eburet-oss/sing-tun-lx
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add netns support

Browse source
This commit is contained in:
世界 2026-07-11 00:57:57 +08:00
parent d0d4ebd8db
commit 994d6ccdbf
No known key found for this signature in database
GPG key ID: CD109927C34A63C4
7 changed files with 220 additions and 80 deletions
Download patch file Download diff file Expand all files Collapse all files

67
redirect_linux.go
View file

@ -26,6 +26,7 @@ type autoRedirect struct {
logger logger.Logger
tableName string
networkMonitor NetworkUpdateMonitor
ownedNetworkMonitor bool
networkListener *list.Element[NetworkUpdateCallback]
interfaceFinder control.InterfaceFinder
localAddresses []netip.Prefix
@ -51,7 +52,7 @@ type autoRedirect struct {
}
func NewAutoRedirect(options AutoRedirectOptions) (AutoRedirect, error) {
return &autoRedirect{
r := &autoRedirect{
tunOptions: options.TunOptions,
ctx: options.Context,
handler: options.Handler,
@ -63,7 +64,11 @@ func NewAutoRedirect(options AutoRedirectOptions) (AutoRedirect, error) {
customRedirectPortFunc: options.CustomRedirectPort,
routeAddressSet: options.RouteAddressSet,
routeExcludeAddressSet: options.RouteExcludeAddressSet,
}, nil
}
if options.TunOptions.NetNs != "" {
r.interfaceFinder = &networkNamespaceInterfaceFinder{control.NewDefaultInterfaceFinder(), options.TunOptions}
}
return r, nil
}
func (r *autoRedirect) Start() error {
@ -89,8 +94,11 @@ func (r *autoRedirect) Start() error {
}
}
} else {
if r.tunOptions.NetNs != "" && !r.useNFTables {
return E.New("auto_redirect in network namespace requires nftables")
}
if r.useNFTables {
err = r.initializeNFTables()
err = runInNetworkNamespace(r.tunOptions.NetNs, r.initializeNFTables)
if err != nil {
return E.Cause(err, "missing nftables support")
}
@ -132,7 +140,7 @@ func (r *autoRedirect) Start() error {
listenAddr = netip.IPv4Unspecified()
}
server := newRedirectServer(r.ctx, r.handler, r.logger, listenAddr)
err = server.Start()
err = runInNetworkNamespace(r.tunOptions.NetNs, server.Start)
if err != nil {
return E.Cause(err, "start redirect server")
}
@ -151,24 +159,43 @@ func (r *autoRedirect) Start() error {
})
if err != nil {
r.logger.Warn("nfqueue not available, pre-match disabled (missing nfnetlink_queue and nft_queue kernel module?): ", err)
} else if err = handler.Start(); err != nil {
} else if err = runInNetworkNamespace(r.tunOptions.NetNs, handler.Start); err != nil {
r.logger.Warn("nfqueue start failed, pre-match disabled (missing nfnetlink_queue and nft_queue kernel module?): ", err)
} else {
r.nfqueueHandler = handler
r.nfqueueEnabled = true
}
}
r.cleanupNFTables()
err = r.setupNFTables()
if err != nil {
return E.Cause(err, "setup nftables")
}
if r.tunOptions.AutoRedirectMarkMode {
err = r.setupRedirectRoutes()
if r.tunOptions.NetNs != "" {
var monitor NetworkUpdateMonitor
monitor, err = NewNetworkUpdateMonitor(r.logger)
if err != nil {
r.cleanupNFTables()
return E.Cause(err, "setup redirect routes")
return E.Cause(err, "create netns network monitor")
}
err = runInNetworkNamespace(r.tunOptions.NetNs, monitor.Start)
if err != nil {
return E.Cause(err, "start netns network monitor")
}
r.networkMonitor = monitor
r.ownedNetworkMonitor = true
}
err = runInNetworkNamespace(r.tunOptions.NetNs, func() error {
r.cleanupNFTables()
setupErr := r.setupNFTables()
if setupErr != nil {
return E.Cause(setupErr, "setup nftables")
}
if r.tunOptions.AutoRedirectMarkMode {
setupErr = r.setupRedirectRoutes()
if setupErr != nil {
r.cleanupNFTables()
return E.Cause(setupErr, "setup redirect routes")
}
}
return nil
})
if err != nil {
return err
}
} else {
r.cleanupIPTables()
@ -185,8 +212,14 @@ func (r *autoRedirect) Close() error {
r.nfqueueHandler.Close()
}
if r.useNFTables {
r.cleanupNFTables()
r.cleanupRedirectRoutes()
_ = runInNetworkNamespace(r.tunOptions.NetNs, func() error {
r.cleanupNFTables()
r.cleanupRedirectRoutes()
return nil
})
if r.ownedNetworkMonitor {
_ = r.networkMonitor.Close()
}
} else {
r.cleanupIPTables()
}
@ -197,7 +230,7 @@ func (r *autoRedirect) Close() error {
func (r *autoRedirect) UpdateRouteAddressSet() {
if r.useNFTables {
err := r.nftablesUpdateRouteAddressSet()
err := runInNetworkNamespace(r.tunOptions.NetNs, r.nftablesUpdateRouteAddressSet)
if err != nil {
r.logger.Error("update route address set: ", err)
}