Ensure tls session is authenticated before sending push reply

We ensure here that the tls session is authenticated before sending
a push_reply

This the final part of the fix for CVE-2020-15078 in the master branch.

CVE: 2020-15078
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20210624130840.2583433-1-arne@rfc2549.org>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22587.html

Signed-off-by: Gert Doering <gert@greenie.muc.de>

diff --git a/src/openvpn/push.c b/src/openvpn/push.c
index f3a0054a9eee556dbd1ce75b6c6eb641129d2aec..f4957f147edb2395560580f0ed68adf7804ab89a 100644 (file)
--- a/src/openvpn/push.c
+++ b/src/openvpn/push.c
@@ -867,7 +867,8 @@ process_incoming_push_request(struct context *c)
         send_auth_failed(c, client_reason);
         ret = PUSH_MSG_AUTH_FAILURE;
     }
-    else if (c->c2.tls_multi->multi_state >= CAS_CONNECT_DONE)
+    else if (tls_authentication_status(c->c2.tls_multi) == TLS_AUTHENTICATION_SUCCEEDED
+             && c->c2.tls_multi->multi_state >= CAS_CONNECT_DONE)
     {
         time_t now;