Add portForwards.guestIPMustBeZero property

[jandubois]

When guestIPMustBeZero is set the rule will only match if the bind is against literal 0.0.0.0 and not any other interface.

To forward any ports bound to 0.0.0.0 in the guest to 0.0.0.0 on the host, but any other ports bound to 127.0.0.1 only to localhost on the host use these rules:

portForwards:
- guestPortRange: [1, 65535]
  guestIPMustBeZero: true
  hostIP: "0.0.0.0"
- guestPortRange: [1, 65535]
  guestIP: "127.0.0.1"
  hostIP: "127.0.0.1"

Fixes #658

[AkihiroSuda]

guestIPZero: true
guestIP: "0.0.0.0"

Can we come up with a better name to distinguish them?
e.g., propagateExposure: true

[jandubois]

Can we come up with a better name to distinguish them?

I've been pleading for suggestions in #658 already...

e.g., propagateExposure: true

Sorry, but that name doesn't really work for me; I have no idea what it means. If anything, this option would reduce exposure, as the rule would no longer match any interface, but only a bind to 0.0.0.0 (so it is not treated as a wildcard).

I have one other suggestion now: guestIPExactMatchRequired:

portForwards:
- guestIP: "0.0.0.0"
  guestIPExactMatchRequired: true
  hostIP: "0.0.0.0"

In the end, the documentation should clarify this, but ideally the name should be self-explanatory.

[jandubois]

I do have an issue with "exact match required" though: it is hard to argue that it should imply that guestIP must be 0.0.0.0 because every specific IP address also requires an exact match.

So you could say that setting is just ignored for other guestIP values. Or you say it defaults to true, except for 0.0.0.0, where it defaults to false, which also feels weird.

[AkihiroSuda]

guestIPExactMatchRequired seems better than guestIPZero

[AkihiroSuda]

Please update the PR title and description (when this PR is out of draft)

[jandubois]

Please update the PR title and description (when this PR is out of draft)

Done. I've also changed the second rule in the description to only forward all the 127.0.0.1 binds. I think forwarding all ports from all interfaces is generally not a good idea.

[AkihiroSuda]

Thanks.

Maybe we should document this in docs/network.md too