tls: fix various tlsClient()/tlsServer() related bugs

- TLSconn structure on stack but not initialized (zeroed)
- original filedescriptor double closed in error case
- original filedescriptor leaked in success case
- leaked TLSconn.sessionID and TLSconn.cert
- clarify in pushtls(2) and pushssl(2)

2 files changed, 10 insertions, 8 deletions

diff --git a/sys/src/cmd/vnc/vncs.c b/sys/src/cmd/vnc/vncs.c
index ee36d0c7b..f191db7e2 100644
--- a/sys/src/cmd/vnc/vncs.c
+++ b/sys/src/cmd/vnc/vncs.c
@@ -152,7 +152,7 @@ main(int argc, char **argv)
 		exits(nil);
 	}
 
-	if(altnet && !cert)
+	if(altnet && cert == nil)
 		sysfatal("announcing on alternate network requires TLS (-c)");
 
 	if(argc == 0)
@@ -524,7 +524,6 @@ vncaccept(Vncs *v)
 {
 	char buf[32];
 	int fd;
-	TLSconn conn;
 
 	/* caller returns to listen */
 	switch(rfork(RFPROC|RFMEM|RFNAMEG)){
@@ -546,6 +545,8 @@ vncaccept(Vncs *v)
 	}
 
 	if(cert != nil){
+		TLSconn conn;
+
 		memset(&conn, 0, sizeof conn);
 		conn.cert = readcert(cert, &conn.certlen);
 		if(conn.cert == nil){
@@ -556,11 +557,9 @@ vncaccept(Vncs *v)
 		if(fd < 0){
 			fprint(2, "%V: tlsServer: %r; hanging up\n", v);
 			free(conn.cert);
-			if(conn.sessionID)
-				free(conn.sessionID);
+			free(conn.sessionID);
 			exits(nil);
 		}
-		close(v->datafd);
 		v->datafd = fd;
 		free(conn.cert);
 		free(conn.sessionID);
diff --git a/sys/src/cmd/vnc/vncv.c b/sys/src/cmd/vnc/vncv.c
index 8d44813c9..49203b04b 100644
--- a/sys/src/cmd/vnc/vncv.c
+++ b/sys/src/cmd/vnc/vncv.c
@@ -84,7 +84,6 @@ main(int argc, char **argv)
 	int p, dfd, cfd, shared;
 	char *keypattern, *addr, *label;
 	Point d;
-	TLSconn conn;
 
 	keypattern = nil;
 	shared = 0;
@@ -123,10 +122,14 @@ main(int argc, char **argv)
 	if(dfd < 0)
 		sysfatal("cannot dial %s: %r", addr);
 	if(tls){
-		dfd = tlsClient(dfd, &conn);
-		if(dfd < 0)
+		TLSconn conn;
+
+		memset(&conn, 0, sizeof(conn));
+		if((dfd = tlsClient(dfd, &conn)) < 0)
 			sysfatal("tlsClient: %r");
 		/* XXX check thumbprint */
+		free(conn.cert);
+		free(conn.sessionID);
 	}
 	vnc = vncinit(dfd, cfd, nil);