WIP

To enable cross-VM communication.

.cargo/config.toml

@@ -0,0 +1,2 @@
+[target.aarch64-apple-darwin]
+runner = 'sudo -E'

.cirrus.yml

@@ -1,27 +1,68 @@
+use_compute_credits: true
+
+macos_instance:
+  image: ghcr.io/cirruslabs/macos-runner:tahoe
+
 env:
   PATH: "$PATH:$HOME/.cargo/bin"
 
 task:
-  name: Build
-  macos_instance:
-    image: ghcr.io/cirruslabs/macos-monterey-xcode:14
-  install_rust_script:
-    - curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
-  build_script:
-    - cargo build
+  name: Lint
+  install_rust_script: curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+  rustfmt_script: cargo fmt --check
+  clippy_script: cargo clippy --all-targets --all-features -- -D warnings
+
+task:
+  alias: Test
+  matrix:
+    - name: Test on macOS Sequoia
+      macos_instance:
+        image: ghcr.io/cirruslabs/macos-runner:sequoia
+    - name: Test on macOS Tahoe
+      macos_instance:
+        image: ghcr.io/cirruslabs/macos-runner:tahoe
+  install_rust_script: curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+  test_script: cargo test
+
+task:
+  name: Release (Dry Run)
+  only_if: $CIRRUS_TAG == ''
+  depends_on:
+    - Lint
+    - Test
+  install_rust_script: curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+  install_script: brew install go
+  install_goreleaser_script: brew install --cask goreleaser/tap/goreleaser-pro
+  build_script: goreleaser build --snapshot
+  goreleaser_artifacts:
+    path: "dist/**"
 
 task:
   name: Release
   only_if: $CIRRUS_TAG != ''
-  macos_instance:
-    image: ghcr.io/cirruslabs/macos-monterey-xcode:14
+  depends_on:
+    - Lint
+    - Test
   env:
     GITHUB_TOKEN: ENCRYPTED[!98ace8259c6024da912c14d5a3c5c6aac186890a8d4819fad78f3e0c41a4e0cd3a2537dd6e91493952fb056fa434be7c!]
     GORELEASER_KEY: ENCRYPTED[!9b80b6ef684ceaf40edd4c7af93014ee156c8aba7e6e5795f41c482729887b5c31f36b651491d790f1f668670888d9fd!]
-  install_rust_script:
-    - curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
-  install_goreleaser_script:
-    - brew install go goreleaser/tap/goreleaser-pro
-  build_script:
-    - cargo build --release
+    SENTRY_ORG: cirrus-labs
+    SENTRY_PROJECT: persistent-workers
+    SENTRY_AUTH_TOKEN: ENCRYPTED[!c16a5cf7da5f856b4bc2f21fe8cb7aa2a6c981f851c094ed4d3025fd02ea59a58a86cee8b193a69a1fc20fa217e56ac3!]
+  install_rust_script: curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+  install_script: brew install go getsentry/tools/sentry-cli
+  install_goreleaser_script: brew install --cask goreleaser/tap/goreleaser-pro
   release_script: goreleaser
+  upload_sentry_debug_files_script:
+    - cd target/aarch64-apple-darwin/release/
+    # Generate and upload symbols
+    - dsymutil softnet
+    - sentry-cli debug-files upload -o $SENTRY_ORG -p $SENTRY_PROJECT softnet.dSYM/
+    # Bundle and upload sources
+    - sentry-cli debug-files bundle-sources softnet.dSYM/
+    - sentry-cli debug-files upload -o $SENTRY_ORG -p $SENTRY_PROJECT softnet.src.zip
+  create_sentry_release_script:
+    - export SENTRY_RELEASE="softnet@$CIRRUS_TAG"
+    - sentry-cli releases new $SENTRY_RELEASE
+    - sentry-cli releases set-commits $SENTRY_RELEASE --auto
+    - sentry-cli releases finalize $SENTRY_RELEASE

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @edigaryev @fkorotkov

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: "cargo"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      all-updates:
+        patterns:
+          - "*"

.gitignore

@@ -1 +1,3 @@
+/.idea
+/dist
 /target

.goreleaser.yml

@@ -1,32 +1,33 @@
+---
+version: 2
 project_name: softnet
 
 builds:
-  - builder: prebuilt
-    goos:
-      - darwin
-    goarch:
-      - arm64
-    prebuilt:
-      path: target/release/softnet
+  - builder: rust
+    command: build
+    targets:
+      - aarch64-apple-darwin
+      - x86_64-apple-darwin
+
+universal_binaries:
+  - replace: true
 
 archives:
-  - id: binary
-    format: binary
-    name_template: "{{ .ProjectName }}"
-  - id: regular
-    name_template: "{{ .ProjectName }}"
+  - name_template: "{{ .ProjectName }}"
+    formats:
+      - tar.gz
 
 release:
   prerelease: auto
 
 brews:
-  - name: softnet
-    ids:
-      - regular
-    tap:
+  - name: "{{ .ProjectName }}"
+    repository:
       owner: cirruslabs
       name: homebrew-cli
     caveats: See the Github repository for more information
     homepage: https://github.com/cirruslabs/softnet
     description: Software networking with isolation for Tart
     skip_upload: auto
+    custom_block: |
+      depends_on :macos => :sequoia

Cargo.toml

@@ -2,22 +2,39 @@
 name = "softnet"
 version = "0.1.0"
 publish = false
-edition = "2021"
+edition = "2024"
 
 [lib]
 path = "lib/mod.rs"
 
+[profile.release-with-debug]
+inherits = "release"
+debug = true
+
 [dependencies]
-smoltcp = "0.8.1"
-libc = "0.2.126"
-polling = "2.2.0"
-dhcproto = "0.7.0"
-vmnet = "0.1.1"
-clap = { version = "3.1.18", features = ["derive"] }
-mac_address = "1.1.3"
-privdrop = "0.5.2"
-thiserror = "1.0.31"
-ip_network = "0.4.1"
-users = "0.11.0"
-system-configuration = "0.5.0"
-num_enum = "0.5.7"
+smoltcp = "0"
+libc = "0"
+polling = "3"
+dhcproto = { git = "https://github.com/bluecatengineering/dhcproto.git", branch = "master" }
+vmnet = "0.5.1"
+clap = { version = "4", features = ["derive"] }
+mac_address = "1"
+privdrop = "0"
+anyhow = { version = "1", features = ["backtrace"] }
+ip_network = "0"
+uzers = "0"
+system-configuration = "0"
+num_enum = "0"
+sentry = { version = "0", features = ["debug-images"] }
+sentry-anyhow = { version = "0", features = ["backtrace"] }
+nix = { version = "0", features = ["signal", "socket"] }
+prefix-trie = "0"
+ipnet = "2"
+oslog = "0.2.0"
+log = "0.4.29"
+serial_test = "3"
+coarsetime = "0.1.37"
+pnet_datalink = "0.35.0"
+
+[profile.release]
+debug = true

README.md

@@ -2,14 +2,26 @@
 
 Softnet is a software networking for [Tart](https://github.com/cirruslabs/tart) which provides better network isolation and alleviates DHCP shortage on production systems.
 
+It is essentially a userspace packet filter which restricts the VM networking and prevents a class of security issues, such as ARP spoofing. By default, the VM will only be able to:
+
+* send traffic from its own MAC-address
+* send traffic from the IP-address assigned to it by the DHCP
+* send traffic to globally routable IPv4 addresses
+* send traffic to gateway IP of the vmnet bridge (this would normally be \"bridge100\" interface)
+* receive any incoming traffic
+
+In addition, Softnet tunes macOS built-in DHCP server to decrease its lease time from the default 86,400 seconds (one day) to 600 seconds (10 minutes). This is especially important when you use Tart to clone and run a lot of ephemeral VMs over a period of one day.
+
+Please check out [this blog post](https://cirrus-ci.org/blog/2022/07/07/isolating-network-between-tarts-macos-virtual-machines/) for backstory.
+
 ## Working model
 
 Softnet solves two problems:
 
 1. VM network isolation
-  * [`VZNATNetworkDeviceAttachment`](https://developer.apple.com/documentation/virtualization/vznatnetworkdeviceattachment) (the default networking in Tart) enables [vmnet's bridge isolation](https://developer.apple.com/documentation/vmnet/vmnet_enable_isolation_key) by default and prevents cross-VM traffic, however it's still possible for any VM to spoof the host's ARP-table and capture other VMs traffic, for example
+    * [`VZNATNetworkDeviceAttachment`](https://developer.apple.com/documentation/virtualization/vznatnetworkdeviceattachment) (the default networking in Tart) enables [vmnet's bridge isolation](https://developer.apple.com/documentation/vmnet/vmnet_enable_isolation_key) by default and prevents cross-VM traffic, however it's still possible for any VM to spoof the host's ARP-table and capture other VMs traffic by using tools that enable conducting the [ARP spoofing attacks](https://en.wikipedia.org/wiki/ARP_spoofing) (e.g. [arpspoof](https://www.monkey.org/~dugsong/dsniff/), [arpoison](http://www.arpoison.net/) and so on)
 2. DHCP exhaustion
-  * macOS built-in DHCP-server allocates a `/24` subnet with 86400 seconds lease time by default, which only allows for ~253 VMs a day (or 1 VM every ~6 minutes) to be spawned without causing a denial-of-service, which is pretty limiting for CI services like Cirrus CI
+    * macOS built-in DHCP-server allocates a `/24` subnet with 86400 seconds lease time by default, which only allows for ~253 VMs a day (or 1 VM every ~6 minutes) to be spawned without causing a denial-of-service, which is pretty limiting for CI services like Cirrus CI
 
 And assumes that:
 
@@ -30,4 +42,4 @@ For proper functioning, Softnet binary requires two things:
 
 ## Running
 
-Softnet is started and managed automatically by Tart if `--with-softnet` flag is present when calling `tart run`.
+Softnet is started and managed automatically by Tart if `--net-softnet` flag is provided when calling `tart run`.

lib/dhcp_snooper.rs

@@ -1,15 +1,23 @@
-use dhcproto::v4::{DhcpOption, MessageType, OptionCode};
 use dhcproto::Decodable;
+use dhcproto::v4::{DhcpOption, MessageType, OptionCode};
 use smoltcp::wire::Ipv4Address;
 use std::collections::HashSet;
-use std::time::{Duration, Instant};
+use std::time::Duration;
 
 #[derive(Default)]
 pub struct DhcpSnooper {
     vm_lease: Option<Lease>,
+    uncertainty_duration: Duration,
 }
 
 impl DhcpSnooper {
+    pub fn new(uncertainty_duration: Duration) -> Self {
+        DhcpSnooper {
+            uncertainty_duration,
+            ..Default::default()
+        }
+    }
+
     pub fn register_dhcp_reply(&mut self, dhcp_packet: &[u8]) {
         let mut decoder = dhcproto::v4::Decoder::new(dhcp_packet);
 
@@ -26,17 +34,18 @@ impl DhcpSnooper {
                 };
 
                 let dns_ips = match message.opts().get(OptionCode::DomainNameServer) {
-                    Some(DhcpOption::DomainNameServer(dns_ips)) => HashSet::from_iter(
-                        dns_ips.iter().map(|dns_ip| Ipv4Address(dns_ip.octets())),
-                    ),
+                    Some(DhcpOption::DomainNameServer(dns_ips)) => {
+                        HashSet::from_iter(dns_ips.iter().cloned())
+                    }
                     _ => HashSet::new(),
                 };
 
-                self.vm_lease = Some(Lease::new(
-                    message.yiaddr().into(),
-                    Duration::from_secs(*lease_time as u64),
-                    dns_ips,
-                ))
+                let mut lease_duration = Duration::from_secs(*lease_time as u64);
+
+                // Adjust for uncertainty caused by using a coarse clock
+                lease_duration = lease_duration.saturating_sub(self.uncertainty_duration);
+
+                self.vm_lease = Some(Lease::new(message.yiaddr(), lease_duration, dns_ips))
             }
             Some(MessageType::Nak) => {
                 self.vm_lease = None;
@@ -45,6 +54,11 @@ impl DhcpSnooper {
         };
     }
 
+    #[cfg(test)]
+    pub(crate) fn set_lease(&mut self, vm_lease: Option<Lease>) {
+        self.vm_lease = vm_lease
+    }
+
     pub fn lease(&self) -> &Option<Lease> {
         &self.vm_lease
     }
@@ -58,22 +72,31 @@ impl DhcpSnooper {
     }
 }
 
+#[derive(Debug)]
 pub struct Lease {
     address: Ipv4Address,
-    valid_until: Instant,
+    valid_until: coarsetime::Instant,
     dns_ips: HashSet<Ipv4Address>,
 }
 
 impl Lease {
-    fn new(address: Ipv4Address, lease_time: Duration, dns_ips: HashSet<Ipv4Address>) -> Lease {
+    pub fn new(address: Ipv4Address, lease_time: Duration, dns_ips: HashSet<Ipv4Address>) -> Lease {
         Lease {
             address,
-            valid_until: Instant::now() + lease_time,
+            valid_until: coarsetime::Instant::recent() + lease_time.into(),
             dns_ips,
         }
     }
 
+    pub fn address(&self) -> Ipv4Address {
+        self.address
+    }
+
+    pub fn valid(&self) -> bool {
+        coarsetime::Instant::recent() < self.valid_until
+    }
+
     pub fn valid_ip_source(&self, address: Ipv4Address) -> bool {
-        self.address == address && Instant::now() < self.valid_until
+        self.address == address && self.valid()
     }
 }

lib/host.rs

@@ -1,60 +1,124 @@
-use crate::{Error, Result};
+use anyhow::{Context, Result, anyhow};
+use clap::ValueEnum;
+use log::info;
+use smoltcp::wire::EthernetAddress;
+use std::net::IpAddr;
 use std::net::Ipv4Addr;
 use std::os::unix::io::{AsRawFd, RawFd};
 use std::os::unix::net::UnixDatagram;
 use std::str::FromStr;
-use std::sync::mpsc::{sync_channel, SyncSender};
+use std::sync::mpsc::{SyncSender, sync_channel};
 use vmnet::mode::Mode;
 use vmnet::parameters::{Parameter, ParameterKind};
-use vmnet::{Events, Options};
+use vmnet::port_forwarding::{AddressFamily, Protocol};
+use vmnet::{Batch, Events, Options};
+
+#[derive(ValueEnum, Clone, Debug)]
+pub enum NetType {
+    /// Shared network
+    ///
+    /// Uses NAT-translation to give guests access to the global network
+    Nat,
+    /// Host network
+    ///
+    /// Guests will be able to talk only to the host without access to global network
+    Host,
+}
 
 pub struct Host {
     interface: vmnet::Interface,
     new_packets_rx: UnixDatagram,
     callback_can_continue_tx: SyncSender<()>,
     pub gateway_ip: smoltcp::wire::Ipv4Address,
+    pub gateway_mac: EthernetAddress,
     pub max_packet_size: u64,
+    pub read_max_packets: u64,
     finalized: bool,
 }
 
 impl Host {
-    pub fn new() -> Result<Host> {
-        // Initialize a vmnet.framework NAT interface with isolation enabled
+    pub fn new(vm_net_type: NetType, enable_isolation: bool) -> Result<Host> {
+        // Initialize a vmnet.framework NAT or Host interface with isolation enabled
         let mut interface = vmnet::Interface::new(
-            Mode::Shared(Default::default()),
+            match vm_net_type {
+                NetType::Nat => Mode::Shared(Default::default()),
+                NetType::Host => Mode::Host(Default::default()),
+            },
             Options {
-                enable_isolation: Some(true),
+                enable_isolation: Some(enable_isolation),
                 ..Default::default()
             },
         )
-        .map_err(|err| Error::VmnetFailed { source: err })?;
+        .context("failed to initialize vmnet interface")?;
 
         // Retrieve first IP (gateway) used for this interface
-        let gateway_ip = match interface.parameters().get(ParameterKind::StartAddress) {
-            Some(Parameter::StartAddress(gateway_ip)) => gateway_ip,
-            _ => return Err(Error::VmnetUnexpected),
+        let Some(Parameter::StartAddress(start_address)) =
+            interface.parameters().get(ParameterKind::StartAddress)
+        else {
+            return Err(anyhow!(
+                "failed to retrieve vmnet's interface start address"
+            ));
         };
-        let gateway_ip = Ipv4Addr::from_str(&gateway_ip).map_err(|_| Error::VmnetUnexpected)?;
+        let start_address = Ipv4Addr::from_str(&start_address)
+            .context("failed to parse vmnet's interface start address")?;
+
+        // Retrieve last IP used for this interface and calculate the prefix
+        let Some(Parameter::EndAddress(end_address)) =
+            interface.parameters().get(ParameterKind::EndAddress)
+        else {
+            return Err(anyhow!("failed to retrieve vmnet's interface end address"));
+        };
+        let end_address = Ipv4Addr::from_str(&end_address)
+            .context("failed to parse vmnet's interface end address")?;
+
+        let Some(prefix) = Self::ipv4_range_prefix(start_address, end_address) else {
+            return Err(anyhow!(
+                "failed to resolve vmnet's interface: prefix ambiguity for {}–{}",
+                start_address,
+                end_address
+            ));
+        };
+
+        // Figure out the gateway's interface MAC address
+        let Some(gateway_mac) = Self::interface_mac_for_ip(start_address, prefix) else {
+            return Err(anyhow!(
+                "failed to resolve vmnet's interface: no interface found with {}/{} CIDR",
+                start_address,
+                prefix
+            ));
+        };
+        let gateway_mac = EthernetAddress(gateway_mac.octets());
 
         // Retrieve max packet size for this interface
-        let max_packet_size = match interface.parameters().get(ParameterKind::MaxPacketSize) {
-            Some(Parameter::MaxPacketSize(max_packet_size)) => max_packet_size,
-            _ => return Err(Error::VmnetUnexpected),
+        let Some(Parameter::MaxPacketSize(max_packet_size)) =
+            interface.parameters().get(ParameterKind::MaxPacketSize)
+        else {
+            return Err(anyhow!(
+                "failed to retrieve vmnet's interface max packet size"
+            ));
+        };
+
+        // Retrieve read max packets for this interface
+        let Some(Parameter::ReadMaxPackets(read_max_packets)) =
+            interface.parameters().get(ParameterKind::ReadMaxPackets)
+        else {
+            return Err(anyhow!(
+                "failed to retrieve vmnet's interface read max packets"
+            ));
         };
 
         // Set up a socketpair() to emulate polling of the vmnet interface
-        let (new_packets_tx, new_packets_rx) =
-            UnixDatagram::pair().map_err(|err| Error::InitFailed { source: err.into() })?;
-        new_packets_rx
-            .set_nonblocking(true)
-            .map_err(|err| Error::InitFailed { source: err.into() })?;
+        let (new_packets_tx, new_packets_rx) = UnixDatagram::pair()?;
+        new_packets_rx.set_nonblocking(true)?;
 
         let (callback_can_continue_tx, callback_can_continue_rx) = sync_channel(0);
 
         interface
             .set_event_callback(Events::PACKETS_AVAILABLE, move |_mask, _params| {
                 // Send a dummy datagram to make the other end of socketpair() readable
-                new_packets_tx.send(&[0; 1]).unwrap();
+                // and ignore the error as this merely a signalling channel to wake up
+                // the poller
+                new_packets_tx.send(&[0; 1]).ok();
 
                 // Wait for the permission to continue to avoid
                 // wasting CPU cycles or in case of termination,
@@ -64,28 +128,87 @@ impl Host {
                 // [1]: https://en.wikipedia.org/wiki/Blocks_(C_language_extension)
                 callback_can_continue_rx.recv().unwrap();
             })
-            .map_err(|err| Error::VmnetFailed { source: err })?;
+            .context("failed to set vmnet interface's event callback")?;
 
         Ok(Host {
             interface,
             new_packets_rx,
             callback_can_continue_tx,
-            gateway_ip: gateway_ip.into(),
+            gateway_ip: start_address,
+            gateway_mac,
             max_packet_size,
+            read_max_packets,
             finalized: false,
         })
     }
+
+    fn interface_mac_for_ip(ip: Ipv4Addr, prefix: u8) -> Option<pnet_datalink::MacAddr> {
+        for iface in pnet_datalink::interfaces() {
+            if iface
+                .ips
+                .iter()
+                .any(|network| network.ip() == IpAddr::V4(ip) && network.prefix() == prefix)
+                && let Some(mac) = iface.mac
+            {
+                return Some(mac);
+            }
+        }
+
+        None
+    }
+
+    fn ipv4_range_prefix(start_address: Ipv4Addr, end_address: Ipv4Addr) -> Option<u8> {
+        let start_address = start_address.to_bits();
+        let end_address = end_address.to_bits();
+
+        if start_address > end_address {
+            return None;
+        }
+
+        Some((start_address ^ end_address).leading_zeros() as u8)
+    }
 }
 
 impl Host {
-    pub fn read(&mut self, buf: &mut [u8]) -> vmnet::Result<usize> {
+    pub fn port_forwarding_add_rule(
+        &mut self,
+        external_port: u16,
+        internal_addr: Ipv4Addr,
+        internal_port: u16,
+    ) -> Result<()> {
+        let details = format!(
+            "external_port={external_port}, internal_addr={internal_addr}, internal_port={internal_port}"
+        );
+
+        self.interface
+            .port_forwarding_rule_add(
+                AddressFamily::Ipv4,
+                Protocol::Tcp,
+                external_port,
+                internal_addr.into(),
+                internal_port,
+            )
+            .map(|_| info!("added port forwarding rule {details}"))
+            .map_err(|err| anyhow!("failed to add port forwarding rule {details}: {err}"))
+    }
+
+    pub fn port_forwarding_remove_rule(&mut self, external_port: u16) -> Result<()> {
+        let details = format!("external_port={external_port}");
+
+        self.interface
+            .port_forwarding_rule_remove(AddressFamily::Ipv4, Protocol::Tcp, external_port)
+            .map(|_| info!("removed port forwarding rule {details}"))
+            .map_err(|err| anyhow!("failed to remove port forwarding rule {details}: {err}"))
+    }
+
+    pub fn read(&mut self, batch: &mut Batch, bufs: &mut [Vec<u8>]) -> vmnet::Result<usize> {
         // Dequeue dummy datagram from the socket (if any)
         // to free up buffer space and reduce false-positives
         // when polling
         let mut buf_to_be_discarded: [u8; 1] = [0; 1];
         let _ = self.new_packets_rx.recv(&mut buf_to_be_discarded);
 
-        let result = self.interface.read(buf);
+        let result = self.interface.read_batch(batch, bufs);
 
         if let Err(vmnet::Error::VmnetReadNothing) = result {
             // We've emptied everything, unlock the callback
@@ -104,14 +227,14 @@ impl Host {
         // First make sure our callback won't be scheduled again after it finishes
         self.interface
             .clear_event_callback()
-            .map_err(|err| Error::VmnetFailed { source: err })?;
+            .context("failed to clear vmnet interface's event callback")?;
 
         // Now let the callback finish
         let _ = self.callback_can_continue_tx.send(());
 
         self.interface
             .finalize()
-            .map_err(|err| Error::VmnetFailed { source: err })?;
+            .context("failed to finalize vmnet's interface")?;
 
         self.finalized = true;
 
@@ -132,3 +255,58 @@ impl AsRawFd for Host {
         self.new_packets_rx.as_raw_fd()
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::Host;
+    use std::net::Ipv4Addr;
+
+    #[test]
+    fn ipv4_range_prefix_for_class_c_subnet() {
+        assert_eq!(
+            Host::ipv4_range_prefix(
+                Ipv4Addr::new(192, 168, 64, 0),
+                Ipv4Addr::new(192, 168, 64, 255),
+            ),
+            Some(24)
+        );
+    }
+
+    #[test]
+    fn ipv4_range_prefix_for_single_address() {
+        assert_eq!(
+            Host::ipv4_range_prefix(Ipv4Addr::new(10, 0, 0, 1), Ipv4Addr::new(10, 0, 0, 1)),
+            Some(32)
+        );
+    }
+
+    #[test]
+    fn ipv4_range_prefix_for_class_c_usable_range() {
+        assert_eq!(
+            Host::ipv4_range_prefix(
+                Ipv4Addr::new(192, 168, 64, 1),
+                Ipv4Addr::new(192, 168, 64, 254),
+            ),
+            Some(24)
+        );
+    }
+
+    #[test]
+    fn ipv4_range_prefix_for_containing_class_c_subnet() {
+        assert_eq!(
+            Host::ipv4_range_prefix(
+                Ipv4Addr::new(192, 168, 64, 2),
+                Ipv4Addr::new(192, 168, 64, 254),
+            ),
+            Some(24)
+        );
+    }
+
+    #[test]
+    fn ipv4_range_prefix_rejects_inverted_range() {
+        assert_eq!(
+            Host::ipv4_range_prefix(Ipv4Addr::new(10, 0, 0, 2), Ipv4Addr::new(10, 0, 0, 1)),
+            None
+        );
+    }
+}

lib/mod.rs

@@ -1,30 +1,6 @@
 mod dhcp_snooper;
 mod host;
+pub use host::NetType;
 mod poller;
 pub mod proxy;
 mod vm;
-
-use thiserror::Error;
-
-#[derive(Error, Debug)]
-pub enum Error {
-    #[error("initialization failed")]
-    InitFailed { source: Box<dyn std::error::Error> },
-
-    #[error("failed to poll")]
-    PollFailed { source: std::io::Error },
-
-    #[error("vmnet failed")]
-    VmnetFailed { source: vmnet::Error },
-
-    #[error("vmnet returned unexpected data")]
-    VmnetUnexpected,
-
-    #[error("failed to do I/O on VM socket")]
-    VMIOFailed { source: std::io::Error },
-
-    #[error("failed to do I/O on host socket")]
-    HostIOFailed { source: vmnet::Error },
-}
-
-pub type Result<T> = std::result::Result<T, Error>;

lib/poller.rs

@@ -1,13 +1,17 @@
-use crate::{Error, Result};
+use anyhow::Result;
 use num_enum::IntoPrimitive;
+use polling::PollMode;
+use polling::os::kqueue::PollerKqueueExt;
+use std::os::fd::{AsRawFd, BorrowedFd};
 use std::os::unix::io::RawFd;
 use std::time::Duration;
 
-pub struct Poller {
+pub struct Poller<'poller> {
     poller: polling::Poller,
-    events: Vec<polling::Event>,
-    vm_fd: RawFd,
-    host_fd: RawFd,
+    events: polling::Events,
+    timeout: Duration,
+    vm_fd: BorrowedFd<'poller>,
+    host_fd: BorrowedFd<'poller>,
 }
 
 #[derive(IntoPrimitive)]
@@ -15,55 +19,68 @@ pub struct Poller {
 enum EventKey {
     VM,
     Host,
+    Interrupt,
 }
 
-impl Poller {
-    pub fn new(vm_fd: RawFd, host_fd: RawFd) -> Result<Poller> {
-        let poller =
-            polling::Poller::new().map_err(|err| Error::InitFailed { source: err.into() })?;
+impl Poller<'_> {
+    pub fn new<'poller>(
+        vm_fd: RawFd,
+        host_fd: RawFd,
+        timeout: Duration,
+    ) -> Result<Poller<'poller>> {
+        let poller = polling::Poller::new()?;
 
         Ok(Poller {
             poller,
-            events: Vec::new(),
-            vm_fd,
-            host_fd,
+            events: polling::Events::new(),
+            timeout,
+            vm_fd: unsafe { BorrowedFd::borrow_raw(vm_fd) },
+            host_fd: unsafe { BorrowedFd::borrow_raw(host_fd) },
         })
     }
 
     pub fn arm(&self) -> Result<()> {
-        self.poller
-            .add(self.vm_fd as RawFd, self.vm_interest())
-            .map_err(|err| Error::PollFailed { source: err })?;
+        unsafe {
+            self.poller.add_with_mode(
+                self.vm_fd.as_raw_fd(),
+                self.vm_interest(),
+                PollMode::Edge,
+            )?;
+            self.poller.add_with_mode(
+                self.host_fd.as_raw_fd(),
+                self.host_interest(),
+                PollMode::Edge,
+            )?;
+        }
 
+        let interrupt_signal = polling::os::kqueue::Signal(libc::SIGINT);
         self.poller
-            .add(self.host_fd as RawFd, self.host_interest())
-            .map_err(|err| Error::PollFailed { source: err })?;
+            .add_filter(interrupt_signal, EventKey::Interrupt.into(), PollMode::Edge)?;
 
         Ok(())
     }
 
-    pub fn rearm(&mut self) -> Result<()> {
+    pub fn rearm(&mut self) {
         self.events.clear();
-
-        self.poller
-            .modify(self.vm_fd as RawFd, self.vm_interest())
-            .map_err(|err| Error::PollFailed { source: err })?;
-        self.poller
-            .modify(self.host_fd as RawFd, self.host_interest())
-            .map_err(|err| Error::PollFailed { source: err })?;
-
-        Ok(())
     }
 
-    pub fn wait(&mut self) -> Result<(bool, bool)> {
-        self.poller
-            .wait(&mut self.events, Some(Duration::from_millis(100)))
-            .map_err(|err| Error::PollFailed { source: err })?;
+    pub fn wait(&mut self) -> Result<(bool, bool, bool)> {
+        self.poller.wait(&mut self.events, Some(self.timeout))?;
 
-        let vm_readable = self.events.iter().any(|ev| ev.key == EventKey::VM.into());
-        let host_readable = self.events.iter().any(|ev| ev.key == EventKey::Host.into());
+        let vm_readable = self
+            .events
+            .iter()
+            .any(|ev| ev.key == Into::<usize>::into(EventKey::VM));
+        let host_readable = self
+            .events
+            .iter()
+            .any(|ev| ev.key == Into::<usize>::into(EventKey::Host));
+        let interrupt = self
+            .events
+            .iter()
+            .any(|ev| ev.key == Into::<usize>::into(EventKey::Interrupt));
 
-        Ok((vm_readable, host_readable))
+        Ok((vm_readable, host_readable, interrupt))
     }
 
     fn vm_interest(&self) -> polling::Event {

lib/proxy/exposed_port.rs

@@ -0,0 +1,47 @@
+use anyhow::{Context, Error, anyhow};
+use std::str::FromStr;
+
+#[derive(Debug, Clone, Copy, Default, PartialEq)]
+pub struct ExposedPort {
+    pub external_port: u16,
+    pub internal_port: u16,
+}
+
+impl FromStr for ExposedPort {
+    type Err = Error;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        let splits: Vec<&str> = s.split(':').collect();
+
+        match splits.len() {
+            2 => Ok(ExposedPort {
+                external_port: splits[0]
+                    .parse()
+                    .context(format!("invalid external port {:?}", splits[0]))?,
+                internal_port: splits[1]
+                    .parse()
+                    .context(format!("invalid internal port {:?}", splits[1]))?,
+            }),
+            _ => Err(anyhow!(
+                "invalid exposed port specification {:?}, the format should be EXTERNAL:INTERNAL",
+                s
+            )),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::proxy::exposed_port::ExposedPort;
+
+    #[test]
+    fn exposed_port() {
+        assert_eq!(
+            ExposedPort {
+                external_port: 2222,
+                internal_port: 22
+            },
+            "2222:22".parse().unwrap()
+        );
+    }
+}

lib/proxy/host.rs

@@ -1,9 +1,9 @@
-use crate::proxy::udp_packet_helper::UdpPacketHelper;
 use crate::proxy::Proxy;
-use crate::{Error, Result};
+use crate::proxy::udp_packet_helper::UdpPacketHelper;
+use anyhow::{Context, Result};
 use smoltcp::wire::{EthernetFrame, EthernetProtocol, Ipv4Packet, UdpPacket};
 
-impl Proxy {
+impl Proxy<'_> {
     pub(crate) fn process_frame_from_host(&mut self, frame: &EthernetFrame<&[u8]>) -> Result<()> {
         if self.allowed_from_host(frame).is_none() {
             // Block packet by not forwarding it to the VM
@@ -16,13 +16,35 @@ impl Proxy {
             self.snoop(frame);
         }
 
-        self.vm
-            .write(frame.as_ref())
-            .map(|_| ())
-            .map_err(|err| Error::VMIOFailed { source: err })
+        match self.vm.write(frame.as_ref()) {
+            Ok(_) => Ok(()),
+            Err(err) => {
+                if let Some(libc::ENOBUFS) = err.raw_os_error() {
+                    if !self.enobufs_encountered {
+                        sentry::capture_message(
+                            "No buffer space available in VM's socket",
+                            sentry::Level::Warning,
+                        );
+                        self.enobufs_encountered = true;
+                    }
+
+                    return Ok(());
+                }
+
+                Err(err).context("failed to write to the VM")
+            }
+        }
     }
 
     fn allowed_from_host(&mut self, frame: &EthernetFrame<&[u8]>) -> Option<()> {
+        let from_gateway = frame.src_addr() == self.host.gateway_mac;
+        let peer_action = self.rules_mac.get(frame.src_addr().as_bytes());
+        let from_allowed_peer = peer_action == Some(&crate::proxy::Action::Allow);
+
+        if !from_gateway && !from_allowed_peer {
+            return None;
+        }
+
         match frame.ethertype() {
             EthernetProtocol::Arp => Some(()),
             EthernetProtocol::Ipv4 => Some(()),
@@ -44,7 +66,7 @@ impl Proxy {
             return;
         }
 
-        if ipv4_pkt.protocol() != smoltcp::wire::IpProtocol::Udp {
+        if ipv4_pkt.next_header() != smoltcp::wire::IpProtocol::Udp {
             return;
         }
 

lib/proxy/mod.rs

@@ -1,58 +1,181 @@
+mod exposed_port;
 mod host;
+mod port_forwarder;
 mod udp_packet_helper;
 mod vm;
 
 use crate::dhcp_snooper::DhcpSnooper;
 use crate::host::Host;
+use crate::host::NetType;
 use crate::poller::Poller;
 use crate::vm::VM;
-use crate::Error;
-use crate::Result;
+use anyhow::Result;
+pub use exposed_port::ExposedPort;
+use ipnet::Ipv4Net;
 use mac_address::MacAddress;
+use port_forwarder::PortForwarder;
+use prefix_trie::{Prefix, PrefixMap};
 use smoltcp::wire::EthernetFrame;
+use std::collections::HashMap;
 use std::io::ErrorKind;
 use std::os::unix::io::{AsRawFd, RawFd};
+use std::str::FromStr;
+use std::time::Duration;
+use vmnet::Batch;
 
-pub struct Proxy {
+pub struct Proxy<'proxy> {
     vm: VM,
     host: Host,
-    poller: Poller,
+    poller: Poller<'proxy>,
     vm_mac_address: smoltcp::wire::EthernetAddress,
     dhcp_snooper: DhcpSnooper,
+    rules: PrefixMap<Ipv4Net, Action>,
+    rules_mac: HashMap<[u8; 6], Action>,
+    enobufs_encountered: bool,
+    port_forwarder: PortForwarder,
 }
 
-impl Proxy {
-    pub fn new(vm_fd: RawFd, vm_mac_address: MacAddress) -> Result<Proxy> {
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum Target {
+    Prefix(Ipv4Net),
+    MacAddress(MacAddress),
+    Host,
+}
+
+impl Target {
+    pub fn is_ipv4_default_route(&self) -> bool {
+        matches!(self, Target::Prefix(prefix) if *prefix == Ipv4Net::zero())
+    }
+
+    pub fn is_mac_address(&self) -> bool {
+        matches!(self, Target::MacAddress(_))
+    }
+}
+
+impl FromStr for Target {
+    type Err = ipnet::AddrParseError;
+
+    fn from_str(s: &str) -> std::result::Result<Self, Self::Err> {
+        if s == "@host" {
+            return Ok(Target::Host);
+        }
+
+        if let Ok(mac_address) = MacAddress::from_str(s) {
+            return Ok(Target::MacAddress(mac_address));
+        }
+
+        Ipv4Net::from_str(s).map(Target::Prefix)
+    }
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub(crate) enum Action {
+    Block,
+    Allow,
+}
+
+impl Proxy<'_> {
+    pub fn new<'proxy>(
+        vm_fd: RawFd,
+        vm_mac_address: MacAddress,
+        vm_net_type: NetType,
+        enable_isolation: bool,
+        allow: Vec<Target>,
+        block: Vec<Target>,
+        exposed_ports: Vec<ExposedPort>,
+    ) -> Result<Proxy<'proxy>> {
         let vm = VM::new(vm_fd)?;
-        let host = Host::new()?;
-        let poller = Poller::new(vm.as_raw_fd(), host.as_raw_fd())?;
+        let host = Host::new(vm_net_type, enable_isolation)?;
+        let poller_timeout = Duration::from_millis(100);
+        let poller = Poller::new(vm.as_raw_fd(), host.as_raw_fd(), poller_timeout)?;
+
+        // Craft packet filter rules
+        //
+        // SECURITY: blocking rules must always take precedence
+        // over allowing rules when prefixes are identical.
+        let mut rules = PrefixMap::new();
+        let mut rules_mac = HashMap::new();
+
+        for allow_target in allow {
+            let allow_prefix = match allow_target {
+                Target::Prefix(prefix) => prefix,
+                Target::Host => host.gateway_ip.into(),
+                Target::MacAddress(mac_address) => {
+                    rules_mac.insert(mac_address.bytes(), Action::Allow);
+
+                    continue;
+                }
+            };
+
+            rules.insert(allow_prefix, Action::Allow);
+        }
+
+        for block_target in block {
+            let block_prefix = match block_target {
+                Target::Prefix(prefix) => prefix,
+                Target::Host => host.gateway_ip.into(),
+                Target::MacAddress(mac_address) => {
+                    rules_mac.insert(mac_address.bytes(), Action::Block);
+
+                    continue;
+                }
+            };
+
+            rules.insert(block_prefix, Action::Block);
+        }
 
         Ok(Proxy {
             vm,
             host,
             poller,
             vm_mac_address: smoltcp::wire::EthernetAddress(vm_mac_address.bytes()),
-            dhcp_snooper: Default::default(),
+            dhcp_snooper: DhcpSnooper::new(poller_timeout),
+            rules,
+            rules_mac,
+            enobufs_encountered: false,
+            port_forwarder: PortForwarder::new(exposed_ports),
         })
     }
 
     pub fn run(&mut self) -> Result<()> {
+        // Create a single buffer from reading from the VM
         let mut buf: Vec<u8> = vec![0; self.host.max_packet_size as usize];
 
+        // Create multiple buffers and a batch for reading from the host
+        let mut bufs = vec![
+            vec![0u8; self.host.max_packet_size as usize];
+            self.host.read_max_packets as usize
+        ];
+        let mut batch = Batch::preallocate(bufs.len());
+
         self.poller.arm()?;
 
         loop {
-            let (vm_readable, host_readable) = self.poller.wait()?;
+            let (vm_readable, host_readable, interrupt) = self.poller.wait()?;
+
+            // Update coarse time for the DHCP snooper
+            coarsetime::Instant::update();
 
             if vm_readable {
                 self.read_from_vm(buf.as_mut_slice())?;
             }
 
             if host_readable {
-                self.read_from_host(buf.as_mut_slice())?;
+                self.read_from_host(&mut batch, &mut bufs)?;
             }
 
-            self.poller.rearm()?;
+            // Graceful termination
+            if interrupt {
+                return Ok(());
+            }
+
+            // Timeout
+            if !vm_readable && !host_readable && !interrupt {
+                self.port_forwarder
+                    .tick(&mut self.host, self.dhcp_snooper.lease());
+            }
+
+            self.poller.rearm();
         }
     }
 
@@ -60,6 +183,9 @@ impl Proxy {
         loop {
             match self.vm.read(buf) {
                 Ok(n) => {
+                    // Update coarse time for the DHCP snooper
+                    coarsetime::Instant::update();
+
                     if let Ok(frame) = EthernetFrame::new_checked(&buf[..n]) {
                         self.process_frame_from_vm(frame)?;
                     }
@@ -69,18 +195,23 @@ impl Proxy {
                         return Ok(());
                     }
 
-                    return Err(Error::VMIOFailed { source: err });
+                    return Err(err.into());
                 }
             }
         }
     }
 
-    fn read_from_host(&mut self, buf: &mut [u8]) -> Result<()> {
+    fn read_from_host(&mut self, batch: &mut Batch, bufs: &mut [Vec<u8>]) -> Result<()> {
         loop {
-            match self.host.read(buf) {
-                Ok(n) => {
-                    if let Ok(pkt) = EthernetFrame::new_checked(&buf[..n]) {
-                        self.process_frame_from_host(&pkt)?;
+            match self.host.read(batch, bufs) {
+                Ok(pktcnt) => {
+                    // Update coarse time for the DHCP snooper
+                    coarsetime::Instant::update();
+
+                    for buf in batch.packet_sized_bufs(bufs).take(pktcnt) {
+                        if let Ok(pkt) = EthernetFrame::new_checked(buf) {
+                            self.process_frame_from_host(&pkt)?;
+                        }
                     }
                 }
                 Err(err) => {
@@ -88,9 +219,169 @@ impl Proxy {
                         return Ok(());
                     }
 
-                    return Err(Error::HostIOFailed { source: err });
+                    return Err(err.into());
                 }
             }
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use crate::NetType;
+    use crate::dhcp_snooper::Lease;
+    use crate::proxy::{Action, Proxy, Target};
+    use ipnet::Ipv4Net;
+    use mac_address::MacAddress;
+    use nix::sys::socket::{AddressFamily, SockFlag, SockType, socketpair};
+    use prefix_trie::PrefixMap;
+    use serial_test::serial;
+    use smoltcp::wire::{EthernetAddress, Ipv4Address, Ipv4Packet};
+    use std::collections::HashSet;
+    use std::os::fd::AsRawFd;
+    use std::str::FromStr;
+    use std::time::Duration;
+
+    #[test]
+    #[serial]
+    fn test_blocking_takes_precedence() {
+        let vm_ip = Ipv4Address::from_str("192.168.0.2").unwrap();
+        let proxy = create_proxy(vm_ip, vec!["66.66.0.0/16"], vec!["66.66.0.0/16"]);
+
+        assert_eq!(
+            proxy.rules,
+            PrefixMap::<Ipv4Net, Action>::from_iter(vec![(
+                Ipv4Net::from_str("66.66.0.0/16").unwrap(),
+                Action::Block
+            ),])
+        );
+
+        assert!(allowed_from_vm_ipv4(&proxy, vm_ip, "66.66.66.66").is_none());
+    }
+
+    #[test]
+    #[serial]
+    fn test_longest_prefix_match_wins() {
+        let vm_ip = Ipv4Address::from_str("192.168.0.2").unwrap();
+        let proxy = create_proxy(vm_ip, vec!["33.33.33.33/32"], vec!["33.33.33.0/24"]);
+
+        assert_eq!(
+            proxy.rules,
+            PrefixMap::<Ipv4Net, Action>::from_iter(vec![
+                (Ipv4Net::from_str("33.33.33.33/32").unwrap(), Action::Allow),
+                (Ipv4Net::from_str("33.33.33.0/24").unwrap(), Action::Block),
+            ])
+        );
+
+        assert!(allowed_from_vm_ipv4(&proxy, vm_ip, "33.33.33.32").is_none());
+        assert!(allowed_from_vm_ipv4(&proxy, vm_ip, "33.33.33.33").is_some());
+        assert!(allowed_from_vm_ipv4(&proxy, vm_ip, "33.33.33.34").is_none());
+    }
+
+    #[test]
+    #[serial]
+    fn test_allow_host() {
+        let vm_ip = Ipv4Address::from_str("192.168.0.2").unwrap();
+        let proxy = create_proxy(vm_ip, vec!["@host"], vec!["0.0.0.0/0"]);
+
+        assert_eq!(
+            proxy.rules,
+            PrefixMap::from_iter(vec![
+                (proxy.host.gateway_ip.into(), Action::Allow),
+                (Ipv4Net::from_str("0.0.0.0/0").unwrap(), Action::Block),
+            ])
+        );
+
+        // Access to global IPs should be disallowed because of --block=0.0.0.0/0
+        assert!(allowed_from_vm_ipv4(&proxy, vm_ip, "8.8.8.8").is_none());
+
+        // Despite the above, access to host IP address should be possible because of --allow=@host
+        assert!(allowed_from_vm_ipv4(&proxy, vm_ip, &proxy.host.gateway_ip.to_string()).is_some());
+    }
+
+    #[test]
+    #[serial]
+    fn test_allow_mac_takes_precedence_over_blocked_prefix() {
+        let vm_ip = Ipv4Address::from_str("192.168.0.2").unwrap();
+        let peer_mac = EthernetAddress([0x02, 0, 0, 0, 0, 0x02]);
+        let proxy = create_proxy(vm_ip, vec!["02:00:00:00:00:02"], vec!["0.0.0.0/0"]);
+
+        assert!(allowed_from_vm_ipv4_to_mac(&proxy, vm_ip, "192.168.0.3", peer_mac).is_some());
+    }
+
+    #[test]
+    #[serial]
+    fn test_block_mac_takes_precedence_over_allowed_prefix() {
+        let vm_ip = Ipv4Address::from_str("192.168.0.2").unwrap();
+        let peer_mac = EthernetAddress([0x02, 0, 0, 0, 0, 0x02]);
+        let proxy = create_proxy(
+            vm_ip,
+            vec!["192.168.0.0/24", "02:00:00:00:00:02"],
+            vec!["02:00:00:00:00:02"],
+        );
+
+        assert!(allowed_from_vm_ipv4_to_mac(&proxy, vm_ip, "192.168.0.3", peer_mac).is_none());
+    }
+
+    fn create_proxy<'test>(vm_ip: Ipv4Address, allow: Vec<&str>, block: Vec<&str>) -> Proxy<'test> {
+        let (vm_fd, _) = socketpair(
+            AddressFamily::Unix,
+            SockType::Datagram,
+            None,
+            SockFlag::empty(),
+        )
+        .unwrap();
+        let vm_fd = Box::leak(Box::new(vm_fd));
+
+        let allow: Vec<Target> = allow
+            .into_iter()
+            .map(|cidr| cidr.parse().unwrap())
+            .collect();
+        let block: Vec<Target> = block
+            .into_iter()
+            .map(|cidr| cidr.parse().unwrap())
+            .collect();
+        let enable_isolation = !allow.iter().any(Target::is_ipv4_default_route)
+            && !allow.iter().chain(block.iter()).any(Target::is_mac_address);
+
+        let mut proxy = Proxy::new(
+            vm_fd.as_raw_fd(),
+            MacAddress::from_str("02:00:00:00:00:01").unwrap(),
+            NetType::Nat,
+            enable_isolation,
+            allow,
+            block,
+            Vec::default(),
+        )
+        .unwrap();
+
+        proxy.dhcp_snooper.set_lease(Some(Lease::new(
+            vm_ip,
+            Duration::from_secs(600),
+            HashSet::new(),
+        )));
+
+        proxy
+    }
+
+    fn allowed_from_vm_ipv4(proxy: &Proxy, src: Ipv4Address, dst: &str) -> Option<()> {
+        allowed_from_vm_ipv4_to_mac(proxy, src, dst, EthernetAddress([0x02, 0, 0, 0, 0, 0x03]))
+    }
+
+    fn allowed_from_vm_ipv4_to_mac(
+        proxy: &Proxy,
+        src: Ipv4Address,
+        dst: &str,
+        dst_mac: EthernetAddress,
+    ) -> Option<()> {
+        let mut buf = vec![0; 1500];
+
+        let mut ipv4_pkt_mut = Ipv4Packet::new_unchecked(&mut buf[..]);
+        ipv4_pkt_mut.set_src_addr(src);
+        ipv4_pkt_mut.set_dst_addr(Ipv4Address::from_str(dst).unwrap());
+
+        let ipv4_pkt = Ipv4Packet::new_unchecked(buf.as_slice());
+
+        proxy.allowed_from_vm_ipv4(ipv4_pkt, dst_mac)
+    }
+}

lib/proxy/port_forwarder.rs

@@ -0,0 +1,99 @@
+use crate::dhcp_snooper::Lease;
+use crate::host::Host;
+use crate::proxy::exposed_port::ExposedPort;
+use anyhow::Result;
+use log::error;
+use std::net::Ipv4Addr;
+
+#[derive(Default)]
+pub struct PortForwarder {
+    port_forwardings: Vec<PortForwarding>,
+    failed: bool,
+}
+
+#[derive(Debug, Clone, Copy, Default)]
+struct PortForwarding {
+    exposed_port: ExposedPort,
+    forwarding_to_addr: Option<Ipv4Addr>,
+}
+
+impl PortForwarder {
+    pub fn new(exposed_ports: Vec<ExposedPort>) -> PortForwarder {
+        let port_forwardings = exposed_ports
+            .into_iter()
+            .map(|exposed_port| PortForwarding {
+                exposed_port,
+                ..Default::default()
+            })
+            .collect();
+
+        PortForwarder {
+            port_forwardings,
+            ..Default::default()
+        }
+    }
+
+    pub fn tick(&mut self, host: &mut Host, lease: &Option<Lease>) {
+        if self.failed {
+            return;
+        }
+
+        if let Err(err) = self.tick_inner(host, lease) {
+            error!("port-forwarding failed: {}", err);
+
+            self.failed = true;
+        }
+    }
+
+    fn tick_inner(&mut self, host: &mut Host, lease: &Option<Lease>) -> Result<()> {
+        if let Some(lease) = lease {
+            // Lease exists, but is not valid, remove all port forwardings
+            if !lease.valid() {
+                self.remove_all_port_forwardings(host)?;
+
+                return Ok(());
+            }
+
+            // Lease exists and is valid, install/re-install port forwardings
+            for port_forwarding in &mut self.port_forwardings {
+                if let Some(installed_addr) = port_forwarding.forwarding_to_addr {
+                    // Port forwarding already installed, perhaps it's outdated?
+                    if installed_addr == lease.address() {
+                        // Nope, the port forwarding is up to date
+                        continue;
+                    }
+
+                    // Remove port forwarding since the lease address had changed
+                    host.port_forwarding_remove_rule(port_forwarding.exposed_port.external_port)?;
+                    port_forwarding.forwarding_to_addr = None;
+                }
+
+                // Install new port forwarding
+                host.port_forwarding_add_rule(
+                    port_forwarding.exposed_port.external_port,
+                    lease.address(),
+                    port_forwarding.exposed_port.internal_port,
+                )?;
+                port_forwarding.forwarding_to_addr = Some(lease.address());
+            }
+        } else {
+            // Lease does not exist, remove all port forwardings
+            self.remove_all_port_forwardings(host)?;
+        }
+
+        Ok(())
+    }
+
+    fn remove_all_port_forwardings(&mut self, host: &mut Host) -> Result<()> {
+        for port_forwarding in &mut self.port_forwardings {
+            if port_forwarding.forwarding_to_addr.is_none() {
+                continue;
+            }
+
+            host.port_forwarding_remove_rule(port_forwarding.exposed_port.external_port)?;
+            port_forwarding.forwarding_to_addr = None;
+        }
+
+        Ok(())
+    }
+}

lib/proxy/vm.rs

@@ -1,12 +1,14 @@
 use crate::proxy::udp_packet_helper::UdpPacketHelper;
-use crate::proxy::Proxy;
-use crate::{Error, Result};
+use crate::proxy::{Action, Proxy};
+use anyhow::Context;
+use anyhow::Result;
+use ipnet::Ipv4Net;
 use smoltcp::wire::{
-    ArpPacket, EthernetFrame, EthernetProtocol, IpProtocol, Ipv4Packet, UdpPacket,
+    ArpPacket, EthernetAddress, EthernetFrame, EthernetProtocol, IpProtocol, Ipv4Packet, UdpPacket,
 };
 use std::net::Ipv4Addr;
 
-impl Proxy {
+impl Proxy<'_> {
     pub(crate) fn process_frame_from_vm(&mut self, frame: EthernetFrame<&[u8]>) -> Result<()> {
         if self.allowed_from_vm(&frame).is_none() {
             // Block packet by not forwarding it to the host
@@ -16,7 +18,7 @@ impl Proxy {
         self.host
             .write(frame.as_ref())
             .map(|_| ())
-            .map_err(|err| Error::HostIOFailed { source: err })
+            .context("failed to write to the host")
     }
 
     fn allowed_from_vm(&self, frame: &EthernetFrame<&[u8]>) -> Option<()> {
@@ -27,26 +29,34 @@ impl Proxy {
         match frame.ethertype() {
             EthernetProtocol::Arp => {
                 let arp_pkt = ArpPacket::new_checked(frame.payload()).ok()?;
-                self.allowed_from_vm_arp(arp_pkt)
+                self.allowed_from_vm_arp(arp_pkt, frame.dst_addr())
             }
             EthernetProtocol::Ipv4 => {
                 let ipv4_pkt = Ipv4Packet::new_checked(frame.payload()).ok()?;
-                self.allowed_from_vm_ipv4(ipv4_pkt)
+                self.allowed_from_vm_ipv4(ipv4_pkt, frame.dst_addr())
             }
             _ => None,
         }
     }
 
-    fn allowed_from_vm_arp(&self, arp_pkt: ArpPacket<&[u8]>) -> Option<()> {
+    fn allowed_from_vm_arp(
+        &self,
+        arp_pkt: ArpPacket<&[u8]>,
+        dst_mac: EthernetAddress,
+    ) -> Option<()> {
         if arp_pkt.source_hardware_addr() != self.vm_mac_address.0 {
             return None;
         }
 
+        if self.rules_mac.get(dst_mac.as_bytes()) == Some(&Action::Block) {
+            return None;
+        }
+
         let source_protocol_addr: [u8; 4] = arp_pkt.source_protocol_addr().try_into().unwrap();
         let source_protocol_addr = Ipv4Addr::from(source_protocol_addr);
 
         if let Some(lease) = self.dhcp_snooper.lease() {
-            if lease.valid_ip_source(source_protocol_addr.into()) {
+            if lease.valid_ip_source(source_protocol_addr) {
                 return Some(());
             }
         } else if source_protocol_addr.is_unspecified() {
@@ -56,32 +66,64 @@ impl Proxy {
         None
     }
 
-    fn allowed_from_vm_ipv4(&self, ipv4_pkt: Ipv4Packet<&[u8]>) -> Option<()> {
-        // Once we've learned the VM's IP from the DHCP snooping,
-        // allow all global traffic for that VM's IP
-        if let Some(lease) = &self.dhcp_snooper.lease() {
-            let dst_is_global =
-                ip_network::IpNetwork::from(Ipv4Addr::from(ipv4_pkt.dst_addr().0)).is_global();
+    pub(crate) fn allowed_from_vm_ipv4(
+        &self,
+        ipv4_pkt: Ipv4Packet<&[u8]>,
+        dst_mac: EthernetAddress,
+    ) -> Option<()> {
+        // Is this packet coming from VM's IP address that we've learned from DHCP snooping?
+        if let Some(lease) = &self.dhcp_snooper.lease()
+            && lease.valid_ip_source(ipv4_pkt.src_addr())
+        {
+            let dst_addr = ipv4_pkt.dst_addr();
 
-            if lease.valid_ip_source(ipv4_pkt.src_addr()) && dst_is_global {
+            match self.rules_mac.get(dst_mac.as_bytes()) {
+                Some(Action::Block) => return None,
+                Some(Action::Allow) => return Some(()),
+                None => {}
+            }
+
+            // Filter traffic based on user-specified rules first
+            if !self.rules.is_empty() {
+                let dst_net = Ipv4Net::from(dst_addr);
+
+                if let Some((_, action)) = self.rules.get_lpm(&dst_net) {
+                    return match action {
+                        Action::Allow => Some(()),
+                        Action::Block => None,
+                    };
+                }
+            }
+
+            // When no user-specified rules matched, simply allow all global traffic
+            if ip_network::IpNetwork::from(dst_addr).is_global() {
                 return Some(());
             }
+
+            // Additionally, allow communication with the host,
+            // otherwise things like SSH to a VM won't work
+            if ipv4_pkt.dst_addr() == self.host.gateway_ip {
+                return Some(());
+            }
+
+            // Additionally, allow DNS requests to DNS-servers
+            // provided to a VM by the host's DHCP server
+            if ipv4_pkt.next_header() == IpProtocol::Udp {
+                let udp_pkt = UdpPacket::new_checked(ipv4_pkt.payload()).ok()?;
+
+                if udp_pkt.is_dns_request()
+                    && self.dhcp_snooper.valid_dns_target(&ipv4_pkt.dst_addr())
+                {
+                    return Some(());
+                }
+            }
         }
 
-        // Allow communication with host
-        if ipv4_pkt.dst_addr() == self.host.gateway_ip {
-            return Some(());
-        }
-
-        if ipv4_pkt.protocol() == IpProtocol::Udp {
+        // Allow outgoing DHCP requests to broadcast addresses,
+        // otherwise DHCP snooper will never be populated
+        if ipv4_pkt.next_header() == IpProtocol::Udp {
             let udp_pkt = UdpPacket::new_checked(ipv4_pkt.payload()).ok()?;
 
-            // Allow DNS communication with the DNS-servers provided by DHCP
-            if udp_pkt.is_dns_request() && self.dhcp_snooper.valid_dns_target(&ipv4_pkt.dst_addr())
-            {
-                return Some(());
-            }
-
             // Allow DHCP communication with the bootpd(8) on host via broadcast address
             if udp_pkt.is_dhcp_request() && ipv4_pkt.dst_addr().is_broadcast() {
                 return Some(());

lib/vm.rs

@@ -1,4 +1,4 @@
-use crate::{Error, Result};
+use anyhow::Result;
 use std::os::unix::io::{AsRawFd, FromRawFd, RawFd};
 use std::os::unix::net::UnixDatagram;
 
@@ -9,8 +9,7 @@ pub struct VM {
 impl VM {
     pub fn new(vm_fd: RawFd) -> Result<VM> {
         let sock = unsafe { UnixDatagram::from_raw_fd(vm_fd) };
-        sock.set_nonblocking(true)
-            .map_err(|err| Error::InitFailed { source: err.into() })?;
+        sock.set_nonblocking(true)?;
 
         Ok(VM { sock })
     }

rust-toolchain.toml

@@ -0,0 +1,2 @@
+[toolchain]
+channel = "nightly"

src/main.rs

@@ -1,17 +1,26 @@
+use anyhow::{Context, anyhow};
 use clap::Parser;
+use log::LevelFilter;
+use nix::sys::signal::{SigHandler, Signal, signal};
+use oslog::OsLogger;
 use privdrop::PrivDrop;
+use softnet::NetType;
+use softnet::proxy::ExposedPort;
 use softnet::proxy::Proxy;
+use softnet::proxy::Target;
+use std::borrow::Cow;
+use std::env;
 use std::os::raw::c_int;
 use std::os::unix::io::RawFd;
 use std::os::unix::process::CommandExt;
-use std::process::Command;
+use std::process::{Command, ExitCode};
 use system_configuration::core_foundation::base::TCFType;
 use system_configuration::core_foundation::dictionary::CFDictionary;
 use system_configuration::core_foundation::number::CFNumber;
 use system_configuration::core_foundation::string::CFString;
 use system_configuration::preferences::SCPreferences;
 use system_configuration::sys::preferences::{SCPreferencesCommitChanges, SCPreferencesSetValue};
-use users::{get_current_groupname, get_current_username, get_effective_uid};
+use uzers::{get_current_groupname, get_current_username, get_effective_uid};
 
 #[derive(Parser, Debug)]
 struct Args {
@@ -24,6 +33,9 @@ struct Args {
     #[clap(long, help = "MAC address to enforce for the VM")]
     vm_mac_address: mac_address::MacAddress,
 
+    #[clap(long, value_enum, help = "type of network to use for the VM", default_value_t=NetType::Nat)]
+    vm_net_type: NetType,
+
     #[clap(
         long,
         help = "set bootpd(8) lease time to this value (in seconds) before starting the VM",
@@ -37,24 +49,105 @@ struct Args {
     #[clap(long, help = "group name to drop privileges to")]
     group: Option<String>,
 
-    #[clap(long, hide=true)]
+    #[clap(
+        long,
+        help = "Comma-separated list of CIDRs to allow the traffic to \
+        (e.g. --allow=192.168.0.0/24 may be used to allow a LAN access for a VM), \
+        plus supported @-aliases. Currently the only supported @-alias is @host, \
+        which matches the vmnet bridge gateway IP. \
+        When used with --block, the longest prefix match always wins. \
+        In case an identical prefix is both --allow'ed and --block'ed, \
+        blocking will take precedence. --allow=0.0.0.0/0 is a special case, \
+        it additionally disables bridge isolation (even when --block=0.0.0.0/0 is specified).",
+        value_name = "comma-separated CIDRs, MAC addresses or @-aliases",
+        use_value_delimiter = true,
+        action = clap::ArgAction::Set
+    )]
+    allow: Vec<Target>,
+
+    #[clap(
+        long,
+        help = "Comma-separated list of CIDRs to block the traffic to \
+        (e.g. --block=0.0.0.0/0 may be used to establish a default deny policy \
+        that is further relaxed with --allow), plus supported @-aliases. \
+        Currently the only supported @-alias is @host, which matches the vmnet bridge gateway IP. \
+        When used with --allow, the longest prefix match always wins. \
+        In case an identical prefix is both --allow'ed and --block'ed, \
+        blocking will take precedence.",
+        value_name = "comma-separated CIDRs, MAC addresses or @-aliases",
+        use_value_delimiter = true,
+        action = clap::ArgAction::Set
+    )]
+    block: Vec<Target>,
+
+    #[clap(
+        long,
+        help = "comma-separated list of TCP ports to expose (e.g. --expose 2222:22,8080:80)",
+        value_name = "comma-separated port specifications",
+        use_value_delimiter = true,
+        action = clap::ArgAction::Set
+    )]
+    expose: Vec<ExposedPort>,
+
+    #[clap(long, hide = true)]
     sudo_escalation_probing: bool,
 
-    #[clap(long, hide=true)]
+    #[clap(long, hide = true)]
     sudo_escalation_done: bool,
 }
 
-fn main() {
-    if let Err(err) = try_main() {
-        match err.source() {
-            Some(source) => eprintln!("{}: {}", err, source),
-            None => eprintln!("{}", err),
+fn main() -> ExitCode {
+    // Enable backtraces by default
+    if env::var("RUST_BACKTRACE").is_err() {
+        unsafe {
+            env::set_var("RUST_BACKTRACE", "full");
+        }
+    }
+
+    // Initialize Sentry
+    let _sentry = sentry::init(sentry::ClientOptions {
+        release: option_env!("CIRRUS_TAG").map(|tag| Cow::from(format!("softnet@{tag}"))),
+        ..Default::default()
+    });
+
+    // Enrich future events with Cirrus CI-specific tags
+    if let Ok(tags) = env::var("CIRRUS_SENTRY_TAGS") {
+        sentry::configure_scope(|scope| {
+            for (key, value) in tags.split(',').filter_map(|tag| tag.split_once('=')) {
+                scope.set_tag(key, value);
+            }
+        });
+    }
+
+    match try_main() {
+        Ok(_) => ExitCode::SUCCESS,
+        Err(err) => {
+            // Print the error into stderr
+            let causes: Vec<String> = err.chain().map(|x| x.to_string()).collect();
+            eprintln!("{}", causes.join(": "));
+
+            // Capture the error into Sentry
+            sentry_anyhow::capture_anyhow(&err);
+
+            ExitCode::FAILURE
         }
-        std::process::exit(1);
     }
 }
 
-fn try_main() -> Result<(), Box<dyn std::error::Error>> {
+fn try_main() -> anyhow::Result<()> {
+    // Initialize logger
+    OsLogger::new("org.cirruslabs.softnet")
+        .level_filter(LevelFilter::Info)
+        .init()?;
+
+    // The default signal(3)[1] action for SIGINT is to interrupt program,
+    // but we want to handle SIGINT ourselves, so we ignore it. The kqueue(2)'s[2]
+    // EVFILT_SIGNAL will receive it anyways, because it has lower precedence.
+    //
+    // [1]: https://developer.apple.com/library/archive/documentation/System/Conceptual/ManPages_iPhoneOS/man3/signal.3.html
+    // [2]: https://developer.apple.com/library/archive/documentation/System/Conceptual/ManPages_iPhoneOS/man2/kqueue.2.html
+    unsafe { signal(Signal::SIGINT, SigHandler::SigIgn) }?;
+
     let args: Args = Args::parse();
 
     // No need to run anything, just return
@@ -66,11 +159,11 @@ fn try_main() -> Result<(), Box<dyn std::error::Error>> {
 
     // Retrieve real (not effective) user and group names
     let current_user_name = get_current_username()
-        .ok_or("failed to resolve real user name")?
+        .ok_or(anyhow!("failed to resolve real user name"))?
         .to_string_lossy()
         .to_string();
     let current_group_name = get_current_groupname()
-        .ok_or("failed to resolve real group name")?
+        .ok_or(anyhow!("failed to resolve real group name"))?
         .to_string_lossy()
         .to_string();
 
@@ -81,7 +174,8 @@ fn try_main() -> Result<(), Box<dyn std::error::Error>> {
             let args = std::env::args().skip(1);
 
             let _ = Command::new("sudo")
-                .arg("-n")
+                .arg("--non-interactive")
+                .arg("--preserve-env=SENTRY_DSN,CIRRUS_SENTRY_TAGS")
                 .arg(&exe)
                 .args(args)
                 .arg("--sudo-escalation-done")
@@ -92,14 +186,27 @@ fn try_main() -> Result<(), Box<dyn std::error::Error>> {
                 .exec();
         }
 
-        return Err("root privileges are required to run and passwordless sudo was not available".into());
+        return Err(anyhow!(
+            "root privileges are required to run and passwordless sudo was not available"
+        ));
     }
 
     // Set bootpd(8) min/max lease time while still having the root privileges
     set_bootpd_lease_time(args.bootpd_lease_time);
 
+    let enable_isolation = bridge_isolation_enabled(&args.allow, &args.block);
+
     // Initialize the proxy while still having the root privileges
-    let mut proxy = Proxy::new(args.vm_fd as RawFd, args.vm_mac_address)?;
+    let mut proxy = Proxy::new(
+        args.vm_fd as RawFd,
+        args.vm_mac_address,
+        args.vm_net_type,
+        enable_isolation,
+        args.allow,
+        args.block,
+        args.expose,
+    )
+    .context("failed to initialize proxy")?;
 
     // Drop effective privileges to the user
     // and group which have had invoked us
@@ -107,10 +214,10 @@ fn try_main() -> Result<(), Box<dyn std::error::Error>> {
         .user(args.user.unwrap_or(current_user_name))
         .group(args.group.unwrap_or(current_group_name))
         .apply()
-        .map_err(|err| format!("failed to drop privileges: {}", err))?;
+        .context("failed to drop privileges")?;
 
     // Run proxy
-    proxy.run().map_err(|err| err.into())
+    proxy.run()
 }
 
 fn sudo_escalation_works() -> bool {
@@ -127,6 +234,14 @@ fn sudo_escalation_works() -> bool {
         .unwrap_or(false)
 }
 
+fn bridge_isolation_enabled(allow: &[Target], block: &[Target]) -> bool {
+    let disables_isolation_for_compat = allow.iter().any(Target::is_ipv4_default_route);
+    let disables_isolation_for_mac_filtering =
+        allow.iter().chain(block.iter()).any(Target::is_mac_address);
+
+    !(disables_isolation_for_compat || disables_isolation_for_mac_filtering)
+}
+
 fn set_bootpd_lease_time(lease_time: u32) {
     let prefs = SCPreferences::group(
         &CFString::new("softnet"),
@@ -148,3 +263,44 @@ fn set_bootpd_lease_time(lease_time: u32) {
         SCPreferencesCommitChanges(prefs.as_concrete_TypeRef());
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn targets(values: &[&str]) -> Vec<Target> {
+        values.iter().map(|value| value.parse().unwrap()).collect()
+    }
+
+    #[test]
+    fn bridge_isolation_disabled_for_legacy_allow_default_route() {
+        assert!(!bridge_isolation_enabled(
+            &targets(&["0.0.0.0/0"]),
+            &targets(&[])
+        ));
+    }
+
+    #[test]
+    fn bridge_isolation_disabled_for_legacy_allow_default_route_even_when_blocked() {
+        assert!(!bridge_isolation_enabled(
+            &targets(&["0.0.0.0/0"]),
+            &targets(&["0.0.0.0/0"])
+        ));
+    }
+
+    #[test]
+    fn bridge_isolation_kept_for_block_default_route_only() {
+        assert!(bridge_isolation_enabled(
+            &targets(&[]),
+            &targets(&["0.0.0.0/0"])
+        ));
+    }
+
+    #[test]
+    fn bridge_isolation_disabled_for_mac_filtering() {
+        assert!(!bridge_isolation_enabled(
+            &targets(&[]),
+            &targets(&["02:00:00:00:00:02"])
+        ));
+    }
+}