linux

package

v0.5.0 Latest Latest Go to latest Published: Apr 18, 2026 License: GPL-3.0 Imports: 10 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/SamNet-dev/snix

Links

Open Source Insights

Documentation ¶

Rendered for

Overview ¶

Package linux implements the snix Backend using Linux netfilter NFQUEUE plus managed iptables rules.

Safety invariants:

Installed rules are narrowly scoped to a single (remoteIP, remotePort) pair and never touch the SSH control plane.
All rules use `--queue-bypass` so a crashed or wedged snix never blackholes user traffic.
installRules and removeRules are idempotent. Close() is safe to call multiple times.
We record the exact rule specs we added and only delete those; we never flush chains.

Constants ¶

View Source

const (
	// DefaultQueueNum is the default NFQUEUE number we install rules for.
	// Picked high to avoid collisions with common systems.
	DefaultQueueNum = 42
)

Variables ¶

This section is empty.

Functions ¶

This section is empty.

Types ¶

type Backend ¶

type Backend struct {
	// contains filtered or unexported fields
}

Backend implements platform.Backend on Linux.

func New ¶

func New(cfg Config) *Backend

New returns an unopened Backend.

func (*Backend) Close ¶

func (b *Backend) Close() error

Close tears down everything Open set up. Safe to call multiple times.

func (*Backend) Inject ¶

func (b *Backend) Inject(pkt []byte, _ platform.Direction) error

Inject writes a fully formed IPv4 packet to the raw socket. The destination address is read from the IP header (bytes 16:20).

func (*Backend) Open ¶

func (b *Backend) Open(ctx context.Context, scope platform.Scope) error

Open installs iptables rules, opens an NFQUEUE reader, and opens a raw socket for Inject(). It is a configuration error to call Open twice.

func (*Backend) Packets ¶

func (b *Backend) Packets() <-chan platform.Packet

Packets returns the observed-packet channel.

type Config ¶

type Config struct {
	// QueueNum is the netfilter queue number. Default: DefaultQueueNum.
	QueueNum uint16
	// MaxPacketLen is the per-packet copy-range limit passed to NFQUEUE.
	MaxPacketLen uint32
}

Config tunes the Linux backend.

Source Files ¶

View all Source files

nfqueue.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL