Internal change

PiperOrigin-RevId: 477302086
Change-Id: Ib268dfbcfb9b4fc229a18dad3fb9633cb6c2642a

patches/remove_session_opt_pull_check.patch

diff --git a/patches/remove_session_opt_pull_check.patch b/patches/remove_session_opt_pull_check.patch
new file mode 100644
index 0000000..8e4d3b6
--- /dev/null
+++ b/patches/remove_session_opt_pull_check.patch
@@ -0,0 +1,30 @@
+--- a/src/openvpn/ssl.c
++++ b/src/openvpn/ssl.c
+@@ -2386,20 +2386,15 @@ key_method_2_write(struct buffer *buf, s
+         {
+             goto error;
+         }
+-        /* if auth-nocache was specified, the auth_user_pass object reaches
+-         * a "complete" state only after having received the push-reply
+-         * message. The push message might contain an auth-token that needs
+-         * the username of auth_user_pass.
++        /* purge username/password after writing them to the buffer for
++         * authentication.
+          *
+-         * For this reason, skip the purge operation here if no push-reply
+-         * message has been received yet.
+-         *
+-         * This normally happens upon first negotiation only.
++         * We don't wait for the server push-reply message, which might contain
++         * an auth-token that needs the username of auth_user_pass. It means
++         * auth-token may not work properly if username and password are purged
++         * too early.
+          */
+-        if (!session->opt->pull)
+-        {
+-            purge_user_pass(&auth_user_pass, false);
+-        }
++        purge_user_pass(&auth_user_pass, false);
+     }
+     else
+     {

patches/series

diff --git a/patches/series b/patches/series
index c79e662..16c07cc 100644
--- a/patches/series
+++ b/patches/series
@@ -2,3 +2,4 @@
 add_missing_licenses.patch
 fix_long_password.patch
 cleanup_makefiles.patch
+remove_session_opt_pull_check.patch

src/openvpn/ssl.c

diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c
index 841a649..94ab142 100644
--- a/src/openvpn/ssl.c
+++ b/src/openvpn/ssl.c
@@ -2386,20 +2386,15 @@
         {
             goto error;
         }
-        /* if auth-nocache was specified, the auth_user_pass object reaches
-         * a "complete" state only after having received the push-reply
-         * message. The push message might contain an auth-token that needs
-         * the username of auth_user_pass.
+        /* purge username/password after writing them to the buffer for
+         * authentication.
          *
-         * For this reason, skip the purge operation here if no push-reply
-         * message has been received yet.
-         *
-         * This normally happens upon first negotiation only.
+         * We don't wait for the server push-reply message, which might contain
+         * an auth-token that needs the username of auth_user_pass. It means
+         * auth-token may not work properly if username and password are purged
+         * too early.
          */
-        if (!session->opt->pull)
-        {
-            purge_user_pass(&auth_user_pass, false);
-        }
+        purge_user_pass(&auth_user_pass, false);
     }
     else
     {