2 files changed, 23 insertions, 15 deletions

diff --git a/src/lib/libtls/man/tls_init.3 b/src/lib/libtls/man/tls_init.3
index 5fb9cdd802..dfafa612c1 100644
--- a/src/lib/libtls/man/tls_init.3
+++ b/src/lib/libtls/man/tls_init.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: tls_init.3,v 1.9 2018/03/07 19:07:14 deraadt Exp $
+.\" $OpenBSD: tls_init.3,v 1.10 2018/03/08 16:12:00 beck Exp $
 .\"
 .\" Copyright (c) 2014 Ted Unangst <tedu@openbsd.org>
 .\" Copyright (c) 2016 Joel Sing <jsing@openbsd.org>
@@ -16,7 +16,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: March 7 2018 $
+.Dd $Mdocdate: March 8 2018 $
 .Dt TLS_INIT 3
 .Os
 .Sh NAME
@@ -46,7 +46,7 @@ The
 .Fn tls_init
 function initializes global data structures.
 It should be called once before any other functions.
-It may be called more than once, but not concurrently.
+It may be called more than once, and may be called concurrently.
 .Pp
 Before a connection is created, a configuration must be created.
 The
diff --git a/src/lib/libtls/tls.c b/src/lib/libtls/tls.c
index c0430d7cd1..e7a485bcec 100644
--- a/src/lib/libtls/tls.c
+++ b/src/lib/libtls/tls.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls.c,v 1.77 2018/03/07 19:07:13 deraadt Exp $ */
+/* $OpenBSD: tls.c,v 1.78 2018/03/08 16:12:00 beck Exp $ */
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  *
@@ -19,6 +19,7 @@
 
 #include <errno.h>
 #include <limits.h>
+#include <pthread.h>
 #include <stdlib.h>
 #include <unistd.h>
 
@@ -35,28 +36,35 @@
 
 static struct tls_config *tls_config_default;
 
-int
-tls_init(void)
-{
-        static int tls_initialised = 0;
-
-        if (tls_initialised)
-                return (0);
+static int tls_init_rv = -1;
 
+static void
+tls_do_init(void)
+{
         SSL_load_error_strings();
         SSL_library_init();
 
         if (BIO_sock_init() != 1)
-                return (-1);
+                return;
 
         if ((tls_config_default = tls_config_new()) == NULL)
-                return (-1);
+                return;
 
         tls_config_default->refcount++;
 
-        tls_initialised = 1;
+        tls_init_rv = 0;
+        return;
+}
 
-        return (0);
+int
+tls_init(void)
+{
+        static pthread_once_t once = PTHREAD_ONCE_INIT;
+
+        if (pthread_once(&once, tls_do_init) != 0)
+                return -1;
+
+        return tls_init_rv;
 }
 
 const char *