Server defined reneg-sec not working

After doing a bit of testing it appears that the reneg-sec directive does not work when the server (in this testing case OpenVPN 2.4.4 and 2.4.5) is charge of the renegotiation time (pushing the config option), but does work when the client is in charge.

I was able to reproduce this on the Linux CLI, my own Android (SWIG based) implementation, and an iOS/Mac version as well.

After further testing it appears that the 2.4.4, 2.4.5 and 2.4.6 OpenVPN clients are working correctly, implying this is a bug somewhere in openvpn3.

Server in control

Steps to Reproduce:

My Server Config included:

...
reneg-sec 60
hand-window 15
tran-window 25

And then the client config has no reneg-sec directive defined.

Behaviour

1. Client will connect and have VPN connectivity for 60 seconds.
2. It will then display log messages showing the "Tunnel Options" log messages as it renegotiates.
3. The renegotiation seemingly doesn't work, as 25 seconds later VPN internet connectivity ceases, with no event or log messages occurring into the console.
4. Even though the tunnel connectivity is dead, the "Tunnel Options" log message keep occurring at 60 second intervals.

Client in control

Steps to Reproduce:

Server Config should include a reneg-sec value of 0, or a value higher than the client. I also left the hand-window and tran-window directives out (i.e. default settings).

On the client, I used a value of 60 with reneg-sec.

Behaviour

1. Client will connect and have VPN connectivity for as long as I tested for under these conditions (about 20 minutes)
2. It will then display log messages showing the "Tunnel Options" log messages as it renegotiates at each of the 60 second intervals.

Start by reproducing the server-controlled case with OpenVPN 2.4.4 or 2.4.5, using reneg-sec 60, hand-window 15, and tran-window 25, then compare it with the client-controlled case. Trace the renegotiation handling after the Tunnel Options messages and verify that connectivity continues after the 25-second transition window. There are no files or tests identified in the issue, so the relevant implementation and regression coverage must first be located.