diff options
| author |   jsing <jsing@openbsd.org> | 2015-08-27 14:34:46 +0000 |
|---|---|---|
| committer | jsing <jsing@openbsd.org> | 2015-08-27 14:34:46 +0000 |
| commit | 93310cfa04ecb20aee67669b31aaf7bb7c7ae493 (patch) | |
| tree | aae8a4731a3a658c34348cac094b612b2f8caa7b /lib/libtls/tls_client.c | |
| parent | Change AEAD out_len argument to size_t instead of ssize_t - while here, (diff) | |
| download | wireguard-openbsd-93310cfa04ecb20aee67669b31aaf7bb7c7ae493.tar.xz wireguard-openbsd-93310cfa04ecb20aee67669b31aaf7bb7c7ae493.zip | |
Split the persistent/configuration flags from temporary state flags and
ensure that the temporary state flags get cleared in tls_reset(). Fixes a
bug spotted by Marko Kreen whereby TLS_CONNECTING could remain on reset.
While here, also move the TLS_STATE_CONNECTING check to after the
TLS_CLIENT check - if TLS_STATE_CONNECTING was ever set on any other
context type it would allow a bypass.
ok bluhm@
Diffstat (limited to 'lib/libtls/tls_client.c')
| -rw-r--r-- | lib/libtls/tls_client.c | 14 |
1 files changed, 7 insertions, 7 deletions
diff --git a/lib/libtls/tls_client.c b/lib/libtls/tls_client.c index 442ba4321ef..241c506676e 100644 --- a/lib/libtls/tls_client.c +++ b/lib/libtls/tls_client.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tls_client.c,v 1.19 2015/08/22 14:51:34 jsing Exp $ */ +/* $OpenBSD: tls_client.c,v 1.20 2015/08/27 14:34:46 jsing Exp $ */ /* * Copyright (c) 2014 Joel Sing <jsing@openbsd.org> * @@ -168,14 +168,14 @@ tls_connect_fds(struct tls *ctx, int fd_read, int fd_write, X509 *cert = NULL; int ret, err; - if (ctx->flags & TLS_CONNECTING) - goto connecting; - if ((ctx->flags & TLS_CLIENT) == 0) { tls_set_error(ctx, "not a client context"); goto err; } + if (ctx->state & TLS_STATE_CONNECTING) + goto connecting; + if (fd_read < 0 || fd_write < 0) { tls_set_error(ctx, "invalid file descriptors"); return (-1); @@ -248,16 +248,16 @@ tls_connect_fds(struct tls *ctx, int fd_read, int fd_write, } } - connecting: +connecting: if ((ret = SSL_connect(ctx->ssl_conn)) != 1) { err = tls_ssl_error(ctx, ctx->ssl_conn, ret, "connect"); if (err == TLS_READ_AGAIN || err == TLS_WRITE_AGAIN) { - ctx->flags |= TLS_CONNECTING; + ctx->state |= TLS_STATE_CONNECTING; return (err); } goto err; } - ctx->flags &= ~TLS_CONNECTING; + ctx->state &= ~TLS_STATE_CONNECTING; if (ctx->config->verify_name) { cert = SSL_get_peer_certificate(ctx->ssl_conn); |