From bcb83578d9fd2c0bd96b1e8622130c3e42db9ca4 Mon Sep 17 00:00:00 2001
From: Shtorm <108103062+shtorm-7@users.noreply.github.com>
Date: Fri, 4 Sep 2026 06:01:33 +0300
Subject: [PATCH] vless: fix nil pointer panic on encryption handshake failure

---
 protocol/vless/encryption/common.go | 7 +++++++
 protocol/vless/outbound.go          | 9 +++++++--
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/protocol/vless/encryption/common.go b/protocol/vless/encryption/common.go
index 84e3818d..ad2592d0 100644
--- a/protocol/vless/encryption/common.go
+++ b/protocol/vless/encryption/common.go
@@ -164,6 +164,13 @@ func (c *CommonConn) IsEncryptionLayer() bool {
 	return true
 }
 
+func (c *CommonConn) Close() error {
+	if c == nil || c.Conn == nil {
+		return nil
+	}
+	return c.Conn.Close()
+}
+
 type AEAD struct {
 	cipher.AEAD
 	Nonce [12]byte
diff --git a/protocol/vless/outbound.go b/protocol/vless/outbound.go
index 391b0213..fca1995c 100644
--- a/protocol/vless/outbound.go
+++ b/protocol/vless/outbound.go
@@ -214,10 +214,13 @@ func (h *vlessDialer) DialContext(ctx context.Context, network string, destinati
 	}
 
 	if h.encryption != nil {
-		conn, err = h.encryption.Handshake(conn)
+		var encConn net.Conn
+		encConn, err = h.encryption.Handshake(conn)
 		if err != nil {
+			common.Close(conn)
 			return nil, E.Cause(err, "encryption handshake")
 		}
+		conn = encConn
 	}
 
 	var visionBaseConn net.Conn
@@ -299,11 +302,13 @@ func (h *vlessDialer) ListenPacket(ctx context.Context, destination M.Socksaddr)
 		return nil, err
 	}
 	if h.encryption != nil {
-		conn, err = h.encryption.Handshake(conn)
+		var encConn net.Conn
+		encConn, err = h.encryption.Handshake(conn)
 		if err != nil {
 			common.Close(conn)
 			return nil, E.Cause(err, "encryption handshake")
 		}
+		conn = encConn
 	}
 	if h.xudp {
 		return h.client.DialEarlyXUDPPacketConn(conn, destination)