tun

package module
v0.9.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Aug 30, 2026 License: GPL-2.0 Imports: 54 Imported by: 96

README

sing-tun

Simple transparent proxy library.

For Linux, Windows, macOS and iOS.

License

Copyright (C) 2022 by nekohasekai <contact-sagernet@sekai.icu>

This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.

Documentation

Index

Constants

View Source
const (
	DefaultAutoRedirectInputMark  = 0x2023
	DefaultAutoRedirectOutputMark = 0x2024
	DefaultAutoRedirectResetMark  = 0x2025
	DefaultAutoRedirectNFQueue    = 100
)
View Source
const (
	DefaultIPRoute2TableIndex                    = 2022
	DefaultIPRoute2RuleIndex                     = 9000
	DefaultIPRoute2AutoRedirectFallbackRuleIndex = 32768
)
View Source
const (
	DNSModeDisabled = "disabled"
	DNSModeNative   = "native"
	DNSModeHijack   = "hijack"
)
View Source
const FlagAndroidVPNUpdate = 1 << iota
View Source
const PacketOffset = 0
View Source
const WithGVisor = false

Variables

View Source
var ErrGVisorNotIncluded = E.New(`gVisor is not included in this build, rebuild with -tags with_gvisor`)
View Source
var ErrIncludeAllNetworks = E.New("`system` and `mixed` stack are not available when `includeAllNetworks` is enabled. See https://github.com/SagerNet/sing-tun/issues/25")
View Source
var ErrNetlinkBanned = E.New(
	"netlink socket in Android is banned by Google, " +
		"use the root or system (ADB) user to run sing-box, " +
		"or switch to the sing-box Android graphical interface client",
)
View Source
var ErrNoRoute = E.New("no route to internet")
View Source
var ErrTooManySegments = errors.New("too many segments")

ErrTooManySegments is returned by Device.Read() when segmentation overflows the length of supplied buffers. This error should not cause reads to cease.

Functions

func BroadcastAddr added in v0.1.19

func BroadcastAddr(inet4Address []netip.Prefix) netip.Addr

func BuildUnreachable added in v0.9.0

func BuildUnreachable(packet []byte, source netip.Addr, headroom int) ([]byte, bool)

func CalculateInterfaceName

func CalculateInterfaceName(name string) (tunName string)

func GSOSplit added in v0.6.0

func GSOSplit(in []byte, options GSOOptions, outBufs [][]byte, sizes []int, outOffset int) (int, error)

GSOSplit splits packets from 'in' into outBufs[<index>][outOffset:], writing the size of each element into sizes. It returns the number of buffers populated, and/or an error. Callers may pass an 'in' slice that overlaps with the first element of outBuffers, i.e. &in[0] may be equal to &outBufs[0][outOffset]. GSONone is a valid options.GSOType regardless of the value of options.NeedsCsum. Length of each outBufs element must be greater than or equal to the length of 'in', otherwise output may be silently truncated.

func HasNextAddress added in v0.4.1

func HasNextAddress(prefix netip.Prefix, count int) bool

func PacketDestination added in v0.6.0

func PacketDestination(packet []byte) netip.Addr

func PacketFillHeader added in v0.6.0

func PacketFillHeader(packet []byte, ipVersion int)

func PacketIPVersion added in v0.6.0

func PacketIPVersion(packet []byte) int

Types

type AutoRedirect added in v0.4.1

type AutoRedirect interface {
	Start() error
	Close() error
	UpdateRouteAddressSet()
}

func NewAutoRedirect added in v0.4.1

func NewAutoRedirect(options AutoRedirectOptions) (AutoRedirect, error)

type AutoRedirectOptions added in v0.4.1

type AutoRedirectOptions struct {
	TunOptions             *Options
	Context                context.Context
	Handler                Handler
	Logger                 logger.Logger
	NetworkMonitor         NetworkUpdateMonitor
	InterfaceFinder        control.InterfaceFinder
	TableName              string
	DisableNFTables        bool
	CustomRedirectPort     func() int
	RouteAddressSet        *[]*netipx.IPSet
	RouteExcludeAddressSet *[]*netipx.IPSet
}

type DarwinTUN added in v0.7.0

type DarwinTUN interface {
	Tun
	BatchRead() ([]*buf.Buffer, error)
	BatchWrite(buffers []*buf.Buffer) error
}

type DefaultInterfaceMonitor

type DefaultInterfaceMonitor interface {
	Start() error
	Close() error
	DefaultInterface() *control.Interface
	OverrideAndroidVPN() bool
	AndroidVPNEnabled() bool
	RegisterCallback(callback DefaultInterfaceUpdateCallback) *list.Element[DefaultInterfaceUpdateCallback]
	UnregisterCallback(element *list.Element[DefaultInterfaceUpdateCallback])
	RegisterMyInterface(interfaceName string)
	MyInterfaces() []string
}

func NewDefaultInterfaceMonitor

func NewDefaultInterfaceMonitor(networkMonitor NetworkUpdateMonitor, logger logger.Logger, options DefaultInterfaceMonitorOptions) (DefaultInterfaceMonitor, error)

type DefaultInterfaceMonitorOptions

type DefaultInterfaceMonitorOptions struct {
	InterfaceFinder       control.InterfaceFinder
	OverrideAndroidVPN    bool
	UnderNetworkExtension bool
}

type DefaultInterfaceUpdateCallback

type DefaultInterfaceUpdateCallback = func(defaultInterface *control.Interface, flags int)

type FlowAction added in v0.9.0

type FlowAction uint8
const (
	ActionAccept FlowAction = iota
	ActionFlow
	ActionReject
	ActionDrop
	ActionBypass
	ActionHijackDNS
)

type FlowCloseReason added in v0.9.0

type FlowCloseReason uint8
const (
	FlowCloseReset FlowCloseReason = iota
	FlowCloseFinished
	FlowCloseTimeout
)

func (FlowCloseReason) String added in v0.9.0

func (r FlowCloseReason) String() string

type FlowHandle added in v0.9.0

type FlowHandle interface {
	CloseFlow()
}

type FlowTracker added in v0.9.0

type FlowTracker interface {
	AttachFlow(handle FlowHandle)
	CountForward(n int)
	CountReverse(n int)
	FlowEstablished()
	CloseFlow(reason FlowCloseReason)
}

type FlowVerdict added in v0.9.0

type FlowVerdict struct {
	Action      FlowAction
	Port        Port
	Destination netip.AddrPort
	UDPTimeout  time.Duration
	NewTracker  func() FlowTracker
}

type ForwardDispatcher added in v0.9.0

type ForwardDispatcher struct {
	// contains filtered or unexported fields
}

func NewForwardDispatcher added in v0.9.0

func NewForwardDispatcher(handler Handler, writeback ForwardWriteback, logger logger.Logger, udpTimeout time.Duration, icmpTimeout time.Duration) *ForwardDispatcher

func (*ForwardDispatcher) Close added in v0.9.0

func (d *ForwardDispatcher) Close()

func (*ForwardDispatcher) Dispatch added in v0.9.0

func (d *ForwardDispatcher) Dispatch(packet []byte) bool

func (*ForwardDispatcher) Flush added in v0.9.0

func (d *ForwardDispatcher) Flush()

func (*ForwardDispatcher) ResetNetwork added in v0.9.0

func (d *ForwardDispatcher) ResetNetwork()

type ForwardWriteback added in v0.9.0

type ForwardWriteback interface {
	ReturnHeadroom() int
	WriteReturnPackets(packets [][]byte) error
}

type GSOOptions added in v0.6.0

type GSOOptions struct {
	// GSOType represents the type of segmentation offload.
	GSOType GSOType
	// HdrLen is the sum of the layer 3 and 4 header lengths. This field may be
	// zero when GSOType == GSONone.
	HdrLen uint16
	// CsumStart is the head byte index of the packet data to be checksummed,
	// i.e. the start of the TCP or UDP header.
	CsumStart uint16
	// CsumOffset is the offset from CsumStart where the 2-byte checksum value
	// should be placed.
	CsumOffset uint16
	// GSOSize is the size of each segment exclusive of HdrLen. The tail segment
	// may be smaller than this value.
	GSOSize uint16
	// NeedsCsum may be set where GSOType == GSONone. When set, the checksum
	// at CsumStart + CsumOffset must be a partial checksum, i.e. the
	// pseudo-header sum.
	NeedsCsum bool
}

GSOOptions is loosely modeled after struct virtio_net_hdr from the VIRTIO specification. It is a common representation of GSO metadata that can be applied to support packet GSO across tun.Device implementations.

type GSOType added in v0.6.0

type GSOType int

GSOType represents the type of segmentation offload.

const (
	GSONone GSOType = iota
	GSOTCPv4
	GSOTCPv6
	GSOUDPL4
)

func (GSOType) String added in v0.6.0

func (g GSOType) String() string

type Handler

type Handler interface {
	JudgeFlow(network uint8, source netip.AddrPort, destination netip.AddrPort, firstPacket []byte) FlowVerdict
	NewDNSPacket(payload []byte, source M.Socksaddr, destination M.Socksaddr, writer N.PacketWriter)
	N.TCPConnectionHandlerEx
	N.UDPConnectionHandlerEx
}

type LinuxTUN added in v0.2.0

type LinuxTUN interface {
	Tun
	N.FrontHeadroom
	BatchSize() int
	BatchRead(buffers [][]byte, offset int, readN []int) (n int, err error)
	BatchWrite(buffers [][]byte, offset int) (n int, err error)
	TXChecksumOffload() bool
}

type NATFiltering added in v0.9.0

type NATFiltering uint8
const (
	NATFilteringEndpointIndependent NATFiltering = iota
	NATFilteringAddressDependent
	NATFilteringAddressAndPortDependent
)

type NATMapping added in v0.9.0

type NATMapping uint8
const (
	NATMappingEndpointIndependent NATMapping = iota
	NATMappingAddressDependent
	NATMappingAddressAndPortDependent
)

type NativeTun

type NativeTun struct {
	// contains filtered or unexported fields
}

func (*NativeTun) BatchRead added in v0.2.0

func (t *NativeTun) BatchRead(buffers [][]byte, offset int, readN []int) (int, error)

func (*NativeTun) BatchSize added in v0.2.0

func (t *NativeTun) BatchSize() int

func (*NativeTun) BatchWrite added in v0.2.0

func (t *NativeTun) BatchWrite(buffers [][]byte, offset int) (int, error)

func (*NativeTun) Close

func (t *NativeTun) Close() error

func (*NativeTun) FrontHeadroom added in v0.2.0

func (t *NativeTun) FrontHeadroom() int

func (*NativeTun) Name added in v0.6.0

func (t *NativeTun) Name() (string, error)

func (*NativeTun) Read

func (t *NativeTun) Read(p []byte) (n int, err error)

func (*NativeTun) Start added in v0.6.0

func (t *NativeTun) Start() error

func (*NativeTun) TXChecksumOffload added in v0.2.0

func (t *NativeTun) TXChecksumOffload() bool

func (*NativeTun) UpdateRouteOptions added in v0.6.0

func (t *NativeTun) UpdateRouteOptions(tunOptions Options) error

func (*NativeTun) Write

func (t *NativeTun) Write(p []byte) (n int, err error)

type NetworkUpdateCallback

type NetworkUpdateCallback = func()

type NetworkUpdateMonitor

type NetworkUpdateMonitor interface {
	Start() error
	Close() error
	RegisterCallback(callback NetworkUpdateCallback) *list.Element[NetworkUpdateCallback]
	UnregisterCallback(element *list.Element[NetworkUpdateCallback])
}

func NewNetworkUpdateMonitor

func NewNetworkUpdateMonitor(logger logger.Logger) (NetworkUpdateMonitor, error)

type Options

type Options struct {
	Name                                  string
	NetNs                                 string
	Inet4Address                          []netip.Prefix
	Inet6Address                          []netip.Prefix
	MTU                                   uint32
	GSO                                   bool
	AutoRoute                             bool
	InterfaceScope                        bool
	Inet4Gateway                          netip.Addr
	Inet6Gateway                          netip.Addr
	DNSMode                               string
	DNSAddress                            []netip.Addr
	IPRoute2TableIndex                    int
	IPRoute2RuleIndex                     int
	IPRoute2AutoRedirectFallbackRuleIndex int
	AutoRedirectMarkMode                  bool
	AutoRedirectInputMark                 uint32
	AutoRedirectOutputMark                uint32
	AutoRedirectResetMark                 uint32
	AutoRedirectNFQueue                   uint16
	ExcludeMPTCP                          bool
	Inet4LoopbackAddress                  []netip.Addr
	Inet6LoopbackAddress                  []netip.Addr
	StrictRoute                           bool
	Inet4RouteAddress                     []netip.Prefix
	Inet6RouteAddress                     []netip.Prefix
	Inet4RouteExcludeAddress              []netip.Prefix
	Inet6RouteExcludeAddress              []netip.Prefix
	IncludeInterface                      []string
	ExcludeInterface                      []string
	IncludeUID                            []ranges.Range[uint32]
	ExcludeUID                            []ranges.Range[uint32]
	IncludeAndroidUser                    []int
	IncludePackage                        []string
	ExcludePackage                        []string
	IncludeMACAddress                     []net.HardwareAddr
	ExcludeMACAddress                     []net.HardwareAddr
	InterfaceFinder                       control.InterfaceFinder
	InterfaceMonitor                      DefaultInterfaceMonitor
	FileDescriptor                        int
	Logger                                logger.Logger

	// For library usages.
	EXP_DisableDNSHijack      bool
	EXP_ExternalConfiguration bool

	// For gvisor stack, it should be enabled when MTU is less than 32768; otherwise it should be less than or equal to 8192.
	// The above condition is just an estimate and not exact, calculated on M4 pro.
	EXP_MultiPendingPackets bool

	// Will cause the darwin network to die, do not use.
	EXP_SendMsgX bool
	// contains filtered or unexported fields
}

func (*Options) BuildAndroidRules

func (o *Options) BuildAndroidRules(packageManager PackageManager)

func (*Options) BuildAutoRouteRanges added in v0.1.21

func (o *Options) BuildAutoRouteRanges(underNetworkExtension bool) ([]netip.Prefix, error)

func (*Options) DNSModeOrDefault added in v0.9.0

func (o *Options) DNSModeOrDefault() string

func (*Options) DNSServerAddress added in v0.9.0

func (o *Options) DNSServerAddress() ([]netip.Addr, error)

func (*Options) ExcludedRanges

func (o *Options) ExcludedRanges() (uidRanges []ranges.Range[uint32])

func (*Options) Inet4DNSAddress added in v0.9.0

func (o *Options) Inet4DNSAddress() ([]netip.Addr, error)

func (*Options) Inet4GatewayAddr added in v0.4.1

func (o *Options) Inet4GatewayAddr() netip.Addr

func (*Options) Inet6DNSAddress added in v0.9.0

func (o *Options) Inet6DNSAddress() ([]netip.Addr, error)

func (*Options) Inet6GatewayAddr added in v0.4.1

func (o *Options) Inet6GatewayAddr() netip.Addr

type PackageManager

type PackageManager interface {
	Start() error
	Close() error
	IDByPackage(packageName string) (uint32, bool)
	IDBySharedPackage(sharedPackage string) (uint32, bool)
	PackageByID(id uint32) (string, bool)
	PackagesByID(id uint32) ([]string, bool)
	SharedPackageByID(id uint32) (string, bool)
}

func NewPackageManager

func NewPackageManager(options PackageManagerOptions) (PackageManager, error)

type PackageManagerCallback

type PackageManagerCallback interface {
	OnPackagesUpdated(packages int, sharedUsers int)
}

type PackageManagerOptions added in v0.4.1

type PackageManagerOptions struct {
	Callback PackageManagerCallback

	// Logger is the logger to log errors
	// optional
	Logger logger.Logger
}

type Port added in v0.9.0

type Port interface {
	PortAddresses() (v4 netip.Addr, v6 netip.Addr)
	PortMTU() uint32
	AttachReturn(returnPath Return) error
	DetachReturn(returnPath Return) error
	WritePackets(packets [][]byte) error
}

type PortWithSelectorRange added in v0.9.0

type PortWithSelectorRange interface {
	Port
	PortSelectorRange() (start uint16, count uint16)
}

type Return added in v0.9.0

type Return interface {
	ReturnHeadroom() int
	ReturnPackets(packets [][]byte) [][]byte
}

type Session

type Session struct {
	SourceAddress      netip.Addr
	DestinationAddress netip.Addr
	SourcePort         uint16
	DestinationPort    uint16
}

type Stack

type Stack interface {
	Start() error
	ResetNetwork()
	Close() error
}

func NewGVisor

func NewGVisor(
	options StackOptions,
) (Stack, error)

func NewMixed added in v0.1.12

func NewMixed(
	options StackOptions,
) (Stack, error)

func NewStack

func NewStack(
	stack string,
	options StackOptions,
) (Stack, error)

func NewSystem

func NewSystem(options StackOptions) (Stack, error)

type StackOptions

type StackOptions struct {
	Context                context.Context
	Tun                    Tun
	TunOptions             Options
	UDPTimeout             time.Duration
	ICMPTimeout            time.Duration
	UDPMapping             NATMapping
	UDPFiltering           NATFiltering
	UDPNATMax              uint32
	Handler                Handler
	Logger                 logger.Logger
	ForwarderBindInterface bool
	IncludeAllNetworks     bool
	InterfaceFinder        control.InterfaceFinder
}

type System

type System struct {
	// contains filtered or unexported fields
}

func (*System) Close

func (s *System) Close() error

func (*System) ResetNetwork added in v0.9.0

func (s *System) ResetNetwork()

func (*System) Start

func (s *System) Start() error

type TCPNat

type TCPNat struct {
	// contains filtered or unexported fields
}

func NewNat

func NewNat(ctx context.Context, timeout time.Duration) *TCPNat

func (*TCPNat) Lookup

func (n *TCPNat) Lookup(source netip.AddrPort, destination netip.AddrPort) uint16

func (*TCPNat) LookupBack

func (n *TCPNat) LookupBack(port uint16) *TCPSession

func (*TCPNat) Purge added in v0.9.0

func (n *TCPNat) Purge()

type TCPSession

type TCPSession struct {
	sync.Mutex
	Source      netip.AddrPort
	Destination netip.AddrPort
	LastActive  time.Time
}

type Tun

type Tun interface {
	io.ReadWriter
	Name() (string, error)
	Start() error
	Close() error
	UpdateRouteOptions(tunOptions Options) error
}

func New added in v0.1.2

func New(options Options) (Tun, error)

type UDPEgressConn added in v0.9.0

type UDPEgressConn struct {
	// contains filtered or unexported fields
}

func NewUDPEgressConn added in v0.9.0

func NewUDPEgressConn(anchor *net.UDPConn, pool *UDPEgressPool) *UDPEgressConn

func (*UDPEgressConn) Close added in v0.9.0

func (c *UDPEgressConn) Close() error

func (*UDPEgressConn) LocalAddr added in v0.9.0

func (c *UDPEgressConn) LocalAddr() net.Addr

func (*UDPEgressConn) ReadFromUDPAddrPort added in v0.9.0

func (c *UDPEgressConn) ReadFromUDPAddrPort(buffer []byte) (int, netip.AddrPort, error)

func (*UDPEgressConn) SetDeadline added in v0.9.0

func (c *UDPEgressConn) SetDeadline(t time.Time) error

func (*UDPEgressConn) SetReadDeadline added in v0.9.0

func (c *UDPEgressConn) SetReadDeadline(t time.Time) error

func (*UDPEgressConn) SetWriteDeadline added in v0.9.0

func (c *UDPEgressConn) SetWriteDeadline(t time.Time) error

func (*UDPEgressConn) WriteToUDPAddrPort added in v0.9.0

func (c *UDPEgressConn) WriteToUDPAddrPort(buffer []byte, destination netip.AddrPort) (int, error)

type UDPEgressPool added in v0.9.0

type UDPEgressPool struct {
	// contains filtered or unexported fields
}

func NewUDPEgressPool added in v0.9.0

func NewUDPEgressPool(options UDPEgressPoolOptions) *UDPEgressPool

func (*UDPEgressPool) Close added in v0.9.0

func (p *UDPEgressPool) Close()

func (*UDPEgressPool) LookupEgress added in v0.9.0

func (p *UDPEgressPool) LookupEgress(destination netip.AddrPort) *net.UDPConn

func (*UDPEgressPool) ReceiveEgress added in v0.9.0

func (p *UDPEgressPool) ReceiveEgress(buffer []byte) (int, netip.AddrPort, error)

func (*UDPEgressPool) SetEgressPort added in v0.9.0

func (p *UDPEgressPool) SetEgressPort(port uint16) bool

type UDPEgressPoolOptions added in v0.9.0

type UDPEgressPoolOptions struct {
	Logger           logger.Logger
	Network          string
	Control          control.Func
	InterfaceFinder  control.InterfaceFinder
	InterfaceMonitor DefaultInterfaceMonitor
	ExcludeInterface string
	IsExempt         func() bool
}

type UDPNat added in v0.9.0

type UDPNat struct {
	// contains filtered or unexported fields
}

func NewUDPNat added in v0.9.0

func NewUDPNat(options UDPNatOptions) *UDPNat

func (*UDPNat) Close added in v0.9.0

func (s *UDPNat) Close() error

func (*UDPNat) NewPacket added in v0.9.0

func (s *UDPNat) NewPacket(bufferSlices [][]byte, source M.Socksaddr, destination M.Socksaddr, userData any)

func (*UDPNat) NewPacketBatch added in v0.9.0

func (s *UDPNat) NewPacketBatch(buffers []*buf.Buffer, sources []M.Socksaddr, destination M.Socksaddr, userData any)

func (*UDPNat) Purge added in v0.9.0

func (s *UDPNat) Purge()

func (*UDPNat) PurgeExpired added in v0.9.0

func (s *UDPNat) PurgeExpired()

func (*UDPNat) Start added in v0.9.0

func (s *UDPNat) Start() error

type UDPNatOptions added in v0.9.0

type UDPNatOptions struct {
	Handler   N.UDPConnectionHandlerEx
	Prepare   UDPNatPrepareFunc
	Timeout   time.Duration
	Shared    bool
	Mapping   NATMapping
	Filtering NATFiltering
	MaxSize   uint32

	InterfaceFinder  control.InterfaceFinder
	ExcludeInterface []string
}

type UDPNatPrepareFunc added in v0.9.0

type UDPNatPrepareFunc func(source M.Socksaddr, destination M.Socksaddr, userData any) (bool, context.Context, N.PacketWriter, N.CloseHandlerFunc)

type WinTun

type WinTun interface {
	Tun
	ReadPacket() ([]byte, func(), error)
}

Directories

Path Synopsis
checksum
Package checksum provides the implementation of the encoding and decoding of network protocol headers.
Package checksum provides the implementation of the encoding and decoding of network protocol headers.
header
Package header provides the implementation of the encoding and decoding of network protocol headers.
Package header provides the implementation of the encoding and decoding of network protocol headers.
seqnum
Package seqnum defines the types and methods for TCP sequence numbers such that they fit in 32-bit words and work properly when overflows occur.
Package seqnum defines the types and methods for TCP sequence numbers such that they fit in 32-bit words and work properly when overflows occur.
internal

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL