Struct SmoltcpNetwork 

pub struct SmoltcpNetwork { /* private fields */ }

The networking engine. Created from crate::config::NetworkConfig by the runtime.

Owns the smoltcp poll thread and provides:

• take_backend() — the NetBackend for VmBuilder::net()
• guest_bootstrap_network() — typed guest network setup
• ca_cert_pem() — CA certificate for TLS interception

Implementations

impl SmoltcpNetwork

pub fn new( config: ResolvedNetworkConfig, slot: u16, deployment_profile: DeploymentProfile, ) -> Result<Self, NetworkInitError>

Creates the network backend from a fully resolved runtime configuration.

MultiTenant applies platform-owned configuration floors before any sockets, resolvers, or TLS state are created. The requested tenant policy remains separate and is intersected with the platform’s public-network policy by the poll loop.

Errors

Returns an error when the effective network configuration would allocate unsafe resources or TLS interception cannot initialize.

pub fn start(&mut self, tokio_handle: Handle)

Start the smoltcp poll thread.

Must be called before VM boot. Requires a tokio runtime handle for spawning proxy tasks, DNS resolution, and published port listeners.

pub fn take_backend(&mut self) -> Box<dyn NetBackend + Send>

Take the NetBackend for VmBuilder::net(). One-shot.

pub fn guest_mac(&self) -> [u8; 6]

Guest MAC address for VmBuilder::net().mac().

pub fn guest_env_vars(&self) -> Vec<(String, String)>

Generate MSB_NET* environment variables for the guest.

The guest init (agentd) reads these to configure the network interface via ioctls + netlink.

pub fn guest_bootstrap_network(&self) -> BootstrapNetwork

Build the typed network payload consumed by agentd during bootstrap.

pub fn guest_host_alias(&self) -> &'static str

Return the stable hostname used by guests to address the host gateway.

pub fn guest_secret_env(&self) -> Vec<BootstrapEnvVar>

Return guest-visible secret placeholders for the baseline environment.

Real secret values stay in the host-side network handler and never enter this payload.

pub fn ca_cert_pem(&self) -> Option<Vec<u8>>

CA certificate PEM bytes if TLS interception is enabled.

Write to the runtime mount before VM boot so the guest can trust it.

pub fn host_cas_cert_pem(&self) -> Option<Vec<u8>>

Host-trusted CA bundle to ship into the guest, if crate::config::NetworkConfig::trust_host_cas is enabled.

Returned PEM may concatenate CAs that the Mozilla root bundle in the guest already trusts; duplicates are harmless and saved the cost of computing a delta. Returns None when the host store is empty or the feature is disabled.

pub fn termination_handle(&self) -> TerminationHandle

Create a handle for wiring runtime termination into the network stack.

pub fn metrics_handle(&self) -> MetricsHandle

Create a handle for reading aggregate network byte counters.

pub fn secrets_handle(&self) -> SecretsHandle

Live-swappable view of the secrets configuration. The runtime control socket uses it to apply secret rotation, removal, and allowed-host updates without restarting the sandbox.