SimpleDeFence 0.1.1 beta

SimpleDeFence 0.1.1 beta

Beta. The GUI changes in this release have not been exercised on a real
desktop yet - the tray icon in particular is new Win32 interop that has
never been run - so treat it as a test build rather than an upgrade.

Security

• The control pipe between the service and the GUI could be taken over by
  any local process. The server destroyed and rebuilt its pipe for every
  request, leaving the name unowned in between; whoever claimed it in that
  gap received the GUI's next message, and the unlock message carries the
  configuration passphrase in cleartext. The instance is now permanent,
  and the client verifies the pipe is owned by LocalSystem before it
  writes anything.
• The pipe admitted Authenticated Users - every account that can log on -
  with an image-path comparison standing in for authorization, which any
  copy of the shipped GUI satisfies because the GUI and the service are
  the same executable. It is now restricted to Administrators and SYSTEM,
  and the server requires the caller's effective token to hold the
  Administrators role.
• The GUI elevates when it can. Its privilege level used to depend on how
  it was launched: elevated from the logon task, unprivileged from the
  Start Menu.
• Learning mode auto-whitelisted svchost.exe, granting every service that
  shares that host unrestricted TCP and UDP access, permanently.
• The service followed directory junctions while stripping ACLs as
  LocalSystem, in a tree it also grants users write access to.
• The updater verified the downloaded installer and then launched it as
  two separate steps, and could not launch it at all.

Fixes

• Auto-update never worked on any install: clients asked for a module
  name for an architecture this project does not build.
• Exception merging could delete a rule or duplicate one depending on
  insertion order.
• The tray icon had no exception boundary at its native window callback.

Changes

• Own tray implementation; the H.NotifyIcon.WinUI dependency is gone.
• Connection rows highlight on hover and show the executable's full path.
• Allow asks which policy to apply instead of applying the widest one.
• Dialogs, menus and flyouts follow the app's light/dark setting.
• The install directory drops from 396 files and 229 MB to 326 and
  177 MB; the installer from 75.5 MB to 54.3 MB.

Known issues

• On a standard user account the GUI runs unprivileged and cannot command
  the service; it says so and offers to restart elevated.
• The installer is not code-signed.