Add support for custom non-default routes on interfaces

Author: RahulThennarasu

Sources/Containerization/ContainerManager.swift

@@ -94,6 +94,7 @@ public struct ContainerManager: Sendable {
             public let address: String
             public let gateway: String?
             public let macAddress: String?
+            public let routes: [Route]
 
             // `reference` isn't used concurrently.
             nonisolated(unsafe) private let reference: vmnet_network_ref
@@ -102,12 +103,14 @@ public struct ContainerManager: Sendable {
                 reference: vmnet_network_ref,
                 address: String,
                 gateway: String,
-                macAddress: String? = nil
+                macAddress: String? = nil,
+                routes: [Route] = []
             ) {
                 self.address = address
                 self.gateway = gateway
                 self.macAddress = macAddress
                 self.reference = reference
+                self.routes = routes
             }
 
             /// Returns the underlying `VZVirtioNetworkDeviceConfiguration`.

Sources/Containerization/Interface.swift

@@ -14,6 +14,19 @@
 // limitations under the License.
 //===----------------------------------------------------------------------===//
 
+/// A custom route for an interface.
+public struct Route: Sendable {
+    /// Destination network in CIDR notation (e.g., "192.168.1.0/24")
+    public let destination: String
+
+    /// Gateway IP address for this route
+    public let gateway: String
+
+    public init(destination: String, gateway: String) {
+        self.destination = destination
+        self.gateway = gateway
+    }
+}
 /// A network interface.
 public protocol Interface: Sendable {
     /// The interface IPv4 address and subnet prefix length, as a CIDR address.
@@ -25,4 +38,6 @@ public protocol Interface: Sendable {
 
     /// The interface MAC address, or nil to auto-configure the address.
     var macAddress: String? { get }
+
+    var routes: [Route] { get }
 }

Sources/Containerization/LinuxContainer.swift

@@ -348,6 +348,15 @@ extension LinuxContainer {
                         if let gateway = i.gateway {
                             try await agent.routeAddDefault(name: name, gateway: gateway)
                         }
+
+                        for route in i.routes {
+                            try await agent.routeAddLink(
+                                name: name,
+                                address: route.destination,
+                                gateway: route.gateway,
+                                srcAddr: ""
+                            )
+                        }
                     }
 
                     // Setup /etc/resolv.conf and /etc/hosts if asked for.

Sources/Containerization/LinuxPod.swift

@@ -339,6 +339,15 @@ extension LinuxPod {
                         if let gateway = i.gateway {
                             try await agent.routeAddDefault(name: name, gateway: gateway)
                         }
+
+                        for route in i.routes {
+                            try await agent.routeAddLink(
+                                name: name,
+                                address: route.destination,
+                                gateway: route.gateway,
+                                srcAddr: ""
+                            )
+                        }
                     }
 
                     // Setup /etc/resolv.conf if asked for

Sources/Containerization/NATInterface.swift

@@ -18,6 +18,7 @@ public struct NATInterface: Interface {
     public var address: String
     public var gateway: String?
     public var macAddress: String?
+    public var routes: [Route] { [] }
 
     public init(address: String, gateway: String?, macAddress: String? = nil) {
         self.address = address

Sources/Containerization/NATNetworkInterface.swift

@@ -29,6 +29,7 @@ public final class NATNetworkInterface: Interface, Sendable {
     public let address: String
     public let gateway: String?
     public let macAddress: String?
+    public var routes: [Route] { [] }
 
     @available(macOS 26, *)
     // `reference` isn't used concurrently.

Sources/Containerization/SandboxContext/SandboxContext.pb.swift

@@ -816,9 +816,20 @@ public struct Com_Apple_Containerization_Sandbox_V3_IpRouteAddLinkRequest: Senda
 
   public var srcAddr: String = String()
 
+  public var gateway: String {
+    get {return _gateway ?? String()}
+    set {_gateway = newValue}
+  }
+  /// Returns true if `gateway` has been explicitly set.
+  public var hasGateway: Bool {return self._gateway != nil}
+  /// Clears the value of `gateway`. Subsequent reads from it will return its default value.
+  public mutating func clearGateway() {self._gateway = nil}
+
   public var unknownFields = SwiftProtobuf.UnknownStorage()
 
   public init() {}
+
+  fileprivate var _gateway: String? = nil
 }
 
 public struct Com_Apple_Containerization_Sandbox_V3_IpRouteAddLinkResponse: Sendable {
@@ -2679,6 +2690,7 @@ extension Com_Apple_Containerization_Sandbox_V3_IpRouteAddLinkRequest: SwiftProt
     1: .same(proto: "interface"),
     2: .same(proto: "address"),
     3: .same(proto: "srcAddr"),
+    4: .same(proto: "gateway"),
   ]
 
   public mutating func decodeMessage<D: SwiftProtobuf.Decoder>(decoder: inout D) throws {
@@ -2690,12 +2702,17 @@ extension Com_Apple_Containerization_Sandbox_V3_IpRouteAddLinkRequest: SwiftProt
       case 1: try { try decoder.decodeSingularStringField(value: &self.interface) }()
       case 2: try { try decoder.decodeSingularStringField(value: &self.address) }()
       case 3: try { try decoder.decodeSingularStringField(value: &self.srcAddr) }()
+      case 4: try { try decoder.decodeSingularStringField(value: &self._gateway) }()
       default: break
       }
     }
   }
 
   public func traverse<V: SwiftProtobuf.Visitor>(visitor: inout V) throws {
+    // The use of inline closures is to circumvent an issue where the compiler
+    // allocates stack space for every if/case branch local when no optimizations
+    // are enabled. https://github.com/apple/swift-protobuf/issues/1034 and
+    // https://github.com/apple/swift-protobuf/issues/1182
     if !self.interface.isEmpty {
       try visitor.visitSingularStringField(value: self.interface, fieldNumber: 1)
     }
@@ -2705,13 +2722,17 @@ extension Com_Apple_Containerization_Sandbox_V3_IpRouteAddLinkRequest: SwiftProt
     if !self.srcAddr.isEmpty {
       try visitor.visitSingularStringField(value: self.srcAddr, fieldNumber: 3)
     }
+    try { if let v = self._gateway {
+      try visitor.visitSingularStringField(value: v, fieldNumber: 4)
+    } }()
     try unknownFields.traverse(visitor: &visitor)
   }
 
   public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_IpRouteAddLinkRequest, rhs: Com_Apple_Containerization_Sandbox_V3_IpRouteAddLinkRequest) -> Bool {
     if lhs.interface != rhs.interface {return false}
     if lhs.address != rhs.address {return false}
     if lhs.srcAddr != rhs.srcAddr {return false}
+    if lhs._gateway != rhs._gateway {return false}
     if lhs.unknownFields != rhs.unknownFields {return false}
     return true
   }

Sources/Containerization/SandboxContext/SandboxContext.proto

@@ -243,6 +243,7 @@ message IpRouteAddLinkRequest {
   string interface = 1;
   string address = 2;
   string srcAddr = 3;
+  optional string gateway = 4;
 }
 
 message IpRouteAddLinkResponse {}

Sources/Containerization/VirtualMachineAgent.swift

@@ -66,6 +66,7 @@ public protocol VirtualMachineAgent: Sendable {
     func down(name: String) async throws
     func addressAdd(name: String, address: String) async throws
     func routeAddDefault(name: String, gateway: String) async throws
+    func routeAddLink(name: String, address: String, gateway: String, srcAddr: String) async throws
     func configureDNS(config: DNS, location: String) async throws
     func configureHosts(config: Hosts, location: String) async throws
 

Sources/Containerization/Vminitd.swift

@@ -382,6 +382,17 @@ extension Vminitd {
             })
     }
 
+    public func routeAddLink(name: String, address: String, gateway: String, srcAddr: String = "") async throws {
+        _ = try await client.ipRouteAddLink(
+            .with {
+                $0.interface = name
+                $0.address = address
+                $0.gateway = gateway
+                $0.srcAddr = srcAddr
+            }
+        )
+    }
+
     /// Configure DNS within the sandbox's environment.
     public func configureDNS(config: DNS, location: String) async throws {
         _ = try await client.configureDns(