@@ -2073,6 +2073,15 @@ sanitize_control_message(const char *src, struct gc_arena *gc)

 	  skip = 4;

 	  redact = true;

 	}

+      else if (!check_debug_level(D_SHOW_KEYS)

+               && (c == 'a' && !strncmp(src, "auth-token ", 11)))

+	{

+          /* Unless --verb is 7 or higher (D_SHOW_KEYS), hide

+           * the auth-token value coming in the src string

+           */

+	  skip = 10;

+	  redact = true;

+	}

       if (c == ',') /* end of redacted item? */

 	{

@@ -309,7 +309,7 @@ prepare_push_reply (struct context *c, struct gc_arena *gc,

 		    struct push_list *push_list)

 {

   const char *optstr = NULL;

-  const struct tls_multi *tls_multi = c->c2.tls_multi;

+  struct tls_multi *tls_multi = c->c2.tls_multi;

   const char * const peer_info = tls_multi->peer_info;

   struct options *o = &c->options;

@@ -371,6 +371,16 @@ prepare_push_reply (struct context *c, struct gc_arena *gc,

 	  push_option_fmt(gc, push_list, M_USAGE, "cipher %s", o->ciphername);

 	}

     }

+

+  /* If server uses --auth-gen-token and we have an auth token

+   * to send to the client

+   */

+  if (false == tls_multi->auth_token_sent && NULL != tls_multi->auth_token)

+    {

+      push_option_fmt(gc, push_list, M_USAGE,

+                      "auth-token %s", tls_multi->auth_token);

+      tls_multi->auth_token_sent = true;

+    }

   return true;

 }

@@ -533,6 +533,8 @@ struct tls_multi

                           *   user/pass authentications in this session.

                           */

   time_t auth_token_tstamp; /**< timestamp of the generated token */

+  bool auth_token_sent;  /**< If server uses --auth-gen-token and

+                          *   token has been sent to client */

   /*

    * Our session objects.

    */