Split the persistent/configuration flags from temporary state flags and

ensure that the temporary state flags get cleared in tls_reset(). Fixes a
bug spotted by Marko Kreen whereby TLS_CONNECTING could remain on reset.

While here, also move the TLS_STATE_CONNECTING check to after the
TLS_CLIENT check - if TLS_STATE_CONNECTING was ever set on any other
context type it would allow a bypass.

ok bluhm@

1 files changed, 5 insertions, 3 deletions

diff --git a/src/lib/libtls/tls_internal.h b/src/lib/libtls/tls_internal.h
index ba37e136e6..cf4a8e28ad 100644
--- a/src/lib/libtls/tls_internal.h
+++ b/src/lib/libtls/tls_internal.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls_internal.h,v 1.12 2015/03/31 12:21:27 jsing Exp $ */
+/* $OpenBSD: tls_internal.h,v 1.13 2015/08/27 14:34:46 jsing Exp $ */
 /*
  * Copyright (c) 2014 Jeremie Courreges-Anglas <jca@openbsd.org>
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
@@ -51,11 +51,13 @@ struct tls_config {
 #define TLS_CLIENT              (1 << 0)
 #define TLS_SERVER              (1 << 1)
 #define TLS_SERVER_CONN         (1 << 2)
-#define TLS_CONNECTING          (1 << 3)
+
+#define TLS_STATE_CONNECTING    (1 << 0)
 
 struct tls {
         struct tls_config *config;
-        uint64_t flags;
+        uint32_t flags;
+        uint32_t state;
 
         int err;
         char *errmsg;