From 4ba1066299010370d677ad5fc19fd5bf846a2114 Mon Sep 17 00:00:00 2001
From: Zsolt Parragi <zsolt.parragi@percona.com>
Date: Wed, 1 Jul 2026 13:45:18 +0100
Subject: [PATCH 1/2] PG-2513: Make client connected flag atomic

This fixes a possible race as it can be used by multiple threads, e.g.

Also clean up the order of pointer cleanup and connected flag unset. The
client code is still thread unsafe even with this change, but it at
least makes the connected handling more consistent.
---
 kmipclient/include/kmipclient/NetClient.hpp | 5 +++--
 kmipclient/src/NetClientOpenSSL.cpp         | 4 ++--
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/kmipclient/include/kmipclient/NetClient.hpp b/kmipclient/include/kmipclient/NetClient.hpp
index 40e3da2..e0edf8c 100644
--- a/kmipclient/include/kmipclient/NetClient.hpp
+++ b/kmipclient/include/kmipclient/NetClient.hpp
@@ -8,6 +8,7 @@
 #ifndef KMIP_NET_CLIENT_HPP
 #define KMIP_NET_CLIENT_HPP
 
+#include <atomic>
 #include <cstdint>
 #include <span>
 #include <string>
@@ -99,7 +100,7 @@ namespace kmipclient {
      * @brief Checks whether a connection is currently established.
      * @return true when connected, false otherwise.
      */
-    [[nodiscard]] bool is_connected() const { return m_isConnected; }
+    [[nodiscard]] bool is_connected() const noexcept { return m_isConnected; }
     /**
      * @brief Sends bytes over the established connection.
      * @param data Source buffer.
@@ -122,7 +123,7 @@ namespace kmipclient {
     std::string m_serverCaCertificateFn;
     int m_timeout_ms;
     TlsVerificationOptions m_tls_verification{};
-    bool m_isConnected = false;
+    std::atomic<bool> m_isConnected{false};
   };
 }  // namespace kmipclient
 #endif  // KMIP_NET_CLIENT_HPP
diff --git a/kmipclient/src/NetClientOpenSSL.cpp b/kmipclient/src/NetClientOpenSSL.cpp
index c269efb..28858d6 100644
--- a/kmipclient/src/NetClientOpenSSL.cpp
+++ b/kmipclient/src/NetClientOpenSSL.cpp
@@ -331,13 +331,13 @@ namespace kmipclient {
 
   NetClientOpenSSL::~NetClientOpenSSL() {
     // Avoid calling virtual methods from destructor.
+    m_isConnected = false;
     if (bio_) {
       bio_.reset();
     }
     if (ctx_) {
       ctx_.reset();
     }
-    m_isConnected = false;
   }
 
   bool NetClientOpenSSL::connect() {
@@ -477,6 +477,7 @@ namespace kmipclient {
   }
 
   void NetClientOpenSSL::close() {
+    m_isConnected = false;
     if (bio_) {
       // BIO_free_all is called by unique_ptr reset
       bio_.reset();
@@ -484,7 +485,6 @@ namespace kmipclient {
     if (ctx_) {
       ctx_.reset();
     }
-    m_isConnected = false;
   }
 
   int NetClientOpenSSL::send(std::span<const std::uint8_t> data) {

From ffd90bd9e38ad5dc23b6460ccfb4dde10d271b41 Mon Sep 17 00:00:00 2001
From: Zsolt Parragi <zsolt.parragi@percona.com>
Date: Wed, 1 Jul 2026 14:11:02 +0100
Subject: [PATCH 2/2] Simplify the client destructor/close call a bit

It had an overly defensive LLM style, when in reality it could be much
simpler.
---
 kmipclient/src/NetClientOpenSSL.cpp | 18 +++---------------
 1 file changed, 3 insertions(+), 15 deletions(-)

diff --git a/kmipclient/src/NetClientOpenSSL.cpp b/kmipclient/src/NetClientOpenSSL.cpp
index 28858d6..34ef2bf 100644
--- a/kmipclient/src/NetClientOpenSSL.cpp
+++ b/kmipclient/src/NetClientOpenSSL.cpp
@@ -330,14 +330,7 @@ namespace kmipclient {
   }
 
   NetClientOpenSSL::~NetClientOpenSSL() {
-    // Avoid calling virtual methods from destructor.
-    m_isConnected = false;
-    if (bio_) {
-      bio_.reset();
-    }
-    if (ctx_) {
-      ctx_.reset();
-    }
+    close();
   }
 
   bool NetClientOpenSSL::connect() {
@@ -478,13 +471,8 @@ namespace kmipclient {
 
   void NetClientOpenSSL::close() {
     m_isConnected = false;
-    if (bio_) {
-      // BIO_free_all is called by unique_ptr reset
-      bio_.reset();
-    }
-    if (ctx_) {
-      ctx_.reset();
-    }
+    bio_.reset();
+    ctx_.reset();
   }
 
   int NetClientOpenSSL::send(std::span<const std::uint8_t> data) {