fixed build

.cargo/config.toml

@@ -1,2 +0,0 @@
-[target.aarch64-apple-darwin]
-runner = 'sudo -E'

.cirrus.yml

@@ -1,60 +1,37 @@
-use_compute_credits: true
-
-macos_instance:
-  image: ghcr.io/cirruslabs/macos-runner:tahoe
-
 env:
   PATH: "$PATH:$HOME/.cargo/bin"
 
 task:
-  name: Lint
-  install_rust_script: curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
-  rustfmt_script: cargo fmt --check
-  clippy_script: cargo clippy --all-targets --all-features -- -D warnings
-
-task:
-  alias: Test
-  matrix:
-    - name: Test on macOS Sequoia
-      macos_instance:
-        image: ghcr.io/cirruslabs/macos-runner:sequoia
-    - name: Test on macOS Tahoe
-      macos_instance:
-        image: ghcr.io/cirruslabs/macos-runner:tahoe
-  install_rust_script: curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
-  test_script: cargo test
-
-task:
-  name: Release (Dry Run)
-  only_if: $CIRRUS_TAG == ''
-  depends_on:
-    - Lint
-    - Test
-  install_rust_script: curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
-  install_script: brew install go
-  install_goreleaser_script: brew install --cask goreleaser/tap/goreleaser-pro
-  build_script: goreleaser build --snapshot
-  goreleaser_artifacts:
-    path: "dist/**"
+  name: Build
+  macos_instance:
+    image: ghcr.io/cirruslabs/macos-sonoma-xcode:latest
+  install_rust_script:
+    - curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+    - rustup target add x86_64-apple-darwin
+  build_script:
+    - cargo build --target aarch64-apple-darwin --target x86_64-apple-darwin
 
 task:
   name: Release
   only_if: $CIRRUS_TAG != ''
-  depends_on:
-    - Lint
-    - Test
+  macos_instance:
+    image: ghcr.io/cirruslabs/macos-sonoma-xcode:latest
   env:
     GITHUB_TOKEN: ENCRYPTED[!98ace8259c6024da912c14d5a3c5c6aac186890a8d4819fad78f3e0c41a4e0cd3a2537dd6e91493952fb056fa434be7c!]
     GORELEASER_KEY: ENCRYPTED[!9b80b6ef684ceaf40edd4c7af93014ee156c8aba7e6e5795f41c482729887b5c31f36b651491d790f1f668670888d9fd!]
     SENTRY_ORG: cirrus-labs
     SENTRY_PROJECT: persistent-workers
     SENTRY_AUTH_TOKEN: ENCRYPTED[!c16a5cf7da5f856b4bc2f21fe8cb7aa2a6c981f851c094ed4d3025fd02ea59a58a86cee8b193a69a1fc20fa217e56ac3!]
-  install_rust_script: curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
-  install_script: brew install go getsentry/tools/sentry-cli
-  install_goreleaser_script: brew install --cask goreleaser/tap/goreleaser-pro
+  install_rust_script:
+    - curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+    - rustup target add x86_64-apple-darwin
+  install_script:
+    - brew install go goreleaser/tap/goreleaser-pro getsentry/tools/sentry-cli
+  build_script:
+    - cargo build --target aarch64-apple-darwin --target x86_64-apple-darwin --profile release-with-debug
   release_script: goreleaser
   upload_sentry_debug_files_script:
-    - cd target/aarch64-apple-darwin/release/
+    - cd target/aarch64-apple-darwin/release-with-debug/
     # Generate and upload symbols
     - dsymutil softnet
     - sentry-cli debug-files upload -o $SENTRY_ORG -p $SENTRY_PROJECT softnet.dSYM/

.github/CODEOWNERS

@@ -1 +0,0 @@
-* @edigaryev @fkorotkov

.github/dependabot.yml

@@ -1,10 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: "cargo"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    groups:
-      all-updates:
-        patterns:
-          - "*"

.goreleaser.yml

@@ -1,27 +1,26 @@
----
-version: 2
 project_name: softnet
 
 builds:
-  - builder: rust
-    command: build
-    targets:
-      - aarch64-apple-darwin
-      - x86_64-apple-darwin
-
-universal_binaries:
-  - replace: true
+  - id: softnet
+    builder: prebuilt
+    goamd64: [v1]
+    goos:
+      - darwin
+    goarch:
+      - arm64
+      - amd64
+    prebuilt:
+      path: 'target/{{- if eq .Arch "arm64" }}aarch64{{- else }}x86_64{{ end }}-apple-darwin/release-with-debug/softnet'
 
 archives:
-  - name_template: "{{ .ProjectName }}"
-    formats:
-      - tar.gz
+  - id: regular
+    name_template: "{{ .ProjectName }}-{{ .Arch }}"
 
 release:
   prerelease: auto
 
 brews:
-  - name: "{{ .ProjectName }}"
+  - name: softnet
     repository:
       owner: cirruslabs
       name: homebrew-cli
@@ -29,5 +28,3 @@ brews:
     homepage: https://github.com/cirruslabs/softnet
     description: Software networking with isolation for Tart
     skip_upload: auto
-    custom_block: |
-      depends_on :macos => :sequoia

Cargo.toml

@@ -2,7 +2,7 @@
 name = "softnet"
 version = "0.1.0"
 publish = false
-edition = "2024"
+edition = "2021"
 
 [lib]
 path = "lib/mod.rs"
@@ -12,28 +12,19 @@ inherits = "release"
 debug = true
 
 [dependencies]
-smoltcp = "0"
-libc = "0"
-polling = "3"
-dhcproto = { git = "https://github.com/bluecatengineering/dhcproto.git", branch = "master" }
-vmnet = "0.5.0"
-clap = { version = "4", features = ["derive"] }
-mac_address = "1"
-privdrop = "0"
-anyhow = { version = "1", features = ["backtrace"] }
-ip_network = "0"
-uzers = "0"
-system-configuration = "0"
-num_enum = "0"
-sentry = { version = "0", features = ["debug-images"] }
-sentry-anyhow = { version = "0", features = ["backtrace"] }
-nix = { version = "0", features = ["signal", "socket"] }
-prefix-trie = "0"
-ipnet = "2"
-oslog = "0.2.0"
-log = "0.4.29"
-serial_test = "3"
-coarsetime = "0.1.37"
-
-[profile.release]
-debug = true
+smoltcp = "0.8.1"
+libc = "0.2.126"
+polling = { git = "https://github.com/smol-rs/polling.git" }
+dhcproto = "0.7.0"
+vmnet = "0.1.1"
+clap = { version = "3.1.18", features = ["derive"] }
+mac_address = "1.1.3"
+privdrop = "0.5.2"
+anyhow = { version = "1.0.66", features = ["backtrace"] }
+ip_network = "0.4.1"
+uzers = "0.11.3"
+system-configuration = "0.5.0"
+num_enum = "0.5.7"
+sentry = { version = "0.29.1", features = ["debug-images"] }
+sentry-anyhow = { version = "0.29.1", features = ["backtrace"] }
+nix = "0.26.2"

README.md

@@ -1,17 +1,6 @@
 # Softnet
 
 Softnet is a software networking for [Tart](https://github.com/cirruslabs/tart) which provides better network isolation and alleviates DHCP shortage on production systems.
-
-It is essentially a userspace packet filter which restricts the VM networking and prevents a class of security issues, such as ARP spoofing. By default, the VM will only be able to:
-
-* send traffic from its own MAC-address
-* send traffic from the IP-address assigned to it by the DHCP
-* send traffic to globally routable IPv4 addresses
-* send traffic to gateway IP of the vmnet bridge (this would normally be \"bridge100\" interface)
-* receive any incoming traffic
-
-In addition, Softnet tunes macOS built-in DHCP server to decrease its lease time from the default 86,400 seconds (one day) to 600 seconds (10 minutes). This is especially important when you use Tart to clone and run a lot of ephemeral VMs over a period of one day.
-
 Please check out [this blog post](https://cirrus-ci.org/blog/2022/07/07/isolating-network-between-tarts-macos-virtual-machines/) for backstory.
 
 ## Working model
@@ -19,9 +8,9 @@ Please check out [this blog post](https://cirrus-ci.org/blog/2022/07/07/isolatin
 Softnet solves two problems:
 
 1. VM network isolation
-    * [`VZNATNetworkDeviceAttachment`](https://developer.apple.com/documentation/virtualization/vznatnetworkdeviceattachment) (the default networking in Tart) enables [vmnet's bridge isolation](https://developer.apple.com/documentation/vmnet/vmnet_enable_isolation_key) by default and prevents cross-VM traffic, however it's still possible for any VM to spoof the host's ARP-table and capture other VMs traffic by using tools that enable conducting the [ARP spoofing attacks](https://en.wikipedia.org/wiki/ARP_spoofing) (e.g. [arpspoof](https://www.monkey.org/~dugsong/dsniff/), [arpoison](http://www.arpoison.net/) and so on)
+  * [`VZNATNetworkDeviceAttachment`](https://developer.apple.com/documentation/virtualization/vznatnetworkdeviceattachment) (the default networking in Tart) enables [vmnet's bridge isolation](https://developer.apple.com/documentation/vmnet/vmnet_enable_isolation_key) by default and prevents cross-VM traffic, however it's still possible for any VM to spoof the host's ARP-table and capture other VMs traffic
 2. DHCP exhaustion
-    * macOS built-in DHCP-server allocates a `/24` subnet with 86400 seconds lease time by default, which only allows for ~253 VMs a day (or 1 VM every ~6 minutes) to be spawned without causing a denial-of-service, which is pretty limiting for CI services like Cirrus CI
+  * macOS built-in DHCP-server allocates a `/24` subnet with 86400 seconds lease time by default, which only allows for ~253 VMs a day (or 1 VM every ~6 minutes) to be spawned without causing a denial-of-service, which is pretty limiting for CI services like Cirrus CI
 
 And assumes that:
 

lib/dhcp_snooper.rs

@@ -1,23 +1,15 @@
-use dhcproto::Decodable;
 use dhcproto::v4::{DhcpOption, MessageType, OptionCode};
+use dhcproto::Decodable;
 use smoltcp::wire::Ipv4Address;
 use std::collections::HashSet;
-use std::time::Duration;
+use std::time::{Duration, Instant};
 
 #[derive(Default)]
 pub struct DhcpSnooper {
     vm_lease: Option<Lease>,
-    uncertainty_duration: Duration,
 }
 
 impl DhcpSnooper {
-    pub fn new(uncertainty_duration: Duration) -> Self {
-        DhcpSnooper {
-            uncertainty_duration,
-            ..Default::default()
-        }
-    }
-
     pub fn register_dhcp_reply(&mut self, dhcp_packet: &[u8]) {
         let mut decoder = dhcproto::v4::Decoder::new(dhcp_packet);
 
@@ -34,18 +26,17 @@ impl DhcpSnooper {
                 };
 
                 let dns_ips = match message.opts().get(OptionCode::DomainNameServer) {
-                    Some(DhcpOption::DomainNameServer(dns_ips)) => {
-                        HashSet::from_iter(dns_ips.iter().cloned())
-                    }
+                    Some(DhcpOption::DomainNameServer(dns_ips)) => HashSet::from_iter(
+                        dns_ips.iter().map(|dns_ip| Ipv4Address(dns_ip.octets())),
+                    ),
                     _ => HashSet::new(),
                 };
 
-                let mut lease_duration = Duration::from_secs(*lease_time as u64);
-
-                // Adjust for uncertainty caused by using a coarse clock
-                lease_duration = lease_duration.saturating_sub(self.uncertainty_duration);
-
-                self.vm_lease = Some(Lease::new(message.yiaddr(), lease_duration, dns_ips))
+                self.vm_lease = Some(Lease::new(
+                    message.yiaddr().into(),
+                    Duration::from_secs(*lease_time as u64),
+                    dns_ips,
+                ))
             }
             Some(MessageType::Nak) => {
                 self.vm_lease = None;
@@ -54,11 +45,6 @@ impl DhcpSnooper {
         };
     }
 
-    #[cfg(test)]
-    pub(crate) fn set_lease(&mut self, vm_lease: Option<Lease>) {
-        self.vm_lease = vm_lease
-    }
-
     pub fn lease(&self) -> &Option<Lease> {
         &self.vm_lease
     }
@@ -72,31 +58,22 @@ impl DhcpSnooper {
     }
 }
 
-#[derive(Debug)]
 pub struct Lease {
     address: Ipv4Address,
-    valid_until: coarsetime::Instant,
+    valid_until: Instant,
     dns_ips: HashSet<Ipv4Address>,
 }
 
 impl Lease {
-    pub fn new(address: Ipv4Address, lease_time: Duration, dns_ips: HashSet<Ipv4Address>) -> Lease {
+    fn new(address: Ipv4Address, lease_time: Duration, dns_ips: HashSet<Ipv4Address>) -> Lease {
         Lease {
             address,
-            valid_until: coarsetime::Instant::recent() + lease_time.into(),
+            valid_until: Instant::now() + lease_time,
             dns_ips,
         }
     }
 
-    pub fn address(&self) -> Ipv4Address {
-        self.address
-    }
-
-    pub fn valid(&self) -> bool {
-        coarsetime::Instant::recent() < self.valid_until
-    }
-
     pub fn valid_ip_source(&self, address: Ipv4Address) -> bool {
-        self.address == address && self.valid()
+        self.address == address && Instant::now() < self.valid_until
     }
 }

lib/host.rs

@@ -1,17 +1,15 @@
-use anyhow::{Context, Result, anyhow};
-use clap::ValueEnum;
-use log::info;
+use clap::ArgEnum;
+use anyhow::{anyhow, Context, Result};
 use std::net::Ipv4Addr;
 use std::os::unix::io::{AsRawFd, RawFd};
 use std::os::unix::net::UnixDatagram;
 use std::str::FromStr;
-use std::sync::mpsc::{SyncSender, sync_channel};
+use std::sync::mpsc::{sync_channel, SyncSender};
 use vmnet::mode::Mode;
 use vmnet::parameters::{Parameter, ParameterKind};
-use vmnet::port_forwarding::{AddressFamily, Protocol};
-use vmnet::{Batch, Events, Options};
+use vmnet::{Events, Options};
 
-#[derive(ValueEnum, Clone, Debug)]
+#[derive(ArgEnum, Clone, Debug)]
 pub enum NetType {
     /// Shared network
     ///
@@ -29,12 +27,11 @@ pub struct Host {
     callback_can_continue_tx: SyncSender<()>,
     pub gateway_ip: smoltcp::wire::Ipv4Address,
     pub max_packet_size: u64,
-    pub read_max_packets: u64,
     finalized: bool,
 }
 
 impl Host {
-    pub fn new(vm_net_type: NetType, enable_isolation: bool) -> Result<Host> {
+    pub fn new(vm_net_type: NetType) -> Result<Host> {
         // Initialize a vmnet.framework NAT or Host interface with isolation enabled
         let mut interface = vmnet::Interface::new(
             match vm_net_type {
@@ -42,39 +39,22 @@ impl Host {
                 NetType::Host => Mode::Host(Default::default()),
             },
             Options {
-                enable_isolation: Some(enable_isolation),
+                enable_isolation: Some(true),
                 ..Default::default()
             },
         )
         .context("failed to initialize vmnet interface")?;
 
         // Retrieve first IP (gateway) used for this interface
-        let Some(Parameter::StartAddress(gateway_ip)) =
-            interface.parameters().get(ParameterKind::StartAddress)
-        else {
-            return Err(anyhow!(
-                "failed to retrieve vmnet's interface start address"
-            ));
+        let Some(Parameter::StartAddress(gateway_ip)) = interface.parameters().get(ParameterKind::StartAddress) else {
+            return Err(anyhow!("failed to retrieve vmnet's interface start address"));
         };
         let gateway_ip = Ipv4Addr::from_str(&gateway_ip)
             .context("failed to parse vmnet's interface start address")?;
 
         // Retrieve max packet size for this interface
-        let Some(Parameter::MaxPacketSize(max_packet_size)) =
-            interface.parameters().get(ParameterKind::MaxPacketSize)
-        else {
-            return Err(anyhow!(
-                "failed to retrieve vmnet's interface max packet size"
-            ));
-        };
-
-        // Retrieve read max packets for this interface
-        let Some(Parameter::ReadMaxPackets(read_max_packets)) =
-            interface.parameters().get(ParameterKind::ReadMaxPackets)
-        else {
-            return Err(anyhow!(
-                "failed to retrieve vmnet's interface read max packets"
-            ));
+        let Some(Parameter::MaxPacketSize(max_packet_size)) = interface.parameters().get(ParameterKind::MaxPacketSize) else {
+            return Err(anyhow!("failed to retrieve vmnet's interface max packet size"));
         };
 
         // Set up a socketpair() to emulate polling of the vmnet interface
@@ -86,9 +66,7 @@ impl Host {
         interface
             .set_event_callback(Events::PACKETS_AVAILABLE, move |_mask, _params| {
                 // Send a dummy datagram to make the other end of socketpair() readable
-                // and ignore the error as this merely a signalling channel to wake up
-                // the poller
-                new_packets_tx.send(&[0; 1]).ok();
+                new_packets_tx.send(&[0; 1]).unwrap();
 
                 // Wait for the permission to continue to avoid
                 // wasting CPU cycles or in case of termination,
@@ -104,54 +82,22 @@ impl Host {
             interface,
             new_packets_rx,
             callback_can_continue_tx,
-            gateway_ip,
+            gateway_ip: gateway_ip.into(),
             max_packet_size,
-            read_max_packets,
             finalized: false,
         })
     }
 }
 
 impl Host {
-    pub fn port_forwarding_add_rule(
-        &mut self,
-        external_port: u16,
-        internal_addr: Ipv4Addr,
-        internal_port: u16,
-    ) -> Result<()> {
-        let details = format!(
-            "external_port={external_port}, internal_addr={internal_addr}, internal_port={internal_port}"
-        );
-
-        self.interface
-            .port_forwarding_rule_add(
-                AddressFamily::Ipv4,
-                Protocol::Tcp,
-                external_port,
-                internal_addr.into(),
-                internal_port,
-            )
-            .map(|_| info!("added port forwarding rule {details}"))
-            .map_err(|err| anyhow!("failed to add port forwarding rule {details}: {err}"))
-    }
-
-    pub fn port_forwarding_remove_rule(&mut self, external_port: u16) -> Result<()> {
-        let details = format!("external_port={external_port}");
-
-        self.interface
-            .port_forwarding_rule_remove(AddressFamily::Ipv4, Protocol::Tcp, external_port)
-            .map(|_| info!("removed port forwarding rule {details}"))
-            .map_err(|err| anyhow!("failed to remove port forwarding rule {details}: {err}"))
-    }
-
-    pub fn read(&mut self, batch: &mut Batch, bufs: &mut [Vec<u8>]) -> vmnet::Result<usize> {
+    pub fn read(&mut self, buf: &mut [u8]) -> vmnet::Result<usize> {
         // Dequeue dummy datagram from the socket (if any)
         // to free up buffer space and reduce false-positives
         // when polling
         let mut buf_to_be_discarded: [u8; 1] = [0; 1];
         let _ = self.new_packets_rx.recv(&mut buf_to_be_discarded);
 
-        let result = self.interface.read_batch(batch, bufs);
+        let result = self.interface.read(buf);
 
         if let Err(vmnet::Error::VmnetReadNothing) = result {
             // We've emptied everything, unlock the callback

lib/poller.rs

@@ -1,17 +1,15 @@
 use anyhow::Result;
 use num_enum::IntoPrimitive;
-use polling::PollMode;
 use polling::os::kqueue::PollerKqueueExt;
-use std::os::fd::{AsRawFd, BorrowedFd};
+use polling::PollMode;
 use std::os::unix::io::RawFd;
 use std::time::Duration;
 
-pub struct Poller<'poller> {
+pub struct Poller {
     poller: polling::Poller,
-    events: polling::Events,
-    timeout: Duration,
-    vm_fd: BorrowedFd<'poller>,
-    host_fd: BorrowedFd<'poller>,
+    events: Vec<polling::Event>,
+    vm_fd: RawFd,
+    host_fd: RawFd,
 }
 
 #[derive(IntoPrimitive)]
@@ -22,50 +20,56 @@ enum EventKey {
     Interrupt,
 }
 
-impl Poller<'_> {
-    pub fn new<'poller>(
-        vm_fd: RawFd,
-        host_fd: RawFd,
-        timeout: Duration,
-    ) -> Result<Poller<'poller>> {
+impl Poller {
+    pub fn new(vm_fd: RawFd, host_fd: RawFd) -> Result<Poller> {
         let poller = polling::Poller::new()?;
 
         Ok(Poller {
             poller,
-            events: polling::Events::new(),
-            timeout,
-            vm_fd: unsafe { BorrowedFd::borrow_raw(vm_fd) },
-            host_fd: unsafe { BorrowedFd::borrow_raw(host_fd) },
+            events: Vec::new(),
+            vm_fd,
+            host_fd,
         })
     }
 
     pub fn arm(&self) -> Result<()> {
-        unsafe {
-            self.poller.add_with_mode(
-                self.vm_fd.as_raw_fd(),
-                self.vm_interest(),
-                PollMode::Edge,
-            )?;
-            self.poller.add_with_mode(
-                self.host_fd.as_raw_fd(),
-                self.host_interest(),
-                PollMode::Edge,
-            )?;
-        }
+        self.poller.add(self.vm_fd as RawFd, self.vm_interest())?;
+        self.poller
+            .add(self.host_fd as RawFd, self.host_interest())?;
 
         let interrupt_signal = polling::os::kqueue::Signal(libc::SIGINT);
         self.poller
-            .add_filter(interrupt_signal, EventKey::Interrupt.into(), PollMode::Edge)?;
+            .add_filter(
+                interrupt_signal,
+                EventKey::Interrupt.into(),
+                PollMode::Oneshot,
+            )
+            .unwrap();
 
         Ok(())
     }
 
-    pub fn rearm(&mut self) {
+    pub fn rearm(&mut self) -> Result<()> {
         self.events.clear();
+
+        self.poller
+            .modify(self.vm_fd as RawFd, self.vm_interest())?;
+        self.poller
+            .modify(self.host_fd as RawFd, self.host_interest())?;
+
+        let interrupt_signal = polling::os::kqueue::Signal(libc::SIGINT);
+        self.poller.modify_filter(
+            interrupt_signal,
+            EventKey::Interrupt.into(),
+            PollMode::Oneshot,
+        )?;
+
+        Ok(())
     }
 
     pub fn wait(&mut self) -> Result<(bool, bool, bool)> {
-        self.poller.wait(&mut self.events, Some(self.timeout))?;
+        self.poller
+            .wait(&mut self.events, Some(Duration::from_millis(100)))?;
 
         let vm_readable = self
             .events

lib/proxy/exposed_port.rs

@@ -1,47 +0,0 @@
-use anyhow::{Context, Error, anyhow};
-use std::str::FromStr;
-
-#[derive(Debug, Clone, Copy, Default, PartialEq)]
-pub struct ExposedPort {
-    pub external_port: u16,
-    pub internal_port: u16,
-}
-
-impl FromStr for ExposedPort {
-    type Err = Error;
-
-    fn from_str(s: &str) -> Result<Self, Self::Err> {
-        let splits: Vec<&str> = s.split(':').collect();
-
-        match splits.len() {
-            2 => Ok(ExposedPort {
-                external_port: splits[0]
-                    .parse()
-                    .context(format!("invalid external port {:?}", splits[0]))?,
-                internal_port: splits[1]
-                    .parse()
-                    .context(format!("invalid internal port {:?}", splits[1]))?,
-            }),
-            _ => Err(anyhow!(
-                "invalid exposed port specification {:?}, the format should be EXTERNAL:INTERNAL",
-                s
-            )),
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use crate::proxy::exposed_port::ExposedPort;
-
-    #[test]
-    fn exposed_port() {
-        assert_eq!(
-            ExposedPort {
-                external_port: 2222,
-                internal_port: 22
-            },
-            "2222:22".parse().unwrap()
-        );
-    }
-}

lib/proxy/host.rs

@@ -1,9 +1,9 @@
-use crate::proxy::Proxy;
 use crate::proxy::udp_packet_helper::UdpPacketHelper;
+use crate::proxy::Proxy;
 use anyhow::{Context, Result};
 use smoltcp::wire::{EthernetFrame, EthernetProtocol, Ipv4Packet, UdpPacket};
 
-impl Proxy<'_> {
+impl Proxy {
     pub(crate) fn process_frame_from_host(&mut self, frame: &EthernetFrame<&[u8]>) -> Result<()> {
         if self.allowed_from_host(frame).is_none() {
             // Block packet by not forwarding it to the VM
@@ -58,7 +58,7 @@ impl Proxy<'_> {
             return;
         }
 
-        if ipv4_pkt.next_header() != smoltcp::wire::IpProtocol::Udp {
+        if ipv4_pkt.protocol() != smoltcp::wire::IpProtocol::Udp {
             return;
         }
 

lib/proxy/mod.rs

@@ -1,6 +1,4 @@
-mod exposed_port;
 mod host;
-mod port_forwarder;
 mod udp_packet_helper;
 mod vm;
 
@@ -10,99 +8,50 @@ use crate::host::NetType;
 use crate::poller::Poller;
 use crate::vm::VM;
 use anyhow::Result;
-pub use exposed_port::ExposedPort;
-use ipnet::Ipv4Net;
 use mac_address::MacAddress;
-use port_forwarder::PortForwarder;
-use prefix_trie::{Prefix, PrefixMap, PrefixSet};
 use smoltcp::wire::EthernetFrame;
 use std::io::ErrorKind;
 use std::os::unix::io::{AsRawFd, RawFd};
-use std::time::Duration;
-use vmnet::Batch;
 
-pub struct Proxy<'proxy> {
+pub struct Proxy {
     vm: VM,
     host: Host,
-    poller: Poller<'proxy>,
+    poller: Poller,
     vm_mac_address: smoltcp::wire::EthernetAddress,
     dhcp_snooper: DhcpSnooper,
-    rules: PrefixMap<Ipv4Net, Action>,
     enobufs_encountered: bool,
-    port_forwarder: PortForwarder,
 }
 
-#[derive(Debug, Clone, PartialEq)]
-pub(crate) enum Action {
-    Block,
-    Allow,
-}
-
-impl Proxy<'_> {
-    pub fn new<'proxy>(
-        vm_fd: RawFd,
-        vm_mac_address: MacAddress,
-        vm_net_type: NetType,
-        allow: PrefixSet<Ipv4Net>,
-        block: PrefixSet<Ipv4Net>,
-        exposed_ports: Vec<ExposedPort>,
-    ) -> Result<Proxy<'proxy>> {
+impl Proxy {
+    pub fn new(vm_fd: RawFd, vm_mac_address: MacAddress, vm_net_type: NetType) -> Result<Proxy> {
         let vm = VM::new(vm_fd)?;
-        let host = Host::new(vm_net_type, !allow.contains(&Ipv4Net::zero()))?;
-        let poller_timeout = Duration::from_millis(100);
-        let poller = Poller::new(vm.as_raw_fd(), host.as_raw_fd(), poller_timeout)?;
-
-        // Craft packet filter rules
-        //
-        // SECURITY: blocking rules must always take precedence
-        // over allowing rules when prefixes are identical.
-        let mut rules = PrefixMap::new();
-
-        for allow_net in allow {
-            rules.insert(allow_net, Action::Allow);
-        }
-
-        for block_net in block {
-            rules.insert(block_net, Action::Block);
-        }
+        let host = Host::new(vm_net_type)?;
+        let poller = Poller::new(vm.as_raw_fd(), host.as_raw_fd())?;
 
         Ok(Proxy {
             vm,
             host,
             poller,
             vm_mac_address: smoltcp::wire::EthernetAddress(vm_mac_address.bytes()),
-            dhcp_snooper: DhcpSnooper::new(poller_timeout),
-            rules,
+            dhcp_snooper: Default::default(),
             enobufs_encountered: false,
-            port_forwarder: PortForwarder::new(exposed_ports),
         })
     }
 
     pub fn run(&mut self) -> Result<()> {
-        // Create a single buffer from reading from the VM
         let mut buf: Vec<u8> = vec![0; self.host.max_packet_size as usize];
 
-        // Create multiple buffers and a batch for reading from the host
-        let mut bufs = vec![
-            vec![0u8; self.host.max_packet_size as usize];
-            self.host.read_max_packets as usize
-        ];
-        let mut batch = Batch::preallocate(bufs.len());
-
         self.poller.arm()?;
 
         loop {
             let (vm_readable, host_readable, interrupt) = self.poller.wait()?;
 
-            // Update coarse time for the DHCP snooper
-            coarsetime::Instant::update();
-
             if vm_readable {
                 self.read_from_vm(buf.as_mut_slice())?;
             }
 
             if host_readable {
-                self.read_from_host(&mut batch, &mut bufs)?;
+                self.read_from_host(buf.as_mut_slice())?;
             }
 
             // Graceful termination
@@ -110,13 +59,7 @@ impl Proxy<'_> {
                 return Ok(());
             }
 
-            // Timeout
-            if !vm_readable && !host_readable && !interrupt {
-                self.port_forwarder
-                    .tick(&mut self.host, self.dhcp_snooper.lease());
-            }
-
-            self.poller.rearm();
+            self.poller.rearm()?;
         }
     }
 
@@ -124,9 +67,6 @@ impl Proxy<'_> {
         loop {
             match self.vm.read(buf) {
                 Ok(n) => {
-                    // Update coarse time for the DHCP snooper
-                    coarsetime::Instant::update();
-
                     if let Ok(frame) = EthernetFrame::new_checked(&buf[..n]) {
                         self.process_frame_from_vm(frame)?;
                     }
@@ -142,17 +82,12 @@ impl Proxy<'_> {
         }
     }
 
-    fn read_from_host(&mut self, batch: &mut Batch, bufs: &mut [Vec<u8>]) -> Result<()> {
+    fn read_from_host(&mut self, buf: &mut [u8]) -> Result<()> {
         loop {
-            match self.host.read(batch, bufs) {
-                Ok(pktcnt) => {
-                    // Update coarse time for the DHCP snooper
-                    coarsetime::Instant::update();
-
-                    for buf in batch.packet_sized_bufs(bufs).take(pktcnt) {
-                        if let Ok(pkt) = EthernetFrame::new_checked(buf) {
-                            self.process_frame_from_host(&pkt)?;
-                        }
+            match self.host.read(buf) {
+                Ok(n) => {
+                    if let Ok(pkt) = EthernetFrame::new_checked(&buf[..n]) {
+                        self.process_frame_from_host(&pkt)?;
                     }
                 }
                 Err(err) => {
@@ -166,105 +101,3 @@ impl Proxy<'_> {
         }
     }
 }
-
-#[cfg(test)]
-mod tests {
-    use crate::NetType;
-    use crate::dhcp_snooper::Lease;
-    use crate::proxy::{Action, Proxy};
-    use ipnet::Ipv4Net;
-    use mac_address::MacAddress;
-    use nix::sys::socket::{AddressFamily, SockFlag, SockType, socketpair};
-    use prefix_trie::{PrefixMap, PrefixSet};
-    use serial_test::serial;
-    use smoltcp::wire::{Ipv4Address, Ipv4Packet};
-    use std::collections::HashSet;
-    use std::os::fd::AsRawFd;
-    use std::str::FromStr;
-    use std::time::Duration;
-
-    #[test]
-    #[serial]
-    fn test_blocking_takes_precedence() {
-        let vm_ip = Ipv4Address::from_str("192.168.0.2").unwrap();
-        let proxy = create_proxy(vm_ip, vec!["66.66.0.0/16"], vec!["66.66.0.0/16"]);
-
-        assert_eq!(
-            proxy.rules,
-            PrefixMap::<Ipv4Net, Action>::from_iter(vec![(
-                Ipv4Net::from_str("66.66.0.0/16").unwrap(),
-                Action::Block
-            ),])
-        );
-
-        assert!(allowed_from_vm_ipv4(&proxy, vm_ip, "66.66.66.66").is_none());
-    }
-
-    #[test]
-    #[serial]
-    fn test_longest_prefix_match_wins() {
-        let vm_ip = Ipv4Address::from_str("192.168.0.2").unwrap();
-        let proxy = create_proxy(vm_ip, vec!["33.33.33.33/32"], vec!["33.33.33.0/24"]);
-
-        assert_eq!(
-            proxy.rules,
-            PrefixMap::<Ipv4Net, Action>::from_iter(vec![
-                (Ipv4Net::from_str("33.33.33.33/32").unwrap(), Action::Allow),
-                (Ipv4Net::from_str("33.33.33.0/24").unwrap(), Action::Block),
-            ])
-        );
-
-        assert!(allowed_from_vm_ipv4(&proxy, vm_ip, "33.33.33.32").is_none());
-        assert!(allowed_from_vm_ipv4(&proxy, vm_ip, "33.33.33.33").is_some());
-        assert!(allowed_from_vm_ipv4(&proxy, vm_ip, "33.33.33.34").is_none());
-    }
-
-    fn create_proxy<'test>(vm_ip: Ipv4Address, allow: Vec<&str>, block: Vec<&str>) -> Proxy<'test> {
-        let (vm_fd, _) = socketpair(
-            AddressFamily::Unix,
-            SockType::Datagram,
-            None,
-            SockFlag::empty(),
-        )
-        .unwrap();
-        let vm_fd = Box::leak(Box::new(vm_fd));
-
-        let mut proxy = Proxy::new(
-            vm_fd.as_raw_fd(),
-            MacAddress::from_str("02:00:00:00:00:01").unwrap(),
-            NetType::Nat,
-            PrefixSet::from_iter(
-                allow
-                    .into_iter()
-                    .map(|cidr| Ipv4Net::from_str(cidr).unwrap()),
-            ),
-            PrefixSet::from_iter(
-                block
-                    .into_iter()
-                    .map(|cidr| Ipv4Net::from_str(cidr).unwrap()),
-            ),
-            Vec::default(),
-        )
-        .unwrap();
-
-        proxy.dhcp_snooper.set_lease(Some(Lease::new(
-            vm_ip,
-            Duration::from_secs(600),
-            HashSet::new(),
-        )));
-
-        proxy
-    }
-
-    fn allowed_from_vm_ipv4(proxy: &Proxy, src: Ipv4Address, dst: &str) -> Option<()> {
-        let mut buf = vec![0; 1500];
-
-        let mut ipv4_pkt_mut = Ipv4Packet::new_unchecked(&mut buf[..]);
-        ipv4_pkt_mut.set_src_addr(src);
-        ipv4_pkt_mut.set_dst_addr(Ipv4Address::from_str(dst).unwrap());
-
-        let ipv4_pkt = Ipv4Packet::new_unchecked(buf.as_slice());
-
-        proxy.allowed_from_vm_ipv4(ipv4_pkt)
-    }
-}

lib/proxy/port_forwarder.rs

@@ -1,99 +0,0 @@
-use crate::dhcp_snooper::Lease;
-use crate::host::Host;
-use crate::proxy::exposed_port::ExposedPort;
-use anyhow::Result;
-use log::error;
-use std::net::Ipv4Addr;
-
-#[derive(Default)]
-pub struct PortForwarder {
-    port_forwardings: Vec<PortForwarding>,
-    failed: bool,
-}
-
-#[derive(Debug, Clone, Copy, Default)]
-struct PortForwarding {
-    exposed_port: ExposedPort,
-    forwarding_to_addr: Option<Ipv4Addr>,
-}
-
-impl PortForwarder {
-    pub fn new(exposed_ports: Vec<ExposedPort>) -> PortForwarder {
-        let port_forwardings = exposed_ports
-            .into_iter()
-            .map(|exposed_port| PortForwarding {
-                exposed_port,
-                ..Default::default()
-            })
-            .collect();
-
-        PortForwarder {
-            port_forwardings,
-            ..Default::default()
-        }
-    }
-
-    pub fn tick(&mut self, host: &mut Host, lease: &Option<Lease>) {
-        if self.failed {
-            return;
-        }
-
-        if let Err(err) = self.tick_inner(host, lease) {
-            error!("port-forwarding failed: {}", err);
-
-            self.failed = true;
-        }
-    }
-
-    fn tick_inner(&mut self, host: &mut Host, lease: &Option<Lease>) -> Result<()> {
-        if let Some(lease) = lease {
-            // Lease exists, but is not valid, remove all port forwardings
-            if !lease.valid() {
-                self.remove_all_port_forwardings(host)?;
-
-                return Ok(());
-            }
-
-            // Lease exists and is valid, install/re-install port forwardings
-            for port_forwarding in &mut self.port_forwardings {
-                if let Some(installed_addr) = port_forwarding.forwarding_to_addr {
-                    // Port forwarding already installed, perhaps it's outdated?
-                    if installed_addr == lease.address() {
-                        // Nope, the port forwarding is up to date
-                        continue;
-                    }
-
-                    // Remove port forwarding since the lease address had changed
-                    host.port_forwarding_remove_rule(port_forwarding.exposed_port.external_port)?;
-                    port_forwarding.forwarding_to_addr = None;
-                }
-
-                // Install new port forwarding
-                host.port_forwarding_add_rule(
-                    port_forwarding.exposed_port.external_port,
-                    lease.address(),
-                    port_forwarding.exposed_port.internal_port,
-                )?;
-                port_forwarding.forwarding_to_addr = Some(lease.address());
-            }
-        } else {
-            // Lease does not exist, remove all port forwardings
-            self.remove_all_port_forwardings(host)?;
-        }
-
-        Ok(())
-    }
-
-    fn remove_all_port_forwardings(&mut self, host: &mut Host) -> Result<()> {
-        for port_forwarding in &mut self.port_forwardings {
-            if port_forwarding.forwarding_to_addr.is_none() {
-                continue;
-            }
-
-            host.port_forwarding_remove_rule(port_forwarding.exposed_port.external_port)?;
-            port_forwarding.forwarding_to_addr = None;
-        }
-
-        Ok(())
-    }
-}

lib/proxy/vm.rs

@@ -1,14 +1,13 @@
 use crate::proxy::udp_packet_helper::UdpPacketHelper;
-use crate::proxy::{Action, Proxy};
+use crate::proxy::Proxy;
 use anyhow::Context;
 use anyhow::Result;
-use ipnet::Ipv4Net;
 use smoltcp::wire::{
     ArpPacket, EthernetFrame, EthernetProtocol, IpProtocol, Ipv4Packet, UdpPacket,
 };
 use std::net::Ipv4Addr;
 
-impl Proxy<'_> {
+impl Proxy {
     pub(crate) fn process_frame_from_vm(&mut self, frame: EthernetFrame<&[u8]>) -> Result<()> {
         if self.allowed_from_vm(&frame).is_none() {
             // Block packet by not forwarding it to the host
@@ -48,7 +47,7 @@ impl Proxy<'_> {
         let source_protocol_addr = Ipv4Addr::from(source_protocol_addr);
 
         if let Some(lease) = self.dhcp_snooper.lease() {
-            if lease.valid_ip_source(source_protocol_addr) {
+            if lease.valid_ip_source(source_protocol_addr.into()) {
                 return Some(());
             }
         } else if source_protocol_addr.is_unspecified() {
@@ -58,54 +57,36 @@ impl Proxy<'_> {
         None
     }
 
-    pub(crate) fn allowed_from_vm_ipv4(&self, ipv4_pkt: Ipv4Packet<&[u8]>) -> Option<()> {
-        // Is this packet coming from VM's IP address that we've learned from DHCP snooping?
-        if let Some(lease) = &self.dhcp_snooper.lease()
-            && lease.valid_ip_source(ipv4_pkt.src_addr())
-        {
-            let dst_addr = ipv4_pkt.dst_addr();
+    fn allowed_from_vm_ipv4(&self, ipv4_pkt: Ipv4Packet<&[u8]>) -> Option<()> {
+        // Once we've learned the VM's IP from the DHCP snooping,
+        // allow all global traffic for that VM's IP
+        if let Some(lease) = &self.dhcp_snooper.lease() {
+            let ip_net = &ip_network::IpNetwork::from(Ipv4Addr::from(ipv4_pkt.dst_addr().0));
+            let dst_is_global_or_private =
+              match &ip_net {
+                ip_network::IpNetwork::V4(ip_net) => ip_net.is_global() || ip_net.is_private(),
+                ip_network::IpNetwork::V6(ip_net) => ip_net.is_global(),
+              };
 
-            // Filter traffic based on user-specified rules first
-            if !self.rules.is_empty() {
-                let dst_net = Ipv4Net::from(dst_addr);
-
-                if let Some((_, action)) = self.rules.get_lpm(&dst_net) {
-                    return match action {
-                        Action::Allow => Some(()),
-                        Action::Block => None,
-                    };
-                }
-            }
-
-            // When no user-specified rules matched, simply allow all global traffic
-            if ip_network::IpNetwork::from(dst_addr).is_global() {
+            if lease.valid_ip_source(ipv4_pkt.src_addr()) && dst_is_global_or_private {
                 return Some(());
             }
-
-            // Additionally, allow communication with the host,
-            // otherwise things like SSH to a VM won't work
-            if ipv4_pkt.dst_addr() == self.host.gateway_ip {
-                return Some(());
-            }
-
-            // Additionally, allow DNS requests to DNS-servers
-            // provided to a VM by the host's DHCP server
-            if ipv4_pkt.next_header() == IpProtocol::Udp {
-                let udp_pkt = UdpPacket::new_checked(ipv4_pkt.payload()).ok()?;
-
-                if udp_pkt.is_dns_request()
-                    && self.dhcp_snooper.valid_dns_target(&ipv4_pkt.dst_addr())
-                {
-                    return Some(());
-                }
-            }
         }
 
-        // Allow outgoing DHCP requests to broadcast addresses,
-        // otherwise DHCP snooper will never be populated
-        if ipv4_pkt.next_header() == IpProtocol::Udp {
+        // Allow communication with host
+        if ipv4_pkt.dst_addr() == self.host.gateway_ip {
+            return Some(());
+        }
+
+        if ipv4_pkt.protocol() == IpProtocol::Udp {
             let udp_pkt = UdpPacket::new_checked(ipv4_pkt.payload()).ok()?;
 
+            // Allow DNS communication with the DNS-servers provided by DHCP
+            if udp_pkt.is_dns_request() && self.dhcp_snooper.valid_dns_target(&ipv4_pkt.dst_addr())
+            {
+                return Some(());
+            }
+
             // Allow DHCP communication with the bootpd(8) on host via broadcast address
             if udp_pkt.is_dhcp_request() && ipv4_pkt.dst_addr().is_broadcast() {
                 return Some(());

rust-toolchain

@@ -0,0 +1 @@
+nightly

rust-toolchain.toml

@@ -1,2 +0,0 @@
-[toolchain]
-channel = "nightly"

src/main.rs

@@ -1,13 +1,8 @@
-use anyhow::{Context, anyhow};
+use anyhow::{anyhow, Context};
 use clap::Parser;
-use ipnet::Ipv4Net;
-use log::LevelFilter;
-use nix::sys::signal::{SigHandler, Signal, signal};
-use oslog::OsLogger;
-use prefix_trie::PrefixSet;
+use nix::sys::signal::{signal, SigHandler, Signal};
 use privdrop::PrivDrop;
 use softnet::NetType;
-use softnet::proxy::ExposedPort;
 use softnet::proxy::Proxy;
 use std::borrow::Cow;
 use std::env;
@@ -34,7 +29,7 @@ struct Args {
     #[clap(long, help = "MAC address to enforce for the VM")]
     vm_mac_address: mac_address::MacAddress,
 
-    #[clap(long, value_enum, help = "type of network to use for the VM", default_value_t=NetType::Nat)]
+    #[clap(long, arg_enum, help = "type of network to use for the VM", default_value_t=NetType::Nat)]
     vm_net_type: NetType,
 
     #[clap(
@@ -50,42 +45,6 @@ struct Args {
     #[clap(long, help = "group name to drop privileges to")]
     group: Option<String>,
 
-    #[clap(
-        long,
-        help = "Comma-separated list of CIDRs to allow the traffic to \
-        (e.g. --allow=192.168.0.0/24 may be used to allow a LAN access for a VM). \
-        When used with --block, the longest prefix match always wins. \
-        In case an identical prefix is both --allow'ed and --block'ed, \
-        blocking will take precedence. --allow=0.0.0.0/0 is a special case, \
-        it additionally disables bridge isolation (even when --block=0.0.0.0/0 is specified).",
-        value_name = "comma-separated CIDRs",
-        use_value_delimiter = true,
-        action = clap::ArgAction::Set
-    )]
-    allow: Vec<Ipv4Net>,
-
-    #[clap(
-        long,
-        help = "Comma-separated list of CIDRs to block the traffic to \
-        (e.g. --block=0.0.0.0/0 may be used to establish a default deny policy \
-        that is further relaxed with --allow). When used with --allow, \
-        the longest prefix match always wins. In case the same prefix is both \
-        --allow'ed and --block'ed, blocking takes precedence.",
-        value_name = "comma-separated CIDRs",
-        use_value_delimiter = true,
-        action = clap::ArgAction::Set
-    )]
-    block: Vec<Ipv4Net>,
-
-    #[clap(
-        long,
-        help = "comma-separated list of TCP ports to expose (e.g. --expose 2222:22,8080:80)",
-        value_name = "comma-separated port specifications",
-        use_value_delimiter = true,
-        action = clap::ArgAction::Set
-    )]
-    expose: Vec<ExposedPort>,
-
     #[clap(long, hide = true)]
     sudo_escalation_probing: bool,
 
@@ -96,9 +55,7 @@ struct Args {
 fn main() -> ExitCode {
     // Enable backtraces by default
     if env::var("RUST_BACKTRACE").is_err() {
-        unsafe {
-            env::set_var("RUST_BACKTRACE", "full");
-        }
+        env::set_var("RUST_BACKTRACE", "full");
     }
 
     // Initialize Sentry
@@ -132,11 +89,6 @@ fn main() -> ExitCode {
 }
 
 fn try_main() -> anyhow::Result<()> {
-    // Initialize logger
-    OsLogger::new("org.cirruslabs.softnet")
-        .level_filter(LevelFilter::Info)
-        .init()?;
-
     // The default signal(3)[1] action for SIGINT is to interrupt program,
     // but we want to handle SIGINT ourselves, so we ignore it. The kqueue(2)'s[2]
     // EVFILT_SIGNAL will receive it anyways, because it has lower precedence.
@@ -192,15 +144,8 @@ fn try_main() -> anyhow::Result<()> {
     set_bootpd_lease_time(args.bootpd_lease_time);
 
     // Initialize the proxy while still having the root privileges
-    let mut proxy = Proxy::new(
-        args.vm_fd as RawFd,
-        args.vm_mac_address,
-        args.vm_net_type,
-        PrefixSet::from_iter(args.allow),
-        PrefixSet::from_iter(args.block),
-        args.expose,
-    )
-    .context("failed to initialize proxy")?;
+    let mut proxy = Proxy::new(args.vm_fd as RawFd, args.vm_mac_address, args.vm_net_type)
+        .context("failed to initialize proxy")?;
 
     // Drop effective privileges to the user
     // and group which have had invoked us