Disable isolation when --allow=0.0.0.0/0 is specified (#39)

* Disable isolation when --allow=0.0.0.0/0 is specified

* Upgrade & upgrade the dependencies

lib/host.rs

@@ -31,7 +31,7 @@ pub struct Host {
 }
 
 impl Host {
-    pub fn new(vm_net_type: NetType) -> Result<Host> {
+    pub fn new(vm_net_type: NetType, enable_isolation: bool) -> Result<Host> {
         // Initialize a vmnet.framework NAT or Host interface with isolation enabled
         let mut interface = vmnet::Interface::new(
             match vm_net_type {
@@ -39,7 +39,7 @@ impl Host {
                 NetType::Host => Mode::Host(Default::default()),
             },
             Options {
-                enable_isolation: Some(true),
+                enable_isolation: Some(enable_isolation),
                 ..Default::default()
             },
         )

lib/poller.rs

@@ -2,14 +2,15 @@ use anyhow::Result;
 use num_enum::IntoPrimitive;
 use polling::os::kqueue::PollerKqueueExt;
 use polling::PollMode;
+use std::os::fd::{AsRawFd, BorrowedFd};
 use std::os::unix::io::RawFd;
 use std::time::Duration;
 
-pub struct Poller {
+pub struct Poller<'poller> {
     poller: polling::Poller,
-    events: Vec<polling::Event>,
-    vm_fd: RawFd,
-    host_fd: RawFd,
+    events: polling::Events,
+    vm_fd: BorrowedFd<'poller>,
+    host_fd: BorrowedFd<'poller>,
 }
 
 #[derive(IntoPrimitive)]
@@ -20,22 +21,25 @@ enum EventKey {
     Interrupt,
 }
 
-impl Poller {
-    pub fn new(vm_fd: RawFd, host_fd: RawFd) -> Result<Poller> {
+impl Poller<'_> {
+    pub fn new<'poller>(vm_fd: RawFd, host_fd: RawFd) -> Result<Poller<'poller>> {
         let poller = polling::Poller::new()?;
 
         Ok(Poller {
             poller,
-            events: Vec::new(),
-            vm_fd,
-            host_fd,
+            events: polling::Events::new(),
+            vm_fd: unsafe { BorrowedFd::borrow_raw(vm_fd) },
+            host_fd: unsafe { BorrowedFd::borrow_raw(host_fd) },
         })
     }
 
     pub fn arm(&self) -> Result<()> {
-        self.poller.add(self.vm_fd as RawFd, self.vm_interest())?;
-        self.poller
-            .add(self.host_fd as RawFd, self.host_interest())?;
+        unsafe {
+            self.poller
+                .add(self.vm_fd.as_raw_fd(), self.vm_interest())?;
+            self.poller
+                .add(self.host_fd.as_raw_fd(), self.host_interest())?;
+        }
 
         let interrupt_signal = polling::os::kqueue::Signal(libc::SIGINT);
         self.poller
@@ -52,10 +56,8 @@ impl Poller {
     pub fn rearm(&mut self) -> Result<()> {
         self.events.clear();
 
-        self.poller
-            .modify(self.vm_fd as RawFd, self.vm_interest())?;
-        self.poller
-            .modify(self.host_fd as RawFd, self.host_interest())?;
+        self.poller.modify(self.vm_fd, self.vm_interest())?;
+        self.poller.modify(self.host_fd, self.host_interest())?;
 
         let interrupt_signal = polling::os::kqueue::Signal(libc::SIGINT);
         self.poller.modify_filter(

lib/proxy/host.rs

@@ -3,7 +3,7 @@ use crate::proxy::Proxy;
 use anyhow::{Context, Result};
 use smoltcp::wire::{EthernetFrame, EthernetProtocol, Ipv4Packet, UdpPacket};
 
-impl Proxy {
+impl Proxy<'_> {
     pub(crate) fn process_frame_from_host(&mut self, frame: &EthernetFrame<&[u8]>) -> Result<()> {
         if self.allowed_from_host(frame).is_none() {
             // Block packet by not forwarding it to the VM
@@ -58,7 +58,7 @@ impl Proxy {
             return;
         }
 
-        if ipv4_pkt.protocol() != smoltcp::wire::IpProtocol::Udp {
+        if ipv4_pkt.next_header() != smoltcp::wire::IpProtocol::Udp {
             return;
         }
 

lib/proxy/mod.rs

@@ -10,30 +10,30 @@ use crate::vm::VM;
 use anyhow::Result;
 use ipnet::Ipv4Net;
 use mac_address::MacAddress;
-use prefix_trie::PrefixSet;
+use prefix_trie::{Prefix, PrefixSet};
 use smoltcp::wire::EthernetFrame;
 use std::io::ErrorKind;
 use std::os::unix::io::{AsRawFd, RawFd};
 
-pub struct Proxy {
+pub struct Proxy<'proxy> {
     vm: VM,
     host: Host,
-    poller: Poller,
+    poller: Poller<'proxy>,
     vm_mac_address: smoltcp::wire::EthernetAddress,
     dhcp_snooper: DhcpSnooper,
     allow: PrefixSet<Ipv4Net>,
     enobufs_encountered: bool,
 }
 
-impl Proxy {
-    pub fn new(
+impl Proxy<'_> {
+    pub fn new<'proxy>(
         vm_fd: RawFd,
         vm_mac_address: MacAddress,
         vm_net_type: NetType,
         allow: PrefixSet<Ipv4Net>,
-    ) -> Result<Proxy> {
+    ) -> Result<Proxy<'proxy>> {
         let vm = VM::new(vm_fd)?;
-        let host = Host::new(vm_net_type)?;
+        let host = Host::new(vm_net_type, !allow.contains(&Ipv4Net::zero()))?;
         let poller = Poller::new(vm.as_raw_fd(), host.as_raw_fd())?;
 
         Ok(Proxy {

lib/proxy/vm.rs

@@ -8,7 +8,7 @@ use smoltcp::wire::{
 };
 use std::net::Ipv4Addr;
 
-impl Proxy {
+impl Proxy<'_> {
     pub(crate) fn process_frame_from_vm(&mut self, frame: EthernetFrame<&[u8]>) -> Result<()> {
         if self.allowed_from_vm(&frame).is_none() {
             // Block packet by not forwarding it to the host
@@ -72,7 +72,11 @@ impl Proxy {
             // Also allow all traffic to the user-specified CIDRs
             let dst_net = Ipv4Net::from(dst_addr);
 
-            if self.allow.get_spm(&dst_net).is_some() {
+            // Use get_lpm() instead of get_spm() to work around prefix-trie
+            // not handling prefixes like 0.0.0.0/0 correctly[1]
+            //
+            // [1]: https://github.com/tiborschneider/prefix-trie/issues/8
+            if self.allow.get_lpm(&dst_net).is_some() {
                 return Some(());
             }
         }
@@ -82,7 +86,7 @@ impl Proxy {
             return Some(());
         }
 
-        if ipv4_pkt.protocol() == IpProtocol::Udp {
+        if ipv4_pkt.next_header() == IpProtocol::Udp {
             let udp_pkt = UdpPacket::new_checked(ipv4_pkt.payload()).ok()?;
 
             // Allow DNS communication with the DNS-servers provided by DHCP