From 52e0c00cd80a435424812ba1e7253086385328c3 Mon Sep 17 00:00:00 2001
From: tke <tobias.kessels@certbw.de>
Date: Wed, 1 Jul 2026 09:37:41 +0200
Subject: [PATCH] fix(proxy): handle blocked CONNECT resets

---
 scripts/proxy/bridge.js | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/scripts/proxy/bridge.js b/scripts/proxy/bridge.js
index 98f14aa..71e6374 100644
--- a/scripts/proxy/bridge.js
+++ b/scripts/proxy/bridge.js
@@ -329,6 +329,11 @@ function createBridge(port, profileName) {
         const portNum = Number(portStr || 443);
         const { config: upstreamConfig, overrideProfile } = getUpstream(profileName, `https://${req.url}/`, host);
         const upstream = parseProxyConfig(upstreamConfig);
+        let upstreamSocket;
+
+        clientSocket.on('error', () => {
+            if (upstreamSocket) upstreamSocket.destroy();
+        });
 
         log('INFO', id, 'connect', { port, profile: profileName, override: overrideProfile, target: req.url, upstream: upstreamConfig });
 
@@ -336,7 +341,7 @@ function createBridge(port, profileName) {
             return clientSocket.end('HTTP/1.1 403 Forbidden\r\n\r\n');
         }
 
-        const upstreamSocket = net.connect(upstream.type === 'PROXY' ? upstream.port : portNum, upstream.type === 'PROXY' ? upstream.host : host, () => {
+        upstreamSocket = net.connect(upstream.type === 'PROXY' ? upstream.port : portNum, upstream.type === 'PROXY' ? upstream.host : host, () => {
             if (upstream.type === 'PROXY') {
                 if (!AUTH_HEADER) refreshAuth();
                 upstreamSocket.write(`CONNECT ${req.url} HTTP/1.1\r\nHost: ${req.url}\r\n`);
@@ -379,7 +384,6 @@ function createBridge(port, profileName) {
             });
         }
         upstreamSocket.on('error', () => clientSocket.end('HTTP/1.1 502 Bad Gateway\r\n\r\n'));
-        clientSocket.on('error', () => upstreamSocket.end());
     });
 
     server.listen(port, LISTEN_HOST, () => {