WIP: support peer MAC addresses in --allow/--block

To enable cross-VM communication.

.cargo/config.toml

@@ -0,0 +1,2 @@
+[target.aarch64-apple-darwin]
+runner = 'sudo -E'

.cirrus.yml

@@ -1,37 +1,60 @@
+use_compute_credits: true
+
+macos_instance:
+  image: ghcr.io/cirruslabs/macos-runner:tahoe
+
 env:
   PATH: "$PATH:$HOME/.cargo/bin"
 
 task:
-  name: Build
-  macos_instance:
-    image: ghcr.io/cirruslabs/macos-sonoma-xcode:latest
-  install_rust_script:
-    - curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
-    - rustup target add x86_64-apple-darwin
-  build_script:
-    - cargo build --target aarch64-apple-darwin --target x86_64-apple-darwin
+  name: Lint
+  install_rust_script: curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+  rustfmt_script: cargo fmt --check
+  clippy_script: cargo clippy --all-targets --all-features -- -D warnings
+
+task:
+  alias: Test
+  matrix:
+    - name: Test on macOS Sequoia
+      macos_instance:
+        image: ghcr.io/cirruslabs/macos-runner:sequoia
+    - name: Test on macOS Tahoe
+      macos_instance:
+        image: ghcr.io/cirruslabs/macos-runner:tahoe
+  install_rust_script: curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+  test_script: cargo test
+
+task:
+  name: Release (Dry Run)
+  only_if: $CIRRUS_TAG == ''
+  depends_on:
+    - Lint
+    - Test
+  install_rust_script: curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+  install_script: brew install go
+  install_goreleaser_script: brew install --cask goreleaser/tap/goreleaser-pro
+  build_script: goreleaser build --snapshot
+  goreleaser_artifacts:
+    path: "dist/**"
 
 task:
   name: Release
   only_if: $CIRRUS_TAG != ''
-  macos_instance:
-    image: ghcr.io/cirruslabs/macos-sonoma-xcode:latest
+  depends_on:
+    - Lint
+    - Test
   env:
     GITHUB_TOKEN: ENCRYPTED[!98ace8259c6024da912c14d5a3c5c6aac186890a8d4819fad78f3e0c41a4e0cd3a2537dd6e91493952fb056fa434be7c!]
     GORELEASER_KEY: ENCRYPTED[!9b80b6ef684ceaf40edd4c7af93014ee156c8aba7e6e5795f41c482729887b5c31f36b651491d790f1f668670888d9fd!]
     SENTRY_ORG: cirrus-labs
     SENTRY_PROJECT: persistent-workers
     SENTRY_AUTH_TOKEN: ENCRYPTED[!c16a5cf7da5f856b4bc2f21fe8cb7aa2a6c981f851c094ed4d3025fd02ea59a58a86cee8b193a69a1fc20fa217e56ac3!]
-  install_rust_script:
-    - curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
-    - rustup target add x86_64-apple-darwin
-  install_script:
-    - brew install go goreleaser/tap/goreleaser-pro getsentry/tools/sentry-cli
-  build_script:
-    - cargo build --target aarch64-apple-darwin --target x86_64-apple-darwin --profile release-with-debug
+  install_rust_script: curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+  install_script: brew install go getsentry/tools/sentry-cli
+  install_goreleaser_script: brew install --cask goreleaser/tap/goreleaser-pro
   release_script: goreleaser
   upload_sentry_debug_files_script:
-    - cd target/aarch64-apple-darwin/release-with-debug/
+    - cd target/aarch64-apple-darwin/release/
     # Generate and upload symbols
     - dsymutil softnet
     - sentry-cli debug-files upload -o $SENTRY_ORG -p $SENTRY_PROJECT softnet.dSYM/

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @edigaryev @fkorotkov

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: "cargo"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      all-updates:
+        patterns:
+          - "*"

.goreleaser.yml

@@ -1,26 +1,27 @@
+---
+version: 2
 project_name: softnet
 
 builds:
-  - id: softnet
-    builder: prebuilt
-    goamd64: [v1]
-    goos:
-      - darwin
-    goarch:
-      - arm64
-      - amd64
-    prebuilt:
-      path: 'target/{{- if eq .Arch "arm64" }}aarch64{{- else }}x86_64{{ end }}-apple-darwin/release-with-debug/softnet'
+  - builder: rust
+    command: build
+    targets:
+      - aarch64-apple-darwin
+      - x86_64-apple-darwin
+
+universal_binaries:
+  - replace: true
 
 archives:
-  - id: regular
-    name_template: "{{ .ProjectName }}-{{ .Arch }}"
+  - name_template: "{{ .ProjectName }}"
+    formats:
+      - tar.gz
 
 release:
   prerelease: auto
 
 brews:
-  - name: softnet
+  - name: "{{ .ProjectName }}"
     repository:
       owner: cirruslabs
       name: homebrew-cli
@@ -28,3 +29,5 @@ brews:
     homepage: https://github.com/cirruslabs/softnet
     description: Software networking with isolation for Tart
     skip_upload: auto
+    custom_block: |
+      depends_on :macos => :sequoia

Cargo.toml

@@ -2,7 +2,7 @@
 name = "softnet"
 version = "0.1.0"
 publish = false
-edition = "2021"
+edition = "2024"
 
 [lib]
 path = "lib/mod.rs"
@@ -15,8 +15,8 @@ debug = true
 smoltcp = "0"
 libc = "0"
 polling = "3"
-dhcproto = "0"
-vmnet = "0"
+dhcproto = { git = "https://github.com/bluecatengineering/dhcproto.git", branch = "master" }
+vmnet = "0.5.1"
 clap = { version = "4", features = ["derive"] }
 mac_address = "1"
 privdrop = "0"
@@ -27,6 +27,16 @@ system-configuration = "0"
 num_enum = "0"
 sentry = { version = "0", features = ["debug-images"] }
 sentry-anyhow = { version = "0", features = ["backtrace"] }
-nix = { version = "0", features = ["signal"] }
+nix = { version = "0", features = ["signal", "socket"] }
 prefix-trie = "0"
 ipnet = "2"
+oslog = "0.2.0"
+log = "0.4.29"
+serial_test = "3"
+coarsetime = "0.1.37"
+pnet_datalink = "0.35.0"
+pcap = "2.4.0"
+ipnetwork = "0.20"
+
+[profile.release]
+debug = true

README.md

@@ -1,6 +1,17 @@
 # Softnet
 
 Softnet is a software networking for [Tart](https://github.com/cirruslabs/tart) which provides better network isolation and alleviates DHCP shortage on production systems.
+
+It is essentially a userspace packet filter which restricts the VM networking and prevents a class of security issues, such as ARP spoofing. By default, the VM will only be able to:
+
+* send traffic from its own MAC-address
+* send traffic from the IP-address assigned to it by the DHCP
+* send traffic to globally routable IPv4 addresses
+* send traffic to gateway IP of the vmnet bridge (this would normally be \"bridge100\" interface)
+* receive any incoming traffic
+
+In addition, Softnet tunes macOS built-in DHCP server to decrease its lease time from the default 86,400 seconds (one day) to 600 seconds (10 minutes). This is especially important when you use Tart to clone and run a lot of ephemeral VMs over a period of one day.
+
 Please check out [this blog post](https://cirrus-ci.org/blog/2022/07/07/isolating-network-between-tarts-macos-virtual-machines/) for backstory.
 
 ## Working model

lib/dhcp_snooper.rs

@@ -1,15 +1,23 @@
-use dhcproto::v4::{DhcpOption, MessageType, OptionCode};
 use dhcproto::Decodable;
+use dhcproto::v4::{DhcpOption, MessageType, OptionCode};
 use smoltcp::wire::Ipv4Address;
 use std::collections::HashSet;
-use std::time::{Duration, Instant};
+use std::time::Duration;
 
 #[derive(Default)]
 pub struct DhcpSnooper {
     vm_lease: Option<Lease>,
+    uncertainty_duration: Duration,
 }
 
 impl DhcpSnooper {
+    pub fn new(uncertainty_duration: Duration) -> Self {
+        DhcpSnooper {
+            uncertainty_duration,
+            ..Default::default()
+        }
+    }
+
     pub fn register_dhcp_reply(&mut self, dhcp_packet: &[u8]) {
         let mut decoder = dhcproto::v4::Decoder::new(dhcp_packet);
 
@@ -26,17 +34,18 @@ impl DhcpSnooper {
                 };
 
                 let dns_ips = match message.opts().get(OptionCode::DomainNameServer) {
-                    Some(DhcpOption::DomainNameServer(dns_ips)) => HashSet::from_iter(
-                        dns_ips.iter().map(|dns_ip| Ipv4Address(dns_ip.octets())),
-                    ),
+                    Some(DhcpOption::DomainNameServer(dns_ips)) => {
+                        HashSet::from_iter(dns_ips.iter().cloned())
+                    }
                     _ => HashSet::new(),
                 };
 
-                self.vm_lease = Some(Lease::new(
-                    message.yiaddr().into(),
-                    Duration::from_secs(*lease_time as u64),
-                    dns_ips,
-                ))
+                let mut lease_duration = Duration::from_secs(*lease_time as u64);
+
+                // Adjust for uncertainty caused by using a coarse clock
+                lease_duration = lease_duration.saturating_sub(self.uncertainty_duration);
+
+                self.vm_lease = Some(Lease::new(message.yiaddr(), lease_duration, dns_ips))
             }
             Some(MessageType::Nak) => {
                 self.vm_lease = None;
@@ -45,6 +54,11 @@ impl DhcpSnooper {
         };
     }
 
+    #[cfg(test)]
+    pub(crate) fn set_lease(&mut self, vm_lease: Option<Lease>) {
+        self.vm_lease = vm_lease
+    }
+
     pub fn lease(&self) -> &Option<Lease> {
         &self.vm_lease
     }
@@ -58,22 +72,31 @@ impl DhcpSnooper {
     }
 }
 
+#[derive(Debug)]
 pub struct Lease {
     address: Ipv4Address,
-    valid_until: Instant,
+    valid_until: coarsetime::Instant,
     dns_ips: HashSet<Ipv4Address>,
 }
 
 impl Lease {
-    fn new(address: Ipv4Address, lease_time: Duration, dns_ips: HashSet<Ipv4Address>) -> Lease {
+    pub fn new(address: Ipv4Address, lease_time: Duration, dns_ips: HashSet<Ipv4Address>) -> Lease {
         Lease {
             address,
-            valid_until: Instant::now() + lease_time,
+            valid_until: coarsetime::Instant::recent() + lease_time.into(),
             dns_ips,
         }
     }
 
+    pub fn address(&self) -> Ipv4Address {
+        self.address
+    }
+
+    pub fn valid(&self) -> bool {
+        coarsetime::Instant::recent() < self.valid_until
+    }
+
     pub fn valid_ip_source(&self, address: Ipv4Address) -> bool {
-        self.address == address && Instant::now() < self.valid_until
+        self.address == address && self.valid()
     }
 }

lib/dhcp_snooper_global.rs

@@ -0,0 +1,210 @@
+use crate::dhcp_snooper::Lease;
+use anyhow::{Context, Result, anyhow};
+use dhcproto::Decodable;
+use dhcproto::v4::{DhcpOption, MessageType, Opcode, OptionCode};
+use smoltcp::wire::{
+    EthernetFrame, EthernetProtocol, IpProtocol, Ipv4Address, Ipv4Packet, UdpPacket,
+};
+use std::collections::HashMap;
+use std::os::unix::io::RawFd;
+use std::time::{Duration, Instant};
+
+const TABLE_PRINT_INTERVAL: Duration = Duration::from_secs(5);
+
+unsafe extern "C" {
+    fn pcap_get_selectable_fd(pcap: *mut libc::c_void) -> libc::c_int;
+}
+
+#[derive(Default)]
+pub struct DhcpSnooperGlobal {
+    pcap_capture: Option<pcap::Capture<pcap::Active>>,
+    pcap_fd: Option<RawFd>,
+    leases_by_mac: HashMap<[u8; 6], Lease>,
+    uncertainty_duration: Duration,
+    last_table_print: Option<Instant>,
+}
+
+impl DhcpSnooperGlobal {
+    pub fn new(gateway_interface_name: &str, uncertainty_duration: Duration) -> Result<Self> {
+        // Start capturing packets on bridge interface in promiscuous mode.
+        let mut pcap_capture = pcap::Capture::from_device(gateway_interface_name)?
+            .promisc(true)
+            .timeout(1)
+            .immediate_mode(true)
+            .open()?;
+
+        // Capture packets using a filter to avoid wasting CPU cycles in user-space.
+        pcap_capture
+            .filter("udp and (port 67 or port 68)", true)
+            .context("failed to install DHCP pcap filter")?;
+
+        // Prepare packet capture for event-driven consumption.
+        let pcap_capture = pcap_capture.setnonblock()?;
+        let pcap_fd = unsafe { pcap_get_selectable_fd(pcap_capture.as_ptr().cast()) };
+        if pcap_fd == -1 {
+            return Err(anyhow!("failed to call pcap_get_selectable_fd(3)"));
+        }
+
+        Ok(DhcpSnooperGlobal {
+            pcap_capture: Some(pcap_capture),
+            pcap_fd: Some(pcap_fd),
+            uncertainty_duration,
+            ..Default::default()
+        })
+    }
+
+    pub fn disabled(uncertainty_duration: Duration) -> Self {
+        DhcpSnooperGlobal {
+            uncertainty_duration,
+            ..Default::default()
+        }
+    }
+
+    pub fn pcap_raw_fd(&self) -> Option<RawFd> {
+        self.pcap_fd
+    }
+
+    pub fn read_pcap(&mut self, mut handle_packet: impl FnMut(&mut Self, &[u8])) -> Result<()> {
+        let Some(mut pcap_capture) = self.pcap_capture.take() else {
+            return Ok(());
+        };
+
+        let result = loop {
+            match pcap_capture.next_packet() {
+                Ok(packet) => handle_packet(self, packet.data),
+                Err(pcap::Error::TimeoutExpired) => break Ok(()),
+                Err(err) => break Err(err.into()),
+            }
+        };
+
+        self.pcap_capture = Some(pcap_capture);
+        result
+    }
+
+    pub fn register_ethernet_packet(&mut self, packet: &[u8]) {
+        Self::register_ethernet_packet_with(
+            &mut self.leases_by_mac,
+            self.uncertainty_duration,
+            packet,
+        );
+    }
+
+    fn register_ethernet_packet_with(
+        leases_by_mac: &mut HashMap<[u8; 6], Lease>,
+        uncertainty_duration: Duration,
+        packet: &[u8],
+    ) {
+        let Some(dhcp_packet) = Self::dhcp_payload(packet) else {
+            return;
+        };
+
+        let mut decoder = dhcproto::v4::Decoder::new(dhcp_packet);
+        let message = match dhcproto::v4::Message::decode(&mut decoder) {
+            Ok(message) => message,
+            Err(_) => return,
+        };
+
+        println!("{message}");
+
+        let Some(mac) = Self::message_mac(&message) else {
+            return;
+        };
+
+        match message.opts().msg_type() {
+            Some(MessageType::Ack) => {
+                let lease_time = match message.opts().get(OptionCode::AddressLeaseTime) {
+                    Some(DhcpOption::AddressLeaseTime(lease_time)) => *lease_time,
+                    _ => 600,
+                };
+                let mut lease_duration = Duration::from_secs(lease_time as u64);
+                lease_duration = lease_duration.saturating_sub(uncertainty_duration);
+
+                leases_by_mac.insert(
+                    mac,
+                    Lease::new(message.yiaddr(), lease_duration, Default::default()),
+                );
+
+                println!(
+                    "DHCP global lease learned: {} -> {}",
+                    Self::format_mac(&mac),
+                    message.yiaddr()
+                );
+            }
+            Some(MessageType::Nak) => {
+                leases_by_mac.remove(&mac);
+                println!("DHCP global lease removed: {}", Self::format_mac(&mac));
+            }
+            _ => {}
+        }
+    }
+
+    pub fn print_table_periodically(&mut self) {
+        let now = Instant::now();
+        if self
+            .last_table_print
+            .is_some_and(|last_print| now.duration_since(last_print) < TABLE_PRINT_INTERVAL)
+        {
+            return;
+        }
+        self.last_table_print = Some(now);
+
+        self.print_table();
+    }
+
+    pub fn valid_ip_for_mac(&self, mac: &[u8; 6], ip: Ipv4Address) -> bool {
+        self.leases_by_mac
+            .get(mac)
+            .is_some_and(|lease| lease.valid_ip_source(ip))
+    }
+
+    fn print_table(&self) {
+        if self.leases_by_mac.is_empty() {
+            println!("DHCP global leases: <empty>");
+            return;
+        }
+
+        println!("DHCP global leases:");
+        for (mac, lease) in &self.leases_by_mac {
+            let state = if lease.valid() { "valid" } else { "expired" };
+            println!(
+                "  {} -> {} ({state})",
+                Self::format_mac(mac),
+                lease.address()
+            );
+        }
+    }
+
+    fn dhcp_payload(packet: &[u8]) -> Option<&[u8]> {
+        let frame = EthernetFrame::new_checked(packet).ok()?;
+        if frame.ethertype() != EthernetProtocol::Ipv4 {
+            return None;
+        }
+
+        let ipv4_packet = Ipv4Packet::new_checked(frame.payload()).ok()?;
+        if ipv4_packet.next_header() != IpProtocol::Udp {
+            return None;
+        }
+
+        let udp_packet = UdpPacket::new_checked(ipv4_packet.payload()).ok()?;
+        if !matches!(udp_packet.src_port(), 67 | 68) && !matches!(udp_packet.dst_port(), 67 | 68) {
+            return None;
+        }
+
+        Some(udp_packet.payload())
+    }
+
+    fn message_mac(message: &dhcproto::v4::Message) -> Option<[u8; 6]> {
+        if message.opcode() != Opcode::BootReply {
+            return None;
+        }
+
+        message.chaddr().try_into().ok()
+    }
+
+    fn format_mac(mac: &[u8; 6]) -> String {
+        mac.iter()
+            .map(|octet| format!("{octet:02x}"))
+            .collect::<Vec<_>>()
+            .join(":")
+    }
+}

lib/host.rs

@@ -1,13 +1,18 @@
-use anyhow::{anyhow, Context, Result};
+use anyhow::{Context, Result, anyhow};
 use clap::ValueEnum;
+use ipnetwork::{IpNetwork, Ipv4Network};
+use log::info;
+use pnet_datalink::MacAddr;
+use smoltcp::wire::EthernetAddress;
 use std::net::Ipv4Addr;
 use std::os::unix::io::{AsRawFd, RawFd};
 use std::os::unix::net::UnixDatagram;
 use std::str::FromStr;
-use std::sync::mpsc::{sync_channel, SyncSender};
+use std::sync::mpsc::{SyncSender, sync_channel};
 use vmnet::mode::Mode;
 use vmnet::parameters::{Parameter, ParameterKind};
-use vmnet::{Events, Options};
+use vmnet::port_forwarding::{AddressFamily, Protocol};
+use vmnet::{Batch, Events, Options};
 
 #[derive(ValueEnum, Clone, Debug)]
 pub enum NetType {
@@ -25,8 +30,11 @@ pub struct Host {
     interface: vmnet::Interface,
     new_packets_rx: UnixDatagram,
     callback_can_continue_tx: SyncSender<()>,
+    pub gateway_interface_name: String,
     pub gateway_ip: smoltcp::wire::Ipv4Address,
+    pub gateway_mac: EthernetAddress,
     pub max_packet_size: u64,
+    pub read_max_packets: u64,
     finalized: bool,
 }
 
@@ -45,17 +53,38 @@ impl Host {
         )
         .context("failed to initialize vmnet interface")?;
 
-        // Retrieve first IP (gateway) used for this interface
-        let Some(Parameter::StartAddress(gateway_ip)) =
+        // Retrieve the first IP (gateway) used for this interface
+        let Some(Parameter::StartAddress(start_address)) =
             interface.parameters().get(ParameterKind::StartAddress)
         else {
             return Err(anyhow!(
                 "failed to retrieve vmnet's interface start address"
             ));
         };
-        let gateway_ip = Ipv4Addr::from_str(&gateway_ip)
+        let start_address = Ipv4Addr::from_str(&start_address)
             .context("failed to parse vmnet's interface start address")?;
 
+        // Retrieve the last IP used for this interface
+        let Some(Parameter::EndAddress(end_address)) =
+            interface.parameters().get(ParameterKind::EndAddress)
+        else {
+            return Err(anyhow!("failed to retrieve vmnet's interface end address"));
+        };
+        let end_address = Ipv4Addr::from_str(&end_address)
+            .context("failed to parse vmnet's interface end address")?;
+
+        // Determine the prefix used for this interface
+        let prefix = Self::ipv4_range_prefix(start_address, end_address);
+
+        let Some((gateway_name, gateway_mac)) = Self::interface_ip_to_mac(start_address, prefix)
+        else {
+            return Err(anyhow!(
+                "failed to resolve vmnet's interface from start address {}",
+                start_address
+            ));
+        };
+        let gateway_mac = EthernetAddress(gateway_mac.octets());
+
         // Retrieve max packet size for this interface
         let Some(Parameter::MaxPacketSize(max_packet_size)) =
             interface.parameters().get(ParameterKind::MaxPacketSize)
@@ -65,6 +94,15 @@ impl Host {
             ));
         };
 
+        // Retrieve read max packets for this interface
+        let Some(Parameter::ReadMaxPackets(read_max_packets)) =
+            interface.parameters().get(ParameterKind::ReadMaxPackets)
+        else {
+            return Err(anyhow!(
+                "failed to retrieve vmnet's interface read max packets"
+            ));
+        };
+
         // Set up a socketpair() to emulate polling of the vmnet interface
         let (new_packets_tx, new_packets_rx) = UnixDatagram::pair()?;
         new_packets_rx.set_nonblocking(true)?;
@@ -92,22 +130,74 @@ impl Host {
             interface,
             new_packets_rx,
             callback_can_continue_tx,
-            gateway_ip: gateway_ip.into(),
+            gateway_interface_name: gateway_name,
+            gateway_ip: start_address,
+            gateway_mac,
             max_packet_size,
+            read_max_packets,
             finalized: false,
         })
     }
+
+    fn interface_ip_to_mac(ip: Ipv4Addr, prefix: u8) -> Option<(String, MacAddr)> {
+        let ip_network = IpNetwork::V4(Ipv4Network::new(ip, prefix).unwrap());
+
+        for iface in pnet_datalink::interfaces() {
+            if iface.ips.contains(&ip_network)
+                && let Some(mac) = iface.mac
+            {
+                return Some((iface.name, mac));
+            }
+        }
+
+        None
+    }
+
+    fn ipv4_range_prefix(start_address: Ipv4Addr, end_address: Ipv4Addr) -> u8 {
+        (u32::from(start_address) ^ u32::from(end_address)).leading_zeros() as u8
+    }
 }
 
 impl Host {
-    pub fn read(&mut self, buf: &mut [u8]) -> vmnet::Result<usize> {
+    pub fn port_forwarding_add_rule(
+        &mut self,
+        external_port: u16,
+        internal_addr: Ipv4Addr,
+        internal_port: u16,
+    ) -> Result<()> {
+        let details = format!(
+            "external_port={external_port}, internal_addr={internal_addr}, internal_port={internal_port}"
+        );
+
+        self.interface
+            .port_forwarding_rule_add(
+                AddressFamily::Ipv4,
+                Protocol::Tcp,
+                external_port,
+                internal_addr.into(),
+                internal_port,
+            )
+            .map(|_| info!("added port forwarding rule {details}"))
+            .map_err(|err| anyhow!("failed to add port forwarding rule {details}: {err}"))
+    }
+
+    pub fn port_forwarding_remove_rule(&mut self, external_port: u16) -> Result<()> {
+        let details = format!("external_port={external_port}");
+
+        self.interface
+            .port_forwarding_rule_remove(AddressFamily::Ipv4, Protocol::Tcp, external_port)
+            .map(|_| info!("removed port forwarding rule {details}"))
+            .map_err(|err| anyhow!("failed to remove port forwarding rule {details}: {err}"))
+    }
+
+    pub fn read(&mut self, batch: &mut Batch, bufs: &mut [Vec<u8>]) -> vmnet::Result<usize> {
         // Dequeue dummy datagram from the socket (if any)
         // to free up buffer space and reduce false-positives
         // when polling
         let mut buf_to_be_discarded: [u8; 1] = [0; 1];
         let _ = self.new_packets_rx.recv(&mut buf_to_be_discarded);
 
-        let result = self.interface.read(buf);
+        let result = self.interface.read_batch(batch, bufs);
 
         if let Err(vmnet::Error::VmnetReadNothing) = result {
             // We've emptied everything, unlock the callback
@@ -154,3 +244,28 @@ impl AsRawFd for Host {
         self.new_packets_rx.as_raw_fd()
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::Host;
+    use std::net::Ipv4Addr;
+
+    #[test]
+    fn ipv4_range_prefix_for_vmnet_class_c_range() {
+        assert_eq!(
+            Host::ipv4_range_prefix(
+                Ipv4Addr::new(192, 168, 64, 1),
+                Ipv4Addr::new(192, 168, 64, 254),
+            ),
+            24
+        );
+    }
+
+    #[test]
+    fn ipv4_range_prefix_for_single_address() {
+        assert_eq!(
+            Host::ipv4_range_prefix(Ipv4Addr::new(10, 0, 0, 1), Ipv4Addr::new(10, 0, 0, 1)),
+            32
+        );
+    }
+}

lib/mod.rs

@@ -1,4 +1,5 @@
 mod dhcp_snooper;
+mod dhcp_snooper_global;
 mod host;
 pub use host::NetType;
 mod poller;

lib/poller.rs

@@ -1,7 +1,7 @@
 use anyhow::Result;
 use num_enum::IntoPrimitive;
-use polling::os::kqueue::PollerKqueueExt;
 use polling::PollMode;
+use polling::os::kqueue::PollerKqueueExt;
 use std::os::fd::{AsRawFd, BorrowedFd};
 use std::os::unix::io::RawFd;
 use std::time::Duration;
@@ -9,8 +9,10 @@ use std::time::Duration;
 pub struct Poller<'poller> {
     poller: polling::Poller,
     events: polling::Events,
+    timeout: Duration,
     vm_fd: BorrowedFd<'poller>,
     host_fd: BorrowedFd<'poller>,
+    pcap_fd: Option<BorrowedFd<'poller>>,
 }
 
 #[derive(IntoPrimitive)]
@@ -18,60 +20,70 @@ pub struct Poller<'poller> {
 enum EventKey {
     VM,
     Host,
+    Pcap,
     Interrupt,
 }
 
+pub struct Readiness {
+    pub vm_readable: bool,
+    pub host_readable: bool,
+    pub pcap_readable: bool,
+    pub interrupt: bool,
+}
+
 impl Poller<'_> {
-    pub fn new<'poller>(vm_fd: RawFd, host_fd: RawFd) -> Result<Poller<'poller>> {
+    pub fn new<'poller>(
+        vm_fd: RawFd,
+        host_fd: RawFd,
+        pcap_fd: Option<RawFd>,
+        timeout: Duration,
+    ) -> Result<Poller<'poller>> {
         let poller = polling::Poller::new()?;
 
         Ok(Poller {
             poller,
             events: polling::Events::new(),
+            timeout,
             vm_fd: unsafe { BorrowedFd::borrow_raw(vm_fd) },
             host_fd: unsafe { BorrowedFd::borrow_raw(host_fd) },
+            pcap_fd: pcap_fd.map(|fd| unsafe { BorrowedFd::borrow_raw(fd) }),
         })
     }
 
     pub fn arm(&self) -> Result<()> {
         unsafe {
-            self.poller
-                .add(self.vm_fd.as_raw_fd(), self.vm_interest())?;
-            self.poller
-                .add(self.host_fd.as_raw_fd(), self.host_interest())?;
+            self.poller.add_with_mode(
+                self.vm_fd.as_raw_fd(),
+                self.vm_interest(),
+                PollMode::Edge,
+            )?;
+            self.poller.add_with_mode(
+                self.host_fd.as_raw_fd(),
+                self.host_interest(),
+                PollMode::Edge,
+            )?;
+            if let Some(pcap_fd) = self.pcap_fd {
+                self.poller.add_with_mode(
+                    pcap_fd.as_raw_fd(),
+                    self.pcap_interest(),
+                    PollMode::Edge,
+                )?;
+            }
         }
 
         let interrupt_signal = polling::os::kqueue::Signal(libc::SIGINT);
         self.poller
-            .add_filter(
-                interrupt_signal,
-                EventKey::Interrupt.into(),
-                PollMode::Oneshot,
-            )
-            .unwrap();
+            .add_filter(interrupt_signal, EventKey::Interrupt.into(), PollMode::Edge)?;
 
         Ok(())
     }
 
-    pub fn rearm(&mut self) -> Result<()> {
+    pub fn rearm(&mut self) {
         self.events.clear();
-
-        self.poller.modify(self.vm_fd, self.vm_interest())?;
-        self.poller.modify(self.host_fd, self.host_interest())?;
-
-        let interrupt_signal = polling::os::kqueue::Signal(libc::SIGINT);
-        self.poller.modify_filter(
-            interrupt_signal,
-            EventKey::Interrupt.into(),
-            PollMode::Oneshot,
-        )?;
-
-        Ok(())
     }
 
-    pub fn wait(&mut self) -> Result<(bool, bool, bool)> {
-        self.poller
-            .wait(&mut self.events, Some(Duration::from_millis(100)))?;
+    pub fn wait(&mut self) -> Result<Readiness> {
+        self.poller.wait(&mut self.events, Some(self.timeout))?;
 
         let vm_readable = self
             .events
@@ -81,12 +93,21 @@ impl Poller<'_> {
             .events
             .iter()
             .any(|ev| ev.key == Into::<usize>::into(EventKey::Host));
+        let pcap_readable = self
+            .events
+            .iter()
+            .any(|ev| ev.key == Into::<usize>::into(EventKey::Pcap));
         let interrupt = self
             .events
             .iter()
             .any(|ev| ev.key == Into::<usize>::into(EventKey::Interrupt));
 
-        Ok((vm_readable, host_readable, interrupt))
+        Ok(Readiness {
+            vm_readable,
+            host_readable,
+            pcap_readable,
+            interrupt,
+        })
     }
 
     fn vm_interest(&self) -> polling::Event {
@@ -96,4 +117,8 @@ impl Poller<'_> {
     fn host_interest(&self) -> polling::Event {
         polling::Event::readable(EventKey::Host.into())
     }
+
+    fn pcap_interest(&self) -> polling::Event {
+        polling::Event::readable(EventKey::Pcap.into())
+    }
 }

lib/proxy/exposed_port.rs

@@ -0,0 +1,47 @@
+use anyhow::{Context, Error, anyhow};
+use std::str::FromStr;
+
+#[derive(Debug, Clone, Copy, Default, PartialEq)]
+pub struct ExposedPort {
+    pub external_port: u16,
+    pub internal_port: u16,
+}
+
+impl FromStr for ExposedPort {
+    type Err = Error;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        let splits: Vec<&str> = s.split(':').collect();
+
+        match splits.len() {
+            2 => Ok(ExposedPort {
+                external_port: splits[0]
+                    .parse()
+                    .context(format!("invalid external port {:?}", splits[0]))?,
+                internal_port: splits[1]
+                    .parse()
+                    .context(format!("invalid internal port {:?}", splits[1]))?,
+            }),
+            _ => Err(anyhow!(
+                "invalid exposed port specification {:?}, the format should be EXTERNAL:INTERNAL",
+                s
+            )),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::proxy::exposed_port::ExposedPort;
+
+    #[test]
+    fn exposed_port() {
+        assert_eq!(
+            ExposedPort {
+                external_port: 2222,
+                internal_port: 22
+            },
+            "2222:22".parse().unwrap()
+        );
+    }
+}

lib/proxy/host.rs

@@ -1,5 +1,5 @@
-use crate::proxy::udp_packet_helper::UdpPacketHelper;
 use crate::proxy::Proxy;
+use crate::proxy::udp_packet_helper::UdpPacketHelper;
 use anyhow::{Context, Result};
 use smoltcp::wire::{EthernetFrame, EthernetProtocol, Ipv4Packet, UdpPacket};
 
@@ -37,6 +37,29 @@ impl Proxy<'_> {
     }
 
     fn allowed_from_host(&mut self, frame: &EthernetFrame<&[u8]>) -> Option<()> {
+        // let mac = frame
+        //     .src_addr()
+        //     .as_bytes()
+        //     .iter()
+        //     .map(|b| format!("{:02x}", b))
+        //     .collect::<Vec<_>>()
+        //     .join(":");
+        //
+        // println!("{}", mac);
+
+        let from_gateway = frame.src_addr() == self.host.gateway_mac;
+        let peer_action = self.rules_mac.get(frame.src_addr().as_bytes());
+        let from_allowed_peer = peer_action == Some(&crate::proxy::Action::Allow);
+
+        if !from_gateway && !from_allowed_peer {
+            println!("dropping packet from {}", frame.src_addr());
+            return None;
+        }
+
+        if from_allowed_peer {
+            println!("allowing packet from peer {}", frame.src_addr());
+        }
+
         match frame.ethertype() {
             EthernetProtocol::Arp => Some(()),
             EthernetProtocol::Ipv4 => Some(()),
@@ -45,6 +68,8 @@ impl Proxy<'_> {
     }
 
     fn snoop(&mut self, frame: &EthernetFrame<&[u8]>) {
+        // TODO: resolve IPs for the MAC addresses from --allow/--block too
+
         if frame.ethertype() != EthernetProtocol::Ipv4 {
             return;
         }

lib/proxy/mod.rs

@@ -1,19 +1,28 @@
+mod exposed_port;
 mod host;
+mod port_forwarder;
 mod udp_packet_helper;
 mod vm;
 
 use crate::dhcp_snooper::DhcpSnooper;
+use crate::dhcp_snooper_global::DhcpSnooperGlobal;
 use crate::host::Host;
 use crate::host::NetType;
 use crate::poller::Poller;
 use crate::vm::VM;
 use anyhow::Result;
+pub use exposed_port::ExposedPort;
 use ipnet::Ipv4Net;
 use mac_address::MacAddress;
-use prefix_trie::{Prefix, PrefixSet};
+use port_forwarder::PortForwarder;
+use prefix_trie::{Prefix, PrefixMap};
 use smoltcp::wire::EthernetFrame;
+use std::collections::HashMap;
 use std::io::ErrorKind;
 use std::os::unix::io::{AsRawFd, RawFd};
+use std::str::FromStr;
+use std::time::Duration;
+use vmnet::Batch;
 
 pub struct Proxy<'proxy> {
     vm: VM,
@@ -21,8 +30,40 @@ pub struct Proxy<'proxy> {
     poller: Poller<'proxy>,
     vm_mac_address: smoltcp::wire::EthernetAddress,
     dhcp_snooper: DhcpSnooper,
-    allow: PrefixSet<Ipv4Net>,
+    dhcp_snooper_global: DhcpSnooperGlobal,
+    rules: PrefixMap<Ipv4Net, Action>,
+    rules_mac: HashMap<[u8; 6], Action>,
     enobufs_encountered: bool,
+    port_forwarder: PortForwarder,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum Target {
+    Prefix(Ipv4Net),
+    MacAddress(MacAddress),
+    Host,
+}
+
+impl FromStr for Target {
+    type Err = ipnet::AddrParseError;
+
+    fn from_str(s: &str) -> std::result::Result<Self, Self::Err> {
+        if s == "@host" {
+            return Ok(Target::Host);
+        }
+
+        if let Ok(mac_address) = MacAddress::from_str(s) {
+            return Ok(Target::MacAddress(mac_address));
+        }
+
+        Ipv4Net::from_str(s).map(Target::Prefix)
+    }
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub(crate) enum Action {
+    Block,
+    Allow,
 }
 
 impl Proxy<'_> {
@@ -30,45 +71,130 @@ impl Proxy<'_> {
         vm_fd: RawFd,
         vm_mac_address: MacAddress,
         vm_net_type: NetType,
-        allow: PrefixSet<Ipv4Net>,
+        allow: Vec<Target>,
+        block: Vec<Target>,
+        exposed_ports: Vec<ExposedPort>,
     ) -> Result<Proxy<'proxy>> {
+        let allowing_all_ipv4 = allow.contains(&Target::Prefix(Ipv4Net::zero()));
+        let using_mac_filtering = allow
+            .iter()
+            .chain(block.iter())
+            .any(|target| matches!(target, Target::MacAddress(_)));
+        let enable_isolation = !allowing_all_ipv4 && !using_mac_filtering;
+
         let vm = VM::new(vm_fd)?;
-        let host = Host::new(vm_net_type, !allow.contains(&Ipv4Net::zero()))?;
-        let poller = Poller::new(vm.as_raw_fd(), host.as_raw_fd())?;
+        let host = Host::new(vm_net_type, enable_isolation)?;
+        let poller_timeout = Duration::from_millis(100);
+        let dhcp_snooper_global = if using_mac_filtering {
+            DhcpSnooperGlobal::new(&host.gateway_interface_name, poller_timeout)?
+        } else {
+            DhcpSnooperGlobal::disabled(poller_timeout)
+        };
+        let poller = Poller::new(
+            vm.as_raw_fd(),
+            host.as_raw_fd(),
+            dhcp_snooper_global.pcap_raw_fd(),
+            poller_timeout,
+        )?;
+
+        // Craft packet filter rules
+        //
+        // SECURITY: blocking rules must always take precedence
+        // over allowing rules when prefixes are identical.
+        let mut rules = PrefixMap::new();
+        let mut rules_mac = HashMap::new();
+
+        for allow_target in allow {
+            let allow_prefix = match allow_target {
+                Target::Prefix(prefix) => prefix,
+                Target::Host => host.gateway_ip.into(),
+                Target::MacAddress(mac_address) => {
+                    rules_mac.insert(mac_address.bytes(), Action::Allow);
+
+                    continue;
+                }
+            };
+
+            rules.insert(allow_prefix, Action::Allow);
+        }
+
+        for block_target in block {
+            let block_prefix = match block_target {
+                Target::Prefix(prefix) => prefix,
+                Target::Host => host.gateway_ip.into(),
+                Target::MacAddress(mac_address) => {
+                    rules_mac.insert(mac_address.bytes(), Action::Block);
+
+                    continue;
+                }
+            };
+
+            rules.insert(block_prefix, Action::Block);
+        }
 
         Ok(Proxy {
             vm,
             host,
             poller,
             vm_mac_address: smoltcp::wire::EthernetAddress(vm_mac_address.bytes()),
-            dhcp_snooper: Default::default(),
-            allow,
+            dhcp_snooper: DhcpSnooper::new(poller_timeout),
+            dhcp_snooper_global,
+            rules,
+            rules_mac,
             enobufs_encountered: false,
+            port_forwarder: PortForwarder::new(exposed_ports),
         })
     }
 
     pub fn run(&mut self) -> Result<()> {
+        // Create a single buffer from reading from the VM
         let mut buf: Vec<u8> = vec![0; self.host.max_packet_size as usize];
 
+        // Create multiple buffers and a batch for reading from the host
+        let mut bufs = vec![
+            vec![0u8; self.host.max_packet_size as usize];
+            self.host.read_max_packets as usize
+        ];
+        let mut batch = Batch::preallocate(bufs.len());
+
         self.poller.arm()?;
 
         loop {
-            let (vm_readable, host_readable, interrupt) = self.poller.wait()?;
+            let readiness = self.poller.wait()?;
 
-            if vm_readable {
+            // Update coarse time for the DHCP snooper
+            coarsetime::Instant::update();
+
+            if readiness.vm_readable {
                 self.read_from_vm(buf.as_mut_slice())?;
             }
 
-            if host_readable {
-                self.read_from_host(buf.as_mut_slice())?;
+            if readiness.host_readable {
+                self.read_from_host(&mut batch, &mut bufs)?;
             }
 
+            if readiness.pcap_readable {
+                self.dhcp_snooper_global
+                    .read_pcap(|snooper, packet| snooper.register_ethernet_packet(packet))?;
+            }
+            self.dhcp_snooper_global.print_table_periodically();
+
             // Graceful termination
-            if interrupt {
+            if readiness.interrupt {
                 return Ok(());
             }
 
-            self.poller.rearm()?;
+            // Timeout
+            if !readiness.vm_readable
+                && !readiness.host_readable
+                && !readiness.pcap_readable
+                && !readiness.interrupt
+            {
+                self.port_forwarder
+                    .tick(&mut self.host, self.dhcp_snooper.lease());
+            }
+
+            self.poller.rearm();
         }
     }
 
@@ -76,6 +202,9 @@ impl Proxy<'_> {
         loop {
             match self.vm.read(buf) {
                 Ok(n) => {
+                    // Update coarse time for the DHCP snooper
+                    coarsetime::Instant::update();
+
                     if let Ok(frame) = EthernetFrame::new_checked(&buf[..n]) {
                         self.process_frame_from_vm(frame)?;
                     }
@@ -91,12 +220,17 @@ impl Proxy<'_> {
         }
     }
 
-    fn read_from_host(&mut self, buf: &mut [u8]) -> Result<()> {
+    fn read_from_host(&mut self, batch: &mut Batch, bufs: &mut [Vec<u8>]) -> Result<()> {
         loop {
-            match self.host.read(buf) {
-                Ok(n) => {
-                    if let Ok(pkt) = EthernetFrame::new_checked(&buf[..n]) {
-                        self.process_frame_from_host(&pkt)?;
+            match self.host.read(batch, bufs) {
+                Ok(pktcnt) => {
+                    // Update coarse time for the DHCP snooper
+                    coarsetime::Instant::update();
+
+                    for buf in batch.packet_sized_bufs(bufs).take(pktcnt) {
+                        if let Ok(pkt) = EthernetFrame::new_checked(buf) {
+                            self.process_frame_from_host(&pkt)?;
+                        }
                     }
                 }
                 Err(err) => {
@@ -110,3 +244,124 @@ impl Proxy<'_> {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use crate::NetType;
+    use crate::dhcp_snooper::Lease;
+    use crate::proxy::{Action, Proxy};
+    use ipnet::Ipv4Net;
+    use mac_address::MacAddress;
+    use nix::sys::socket::{AddressFamily, SockFlag, SockType, socketpair};
+    use prefix_trie::PrefixMap;
+    use serial_test::serial;
+    use smoltcp::wire::{Ipv4Address, Ipv4Packet};
+    use std::collections::HashSet;
+    use std::os::fd::AsRawFd;
+    use std::str::FromStr;
+    use std::time::Duration;
+
+    #[test]
+    #[serial]
+    fn test_blocking_takes_precedence() {
+        let vm_ip = Ipv4Address::from_str("192.168.0.2").unwrap();
+        let proxy = create_proxy(vm_ip, vec!["66.66.0.0/16"], vec!["66.66.0.0/16"]);
+
+        assert_eq!(
+            proxy.rules,
+            PrefixMap::<Ipv4Net, Action>::from_iter(vec![(
+                Ipv4Net::from_str("66.66.0.0/16").unwrap(),
+                Action::Block
+            ),])
+        );
+
+        assert!(allowed_from_vm_ipv4(&proxy, vm_ip, "66.66.66.66").is_none());
+    }
+
+    #[test]
+    #[serial]
+    fn test_longest_prefix_match_wins() {
+        let vm_ip = Ipv4Address::from_str("192.168.0.2").unwrap();
+        let proxy = create_proxy(vm_ip, vec!["33.33.33.33/32"], vec!["33.33.33.0/24"]);
+
+        assert_eq!(
+            proxy.rules,
+            PrefixMap::<Ipv4Net, Action>::from_iter(vec![
+                (Ipv4Net::from_str("33.33.33.33/32").unwrap(), Action::Allow),
+                (Ipv4Net::from_str("33.33.33.0/24").unwrap(), Action::Block),
+            ])
+        );
+
+        assert!(allowed_from_vm_ipv4(&proxy, vm_ip, "33.33.33.32").is_none());
+        assert!(allowed_from_vm_ipv4(&proxy, vm_ip, "33.33.33.33").is_some());
+        assert!(allowed_from_vm_ipv4(&proxy, vm_ip, "33.33.33.34").is_none());
+    }
+
+    #[test]
+    #[serial]
+    fn test_allow_host() {
+        let vm_ip = Ipv4Address::from_str("192.168.0.2").unwrap();
+        let proxy = create_proxy(vm_ip, vec!["@host"], vec!["0.0.0.0/0"]);
+
+        assert_eq!(
+            proxy.rules,
+            PrefixMap::from_iter(vec![
+                (proxy.host.gateway_ip.into(), Action::Allow),
+                (Ipv4Net::from_str("0.0.0.0/0").unwrap(), Action::Block),
+            ])
+        );
+
+        // Access to global IPs should be disallowed because of --block=0.0.0.0/0
+        assert!(allowed_from_vm_ipv4(&proxy, vm_ip, "8.8.8.8").is_none());
+
+        // Despite the above, access to host IP address should be possible because of --allow=@host
+        assert!(allowed_from_vm_ipv4(&proxy, vm_ip, &proxy.host.gateway_ip.to_string()).is_some());
+    }
+
+    fn create_proxy<'test>(vm_ip: Ipv4Address, allow: Vec<&str>, block: Vec<&str>) -> Proxy<'test> {
+        let (vm_fd, _) = socketpair(
+            AddressFamily::Unix,
+            SockType::Datagram,
+            None,
+            SockFlag::empty(),
+        )
+        .unwrap();
+        let vm_fd = Box::leak(Box::new(vm_fd));
+
+        let mut proxy = Proxy::new(
+            vm_fd.as_raw_fd(),
+            MacAddress::from_str("02:00:00:00:00:01").unwrap(),
+            NetType::Nat,
+            allow
+                .into_iter()
+                .map(|cidr| cidr.parse().unwrap())
+                .collect(),
+            block
+                .into_iter()
+                .map(|cidr| cidr.parse().unwrap())
+                .collect(),
+            Vec::default(),
+        )
+        .unwrap();
+
+        proxy.dhcp_snooper.set_lease(Some(Lease::new(
+            vm_ip,
+            Duration::from_secs(600),
+            HashSet::new(),
+        )));
+
+        proxy
+    }
+
+    fn allowed_from_vm_ipv4(proxy: &Proxy, src: Ipv4Address, dst: &str) -> Option<()> {
+        let mut buf = vec![0; 1500];
+
+        let mut ipv4_pkt_mut = Ipv4Packet::new_unchecked(&mut buf[..]);
+        ipv4_pkt_mut.set_src_addr(src);
+        ipv4_pkt_mut.set_dst_addr(Ipv4Address::from_str(dst).unwrap());
+
+        let ipv4_pkt = Ipv4Packet::new_unchecked(buf.as_slice());
+
+        proxy.allowed_from_vm_ipv4(ipv4_pkt)
+    }
+}

lib/proxy/port_forwarder.rs

@@ -0,0 +1,99 @@
+use crate::dhcp_snooper::Lease;
+use crate::host::Host;
+use crate::proxy::exposed_port::ExposedPort;
+use anyhow::Result;
+use log::error;
+use std::net::Ipv4Addr;
+
+#[derive(Default)]
+pub struct PortForwarder {
+    port_forwardings: Vec<PortForwarding>,
+    failed: bool,
+}
+
+#[derive(Debug, Clone, Copy, Default)]
+struct PortForwarding {
+    exposed_port: ExposedPort,
+    forwarding_to_addr: Option<Ipv4Addr>,
+}
+
+impl PortForwarder {
+    pub fn new(exposed_ports: Vec<ExposedPort>) -> PortForwarder {
+        let port_forwardings = exposed_ports
+            .into_iter()
+            .map(|exposed_port| PortForwarding {
+                exposed_port,
+                ..Default::default()
+            })
+            .collect();
+
+        PortForwarder {
+            port_forwardings,
+            ..Default::default()
+        }
+    }
+
+    pub fn tick(&mut self, host: &mut Host, lease: &Option<Lease>) {
+        if self.failed {
+            return;
+        }
+
+        if let Err(err) = self.tick_inner(host, lease) {
+            error!("port-forwarding failed: {}", err);
+
+            self.failed = true;
+        }
+    }
+
+    fn tick_inner(&mut self, host: &mut Host, lease: &Option<Lease>) -> Result<()> {
+        if let Some(lease) = lease {
+            // Lease exists, but is not valid, remove all port forwardings
+            if !lease.valid() {
+                self.remove_all_port_forwardings(host)?;
+
+                return Ok(());
+            }
+
+            // Lease exists and is valid, install/re-install port forwardings
+            for port_forwarding in &mut self.port_forwardings {
+                if let Some(installed_addr) = port_forwarding.forwarding_to_addr {
+                    // Port forwarding already installed, perhaps it's outdated?
+                    if installed_addr == lease.address() {
+                        // Nope, the port forwarding is up to date
+                        continue;
+                    }
+
+                    // Remove port forwarding since the lease address had changed
+                    host.port_forwarding_remove_rule(port_forwarding.exposed_port.external_port)?;
+                    port_forwarding.forwarding_to_addr = None;
+                }
+
+                // Install new port forwarding
+                host.port_forwarding_add_rule(
+                    port_forwarding.exposed_port.external_port,
+                    lease.address(),
+                    port_forwarding.exposed_port.internal_port,
+                )?;
+                port_forwarding.forwarding_to_addr = Some(lease.address());
+            }
+        } else {
+            // Lease does not exist, remove all port forwardings
+            self.remove_all_port_forwardings(host)?;
+        }
+
+        Ok(())
+    }
+
+    fn remove_all_port_forwardings(&mut self, host: &mut Host) -> Result<()> {
+        for port_forwarding in &mut self.port_forwardings {
+            if port_forwarding.forwarding_to_addr.is_none() {
+                continue;
+            }
+
+            host.port_forwarding_remove_rule(port_forwarding.exposed_port.external_port)?;
+            port_forwarding.forwarding_to_addr = None;
+        }
+
+        Ok(())
+    }
+}

lib/proxy/vm.rs

@@ -1,5 +1,5 @@
 use crate::proxy::udp_packet_helper::UdpPacketHelper;
-use crate::proxy::Proxy;
+use crate::proxy::{Action, Proxy};
 use anyhow::Context;
 use anyhow::Result;
 use ipnet::Ipv4Net;
@@ -48,7 +48,7 @@ impl Proxy<'_> {
         let source_protocol_addr = Ipv4Addr::from(source_protocol_addr);
 
         if let Some(lease) = self.dhcp_snooper.lease() {
-            if lease.valid_ip_source(source_protocol_addr.into()) {
+            if lease.valid_ip_source(source_protocol_addr) {
                 return Some(());
             }
         } else if source_protocol_addr.is_unspecified() {
@@ -58,43 +58,66 @@ impl Proxy<'_> {
         None
     }
 
-    fn allowed_from_vm_ipv4(&self, ipv4_pkt: Ipv4Packet<&[u8]>) -> Option<()> {
-        // Have we learned the VM's IP from the DHCP snooping?
-        if let Some(lease) = &self.dhcp_snooper.lease() {
-            // If so, allow all global traffic
-            let dst_addr = Ipv4Addr::from(ipv4_pkt.dst_addr().0);
-            let dst_is_global = ip_network::IpNetwork::from(dst_addr).is_global();
+    pub(crate) fn allowed_from_vm_ipv4(&self, ipv4_pkt: Ipv4Packet<&[u8]>) -> Option<()> {
+        // Is this packet coming from VM's IP address that we've learned from DHCP snooping?
+        if let Some(lease) = &self.dhcp_snooper.lease()
+            && lease.valid_ip_source(ipv4_pkt.src_addr())
+        {
+            let dst_addr = ipv4_pkt.dst_addr();
 
-            if lease.valid_ip_source(ipv4_pkt.src_addr()) && dst_is_global {
+            if self.rules_mac.iter().any(|(mac, action)| {
+                *action == Action::Block && self.dhcp_snooper_global.valid_ip_for_mac(mac, dst_addr)
+            }) {
+                return None;
+            }
+
+            if self.rules_mac.iter().any(|(mac, action)| {
+                *action == Action::Allow && self.dhcp_snooper_global.valid_ip_for_mac(mac, dst_addr)
+            }) {
                 return Some(());
             }
 
-            // Also allow all traffic to the user-specified CIDRs
-            let dst_net = Ipv4Net::from(dst_addr);
+            // Filter traffic based on user-specified rules first
+            if !self.rules.is_empty() {
+                let dst_net = Ipv4Net::from(dst_addr);
 
-            // Use get_lpm() instead of get_spm() to work around prefix-trie
-            // not handling prefixes like 0.0.0.0/0 correctly[1]
-            //
-            // [1]: https://github.com/tiborschneider/prefix-trie/issues/8
-            if self.allow.get_lpm(&dst_net).is_some() {
+                if let Some((_, action)) = self.rules.get_lpm(&dst_net) {
+                    return match action {
+                        Action::Allow => Some(()),
+                        Action::Block => None,
+                    };
+                }
+            }
+
+            // When no user-specified rules matched, simply allow all global traffic
+            if ip_network::IpNetwork::from(dst_addr).is_global() {
                 return Some(());
             }
+
+            // Additionally, allow communication with the host,
+            // otherwise things like SSH to a VM won't work
+            if ipv4_pkt.dst_addr() == self.host.gateway_ip {
+                return Some(());
+            }
+
+            // Additionally, allow DNS requests to DNS-servers
+            // provided to a VM by the host's DHCP server
+            if ipv4_pkt.next_header() == IpProtocol::Udp {
+                let udp_pkt = UdpPacket::new_checked(ipv4_pkt.payload()).ok()?;
+
+                if udp_pkt.is_dns_request()
+                    && self.dhcp_snooper.valid_dns_target(&ipv4_pkt.dst_addr())
+                {
+                    return Some(());
+                }
+            }
         }
 
-        // Allow communication with host
-        if ipv4_pkt.dst_addr() == self.host.gateway_ip {
-            return Some(());
-        }
-
+        // Allow outgoing DHCP requests to broadcast addresses,
+        // otherwise DHCP snooper will never be populated
         if ipv4_pkt.next_header() == IpProtocol::Udp {
             let udp_pkt = UdpPacket::new_checked(ipv4_pkt.payload()).ok()?;
 
-            // Allow DNS communication with the DNS-servers provided by DHCP
-            if udp_pkt.is_dns_request() && self.dhcp_snooper.valid_dns_target(&ipv4_pkt.dst_addr())
-            {
-                return Some(());
-            }
-
             // Allow DHCP communication with the bootpd(8) on host via broadcast address
             if udp_pkt.is_dhcp_request() && ipv4_pkt.dst_addr().is_broadcast() {
                 return Some(());

src/main.rs

@@ -1,14 +1,15 @@
-use anyhow::{anyhow, Context};
+use anyhow::{Context, anyhow};
 use clap::Parser;
-use ipnet::Ipv4Net;
-use nix::sys::signal::{signal, SigHandler, Signal};
-use prefix_trie::PrefixSet;
+use log::LevelFilter;
+use nix::sys::signal::{SigHandler, Signal, signal};
+use oslog::OsLogger;
 use privdrop::PrivDrop;
-use softnet::proxy::Proxy;
 use softnet::NetType;
+use softnet::proxy::ExposedPort;
+use softnet::proxy::Proxy;
+use softnet::proxy::Target;
 use std::borrow::Cow;
 use std::env;
-
 use std::os::raw::c_int;
 use std::os::unix::io::RawFd;
 use std::os::unix::process::CommandExt;
@@ -50,12 +51,43 @@ struct Args {
 
     #[clap(
         long,
-        help = "comma-separated list of CIDRs to allow the traffic to (e.g. --allow=192.168.0.0/24)",
-        value_name = "comma-separated CIDRs",
+        help = "Comma-separated list of CIDRs to allow the traffic to \
+        (e.g. --allow=192.168.0.0/24 may be used to allow a LAN access for a VM), \
+        plus supported @-aliases. Currently the only supported @-alias is @host, \
+        which matches the vmnet bridge gateway IP. \
+        When used with --block, the longest prefix match always wins. \
+        In case an identical prefix is both --allow'ed and --block'ed, \
+        blocking will take precedence. --allow=0.0.0.0/0 is a special case, \
+        it additionally disables bridge isolation (even when --block=0.0.0.0/0 is specified).",
+        value_name = "comma-separated CIDRs, MAC addresses or @-aliases",
         use_value_delimiter = true,
         action = clap::ArgAction::Set
     )]
-    allow: Vec<Ipv4Net>,
+    allow: Vec<Target>,
+
+    #[clap(
+        long,
+        help = "Comma-separated list of CIDRs to block the traffic to \
+        (e.g. --block=0.0.0.0/0 may be used to establish a default deny policy \
+        that is further relaxed with --allow), plus supported @-aliases. \
+        Currently the only supported @-alias is @host, which matches the vmnet bridge gateway IP. \
+        When used with --allow, the longest prefix match always wins. \
+        In case an identical prefix is both --allow'ed and --block'ed, \
+        blocking will take precedence.",
+        value_name = "comma-separated CIDRs, MAC addresses or @-aliases",
+        use_value_delimiter = true,
+        action = clap::ArgAction::Set
+    )]
+    block: Vec<Target>,
+
+    #[clap(
+        long,
+        help = "comma-separated list of TCP ports to expose (e.g. --expose 2222:22,8080:80)",
+        value_name = "comma-separated port specifications",
+        use_value_delimiter = true,
+        action = clap::ArgAction::Set
+    )]
+    expose: Vec<ExposedPort>,
 
     #[clap(long, hide = true)]
     sudo_escalation_probing: bool,
@@ -67,7 +99,9 @@ struct Args {
 fn main() -> ExitCode {
     // Enable backtraces by default
     if env::var("RUST_BACKTRACE").is_err() {
-        env::set_var("RUST_BACKTRACE", "full");
+        unsafe {
+            env::set_var("RUST_BACKTRACE", "full");
+        }
     }
 
     // Initialize Sentry
@@ -101,6 +135,11 @@ fn main() -> ExitCode {
 }
 
 fn try_main() -> anyhow::Result<()> {
+    // Initialize logger
+    OsLogger::new("org.cirruslabs.softnet")
+        .level_filter(LevelFilter::Info)
+        .init()?;
+
     // The default signal(3)[1] action for SIGINT is to interrupt program,
     // but we want to handle SIGINT ourselves, so we ignore it. The kqueue(2)'s[2]
     // EVFILT_SIGNAL will receive it anyways, because it has lower precedence.
@@ -160,7 +199,9 @@ fn try_main() -> anyhow::Result<()> {
         args.vm_fd as RawFd,
         args.vm_mac_address,
         args.vm_net_type,
-        PrefixSet::from_iter(args.allow),
+        args.allow,
+        args.block,
+        args.expose,
     )
     .context("failed to initialize proxy")?;