go-freebsd-ifc

Why

Jail and bhyve networking, LACP, VPN TAP/TUN, SDN and test topologies — driven from Go code that can read state back and reconcile it, rather than by parsing ifconfig and route output. Much of it was hardened while building a daemon on top of the library.

How

• Thin public packages (if, bridge, epair, vlan, vxlan, lagg, tap, tun, ip, route) over internal ops; cgo is confined to a small layer wrapping socket() and ioctl().
• Interfaces are SIOC* ioctls on a datagram socket. VXLAN uses SIOCSDRVSPEC and manages forwarding-table peers — something ifconfig(8) itself doesn’t expose.
• Routes are written over a PF_ROUTE socket and read back through the NET_RT_DUMP sysctl.
• ABI pinning. Struct sizes and constants are exported from C and compared against the Go structs in tests, so a header change in a future FreeBSD release fails loudly instead of silently corrupting messages.
• Idempotent by design. Re-adding a bridge member, address or route is a no-op; deleting an address that’s already gone succeeds. Removing a VXLAN peer is deliberately strict — a missing entry usually means the caller’s view of the table is stale.
• Typed errors that work with errors.Is/errors.As, unit tests next to each package, root-only e2e tests, and 13 example programs.

pair, _ := epair.Create()
br, _ := bridge.Create()
bridge.AddMember(br, pair.B)
bridge.Up(br, true)

$ git clone https://github.com/zombocoder/go-freebsd-ifc