Add FreeBSD /dev/tun support with FIB-based routing isolation

.github/workflows/test.yml

@@ -9,15 +9,28 @@ on:
       - '**.md'
       - '.github/**'
       - '!.github/workflows/debug.yml'
+      - '!.github/workflows/test.yml'
   pull_request:
     branches:
       - main
       - dev
 
 jobs:
-  build:
-    name: Linux
-    runs-on: ubuntu-latest
+  test:
+    name: ${{ matrix.os }} (Go ${{ matrix.go }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest]
+        go: ['1.25.x', '1.26.x', stable]
+        include:
+          - os: windows-latest
+            go: stable
+          - os: macos-latest
+            go: stable
+    env:
+      GOTOOLCHAIN: local
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -26,81 +39,21 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: ^1.25.0
-      - name: Build
+          go-version: ${{ matrix.go }}
+      - name: Install network test tools
+        if: runner.os == 'Linux'
         run: |
-          make test
-          go test -c -o ping_test ./ping
-          sudo ./ping_test -test.v
-  build_go124:
-    name: Linux (Go 1.24)
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - name: Setup Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: ~1.24
-        continue-on-error: true
-      - name: Build
-        run: |
-          make test
-          go test -c -o ping_test ./ping
-          sudo ./ping_test -test.v
-  build_go123:
-    name: Linux (Go 1.23)
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - name: Setup Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: ~1.23
-        continue-on-error: true
-      - name: Build
+          sudo apt-get update
+          sudo apt-get install -y iproute2
+      - name: Test
+        env:
+          TEST_FLAGS: ${{ runner.os != 'Windows' && '-exec sudo' || '' }}
+        run: make test
+      - name: Test unprivileged ping
+        if: runner.os != 'Linux'
+        run: go test -v ./ping
+      - name: Test privileged ping
+        if: runner.os != 'Windows'
         run: |
-          make test
           go test -c -o ping_test ./ping
           sudo ./ping_test -test.v
-  build_windows:
-    name: Windows
-    runs-on: windows-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - name: Setup Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: ^1.23
-        continue-on-error: true
-      - name: Build
-        run: |
-          make test
-          go test -v ./ping
-  build_darwin:
-    name: macOS
-    runs-on: macos-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - name: Setup Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: ^1.23
-        continue-on-error: true
-      - name: Build
-        run: |
-          make test
-          go test -v ./ping
-          go test -c -o ping_test ./ping
-          sudo ./ping_test -test.v

Makefile

@@ -9,13 +9,7 @@ build:
 	GOOS=windows GOARCH=amd64 go build -v -tags with_gvisor .
 
 fmt:
-	@gofumpt -l -w .
-	@gofmt -s -w .
-	@gci write --custom-order -s standard -s "prefix(github.com/sagernet/)" -s "default" .
-
-fmt_install:
-	go install -v mvdan.cc/gofumpt@latest
-	go install -v github.com/daixiang0/gci@latest
+	@golangci-lint fmt
 
 lint:
 	GOOS=linux golangci-lint --max-same-issues=0 --max-issues-per-linter=0 run ./...
@@ -29,4 +23,4 @@ lint_install:
 test:
 	go build -v .
 	#go test -bench=. ./internal/checksum_test
-	go test -v .
+	go test -v $(TEST_FLAGS) .

flow.go

@@ -63,9 +63,39 @@ type Port interface {
 	WritePackets(packets [][]byte) error
 }
 
+type SelectorRange struct {
+	Start uint16
+	Count uint16
+}
+
 type PortWithSelectorRange interface {
-	Port
-	PortSelectorRange() (start uint16, count uint16)
+	PortSelectorRanges(protocol uint8) []SelectorRange
+	ExpandSelectorRanges(protocol uint8) bool
+}
+
+type PortWithSelectorReservation interface {
+	ReserveSelector(protocol uint8, address netip.AddrPort) bool
+	ReleaseSelector(protocol uint8, address netip.AddrPort)
+}
+
+type PortWithUpstream interface {
+	UpstreamPort() any
+}
+
+func portCapability[T any](port any) (T, bool) {
+	for port != nil {
+		capability, matched := port.(T)
+		if matched {
+			return capability, true
+		}
+		wrapper, isWrapper := port.(PortWithUpstream)
+		if !isWrapper {
+			break
+		}
+		port = wrapper.UpstreamPort()
+	}
+	var zero T
+	return zero, false
 }
 
 type Return interface {