Use a flag to track when we need to call SSL_shutdown(). This avoids an

issue where by calling tls_close() on a TLS context that has not attempted
a handshake, results in an unexpected failure.

Reported by Vinay Sajip.

ok beck@

1 files changed, 3 insertions, 1 deletions

diff --git a/src/lib/libtls/tls_client.c b/src/lib/libtls/tls_client.c
index d22a8a95ce..a1e2caa717 100644
--- a/src/lib/libtls/tls_client.c
+++ b/src/lib/libtls/tls_client.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls_client.c,v 1.39 2017/01/12 16:15:58 jsing Exp $ */
+/* $OpenBSD: tls_client.c,v 1.40 2017/01/26 12:56:37 jsing Exp $ */
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  *
@@ -297,6 +297,8 @@ tls_handshake_client(struct tls *ctx)
                 goto err;
         }
 
+        ctx->state |= TLS_SSL_NEEDS_SHUTDOWN;
+
         ERR_clear_error();
         if ((ssl_ret = SSL_connect(ctx->ssl_conn)) != 1) {
                 rv = tls_ssl_error(ctx, ctx->ssl_conn, ssl_ret, "handshake");