Fix error usages

redirect_nftables_rules.go

@@ -742,9 +742,7 @@ func (r *autoRedirect) nftablesCreateUnreachable(
 				Data:     []byte{uint8(nfProto)},
 			},
 			&expr.Counter{},
-			&expr.Verdict{
-				Kind: expr.VerdictDrop,
-			},
+			&expr.Reject{},
 		},
 	})
 }

stack_gvisor_lazy.go

@@ -4,8 +4,10 @@ package tun
 
 import (
 	"context"
+	"errors"
 	"net"
 	"os"
+	"sync"
 	"time"
 
 	"github.com/sagernet/gvisor/pkg/tcpip"
@@ -17,19 +19,25 @@ import (
 )
 
 type gLazyConn struct {
-	tcpConn       *gonet.TCPConn
-	parentCtx     context.Context
-	stack         *stack.Stack
-	request       *tcp.ForwarderRequest
-	localAddr     net.Addr
-	remoteAddr    net.Addr
-	handshakeDone bool
-	handshakeErr  error
+	tcpConn         *gonet.TCPConn
+	parentCtx       context.Context
+	stack           *stack.Stack
+	request         *tcp.ForwarderRequest
+	localAddr       net.Addr
+	remoteAddr      net.Addr
+	handshakeAccess sync.Mutex
+	handshakeDone   bool
+	handshakeErr    error
 }
 
 func (c *gLazyConn) HandshakeContext(ctx context.Context) error {
 	if c.handshakeDone {
-		return nil
+		return c.handshakeErr
+	}
+	c.handshakeAccess.Lock()
+	defer c.handshakeAccess.Unlock()
+	if c.handshakeDone {
+		return c.handshakeErr
 	}
 	defer func() {
 		c.handshakeDone = true
@@ -67,7 +75,12 @@ func (c *gLazyConn) HandshakeFailure(err error) error {
 	if c.handshakeDone {
 		return os.ErrInvalid
 	}
-	c.request.Complete(err != ErrDrop)
+	c.handshakeAccess.Lock()
+	defer c.handshakeAccess.Unlock()
+	if c.handshakeDone {
+		return os.ErrInvalid
+	}
+	c.request.Complete(!errors.Is(err, ErrDrop))
 	c.handshakeDone = true
 	c.handshakeErr = err
 	return nil
@@ -78,25 +91,17 @@ func (c *gLazyConn) HandshakeSuccess() error {
 }
 
 func (c *gLazyConn) Read(b []byte) (n int, err error) {
-	if !c.handshakeDone {
-		err = c.HandshakeContext(context.Background())
-		if err != nil {
-			return
-		}
-	} else if c.handshakeErr != nil {
-		return 0, c.handshakeErr
+	err = c.HandshakeContext(context.Background())
+	if err != nil {
+		return
 	}
 	return c.tcpConn.Read(b)
 }
 
 func (c *gLazyConn) Write(b []byte) (n int, err error) {
-	if !c.handshakeDone {
-		err = c.HandshakeContext(context.Background())
-		if err != nil {
-			return
-		}
-	} else if c.handshakeErr != nil {
-		return 0, c.handshakeErr
+	err = c.HandshakeContext(context.Background())
+	if err != nil {
+		return
 	}
 	return c.tcpConn.Write(b)
 }
@@ -110,46 +115,41 @@ func (c *gLazyConn) RemoteAddr() net.Addr {
 }
 
 func (c *gLazyConn) SetDeadline(t time.Time) error {
-	if !c.handshakeDone {
-		err := c.HandshakeContext(context.Background())
-		if err != nil {
-			return err
-		}
-	} else if c.handshakeErr != nil {
-		return c.handshakeErr
+	err := c.HandshakeContext(context.Background())
+	if err != nil {
+		return err
 	}
 	return c.tcpConn.SetDeadline(t)
 }
 
 func (c *gLazyConn) SetReadDeadline(t time.Time) error {
-	if !c.handshakeDone {
-		err := c.HandshakeContext(context.Background())
-		if err != nil {
-			return err
-		}
-	} else if c.handshakeErr != nil {
-		return c.handshakeErr
+	err := c.HandshakeContext(context.Background())
+	if err != nil {
+		return err
 	}
 	return c.tcpConn.SetReadDeadline(t)
 }
 
 func (c *gLazyConn) SetWriteDeadline(t time.Time) error {
-	if !c.handshakeDone {
-		err := c.HandshakeContext(context.Background())
-		if err != nil {
-			return err
-		}
-	} else if c.handshakeErr != nil {
-		return c.handshakeErr
+	err := c.HandshakeContext(context.Background())
+	if err != nil {
+		return err
 	}
 	return c.tcpConn.SetWriteDeadline(t)
 }
 
 func (c *gLazyConn) Close() error {
 	if !c.handshakeDone {
-		c.request.Complete(true)
-		c.handshakeErr = net.ErrClosed
-		return nil
+		c.handshakeAccess.Lock()
+		if !c.handshakeDone {
+			c.request.Complete(true)
+			c.handshakeErr = net.ErrClosed
+			c.handshakeDone = true
+			return nil
+		} else if c.handshakeErr != nil {
+			return nil
+		}
+		c.handshakeAccess.Unlock()
 	} else if c.handshakeErr != nil {
 		return nil
 	}
@@ -158,9 +158,16 @@ func (c *gLazyConn) Close() error {
 
 func (c *gLazyConn) CloseRead() error {
 	if !c.handshakeDone {
-		c.request.Complete(true)
-		c.handshakeErr = net.ErrClosed
-		return nil
+		c.handshakeAccess.Lock()
+		if !c.handshakeDone {
+			c.request.Complete(true)
+			c.handshakeErr = net.ErrClosed
+			c.handshakeDone = true
+			return nil
+		} else if c.handshakeErr != nil {
+			return nil
+		}
+		c.handshakeAccess.Unlock()
 	} else if c.handshakeErr != nil {
 		return nil
 	}
@@ -169,9 +176,16 @@ func (c *gLazyConn) CloseRead() error {
 
 func (c *gLazyConn) CloseWrite() error {
 	if !c.handshakeDone {
-		c.request.Complete(true)
-		c.handshakeErr = net.ErrClosed
-		return nil
+		c.handshakeAccess.Lock()
+		if !c.handshakeDone {
+			c.request.Complete(true)
+			c.handshakeErr = net.ErrClosed
+			c.handshakeDone = true
+			return nil
+		} else if c.handshakeErr != nil {
+			return nil
+		}
+		c.handshakeAccess.Unlock()
 	} else if c.handshakeErr != nil {
 		return nil
 	}
@@ -179,10 +193,14 @@ func (c *gLazyConn) CloseWrite() error {
 }
 
 func (c *gLazyConn) ReaderReplaceable() bool {
+	c.handshakeAccess.Lock()
+	defer c.handshakeAccess.Unlock()
 	return c.handshakeDone && c.handshakeErr == nil
 }
 
 func (c *gLazyConn) WriterReplaceable() bool {
+	c.handshakeAccess.Lock()
+	defer c.handshakeAccess.Unlock()
 	return c.handshakeDone && c.handshakeErr == nil
 }
 

stack_gvisor_tcp.go

@@ -4,6 +4,7 @@ package tun
 
 import (
 	"context"
+	"errors"
 
 	"github.com/sagernet/gvisor/pkg/tcpip/stack"
 	"github.com/sagernet/gvisor/pkg/tcpip/transport/tcp"
@@ -37,7 +38,7 @@ func (f *TCPForwarder) Forward(r *tcp.ForwarderRequest) {
 	destination := M.SocksaddrFrom(AddrFromAddress(r.ID().LocalAddress), r.ID().LocalPort)
 	pErr := f.handler.PrepareConnection(N.NetworkTCP, source, destination)
 	if pErr != nil {
-		r.Complete(pErr != ErrDrop)
+		r.Complete(!errors.Is(pErr, ErrDrop))
 		return
 	}
 	conn := &gLazyConn{

stack_gvisor_udp.go

@@ -4,6 +4,7 @@ package tun
 
 import (
 	"context"
+	"errors"
 	"math"
 	"net/netip"
 	"os"
@@ -59,7 +60,7 @@ func rangeIterate(r stack.Range, fn func(*buffer.View))
 func (f *UDPForwarder) PreparePacketConnection(source M.Socksaddr, destination M.Socksaddr, userData any) (bool, context.Context, N.PacketWriter, N.CloseHandlerFunc) {
 	pErr := f.handler.PrepareConnection(N.NetworkUDP, source, destination)
 	if pErr != nil {
-		if pErr != ErrDrop {
+		if !errors.Is(pErr, ErrDrop) {
 			gWriteUnreachable(f.stack, userData.(*stack.PacketBuffer))
 		}
 		return false, nil, nil, nil

stack_system.go

@@ -2,6 +2,7 @@ package tun
 
 import (
 	"context"
+	"errors"
 	"net"
 	"net/netip"
 	"syscall"
@@ -354,7 +355,7 @@ func (s *System) processIPv4TCP(ipHdr header.IPv4, tcpHdr header.TCP) (bool, err
 	} else {
 		natPort, err := s.tcpNat.Lookup(source, destination, s.handler)
 		if err != nil {
-			if err == ErrDrop {
+			if errors.Is(err, ErrDrop) {
 				return false, nil
 			} else {
 				return false, s.resetIPv4TCP(ipHdr, tcpHdr)
@@ -441,7 +442,7 @@ func (s *System) processIPv6TCP(ipHdr header.IPv6, tcpHdr header.TCP) (bool, err
 	} else {
 		natPort, err := s.tcpNat.Lookup(source, destination, s.handler)
 		if err != nil {
-			if err == ErrDrop {
+			if errors.Is(err, ErrDrop) {
 				return false, nil
 			} else {
 				return false, s.resetIPv6TCP(ipHdr, tcpHdr)
@@ -536,7 +537,7 @@ func (s *System) processIPv6UDP(ipHdr header.IPv6, udpHdr header.UDP) error {
 func (s *System) preparePacketConnection(source M.Socksaddr, destination M.Socksaddr, userData any) (bool, context.Context, N.PacketWriter, N.CloseHandlerFunc) {
 	pErr := s.handler.PrepareConnection(N.NetworkUDP, source, destination)
 	if pErr != nil {
-		if pErr != ErrDrop {
+		if !errors.Is(pErr, ErrDrop) {
 			if source.IsIPv4() {
 				ipHdr := userData.(header.IPv4)
 				s.rejectIPv4WithICMP(ipHdr, header.ICMPv4PortUnreachable)