honk is a Rust transparent-proxy engine for Linux, inspired by dae for its eBPF datapath and configuration surface, and by sing-box for its outbound groups, multi-protocol dialers, and Clash-compatible API.
It is not a line-for-line port of either project. The kernel path follows dae's TC + match_set + dae0/daens model, while the userspace outbound and control stacks follow sing-box-oriented designs. The project combines dae's datapath model with sing-box-inspired userspace behavior.
Status: experimental (
v0.0.1-alpha). honk is an early alpha release. Expect breaking changes, incomplete features (see TODO), and limited real-world validation. It is not recommended for production use.
License: GPL-3.0-only.
The default-off UDP NFQUEUE path holds only ambiguous LAN-forwarded first packets after LAN TC and before conntrack/NAT. Enable it with a process configuration change:
experimental {
udp_nfqueue {
enabled: true
}
}Changing experimental.udp_nfqueue.enabled requires a restart. Enabled startup requires a build with the ebpf feature and the real eBPF backend; --mock-ebpf and builds without ebpf are rejected. Host-originated WAN egress remains on the canonical TPROXY path. DNS port 53, must, block, and already-safe route-time direct decisions never enter NFQUEUE; only decisions that can still change in userspace are staged.
The path owns raw-netlink queue 320 and nftables objects inet honk_nfqueue / udp_decision; same-namespace firewall managers must leave them untouched while honk runs. Direct releases the held skb, proxy submits one retained payload to the normal UDP initializer, and block/cancellation drops it. The ingest actor is bounded to 256 packets and 8 MiB of payload, and every packet keeps a three-second absolute deadline from listener receipt. With the Clash API enabled, /stats.udp.nfqueue exposes actor depth/bytes/oldest age plus explicit kernel-stat availability and read failures. See the NFQUEUE design and API reference for invariants and the full metric schema.
VLESS share links select one explicit mode with vless_mode=legacy|uot-v2|h2mux|h2mux-padded|xudp|mux-cool. legacy is the backward-compatible TCP-only default. uot-v2 keeps that TCP path and adds direct UoT v2 for UDP. h2mux carries logical TCP and native connected sing-mux UDP over shared HTTP/2 carriers; h2mux-padded adds sing-mux v1 padding. xudp keeps ordinary VLESS TCP and opens one Single XUDP carrier per UDP transport. mux-cool shares node-owned Xray Mux.Cool carriers across logical TCP and XUDP.
Modes are not negotiated and never fall back or replay a UDP first packet. Non-legacy modes cannot use VLESS Encryption; only xudp may combine with flow=xtls-rprx-vision. The official interop suite covers sing-box and Xray: all six cleartext modes, H2MUX over TLS and REALITY, padding, and XUDP Vision. See the node reference for wire, lifecycle, and import rules.
These checkboxes indicate maintainer review status, not feature availability:
- eBPF routing, maps, and semantics
- Control plane
- AnyTLS / Shadowsocks (including 2022) / SOCKS5
- RPRX (VLESS / XTLS / XHTTP / WSS / REALITY)
- Trojan-GFW (needs UoT implementation)
- DNS logic
- Configuration parser (dae extensions)
- Reload logic
- Tooling
- Evaluate AF_XDP and XDP paths for further performance gains
- Add a honk REST API
- Add a score-based group policy
- Add inbound support
- Track additional work through GitHub Issues and Discussions
No
test.1release tag will be published until all currently unreviewed code has been reviewed and any unverified AI-generated implementation has been addressed.
- dae / daed-rs — eBPF transparent proxy lineage
- sing-box — outbound group and Clash API patterns
- daeuniverse/outbound — protocol reference
- juicity-rs by Markson Pigeonzilla Plus — Juicity protocol implementation reference; the wire-format alignment and live interop testing of honk's Juicity outbound were done against it
- aya-rs — Rust eBPF
SPDX-License-Identifier: GPL-3.0-only
Copyright (c) 2025, glassyiris <honk@catmint.cc> and honk contributors