From aa570b78251a9d0b38767a5def04dca2a063e51a Mon Sep 17 00:00:00 2001 From: patterniha <71074308+patterniha@users.noreply.github.com> Date: Fri, 13 Nov 2026 20:17:40 +0330 Subject: [PATCH] HTTPUpgrade client: Close the connection when the upgrade fails When the upgrade request could not be sent, or the server did not answer with a valid "101 Switching Protocols", the dial returned the error and left the TCP connection open until the garbage collector closed it. With "fingerprint": "unsafe", a failed TLS handshake is one of these cases. Go's TLS does the handshake at the first write, and here the first write is the upgrade request. Co-Authored-By: Claude Fable 5.2 --- transport/internet/httpupgrade/dialer.go | 2 ++ 1 file changed, 2 insertions(+) diff --git a/transport/internet/httpupgrade/dialer.go b/transport/internet/httpupgrade/dialer.go index cf244b38d..74463e672 100644 --- a/transport/internet/httpupgrade/dialer.go +++ b/transport/internet/httpupgrade/dialer.go @@ -111,6 +111,7 @@ func dialhttpUpgrade(ctx context.Context, dest net.Destination, streamSettings * err = req.Write(conn) if err != nil { + conn.Close() return nil, err } @@ -123,6 +124,7 @@ func dialhttpUpgrade(ctx context.Context, dest net.Destination, streamSettings * if transportConfiguration.Ed == 0 { _, err = connRF.Read([]byte{}) if err != nil { + conn.Close() return nil, err } }