fix: close connection when dial setup fails to avoid a file descriptor leak

conn.go

@@ -22,11 +22,8 @@ import (
 	"github.com/ClickHouse/clickhouse-go/v2/lib/proto"
 )
 
-func dial(ctx context.Context, addr string, num int, opt *Options) (*connect, error) {
-	var (
-		err  error
-		conn net.Conn
-	)
+func dial(ctx context.Context, addr string, num int, opt *Options) (c *connect, err error) {
+	var conn net.Conn
 
 	switch {
 	case opt.DialContext != nil:
@@ -44,6 +41,15 @@ func dial(ctx context.Context, addr string, num int, opt *Options) (*connect, er
 		return nil, err
 	}
 
+	// Close the freshly dialed connection if any later setup step (compression,
+	// JWT, handshake, addendum) fails, otherwise the socket and its fd leak on
+	// every failed connection attempt.
+	defer func() {
+		if err != nil {
+			_ = conn.Close()
+		}
+	}()
+
 	// Get base logger and enrich with connection-specific context
 	baseLogger := opt.logger()
 	logger := prepareConnLogger(baseLogger, num, conn.RemoteAddr().String(), "native")

conn_fd_leak_test.go

@@ -0,0 +1,42 @@
+package clickhouse
+
+import (
+	"context"
+	"net"
+	"sync/atomic"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type closeTrackingConn struct {
+	net.Conn
+	closed *atomic.Bool
+}
+
+func (c *closeTrackingConn) Close() error {
+	c.closed.Store(true)
+
+	return c.Conn.Close()
+}
+
+// TestDialClosesConnectionOnSetupFailure ensures dial does not leak the underlying
+// socket (and its file descriptor) when a post-dial setup step fails. The server
+// side of the pipe is closed up front so the handshake fails.
+func TestDialClosesConnectionOnSetupFailure(t *testing.T) {
+	client, server := net.Pipe()
+	require.NoError(t, server.Close())
+
+	var closed atomic.Bool
+	tracked := &closeTrackingConn{Conn: client, closed: &closed}
+
+	_, err := dial(context.Background(), "127.0.0.1:9000", 1, &Options{
+		DialContext: func(_ context.Context, _ string) (net.Conn, error) {
+			return tracked, nil
+		},
+	})
+
+	require.Error(t, err)
+	assert.True(t, closed.Load(), "dial must close the connection when a post-dial setup step fails")
+}