From ffe6e42cfa104300390a1388b0491b2bdad92be2 Mon Sep 17 00:00:00 2001
From: wwqgtxx <wwqgtxx@gmail.com>
Date: Sat, 9 May 2026 08:49:32 +0800
Subject: [PATCH] fix: conn maybe not closed in error handling

---
 adapter/outbound/masque.go      |  1 +
 adapter/outbound/shadowsocks.go |  8 ++++++--
 adapter/outbound/snell.go       |  7 +++++--
 adapter/outbound/socks5.go      | 15 +++++++++------
 dns/doh.go                      |  2 +-
 dns/dot.go                      |  2 ++
 tunnel/tunnel.go                | 13 +++++++------
 7 files changed, 31 insertions(+), 17 deletions(-)

diff --git a/adapter/outbound/masque.go b/adapter/outbound/masque.go
index 4e748583..efe69ceb 100644
--- a/adapter/outbound/masque.go
+++ b/adapter/outbound/masque.go
@@ -175,6 +175,7 @@ func NewMasque(option MasqueOption) (*Masque, error) {
 				tlsConn := tls.Client(c, tlsConfig)
 				err = tlsConn.HandshakeContext(ctx)
 				if err != nil {
+					_ = c.Close()
 					return nil, err
 				}
 				type netConn struct{ net.Conn } // hide tls-type to skip ALPN check and force enter h2 mode
diff --git a/adapter/outbound/shadowsocks.go b/adapter/outbound/shadowsocks.go
index 333d288f..a1771a74 100644
--- a/adapter/outbound/shadowsocks.go
+++ b/adapter/outbound/shadowsocks.go
@@ -225,12 +225,16 @@ func (ss *ShadowSocks) listenPacketContext(ctx context.Context) (net.PacketConn,
 }
 
 // ListenPacketContext implements C.ProxyAdapter
-func (ss *ShadowSocks) ListenPacketContext(ctx context.Context, metadata *C.Metadata) (C.PacketConn, error) {
+func (ss *ShadowSocks) ListenPacketContext(ctx context.Context, metadata *C.Metadata) (_ C.PacketConn, err error) {
 	if ss.option.UDPOverTCP {
-		c, err := ss.DialContext(ctx, metadata)
+		var c net.Conn
+		c, err = ss.DialContext(ctx, metadata)
 		if err != nil {
 			return nil, err
 		}
+		defer func(c net.Conn) {
+			safeConnClose(c, err)
+		}(c)
 		if err = ss.ResolveUDP(ctx, metadata); err != nil {
 			return nil, err
 		}
diff --git a/adapter/outbound/snell.go b/adapter/outbound/snell.go
index f14bd503..9edeb53b 100644
--- a/adapter/outbound/snell.go
+++ b/adapter/outbound/snell.go
@@ -101,8 +101,7 @@ func (s *Snell) DialContext(ctx context.Context, metadata *C.Metadata) (_ C.Conn
 }
 
 // ListenPacketContext implements C.ProxyAdapter
-func (s *Snell) ListenPacketContext(ctx context.Context, metadata *C.Metadata) (C.PacketConn, error) {
-	var err error
+func (s *Snell) ListenPacketContext(ctx context.Context, metadata *C.Metadata) (_ C.PacketConn, err error) {
 	if err = s.ResolveUDP(ctx, metadata); err != nil {
 		return nil, err
 	}
@@ -111,6 +110,10 @@ func (s *Snell) ListenPacketContext(ctx context.Context, metadata *C.Metadata) (
 		return nil, err
 	}
 
+	defer func(c net.Conn) {
+		safeConnClose(c, err)
+	}(c)
+
 	c, err = s.StreamConnContext(ctx, c, metadata)
 
 	pc := snell.PacketConn(c)
diff --git a/adapter/outbound/socks5.go b/adapter/outbound/socks5.go
index 912856fd..d4fa7b31 100644
--- a/adapter/outbound/socks5.go
+++ b/adapter/outbound/socks5.go
@@ -96,16 +96,19 @@ func (ss *Socks5) ListenPacketContext(ctx context.Context, metadata *C.Metadata)
 		return
 	}
 
-	if ss.tls {
-		cc := tls.Client(c, ss.tlsConfig)
-		err = cc.HandshakeContext(ctx)
-		c = cc
-	}
-
 	defer func(c net.Conn) {
 		safeConnClose(c, err)
 	}(c)
 
+	if ss.tls {
+		cc := tls.Client(c, ss.tlsConfig)
+		err = cc.HandshakeContext(ctx)
+		if err != nil {
+			return nil, fmt.Errorf("%s connect error: %w", ss.addr, err)
+		}
+		c = cc
+	}
+
 	var user *socks5.User
 	if ss.user != "" {
 		user = &socks5.User{
diff --git a/dns/doh.go b/dns/doh.go
index cbc65069..5a5d32d7 100644
--- a/dns/doh.go
+++ b/dns/doh.go
@@ -728,7 +728,7 @@ func (doh *dnsOverHTTPS) tlsDial(ctx context.Context, network string, config *tl
 
 	err = conn.HandshakeContext(ctx)
 	if err != nil {
-		defer conn.Close()
+		_ = rawConn.Close()
 		return nil, err
 	}
 
diff --git a/dns/dot.go b/dns/dot.go
index fa37d86a..57731822 100644
--- a/dns/dot.go
+++ b/dns/dot.go
@@ -129,10 +129,12 @@ func (t *dnsOverTLS) dialContext(ctx context.Context) (net.Conn, error) {
 		},
 	})
 	if err != nil {
+		_ = conn.Close()
 		return nil, err
 	}
 	tlsConn := tls.Client(conn, tlsConfig)
 	if err = tlsConn.HandshakeContext(ctx); err != nil {
+		_ = conn.Close()
 		return nil, err
 	}
 	conn = tlsConn
diff --git a/tunnel/tunnel.go b/tunnel/tunnel.go
index fb2cc75b..d5418c54 100644
--- a/tunnel/tunnel.go
+++ b/tunnel/tunnel.go
@@ -561,13 +561,14 @@ func handleTCPConn(connCtx C.ConnContext) {
 
 		if N.NeedHandshake(remoteConn) {
 			defer func() {
-				for _, chain := range remoteConn.Chains() {
-					if chain == "REJECT" {
-						err = nil
-						return
-					}
-				}
 				if err != nil {
+					_ = remoteConn.Close()
+					for _, chain := range remoteConn.Chains() {
+						if chain == "REJECT" {
+							err = nil
+							return
+						}
+					}
 					remoteConn = nil
 				}
 			}()