fix: conn maybe not closed in error handling

adapter/outbound/masque.go

@@ -175,6 +175,7 @@ func NewMasque(option MasqueOption) (*Masque, error) {
 				tlsConn := tls.Client(c, tlsConfig)
 				err = tlsConn.HandshakeContext(ctx)
 				if err != nil {
+					_ = c.Close()
 					return nil, err
 				}
 				type netConn struct{ net.Conn } // hide tls-type to skip ALPN check and force enter h2 mode

adapter/outbound/shadowsocks.go

@@ -225,12 +225,16 @@ func (ss *ShadowSocks) listenPacketContext(ctx context.Context) (net.PacketConn,
 }
 
 // ListenPacketContext implements C.ProxyAdapter
-func (ss *ShadowSocks) ListenPacketContext(ctx context.Context, metadata *C.Metadata) (C.PacketConn, error) {
+func (ss *ShadowSocks) ListenPacketContext(ctx context.Context, metadata *C.Metadata) (_ C.PacketConn, err error) {
 	if ss.option.UDPOverTCP {
-		c, err := ss.DialContext(ctx, metadata)
+		var c net.Conn
+		c, err = ss.DialContext(ctx, metadata)
 		if err != nil {
 			return nil, err
 		}
+		defer func(c net.Conn) {
+			safeConnClose(c, err)
+		}(c)
 		if err = ss.ResolveUDP(ctx, metadata); err != nil {
 			return nil, err
 		}

adapter/outbound/snell.go

@@ -101,8 +101,7 @@ func (s *Snell) DialContext(ctx context.Context, metadata *C.Metadata) (_ C.Conn
 }
 
 // ListenPacketContext implements C.ProxyAdapter
-func (s *Snell) ListenPacketContext(ctx context.Context, metadata *C.Metadata) (C.PacketConn, error) {
-	var err error
+func (s *Snell) ListenPacketContext(ctx context.Context, metadata *C.Metadata) (_ C.PacketConn, err error) {
 	if err = s.ResolveUDP(ctx, metadata); err != nil {
 		return nil, err
 	}
@@ -111,6 +110,10 @@ func (s *Snell) ListenPacketContext(ctx context.Context, metadata *C.Metadata) (
 		return nil, err
 	}
 
+	defer func(c net.Conn) {
+		safeConnClose(c, err)
+	}(c)
+
 	c, err = s.StreamConnContext(ctx, c, metadata)
 
 	pc := snell.PacketConn(c)

adapter/outbound/socks5.go

@@ -96,16 +96,19 @@ func (ss *Socks5) ListenPacketContext(ctx context.Context, metadata *C.Metadata)
 		return
 	}
 
-	if ss.tls {
-		cc := tls.Client(c, ss.tlsConfig)
-		err = cc.HandshakeContext(ctx)
-		c = cc
-	}
-
 	defer func(c net.Conn) {
 		safeConnClose(c, err)
 	}(c)
 
+	if ss.tls {
+		cc := tls.Client(c, ss.tlsConfig)
+		err = cc.HandshakeContext(ctx)
+		if err != nil {
+			return nil, fmt.Errorf("%s connect error: %w", ss.addr, err)
+		}
+		c = cc
+	}
+
 	var user *socks5.User
 	if ss.user != "" {
 		user = &socks5.User{

dns/doh.go

@@ -728,7 +728,7 @@ func (doh *dnsOverHTTPS) tlsDial(ctx context.Context, network string, config *tl
 
 	err = conn.HandshakeContext(ctx)
 	if err != nil {
-		defer conn.Close()
+		_ = rawConn.Close()
 		return nil, err
 	}
 

dns/dot.go

@@ -129,10 +129,12 @@ func (t *dnsOverTLS) dialContext(ctx context.Context) (net.Conn, error) {
 		},
 	})
 	if err != nil {
+		_ = conn.Close()
 		return nil, err
 	}
 	tlsConn := tls.Client(conn, tlsConfig)
 	if err = tlsConn.HandshakeContext(ctx); err != nil {
+		_ = conn.Close()
 		return nil, err
 	}
 	conn = tlsConn

tunnel/tunnel.go

@@ -561,13 +561,14 @@ func handleTCPConn(connCtx C.ConnContext) {
 
 		if N.NeedHandshake(remoteConn) {
 			defer func() {
-				for _, chain := range remoteConn.Chains() {
-					if chain == "REJECT" {
-						err = nil
-						return
-					}
-				}
 				if err != nil {
+					_ = remoteConn.Close()
+					for _, chain := range remoteConn.Chains() {
+						if chain == "REJECT" {
+							err = nil
+							return
+						}
+					}
 					remoteConn = nil
 				}
 			}()