From: Arne Schwabe <arne@rfc2549.org>
Date: Mon, 5 Apr 2021 22:05:21 +0000 (+0200)
Subject: Ensure key state is authenticated before sending push reply
X-Git-Tag: v2.4.11~1
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0e5516a9d656ce86f7fb370c824344ea1760c255;p=thirdparty%2Fopenvpn.git

Ensure key state is authenticated before sending push reply

This ensures that the key state is authenticated when sending
a push reply.
---

diff --git a/src/openvpn/push.c b/src/openvpn/push.c
index 002be2332..52c6e8200 100644
--- a/src/openvpn/push.c
+++ b/src/openvpn/push.c
@@ -652,6 +652,7 @@ int
 process_incoming_push_request(struct context *c)
 {
     int ret = PUSH_MSG_ERROR;
+    struct key_state *ks = &c->c2.tls_multi->session[TM_ACTIVE].key[KS_PRIMARY];
 
 #ifdef ENABLE_ASYNC_PUSH
     c->c2.push_request_received = true;
@@ -662,7 +663,12 @@ process_incoming_push_request(struct context *c)
         send_auth_failed(c, client_reason);
         ret = PUSH_MSG_AUTH_FAILURE;
     }
-    else if (!c->c2.push_reply_deferred && c->c2.context_auth == CAS_SUCCEEDED)
+    else if (!c->c2.push_reply_deferred && c->c2.context_auth == CAS_SUCCEEDED
+             && ks->authenticated
+ #ifdef ENABLE_DEF_AUTH
+             && !ks->auth_deferred
+ #endif
+             )
     {
         time_t now;