connmark

package

v0.2.4 Latest Latest Go to latest Published: Jun 24, 2026 License: GPL-3.0 Imports: 7 Imported by: 0

Details

Package connmark mirrors sysnet packet marks through conntrack marks so inbound replies are marked before distribution rpfilter chains run.

This section is empty.

This section is empty.

This section is empty.

type Config struct {
	Marks []Mark
}

Config is the complete connmark ruleset owned by Manager.

type Manager struct {
	// contains filtered or unexported fields
}

Manager reconciles the package-owned nftables connmark table.

func NewManager() *Manager

NewManager creates a Manager backed by the current network namespace.

func (m *Manager) Apply(config Config) error

Apply replaces the package-owned connmark table with rules for config.

func (m *Manager) Close() error

Close releases Manager state. nftables.Conn is transient by default, so there is no persistent kernel socket to close.

func (m *Manager) Rollback() error

Rollback deletes the package-owned connmark table.

type Mark struct {
	Value uint32
	Mask  uint32
}

Mark describes a packet-mark selector whose value should be mirrored through conntrack.