Limit allowed private address space to avoid long CIDR strings (#215 )

Allocate a /29 network instead of /30 to work around bootpd bug (#214 )
Bump the all-updates group with 6 updates (#210 )
2026-10-17 20:25:54 +02:00 · 2026-10-09 16:15:40 +01:00 · 2026-10-09 16:15:19 +01:00 · 2026-10-06 19:11:12 +01:00
4 changed files with 67 additions and 186 deletions
@@ -46,7 +46,7 @@ dependencies = [
 "mime",
 "percent-encoding",
 "pin-project-lite",
- "rand 0.10.1",
+ "rand",
 "sha1",
 "smallvec",
 "tokio",
@@ -366,7 +366,7 @@ checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601"
 dependencies = [
 "cfg-if",
 "cpufeatures",
- "rand_core 0.10.1",
+ "rand_core",
 ]

 [[package]]
@@ -411,9 +411,9 @@ checksum = "3a822ea5bc7590f9d40f1ba12c0dc3c2760f3482c6984db1573ad11031420831"

 [[package]]
 name = "coarsetime"
-version = "0.1.37"
+version = "0.1.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e58eb270476aa4fc7843849f8a35063e8743b4dbcdf6dd0f8ea0886980c204c2"
+checksum = "eae63702c5627c75addbfb1ea9d1b3842205a6ffd43e4cce884a2a9eb1828fd7"
 dependencies = [
 "libc",
 "wasix",
@@ -598,7 +598,7 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "10d60334b3b2e7c9d91ef8150abfb6fa4c1c39ebbcf4a81c2e346aad939fee3e"
 dependencies = [
- "thiserror 2.0.19",
+ "thiserror",
 ]

 [[package]]
@@ -649,8 +649,8 @@ dependencies = [
 "dhcproto-macros",
 "hickory-proto",
 "ipnet",
- "rand 0.10.1",
- "thiserror 2.0.19",
+ "rand",
+ "thiserror",
 ]

 [[package]]
@@ -865,19 +865,7 @@ checksum = "c4567c8db10ae91089c99af84c68c38da3ec2f087c3f82960bcdbf3656b6f4d7"
 dependencies = [
 "cfg-if",
 "libc",
- "wasi 0.11.0+wasi-snapshot-preview1",
-]
-
-[[package]]
-name = "getrandom"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26145e563e54f2cadc477553f1ec5ee650b00862f0a58bcd12cbdc5f0ea2d2f4"
-dependencies = [
- "cfg-if",
- "libc",
- "r-efi 5.2.0",
- "wasi 0.14.2+wasi-0.2.4",
+ "wasi",
 ]

 [[package]]
@@ -888,8 +876,8 @@ checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555"
 dependencies = [
 "cfg-if",
 "libc",
- "r-efi 6.0.0",
- "rand_core 0.10.1",
+ "r-efi",
+ "rand_core",
 "wasip2",
 "wasip3",
 ]
@@ -984,8 +972,8 @@ dependencies = [
 "ipnet",
 "jni",
 "once_cell",
- "rand 0.10.1",
- "thiserror 2.0.19",
+ "rand",
+ "thiserror",
 "tinyvec",
 "tracing",
 "url",
@@ -1342,7 +1330,7 @@ dependencies = [
 "jni-sys",
 "log",
 "simd_cesu8",
- "thiserror 2.0.19",
+ "thiserror",
 "walkdir",
 "windows-link",
 ]
@@ -1391,14 +1379,14 @@ dependencies = [

 [[package]]
 name = "jsonrpsee-types"
-version = "0.26.0"
+version = "0.26.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc88ff4688e43cc3fa9883a8a95c6fa27aa2e76c96e610b737b6554d650d7fd5"
+checksum = "e6e6de48c2fb8ba2773f4429c28349576f98d73a3b1d647d963f96df53210312"
 dependencies = [
 "http 1.1.0",
 "serde",
 "serde_json",
- "thiserror 2.0.19",
+ "thiserror",
 ]

 [[package]]
@@ -1531,7 +1519,7 @@ dependencies = [
 "hermit-abi 0.3.9",
 "libc",
 "log",
- "wasi 0.11.0+wasi-snapshot-preview1",
+ "wasi",
 "windows-sys 0.52.0",
 ]

@@ -1560,7 +1548,7 @@ checksum = "4ddcb8865ad3d9950f22f42ffa0ef0aecbfbf191867b3122413602b0a360b2a6"
 dependencies = [
 "cc",
 "libc",
- "thiserror 2.0.19",
+ "thiserror",
 "winapi",
 ]

@@ -1832,15 +1820,6 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"

-[[package]]
-name = "ppv-lite86"
-version = "0.2.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77957b295656769bb8ad2b6a6b09d897d94f05c41b069aede1fcdaa675eaea04"
-dependencies = [
- "zerocopy",
-]
-
 [[package]]
 name = "prefix-trie"
 version = "0.9.2"
@@ -1865,9 +1844,9 @@ dependencies = [

 [[package]]
 name = "privdrop"
-version = "0.5.6"
+version = "0.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70722a5a3728c9603c8d9469b64b8d1ee54dae6d74e24146da7f501b4c76540f"
+checksum = "454e2cdcd17f5b868a2f600b14660c1af558b85b69540b15ddc6b0a890d5b7f0"
 dependencies = [
 "libc",
 "nix 0.30.1",
@@ -1900,12 +1879,6 @@ dependencies = [
 "proc-macro2",
 ]

-[[package]]
-name = "r-efi"
-version = "5.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "74765f6d916ee2faa39bc8e68e4f3ed8949b48cccdac59983d287a7cb71ce9c5"
-
 [[package]]
 name = "r-efi"
 version = "6.0.0"
@@ -1914,42 +1887,13 @@ checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"

 [[package]]
 name = "rand"
-version = "0.9.4"
+version = "0.10.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
-dependencies = [
- "rand_chacha",
- "rand_core 0.9.3",
-]
-
-[[package]]
-name = "rand"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2e8e8bcc7961af1fdac401278c6a831614941f6164ee3bf4ce61b7edb162207"
+checksum = "65c9fb96cbc91e3478eaae79a69fcd3f1ae4ad052e471fe6732fff548984b4af"
 dependencies = [
 "chacha20",
 "getrandom 0.4.2",
- "rand_core 0.10.1",
-]
-
-[[package]]
-name = "rand_chacha"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
-dependencies = [
- "ppv-lite86",
- "rand_core 0.9.3",
-]
-
-[[package]]
-name = "rand_core"
-version = "0.9.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "99d9a13982dcf210057a8a78572b2217b667c3beacbf3a0d8b454f6f82837d38"
-dependencies = [
- "getrandom 0.3.3",
+ "rand_core",
 ]

 [[package]]
@@ -2165,9 +2109,9 @@ checksum = "61697e0a1c7e512e84a621326239844a24d8207b4669b41bc18b32ea5cbf988b"

 [[package]]
 name = "sentry"
-version = "0.49.2"
+version = "0.49.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76a88b65feb368d9dde5d531a2b59b25016e36fd6e4978432371a3ee77746ca2"
+checksum = "9fa951f4e644464ebfd2347a7ab03b0828c512d2448a76262cad2607b343dff4"
 dependencies = [
 "cfg_aliases",
 "httpdate",
@@ -2187,9 +2131,9 @@ dependencies = [

 [[package]]
 name = "sentry-actix"
-version = "0.49.2"
+version = "0.49.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b59b6298f8b1c621e7e711050f7ae9620b972215eb2822db2bfc4b061ed0cd2"
+checksum = "909d0a93b15d1ddcde3894aa23d003cbefc39ef53fe6d7c8294357ced2969cfb"
 dependencies = [
 "actix-http",
 "actix-web",
@@ -2200,9 +2144,9 @@ dependencies = [

 [[package]]
 name = "sentry-anyhow"
-version = "0.49.2"
+version = "0.49.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34e4c4b2e5bf7bb63f8223eb4f6d24f64e2c18b4d01fdeb3d561a951e057425b"
+checksum = "5ae34326bd95495e0db3c34c8888655684630cfe7609a73e863f0a7f4be5efdf"
 dependencies = [
 "anyhow",
 "sentry-backtrace",
@@ -2211,9 +2155,9 @@ dependencies = [

 [[package]]
 name = "sentry-backtrace"
-version = "0.49.2"
+version = "0.49.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c51511d67ed670266a93afeaa26a08019b04ad1420cb9191da30f2338d22c48"
+checksum = "f4f27cf048aa63ccd5bc94c29989133eabb82e9c6bf7441b58e9d4a95837a105"
 dependencies = [
 "backtrace",
 "regex",
@@ -2222,9 +2166,9 @@ dependencies = [

 [[package]]
 name = "sentry-contexts"
-version = "0.49.2"
+version = "0.49.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b757ac1f335856e8d7f5062a1fd9bc07a05a7eb3cc48247db79bf2618a490bd"
+checksum = "c5ed680585dbdacdf9859c2b4dc53358ff02bd256766882e22e343836db36b22"
 dependencies = [
 "hostname",
 "libc",
@@ -2236,11 +2180,11 @@ dependencies = [

 [[package]]
 name = "sentry-core"
-version = "0.49.2"
+version = "0.49.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d889520a375e5b93efb0a66def1630d21d168b0251eb55b286b03fa940ccfc84"
+checksum = "c3ed398494bb8fc412a11a182c1883a10ae147587b8f6314abd222d1d626f31b"
 dependencies = [
- "rand 0.9.4",
+ "rand",
 "sentry-types",
 "serde",
 "serde_json",
@@ -2249,9 +2193,9 @@ dependencies = [

 [[package]]
 name = "sentry-debug-images"
-version = "0.49.2"
+version = "0.49.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "656487fd5f7b7c0105b2e82171982aac64489e0cb679436038febf070f2f76d6"
+checksum = "55854bb40681e84ffd2a69578ad4ef9bfaf5bf2bf1380a745578b591fa24af22"
 dependencies = [
 "findshlibs",
 "sentry-core",
@@ -2259,9 +2203,9 @@ dependencies = [

 [[package]]
 name = "sentry-log"
-version = "0.49.2"
+version = "0.49.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba6c1bee99be05938885266fe5c95e0e4a2f46722cae205519f26e4ebdddd733"
+checksum = "9a3dc14009e1c24b07a8ff9ff8e1bcd0913b3e448b1565e679414776f2e58651"
 dependencies = [
 "bitflags 2.13.2",
 "log",
@@ -2270,9 +2214,9 @@ dependencies = [

 [[package]]
 name = "sentry-panic"
-version = "0.49.2"
+version = "0.49.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e0fe456a7380e9df875a1ef4df1e468d35b19b9051599845fab9d8f0c71c4ae"
+checksum = "b7153e68642b761ed3aa62c022795c11b2facc728b2db7484084492373c944f9"
 dependencies = [
 "sentry-backtrace",
 "sentry-core",
@@ -2280,9 +2224,9 @@ dependencies = [

 [[package]]
 name = "sentry-tracing"
-version = "0.49.2"
+version = "0.49.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77796d14eedbef22c2fe78e9c69fb09f14c7ad607e624d48dce92eedc17a136e"
+checksum = "e7e7db1aefdf623f4e48e21ec9e4af535024187aeafb2a4cc7e29d035def5a13"
 dependencies = [
 "bitflags 2.13.2",
 "sentry-backtrace",
@@ -2293,16 +2237,16 @@ dependencies = [

 [[package]]
 name = "sentry-types"
-version = "0.49.2"
+version = "0.49.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc71f5ca55942d9b2901af95d5df5c5d65c164134c22a83682cac3d0b6c7ef2d"
+checksum = "1c18bf7b159bdfc7c8f97816f476b4947a1937fb6bea9d38d3479e58631614ac"
 dependencies = [
 "debugid",
 "hex",
- "rand 0.9.4",
+ "rand",
 "serde",
 "serde_json",
- "thiserror 2.0.19",
+ "thiserror",
 "time",
 "url",
 "uuid",
@@ -2502,7 +2446,7 @@ dependencies = [
 "polling",
 "prefix-trie",
 "privdrop",
- "rand 0.10.1",
+ "rand",
 "sentry",
 "sentry-anyhow",
 "serde",
@@ -2526,16 +2470,6 @@ version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"

-[[package]]
-name = "syn"
-version = "1.0.109"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
-dependencies = [
- "proc-macro2",
- "unicode-ident",
-]
-
 [[package]]
 name = "syn"
 version = "2.0.117"
@@ -2612,33 +2546,13 @@ dependencies = [
 "windows-sys 0.59.0",
 ]

-[[package]]
-name = "thiserror"
-version = "1.0.64"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d50af8abc119fb8bb6dbabcfa89656f46f84aa0ac7688088608076ad2b459a84"
-dependencies = [
- "thiserror-impl 1.0.64",
-]
-
 [[package]]
 name = "thiserror"
 version = "2.0.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09a43598840e33d5b0331f38c5e30d13bb11c11210a4b58f0d9b18a5a5eefcd9"
 dependencies = [
- "thiserror-impl 2.0.19",
-]
-
-[[package]]
-name = "thiserror-impl"
-version = "1.0.64"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08904e7672f5eb876eaaf87e0ce17857500934f4981c4a0ab2b4aa98baac7fc3"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.117",
+ "thiserror-impl",
 ]

 [[package]]
@@ -2999,7 +2913,7 @@ dependencies = [
 "objc2",
 "objc2-core-foundation",
 "serial_test",
- "thiserror 2.0.19",
+ "thiserror",
 "uuid",
 "vmnet-derive",
 ]
@@ -3041,15 +2955,6 @@ version = "0.11.0+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"

-[[package]]
-name = "wasi"
-version = "0.14.2+wasi-0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9683f9a5a998d873c0d21fcbe3c083009670149a8fab228644b8bd36b2c48cb3"
-dependencies = [
- "wit-bindgen-rt",
-]
-
 [[package]]
 name = "wasip2"
 version = "1.0.3+wasi-0.2.9"
@@ -3074,7 +2979,7 @@ version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1757e0d1f8456693c7e5c6c629bdb54884e032aa0bb53c155f6a39f94440d332"
 dependencies = [
- "wasi 0.11.0+wasi-snapshot-preview1",
+ "wasi",
 ]

 [[package]]
@@ -3452,15 +3357,6 @@ dependencies = [
 "wit-parser",
 ]

-[[package]]
-name = "wit-bindgen-rt"
-version = "0.39.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f42320e61fe2cfd34354ecb597f86f413484a798ba44a8ca1165c58d42da6c1"
-dependencies = [
- "bitflags 2.13.2",
-]
-
 [[package]]
 name = "wit-bindgen-rust"
 version = "0.51.0"
@@ -3565,27 +3461,6 @@ dependencies = [
 "synstructure",
 ]

-[[package]]
-name = "zerocopy"
-version = "0.7.35"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b9b4fd18abc82b8136838da5d50bae7bdea537c574d8dc1a34ed098d6c166f0"
-dependencies = [
- "byteorder",
- "zerocopy-derive",
-]
-
-[[package]]
-name = "zerocopy-derive"
-version = "0.7.35"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa4f8080344d4671fb4e831a13ad1e68092748387dfc4f55e356242fae12ce3e"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.117",
-]
-
 [[package]]
 name = "zerofrom"
 version = "0.1.5"
@@ -23,7 +23,7 @@ Softnet solves two problems:
 2. DHCP exhaustion
    * macOS built-in DHCP-server allocates a `/24` subnet with 86400 seconds lease time by default, which only allows for ~253 VMs a day (or 1 VM every ~6 minutes) to be spawned without causing a denial-of-service, which is pretty limiting for CI services like Cirrus CI

-Each VM gets a separate [`vmnet` network](https://developer.apple.com/documentation/vmnet/vmnet_network_create(_:_:)) with a private `/30` subnet selected to avoid overlap with existing host interface subnets. Softnet reserves an IP-address for the VM's MAC-address, delivers it through its own DHCP-server, and uses the reserved address for packet filtering.
+Each VM gets a separate [`vmnet` network](https://developer.apple.com/documentation/vmnet/vmnet_network_create(_:_:)) with a private `/29` subnet selected to avoid overlap with existing host interface subnets. Softnet reserves an IP-address for the VM's MAC-address, delivers it through its own DHCP-server, and uses the reserved address for packet filtering.

 ### Stateful flow authorization

@@ -42,8 +42,8 @@ impl Host {
        vm_mac: EthernetAddress,
        enable_isolation: bool,
    ) -> Result<Host> {
-        // Find an unused /30 subnet for the gateway and VM
-        let (gateway_ip, vm_ip, subnet) = subnet_finder::find_available_subnet(30)?;
+        // Find an unused /29 subnet for the gateway and VM
+        let (gateway_ip, vm_ip, subnet) = subnet_finder::find_available_subnet(29)?;

        // Create vmnet's network configuration
        let mut configuration = NetworkConfiguration::new(match vm_net_type {
@@ -8,13 +8,19 @@ const MAX_ATTEMPTS: usize = 128;

 /// Find an available private subnet and its first two usable host addresses
 pub(crate) fn find_available_subnet(prefix_len: u8) -> Result<(Ipv4Addr, Ipv4Addr, Ipv4Net)> {
-    // Add private address space (as defined in RFC 1918[1])
+    // Add private address space (as defined in RFC 1918[1]) with one exception
+    //
+    // We narrow the 192.168.0.0/16 allocation pool to work around a macOS bug
+    // where long subnet address strings lose their CIDR prefix in the generated
+    // firewall rules, causing connection issues.
    //
    // [1]: https://datatracker.ietf.org/doc/html/rfc1918#section-3
    let private_subnets: Vec<Ipv4Net> = vec![
        "10.0.0.0/8".parse()?,
        "172.16.0.0/12".parse()?,
-        "192.168.0.0/16".parse()?,
+        "192.168.0.0/18".parse()?,  // third octet 0–63
+        "192.168.64.0/19".parse()?, // third octet 64–95
+        "192.168.96.0/22".parse()?, // third octet 96–99
    ];

    // Figure out which address space is already utilized on the host
@@ -76,11 +82,11 @@ mod tests {
    #[serial_test::serial]
    fn finds_two_usable_addresses() {
        // Find a subnet on the current host
-        let (gateway_ip, vm_ip, subnet) = find_available_subnet(30).unwrap();
+        let (gateway_ip, vm_ip, subnet) = find_available_subnet(29).unwrap();

-        // Check the subnet and its two usable addresses
-        assert_eq!(subnet.prefix_len(), 30);
+        // Check the subnet and its first two usable addresses
+        assert_eq!(subnet.prefix_len(), 29);
        assert!(subnet.network().is_private());
-        assert_eq!(subnet.hosts().collect::<Vec<_>>(), [gateway_ip, vm_ip]);
+        assert_eq!(subnet.hosts().collect::<Vec<_>>()[..2], [gateway_ip, vm_ip]);
    }
 }