From: Arne Schwabe Date: Tue, 15 Nov 2022 12:29:40 +0000 (+0100) Subject: Fix logic error in checking early negotiation support check X-Git-Tag: v2.6_beta1~19 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=543f709f13bca9887cabd4545554539f18346e3c;p=thirdparty%2Fopenvpn.git Fix logic error in checking early negotiation support check We want to check if EARLY_NEG_START is set and reserve the other bits for future expansions. Right now we also check if all reserved bits are zero. oops. Signed-off-by: Arne Schwabe Acked-by: Gert Doering Message-Id: <20221115122940.1947284-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25519.html Signed-off-by: Gert Doering --- diff --git a/src/openvpn/mudp.c b/src/openvpn/mudp.c index 7c6fc816e..bdf35a8ba 100644 --- a/src/openvpn/mudp.c +++ b/src/openvpn/mudp.c @@ -92,7 +92,7 @@ do_pre_decrypt_check(struct multi_context *m, ASSERT(packet_id_read(&pin, &tmp, true)); /* The most significant byte is 0x0f if early negotiation is supported */ - bool early_neg_support = (pin.id & EARLY_NEG_MASK) == EARLY_NEG_START; + bool early_neg_support = ((pin.id & EARLY_NEG_MASK) & EARLY_NEG_START) == EARLY_NEG_START; /* All clients that support early negotiation and tls-crypt are assumed * to also support resending the WKc in the 2nd packet */