eburet-oss/sing-tun-lx
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add netns support

Browse source
This commit is contained in:
世界 2026-07-11 00:57:57 +08:00
parent d0d4ebd8db
commit 994d6ccdbf
No known key found for this signature in database
GPG key ID: CD109927C34A63C4
7 changed files with 220 additions and 80 deletions
Download patch file Download diff file Expand all files Collapse all files

46
redirect_nftables.go
View file

@ -299,27 +299,38 @@ func (r *autoRedirect) setupNFTables() error {
if err != nil {
return E.Cause(err, "flush nftables")
}
r.startDockerFirewallMonitor()
err = r.configureDockerFirewall(false)
if err != nil && r.logger != nil {
r.logger.Warn("configure docker firewall: ", err)
if r.tunOptions.NetNs == "" {
r.startDockerFirewallMonitor()
err = r.configureDockerFirewall(false)
if err != nil && r.logger != nil {
r.logger.Warn("configure docker firewall: ", err)
}
}
r.networkListener = r.networkMonitor.RegisterCallback(func() {
err = r.nftablesUpdateLocalAddressSet()
if err != nil {
r.logger.Error("update local address set: ", err)
}
if r.tunOptions.AutoRedirectMarkMode {
err = r.updateRedirectRoutes()
if err != nil {
r.logger.Error("update redirect routes: ", err)
}
updateErr := runInNetworkNamespace(r.tunOptions.NetNs, r.updateNetworkAddresses)
if updateErr != nil {
r.logger.Error(updateErr)
}
})
return nil
}
func (r *autoRedirect) updateNetworkAddresses() error {
err := r.nftablesUpdateLocalAddressSet()
if err != nil {
err = E.Cause(err, "update local address set")
}
if r.tunOptions.AutoRedirectMarkMode {
routeErr := r.updateRedirectRoutes()
if routeErr != nil {
routeErr = E.Cause(routeErr, "update redirect routes")
}
err = E.Errors(err, routeErr)
}
return err
}
// TODO: test if this works
func (r *autoRedirect) nftablesUpdateLocalAddressSet() error {
err := r.interfaceFinder.Update()
@ -376,6 +387,7 @@ func (r *autoRedirect) nftablesUpdateRouteAddressSet() error {
func (r *autoRedirect) cleanupNFTables() {
if r.networkListener != nil {
r.networkMonitor.UnregisterCallback(r.networkListener)
r.networkListener = nil
}
r.stopDockerFirewallMonitor()
nft, err := nftables.New()
@ -389,9 +401,11 @@ func (r *autoRedirect) cleanupNFTables() {
_ = r.configureOpenWRTFirewall4(nft, true)
_ = nft.Flush()
_ = nft.CloseLasting()
err = r.configureDockerFirewall(true)
if err != nil && r.logger != nil {
r.logger.Warn("cleanup docker firewall: ", err)
if r.tunOptions.NetNs == "" {
err = r.configureDockerFirewall(true)
if err != nil && r.logger != nil {
r.logger.Warn("cleanup docker firewall: ", err)
}
}
}