From 26f363c2a3ef23266b2a6422ed8b1380172b9f39 Mon Sep 17 00:00:00 2001
From: bytecategory <nettopology@proton.me>
Date: Tue, 18 Aug 2026 00:23:53 +0800
Subject: [PATCH] Avoid gRPC listen panic

---
 transport/internet/grpc/config_test.go | 18 ++++++++++++++++++
 transport/internet/grpc/hub.go         |  3 +++
 2 files changed, 21 insertions(+)

diff --git a/transport/internet/grpc/config_test.go b/transport/internet/grpc/config_test.go
index 04a995a433f2..3216764bc8a3 100644
--- a/transport/internet/grpc/config_test.go
+++ b/transport/internet/grpc/config_test.go
@@ -1,10 +1,14 @@
 package grpc
 
 import (
+	"context"
 	"reflect"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/xtls/xray-core/common/net"
+	"github.com/xtls/xray-core/transport/internet"
+	"github.com/xtls/xray-core/transport/internet/stat"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
 )
@@ -127,3 +131,17 @@ func TestSetUserAgent(t *testing.T) {
 	setUserAgent(conn, ua)
 	assert.Equal(t, ua, reflect.ValueOf(conn).Elem().FieldByName("dopts").FieldByName("copts").FieldByName("UserAgent").String())
 }
+
+func TestListenUnixRejectsIPAddress(t *testing.T) {
+	settings := &internet.MemoryStreamConfig{
+		ProtocolSettings: &Config{},
+	}
+
+	var listener internet.Listener
+	var err error
+	assert.NotPanics(t, func() {
+		listener, err = Listen(context.Background(), net.AnyIP, net.Port(0), settings, func(stat.Connection) {})
+	})
+	assert.Nil(t, listener)
+	assert.ErrorContains(t, err, "invalid unix listen")
+}
diff --git a/transport/internet/grpc/hub.go b/transport/internet/grpc/hub.go
index 91bd2ab60563..f89661b3b4b9 100644
--- a/transport/internet/grpc/hub.go
+++ b/transport/internet/grpc/hub.go
@@ -55,6 +55,9 @@ func Listen(ctx context.Context, address net.Address, port net.Port, settings *i
 	grpcSettings := settings.ProtocolSettings.(*Config)
 	var listener *Listener
 	if port == net.Port(0) { // unix
+		if !address.Family().IsDomain() {
+			return nil, errors.New("invalid unix listen: ", address).AtError()
+		}
 		listener = &Listener{
 			handler: handler,
 			local: &net.UnixAddr{