public_git/tart-softnet
1
0
Fork 0
mirror of https://github.com/cirruslabs/softnet.git synced 2026-09-30 03:51:23 +02:00
Code Issues Packages Projects Releases Wiki Activity

--allow: support "@host" syntax (#160)

Browse Source 
* --allow: support "@host" syntax

To make communication with the guest VM possible
when using --block=0.0.0.0/0.

* Use "@-alias" wording instead of "@host"
This commit is contained in:
Nikolay Edigaryev
2026-05-15 16:06:03 +02:00
committed by GitHub
parent bbff9996ab
commit df84a30016
2 changed files with 85 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main.rs
+15 -12
View File
@@ -1,14 +1,13 @@
use anyhow::{Context, anyhow};
use clap::Parser;
use ipnet::Ipv4Net;
use log::LevelFilter;
use nix::sys::signal::{SigHandler, Signal, signal};
use oslog::OsLogger;
use prefix_trie::PrefixSet;
use privdrop::PrivDrop;
use softnet::NetType;
use softnet::proxy::ExposedPort;
use softnet::proxy::Proxy;
use softnet::proxy::Target;
use std::borrow::Cow;
use std::env;
use std::os::raw::c_int;
@@ -53,29 +52,33 @@ struct Args {
#[clap(
long,
help = "Comma-separated list of CIDRs to allow the traffic to \
(e.g. --allow=192.168.0.0/24 may be used to allow a LAN access for a VM). \
(e.g. --allow=192.168.0.0/24 may be used to allow a LAN access for a VM), \
plus supported @-aliases. Currently the only supported @-alias is @host, \
which matches the vmnet bridge gateway IP. \
When used with --block, the longest prefix match always wins. \
In case an identical prefix is both --allow'ed and --block'ed, \
blocking will take precedence. --allow=0.0.0.0/0 is a special case, \
it additionally disables bridge isolation (even when --block=0.0.0.0/0 is specified).",
value_name = "comma-separated CIDRs",
value_name = "comma-separated CIDRs or @-alias",
use_value_delimiter = true,
action = clap::ArgAction::Set
)]
allow: Vec<Ipv4Net>,
allow: Vec<Target>,
#[clap(
long,
help = "Comma-separated list of CIDRs to block the traffic to \
(e.g. --block=0.0.0.0/0 may be used to establish a default deny policy \
that is further relaxed with --allow). When used with --allow, \
the longest prefix match always wins. In case the same prefix is both \
--allow'ed and --block'ed, blocking takes precedence.",
value_name = "comma-separated CIDRs",
that is further relaxed with --allow), plus supported @-aliases. \
Currently the only supported @-alias is @host, which matches the vmnet bridge gateway IP. \
When used with --allow, the longest prefix match always wins. \
In case an identical prefix is both --allow'ed and --block'ed, \
blocking will take precedence.",
value_name = "comma-separated CIDRs or @-alias",
use_value_delimiter = true,
action = clap::ArgAction::Set
)]
block: Vec<Ipv4Net>,
block: Vec<Target>,
#[clap(
long,
@@ -196,8 +199,8 @@ fn try_main() -> anyhow::Result<()> {
args.vm_fd as RawFd,
args.vm_mac_address,
args.vm_net_type,
PrefixSet::from_iter(args.allow),
PrefixSet::from_iter(args.block),
args.allow,
args.block,
args.expose,
)
.context("failed to initialize proxy")?;