Struct SmoltcpNetwork 

pub struct SmoltcpNetwork { /* private fields */ }

The networking engine. Created from NetworkConfig by the runtime.

Owns the smoltcp poll thread and provides:

• take_backend() — the NetBackend for VmBuilder::net()
• guest_env_vars() — MSB_NET* env vars for the guest
• ca_cert_pem() — CA certificate for TLS interception

Implementations

impl SmoltcpNetwork

pub fn new(config: NetworkConfig, slot: u64) -> Result<Self, NetworkInitError>

Create from user config + sandbox slot (for IP/MAC derivation).

Each address family is enabled when either the user supplied an explicit address or the host kernel has a route for that family; otherwise the corresponding guest_*/gateway_* fields stay None and the family is omitted from the smoltcp interface, env vars, and downstream consumers.

Errors

Returns an error when network configuration would allocate unsafe resources or TLS interception cannot initialize.

Panics

Panics if slot exceeds the address pool capacity (65535 for MAC/IPv6, 524287 for IPv4).

pub fn new_with_profile( config: NetworkConfig, slot: u64, deployment_profile: DeploymentProfile, ) -> Result<Self, NetworkInitError>

Create the network backend with an explicit host-runtime deployment profile.

MultiTenant applies platform-owned configuration floors before any sockets, resolvers, or TLS state are created. The requested tenant policy remains separate and is intersected with the platform’s public-network policy by the poll loop.

Errors

Returns an error when the effective network configuration would allocate unsafe resources or TLS interception cannot initialize.

pub fn start(&mut self, tokio_handle: Handle)

Start the smoltcp poll thread.

Must be called before VM boot. Requires a tokio runtime handle for spawning proxy tasks, DNS resolution, and published port listeners.

pub fn take_backend(&mut self) -> Box<dyn NetBackend + Send>

Take the NetBackend for VmBuilder::net(). One-shot.

pub fn guest_mac(&self) -> [u8; 6]

Guest MAC address for VmBuilder::net().mac().

pub fn guest_env_vars(&self) -> Vec<(String, String)>

Generate MSB_NET* environment variables for the guest.

The guest init (agentd) reads these to configure the network interface via ioctls + netlink.

pub fn ca_cert_pem(&self) -> Option<Vec<u8>>

CA certificate PEM bytes if TLS interception is enabled.

Write to the runtime mount before VM boot so the guest can trust it.

pub fn host_cas_cert_pem(&self) -> Option<Vec<u8>>

Host-trusted CA bundle to ship into the guest, if NetworkConfig::trust_host_cas is enabled.

Returned PEM may concatenate CAs that the Mozilla root bundle in the guest already trusts; duplicates are harmless and saved the cost of computing a delta. Returns None when the host store is empty or the feature is disabled.

pub fn termination_handle(&self) -> TerminationHandle

Create a handle for wiring runtime termination into the network stack.

pub fn metrics_handle(&self) -> MetricsHandle

Create a handle for reading aggregate network byte counters.

pub fn secrets_handle(&self) -> SecretsHandle

Live-swappable view of the secrets configuration. The runtime control socket uses it to apply secret rotation, removal, and allowed-host updates without restarting the sandbox.