https://github.com/cirruslabs/softnet

Software networking with isolation for Tart
https://github.com/cirruslabs/softnet

dhcp firewall networking packet-filter security tart vmnet

Last synced: about 2 months ago
JSON representation

Software networking with isolation for Tart

• Host: GitHub
• URL: https://github.com/cirruslabs/softnet
• Owner: cirruslabs
• License: agpl-3.0
• Created: 2022-06-08T00:56:42.000Z (over 2 years ago)
• Default Branch: main
• Last Pushed: 2024-11-04T14:50:43.000Z (about 2 months ago)
• Last Synced: 2024-11-04T15:47:19.937Z (about 2 months ago)
• Topics: dhcp, firewall, networking, packet-filter, security, tart, vmnet
• Language: Rust
• Homepage:
• Size: 210 KB
• Stars: 25
• Watchers: 5
• Forks: 6
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

        
# Softnet

Softnet is a software networking for [Tart](https://github.com/cirruslabs/tart) which provides better network isolation and alleviates DHCP shortage on production systems.

Please check out [this blog post](https://cirrus-ci.org/blog/2022/07/07/isolating-network-between-tarts-macos-virtual-machines/) for backstory.

## Working model

Softnet solves two problems:

1. VM network isolation

    * [`VZNATNetworkDeviceAttachment`](https://developer.apple.com/documentation/virtualization/vznatnetworkdeviceattachment) (the default networking in Tart) enables [vmnet's bridge isolation](https://developer.apple.com/documentation/vmnet/vmnet_enable_isolation_key) by default and prevents cross-VM traffic, however it's still possible for any VM to spoof the host's ARP-table and capture other VMs traffic by using tools that enable conducting the [ARP spoofing attacks](https://en.wikipedia.org/wiki/ARP_spoofing) (e.g. [arpspoof](https://www.monkey.org/~dugsong/dsniff/), [arpoison](http://www.arpoison.net/) and so on)

2. DHCP exhaustion

    * macOS built-in DHCP-server allocates a `/24` subnet with 86400 seconds lease time by default, which only allows for ~253 VMs a day (or 1 VM every ~6 minutes) to be spawned without causing a denial-of-service, which is pretty limiting for CI services like Cirrus CI

And assumes that:

1. Tart gives it's VMs unique MAC-addresses

2. macOS built-in DHCP-server won't re-use the IP-addresses from it's pool until their lease expire

...otherwise it's possible for two VMs to receive an identical IP-address from the macOS built-in DHCP-server (even in the presence of Softnet's packet filtering) and thus bypass the protections offered by Softnet.

## Installing

For proper functioning, Softnet binary requires two things:

* a [SUID-bit](https://en.wikipedia.org/wiki/Setuid#SUID) to be set on the binary or a [passwordless sudo](https://serverfault.com/questions/160581/how-to-setup-passwordless-sudo-on-linux) to be configured, which effectively gives the binary `root` privileges

  * these privileges are needed to create [`vmnet.framework`](https://developer.apple.com/documentation/vmnet) interface and perform DHCP-related system tweaks

  * the privileges will be dropped automatically to that of the calling user (or those represented by the `--user` and `--group` command-line arguments) once all of the initialization is completed

* the binary to be available in `PATH`

  * so that the Tart will be able to find it

## Running

Softnet is started and managed automatically by Tart if `--net-softnet` flag is provided when calling `tart run`.