed. Default.</summary>
+    Off = 0,
+
+    /// <summary>
+    /// Filters active while VPN is connecting/connected/reconnecting. Removed on
+    /// user-initiated disconnect; kept across unexpected drops so traffic stays
+    /// blocked until the user either re-establishes the tunnel or disables the
+    /// kill switch.
+    /// </summary>
+    OnConnected = 1,
+}
+
+/// <summary>
+/// Snapshot of kill switch state, returned over IPC to the client UI.
+/// </summary>
+public sealed class KillSwitchStatus
+{
+    public KillSwitchMode Mode { get; init; }
+    public bool AllowLan { get; init; }
+
+    /// <summary>
+    /// True when filters are currently installed (block-all is in force). Read-only;
+    /// driven by the service based on Mode and the live VPN state.
+    /// </summary>
+    public bool IsActive { get; init; }
+}
+
+[JsonSerializable(typeof(KillSwitchStatus))]
+[JsonSerializable(typeof(KillSwitchMode))]
+public partial class KillSwitchStatusJsonContext : JsonSerializerContext
+{
+}
+

GuardianConnectSDK/GuardianConnect.Services/ClientPipeService.cs

@@ -153,6 +153,19 @@ public async void ServerThread(object? data)
 
         var threadId = Thread.CurrentThread.ManagedThreadId;
 
+        // Outer try logs an unhandled escape with a diagnostic-rich message,
+        // then re-throws so the exception propagates out to the ThreadPool's
+        // unhandled-exception handler and Windows Service Recovery restarts
+        // the service. This is the self-healing path. Previous versions
+        // of this catch swallowed the exception silently, which
+        // left the service alive-but-dead with no functional pipe listeners
+        // after a quick stop+start (pipe-bind hit "All pipe instances are
+        // busy" while the OS was still releasing the prior instance's
+        // handles, all listener threads exited cleanly, service stayed up
+        // accepting no clients). Re-throwing restores the self-heal while
+        // keeping the diagnostic log.
+        try
+        {
         while (!_cancellationToken.IsCancellationRequested && !AdministrativeShutdownRequested)
         {
             var pipeSecurity = new PipeSecurity();
@@ -161,10 +174,53 @@ public async void ServerThread(object? data)
                     PipeAccessRights.FullControl,
                     AccessControlType.Allow));
 
-            //NamedPipeServerStream pipeServer = new NamedPipeServerStream("GuardianFirewallService", PipeDirection.InOut, numThreads);
-            var pipeServer = NamedPipeServerStreamAcl.Create("GuardianFirewallService",
-                PipeDirection.InOut, numThreads, PipeTransmissionMode.Byte, PipeOptions.Asynchronous,
-                65536, 65536, pipeSecurity);
+            // Pipe bind with retry. NamedPipeServerStreamAcl.Create can throw
+            // IOException("All pipe instances are busy.") when the service
+            // restarts quickly after a prior instance: the OS has not yet
+            // released the previous service's named-pipe instance count.
+            // 15 seconds is empirically not enough; the failure mode was
+            // observed in test logs.
+            //
+            // Recoverable in-process via backoff. We retry up to N times with
+            // increasing delay before giving up and letting the outer catch
+            // tear the service down for restart. The other listener threads
+            // are competing for the same pipe-instance pool, so a few of them
+            // will succeed earlier and the others later as old instances
+            // release one at a time.
+            NamedPipeServerStream? pipeServer = null;
+            const int maxBindAttempts = 12;
+            var bindAttempt = 0;
+            while (pipeServer is null && !_cancellationToken.IsCancellationRequested && !AdministrativeShutdownRequested)
+            {
+                try
+                {
+                    pipeServer = NamedPipeServerStreamAcl.Create("GuardianFirewallService",
+                        PipeDirection.InOut, numThreads, PipeTransmissionMode.Byte, PipeOptions.Asynchronous,
+                        65536, 65536, pipeSecurity);
+                }
+                catch (IOException ex) when (ex.Message.Contains("All pipe instances are busy", StringComparison.OrdinalIgnoreCase))
+                {
+                    bindAttempt++;
+                    if (bindAttempt >= maxBindAttempts)
+                    {
+                        _logger.Log(LogLevel.Error,
+                            $"ClientPipeService[{threadId}]: pipe bind still failing after {maxBindAttempts} attempts. Giving up — outer catch will tear the service down for Windows Service Recovery restart.");
+                        throw;
+                    }
+                    var delayMs = Math.Min(bindAttempt * 2000, 10000);
+                    _logger.Log(LogLevel.Warning,
+                        $"ClientPipeService[{threadId}]: pipe bind failed (attempt {bindAttempt}/{maxBindAttempts}, prior service handles still releasing). Retrying in {delayMs} ms.");
+                    Thread.Sleep(delayMs);
+                }
+            }
+
+            if (pipeServer is null)
+            {
+                // Cancelled or shutdown during retry — exit the listener loop cleanly.
+                _logger.Log(LogLevel.Information,
+                    $"ClientPipeService[{threadId}]: pipe bind aborted by cancellation/shutdown.");
+                break;
+            }
 
             // Wait for a client to connect
             _logger.Log(LogLevel.Information,
@@ -288,6 +344,33 @@ public async void ServerThread(object? data)
                             _logger.Log(LogLevel.Information, $"ClientPipeService[{threadId}]: Received PowerAndNetworkEvent: Event Type: {systemEventType}");
                             ServicePowerEventsHandler.HandleSystemEventsFromclient(systemEventType, cmdPayload);
                             break;
+                        case IGuardianNPContract.NPCommands.SetKillSwitchMode:
+                            _logger.Log(LogLevel.Information, $"ClientPipeService[{threadId}]: Performing SetKillSwitchMode (payload='{cmdPayload}')");
+                            var ksMode = (KillSwitchMode)int.Parse(cmdPayload);
+                            var ksModeResp = cmdDispatcher.SetKillSwitchMode(ksMode);
+                            ss.WriteString(JsonSerializer.Serialize(ksModeResp, ErrorResponseJsonContext.Default.ErrorResponse));
+                            break;
+                        case IGuardianNPContract.NPCommands.SetKillSwitchAllowLan:
+                            _logger.Log(LogLevel.Information, $"ClientPipeService[{threadId}]: Performing SetKillSwitchAllowLan (payload='{cmdPayload}')");
+                            var ksLan = bool.Parse(cmdPayload);
+                            var ksLanResp = cmdDispatcher.SetKillSwitchAllowLan(ksLan);
+                            ss.WriteString(JsonSerializer.Serialize(ksLanResp, ErrorResponseJsonContext.Default.ErrorResponse));
+                            break;
+                        case IGuardianNPContract.NPCommands.GetKillSwitchStatus:
+                            _logger.Log(LogLevel.Information, $"ClientPipeService[{threadId}]: Performing GetKillSwitchStatus");
+                            var ksStatus = cmdDispatcher.GetKillSwitchStatus();
+                            ss.WriteString(JsonSerializer.Serialize(ksStatus, KillSwitchStatusJsonContext.Default.KillSwitchStatus));
+                            break;
+                        case IGuardianNPContract.NPCommands.EnterConnectingMode:
+                            _logger.Log(LogLevel.Information, $"ClientPipeService[{threadId}]: Performing EnterConnectingMode");
+                            var enterResp = cmdDispatcher.EnterConnectingMode();
+                            ss.WriteString(JsonSerializer.Serialize(enterResp, ErrorResponseJsonContext.Default.ErrorResponse));
+                            break;
+                        case IGuardianNPContract.NPCommands.ExitConnectingMode:
+                            _logger.Log(LogLevel.Information, $"ClientPipeService[{threadId}]: Performing ExitConnectingMode");
+                            var exitResp = cmdDispatcher.ExitConnectingMode();
+                            ss.WriteString(JsonSerializer.Serialize(exitResp, ErrorResponseJsonContext.Default.ErrorResponse));
+                            break;
                         default:
                             _logger.Log(LogLevel.Information, "WHY ARE WE HERE?");
                             break;
@@ -313,5 +396,15 @@ public async void ServerThread(object? data)
         }
 
         _logger.Log(LogLevel.Information, "ClientPipeService.End -- outer While()...");
+        }
+        catch (Exception ex)
+        {
+            _logger.Log(LogLevel.Error, $"ClientPipeService[{threadId}]: ServerThread terminated by unhandled exception: {ex.GetType().Name}: {ex.Message}");
+            // Re-throw: lets the exception escape to the ThreadPool unhandled-exception
+            // handler, which terminates the service. Windows Service Recovery then
+            // restarts us. This restores previous self-heal behavior; the
+            // outer catch is now diagnostic-only, not a swallow.
+            throw;
+        }
     }
 }

GuardianConnectSDK/GuardianConnect.Services/GuardianConnect.Services.csproj

@@ -26,6 +26,7 @@
         <ProjectReference Include="..\GuardianConnect\GuardianConnect.csproj"/>
         <ProjectReference Include="..\Shared\GuardianConnect.Shared.csproj"/>
         <ProjectReference Include="..\Win32Calls.WFP\Win32Calls.WFP.csproj"/>
+        <ProjectReference Include="..\Win32Calls.WireGuard\Win32Calls.WireGuard.csproj"/>
         <ProjectReference Include="..\Win32Calls\Win32Calls.csproj"/>
     </ItemGroup>