blob: abed109cab9f03e438fb7e3f7dbc50d87d8d48b3 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
|
<#
.SYNOPSIS
Add (or remove) the inbound Windows Firewall rules MeshBay needs.
.DESCRIPTION
WebRTC binds an ephemeral UDP port per connection and the browser always
dials the node (aioice cannot resolve the peer's mDNS `.local` candidate),
so the node must accept unsolicited inbound UDP. Without a rule, Windows
pops an "Allow access" dialog the first time each of MeshBay.exe and
meshbay-node.exe binds a socket.
The installer runs this once, elevated, so the user answers one UAC prompt
instead of two firewall dialogs later. Declining the installer's offer is
fine -- the dialogs are the fallback.
Shipped as an extraResource at <install>\resources\firewall.ps1, so it
locates the two executables from its own path and takes no arguments beyond
the action. Runs elevated and windowless, so it leaves a trace at
%TEMP%\meshbay-firewall.log.
.PARAMETER Action
add (default) create/replace the rules
remove delete them
#>
[CmdletBinding()]
param(
[ValidateSet("add", "remove")]
[string]$Action = "add"
)
$ErrorActionPreference = "Stop"
$log = Join-Path $env:TEMP "meshbay-firewall.log"
"[{0}] {1}" -f (Get-Date -Format s), $Action | Add-Content $log
# This script sits at <install>\resources\firewall.ps1.
$resources = $PSScriptRoot
$install = Split-Path -Parent $resources
$GROUP = "MeshBay"
$targets = @(
@{ Name = "MeshBay"; Path = Join-Path $install "MeshBay.exe" }
@{ Name = "MeshBay Node"; Path = Join-Path $resources "node-runtime\meshbay-node.exe" }
)
try {
foreach ($t in $targets) {
# Idempotent: clear any existing rule of this name first.
Remove-NetFirewallRule -DisplayName $t.Name -ErrorAction SilentlyContinue
if ($Action -eq "add") {
if (-not (Test-Path $t.Path)) {
" skip $($t.Name): $($t.Path) not found" | Add-Content $log
continue
}
New-NetFirewallRule -DisplayName $t.Name -Group $GROUP `
-Direction Inbound -Action Allow `
-Program $t.Path -Protocol UDP -Profile Any | Out-Null
" allowed $($t.Name) ($($t.Path))" | Add-Content $log
}
else {
" removed $($t.Name)" | Add-Content $log
}
}
}
catch {
" ERROR: $_" | Add-Content $log
throw
}
|