mirror of
https://github.com/cirruslabs/softnet.git
synced 2026-10-19 07:52:33 +02:00
Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
cd5f1d2f4f | ||
|
|
a775a92772 | ||
|
|
f38d65f98f |
Generated
+13
-13
@@ -970,9 +970,9 @@ dependencies = [
|
|||||||
|
|
||||||
[[package]]
|
[[package]]
|
||||||
name = "proc-macro2"
|
name = "proc-macro2"
|
||||||
version = "1.0.51"
|
version = "1.0.66"
|
||||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
checksum = "5d727cae5b39d21da60fa540906919ad737832fe0b1c165da3a34d6548c849d6"
|
checksum = "18fb31db3f9bddb2ea821cde30a9f70117e3f119938b5ee630b7403aa6e2ead9"
|
||||||
dependencies = [
|
dependencies = [
|
||||||
"unicode-ident",
|
"unicode-ident",
|
||||||
]
|
]
|
||||||
@@ -1351,7 +1351,7 @@ dependencies = [
|
|||||||
"sentry-anyhow",
|
"sentry-anyhow",
|
||||||
"smoltcp",
|
"smoltcp",
|
||||||
"system-configuration",
|
"system-configuration",
|
||||||
"users",
|
"uzers",
|
||||||
"vmnet",
|
"vmnet",
|
||||||
]
|
]
|
||||||
|
|
||||||
@@ -1634,16 +1634,6 @@ dependencies = [
|
|||||||
"serde",
|
"serde",
|
||||||
]
|
]
|
||||||
|
|
||||||
[[package]]
|
|
||||||
name = "users"
|
|
||||||
version = "0.11.0"
|
|
||||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
||||||
checksum = "24cc0f6d6f267b73e5a2cadf007ba8f9bc39c6a6f9666f8cf25ea809a153b032"
|
|
||||||
dependencies = [
|
|
||||||
"libc",
|
|
||||||
"log",
|
|
||||||
]
|
|
||||||
|
|
||||||
[[package]]
|
[[package]]
|
||||||
name = "uuid"
|
name = "uuid"
|
||||||
version = "1.3.0"
|
version = "1.3.0"
|
||||||
@@ -1654,6 +1644,16 @@ dependencies = [
|
|||||||
"serde",
|
"serde",
|
||||||
]
|
]
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "uzers"
|
||||||
|
version = "0.11.3"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "76d283dc7e8c901e79e32d077866eaf599156cbf427fffa8289aecc52c5c3f63"
|
||||||
|
dependencies = [
|
||||||
|
"libc",
|
||||||
|
"log",
|
||||||
|
]
|
||||||
|
|
||||||
[[package]]
|
[[package]]
|
||||||
name = "vcpkg"
|
name = "vcpkg"
|
||||||
version = "0.2.15"
|
version = "0.2.15"
|
||||||
|
|||||||
+1
-1
@@ -22,7 +22,7 @@ mac_address = "1.1.3"
|
|||||||
privdrop = "0.5.2"
|
privdrop = "0.5.2"
|
||||||
anyhow = { version = "1.0.66", features = ["backtrace"] }
|
anyhow = { version = "1.0.66", features = ["backtrace"] }
|
||||||
ip_network = "0.4.1"
|
ip_network = "0.4.1"
|
||||||
users = "0.11.0"
|
uzers = "0.11.3"
|
||||||
system-configuration = "0.5.0"
|
system-configuration = "0.5.0"
|
||||||
num_enum = "0.5.7"
|
num_enum = "0.5.7"
|
||||||
sentry = { version = "0.29.1", features = ["debug-images"] }
|
sentry = { version = "0.29.1", features = ["debug-images"] }
|
||||||
|
|||||||
@@ -1,13 +1,14 @@
|
|||||||
# Softnet
|
# Softnet
|
||||||
|
|
||||||
Softnet is a software networking for [Tart](https://github.com/cirruslabs/tart) which provides better network isolation and alleviates DHCP shortage on production systems.
|
Softnet is a software networking for [Tart](https://github.com/cirruslabs/tart) which provides better network isolation and alleviates DHCP shortage on production systems.
|
||||||
|
Please check out [this blog post](https://cirrus-ci.org/blog/2022/07/07/isolating-network-between-tarts-macos-virtual-machines/) for backstory.
|
||||||
|
|
||||||
## Working model
|
## Working model
|
||||||
|
|
||||||
Softnet solves two problems:
|
Softnet solves two problems:
|
||||||
|
|
||||||
1. VM network isolation
|
1. VM network isolation
|
||||||
* [`VZNATNetworkDeviceAttachment`](https://developer.apple.com/documentation/virtualization/vznatnetworkdeviceattachment) (the default networking in Tart) enables [vmnet's bridge isolation](https://developer.apple.com/documentation/vmnet/vmnet_enable_isolation_key) by default and prevents cross-VM traffic, however it's still possible for any VM to spoof the host's ARP-table and capture other VMs traffic, for example
|
* [`VZNATNetworkDeviceAttachment`](https://developer.apple.com/documentation/virtualization/vznatnetworkdeviceattachment) (the default networking in Tart) enables [vmnet's bridge isolation](https://developer.apple.com/documentation/vmnet/vmnet_enable_isolation_key) by default and prevents cross-VM traffic, however it's still possible for any VM to spoof the host's ARP-table and capture other VMs traffic
|
||||||
2. DHCP exhaustion
|
2. DHCP exhaustion
|
||||||
* macOS built-in DHCP-server allocates a `/24` subnet with 86400 seconds lease time by default, which only allows for ~253 VMs a day (or 1 VM every ~6 minutes) to be spawned without causing a denial-of-service, which is pretty limiting for CI services like Cirrus CI
|
* macOS built-in DHCP-server allocates a `/24` subnet with 86400 seconds lease time by default, which only allows for ~253 VMs a day (or 1 VM every ~6 minutes) to be spawned without causing a denial-of-service, which is pretty limiting for CI services like Cirrus CI
|
||||||
|
|
||||||
@@ -30,4 +31,4 @@ For proper functioning, Softnet binary requires two things:
|
|||||||
|
|
||||||
## Running
|
## Running
|
||||||
|
|
||||||
Softnet is started and managed automatically by Tart if `--with-softnet` flag is present when calling `tart run`.
|
Softnet is started and managed automatically by Tart if `--net-softnet` flag is provided when calling `tart run`.
|
||||||
|
|||||||
+1
-1
@@ -15,7 +15,7 @@ use system_configuration::core_foundation::number::CFNumber;
|
|||||||
use system_configuration::core_foundation::string::CFString;
|
use system_configuration::core_foundation::string::CFString;
|
||||||
use system_configuration::preferences::SCPreferences;
|
use system_configuration::preferences::SCPreferences;
|
||||||
use system_configuration::sys::preferences::{SCPreferencesCommitChanges, SCPreferencesSetValue};
|
use system_configuration::sys::preferences::{SCPreferencesCommitChanges, SCPreferencesSetValue};
|
||||||
use users::{get_current_groupname, get_current_username, get_effective_uid};
|
use uzers::{get_current_groupname, get_current_username, get_effective_uid};
|
||||||
|
|
||||||
#[derive(Parser, Debug)]
|
#[derive(Parser, Debug)]
|
||||||
struct Args {
|
struct Args {
|
||||||
|
|||||||
Reference in New Issue
Block a user