I believe you can do this by calling syscall.Socket to get a socket, doing whatever you like to the socket, then calling syscall.Connect, then os.NewFile to convert the socket descriptor into an os.File, then net.FileConn to convert the os.File into a net.Conn. Certainly awkward, but it's not clear that we want to complicate the net package by inserting hooks that can run arbitrary code.

@ianlancetaylor I have considered your solution before, but after i read all codes related to connect/listen, i found what you said is quite complicated.
For example, tcp and udp have quite different implementation after fd creation.
I have to copy nearly all net related codes to implement what you said.

Now i create a new file hook_android.go under $GOROOT/src/net with

package net

func SetSocketFunc(f func(int, int, int) (int, error)) {
	socketFunc = f
}

So i can reuse all codes, and inject my function in a init function.

Can you provide similar solution?

I think that solution is more or less a non-starter. It's only going to work where you know that no init code creates a socket and where you know exactly which sockets are created.

More plausible would be code in golang.org/x/net that does what I already suggested. It only has to be written once.

where you know exactly which sockets are created

No, i don't need to distinguish this, all outgoing sockets need this "protect".

And init code creates a socket is rare.

Copy nearly all existing net code to golang.org/x/net with only one hook function different? I think it's more difficult to maintain.

We don't need to copy all existing net code to golang.org/x/net. We only need the code needed to initialize a socket.

I understand that the hook can fix your specific problem. I'm questioning whether it is a general solution. And the API of the net package is already too complex.

It's a Android-specific issue, because in other situation, we can pre-configure iptables rules to apply fwmark for all new connections. Only Android non-root VPNService implementation make things complicated, so i suggest use "_android" suffix to limit this API to android only.

Dup of #9661.