Limit allowed private address space to avoid long CIDR strings (#215)

Bumps the all-updates group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [privdrop](https://github.com/jedisct1/rust-privdrop) | `0.5.6` | `0.5.7` |
| [sentry](https://github.com/getsentry/sentry-rust) | `0.49.2` | `0.49.3` |
| [sentry-anyhow](https://github.com/getsentry/sentry-rust) | `0.49.2` | `0.49.3` |
| [rand](https://github.com/rust-random/rand) | `0.10.1` | `0.10.3` |
| [coarsetime](https://github.com/jedisct1/rust-coarsetime) | `0.1.37` | `0.1.38` |
| [jsonrpsee-types](https://github.com/paritytech/jsonrpsee) | `0.26.0` | `0.26.1` |


Updates `privdrop` from 0.5.6 to 0.5.7
- [Commits](https://github.com/jedisct1/rust-privdrop/compare/0.5.6...0.5.7)

Updates `sentry` from 0.49.2 to 0.49.3
- [Release notes](https://github.com/getsentry/sentry-rust/releases)
- [Changelog](https://github.com/getsentry/sentry-rust/blob/master/CHANGELOG.md)
- [Commits](https://github.com/getsentry/sentry-rust/compare/0.49.2...0.49.3)

Updates `sentry-anyhow` from 0.49.2 to 0.49.3
- [Release notes](https://github.com/getsentry/sentry-rust/releases)
- [Changelog](https://github.com/getsentry/sentry-rust/blob/master/CHANGELOG.md)
- [Commits](https://github.com/getsentry/sentry-rust/compare/0.49.2...0.49.3)

Updates `rand` from 0.10.1 to 0.10.3
- [Release notes](https://github.com/rust-random/rand/releases)
- [Changelog](https://github.com/rust-random/rand/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rust-random/rand/compare/0.10.1...0.10.3)

Updates `coarsetime` from 0.1.37 to 0.1.38
- [Release notes](https://github.com/jedisct1/rust-coarsetime/releases)
- [Commits](https://github.com/jedisct1/rust-coarsetime/compare/0.1.37...0.1.38)

Updates `jsonrpsee-types` from 0.26.0 to 0.26.1
- [Release notes](https://github.com/paritytech/jsonrpsee/releases)
- [Changelog](https://github.com/paritytech/jsonrpsee/blob/master/CHANGELOG.md)
- [Commits](https://github.com/paritytech/jsonrpsee/compare/v0.26.0...v0.26.1)

---
updated-dependencies:
- dependency-name: privdrop
  dependency-version: 0.5.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-updates
- dependency-name: sentry
  dependency-version: 0.49.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-updates
- dependency-name: sentry-anyhow
  dependency-version: 0.49.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-updates
- dependency-name: rand
  dependency-version: 0.10.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-updates
- dependency-name: coarsetime
  dependency-version: 0.1.38
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-updates
- dependency-name: jsonrpsee-types
  dependency-version: 0.26.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.cargo/config.toml

@@ -1,2 +1,5 @@
+[env]
+MACOSX_DEPLOYMENT_TARGET = "26.0"
+
 [target.aarch64-apple-darwin]
 runner = 'sudo -E'

.github/workflows/ci.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: macos-26
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - name: Install Rust
         run: |
           curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal
@@ -34,7 +34,7 @@ jobs:
     runs-on: macos-26
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - name: Install Rust
         run: |
           curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal

.github/workflows/release.yml

@@ -17,7 +17,7 @@ jobs:
     environment: publish
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -45,7 +45,7 @@ jobs:
           permission-contents: write
           permission-pull-requests: write
       - name: Release
-        uses: goreleaser/goreleaser-action@v7
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
         with:
           distribution: goreleaser-pro
           version: "~> v2"
@@ -61,7 +61,7 @@ jobs:
     runs-on: macos-26
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -72,13 +72,13 @@ jobs:
       - name: Install release targets
         run: rustup target add aarch64-apple-darwin x86_64-apple-darwin
       - name: Release dry run
-        uses: goreleaser/goreleaser-action@v7
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
         with:
           distribution: goreleaser-pro
           version: "~> v2"
           args: release --skip=publish --snapshot --clean
       - name: Upload dry-run artifacts
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: softnet-snapshot
           path: dist/**

.goreleaser.yml

@@ -5,6 +5,8 @@ project_name: softnet
 builds:
   - builder: rust
     command: build
+    env:
+      - SOFTNET_VERSION={{ .Version }}-{{ .ShortCommit }}
     targets:
       - aarch64-apple-darwin
       - x86_64-apple-darwin
@@ -36,5 +38,5 @@ brews:
     skip_upload: auto
     custom_block: |
       on_macos do
-        depends_on :macos => :sequoia
+        depends_on :macos => :tahoe
       end

Cargo.toml

@@ -16,7 +16,7 @@ smoltcp = "0"
 libc = "0"
 polling = "3"
 dhcproto = { git = "https://github.com/bluecatengineering/dhcproto.git", branch = "master" }
-vmnet = "0.5.1"
+vmnet = "0.7.0"
 clap = { version = "4", features = ["derive"] }
 mac_address = "1"
 privdrop = "0"
@@ -28,11 +28,13 @@ num_enum = "0"
 sentry = { version = "0", features = ["debug-images"] }
 sentry-anyhow = { version = "0", features = ["backtrace"] }
 nix = { version = "0", features = ["signal", "socket"] }
+network-interface = "2"
 prefix-trie = "0"
 ipnet = "2"
+rand = "0.10"
 oslog = "0.2.0"
 log = "0.4.29"
-serial_test = "3"
+serial_test = "4"
 coarsetime = "0.1.37"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"

README.md

@@ -23,12 +23,7 @@ Softnet solves two problems:
 2. DHCP exhaustion
     * macOS built-in DHCP-server allocates a `/24` subnet with 86400 seconds lease time by default, which only allows for ~253 VMs a day (or 1 VM every ~6 minutes) to be spawned without causing a denial-of-service, which is pretty limiting for CI services like Cirrus CI
 
-And assumes that:
+Each VM gets a separate [`vmnet` network](https://developer.apple.com/documentation/vmnet/vmnet_network_create(_:_:)) with a private `/29` subnet selected to avoid overlap with existing host interface subnets. Softnet reserves an IP-address for the VM's MAC-address, delivers it through its own DHCP-server, and uses the reserved address for packet filtering.
-
-1. Tart gives it's VMs unique MAC-addresses
-2. macOS built-in DHCP-server won't re-use the IP-addresses from it's pool until their lease expire
-
-...otherwise it's possible for two VMs to receive an identical IP-address from the macOS built-in DHCP-server (even in the presence of Softnet's packet filtering) and thus bypass the protections offered by Softnet.
 
 ### Stateful flow authorization
 
@@ -59,6 +54,8 @@ For ICMP, stateful flow authorization supports only echo requests and replies.
 
 ## Installing
 
+Softnet requires macOS 26 or newer; building also requires the macOS 26 SDK or newer.
+
 For proper functioning, Softnet binary requires two things:
 
 * a [SUID-bit](https://en.wikipedia.org/wiki/Setuid#SUID) to be set on the binary or a [passwordless sudo](https://serverfault.com/questions/160581/how-to-setup-passwordless-sudo-on-linux) to be configured, which effectively gives the binary `root` privileges

lib/dhcp_server/mod.rs

@@ -0,0 +1,389 @@
+use anyhow::Result;
+use dhcproto::v4::{
+    CLIENT_PORT, DhcpOption, Flags, HType, Message, MessageType, Opcode, OptionCode, SERVER_PORT,
+};
+use dhcproto::{Decodable, Encodable};
+use smoltcp::phy::ChecksumCapabilities;
+use smoltcp::wire::{
+    ETHERNET_HEADER_LEN, EthernetAddress, EthernetFrame, EthernetProtocol, IpAddress, IpProtocol,
+    Ipv4Address, Ipv4Packet, Ipv4Repr, UDP_HEADER_LEN, UdpPacket, UdpRepr,
+};
+
+pub(crate) const DHCP_SERVER_MAC: EthernetAddress = EthernetAddress([0x02, 0, 0, 0, 0, 1]);
+
+pub(crate) struct DhcpServer {
+    vm_mac: EthernetAddress,
+    vm_ip: Ipv4Address,
+    subnet_mask: Ipv4Address,
+    gateway_ip: Ipv4Address,
+}
+
+impl DhcpServer {
+    /// Creates a DHCP server for the VM's reserved IPv4 configuration.
+    pub fn new(
+        vm_mac: EthernetAddress,
+        vm_ip: Ipv4Address,
+        subnet_mask: Ipv4Address,
+        gateway_ip: Ipv4Address,
+    ) -> Self {
+        Self {
+            vm_mac,
+            vm_ip,
+            subnet_mask,
+            gateway_ip,
+        }
+    }
+
+    /// Returns a reply for a request sent to the DHCP server port.
+    pub fn receive_vm(
+        &self,
+        ip: &Ipv4Packet<&[u8]>,
+        udp: &UdpPacket<&[u8]>,
+    ) -> Result<Option<Vec<u8>>> {
+        // Accept only intact DHCP client datagrams with valid checksums
+        if udp.src_port() != CLIENT_PORT
+            || !ip.verify_checksum()
+            || ip.more_frags()
+            || ip.frag_offset() != 0
+            || UdpRepr::parse(
+                udp,
+                &IpAddress::Ipv4(ip.src_addr()),
+                &IpAddress::Ipv4(ip.dst_addr()),
+                &ChecksumCapabilities::default(),
+            )
+            .is_err()
+        {
+            return Ok(None);
+        }
+
+        // Only accept broadcasts or requests addressed to our gateway
+        if !(ip.dst_addr().is_broadcast() || ip.dst_addr() == self.gateway_ip) {
+            return Ok(None);
+        }
+
+        // Decode the DHCP request
+        let Ok(request) = Message::from_bytes(udp.payload()) else {
+            return Ok(None);
+        };
+
+        // Allow REQUESTs from an obsolete address so the VM can receive a NAK
+        if request.opts().msg_type() != Some(MessageType::Request)
+            && !ip.src_addr().is_unspecified()
+            && self.vm_ip != ip.src_addr()
+        {
+            return Ok(None);
+        }
+
+        // Build a reply if the request is supported
+        if let Some(reply) = self.receive(&request) {
+            // Broadcast NAKs and requested broadcasts; otherwise unicast to the VM
+            let (destination_mac, destination_ip) =
+                if reply.opts().msg_type() == Some(MessageType::Nak) || request.flags().broadcast()
+                {
+                    (EthernetAddress::BROADCAST, Ipv4Address::BROADCAST)
+                } else if !request.ciaddr().is_unspecified() {
+                    (self.vm_mac, request.ciaddr())
+                } else {
+                    (self.vm_mac, reply.yiaddr())
+                };
+
+            // Encode the reply for delivery to the VM
+            let packet = encode_packet(
+                &reply,
+                DHCP_SERVER_MAC,
+                destination_mac,
+                self.gateway_ip,
+                destination_ip,
+                SERVER_PORT,
+                CLIENT_PORT,
+            )?;
+            return Ok(Some(packet));
+        }
+
+        Ok(None)
+    }
+
+    /// Handles a DHCP request from the attached VM.
+    fn receive(&self, request: &Message) -> Option<Message> {
+        // Only accept direct Ethernet requests from the attached VM
+        if request.opcode() != Opcode::BootRequest
+            || request.htype() != HType::Eth
+            || request.hlen() != self.vm_mac.0.len() as u8
+            || request.chaddr() != self.vm_mac.0
+            || !request.giaddr().is_unspecified()
+        {
+            return None;
+        }
+
+        // Ignore requests that select another DHCP server
+        let server_id = match request.opts().get(OptionCode::ServerIdentifier) {
+            Some(DhcpOption::ServerIdentifier(address)) => Some(*address),
+            _ => None,
+        };
+        if server_id.is_some_and(|address| address != self.gateway_ip) {
+            return None;
+        }
+
+        // Read the requested address, if supplied
+        let requested_ip = match request.opts().get(OptionCode::RequestedIpAddress) {
+            Some(DhcpOption::RequestedIpAddress(address)) => Some(*address),
+            _ => None,
+        };
+
+        // Offer the reserved address or validate a request for it
+        match request.opts().msg_type()? {
+            MessageType::Discover if request.ciaddr().is_unspecified() && server_id.is_none() => {
+                Some(self.address_reply(request, MessageType::Offer))
+            }
+            MessageType::Request => {
+                // Use option 50 for SELECTING/INIT-REBOOT and ciaddr for RENEWING/REBINDING
+                let address = match (server_id, requested_ip, request.ciaddr().is_unspecified()) {
+                    (_, Some(address), true) => address,
+                    (None, None, false) => request.ciaddr(),
+                    _ => return None,
+                };
+
+                // Reject requests for any address other than the VM's reservation
+                if address != self.vm_ip {
+                    return Some(self.reply(request, MessageType::Nak));
+                }
+
+                // Acknowledge the reserved address
+                Some(self.address_reply(request, MessageType::Ack))
+            }
+            _ => None,
+        }
+    }
+
+    /// Builds an OFFER or ACK with the VM's reserved address and network configuration.
+    fn address_reply(&self, request: &Message, message_type: MessageType) -> Message {
+        // Include the reserved address and network configuration with an infinite lease
+        let mut reply = self.reply(request, message_type);
+        reply.set_yiaddr(self.vm_ip);
+        let options = reply.opts_mut();
+        options.insert(DhcpOption::SubnetMask(self.subnet_mask));
+        options.insert(DhcpOption::Router(vec![self.gateway_ip]));
+        options.insert(DhcpOption::DomainNameServer(vec![self.gateway_ip]));
+        options.insert(DhcpOption::AddressLeaseTime(u32::MAX));
+
+        reply
+    }
+
+    /// Builds a DHCP reply with the request's transaction and client identifiers.
+    fn reply(&self, request: &Message, message_type: MessageType) -> Message {
+        // Create a reply for the same client and transaction
+        let nak = message_type == MessageType::Nak;
+        let mut reply = Message::default();
+        reply
+            .set_xid(request.xid())
+            .set_chaddr(request.chaddr())
+            .set_opcode(Opcode::BootReply);
+
+        // Broadcast NAKs; otherwise retain the client's address and flags
+        if nak {
+            reply.set_flags(Flags::default().set_broadcast());
+        } else {
+            reply
+                .set_ciaddr(request.ciaddr())
+                .set_flags(request.flags());
+        }
+
+        // Identify the reply type and this DHCP server
+        let options = reply.opts_mut();
+        options.insert(DhcpOption::MessageType(message_type));
+        options.insert(DhcpOption::ServerIdentifier(self.gateway_ip));
+
+        // RFC 6842 requires echoing the client's identifier in every reply
+        if let Some(identifier) = request.opts().get(OptionCode::ClientIdentifier) {
+            options.insert(identifier.clone());
+        }
+
+        reply
+    }
+}
+
+/// Encodes a DHCP message in an Ethernet frame with IPv4 and UDP headers.
+fn encode_packet(
+    message: &Message,
+    source_mac: EthernetAddress,
+    destination_mac: EthernetAddress,
+    source_ip: Ipv4Address,
+    destination_ip: Ipv4Address,
+    source_port: u16,
+    destination_port: u16,
+) -> Result<Vec<u8>> {
+    // Pad the encoded message to the minimum BOOTP size, including short NAKs
+    let mut payload = message.to_vec()?;
+    payload.resize(payload.len().max(dhcproto::v4::MIN_PACKET_SIZE), 0);
+
+    // Allocate space for Ethernet, IPv4, UDP, and the DHCP payload
+    let ip_repr = Ipv4Repr {
+        src_addr: source_ip,
+        dst_addr: destination_ip,
+        next_header: IpProtocol::Udp,
+        payload_len: UDP_HEADER_LEN + payload.len(),
+        hop_limit: 64,
+    };
+    let mut bytes = vec![0; ETHERNET_HEADER_LEN + ip_repr.buffer_len() + ip_repr.payload_len];
+
+    // Write the Ethernet header
+    let mut ethernet = EthernetFrame::new_unchecked(bytes.as_mut_slice());
+    ethernet.set_src_addr(source_mac);
+    ethernet.set_dst_addr(destination_mac);
+    ethernet.set_ethertype(EthernetProtocol::Ipv4);
+
+    // Write the IPv4 header and checksum
+    let mut ip = Ipv4Packet::new_unchecked(ethernet.payload_mut());
+    ip_repr.emit(&mut ip, &ChecksumCapabilities::default());
+
+    // Write the UDP header, DHCP payload, and checksum
+    let mut udp = UdpPacket::new_unchecked(ip.payload_mut());
+    UdpRepr {
+        src_port: source_port,
+        dst_port: destination_port,
+    }
+    .emit(
+        &mut udp,
+        &IpAddress::Ipv4(source_ip),
+        &IpAddress::Ipv4(destination_ip),
+        payload.len(),
+        |buffer| buffer.copy_from_slice(&payload),
+        &ChecksumCapabilities::default(),
+    );
+
+    Ok(bytes)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{DHCP_SERVER_MAC, DhcpServer, encode_packet};
+    use dhcproto::Decodable;
+    use dhcproto::v4::{
+        CLIENT_PORT, DhcpOption, Message, MessageType, Opcode, OptionCode, SERVER_PORT,
+    };
+    use smoltcp::phy::ChecksumCapabilities;
+    use smoltcp::wire::{
+        EthernetAddress, EthernetFrame, Ipv4Address, Ipv4Packet, Ipv4Repr, UdpPacket, UdpRepr,
+    };
+
+    const VM: EthernetAddress = EthernetAddress([2, 0, 0, 0, 0, 2]);
+    const ADDRESS: Ipv4Address = Ipv4Address::new(192, 168, 1, 2);
+    const GATEWAY: Ipv4Address = Ipv4Address::new(192, 168, 1, 1);
+    const MASK: Ipv4Address = Ipv4Address::new(255, 255, 255, 252);
+    const CLIENT_ID: &[u8] = &[1, 2, 0, 0, 0, 0, 2];
+
+    #[test]
+    fn assigns_reserved_address() {
+        // Create a server and a client request
+        let dhcp = DhcpServer::new(VM, ADDRESS, MASK, GATEWAY);
+        let mut message = request(MessageType::Discover);
+
+        // Discover the reserved address
+        let (offer, destination) = exchange(&dhcp, &message, Ipv4Address::BROADCAST);
+        assert_eq!(offer.opts().msg_type(), Some(MessageType::Offer));
+        assert_eq!(offer.yiaddr(), ADDRESS);
+        assert_eq!(destination, ADDRESS);
+
+        // Request the offered address
+        message
+            .opts_mut()
+            .insert(DhcpOption::MessageType(MessageType::Request));
+        message
+            .opts_mut()
+            .insert(DhcpOption::RequestedIpAddress(offer.yiaddr()));
+        message
+            .opts_mut()
+            .insert(DhcpOption::ServerIdentifier(GATEWAY));
+        let (ack, destination) = exchange(&dhcp, &message, Ipv4Address::BROADCAST);
+
+        // Check the address and configuration in the acknowledgement
+        assert_eq!(ack.opcode(), Opcode::BootReply);
+        assert_eq!(ack.opts().msg_type(), Some(MessageType::Ack));
+        assert_eq!(ack.xid(), message.xid());
+        assert_eq!(ack.chaddr(), VM.0);
+        assert_eq!(ack.yiaddr(), ADDRESS);
+        assert_eq!(destination, ADDRESS);
+        for option in [
+            DhcpOption::ServerIdentifier(GATEWAY),
+            DhcpOption::SubnetMask(MASK),
+            DhcpOption::Router(vec![GATEWAY]),
+            DhcpOption::DomainNameServer(vec![GATEWAY]),
+            DhcpOption::AddressLeaseTime(u32::MAX),
+            DhcpOption::ClientIdentifier(CLIENT_ID.to_vec()),
+        ] {
+            assert_eq!(ack.opts().get(OptionCode::from(&option)), Some(&option));
+        }
+    }
+
+    #[test]
+    fn renews_reserved_address_and_rejects_stale_address() {
+        // Renew the reserved address
+        let dhcp = DhcpServer::new(VM, ADDRESS, MASK, GATEWAY);
+        let mut message = request(MessageType::Request);
+        message.set_ciaddr(ADDRESS);
+        let (ack, destination) = exchange(&dhcp, &message, GATEWAY);
+        assert_eq!(ack.opts().msg_type(), Some(MessageType::Ack));
+        assert_eq!(ack.yiaddr(), ADDRESS);
+        assert_eq!(destination, ADDRESS);
+
+        // Broadcast a NAK when the client renews an old address
+        message.set_ciaddr(Ipv4Address::new(192, 168, 2, 2));
+        let (nak, destination) = exchange(&dhcp, &message, GATEWAY);
+        assert_eq!(nak.opts().msg_type(), Some(MessageType::Nak));
+        assert!(nak.yiaddr().is_unspecified());
+        assert_eq!(destination, Ipv4Address::BROADCAST);
+    }
+
+    fn request(kind: MessageType) -> Message {
+        let mut message = Message::default();
+        message.set_xid(42).set_chaddr(&VM.0);
+        message.opts_mut().insert(DhcpOption::MessageType(kind));
+        message
+            .opts_mut()
+            .insert(DhcpOption::ClientIdentifier(CLIENT_ID.to_vec()));
+        message
+    }
+
+    fn exchange(
+        dhcp: &DhcpServer,
+        request: &Message,
+        destination: Ipv4Address,
+    ) -> (Message, Ipv4Address) {
+        // Encode the client request
+        let frame = encode_packet(
+            request,
+            VM,
+            EthernetAddress::BROADCAST,
+            request.ciaddr(),
+            destination,
+            CLIENT_PORT,
+            SERVER_PORT,
+        )
+        .unwrap();
+
+        // Pass the packet to the DHCP server
+        let ethernet = EthernetFrame::new_checked(frame.as_slice()).unwrap();
+        let ip = Ipv4Packet::new_checked(ethernet.payload()).unwrap();
+        let udp = UdpPacket::new_unchecked(ip.payload());
+        let frame = dhcp
+            .receive_vm(&ip, &udp)
+            .unwrap()
+            .expect("expected a DHCP reply");
+
+        // Decode and validate the reply
+        let ethernet = EthernetFrame::new_checked(frame.as_slice()).unwrap();
+        let ip = Ipv4Packet::new_unchecked(ethernet.payload());
+        Ipv4Repr::parse(&ip, &ChecksumCapabilities::default()).unwrap();
+        let udp = UdpPacket::new_unchecked(ip.payload());
+        UdpRepr::parse(
+            &udp,
+            &ip.src_addr().into(),
+            &ip.dst_addr().into(),
+            &ChecksumCapabilities::default(),
+        )
+        .unwrap();
+        assert_eq!(ethernet.src_addr(), DHCP_SERVER_MAC);
+        assert_eq!(ip.src_addr(), GATEWAY);
+        (Message::from_bytes(udp.payload()).unwrap(), ip.dst_addr())
+    }
+}

lib/dhcp_snooper.rs

@@ -1,175 +0,0 @@
-use dhcproto::Decodable;
-use dhcproto::v4::{DhcpOption, HType, MessageType, Opcode, OptionCode};
-use smoltcp::wire::Ipv4Address;
-use std::collections::HashSet;
-use std::time::Duration;
-
-#[derive(Default)]
-pub struct DhcpSnooper {
-    vm_mac_address: [u8; 6],
-    vm_lease: Option<Lease>,
-    uncertainty_duration: Duration,
-}
-
-impl DhcpSnooper {
-    pub fn new(uncertainty_duration: Duration, vm_mac_address: [u8; 6]) -> Self {
-        DhcpSnooper {
-            vm_mac_address,
-            uncertainty_duration,
-            ..Default::default()
-        }
-    }
-
-    pub fn register_dhcp_reply(&mut self, dhcp_packet: &[u8]) {
-        let mut decoder = dhcproto::v4::Decoder::new(dhcp_packet);
-
-        let message = match dhcproto::v4::Message::decode(&mut decoder) {
-            Ok(message) => message,
-            Err(_) => return,
-        };
-
-        // Decoded DHCP replies may be broadcast[1], so additionally validate the BOOTP client
-        // hardware address to avoid acting on another VM's lease transition
-        //
-        // [1]: https://datatracker.ietf.org/doc/html/rfc2131#section-4.1
-        if message.opcode() != Opcode::BootReply
-            || message.htype() != HType::Eth
-            || message.hlen() != self.vm_mac_address.len() as u8
-            || message.chaddr() != self.vm_mac_address
-        {
-            return;
-        }
-
-        match message.opts().msg_type() {
-            Some(MessageType::Ack) => {
-                let lease_time = match message.opts().get(OptionCode::AddressLeaseTime) {
-                    Some(DhcpOption::AddressLeaseTime(lease_time)) => lease_time,
-                    _ => return,
-                };
-
-                let dns_ips = match message.opts().get(OptionCode::DomainNameServer) {
-                    Some(DhcpOption::DomainNameServer(dns_ips)) => {
-                        HashSet::from_iter(dns_ips.iter().cloned())
-                    }
-                    _ => HashSet::new(),
-                };
-
-                let mut lease_duration = Duration::from_secs(*lease_time as u64);
-
-                // Adjust for uncertainty caused by using a coarse clock
-                lease_duration = lease_duration.saturating_sub(self.uncertainty_duration);
-
-                self.vm_lease = Some(Lease::new(message.yiaddr(), lease_duration, dns_ips))
-            }
-            Some(MessageType::Nak) => {
-                self.vm_lease = None;
-            }
-            _ => {}
-        };
-    }
-
-    #[cfg(test)]
-    pub(crate) fn set_lease(&mut self, vm_lease: Option<Lease>) {
-        self.vm_lease = vm_lease
-    }
-
-    pub fn lease(&self) -> &Option<Lease> {
-        &self.vm_lease
-    }
-
-    pub(crate) fn address_and_dns_ips(&self) -> Option<(Ipv4Address, HashSet<Ipv4Address>)> {
-        let lease = self.vm_lease.as_ref().filter(|lease| lease.valid())?;
-        Some((lease.address(), lease.dns_ips.clone()))
-    }
-
-    pub fn valid_dns_target(&self, addr: &Ipv4Address) -> bool {
-        if let Some(lease) = &self.vm_lease {
-            return lease.dns_ips.contains(addr);
-        }
-
-        false
-    }
-}
-
-#[derive(Debug)]
-pub struct Lease {
-    address: Ipv4Address,
-    valid_until: coarsetime::Instant,
-    dns_ips: HashSet<Ipv4Address>,
-}
-
-impl Lease {
-    pub fn new(address: Ipv4Address, lease_time: Duration, dns_ips: HashSet<Ipv4Address>) -> Lease {
-        Lease {
-            address,
-            valid_until: coarsetime::Instant::recent() + lease_time.into(),
-            dns_ips,
-        }
-    }
-
-    pub fn address(&self) -> Ipv4Address {
-        self.address
-    }
-
-    pub fn valid(&self) -> bool {
-        coarsetime::Instant::recent() < self.valid_until
-    }
-
-    pub fn is_valid_for(&self, address: Ipv4Address) -> bool {
-        self.address == address && self.valid()
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::{DhcpSnooper, Lease};
-    use dhcproto::v4::{DhcpOption, Message, MessageType, Opcode};
-    use dhcproto::{Encodable, Encoder};
-    use smoltcp::wire::Ipv4Address;
-    use std::collections::HashSet;
-    use std::time::Duration;
-
-    const VM_MAC: [u8; 6] = [0x02, 0x00, 0x00, 0x00, 0x00, 0x01];
-    const OTHER_MAC: [u8; 6] = [0x02, 0x00, 0x00, 0x00, 0x00, 0x02];
-    const OLD_ADDRESS: Ipv4Address = Ipv4Address::new(192, 168, 64, 2);
-
-    #[test]
-    fn processes_replies_only_for_matching_client() {
-        // Start with an active lease
-        let mut snooper = DhcpSnooper::new(Duration::ZERO, VM_MAC);
-        snooper.set_lease(Some(Lease::new(
-            OLD_ADDRESS,
-            Duration::from_secs(600),
-            HashSet::new(),
-        )));
-
-        // Ignore a NAK for another client
-        let mut message = Message::new(
-            Ipv4Address::UNSPECIFIED,
-            Ipv4Address::UNSPECIFIED,
-            Ipv4Address::UNSPECIFIED,
-            Ipv4Address::UNSPECIFIED,
-            &OTHER_MAC,
-        );
-        message.set_opcode(Opcode::BootReply);
-        message
-            .opts_mut()
-            .insert(DhcpOption::MessageType(MessageType::Nak));
-
-        let mut encoded = Vec::new();
-        message.encode(&mut Encoder::new(&mut encoded)).unwrap();
-
-        snooper.register_dhcp_reply(&encoded);
-
-        assert_eq!(snooper.lease().as_ref().unwrap().address(), OLD_ADDRESS);
-
-        // Process a NAK for the matching client
-        message.set_chaddr(&VM_MAC);
-        encoded.clear();
-        message.encode(&mut Encoder::new(&mut encoded)).unwrap();
-
-        snooper.register_dhcp_reply(&encoded);
-
-        assert!(snooper.lease().is_none());
-    }
-}

lib/host.rs

@@ -1,15 +1,16 @@
+use crate::subnet_finder;
 use anyhow::{Context, Result, anyhow};
 use clap::ValueEnum;
 use log::info;
+use smoltcp::wire::EthernetAddress;
 use std::net::Ipv4Addr;
 use std::os::unix::io::{AsRawFd, RawFd};
 use std::os::unix::net::UnixDatagram;
-use std::str::FromStr;
 use std::sync::mpsc::{SyncSender, sync_channel};
-use vmnet::mode::Mode;
+use vmnet::network::Mode;
 use vmnet::parameters::{Parameter, ParameterKind};
 use vmnet::port_forwarding::{AddressFamily, Protocol};
-use vmnet::{Batch, Events, Options};
+use vmnet::{Batch, Events, Network, NetworkConfiguration, Options};
 
 #[derive(ValueEnum, Clone, Debug)]
 pub enum NetType {
@@ -27,6 +28,8 @@ pub struct Host {
     interface: vmnet::Interface,
     new_packets_rx: UnixDatagram,
     callback_can_continue_tx: SyncSender<()>,
+    pub vm_ip: Ipv4Addr,
+    pub subnet_mask: Ipv4Addr,
     pub gateway_ip: smoltcp::wire::Ipv4Address,
     pub max_packet_size: u64,
     pub read_max_packets: u64,
@@ -34,31 +37,49 @@ pub struct Host {
 }
 
 impl Host {
-    pub fn new(vm_net_type: NetType, enable_isolation: bool) -> Result<Host> {
+    pub fn new(
-        // Initialize a vmnet.framework NAT or Host interface with isolation enabled
+        vm_net_type: NetType,
-        let mut interface = vmnet::Interface::new(
+        vm_mac: EthernetAddress,
-            match vm_net_type {
+        enable_isolation: bool,
-                NetType::Nat => Mode::Shared(Default::default()),
+    ) -> Result<Host> {
-                NetType::Host => Mode::Host(Default::default()),
+        // Find an unused /29 subnet for the gateway and VM
-            },
+        let (gateway_ip, vm_ip, subnet) = subnet_finder::find_available_subnet(29)?;
+
+        // Create vmnet's network configuration
+        let mut configuration = NetworkConfiguration::new(match vm_net_type {
+            NetType::Nat => Mode::Shared,
+            NetType::Host => Mode::Host,
+        })
+        .context("failed to create vmnet network configuration")?;
+
+        // Configure the gateway address and subnet mask
+        let subnet_mask = subnet.netmask();
+        configuration
+            .set_ipv4_subnet(gateway_ip, subnet_mask)
+            .context("failed to configure IPv4 subnet")?;
+
+        // Reserve the VM's address for its MAC
+        configuration
+            .add_dhcp_reservation(vm_mac.0, vm_ip)
+            .context("failed to add DHCP address reservation")?;
+
+        // Create vmnet's network
+        let network = Network::new(&configuration)
+            .with_context(|| format!("failed to create vmnet network {subnet}"))?;
+
+        // Instantiate vmnet's interface
+        //
+        // The interface retains the network reservation until it is stopped
+        let mut interface = vmnet::Interface::with_network(
+            &network,
             Options {
+                allocate_mac_address: Some(false),
                 enable_isolation: Some(enable_isolation),
                 ..Default::default()
             },
         )
         .context("failed to initialize vmnet interface")?;
 
-        // Retrieve first IP (gateway) used for this interface
-        let Some(Parameter::StartAddress(gateway_ip)) =
-            interface.parameters().get(ParameterKind::StartAddress)
-        else {
-            return Err(anyhow!(
-                "failed to retrieve vmnet's interface start address"
-            ));
-        };
-        let gateway_ip = Ipv4Addr::from_str(&gateway_ip)
-            .context("failed to parse vmnet's interface start address")?;
-
         // Retrieve max packet size for this interface
         let Some(Parameter::MaxPacketSize(max_packet_size)) =
             interface.parameters().get(ParameterKind::MaxPacketSize)
@@ -104,6 +125,8 @@ impl Host {
             interface,
             new_packets_rx,
             callback_can_continue_tx,
+            vm_ip,
+            subnet_mask,
             gateway_ip,
             max_packet_size,
             read_max_packets,
@@ -135,15 +158,6 @@ impl Host {
             .map_err(|err| anyhow!("failed to add port forwarding rule {details}: {err}"))
     }
 
-    pub fn port_forwarding_remove_rule(&mut self, external_port: u16) -> Result<()> {
-        let details = format!("external_port={external_port}");
-
-        self.interface
-            .port_forwarding_rule_remove(AddressFamily::Ipv4, Protocol::Tcp, external_port)
-            .map(|_| info!("removed port forwarding rule {details}"))
-            .map_err(|err| anyhow!("failed to remove port forwarding rule {details}: {err}"))
-    }
-
     pub fn read(&mut self, batch: &mut Batch, bufs: &mut [Vec<u8>]) -> vmnet::Result<usize> {
         // Dequeue dummy datagram from the socket (if any)
         // to free up buffer space and reduce false-positives

lib/mod.rs

@@ -1,6 +1,7 @@
-mod dhcp_snooper;
+mod dhcp_server;
 mod host;
 pub use host::NetType;
 mod poller;
 pub mod proxy;
+mod subnet_finder;
 mod vm;

lib/poller.rs

@@ -10,6 +10,7 @@ pub struct Poller<'poller> {
     poller: polling::Poller,
     events: polling::Events,
     timeout: Duration,
+    last_periodic_tick: coarsetime::Instant,
     vm_fd: BorrowedFd<'poller>,
     host_fd: BorrowedFd<'poller>,
     control_fd: Option<BorrowedFd<'poller>>,
@@ -37,6 +38,7 @@ impl Poller<'_> {
             poller,
             events: polling::Events::new(),
             timeout,
+            last_periodic_tick: coarsetime::Instant::recent(),
             vm_fd: unsafe { BorrowedFd::borrow_raw(vm_fd) },
             host_fd: unsafe { BorrowedFd::borrow_raw(host_fd) },
             control_fd: control_fd.map(|fd| unsafe { BorrowedFd::borrow_raw(fd) }),
@@ -94,6 +96,16 @@ impl Poller<'_> {
         Ok((vm_readable, host_readable, interrupt))
     }
 
+    pub fn periodic_tick_due(&mut self) -> bool {
+        let due = self.last_periodic_tick.elapsed_since_recent() >= self.timeout.into();
+
+        if due {
+            self.last_periodic_tick = coarsetime::Instant::recent();
+        }
+
+        due
+    }
+
     pub fn remove_control(&mut self) -> Result<()> {
         if let Some(control_fd) = self.control_fd.take() {
             self.poller.delete(control_fd)?;

lib/proxy/flows/mod.rs

@@ -152,10 +152,6 @@ impl FlowTable {
         true
     }
 
-    pub(crate) fn clear(&mut self) {
-        self.flows.clear();
-    }
-
     fn sweep_if_due(&mut self, now: Instant) {
         if now < self.next_sweep {
             return;

lib/proxy/host.rs

@@ -1,9 +1,9 @@
 use crate::proxy::flows::{FlowDirection, FlowMatch};
-use crate::proxy::udp_packet_helper::UdpPacketHelper;
 use crate::proxy::{Direction, PolicyDecision, Proxy};
 use anyhow::{Context, Result};
+use dhcproto::v4::{CLIENT_PORT, SERVER_PORT};
 use smoltcp::phy::ChecksumCapabilities;
-use smoltcp::wire::{EthernetFrame, EthernetProtocol, Ipv4Packet, Ipv4Repr, UdpPacket};
+use smoltcp::wire::{EthernetFrame, EthernetProtocol, IpProtocol, Ipv4Packet, Ipv4Repr, UdpPacket};
 
 impl Proxy<'_> {
     pub(crate) fn process_frame_from_host(&mut self, frame: &EthernetFrame<&[u8]>) -> Result<()> {
@@ -12,13 +12,11 @@ impl Proxy<'_> {
             return Ok(());
         }
 
-        // Snoop bootpd(8) replies from the host to
+        self.write_to_vm(frame.as_ref())
-        // figure out the IP assigned to the VM
+    }
-        if frame.dst_addr() == self.vm_mac_address || frame.dst_addr().is_broadcast() {
-            self.snoop(frame);
-        }
 
-        match self.vm.write(frame.as_ref()) {
+    pub(super) fn write_to_vm(&mut self, packet: &[u8]) -> Result<()> {
+        match self.vm.write(packet) {
             Ok(_) => Ok(()),
             Err(err) => {
                 if let Some(libc::ENOBUFS) = err.raw_os_error() {
@@ -52,24 +50,25 @@ impl Proxy<'_> {
     }
 
     pub(super) fn allowed_from_host_ipv4(&mut self, ipv4_pkt: &Ipv4Packet<&[u8]>) -> Option<()> {
+        // Drop external DHCP replies, including malformed and fragmented replies
+        if ipv4_pkt.next_header() == IpProtocol::Udp
+            && ipv4_pkt.frag_offset() == 0
+            && ipv4_pkt.payload().len() >= 4
+        {
+            let udp = UdpPacket::new_unchecked(ipv4_pkt.payload());
+            if udp.src_port() == SERVER_PORT && udp.dst_port() == CLIENT_PORT {
+                return None;
+            }
+        }
+
         // Backwards compatibility with Softnet consumers that only use stateless rules
         if self.flows.is_none() {
             return Some(());
         }
 
-        // DHCP is required to maintain the VM's lease and must bypass user-specified rules
-        if self.is_allowed_dhcp_response(ipv4_pkt) {
-            return Some(());
-        }
-
         // Consult the flow table before evaluating inbound policy
         // so established flows are not treated as new traffic
-        let pending = if self
+        let pending = if self.host.vm_ip == ipv4_pkt.dst_addr() {
-            .dhcp_snooper
-            .lease()
-            .as_ref()
-            .is_some_and(|lease| lease.is_valid_for(ipv4_pkt.dst_addr()))
-        {
             match self
                 .flows
                 .as_mut()?
@@ -105,44 +104,4 @@ impl Proxy<'_> {
             }
         }
     }
-
-    fn snoop(&mut self, frame: &EthernetFrame<&[u8]>) {
-        if frame.ethertype() != EthernetProtocol::Ipv4 {
-            return;
-        }
-
-        let ipv4_pkt = match Ipv4Packet::new_checked(frame.payload()) {
-            Ok(ipv4_pkt) => ipv4_pkt,
-            _ => return,
-        };
-
-        if !self.is_allowed_dhcp_response(&ipv4_pkt) {
-            return;
-        }
-
-        let udp_pkt = match UdpPacket::new_checked(ipv4_pkt.payload()) {
-            Ok(udp_pkt) => udp_pkt,
-            Err(_) => return,
-        };
-
-        let address_and_dns_ips_saved = self.dhcp_snooper.address_and_dns_ips();
-        self.dhcp_snooper.register_dhcp_reply(udp_pkt.payload());
-        if address_and_dns_ips_saved != self.dhcp_snooper.address_and_dns_ips()
-            && let Some(flows) = &mut self.flows
-        {
-            flows.clear();
-        }
-    }
-
-    fn is_allowed_dhcp_response(&self, ipv4_pkt: &Ipv4Packet<&[u8]>) -> bool {
-        if ipv4_pkt.src_addr() != self.host.gateway_ip
-            || ipv4_pkt.next_header() != smoltcp::wire::IpProtocol::Udp
-        {
-            return false;
-        }
-
-        UdpPacket::new_checked(ipv4_pkt.payload())
-            .map(|udp_pkt| udp_pkt.is_dhcp_response())
-            .unwrap_or(false)
-    }
 }

lib/proxy/mod.rs

@@ -2,27 +2,24 @@ mod control;
 mod exposed_port;
 mod flows;
 mod host;
-mod port_forwarder;
 mod rule;
 mod rules;
-mod udp_packet_helper;
 mod vm;
 
-use crate::dhcp_snooper::DhcpSnooper;
+use crate::dhcp_server::{DHCP_SERVER_MAC, DhcpServer};
 use crate::host::Host;
 use crate::host::NetType;
 use crate::poller::Poller;
 use crate::vm::VM;
-use anyhow::Result;
+use anyhow::{Context, Result, bail};
 use control::{Control, normalize_rules};
 pub use exposed_port::ExposedPort;
 use flows::{FlowTable, PendingFlow};
 use ipnet::Ipv4Net;
 use mac_address::MacAddress;
-use port_forwarder::PortForwarder;
 pub use rule::{Direction, Rule, Target};
 pub(crate) use rules::{PolicyDecision, Rules};
-use smoltcp::wire::{EthernetFrame, Ipv4Address};
+use smoltcp::wire::{EthernetAddress, EthernetFrame, Ipv4Address};
 use std::io::ErrorKind;
 use std::os::unix::io::{AsRawFd, RawFd};
 use std::time::Duration;
@@ -33,12 +30,11 @@ pub struct Proxy<'proxy> {
     host: Host,
     poller: Poller<'proxy>,
     vm_mac_address: smoltcp::wire::EthernetAddress,
-    dhcp_snooper: DhcpSnooper,
+    dhcp_server: DhcpServer,
     rules: Rules,
     control: Option<Control>,
     flows: Option<FlowTable>,
     enobufs_encountered: bool,
-    port_forwarder: PortForwarder,
 }
 
 impl Proxy<'_> {
@@ -51,12 +47,19 @@ impl Proxy<'_> {
         exposed_ports: Vec<ExposedPort>,
         control_fd: Option<RawFd>,
     ) -> Result<Proxy<'proxy>> {
+        // Ensure that VM's MAC address won't conflict with our DHCP server's MAC address
+        let vm_mac_address = EthernetAddress(vm_mac_address.bytes());
+        if vm_mac_address == DHCP_SERVER_MAC {
+            bail!("VM MAC address {vm_mac_address} is reserved for the DHCP server");
+        }
+
         let allow = normalize_rules(allow);
         let block = normalize_rules(block);
 
         let vm = VM::new(vm_fd)?;
-        let host = Host::new(
+        let mut host = Host::new(
             vm_net_type,
+            vm_mac_address,
             !allow.contains(&Rule::Stateless(Target::Prefix(Ipv4Net::default()))),
         )?;
         let poller_timeout = Duration::from_millis(100);
@@ -75,20 +78,34 @@ impl Proxy<'_> {
         let rules = Rules::new(host.gateway_ip, &allow, &block);
 
         // Any stateful rule enables flow inspection for the whole VM, including
-        // traffic admitted through implicit global, gateway, and DNS fallbacks
+        // traffic admitted through implicit global and gateway fallbacks
         let flows = rules.has_stateful().then(FlowTable::new);
 
+        // vmnet owns the gateway (including ARP and DNS); the VM address is
+        // reserved for this MAC for the lifetime of the attached interface.
+        let dhcp_server = DhcpServer::new(
+            vm_mac_address,
+            host.vm_ip,
+            host.subnet_mask,
+            host.gateway_ip,
+        );
+
+        // Install port forwardings for the reserved VM's IP address
+        for port in exposed_ports {
+            host.port_forwarding_add_rule(port.external_port, host.vm_ip, port.internal_port)
+                .context("failed to configure port forwarding")?;
+        }
+
         Ok(Proxy {
             vm,
             host,
             poller,
-            vm_mac_address: smoltcp::wire::EthernetAddress(vm_mac_address.bytes()),
+            vm_mac_address,
-            dhcp_snooper: DhcpSnooper::new(poller_timeout, vm_mac_address.bytes()),
+            dhcp_server,
             rules,
             control,
             flows,
             enobufs_encountered: false,
-            port_forwarder: PortForwarder::new(exposed_ports),
         })
     }
 
@@ -108,7 +125,7 @@ impl Proxy<'_> {
         loop {
             let (vm_readable, host_readable, interrupt) = self.poller.wait()?;
 
-            // Update coarse time for DHCP snooping and flows
+            // Update coarse time for flows
             coarsetime::Instant::update();
 
             // Service control on every wake (including timeouts) so a bounded read or a pending
@@ -128,10 +145,12 @@ impl Proxy<'_> {
                 return Ok(());
             }
 
-            // Timeout
+            // Periodic maintenance
-            if !vm_readable && !host_readable && !interrupt {
+            if self.poller.periodic_tick_due() {
-                self.port_forwarder
+                // kqueue(2) does not report peer disconnects for Unix datagram sockets
-                    .tick(&mut self.host, self.dhcp_snooper.lease());
+                if !self.vm.is_connected()? {
+                    return Ok(());
+                }
             }
 
             self.poller.rearm();
@@ -144,7 +163,7 @@ impl Proxy<'_> {
         loop {
             match self.vm.read(buf) {
                 Ok(n) => {
-                    // Update coarse time for DHCP snooping and flows
+                    // Update coarse time for flows
                     coarsetime::Instant::update();
 
                     if let Ok(frame) = EthernetFrame::new_checked(&buf[..n]) {
@@ -172,7 +191,7 @@ impl Proxy<'_> {
         loop {
             match self.host.read(batch, bufs) {
                 Ok(pktcnt) => {
-                    // Update coarse time for DHCP snooping and flows
+                    // Update coarse time for flows
                     coarsetime::Instant::update();
 
                     for buf in batch.packet_sized_bufs(bufs).take(pktcnt) {
@@ -258,22 +277,19 @@ impl Proxy<'_> {
 #[cfg(test)]
 mod tests {
     use crate::NetType;
-    use crate::dhcp_snooper::Lease;
     use crate::proxy::Proxy;
     use mac_address::MacAddress;
     use nix::sys::socket::{AddressFamily, SockFlag, SockType, socketpair};
     use serial_test::serial;
     use smoltcp::wire::{IpProtocol, Ipv4Address, Ipv4Packet, UdpPacket};
-    use std::collections::HashSet;
     use std::os::fd::AsRawFd;
     use std::str::FromStr;
-    use std::time::Duration;
 
     #[test]
     #[serial]
     fn test_blocking_takes_precedence() {
-        let vm_ip = Ipv4Address::from_str("192.168.0.2").unwrap();
+        let mut proxy = create_proxy(vec!["66.66.0.0/16"], vec!["66.66.0.0/16"]);
-        let mut proxy = create_proxy(vm_ip, vec!["66.66.0.0/16"], vec!["66.66.0.0/16"]);
+        let vm_ip = proxy.host.vm_ip;
 
         assert_eq!(proxy.rules.len(), 1);
 
@@ -283,8 +299,8 @@ mod tests {
     #[test]
     #[serial]
     fn test_longest_prefix_match_wins() {
-        let vm_ip = Ipv4Address::from_str("192.168.0.2").unwrap();
+        let mut proxy = create_proxy(vec!["33.33.33.33/32"], vec!["33.33.33.0/24"]);
-        let mut proxy = create_proxy(vm_ip, vec!["33.33.33.33/32"], vec!["33.33.33.0/24"]);
+        let vm_ip = proxy.host.vm_ip;
 
         assert_eq!(proxy.rules.len(), 2);
 
@@ -296,8 +312,8 @@ mod tests {
     #[test]
     #[serial]
     fn test_allow_host() {
-        let vm_ip = Ipv4Address::from_str("192.168.0.2").unwrap();
+        let mut proxy = create_proxy(vec!["@host"], vec!["0.0.0.0/0"]);
-        let mut proxy = create_proxy(vm_ip, vec!["@host"], vec!["0.0.0.0/0"]);
+        let vm_ip = proxy.host.vm_ip;
 
         assert_eq!(proxy.rules.len(), 2);
 
@@ -312,10 +328,10 @@ mod tests {
     #[test]
     #[serial]
     fn test_bare_default_block_applies_in_both_directions_in_stateful_mode() {
-        let vm_ip = Ipv4Address::new(192, 168, 0, 2);
+        let mut proxy = create_proxy(vec!["in 192.0.2.0/24"], vec!["0.0.0.0/0"]);
+        let vm_ip = proxy.host.vm_ip;
         let fallback_peer = Ipv4Address::new(203, 0, 113, 1);
         let explicitly_allowed_peer = Ipv4Address::new(192, 0, 2, 1);
-        let mut proxy = create_proxy(vm_ip, vec!["in 192.0.2.0/24"], vec!["0.0.0.0/0"]);
 
         let fallback_request = udp_packet(fallback_peer, 40_000, vm_ip, 1_234);
         let fallback_request = Ipv4Packet::new_checked(fallback_request.as_slice()).unwrap();
@@ -337,9 +353,9 @@ mod tests {
     #[test]
     #[serial]
     fn test_directional_egress_block_does_not_block_reply_to_unmatched_inbound_flow() {
-        let vm_ip = Ipv4Address::new(192, 168, 0, 2);
+        let mut proxy = create_proxy(vec![], vec!["out 203.0.113.0/24"]);
+        let vm_ip = proxy.host.vm_ip;
         let peer = Ipv4Address::new(203, 0, 113, 1);
-        let mut proxy = create_proxy(vm_ip, vec![], vec!["out 203.0.113.0/24"]);
 
         let request = udp_packet(peer, 40_000, vm_ip, 1_234);
         let request = Ipv4Packet::new_checked(request.as_slice()).unwrap();
@@ -353,9 +369,9 @@ mod tests {
     #[test]
     #[serial]
     fn test_directional_ingress_block_does_not_block_reply_to_bare_outbound_allow() {
-        let vm_ip = Ipv4Address::new(192, 168, 0, 2);
+        let mut proxy = create_proxy(vec!["203.0.113.0/24"], vec!["in 203.0.113.0/24"]);
+        let vm_ip = proxy.host.vm_ip;
         let peer = Ipv4Address::new(203, 0, 113, 1);
-        let mut proxy = create_proxy(vm_ip, vec!["203.0.113.0/24"], vec!["in 203.0.113.0/24"]);
 
         let request = udp_packet(vm_ip, 1_234, peer, 40_000);
         let request = Ipv4Packet::new_checked(request.as_slice()).unwrap();
@@ -366,7 +382,7 @@ mod tests {
         assert!(proxy.allowed_from_host_ipv4(&reply).is_some());
     }
 
-    fn create_proxy<'test>(vm_ip: Ipv4Address, allow: Vec<&str>, block: Vec<&str>) -> Proxy<'test> {
+    fn create_proxy<'test>(allow: Vec<&str>, block: Vec<&str>) -> Proxy<'test> {
         let (vm_fd, _) = socketpair(
             AddressFamily::Unix,
             SockType::Datagram,
@@ -376,9 +392,9 @@ mod tests {
         .unwrap();
         let vm_fd = Box::leak(Box::new(vm_fd));
 
-        let mut proxy = Proxy::new(
+        Proxy::new(
             vm_fd.as_raw_fd(),
-            MacAddress::from_str("02:00:00:00:00:01").unwrap(),
+            MacAddress::from_str("02:00:00:00:00:02").unwrap(),
             NetType::Nat,
             allow
                 .into_iter()
@@ -391,15 +407,7 @@ mod tests {
             Vec::default(),
             None,
         )
-        .unwrap();
+        .unwrap()
-
-        proxy.dhcp_snooper.set_lease(Some(Lease::new(
-            vm_ip,
-            Duration::from_secs(600),
-            HashSet::new(),
-        )));
-
-        proxy
     }
 
     fn allowed_from_vm_ipv4(proxy: &mut Proxy, src: Ipv4Address, dst: &str) -> Option<()> {

lib/proxy/port_forwarder.rs

@@ -1,99 +0,0 @@
-use crate::dhcp_snooper::Lease;
-use crate::host::Host;
-use crate::proxy::exposed_port::ExposedPort;
-use anyhow::Result;
-use log::error;
-use std::net::Ipv4Addr;
-
-#[derive(Default)]
-pub struct PortForwarder {
-    port_forwardings: Vec<PortForwarding>,
-    failed: bool,
-}
-
-#[derive(Debug, Clone, Copy, Default)]
-struct PortForwarding {
-    exposed_port: ExposedPort,
-    forwarding_to_addr: Option<Ipv4Addr>,
-}
-
-impl PortForwarder {
-    pub fn new(exposed_ports: Vec<ExposedPort>) -> PortForwarder {
-        let port_forwardings = exposed_ports
-            .into_iter()
-            .map(|exposed_port| PortForwarding {
-                exposed_port,
-                ..Default::default()
-            })
-            .collect();
-
-        PortForwarder {
-            port_forwardings,
-            ..Default::default()
-        }
-    }
-
-    pub fn tick(&mut self, host: &mut Host, lease: &Option<Lease>) {
-        if self.failed {
-            return;
-        }
-
-        if let Err(err) = self.tick_inner(host, lease) {
-            error!("port-forwarding failed: {}", err);
-
-            self.failed = true;
-        }
-    }
-
-    fn tick_inner(&mut self, host: &mut Host, lease: &Option<Lease>) -> Result<()> {
-        if let Some(lease) = lease {
-            // Lease exists, but is not valid, remove all port forwardings
-            if !lease.valid() {
-                self.remove_all_port_forwardings(host)?;
-
-                return Ok(());
-            }
-
-            // Lease exists and is valid, install/re-install port forwardings
-            for port_forwarding in &mut self.port_forwardings {
-                if let Some(installed_addr) = port_forwarding.forwarding_to_addr {
-                    // Port forwarding already installed, perhaps it's outdated?
-                    if installed_addr == lease.address() {
-                        // Nope, the port forwarding is up to date
-                        continue;
-                    }
-
-                    // Remove port forwarding since the lease address had changed
-                    host.port_forwarding_remove_rule(port_forwarding.exposed_port.external_port)?;
-                    port_forwarding.forwarding_to_addr = None;
-                }
-
-                // Install new port forwarding
-                host.port_forwarding_add_rule(
-                    port_forwarding.exposed_port.external_port,
-                    lease.address(),
-                    port_forwarding.exposed_port.internal_port,
-                )?;
-                port_forwarding.forwarding_to_addr = Some(lease.address());
-            }
-        } else {
-            // Lease does not exist, remove all port forwardings
-            self.remove_all_port_forwardings(host)?;
-        }
-
-        Ok(())
-    }
-
-    fn remove_all_port_forwardings(&mut self, host: &mut Host) -> Result<()> {
-        for port_forwarding in &mut self.port_forwardings {
-            if port_forwarding.forwarding_to_addr.is_none() {
-                continue;
-            }
-
-            host.port_forwarding_remove_rule(port_forwarding.exposed_port.external_port)?;
-            port_forwarding.forwarding_to_addr = None;
-        }
-
-        Ok(())
-    }
-}

lib/proxy/udp_packet_helper.rs

@@ -1,66 +0,0 @@
-use smoltcp::wire::UdpPacket;
-
-pub(crate) trait UdpPacketHelper {
-    const DNS_PORT: u16 = 53;
-    const BOOTPS_PORT: u16 = 67;
-    const BOOTPC_PORT: u16 = 68;
-
-    fn is_dns_request(&self) -> bool;
-
-    fn is_dhcp_request(&self) -> bool;
-    fn is_dhcp_response(&self) -> bool;
-}
-
-impl UdpPacketHelper for UdpPacket<&[u8]> {
-    fn is_dns_request(&self) -> bool {
-        self.dst_port() == Self::DNS_PORT
-    }
-
-    fn is_dhcp_request(&self) -> bool {
-        self.src_port() == Self::BOOTPC_PORT && self.dst_port() == Self::BOOTPS_PORT
-    }
-
-    fn is_dhcp_response(&self) -> bool {
-        self.src_port() == Self::BOOTPS_PORT && self.dst_port() == Self::BOOTPC_PORT
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::UdpPacketHelper;
-    use smoltcp::wire::UdpPacket;
-
-    #[test]
-    fn test_is_dhcp_request_requires_both_standard_ports() {
-        assert!(is_dhcp_request(68, 67));
-        assert!(!is_dhcp_request(68, 9999));
-        assert!(!is_dhcp_request(9999, 67));
-    }
-
-    #[test]
-    fn test_is_dhcp_response_requires_both_standard_ports() {
-        assert!(is_dhcp_response(67, 68));
-        assert!(!is_dhcp_response(67, 9999));
-        assert!(!is_dhcp_response(9999, 68));
-    }
-
-    fn is_dhcp_request(src_port: u16, dst_port: u16) -> bool {
-        let buffer = udp_packet_buffer(src_port, dst_port);
-        let udp_pkt = UdpPacket::new_unchecked(&buffer[..]);
-        udp_pkt.is_dhcp_request()
-    }
-
-    fn is_dhcp_response(src_port: u16, dst_port: u16) -> bool {
-        let buffer = udp_packet_buffer(src_port, dst_port);
-        let udp_pkt = UdpPacket::new_unchecked(&buffer[..]);
-        udp_pkt.is_dhcp_response()
-    }
-
-    fn udp_packet_buffer(src_port: u16, dst_port: u16) -> [u8; 8] {
-        let mut buffer = [0; 8];
-        let mut udp_pkt = UdpPacket::new_unchecked(&mut buffer[..]);
-        udp_pkt.set_src_port(src_port);
-        udp_pkt.set_dst_port(dst_port);
-        buffer
-    }
-}

lib/proxy/vm.rs

@@ -1,9 +1,8 @@
-use crate::dhcp_snooper::Lease;
 use crate::proxy::flows::{FlowDirection, FlowMatch};
-use crate::proxy::udp_packet_helper::UdpPacketHelper;
 use crate::proxy::{Direction, PolicyDecision, Proxy};
 use anyhow::Context;
 use anyhow::Result;
+use dhcproto::v4::SERVER_PORT;
 use smoltcp::phy::ChecksumCapabilities;
 use smoltcp::wire::{
     ArpOperation, ArpPacket, ArpRepr, EthernetFrame, EthernetProtocol, IpProtocol, Ipv4Address,
@@ -51,20 +50,17 @@ impl Proxy<'_> {
     }
 
     fn allowed_from_vm_arp(&self, arp_pkt: ArpPacket<&[u8]>) -> Option<()> {
-        vm_arp_allowed(arp_pkt, self.vm_mac_address, self.dhcp_snooper.lease())
+        vm_arp_allowed(arp_pkt, self.vm_mac_address, self.host.vm_ip)
     }
 
     pub(crate) fn allowed_from_vm_ipv4(&mut self, ipv4_pkt: Ipv4Packet<&[u8]>) -> Option<()> {
-        // Is this packet coming from VM's IP address that we've learned from DHCP snooping?
+        // Consume DHCP before enforcing the reserved source address
-        if let Some(lease) = &self.dhcp_snooper.lease()
+        if self.consume_dhcp(&ipv4_pkt) {
-            && lease.is_valid_for(ipv4_pkt.src_addr())
+            return None;
-        {
+        }
-            // Unicast DHCP renewal is required to maintain the VM's lease
-            // and must bypass user-specified rules
-            if is_allowed_dhcp_request(&ipv4_pkt, Some(self.host.gateway_ip)) {
-                return Some(());
-            }
 
+        // Is this packet coming from the VM's reserved IP address?
+        if self.host.vm_ip == ipv4_pkt.src_addr() {
             // Consult the flow table before evaluating outbound policy
             // so established flows are not treated as new traffic
             let pending = match self
@@ -109,54 +105,50 @@ impl Proxy<'_> {
             if dst_addr == self.host.gateway_ip {
                 return self.admit_with_tracking_if_trackable(pending);
             }
-
-            // Additionally, allow DNS requests to DNS-servers
-            // provided to a VM by the host's DHCP server
-            if ipv4_pkt.next_header() == IpProtocol::Udp {
-                let udp_pkt = UdpPacket::new_checked(ipv4_pkt.payload()).ok()?;
-
-                if udp_pkt.is_dns_request() && self.dhcp_snooper.valid_dns_target(&dst_addr) {
-                    return self.admit_with_tracking_if_trackable(pending);
-                }
-            }
-        }
-
-        // Allow outgoing DHCP requests to the bootpd(8) broadcast address,
-        // otherwise DHCP snooper will never be populated
-        if is_allowed_dhcp_request(&ipv4_pkt, None) {
-            return Some(());
         }
 
         None
     }
-}
 
-fn is_allowed_dhcp_request(
+    fn consume_dhcp(&mut self, ipv4_pkt: &Ipv4Packet<&[u8]>) -> bool {
-    ipv4_pkt: &Ipv4Packet<&[u8]>,
+        // Only inspect UDP packets that contain the source and destination ports
-    unicast_target: Option<Ipv4Address>,
+        if ipv4_pkt.next_header() != IpProtocol::Udp
-) -> bool {
+            || ipv4_pkt.frag_offset() != 0
-    let dst_addr = ipv4_pkt.dst_addr();
+            || ipv4_pkt.payload().len() < 4
+        {
+            return false;
+        }
 
-    // Keep the common path cheap and inspect UDP only for a permitted DHCP target
+        // Only consume packets addressed to the DHCP server port
-    if !dst_addr.is_broadcast() && unicast_target != Some(dst_addr) {
+        let udp = UdpPacket::new_unchecked(ipv4_pkt.payload());
-        return false;
+        if udp.dst_port() != SERVER_PORT {
+            return false;
+        }
+
+        // Pass the request to the DHCP server and send any reply
+        let result = match self.dhcp_server.receive_vm(ipv4_pkt, &udp) {
+            Ok(Some(reply)) => self.write_to_vm(&reply),
+            Ok(None) => Ok(()),
+            Err(err) => Err(err),
+        };
+
+        // Report failures to generate or send the reply
+        if let Err(err) = result {
+            sentry::capture_message(
+                &format!("Failed to reply to DHCP request: {err:#}"),
+                sentry::Level::Warning,
+            );
+        }
+
+        // Consume the packet even if the request was rejected or the reply failed
+        true
     }
-
-    if ipv4_pkt.next_header() != IpProtocol::Udp {
-        return false;
-    }
-
-    let Ok(udp_pkt) = UdpPacket::new_checked(ipv4_pkt.payload()) else {
-        return false;
-    };
-
-    udp_pkt.is_dhcp_request()
 }
 
 fn vm_arp_allowed(
     arp_pkt: ArpPacket<&[u8]>,
     vm_mac_address: smoltcp::wire::EthernetAddress,
-    lease: &Option<Lease>,
+    address: Ipv4Address,
 ) -> Option<()> {
     let (operation, source_hardware_addr, source_protocol_addr) =
         match ArpRepr::parse(&arp_pkt).ok()? {
@@ -177,66 +169,34 @@ fn vm_arp_allowed(
         return None;
     }
 
-    if let Some(lease) = lease {
+    (source_protocol_addr == address || source_protocol_addr.is_unspecified()).then_some(())
-        if lease.is_valid_for(source_protocol_addr) {
-            return Some(());
-        }
-    } else if source_protocol_addr.is_unspecified() {
-        return Some(());
-    }
-
-    None
 }
 
 #[cfg(test)]
 mod tests {
-    use crate::dhcp_snooper::Lease;
     use smoltcp::wire::{
-        ArpHardware, ArpOperation, ArpPacket, EthernetAddress, EthernetProtocol, IpProtocol,
+        ArpHardware, ArpOperation, ArpPacket, EthernetAddress, EthernetProtocol, Ipv4Address,
-        Ipv4Address, Ipv4Packet, UdpPacket,
     };
-    use std::collections::HashSet;
-    use std::time::Duration;
 
     #[test]
-    fn test_allowed_dhcp_request_targets() {
+    fn test_allowed_from_vm_arp_allows_unspecified_request() {
-        let gateway = Ipv4Address::new(192, 168, 64, 1);
-        let other = Ipv4Address::new(192, 168, 64, 2);
-
-        assert!(allowed_dhcp_request(Ipv4Address::BROADCAST, None));
-        assert!(allowed_dhcp_request(gateway, Some(gateway)));
-        assert!(!allowed_dhcp_request(gateway, None));
-        assert!(!allowed_dhcp_request(other, Some(gateway)));
-    }
-
-    #[test]
-    fn test_allowed_from_vm_arp_allows_unspecified_request_without_lease() {
         let vm_mac_address = EthernetAddress([0x02, 0x00, 0x00, 0x00, 0x00, 0x01]);
         let buf = arp_packet(vm_mac_address.0, [0, 0, 0, 0], ArpOperation::Request, 6, 4);
         let arp_pkt = ArpPacket::new_checked(buf.as_slice()).unwrap();
 
-        assert!(super::vm_arp_allowed(arp_pkt, vm_mac_address, &None).is_some());
+        assert!(
+            super::vm_arp_allowed(arp_pkt, vm_mac_address, Ipv4Address::new(1, 2, 3, 4)).is_some()
+        );
     }
 
     #[test]
     fn test_allowed_from_vm_arp_allows_reply_for_leased_ip() {
         let vm_mac_address = EthernetAddress([0x02, 0x00, 0x00, 0x00, 0x00, 0x01]);
-        let lease_ip = Ipv4Address::new(192, 168, 0, 2);
+        let vm_ip = Ipv4Address::new(192, 168, 0, 2);
-        let lease = Some(Lease::new(
+        let buf = arp_packet(vm_mac_address.0, vm_ip.octets(), ArpOperation::Reply, 6, 4);
-            lease_ip,
-            Duration::from_secs(600),
-            HashSet::new(),
-        ));
-        let buf = arp_packet(
-            vm_mac_address.0,
-            lease_ip.octets(),
-            ArpOperation::Reply,
-            6,
-            4,
-        );
         let arp_pkt = ArpPacket::new_checked(buf.as_slice()).unwrap();
 
-        assert!(super::vm_arp_allowed(arp_pkt, vm_mac_address, &lease).is_some());
+        assert!(super::vm_arp_allowed(arp_pkt, vm_mac_address, vm_ip).is_some());
     }
 
     #[test]
@@ -251,7 +211,9 @@ mod tests {
         );
         let arp_pkt = ArpPacket::new_checked(buf.as_slice()).unwrap();
 
-        assert!(super::vm_arp_allowed(arp_pkt, vm_mac_address, &None).is_none());
+        assert!(
+            super::vm_arp_allowed(arp_pkt, vm_mac_address, Ipv4Address::new(1, 2, 3, 4)).is_none()
+        );
     }
 
     #[test]
@@ -262,7 +224,9 @@ mod tests {
         arp_pkt.set_hardware_type(ArpHardware::Unknown(2));
         let arp_pkt = ArpPacket::new_checked(buf.as_slice()).unwrap();
 
-        assert!(super::vm_arp_allowed(arp_pkt, vm_mac_address, &None).is_none());
+        assert!(
+            super::vm_arp_allowed(arp_pkt, vm_mac_address, Ipv4Address::new(1, 2, 3, 4)).is_none()
+        );
     }
 
     #[test]
@@ -273,7 +237,9 @@ mod tests {
         arp_pkt.set_protocol_type(EthernetProtocol::Ipv6);
         let arp_pkt = ArpPacket::new_checked(buf.as_slice()).unwrap();
 
-        assert!(super::vm_arp_allowed(arp_pkt, vm_mac_address, &None).is_none());
+        assert!(
+            super::vm_arp_allowed(arp_pkt, vm_mac_address, Ipv4Address::new(1, 2, 3, 4)).is_none()
+        );
     }
 
     #[test]
@@ -282,7 +248,9 @@ mod tests {
         let buf = arp_packet(vm_mac_address.0, [0, 0, 0], ArpOperation::Request, 6, 3);
         let arp_pkt = ArpPacket::new_checked(buf.as_slice()).unwrap();
 
-        assert!(super::vm_arp_allowed(arp_pkt, vm_mac_address, &None).is_none());
+        assert!(
+            super::vm_arp_allowed(arp_pkt, vm_mac_address, Ipv4Address::new(1, 2, 3, 4)).is_none()
+        );
     }
 
     fn arp_packet(
@@ -307,22 +275,4 @@ mod tests {
         arp_pkt.set_target_protocol_addr(&vec![0; protocol_len as usize]);
         buf
     }
-
-    fn allowed_dhcp_request(dst_addr: Ipv4Address, unicast_target: Option<Ipv4Address>) -> bool {
-        let mut buf = vec![0; 28];
-        let mut ipv4_pkt = Ipv4Packet::new_unchecked(buf.as_mut_slice());
-        ipv4_pkt.set_version(4);
-        ipv4_pkt.set_header_len(20);
-        ipv4_pkt.set_total_len(28);
-        ipv4_pkt.set_next_header(IpProtocol::Udp);
-        ipv4_pkt.set_dst_addr(dst_addr);
-
-        let mut udp_pkt = UdpPacket::new_unchecked(ipv4_pkt.payload_mut());
-        udp_pkt.set_src_port(68);
-        udp_pkt.set_dst_port(67);
-        udp_pkt.set_len(8);
-
-        let ipv4_pkt = Ipv4Packet::new_checked(buf.as_slice()).unwrap();
-        super::is_allowed_dhcp_request(&ipv4_pkt, unicast_target)
-    }
 }

lib/subnet_finder/mod.rs

@@ -0,0 +1,92 @@
+use anyhow::{Context, Result};
+use ipnet::{Ipv4AddrRange, Ipv4Net};
+use network_interface::{Addr, NetworkInterface, NetworkInterfaceConfig};
+use rand::seq::{IndexedRandom, IteratorRandom};
+use std::net::Ipv4Addr;
+
+const MAX_ATTEMPTS: usize = 128;
+
+/// Find an available private subnet and its first two usable host addresses
+pub(crate) fn find_available_subnet(prefix_len: u8) -> Result<(Ipv4Addr, Ipv4Addr, Ipv4Net)> {
+    // Add private address space (as defined in RFC 1918[1]) with one exception
+    //
+    // We narrow the 192.168.0.0/16 allocation pool to work around a macOS bug
+    // where long subnet address strings lose their CIDR prefix in the generated
+    // firewall rules, causing connection issues.
+    //
+    // [1]: https://datatracker.ietf.org/doc/html/rfc1918#section-3
+    let private_subnets: Vec<Ipv4Net> = vec![
+        "10.0.0.0/8".parse()?,
+        "172.16.0.0/12".parse()?,
+        "192.168.0.0/18".parse()?,  // third octet 0–63
+        "192.168.64.0/19".parse()?, // third octet 64–95
+        "192.168.96.0/22".parse()?, // third octet 96–99
+    ];
+
+    // Figure out which address space is already utilized on the host
+    let mut used_subnets = Vec::new();
+
+    for interface in NetworkInterface::show()? {
+        for addr in interface.addr {
+            // We only support IPv4 for now
+            if let Addr::V4(addr) = addr {
+                let mask = addr.netmask.context("IPv4 interface has no netmask")?;
+                used_subnets.push(Ipv4Net::with_netmask(addr.ip, mask)?);
+            }
+        }
+    }
+
+    // Try up to MAX_ATTEMPTS random subnets until we're able to
+    // get an available subnet of the desired length
+    for _ in 0..MAX_ATTEMPTS {
+        // Give each private range an equal chance, even if a larger one is occupied
+        let private_subnet = private_subnets.choose(&mut rand::rng()).unwrap();
+
+        // Skip private ranges too small to contain the requested subnet
+        if prefix_len < private_subnet.prefix_len() {
+            continue;
+        }
+
+        // Pick a subnet of the desired length within this private range
+        let address = Ipv4AddrRange::new(private_subnet.network(), private_subnet.broadcast())
+            .choose(&mut rand::rng())
+            .unwrap();
+        let candidate = Ipv4Net::new(address, prefix_len)?.trunc();
+
+        // Only use the subnet if it doesn't overlap address space
+        // that is already utilized on the host
+        let overlaps = used_subnets
+            .iter()
+            .any(|used_subnet| candidate.contains(used_subnet) || used_subnet.contains(&candidate));
+        if overlaps {
+            continue;
+        }
+
+        // Take the first two hosts from the subnet
+        let mut hosts = candidate.hosts();
+        if let (Some(first_host), Some(second_host)) = (hosts.next(), hosts.next()) {
+            return Ok((first_host, second_host, candidate));
+        }
+    }
+
+    anyhow::bail!(
+        "failed to find an unused private IPv4 /{prefix_len} subnet after {MAX_ATTEMPTS} attempts"
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    #[serial_test::serial]
+    fn finds_two_usable_addresses() {
+        // Find a subnet on the current host
+        let (gateway_ip, vm_ip, subnet) = find_available_subnet(29).unwrap();
+
+        // Check the subnet and its first two usable addresses
+        assert_eq!(subnet.prefix_len(), 29);
+        assert!(subnet.network().is_private());
+        assert_eq!(subnet.hosts().collect::<Vec<_>>()[..2], [gateway_ip, vm_ip]);
+    }
+}

lib/vm.rs

@@ -26,6 +26,14 @@ impl VM {
     pub fn read(&self, buf: &mut [u8]) -> std::io::Result<usize> {
         self.sock.recv(buf)
     }
+
+    pub fn is_connected(&self) -> io::Result<bool> {
+        match self.sock.peer_addr() {
+            Ok(_) => Ok(true),
+            Err(error) if error.kind() == io::ErrorKind::NotConnected => Ok(false),
+            Err(error) => Err(error),
+        }
+    }
 }
 
 fn duplicate_vm_fd(vm_fd: RawFd) -> Result<RawFd> {
@@ -115,10 +123,12 @@ impl AsRawFd for VM {
 #[cfg(test)]
 mod tests {
     use super::VM;
+    use polling::{Event, Events, PollMode, Poller};
     use std::fs::File;
     use std::net::UdpSocket;
     use std::os::fd::AsRawFd;
     use std::os::unix::net::{UnixDatagram, UnixStream};
+    use std::time::Duration;
 
     #[test]
     fn test_new_rejects_negative_fd() {
@@ -187,4 +197,62 @@ mod tests {
 
         assert!(socket_fd_is_open);
     }
+
+    #[test]
+    fn test_connected_socket_has_peer() {
+        let (socket, _peer) = UnixDatagram::pair().unwrap();
+        let vm = VM::new(socket.as_raw_fd()).unwrap();
+
+        assert!(vm.is_connected().unwrap());
+    }
+
+    #[test]
+    fn test_disconnected_peer_is_detected_without_kqueue_event() {
+        let (socket, peer) = UnixDatagram::pair().unwrap();
+        let vm = VM::new(socket.as_raw_fd()).unwrap();
+        let poller = Poller::new().unwrap();
+        let mut events = Events::new();
+
+        unsafe {
+            poller
+                .add_with_mode(vm.as_raw_fd(), Event::readable(0), PollMode::Edge)
+                .unwrap();
+        }
+        drop(peer);
+
+        poller
+            .wait(&mut events, Some(Duration::from_millis(20)))
+            .unwrap();
+
+        assert!(events.is_empty());
+        assert!(!vm.is_connected().unwrap());
+    }
+
+    #[test]
+    fn test_disconnected_peer_is_detected_when_another_socket_wakes_kqueue() {
+        let (socket, peer) = UnixDatagram::pair().unwrap();
+        let (host, host_peer) = UnixDatagram::pair().unwrap();
+        let vm = VM::new(socket.as_raw_fd()).unwrap();
+        let poller = Poller::new().unwrap();
+        let mut events = Events::new();
+
+        unsafe {
+            poller
+                .add_with_mode(vm.as_raw_fd(), Event::readable(0), PollMode::Edge)
+                .unwrap();
+            poller
+                .add_with_mode(host.as_raw_fd(), Event::readable(1), PollMode::Edge)
+                .unwrap();
+        }
+        drop(peer);
+        host_peer.send(&[1]).unwrap();
+
+        poller
+            .wait(&mut events, Some(Duration::from_millis(20)))
+            .unwrap();
+
+        assert!(events.iter().any(|event| event.key == 1));
+        assert!(!events.iter().any(|event| event.key == 0));
+        assert!(!vm.is_connected().unwrap());
+    }
 }

src/main.rs

@@ -8,21 +8,30 @@ use softnet::NetType;
 use softnet::proxy::ExposedPort;
 use softnet::proxy::Proxy;
 use softnet::proxy::Rule;
-use std::borrow::Cow;
 use std::env;
 use std::os::raw::c_int;
 use std::os::unix::io::RawFd;
 use std::os::unix::process::CommandExt;
 use std::process::{Command, ExitCode};
 use system_configuration::core_foundation::base::TCFType;
+use system_configuration::core_foundation::boolean::CFBoolean;
 use system_configuration::core_foundation::dictionary::CFDictionary;
 use system_configuration::core_foundation::number::CFNumber;
 use system_configuration::core_foundation::string::CFString;
 use system_configuration::preferences::SCPreferences;
-use system_configuration::sys::preferences::{SCPreferencesCommitChanges, SCPreferencesSetValue};
+use system_configuration::sys::preferences::{
+    SCPreferencesApplyChanges, SCPreferencesCommitChanges, SCPreferencesLock,
+    SCPreferencesSetValue, SCPreferencesUnlock,
+};
 use uzers::{get_current_groupname, get_current_username, get_effective_uid};
 
+const VERSION: &str = match option_env!("SOFTNET_VERSION") {
+    Some(version) => version,
+    None => "unknown-unknown",
+};
+
 #[derive(Parser, Debug)]
+#[command(version = VERSION)]
 struct Args {
     #[clap(
         long,
@@ -130,10 +139,10 @@ fn main() -> ExitCode {
     }
 
     // Initialize Sentry
-    let _sentry = sentry::init(sentry::ClientOptions {
+    let _sentry = sentry::init(
-        release: option_env!("CIRRUS_TAG").map(|tag| Cow::from(format!("softnet@{tag}"))),
+        sentry::ClientOptions::default()
-        ..Default::default()
+            .maybe_release(option_env!("CIRRUS_TAG").map(|tag| format!("softnet@{tag}"))),
-    });
+    );
 
     // Enrich future events with Cirrus CI-specific tags
     if let Ok(tags) = env::var("CIRRUS_SENTRY_TAGS") {
@@ -216,8 +225,8 @@ fn try_main() -> anyhow::Result<()> {
         ));
     }
 
-    // Set bootpd(8) min/max lease time while still having the root privileges
+    // Configure bootpd(8) while still having the root privileges
-    set_bootpd_lease_time(args.bootpd_lease_time);
+    configure_bootpd(args.bootpd_lease_time)?;
 
     // Initialize the proxy while still having the root privileges
     let mut proxy = Proxy::new(
@@ -269,26 +278,59 @@ fn sudo_escalation_works() -> bool {
         .unwrap_or(false)
 }
 
-fn set_bootpd_lease_time(lease_time: u32) {
+fn configure_bootpd(lease_time: u32) -> anyhow::Result<()> {
     let prefs = SCPreferences::group(
         &CFString::new("softnet"),
         &CFString::new("com.apple.InternetSharing.default.plist"),
     );
 
-    let bootpd_dict = CFDictionary::from_CFType_pairs(&[(
+    let bootpd_dict = CFDictionary::from_CFType_pairs(&[
-        CFString::new("DHCPLeaseTimeSecs"),
+        (
-        CFNumber::from(lease_time as i32),
+            CFString::new("DHCPLeaseTimeSecs"),
-    )]);
+            CFNumber::from(lease_time as i32).as_CFType(),
+        ),
+        (
+            CFString::new("dhcp_ignore_client_identifier"),
+            CFBoolean::true_value().as_CFType(),
+        ),
+    ]);
 
     unsafe {
-        SCPreferencesSetValue(
+        let prefs = prefs.as_concrete_TypeRef();
-            prefs.as_concrete_TypeRef(),
+        anyhow::ensure!(
-            CFString::new("bootpd").as_concrete_TypeRef(),
+            SCPreferencesLock(prefs, 1) != 0,
-            bootpd_dict.as_concrete_TypeRef().cast(),
+            "failed to lock bootpd preferences"
         );
 
-        SCPreferencesCommitChanges(prefs.as_concrete_TypeRef());
+        let result = (|| -> anyhow::Result<()> {
+            anyhow::ensure!(
+                SCPreferencesSetValue(
+                    prefs,
+                    CFString::new("bootpd").as_concrete_TypeRef(),
+                    bootpd_dict.as_concrete_TypeRef().cast(),
+                ) != 0,
+                "failed to set bootpd preferences"
+            );
+
+            anyhow::ensure!(
+                SCPreferencesCommitChanges(prefs) != 0,
+                "failed to commit bootpd preferences"
+            );
+
+            anyhow::ensure!(
+                SCPreferencesApplyChanges(prefs) != 0,
+                "failed to apply bootpd preferences"
+            );
+
+            Ok(())
+        })();
+
+        let unlocked = SCPreferencesUnlock(prefs) != 0;
+        result?;
+        anyhow::ensure!(unlocked, "failed to unlock bootpd preferences");
     }
+
+    Ok(())
 }
 
 #[cfg(test)]