Synchronize connection-owned stream access

gumble/gumble/client.go

@@ -116,10 +116,28 @@ func DialWithDialer(dialer *net.Dialer, config *Config, tlsConfig *tls.Config) (
 	}
 	start := time.Now()
 
-	conn, err := tls.DialWithDialer(dialer, "tcp", config.Address, tlsConfig)
+	rawConn, err := dialer.Dial("tcp", config.Address)
 	if err != nil {
 		return nil, err
 	}
+	conn := tls.Client(rawConn, tlsConfig)
+	// net.Dialer.Timeout covers only the TCP dial. Apply the same bounded
+	// deadline to TLS negotiation so a peer that accepts but never responds
+	// cannot block startup indefinitely.
+	if dialer.Timeout > 0 {
+		if err := conn.SetDeadline(start.Add(dialer.Timeout)); err != nil {
+			rawConn.Close()
+			return nil, err
+		}
+	}
+	if err := conn.Handshake(); err != nil {
+		rawConn.Close()
+		return nil, err
+	}
+	if err := conn.SetDeadline(time.Time{}); err != nil {
+		rawConn.Close()
+		return nil, err
+	}
 
 	client := &Client{
 		Conn:           NewConn(conn),