diff options
Diffstat (limited to 'packaging/win')
| -rw-r--r-- | packaging/win/README.md | 8 | ||||
| -rw-r--r-- | packaging/win/firewall.ps1 | 22 |
2 files changed, 24 insertions, 6 deletions
diff --git a/packaging/win/README.md b/packaging/win/README.md index 5130e60..01c8d1a 100644 --- a/packaging/win/README.md +++ b/packaging/win/README.md @@ -109,8 +109,12 @@ Linux packaging solves with a broad `1024-65535/udp` range since those two are fixed and known — matching `packaging/firewall/*/meshbay-cast.xml` exactly. -Say yes and every prompt you'd otherwise hit mid-use — connecting, or the -first cast — is gone. Say no, or the UAC prompt is dismissed, and Windows +Setup checks first, **unelevated** (`firewall.ps1 check` — reading rules needs +no admin, only creating them does), so running the installer again — an +upgrade, a repair install — asks nothing and never pops UAC a second time once +the rules are in place. Say yes the first time and every prompt you'd +otherwise hit mid-use — connecting, or the first cast — is gone. Say no, or +the UAC prompt is dismissed, and Windows falls back to its own **"Allow access"** dialog the first time each program/port combination is used — tick **both Private and Public** then (a libvirt/VM adapter, and sometimes a plain Ethernet one, registers as Public; a diff --git a/packaging/win/firewall.ps1 b/packaging/win/firewall.ps1 index bf1b32b..9b3687a 100644 --- a/packaging/win/firewall.ps1 +++ b/packaging/win/firewall.ps1 @@ -29,20 +29,23 @@ Shipped as an extraResource at <install>\resources\firewall.ps1, so it locates the two executables from its own path and takes no arguments - beyond the action. Runs elevated and windowless, so it leaves a trace at - %TEMP%\meshbay-firewall.log. + beyond the action. add/remove run elevated and windowless, leaving a + trace at %TEMP%\meshbay-firewall.log; check is a plain read (no admin + needed -- Get-NetFirewallRule does not require it, only New/Remove do) + that the installer runs first, unelevated, so re-running setup with the + rules already in place skips the prompt and the UAC entirely. .PARAMETER Action add (default) create/replace the rules remove delete them + check exit 0 if all rules already exist, 1 otherwise -- no admin needed #> [CmdletBinding()] param( - [ValidateSet("add", "remove")] + [ValidateSet("add", "remove", "check")] [string]$Action = "add" ) -$ErrorActionPreference = "Stop" $log = Join-Path $env:TEMP "meshbay-firewall.log" "[{0}] {1}" -f (Get-Date -Format s), $Action | Add-Content $log @@ -63,6 +66,17 @@ $rules = @( @{ Name = "MeshBay Cast Discovery"; Path = $client; Protocol = "UDP"; LocalPort = "5353" } ) +if ($Action -eq "check") { + $missing = $rules | Where-Object { -not (Get-NetFirewallRule -DisplayName $_.Name -ErrorAction SilentlyContinue) } + if ($missing) { + " check: missing $(($missing | ForEach-Object { $_.Name }) -join ', ')" | Add-Content $log + exit 1 + } + " check: all rules present" | Add-Content $log + exit 0 +} + +$ErrorActionPreference = "Stop" try { foreach ($r in $rules) { # Idempotent: clear any existing rule of this name first. |