@@ -187,6 +187,7 @@ func NewConn(options *Options) (*Conn, error) {
187187logIPs ,_ := logIPSet .IPSet ()
188188wireguardEngine .SetFilter (filter .New (netMap .PacketFilter ,localIPs ,logIPs ,nil ,Logger (options .Logger .Named ("packet-filter" ))))
189189server := & Conn {
190+ closed :make (chan struct {}),
190191logger :options .Logger ,
191192magicConn :magicConn ,
192193dialer :dialer ,
@@ -335,22 +336,22 @@ func (c *Conn) Ping(ip netip.Addr, pingType tailcfg.PingType, cb func(*ipnstate.
335336
336337// Closed is a channel that ends when the connection has
337338// been closed.
338- func (c * Conn )Closed ()chan <- struct {} {
339+ func (c * Conn )Closed ()<- chan struct {} {
339340return c .closed
340341}
341342
342343// Close shuts down the Wireguard connection.
343344func (c * Conn )Close ()error {
344- for _ ,l := range c .listeners {
345- _ = l .Close ()
346- }
347345c .mutex .Lock ()
348346defer c .mutex .Unlock ()
349347select {
350348case <- c .closed :
351349return nil
352350default :
353351}
352+ for _ ,l := range c .listeners {
353+ _ = l .closeNoLock ()
354+ }
354355close (c .closed )
355356_ = c .dialer .Close ()
356357_ = c .magicConn .Close ()
@@ -454,6 +455,10 @@ func (ln *listener) Addr() net.Addr { return addr{ln} }
454455func (ln * listener )Close ()error {
455456ln .s .mutex .Lock ()
456457defer ln .s .mutex .Unlock ()
458+ return ln .closeNoLock ()
459+ }
460+
461+ func (ln * listener )closeNoLock ()error {
457462if v ,ok := ln .s .listeners [ln .key ];ok && v == ln {
458463delete (ln .s .listeners ,ln .key )
459464close (ln .conn )