public_git
/
tart
mirror of https://github.com/cirruslabs/tart.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Reject Softnet control FD with host networking

This commit is contained in:
Fedor Korotkov 2026-07-21 17:10:36 -04:00
parent 842320ac5c
commit 311eec95f4
No known key found for this signature in database
2 changed files with 6 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Sources/tart/Commands/Run.swift
View File

@ -227,7 +227,7 @@ struct Run: AsyncParsableCommand {
@Option(help: ArgumentHelp("Connected Unix stream socket file descriptor to use for the Softnet control channel (e.g. --net-softnet-control-fd=3)", discussion: """
This option enables the Softnet control channel on an inherited Unix stream socket. It can be used to dynamically replace Softnet allow and block lists while the VM is running.
The file descriptor must be greater than 2. Implies --net-softnet unless --net-host is specified.
The file descriptor must be greater than 2. Implies --net-softnet.
""", valueName: "file descriptor"))
var netSoftnetControlFd: Int32?
@ -320,7 +320,7 @@ struct Run: AsyncParsableCommand {
}
// Automatically enable --net-softnet when any of its related options are specified
if netSoftnetAllow != nil || netSoftnetBlock != nil || netSoftnetExpose != nil || (netSoftnetControlFd != nil && !netHost) {
if netSoftnetAllow != nil || netSoftnetBlock != nil || netSoftnetExpose != nil || netSoftnetControlFd != nil {
netSoftnet = true
}

10
Tests/TartTests/SoftnetControlFDTests.swift
View File

@ -139,18 +139,16 @@ final class SoftnetControlFDTests: XCTestCase {
XCTAssertEqual(command.netSoftnetControlFd, 3)
}
func testControlFDWorksWithHostNetworking() throws {
func testControlFDIsRejectedWithHostNetworking() throws {
let temporaryHome = try createTemporaryTartHome()
defer { try? FileManager.default.removeItem(at: temporaryHome) }
let previousHome = ProcessInfo.processInfo.environment["TART_HOME"]
setenv("TART_HOME", temporaryHome.path, 1)
defer { restoreEnvironment("TART_HOME", value: previousHome) }
let command = try Run.parse(["vm", "--net-host", "--net-softnet-control-fd", "3"])
XCTAssertTrue(command.netHost)
XCTAssertFalse(command.netSoftnet)
XCTAssertEqual(command.netSoftnetControlFd, 3)
XCTAssertThrowsError(
try Run.parse(["vm", "--net-host", "--net-softnet-control-fd", "3"])
)
}
private func createTemporaryTartHome() throws -> URL {