all: return ptr instead of interface

intra/core/p2est.go

@@ -35,16 +35,18 @@ type P2QuantileEstimator interface {
 	P() float64
 }
 
+var _ P2QuantileEstimator = (*p2)(nil)
+
 // NewP50Estimator returns a new P50 (median) estimator.
-func NewP50Estimator() P2QuantileEstimator {
+func NewP50Estimator() *p2 {
 	// calibrate: go.dev/play/p/Ry1i61XqzgB
 	// 31 worked best amid wild latency fluctuations
 	// using 11 for lower overhead; 5 is the default
 	return NewP2QuantileEstimator(11, 0.5)
 }
 
 // NewP90Estimator returns a new estimator with percentile p.
-func NewP2QuantileEstimator(samples int, probability float64) P2QuantileEstimator {
+func NewP2QuantileEstimator(samples int, probability float64) *p2 {
 	// total samples, typically 5; higher sample size improves accuracy for
 	// lower percentiles (p50) at the expense of computational cost;
 	// for higher percentiles (p90+), even sample size as low as 5 works fine.

intra/dialers/direct_split.go

@@ -34,16 +34,18 @@ type splitter struct {
 	used bool // Initially false.  Becomes true after the first write.
 }
 
+var _ DuplexConn = (*splitter)(nil)
+
 // DialWithSplit returns a TCP connection that always splits the initial upstream segment.
 // Like net.Conn, it is intended for two-threaded use, with one thread calling
 // Read and CloseRead, and another calling Write, ReadFrom, and CloseWrite.
-func DialWithSplit(d *protect.RDial, addr *net.TCPAddr) (DuplexConn, error) {
+func DialWithSplit(d *protect.RDial, addr *net.TCPAddr) (*splitter, error) {
 	conn, err := d.DialTCP(addr.Network(), nil, addr)
 	if err != nil {
 		return nil, err
 	}
 	if conn == nil {
-		return nil, errNoConn
+		return nil, net.UnknownNetworkError("no conn")
 	}
 	return &splitter{TCPConn: conn}, nil
 }

intra/dialers/retrier.go

@@ -122,7 +122,7 @@ func calcTimeout(before, after time.Time) time.Duration {
 // Read and CloseRead, and another calling Write, ReadFrom, and CloseWrite.
 // `dialer` will be used to establish the connection.
 // `addr` is the destination.
-func DialWithSplitRetry(dial *protect.RDial, addr *net.TCPAddr) (DuplexConn, error) {
+func DialWithSplitRetry(dial *protect.RDial, addr *net.TCPAddr) (*retrier, error) {
 	before := time.Now()
 	conn, err := dial.DialTCP(addr.Network(), nil, addr)
 	if err != nil {
@@ -402,9 +402,14 @@ func laddr(c net.Conn) net.Addr {
 	if c != nil && core.IsNotNil(c) {
 		return c.LocalAddr()
 	}
-	return nil
+	return NoNetAddr{}
 }
 
+type NoNetAddr struct{}
+
+func (NoNetAddr) Network() string { return "no" }
+func (NoNetAddr) String() string  { return "none" }
+
 func barrier(m *sync.Mutex) {
 	if m != nil {
 		m.Lock()

intra/dns53/dot.go

@@ -40,7 +40,7 @@ type dot struct {
 var _ dnsx.Transport = (*dot)(nil)
 
 // NewTLSTransport returns a DNS over TLS transport, ready for use.
-func NewTLSTransport(id, rawurl string, addrs []string, px ipn.Proxies, ctl protect.Controller) (t dnsx.Transport, err error) {
+func NewTLSTransport(id, rawurl string, addrs []string, px ipn.Proxies, ctl protect.Controller) (t *dot, err error) {
 	tlscfg := &tls.Config{MinVersion: tls.VersionTLS12}
 	// rawurl is either tls:host[:port] or tls://host[:port] or host[:port]
 	parsedurl, err := url.Parse(rawurl)

intra/dns53/goos.go

@@ -34,7 +34,7 @@ type goosr struct {
 var _ dnsx.Transport = (*transport)(nil)
 
 // NewGoosTransport returns the default Go DNS resolver
-func NewGoosTransport(pxs ipn.Proxies, ctl protect.Controller) (t dnsx.Transport, err error) {
+func NewGoosTransport(pxs ipn.Proxies, ctl protect.Controller) (t *goosr, err error) {
 	// cannot be nil, see: ipn.Exit which the only proxy guaranteed to be connected to the internet;
 	// ex: ipn.Base routed back within the tunnel (rethink's traffic routed back into rethink)
 	// but it doesn't work for goos because the traffic to localhost:53 is routed back in as if

intra/dns53/mdns.go

@@ -48,8 +48,8 @@ type dnssd struct {
 var _ dnsx.Transport = (*dnssd)(nil)
 
 // NewMDNSTransport returns a DNS transport that sends all DNS queries to mDNS endpoint.
-func NewMDNSTransport(protos string) (t dnsx.Transport) {
-	t = &dnssd{
+func NewMDNSTransport(protos string) *dnssd {
+	t := &dnssd{
 		id:     dnsx.Local,
 		use4:   use4(protos),
 		use6:   use6(protos),
@@ -58,7 +58,7 @@ func NewMDNSTransport(protos string) (t dnsx.Transport) {
 		est:    core.NewP50Estimator(),
 	}
 	log.I("mdns: setup: %s", protos)
-	return
+	return t
 }
 
 func use4(l3 string) bool {

intra/dns53/upstream.go

@@ -51,7 +51,7 @@ type transport struct {
 var _ dnsx.Transport = (*transport)(nil)
 
 // NewTransportFromHostname returns a DNS53 transport serving from hostname, ready for use.
-func NewTransportFromHostname(id, hostname string, ipcsv string, px ipn.Proxies, ctl protect.Controller) (t dnsx.Transport, err error) {
+func NewTransportFromHostname(id, hostname string, ipcsv string, px ipn.Proxies, ctl protect.Controller) (t *transport, err error) {
 	// ipcsv may contain port, eg: 10.1.1.3:53
 	do, err := settings.NewDNSOptionsFromHostname(hostname, ipcsv)
 	if err != nil {
@@ -61,7 +61,7 @@ func NewTransportFromHostname(id, hostname string, ipcsv string, px ipn.Proxies,
 }
 
 // NewTransport returns a DNS53 transport serving from ip & port, ready for use.
-func NewTransport(id, ip, port string, px ipn.Proxies, ctl protect.Controller) (t dnsx.Transport, err error) {
+func NewTransport(id, ip, port string, px ipn.Proxies, ctl protect.Controller) (t *transport, err error) {
 	ipport := net.JoinHostPort(ip, port)
 	do, err := settings.NewDNSOptions(ipport)
 	if err != nil {
@@ -71,7 +71,7 @@ func NewTransport(id, ip, port string, px ipn.Proxies, ctl protect.Controller) (
 	return newTransport(id, do, px, ctl)
 }
 
-func newTransport(id string, do *settings.DNSOptions, px ipn.Proxies, ctl protect.Controller) (dnsx.Transport, error) {
+func newTransport(id string, do *settings.DNSOptions, px ipn.Proxies, ctl protect.Controller) (*transport, error) {
 	var relay ipn.Proxy
 	// cannot be nil, see: ipn.Exit which the only proxy guaranteed to be connected to the internet;
 	// ex: ipn.Base routed back within the tunnel (rethink's traffic routed back into rethink).

intra/dnscrypt/multiserver.go

@@ -659,7 +659,7 @@ func NewDcMult(px ipn.Proxies, ctl protect.Controller) *DcMulti {
 }
 
 // AddTransport creates and adds a dnscrypt transport to p
-func AddTransport(p *DcMulti, id, serverstamp string) (dnsx.Transport, error) {
+func AddTransport(p *DcMulti, id, serverstamp string) (*serverinfo, error) {
 	if p == nil {
 		return nil, dnsx.ErrNoDcProxy
 	}

intra/dnsx/cacher.go

@@ -85,7 +85,7 @@ type ctransport struct {
 	est          core.P2QuantileEstimator
 }
 
-func NewDefaultCachingTransport(t Transport) (ct Transport) {
+func NewDefaultCachingTransport(t Transport) Transport {
 	return NewCachingTransport(t, defttl)
 }
 

intra/dnsx/transport.go

@@ -139,7 +139,7 @@ type resolver struct {
 
 var _ Resolver = (*resolver)(nil)
 
-func NewResolver(fakeaddrs string, tunmode *settings.TunMode, dtr x.DNSTransport, l x.DNSListener, pt NatPt) Resolver {
+func NewResolver(fakeaddrs string, tunmode *settings.TunMode, dtr x.DNSTransport, l x.DNSListener, pt NatPt) *resolver {
 	r := &resolver{
 		NatPt:        pt,
 		listener:     l,

intra/doh/doh.go

@@ -90,7 +90,7 @@ func (t *transport) dial(network, addr string) (net.Conn, error) {
 // `rawurl` is the DoH template in string form.
 // `addrs` is a list of IP addresses to bootstrap dialers.
 // `px` is the proxy provider, may be nil (eg for id == dnsx.Default)
-func NewTransport(id, rawurl string, addrs []string, px ipn.Proxies, ctl protect.Controller) (dnsx.Transport, error) {
+func NewTransport(id, rawurl string, addrs []string, px ipn.Proxies, ctl protect.Controller) (*transport, error) {
 	return newTransport(dnsx.DOH, id, rawurl, "", addrs, px, ctl)
 }
 
@@ -100,7 +100,7 @@ func NewTransport(id, rawurl string, addrs []string, px ipn.Proxies, ctl protect
 // `target` is the ODoH resolver.
 // `addrs` is a list of IP addresses to bootstrap endpoint dialers.
 // `px` is the proxy provider, never nil.
-func NewOdohTransport(id, endpoint, target string, addrs []string, px ipn.Proxies, ctl protect.Controller) (dnsx.Transport, error) {
+func NewOdohTransport(id, endpoint, target string, addrs []string, px ipn.Proxies, ctl protect.Controller) (*transport, error) {
 	return newTransport(dnsx.ODOH, id, endpoint, target, addrs, px, ctl)
 }
 

intra/ipn/base.go

@@ -23,7 +23,7 @@ type base struct {
 	status   int
 }
 
-func NewBaseProxy(c protect.Controller) Proxy {
+func NewBaseProxy(c protect.Controller) *base {
 	d := protect.MakeNsRDial(Base, c)
 	h := &base{
 		addr:     "127.3.4.5:6890",

intra/ipn/exit.go

@@ -25,7 +25,7 @@ type exit struct {
 	status    int
 }
 
-func NewExitProxy(c protect.Controller) Proxy {
+func NewExitProxy(c protect.Controller) *exit {
 	if c == nil {
 		log.W("proxy: exit: missing ctl; probably not what you want")
 	}

intra/ipn/ground.go

@@ -17,7 +17,9 @@ type ground struct {
 	addr string
 }
 
-func NewGroundProxy() Proxy {
+var _ Proxy = (*ground)(nil)
+
+func NewGroundProxy() *ground {
 	h := &ground{
 		addr: "[::]:0",
 	}

intra/ipn/h1/auth.go

@@ -41,7 +41,7 @@ type basicAuth struct {
 }
 
 // AuthBasic returns a ProxyAuthorization that implements "Basic" protocol while ignoring realm challanges.
-func AuthBasic(username string, password string) ProxyAuthorization {
+func AuthBasic(username string, password string) *basicAuth {
 	return &basicAuth{username: username, password: password}
 }
 

intra/ipn/http1.go

@@ -32,7 +32,7 @@ type http1 struct {
 	status   int
 }
 
-func NewHTTPProxy(id string, c protect.Controller, po *settings.ProxyOptions) (Proxy, error) {
+func NewHTTPProxy(id string, c protect.Controller, po *settings.ProxyOptions) (*http1, error) {
 	var err error
 	if po == nil {
 		log.W("proxy: err setting up http1 w(%v): %v", po, err)

intra/ipn/piph2.go

@@ -139,7 +139,7 @@ func (t *piph2) dial(network, addr string) (net.Conn, error) {
 	return dialers.SplitDial(t.proxydialer, network, addr)
 }
 
-func NewPipProxy(id string, ctl protect.Controller, po *settings.ProxyOptions) (Proxy, error) {
+func NewPipProxy(id string, ctl protect.Controller, po *settings.ProxyOptions) (*piph2, error) {
 	if po == nil {
 		return nil, errMissingProxyOpt
 	}

intra/ipn/pipws.go

@@ -98,7 +98,7 @@ func (t *pipws) wsconn(rurl, msg string) (c net.Conn, res *http.Response, err er
 // The proxy options must contain a valid URL, and the URL must have a path with the format "/ws/<sha256(rsasig)>".
 // The proxy options must also contain a valid auth user (raw client token) and
 // password (expiry + signed raw client token).
-func NewPipWsProxy(id string, ctl protect.Controller, po *settings.ProxyOptions) (Proxy, error) {
+func NewPipWsProxy(id string, ctl protect.Controller, po *settings.ProxyOptions) (*pipws, error) {
 	if po == nil {
 		return nil, errMissingProxyOpt
 	}

intra/ipn/proxies.go

@@ -149,7 +149,7 @@ func (w *gw) MTU() (int, error)    { return NOMTU, errNoMtu }
 func (w *gw) Stat() *x.Stats       { return &w.stats }
 func (w *gw) Contains(string) bool { return w.ok }
 
-func NewProxifier(c protect.Controller, o x.ProxyListener) Proxies {
+func NewProxifier(c protect.Controller, o x.ProxyListener) *proxifier {
 	if c == nil || o == nil {
 		return nil
 	}

intra/ipn/proxy.go

@@ -18,7 +18,7 @@ import (
 	"github.com/celzero/firestack/intra/settings"
 )
 
-func (pxr *proxifier) NewSocks5Proxy(id, user, pwd, ip, port string) (p Proxy, err error) {
+func (pxr *proxifier) NewSocks5Proxy(id, user, pwd, ip, port string) (p *socks5, err error) {
 	opts := settings.NewAuthProxyOptions("socks5", user, pwd, ip, port, nil)
 	return NewSocks5Proxy(id, pxr.ctl, opts)
 }

intra/ipn/socks5.go

@@ -79,7 +79,7 @@ func (c *socks5udpconn) ReadFrom(b []byte) (n int, addr net.Addr, err error) {
 	return 0, nil, errNoProxyConn
 }
 
-func NewSocks5Proxy(id string, ctl protect.Controller, po *settings.ProxyOptions) (Proxy, error) {
+func NewSocks5Proxy(id string, ctl protect.Controller, po *settings.ProxyOptions) (*socks5, error) {
 	var err error
 	if po == nil {
 		log.W("proxy: err setting up socks5(%v): %v", po, err)

intra/ipn/wgproxy.go

@@ -371,7 +371,7 @@ func loadIPNets(out *[]netip.Prefix, v string) (err error) {
 }
 
 // ref: github.com/WireGuard/wireguard-android/blob/713947e432/tunnel/tools/libwg-go/api-android.go#L76
-func NewWgProxy(id string, ctl protect.Controller, cfg string) (WgProxy, error) {
+func NewWgProxy(id string, ctl protect.Controller, cfg string) (*wgproxy, error) {
 	ifaddrs, allowedaddrs, peers, dnsh, endpointh, mtu, err := wgIfConfigOf(id, &cfg)
 	uapicfg := cfg
 	if err != nil {

intra/log/logger.go

@@ -74,6 +74,8 @@ const (
 
 const defaultLevel = INFO
 
+var _ Logger = (*simpleLogger)(nil)
+
 var defaultFlags = golog.Lshortfile
 var defaultCallerDepth = 2
 var _ = RegisterLogger(defaultLogger())
@@ -86,7 +88,7 @@ func defaultLogger() *simpleLogger {
 	}
 }
 
-func NewLogger(tag string) Logger {
+func NewLogger(tag string) *simpleLogger {
 	l := defaultLogger()
 	if len(tag) <= 0 { // if tag is empty, leave it as is
 		return l

intra/protect/ipmap/ipmap.go

@@ -110,12 +110,12 @@ type IPSet struct {
 	fails        int          // Number of times the confirmed IP has failed.
 }
 
-func NewIPMap() IPMap {
+func NewIPMap() *ipmap {
 	return NewIPMapFor(nil)
 }
 
 // NewIPMapFor returns a fresh IPMap with r as its nameserver.
-func NewIPMapFor(r IPMapper) IPMap {
+func NewIPMapFor(r IPMapper) *ipmap {
 	return &ipmap{
 		m: make(map[string]*IPSet),
 		p: make(map[string]*IPSet),

intra/protect/xdial.go

@@ -58,7 +58,7 @@ var (
 	errAccept      = errors.New("cannot accept network")
 )
 
-func (d *RDial) dial(network, addr string) (Conn, error) {
+func (d *RDial) dial(network, addr string) (net.Conn, error) {
 	usedialer := d.Dialer != nil
 	userdialer := d.RDialer != nil
 	if usedialer {
@@ -88,7 +88,7 @@ func (d *RDial) DialContext(_ context.Context, network, addr string) (net.Conn,
 	}
 }
 
-func (d *RDial) Accept(network, local string) (Listener, error) {
+func (d *RDial) Accept(network, local string) (net.Listener, error) {
 	if network != "tcp" && network != "tcp4" && network != "tcp6" {
 		return nil, errAccept
 	}
@@ -108,7 +108,7 @@ func (d *RDial) Accept(network, local string) (Listener, error) {
 	return d.RDialer.Accept(network, local)
 }
 
-func (d *RDial) Announce(network, local string) (PacketConn, error) {
+func (d *RDial) Announce(network, local string) (net.PacketConn, error) {
 	if network != "udp" && network != "udp4" && network != "udp6" {
 		return nil, errAnnounce
 	}

intra/rnet/http.go

@@ -41,7 +41,7 @@ type httpxhandle struct {
 	px ipn.Proxy
 }
 
-func newHttpServer(id, x string, ctl protect.Controller, listener ServerListener) (Server, error) {
+func newHttpServer(id, x string, ctl protect.Controller, listener ServerListener) (*httpx, error) {
 	var host string
 	var usr string
 	var pwd string

intra/rnet/servers.go

@@ -84,6 +84,8 @@ type Services interface {
 	RefreshServers() (active string)
 }
 
+var _ Services = (*services)(nil)
+var _ Server = (*httpx)(nil)
 var _ Server = (*socks5)(nil)
 
 type services struct {
@@ -94,7 +96,7 @@ type services struct {
 	ctl      protect.Controller
 }
 
-func NewServices(proxies ipn.Proxies, ctl protect.Controller, listener ServerListener) Services {
+func NewServices(proxies ipn.Proxies, ctl protect.Controller, listener ServerListener) *services {
 	if listener == nil || ctl == nil {
 		return nil
 	}

intra/rnet/socks5.go

@@ -40,7 +40,7 @@ type socks5handler struct {
 	px ipn.Proxy
 }
 
-func newSocks5Server(id, x string, ctl protect.Controller, listener ServerListener) (Server, error) {
+func newSocks5Server(id, x string, ctl protect.Controller, listener ServerListener) (*socks5, error) {
 	var host string
 	var usr string
 	var pwd string

intra/x64/natpt.go

@@ -47,7 +47,7 @@ var (
 )
 
 // NewNatPt returns a new NatPt.
-func NewNatPt(tunmode *settings.TunMode) dnsx.NatPt {
+func NewNatPt(tunmode *settings.TunMode) *natPt {
 	log.I("natpt: new; mode(%v)", tunmode)
 	return &natPt{
 		nat64:   newNat64(),