public_git
/
tart
mirror of https://github.com/cirruslabs/tart.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Introduce `--net-host` flag to enforce host-only network (#743) 

* Experimental `--net-host-only` option

* Use Softnet's host networking
This commit is contained in:
Fedor Korotkov 2024-03-01 04:57:39 -05:00 committed by GitHub
parent 5c7743b7cd
commit 99bbd838a1
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 19 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
Sources/tart/Commands/Run.swift
View File

@ -117,6 +117,9 @@ struct Run: AsyncParsableCommand {
discussion: "Learn how to configure Softnet for use with Tart here: https://github.com/cirruslabs/softnet")) discussion: "Learn how to configure Softnet for use with Tart here: https://github.com/cirruslabs/softnet"))
var netSoftnet: Bool = false var netSoftnet: Bool = false
@Flag(help: ArgumentHelp("Restrict network access to the host-only network"))
var netHost: Bool = false
#if arch(arm64) #if arch(arm64)
@Flag(help: ArgumentHelp("Disables audio and entropy devices and switches to only Mac-specific input devices.", discussion: "Useful for running a VM that can be suspended via \"tart suspend\".")) @Flag(help: ArgumentHelp("Disables audio and entropy devices and switches to only Mac-specific input devices.", discussion: "Useful for running a VM that can be suspended via \"tart suspend\"."))
#endif #endif
@ -133,8 +136,14 @@ struct Run: AsyncParsableCommand {
throw ValidationError("--vnc and --vnc-experimental are mutually exclusive") throw ValidationError("--vnc and --vnc-experimental are mutually exclusive")
} }
if netBridged.count > 0 && netSoftnet { // check that not more than one network option is specified
throw ValidationError("--net-bridged and --net-softnet are mutually exclusive") var netFlags = 0
if netBridged.count > 0 { netFlags += 1 }
if netSoftnet { netFlags += 1 }
if netHost { netFlags += 1 }
if netFlags > 1 {
throw ValidationError("--net-bridged, --net-softnet and --net-host are mutually exclusive")
} }
if graphics { if graphics {
@ -184,7 +193,7 @@ struct Run: AsyncParsableCommand {
} }
} }
if netSoftnet && isInteractiveSession() { if (netSoftnet || netHost) && isInteractiveSession() {
try Softnet.configureSUIDBitIfNeeded() try Softnet.configureSUIDBitIfNeeded()
} }
@ -365,10 +374,14 @@ struct Run: AsyncParsableCommand {
func userSpecifiedNetwork(vmDir: VMDirectory) throws -> Network? { func userSpecifiedNetwork(vmDir: VMDirectory) throws -> Network? {
if netSoftnet { if netSoftnet {
let config = try VMConfig.init(fromURL: vmDir.configURL) let config = try VMConfig.init(fromURL: vmDir.configURL)
return try Softnet(vmMACAddress: config.macAddress.string) return try Softnet(vmMACAddress: config.macAddress.string)
} }
if netHost {
let config = try VMConfig.init(fromURL: vmDir.configURL)
return try Softnet(vmMACAddress: config.macAddress.string, extraArguments: ["--vm-net-type", "host"])
}
if netBridged.count > 0 { if netBridged.count > 0 {
func findBridgedInterface(_ name: String) throws -> VZBridgedNetworkInterface { func findBridgedInterface(_ name: String) throws -> VZBridgedNetworkInterface {
let interface = VZBridgedNetworkInterface.networkInterfaces.first { interface in let interface = VZBridgedNetworkInterface.networkInterfaces.first { interface in

4
Sources/tart/Network/Softnet.swift
View File

@ -15,7 +15,7 @@ class Softnet: Network {
let vmFD: Int32 let vmFD: Int32
init(vmMACAddress: String) throws { init(vmMACAddress: String, extraArguments: [String] = []) throws {
let fds = UnsafeMutablePointer<Int32>.allocate(capacity: MemoryLayout<Int>.stride * 2) let fds = UnsafeMutablePointer<Int32>.allocate(capacity: MemoryLayout<Int>.stride * 2)
let ret = socketpair(AF_UNIX, SOCK_DGRAM, 0, fds) let ret = socketpair(AF_UNIX, SOCK_DGRAM, 0, fds)
@ -30,7 +30,7 @@ class Softnet: Network {
try setSocketBuffers(softnetFD, 1 * 1024 * 1024); try setSocketBuffers(softnetFD, 1 * 1024 * 1024);
process.executableURL = try Self.softnetExecutableURL() process.executableURL = try Self.softnetExecutableURL()
process.arguments = ["--vm-fd", String(STDIN_FILENO), "--vm-mac-address", vmMACAddress] process.arguments = ["--vm-fd", String(STDIN_FILENO), "--vm-mac-address", vmMACAddress] + extraArguments
process.standardInput = FileHandle(fileDescriptor: softnetFD, closeOnDealloc: false) process.standardInput = FileHandle(fileDescriptor: softnetFD, closeOnDealloc: false)
} }