Split the persistent/configuration flags from temporary state flags and

ensure that the temporary state flags get cleared in tls_reset(). Fixes a
bug spotted by Marko Kreen whereby TLS_CONNECTING could remain on reset.

While here, also move the TLS_STATE_CONNECTING check to after the
TLS_CLIENT check - if TLS_STATE_CONNECTING was ever set on any other
context type it would allow a bypass.

ok bluhm@

1 files changed, 7 insertions, 7 deletions

diff --git a/src/lib/libtls/tls_client.c b/src/lib/libtls/tls_client.c
index 442ba4321e..241c506676 100644
--- a/src/lib/libtls/tls_client.c
+++ b/src/lib/libtls/tls_client.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls_client.c,v 1.19 2015/08/22 14:51:34 jsing Exp $ */
+/* $OpenBSD: tls_client.c,v 1.20 2015/08/27 14:34:46 jsing Exp $ */
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  *
@@ -168,14 +168,14 @@ tls_connect_fds(struct tls *ctx, int fd_read, int fd_write,
         X509 *cert = NULL;
         int ret, err;
 
-        if (ctx->flags & TLS_CONNECTING)
-                goto connecting;
-
         if ((ctx->flags & TLS_CLIENT) == 0) {
                 tls_set_error(ctx, "not a client context");
                 goto err;
         }
 
+        if (ctx->state & TLS_STATE_CONNECTING)
+                goto connecting;
+
         if (fd_read < 0 || fd_write < 0) {
                 tls_set_error(ctx, "invalid file descriptors");
                 return (-1);
@@ -248,16 +248,16 @@ tls_connect_fds(struct tls *ctx, int fd_read, int fd_write,
                 }
         }
 
- connecting:
+connecting:
         if ((ret = SSL_connect(ctx->ssl_conn)) != 1) {
                 err = tls_ssl_error(ctx, ctx->ssl_conn, ret, "connect");
                 if (err == TLS_READ_AGAIN || err == TLS_WRITE_AGAIN) {
-                        ctx->flags |= TLS_CONNECTING;
+                        ctx->state |= TLS_STATE_CONNECTING;
                         return (err);
                 }
                 goto err;
         }
-        ctx->flags &= ~TLS_CONNECTING;
+        ctx->state &= ~TLS_STATE_CONNECTING;
 
         if (ctx->config->verify_name) {
                 cert = SSL_get_peer_certificate(ctx->ssl_conn);