router

package
v0.22.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 3, 2026 License: AGPL-3.0 Imports: 45 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	ChainA3yTunRules utiliptables.Chain = "A3Y-TUN-RULES"
)

Variables

This section is empty.

Functions

This section is empty.

Types

type ClientNetlinkRouter 

type ClientNetlinkRouter struct {
	// contains filtered or unexported fields
}

ClientNetlinkRouter implements Router using Linux's netlink subsystem for client-side routing. It routes all prefixes advertised by connections to a TUN device using iptables.

func NewClientNetlinkRouter 

func NewClientNetlinkRouter(opts ...Option) (*ClientNetlinkRouter, error)

NewClientNetlinkRouter creates a new client-side netlink-based tunnel router.

func (*ClientNetlinkRouter) AddAddr 

func (r *ClientNetlinkRouter) AddAddr(addr netip.Prefix, tun connection.Connection) error

AddAddr adds an address to a TUN interface and sets up steering of packets from the TUN to connection.Connection by source IP (addr).

func (*ClientNetlinkRouter) AddRoute 

func (r *ClientNetlinkRouter) AddRoute(dst netip.Prefix) error

AddRoute adds a tunnel route for dst.

func (*ClientNetlinkRouter) Close 

func (r *ClientNetlinkRouter) Close() error

Close releases any resources associated with the router.

func (*ClientNetlinkRouter) DelAddr 

func (r *ClientNetlinkRouter) DelAddr(addr netip.Prefix) error

DelAddr deletes an address from a TUN interface and removes the corresponding route.

func (*ClientNetlinkRouter) DelRoute 

func (r *ClientNetlinkRouter) DelRoute(dst netip.Prefix) error

DelRoute removes all routing associations for a given destination prefix.

func (*ClientNetlinkRouter) ListRoutes 

func (r *ClientNetlinkRouter) ListRoutes() ([]TunnelRoute, error)

ListRoutes returns a list of all routes currently managed by the router.

func (*ClientNetlinkRouter) ListenPacket 

func (r *ClientNetlinkRouter) ListenPacket(addr netip.AddrPort) (net.PacketConn, error)

ListenPacket creates an unconnected UDP PacketConn bound to the given overlay address on the kernel network stack.

func (*ClientNetlinkRouter) LocalAddresses 

func (r *ClientNetlinkRouter) LocalAddresses() ([]netip.Prefix, error)

LocalAddresses returns the list of local addresses that are assigned to the router.

func (*ClientNetlinkRouter) Start 

func (r *ClientNetlinkRouter) Start(ctx context.Context) error

Start initializes the router and starts forwarding traffic.

type ICXNetlinkRouter 

type ICXNetlinkRouter struct {
	Handler *icx.Handler
	// contains filtered or unexported fields
}

func NewICXNetlinkRouter 

func NewICXNetlinkRouter(opts ...Option) (*ICXNetlinkRouter, error)

func (*ICXNetlinkRouter) AddAddr 

func (r *ICXNetlinkRouter) AddAddr(_ netip.Prefix, _ connection.Connection) error

AddAddr adds a tun with an associated address to the router.

func (*ICXNetlinkRouter) AddRoute 

func (r *ICXNetlinkRouter) AddRoute(dst netip.Prefix) error

AddRoute adds a dst prefix to be routed through the given tunnel connection. If multiple tunnels are provided, the router will distribute traffic across them uniformly.

func (*ICXNetlinkRouter) Close 

func (r *ICXNetlinkRouter) Close() error

func (*ICXNetlinkRouter) DelAddr 

func (r *ICXNetlinkRouter) DelAddr(_ netip.Prefix) error

DelAddr removes a tun by its addr from the router.

func (*ICXNetlinkRouter) DelRoute 

func (r *ICXNetlinkRouter) DelRoute(dst netip.Prefix) error

Del removes a routing associations for a given destination prefix and Connection name. New matching flows will stop being routed through the tunnel immediately while existing flows may continue to use the tunnel for some draining period before getting re-routed via a different tunnel or dropped (if no tunnel is available for the given dst).

func (*ICXNetlinkRouter) ResolveMAC 

func (r *ICXNetlinkRouter) ResolveMAC(ctx context.Context, peerAddr netip.AddrPort) (tcpip.LinkAddress, error)

ResolveMAC resolves the MAC address for the given peer address.

func (*ICXNetlinkRouter) Start 

func (r *ICXNetlinkRouter) Start(ctx context.Context) error

Start initializes the router and starts forwarding traffic. It's a blocking call that should be run in a separate goroutine.

type ICXNetstackRouter 

type ICXNetstackRouter struct {
	Handler *icx.Handler
	// contains filtered or unexported fields
}

func NewICXNetstackRouter 

func NewICXNetstackRouter(opts ...Option) (*ICXNetstackRouter, error)

func (*ICXNetstackRouter) AddAddr 

func (r *ICXNetstackRouter) AddAddr(addr netip.Prefix, _ connection.Connection) error

AddAddr adds a tun with an associated address to the router.

func (*ICXNetstackRouter) AddRoute 

func (r *ICXNetstackRouter) AddRoute(dst netip.Prefix) error

AddRoute adds a dst prefix to be routed through the given tunnel connection. If multiple tunnels are provided, the router will distribute traffic across them uniformly.

func (*ICXNetstackRouter) Close 

func (r *ICXNetstackRouter) Close() error

func (*ICXNetstackRouter) DelAddr 

func (r *ICXNetstackRouter) DelAddr(addr netip.Prefix) error

DelAddr removes a tun by its addr from the router.

func (*ICXNetstackRouter) DelRoute 

func (r *ICXNetstackRouter) DelRoute(dst netip.Prefix) error

Del removes a routing associations for a given destination prefix and Connection name. New matching flows will stop being routed through the tunnel immediately while existing flows may continue to use the tunnel for some draining period before getting re-routed via a different tunnel or dropped (if no tunnel is available for the given dst).

func (*ICXNetstackRouter) Start 

func (r *ICXNetstackRouter) Start(ctx context.Context) error

Start initializes the router and starts forwarding traffic. It's a blocking call that should be run in a separate goroutine.

type ICXTunRouter 

type ICXTunRouter struct {
	Handler *icx.Handler
	// contains filtered or unexported fields
}

ICXTunRouter is the kernel-device agent datapath: it splices a /dev/net/tun device to the shared icx handler over the agent's existing Geneve packet conn, so any kernel-socket process in the same netns (e.g. the backplane's Envoy) reaches overlay destinations by plain kernel route. It is the VTEP counterpart of ICXNetstackRouter, which confines the overlay to an in-process netstack behind a SOCKS listener.

The Geneve side stays on the caller-provided packet conn (the bifurcated socket shared with the QUIC control plane) rather than the icx driver's own socket: the relay transmits Geneve to the same 5-tuple it accepted the control session from, so data and control must share one socket. Requires NET_ADMIN and access to /dev/net/tun.

func NewICXTunRouter 

func NewICXTunRouter(opts ...Option) (*ICXTunRouter, error)

NewICXTunRouter creates the TUN router: a fresh icx handler in layer-3 mode, a kernel TUN device named by WithTunnelInterface, and the icx tun datapath splicing them across the WithPacketConn socket. The device is created up with the tunnel MTU but carries no addresses or routes until AddAddr / AddRoute program them.

func (*ICXTunRouter) AddAddr 

func (r *ICXTunRouter) AddAddr(addr netip.Prefix, _ connection.Connection) error

AddAddr assigns an overlay prefix to the TUN device. The kernel installs the connected route for the prefix, so anything in the same netns can route to the overlay immediately.

func (*ICXTunRouter) AddRoute 

func (r *ICXTunRouter) AddRoute(dst netip.Prefix) error

AddRoute routes an overlay prefix out the TUN device (link scope). Replace semantics keep it idempotent against the kernel's own connected routes.

func (*ICXTunRouter) AddRouteSrc added in v0.22.0 

func (r *ICXTunRouter) AddRouteSrc(dst netip.Prefix, src netip.Addr) error

AddRouteSrc routes an overlay prefix out the TUN device with src as the route's preferred source address.

The device carries one address per relay the agent is connected to, and the kernel would otherwise choose among them by longest matching prefix — which tracks the connection index, not the relay, so it routinely picks an address leased by a relay other than the one this prefix egresses to. Relays do not federate, so such a packet is dropped. Pinning the source takes the choice away from the kernel.

func (*ICXTunRouter) Close 

func (r *ICXTunRouter) Close() error

Close stops the datapath and releases the TUN device and the underlying packet conn (via the datapath, which owns both), plus the netlink and netns handles. The named netns itself is left in place: Envoy holds sockets in it and a reconnecting session reuses it.

func (*ICXTunRouter) DelAddr 

func (r *ICXTunRouter) DelAddr(addr netip.Prefix) error

DelAddr removes an overlay prefix from the TUN device.

func (*ICXTunRouter) DelRoute 

func (r *ICXTunRouter) DelRoute(dst netip.Prefix) error

DelRoute removes an overlay prefix route from the TUN device.

func (*ICXTunRouter) Start 

func (r *ICXTunRouter) Start(ctx context.Context) error

Start runs the datapath pumps. It blocks until ctx is canceled or the datapath fails.

type NetlinkRouter 

type NetlinkRouter struct {
	// contains filtered or unexported fields
}

NetlinkRouter implements Router using Linux's netlink subsystem.

func NewNetlinkRouter 

func NewNetlinkRouter(opts ...Option) (*NetlinkRouter, error)

NewNetlinkRouter creates a new netlink-based tunnel router.

func (*NetlinkRouter) AddAddr 

func (r *NetlinkRouter) AddAddr(addr netip.Prefix, tun connection.Connection) error

AddAddr adds a tunnel connection with the given address. The addr is used by the multiplexer to route traffic to the correct tunnel based on the destination IP of the incoming packet.

func (*NetlinkRouter) AddRoute 

func (r *NetlinkRouter) AddRoute(dst netip.Prefix) error

func (*NetlinkRouter) Close 

func (r *NetlinkRouter) Close() error

Close releases any resources associated with the router.

func (*NetlinkRouter) DelAddr 

func (r *NetlinkRouter) DelAddr(addr netip.Prefix) error

DelAddr removes a tunnel connection with the given address. The addr is used by the multiplexer to route traffic to the correct tunnel based on the destination IP of the incoming packet.

func (*NetlinkRouter) DelRoute 

func (r *NetlinkRouter) DelRoute(dst netip.Prefix) error

func (*NetlinkRouter) Start 

func (r *NetlinkRouter) Start(ctx context.Context) error

Start initializes the router and starts forwarding traffic.

type NetstackRouter 

type NetstackRouter struct {
	// contains filtered or unexported fields
}

NetstackRouter implements Router using a user-mode network stack. This router can be used for both client and server sides.

func NewNetstackRouter 

func NewNetstackRouter(opts ...Option) (*NetstackRouter, error)

NewNetstackRouter creates a new netstack-based tunnel router.

func (*NetstackRouter) AddAddr 

func (r *NetstackRouter) AddAddr(addr netip.Prefix, conn connection.Connection) error

AddAddr adds a dst route to the tunnel.

func (*NetstackRouter) AddRoute 

func (r *NetstackRouter) AddRoute(dst netip.Prefix) error

func (*NetstackRouter) Close 

func (r *NetstackRouter) Close() error

Close releases any resources associated with the router.

func (*NetstackRouter) Del 

func (r *NetstackRouter) Del(dst netip.Prefix, _ string) error

Del removes a dst route from the tunnel.

func (*NetstackRouter) DelAddr 

func (r *NetstackRouter) DelAddr(addr netip.Prefix) error

DelAddr removes a dst route from the tunnel.

func (*NetstackRouter) DelAll 

func (r *NetstackRouter) DelAll(dst netip.Prefix) error

DelAll removes all routes for the dst.

func (*NetstackRouter) DelRoute 

func (r *NetstackRouter) DelRoute(dst netip.Prefix) error

func (*NetstackRouter) ListenPacket 

func (r *NetstackRouter) ListenPacket(addr netip.AddrPort) (net.PacketConn, error)

ListenPacket creates an unconnected UDP PacketConn bound to the given overlay address inside the gvisor network stack.

func (*NetstackRouter) Start 

func (r *NetstackRouter) Start(ctx context.Context) error

Start initializes the router and starts forwarding traffic.

type Option 

type Option func(*routerOptions)

Option represents a router configuration option.

func WithChecksumRecalculation 

func WithChecksumRecalculation(enable bool) Option

WithChecksumRecalculation enables or disables checksum recalculation for the netstack router. Only valid for netstack routers.

func WithEgressGateway 

func WithEgressGateway(enable bool) Option

WithEgressGateway enables or disables internet egress for the router.

func WithExternalIPv6Prefix 

func WithExternalIPv6Prefix(prefix netip.Prefix) Option

WithExternalIPv6Prefix sets the external IPv6 prefix for the router.

func WithExternalInterface 

func WithExternalInterface(name string) Option

WithExternalInterface sets the external interface name. Only valid for netlink routers.

func WithLocalAddresses 

func WithLocalAddresses(localAddresses []netip.Prefix) Option

WithLocalAddresses sets the local addresses for the router.

func WithPacketConn 

func WithPacketConn(pc batchpc.BatchPacketConn) Option

WithPacketConn sets a custom BatchPacketConn for the ICX netstack router. Only valid for ICX netstack router.

func WithPacketObserver 

func WithPacketObserver(obs connection.PacketObserver) Option

WithPacketObserver sets a packet observer for traffic monitoring.

func WithPcapPath 

func WithPcapPath(path string) Option

WithPcapPath sets the optional path to a packet capture file for the netstack router.

func WithPreserveDefaultGwDsts 

func WithPreserveDefaultGwDsts(dsts []netip.Prefix) Option

WithPreserveDefaultGwDsts preserves default gateway routes for given destinations. Only valid for netlink routers.

func WithResolveConfig 

func WithResolveConfig(conf *network.ResolveConfig) Option

WithResolveConfig sets the DNS configuration for the netstack router.

func WithSocksListenAddr 

func WithSocksListenAddr(addr string) Option

WithSocksListenAddr sets the SOCKS listen address for the netstack router. Only valid for netstack routers.

func WithSourcePortHashing 

func WithSourcePortHashing(enable bool) Option

WithSourcePortHashing enables or disables source port hashing for routing decisions. Only valid for ICX routers.

func WithTunnelInterface 

func WithTunnelInterface(name string) Option

WithTunnelInterface sets the tunnel interface name. Only valid for netlink routers.

func WithTunnelMTU 

func WithTunnelMTU(mtu int) Option

WithTunnelMTU sets the tunnel interface MTU.

func WithTunnelNetns 

func WithTunnelNetns(name string) Option

WithTunnelNetns places the TUN device inside the named network namespace (per the /var/run/netns convention). The namespace is created and bind-mounted if it does not exist. The underlay socket is unaffected — it stays in the namespace it was created in — so only overlay traffic entering the TUN is scoped to the namespace. Only valid for the TUN router; Linux only; requires CAP_SYS_ADMIN in addition to the TUN router's NET_ADMIN.

type OverlayDialer 

type OverlayDialer interface {
	// ListenPacket creates an unconnected UDP PacketConn bound to the given
	// overlay address. Port 0 means ephemeral.
	ListenPacket(addr netip.AddrPort) (net.PacketConn, error)
}

OverlayDialer is optionally implemented by routers that support creating UDP sockets on the overlay network (for BFD, etc.).

type Router 

type Router interface {
	io.Closer

	// Start initializes the router and starts forwarding traffic.
	// It's a blocking call that should be run in a separate goroutine.
	Start(ctx context.Context) error

	// AddAddr adds a tun with an associated address to the router.
	AddAddr(addr netip.Prefix, tun connection.Connection) error

	// DelAddr removes a tun by its addr from the router.
	DelAddr(addr netip.Prefix) error

	// AddRoute adds a dst prefix to be routed through the given tunnel connection.
	// If multiple tunnels are provided, the router will distribute traffic across them
	// uniformly.
	AddRoute(dst netip.Prefix) error

	// Del removes a routing associations for a given destination prefix and Connection name.
	// New matching flows will stop being routed through the tunnel immediately while
	// existing flows may continue to use the tunnel for some draining period before
	// getting re-routed via a different tunnel or dropped (if no tunnel is available for
	// the given dst).
	DelRoute(dst netip.Prefix) error
}

Router is an interface for managing tunnel routing.

type TunnelRoute 

type TunnelRoute struct {
	Dst   netip.Prefix
	TunID string
	State TunnelRouteState
}

type TunnelRouteState 

type TunnelRouteState int
const (
	TunnelRouteStateActive TunnelRouteState = iota
	TunnelRouteStateDraining
)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.