Avoid Docker firewall policy bypass

.github/workflows/lint.yml

@@ -16,21 +16,56 @@ on:
 
 jobs:
   build:
-    name: Build
+    name: Lint ${{ matrix.goos }}/${{ matrix.goarch }}
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - goos: windows
+            goarch: amd64
+          - goos: windows
+            goarch: '386'
+          - goos: windows
+            goarch: arm64
+          - goos: linux
+            goarch: amd64
+          - goos: linux
+            goarch: arm64
+          - goos: linux
+            goarch: arm
+          - goos: linux
+            goarch: '386'
+          - goos: darwin
+            goarch: amd64
+          - goos: darwin
+            goarch: arm64
+          - goos: android
+            goarch: arm64
+          - goos: freebsd
+            goarch: amd64
     steps:
       - name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
           go-version: ^1.25
+      - name: Cache go module
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/go/pkg/mod
+          key: go-${{ hashFiles('**/go.sum') }}
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v8
+        env:
+          GOOS: ${{ matrix.goos }}
+          GOARCH: ${{ matrix.goarch }}
         with:
           version: latest
           args: --timeout=30m
           install-mode: binary
-          verify: false
+          verify: false

.golangci.yml

@@ -1,35 +1,24 @@
 version: "2"
 run:
-  go: "1.25"
+  go: "1.24"
 linters:
   default: none
   enable:
-    - govet
     - ineffassign
-    - paralleltest
     - staticcheck
+    - modernize
   settings:
     staticcheck:
       checks:
         - all
-        - -S1000
-        - -S1008
-        - -S1017
-        - -ST1003
-        - -QF1001
-        - -QF1003
-        - -QF1008
+        - -QF1008 # could remove embedded field "<interface>" from selector
+        - -ST1003 # should not use ALL_CAPS in Go names; use CamelCase instead
+        - -QF1001 # could apply De Morgan's law
   exclusions:
     generated: lax
     presets:
       - comments
       - common-false-positives
-      - legacy
-      - std-error-handling
-    paths:
-      - third_party$
-      - builtin$
-      - examples$
 formatters:
   enable:
     - gci
@@ -42,8 +31,4 @@ formatters:
         - default
       custom-order: true
   exclusions:
-    generated: lax
-    paths:
-      - third_party$
-      - builtin$
-      - examples$
+    generated: lax

Makefile

@@ -18,11 +18,10 @@ fmt_install:
 	go install -v github.com/daixiang0/gci@latest
 
 lint:
-	GOOS=linux golangci-lint run .
-	GOOS=android golangci-lint run .
-	GOOS=windows golangci-lint run .
-	GOOS=darwin golangci-lint run .
-	GOOS=freebsd golangci-lint run .
+	GOOS=linux golangci-lint --max-same-issues=0 --max-issues-per-linter=0 run ./...
+	GOOS=android golangci-lint --max-same-issues=0 --max-issues-per-linter=0 run ./...
+	GOOS=windows golangci-lint --max-same-issues=0 --max-issues-per-linter=0 run ./...
+	GOOS=darwin golangci-lint --max-same-issues=0 --max-issues-per-linter=0 run ./...
 
 lint_install:
 	go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest

flow.go

@@ -0,0 +1,73 @@
+package tun
+
+import (
+	"net/netip"
+	"time"
+)
+
+type FlowVerdict struct {
+	Action      FlowAction
+	Port        Port
+	Destination netip.AddrPort
+	UDPTimeout  time.Duration
+	NewTracker  func() FlowTracker
+}
+
+type FlowAction uint8
+
+const (
+	ActionAccept FlowAction = iota
+	ActionFlow
+	ActionReject
+	ActionDrop
+	ActionBypass
+)
+
+type FlowTracker interface {
+	AttachFlow(handle FlowHandle)
+	CountForward(n int)
+	CountReverse(n int)
+	FlowEstablished()
+	CloseFlow(reason FlowCloseReason)
+}
+
+type FlowHandle interface {
+	CloseFlow()
+}
+
+type FlowCloseReason uint8
+
+const (
+	FlowCloseReset FlowCloseReason = iota
+	FlowCloseFinished
+	FlowCloseTimeout
+)
+
+func (r FlowCloseReason) String() string {
+	switch r {
+	case FlowCloseFinished:
+		return "finished"
+	case FlowCloseTimeout:
+		return "idle timeout"
+	default:
+		return "connection reset"
+	}
+}
+
+type Port interface {
+	PortAddresses() (v4 netip.Addr, v6 netip.Addr)
+	PortMTU() uint32
+	AttachReturn(returnPath Return) error
+	DetachReturn(returnPath Return) error
+	WritePackets(packets [][]byte) error
+}
+
+type PortWithSelectorRange interface {
+	Port
+	PortSelectorRange() (start uint16, count uint16)
+}
+
+type Return interface {
+	ReturnHeadroom() int
+	ReturnPackets(packets [][]byte) [][]byte
+}