fix: close underlying TCP conn on stop during TLS handshake

[isaac-lee-apex]

Problem

Initiator.Stop() hangs indefinitely when a session is stuck in a TLS handshake.

This occurs when TCP connects successfully to a host that never responds to the TLS ClientHello (e.g. a plain TCP server, a misconfigured endpoint, or a firewall that accepts TCP but drops TLS). The existing stop-cancellation goroutine in handleConnection cancels the context.Context used by DialContext, but after DialContext returns successfully, the context is no longer relevant. The subsequent tls.Client(netConn, tlsConfig).Handshake() call is a plain blocking operation with no cancellation mechanism — so when stopChan closes, nothing closes the underlying net.Conn, and Handshake() blocks forever. This causes Stop() to block on wg.Wait() indefinitely.

Other disconnection scenarios (DNS failure, TCP black-hole, TLS to unreachable IP) are unaffected because Stop() can cancel the TCP dial via the context.

Fix

Track the raw TCP connection in a mutex-protected pendingConn variable during the TLS handshake window. The stop-cancellation goroutine now closes pendingConn (in addition to cancelling the dial context) when a stop signal is received. Closing the underlying net.Conn immediately unblocks Handshake() with a "use of closed network connection" error, allowing handleConnection to proceed to the reconnect path where it detects stopChan is closed and exits normally.

The pendingConn is set just before Handshake() and cleared immediately after (on both success and error paths), so the close only happens during the TLS handshake window.

Testing

Verified with an e2e test (TestStopDisconnectedInitiatorSession_TLSHandshakeHang) that starts a plain TCP listener, points an SSL-enabled initiator at it, waits for the TLS handshake to stall, then calls StopSession. Before this fix the test timed out after 15s; with the fix it completes in ~4s.

Amp Threads:

• https://ampcode.com/threads/T-019c4926-8512-75e5-9f4c-9c62f6b65a25