Definition of outbound FirewallException not supported?

[dbieber-rfideas]

Hello,

Thanks for the work on WixSharp. It's a great project.

I'm having trouble figuring out how to add an in/out firewall rule. I have successfully added firewall rules, but it only creates an inbound rule. I need to be able to configure both inbound and outbound type rules. Is that possible with WixSharp? It is supported by Wix4 itself, according to their Schema documentation:
FirewallException
Outbound (wxs:YesNoTypeUnion) : If "yes", registers an outbound firewall rule. The default is "no".

Here is what I'm doing in WixSharp; I've got a json config that defines the firewall rules, among other things, and it parses that on run:
JSON:

  "FirewallRules": [
    {
      "Name": "Firewall Rule 1",
      "Description": "Allow Inbound/Outbound on 12345",
      "RemoteAddresses": [
        "0.0.0.0"
      ],
      "Port": "12345",
      "Protocol": "TCP"
    },
    {
      "Name": "Firewall Rule 2",
      "Description": "Allow Inbound/Outbound on 80",
      "RemoteAddresses": [
        "0.0.0.0"
      ],
      "Port": "80",
      "Protocol": "TCP"
    }
  ]

        foreach (FirewallRules rule in config.FirewallRules)
        {
            project.Add(new FirewallException(rule.Name)
            {
                Name = rule.Name,
                Description = rule.Description,
                RemoteAddress = rule.RemoteAddresses,
                Port = rule.Port.ToString(),
                Protocol = rule.Protocol == FirewallRuleProtocol.TCP
                    ? FirewallExceptionProtocol.tcp
                    : FirewallExceptionProtocol.udp
            });
        }

Is there a way to define the rule as inbound/outbound, or just both?

[oleg-shilo]

FirewallException.Outbound = true;
You can do it the same way as it is described in the WiX doc with the property Outbound.

[dbieber-rfideas]

Hi Oleg,
Thanks for the quick response.
I looked at the FirewallException class and there is no Outbound property. And it is not available when I try to use it:

I am using wix4 4.0.5, with WixToolset.Firewall.wixext version 4.0.5.

[dbieber-rfideas]

Update:
Previously I had trouble getting wix5 to work, but it builds now.
Using the latest version of the WixSharp NuGet package as well as updating wix and its extensions to v5 was sufficient to work.

I'm getting an error when I run the installer and it rolls back the installation. Not sure where the log is stored, but this is probably an issue on my side at this point.

[dbieber-rfideas]

@oleg-shilo

While the property is there, switching to Wix5 has apparently completely broken the FirewallException class.
The installer builds fine, but when I run it, I see this in the log (also the log file does not generate unless I run it with msiexec.exe):

Action start 18:56:45: Wix5SchedFirewallExceptionsUninstall_X86.
SchedFirewallExceptions:  Component '_...Configuration20Utility___' action state (1) doesn't match request (2)
SchedFirewallExceptions:  No firewall exceptions scheduled
Action ended 18:56:45: Wix5SchedFirewallExceptionsUninstall_X86. Return value 1.

Later on, I see:

ExecFirewallExceptions:  Installing firewall exception Configuration Utility
ExecFirewallExceptions:  Error 0x8007000d: failed to set exception icmp types and codes 'no'
ExecFirewallExceptions:  Error 0x8007000d: failed to create INetFwRule firewall exception 'Configuration Utility'
ExecFirewallExceptions:  Error 0x8007000d: failed to add/update firewall exception for name 'Configuration Utility'
CustomAction Wix5ExecFirewallExceptionsInstall_X86 returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
Action ended 18:56:46: InstallFinalize. Return value 3.
ExecFirewallExceptions:  Uninstalling firewall exception Configuration Utility
Action ended 18:56:47: INSTALL. Return value 3.

This is with the simplest possible firewall exception, added directly to the ManagedProject:

        project.Add((new FirewallException("Configuration Utility")
        {
            Port = "80"
        }));

When I used Wix4, the rules were created without issue, but the Outbound property was not available. Updating the WixSharp Nuget package brought the property in, but it did not work correctly until I updated the wix tool and its extensions to v5.

I'm running out of ideas. I've tried various combinations of properties but nothing seems to work.

I'd be happy to provide any other info that you think would help - I may have to redact some words though since this is for a customer.

I'm going to switch to a basic Wix UI rather than a Managed one and see if it helps.

EDIT:
It is caused by the WIX XML that WixSharp generates containing an inapplicable attribute:

<Component Id="_...Reader20Configuration20Utility___" Guid="7521944c-4f42-4aa8-97e7-5338c6c1878e" KeyPath="yes">
            <FirewallException Id="_...Reader20Configuration20Utility___" Name="Configuration Utility" Port="80" Enabled="yes" IcmpTypesAndCodes="no" Outbound="no" xmlns="http://wixtoolset.org/schemas/v4/wxs/firewall" />

            <CreateFolder />
            <RemoveFolder Id="INSTALLDIR" On="uninstall" />
          </Component>

The IcmpTypesAndCodes="no" attribute causes the installer to fail to install the rule. If I remove that attribute, the rule works. If I add it back (with both "no" and "yes" values), it fails. I think this is because that property only applies to rules that are using the ICMPv4 protocol. Since this rule is TCP, it doesn't make sense (if you look at the windows firewall advanced GUI, you will see that this setting is grayed out unless ICMPv4 protocol is selected).

Is it possible for WixSharp to conditionally insert this attribute only when the ICMPv4 protocol is selected (or just omit the attribute since WixSharp doesn't seem to support ICMPv4 protocol)?

[oleg-shilo]

Is it possible for WixSharp to conditionally insert this attribute only when the ICMPv4 protocol is selected

Yes, absolutely.
Though, I am surprised that WiX does not complain about incompatible attributes.

I have created the #1606 issue for that

[oleg-shilo]

Oh, sorry, it was my misunderstanding.

I interpreted your description "It is caused by the WIX XML that WixSharp generates containing an inapplicable attribute:" a fact that WixSharp calculates and inserts this attribute by itself. I was wrong. Please see the description at #1606