Skip to content

SecureWall v0.2.0 (alpha, unsigned installers)

Pre-release
Pre-release

Choose a tag to compare

View all tags
@ryanportfolio ryanportfolio released this 07 Sep 06:28
· 22 commits to main since this release
v0.2.0
1a7c176
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Warning

This is an unsigned alpha prerelease. The real-WFP, reboot, upgrade, and uninstall VM matrix in docs/HARDENING-VALIDATION.md has not been run against this build. Use only on a machine you can recover locally.

SecureWall v0.2.0 is the hardening release that followed a first-principles review of v0.1.1. It installs over v0.1.1.

Security fixes

  • Bounded appId read in the WFP net-event callback. The previous unbounded read fed the path that becomes an Allow rule. Backported from upstream TinyWall 62b088f.
  • Native callback handlers and the service net-event callback catch every managed exception, so a throw no longer unwinds into FWPUClnt and kills the SYSTEM service. Upstream issue #128.
  • Password salt now comes from RandomNumberGenerator instead of System.Random. Upstream 3448b6b.
  • Hosts file and database updates write through a temp file and File.Replace; the hosts lock is restored on every path. Update downloads decompress and hash in memory.

Behaviour changes

  • The audit-policy lease journals the original "Filtering Platform Connection" setting to HKLM\SOFTWARE\SecureWall\AuditRecovery before changing it, and restores it on service start, /uninstall, and /msi-cleanup. A crash no longer leaves failure auditing enabled machine-wide.
  • The block prompt warns when the executable is unsigned (WinVerifyTrust plus catalog lookup), sits in a user-writable directory, or changed in the last 24 hours. Allow rechecks that the file still exists and refuses with a logged reason when it is gone.
  • The persistent recovery baseline permits DHCP and DNS (eight rules: DHCPv4/v6 request and reply, DNS UDP and TCP over v4 and v6). A stopped or crashed service no longer strands the machine without an address or name resolution. These permits sit below every runtime filter, so Normal, BlockAll, and user blocks still win while the service runs.

Known limits

  • The local pipe authorization model is unchanged: image-path check, Authenticated Users pipe DACL, password lock as the only gate. See docs/SECURITY.md, "Local IPC boundary".
  • Baseline DHCP and DNS permits are not scoped by process or address while the service is down.
  • Upstream b741831, 3146d95, and the WFP wrapper fixes are not backported. UPSTREAM.md lists them.

Installers

Choose one:

  • SecureWall_x64.msi: Intel/AMD 64-bit Windows
  • SecureWall_arm64.msi: Windows on ARM
  • SecureWall_x86.msi: 32-bit Windows

Verify the SHA-256 hash against SHA256SUMS.txt before running. Windows shows an unknown-publisher warning because these alpha installers are not code-signed. GitHub Actions builds them from this tag with pinned WiX 3.14.1, MSI ICE validation, the pure security test suite, and the installer package-contract checks.

SecureWall remains GPL-3.0 software derived from TinyWall; source and attribution are included in this repository.

Assets 6
Loading